Wikipedia:Sockpuppet investigations/D47817/Archive


D47817

D47817 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Older archives were moved to an archive of the archive because of the page size and are listed below:

14 June 2022

Suspected sockpuppets

  • Bx16 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: originally filed under this user)
  • Emenhazer (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Leadelape (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

All three accounts have made page moves to Transport for Wales and some following link updates with "Transport for Wales" in the edit summary. GeoffreyT2000 (talk) 14:53, 14 June 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • CheckUser requested and endorsed by clerk - Bx16 and Leadelape are probably  Stale. However, I'm endorsing for comparison of Emenhazer to the accounts at WP:Sockpuppet investigations/Custodi2. These accounts share an interest in Australian and UK companies (esp. transportation companies) and make prolific changes to links using similar edit summaries: [1][2][3] / [4][5][6][7]. If CU suggests that this is Custodi2, a sleeper check is in order since they had a ridiculous number of socks the last time around. Thanks, Spicy (talk) 16:15, 25 June 2022 (UTC)[reply]
  •  In progress - Girth Summit (blether) 20:02, 25 June 2022 (UTC)[reply]
  • They were not, in fact, stale. This appears to be someone who enjoys making new accounts. Sometimes they edit from them, sometimes they don't; the Custodi2 case exhibits very similar behaviour. The accounts in that case are operating out of a different range, but the behaviour in terms of account creation is very similar, and they geolocate to the same general area of a large country. The following accounts are all  Confirmed to one another:
  • All of these I will block without tags for the time being. Spicy, based on the notes I've made above, I'll leave it to your discretion on whether we merge the cases or not, and therefore how these end up getting tagged. Girth Summit (blether) 20:30, 25 June 2022 (UTC)[reply]
  • I'll add an afterthought. Bx16 and Leadelape both logged in without editing on 16 June, a couple of days after this SPI was created. They then logged back into Emenhazer and carried on editing. I suspect that the person behind these accounts was aware of the SPI, and wanted these accounts to be caught. Perhaps we should be taking a WP:DENY approach? Girth Summit (blether) 20:42, 25 June 2022 (UTC)[reply]
  • Thanks, Girth Summit. I've merged this case with Custodi2 - it's pretty clear to me that this is all the same actor. I don't know what their motivations are. However, if you'd prefer they not be tagged, I'm fine with that. If nothing else, it's less work. :) Spicy (talk) 21:33, 25 June 2022 (UTC)[reply]
    I agree with the merge. Regarding the tags, it really was a suggestion, not a preference - if you disagree, please say so. I've always observed and abided by the 'deny' notices at the top of SPI cases, but I've never put one in place, and I've never really been sure how clerks make the determination that it's time to stop tagging... Girth Summit (blether) 21:43, 25 June 2022 (UTC)[reply]
    I don't have any strong feelings one way or the other. I suspect the decision on whether or not to add that parameter to the archivenotice mostly depends on how the clerk was feeling that day. From a practical standpoint, if they're going to keep socking it may be better not to tag them since they create so many socks that non-admins will run into rate limit issues while tagging. Spicy (talk) 23:50, 25 June 2022 (UTC)[reply]

26 August 2022

Suspected sockpuppets

So--what should I say. I ran into this while checking on User:Kohlinekys, whom I have NOT yet blocked. The CU log shows that this IP has been linked to this SPI before. I took this up with the CU list, and there seems to be agreement that these are socks--though what they were up to, we don't agree. A UPE farm was suspected, and that's what I thought first too, but now I am convinced it's one person who just makes a billion accounts to do a couple of edits in a few areas. Their hobby horses are international companies, trains, infboxes, and a few others. You'll see if you check em out. There are a few more accounts and one of them, User:Padcross, goes back to 2015 and there's a few that made an edit or two in 2018 and 2019, but I need to close this up for now.

Here's the other thing. I was dumb. I should have just hardblocked the IP, but I started blocking, and once you start you gotta continue. I am still going to put a hard block on the IP, BTW; blocking the accounts is of limited use since many of em are just disposables. I cannot give you a nicely-formatted list, since my fingers are about to fall of. Do with this what you like--or, if you can format this in a semi-automated way, go for it. They're all blocked. Now take a deep breath.

Gwuthniv Holaertem Ciantocide Nuosemaisr Mokenierte Carlezeon Sophenes Kolenpowe Tuckierer Honermala Broneouiy Terinouva Maneotoun Bombawe Maremarse Monosaers Cycieneos Pensiouer Deneshore Blothbeare Kelinceen Norahense Norimaens Heneseier Qntaine Westair9 Zelegelne Marlyncie Oberonere Sojaneues Vorunmaku Kukeniner Toltsmastes Maremalae Johenjuiek Juixerine Mitelefta Kaliberen Tounaerie Hokenmaey Mounerte Poenibuze Holeinxei Norspecter Heunieet Sobaeneu Hokinesee Seatrioness Croadway Molseinjeak Kunisky Nopulease Keysandchis Colfont Hiooione Neuierene Marlofoxe Cooparuon Totourser Jeouerte Kia61ten Rotoro3 Premyers Verntomeo Bemeoryde Memfatyne Emeinerr Olitavene Marbeoinu Veco100 Honesemut Hukeimala Beuseesen Einehowen Meelieita Vaukineres Padcross Holenshier Bahuker Pharmefae Hensemaei Talkincloc Jusyerine Tygertame Trimeoplaf Vandepouer Geleieree Seesen55 Formisiute Baregeree Feuexerone Pychieu67 Tinmesgais Teakcapuno Melishmal Jaggemild Cobalterie Juinexer Hounsmal Kmatheine Holteniuer Moldmaret Vevelovi Kenopbale Moustreine Paimlaiexe Holesiene Motospue Simeopune Plongger Steindahl Maertlaie Kulseimei Rotoneirea Parinleaine Malonpore Neueforten Suerinem Mountowe Zonbusie Taeveren Blavidomai Kuunserte Prochandas Deejlines Breimmieu Vileinera Theriere Kwanqrheet Ladelelbe Cwq001 Sayyjct Comain76 Shumorant Weimerletz Worlebreist Kronestayi Lisonulere Heinciener Sobberene Laxuie22 Teuereie Holyefert Mousteraif Korotleix Motoquol Rhmainete Hohunert Neutowne Vijinloung Mareontuy Narlebeone Mareoblan Texaneasie Heuineret Voukepine Momosotea Folaur9r Homezowo Satestiue Sembertee Markeouinu Shonerirty Poemaialx Semieport Kiuantare Cotaeirine Nareomaie Nuimlinice Steinleigbe Josutaine Mopinerie Taveneree Perlioda Kohnlocater Keneseier Koseilerte Prosweien Carewenio Padeineo Doummptid Jevioleture Pofainere Cens1980 Somelouin Frenuentaj Hoseinuni Markendae Kolodisae Logynfares Hunererwu Taveoiere Kemineste Hoserere Beuterines Maermoles Korotleix Homezowo

I'll ping a few CUs who saw the thread: Risker, Ponyo, Risker, Zzuuzz, just so they know that I got on it, and that I appreciate their help. Drmies (talk) 02:37, 26 August 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

This sock has been disruptively editing for many years now. Would it be possible to revert all of the sock's edits as well? Bahnfrend (talk) 03:55, 27 August 2022 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

  • I've formatted the sock list. FWIW, I'm pretty sure that this is the same case as WP:Sockpuppet investigations/Custodi2 - same interest in trains, Australia/UK companies, link tweaks and of course the massive sockfarming. That case's archives had to be split because the number of sock templates was causing issues with transclusion limits - I'm not sure how to handle that if the cases are to be merged. Oh, and we decided not to tag these because it's simply too much work. I'll leave this open in case anyone else wants to chime in. Thanks, Spicy (talk) 03:36, 26 August 2022 (UTC)[reply]
  • Sheeeeeeit well that figures. Thanks Spicy; I appreciate your help. And I agree. I just looked at some of the Custodi2 socks, and ran one of them, and it makes sense. Also, what the fuck is wrong with them? Drmies (talk) 03:44, 26 August 2022 (UTC)[reply]
  • One more thing: after looking at the contributions by User:Kohlinekys again, I am convinced that they are our guy--anyone who looks at the edit histories of accounts used more than once will see what I mean. I blocked them, and did not tag the account. Drmies (talk) 20:37, 26 August 2022 (UTC)[reply]
  •  Nothing else to do here. Closing. --Jack Frost (talk) 04:43, 27 August 2022 (UTC)[reply]

27 September 2022

Suspected sockpuppets

These accounts are all  Confirmed to one another. They are operating out of an IP on the same range that the cases in the 26 August batch were using. Girth Summit (blether) 12:42, 27 September 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • S4hour is the oldest account of this batch; blocking all as confirmed to them, and proven to D47817, based on behavioural and technical factors. Closing. Girth Summit (blether) 12:46, 27 September 2022 (UTC)[reply]

31 December 2023

Suspected sockpuppets

Pro forma report, see below. Spicy (talk) 19:24, 31 December 2023 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • These accounts are  Confirmed to each other. Compared to previous accounts in this case, I would say they are  Possilikely (a mix between possible and likely) at best: same geolocation and ISP, but different range. However, the behaviour convinces me that these accounts belong to the same operator. The most obvious behavioural similarity is creating ridiculous numbers of socks. The accounts that have edits display similar interests and patterns of editing to previous accounts in this case, principally making page moves and unhelpful minor edits to articles involving UK/Australia transport, business and geography topics. Technical and behavioural evidence supports that WP:Sockpuppet investigations/Custodi2 is part of this case as well. Spicy (talk) 19:46, 31 December 2023 (UTC)[reply]
  • I've blocked the accounts.  Clerk assistance requested: could a clerk please dual-tag these and merge Custodi2 into this case? Thanks, Spicy (talk) 19:58, 31 December 2023 (UTC)[reply]
  • I've done the tagging for this batch (SPIhelper wouldn't let me the other day for whatever reason). Case merge still pending. Spicy (talk) 01:46, 2 January 2024 (UTC)[reply]
  • Merge done. Closing. Spicy (talk) 18:17, 21 January 2024 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/D47817/Archive&oldid=1198242492"