Wikipedia

Wikipedia:Sockpuppet investigations/Sanketio31/Archive

< Wikipedia:Sockpuppet investigations | Sanketio31


Sanketio31

06 September 2021

edit

Suspected sockpuppets

edit

Not stale:

Possibly stale:

We are filing this SPI on what appears to be 26 accounts who primarily operate at AfD. They vote in concert with each other and have similar unusual behavioral patterns both inside and outside of AfD, which we believe indicates that they are engaged in abusive socking or meatpuppetry. The behaviour is similar to the group previously reported at the SpareSeiko SPI, which was linked to AfD extortion. Some of these accounts were previously filed by Extraordinary Writ at Wikipedia:Sockpuppet investigations/JeepersClub. Extraordinary Writ's report contains very good explanations and some additional evidence that should be considered jointly with this report.

Behavioral similarities inside AfD

Some accounts are clearly copy-pasting the votes of previous AfD participants, examples below:

Copy-paste votes
  • [1] Keep as it does have some significant reliable sources coverage but the main reason is that the remains of a notable holy martyr Vladimir Bogoyavlensky have been interred here which gives the church historic significance in my view, Atlantic306 (talk)
  • Keep Passes GNG as it does have some significant reliable sources as per above. Articuno appears (talk)
  • [2]Restore redirect to Newegg per previous AfD decision: I don't see enough in the announcement press-release or available product reviews to justify a distinct article on this relaunched brand. Possibly, some mention of it should be added to the Newegg history. AllyD (talk)
  • Restore redirect to Newegg per previous AfD decision. Articuno appears (talk) 09:17, 26 April 2021 (UTC) (note same formatting)
  • [3] Delete, Fails WP:NSCHOOL and WP:NCORP, being private educational institution. Chirota (talk)
  • Delete, Fails WP:NSCHOOL and WP:NCORP as per above. Articuno appears (talk) 12:42, 22 April 2021 (UTC) (note the same odd comma and capitalization)
  • [4] Redirect, to Linacre College, fails WP:ORG and WP:GNG, a search reveals no WP:SIGCOV. SailingInABathTub (talk)
  • Redirect, to Linacre College, as per all. Articuno appears (talk) (note the unusual comma usage)
  • [5] Redirect to George Floyd Square, per WP:INDISCRIMINATE. ——Serial
  • Redirect to George Floyd Square, per WP:INDISCRIMINATE. RockOften (talk)
  • [6] Delete There is no content and no sources Applus2021 (talk)
  • Delete Fails GNG There is no content and no sources. RockOften (talk) 12:05, 26 April 2021 (UTC)
  • [7] Delete Couldn't find sufficient evidence of notability. Suonii180 (talk)
  • Delete Can't see sufficient evidence of notability for this school. RockOften (talk)
  • [8] Keep or merge to Realtek as WP:ATD. Deletion is unwarranted. ~Kvng (talk)
  • Keep or merge to Realtek as WP:ATD as per all above. RockOften (talk)
  • [9] Keep The solution to a poorly referenced article about a notable business is to improve the referencing and rewrite the article. Deletion is not the answer. Quite easily, I found this article with four paragraphs about the history of the company. Cullen328 Let's discuss it
  • Keep A notable supermarket with indepth coverage in reputable sources. As also Cullen328 pointed out The solution to a poorly referenced article about a notable business is to improve the referencing and rewrite the article. Deletion is not the answer. Has enough sources to be kept. Riteboke (talk) 14:05, 18 April 2021 (UTC)
  • [10]Keep per Vaticidalprophet's rationale. Donaldd23 (talk)
  • Keep per Vaticidalprophet's rationale. Riteboke (talk)
  • [11] Delete The sources don't satisfy WP:ORGDEPTH and WP:ORGCRIT. VV
  • Delete Sources don't satisfy WP:ORGDEPTH. Frigidpolarbear (talk)
  • [12] Keep: The Danish equivalent article seems to indicate notability - many film and tv music credits [...] PamD
  • Keep As per PamD has many film and TV music credits. Passes WP:GNG. Frigidpolarbear (talk)
  • [13] Delete complete rubbish WP:CRYSTAL unsupported by RS. Mztourist (talk)
  • Delete WP:CRYSTAL unsupported by RS as per Mztourist. Frigidpolarbear (talk)
  • See [14][15][16] for more examples of copy-pasting others' votes and forgetting to close the bold markup.
  • Additionally, accounts in this group frequently nominate an article for deletion, which is followed by other accounts voting keep on it en masse. This is reminiscent of behavior documented in the SpareSeiko SPI. Below is a table which illustrates how the accounts have voted in AfDs where they have overlapped. We have also highlighted where the accounts have explicitly voted against consensus. For brevity, "Sanketio31" will refer to all accounts:
      Nom+keep (more than one keep vote from Sanketio31
      Nom+keep (just keep vote from Sanketio31
      Voting against consensus
Table 1 (AfD overlap)
AfD Sanketio31 nomination? Result (keep/delete)[1] Sanketio31 votes Results without Sanketio31 votes Close
Wikipedia:Articles for deletion/Mel Sanson Yes 4/0 4/0 0/0 Keep
Wikipedia:Articles for deletion/Anu Singh Lather Yes 6/0 3/0 3/0 Keep
Wikipedia:Articles for deletion/Hal Lawton Yes 5/1 4/0 1/1 Keep
Wikipedia:Articles for deletion/Mark Nielsen (CEO) Yes 5/1 4/0 1/1 Keep
Wikipedia:Articles for deletion/Keyva King Yes 3/0 2/0 1/0 Keep
Wikipedia:Articles for deletion/Terminus Group Yes 4/1 3/1 1/1 Keep
WP:Articles for deletion/Kevin Boehm (2nd nomination) Yes 5/4 3/0 2/4 Keep
WP:Articles for deletion/Craig Hanna (2nd nomination) Yes 3/1 3/0 0/1 Keep
WP:Articles for deletion/Amadou Gallo Fall Yes 5/0 1/0 4/0 Keep
WP:Articles for deletion/Sarah Law Yes 5/0 1/0 4/0 Keep
WP:Articles for deletion/Quentin Cheng (2nd nomination) Yes 7/0 1/0 6/0 Keep
WP:Articles for deletion/Ryan Coe Yes 2/4 1/0 1/4 Delete
WP:Articles for deletion/Equity Mates Media Yes 4/8 1/0 3/8 Delete
WP:Articles for deletion/Mazen Khaled Yes 3/0 1/0 2/0 Keep
WP:Articles for deletion/Jason Foodman SpareSeiko 5/6 5/0 0/6 Redirect
WP:Articles for deletion/Special Strong Yes 7/6 3/0 4/6 Delete
WP:Articles for deletion/IHateJulian Yes 7/3 5/0 2/3 Keep
WP:Articles for deletion/Aftab Ahmed (cricketer, born 1931) No 5/5 2/0 3/5 Keep
WP:Articles for deletion/François Bergeron Yes 8/5 6/0 2/5 Keep
WP:Articles for deletion/Anil Acharya No 3/1 0/1 3/0 No consensus
WP:Articles for deletion/ClearTax (company) No 4/3 0/2 4/1 Delete
WP:Articles for deletion/Boyer Rocks No 4/0 2/0 2/0 Keep
WP:Articles for deletion/Wallbox (2nd nomination) No 5/0 2/0 3/0 Keep
WP:Articles for deletion/List of military disasters (4th nomination) No 9/9 1/1 8/8 No consensus
WP:Articles for deletion/Arif Saeed No 5/5/1 1/1/0 4/4/1 Delete
WP:Articles for deletion/Sonita Lontoh No 4/3 1/1 3/2 No consensus
WP:Articles for deletion/Anthony Michael Douglas Yes 0/2 0/1 0/1 Delete
Wikipedia:Articles for deletion/Harvey Neville No 2/2/5 0/0/5 2/2/0 Redirect
Wikipedia:Articles for deletion/Waleed Malik No 0/3/2 0/1/1 0/2/1 Redirect
Wikipedia:Articles for deletion/Usman Khan (cricketer, born 1985) No 0/2/2 0/1/1 0/1/1 Redirect
Wikipedia:Articles for deletion/Perl package manager No 3/0 2/0 1/0 Keep
WP:Articles for deletion/Sudhir Singh Yes 0/3 0/1 0/2 Delete
WP:Articles for deletion/URGE: Unite for Reproductive & Gender Equity No 5/0 2/0 3/0 Keep
WP:Articles for deletion/Case Notes (radio show) No 1/2/2 0/1/1 1/1/1 Redirect
WP:Articles for deletion/Anthony Michael Douglas Yes 0/2 0/1 0/1 Delete
WP:Articles for deletion/Marek Sacha No 3/3 0/1 3/2 No consensus
WP:Articles for deletion/LEAD Technologies (2nd nomination)[2] No 7/7/2 0/2/0 7/5/2 Draftify
WP:Articles for deletion/Gustavo Lopez (music executive) Yes 0/5[3] 0/2 0/3 Delete
Behavioral similarities outside of AfD
Table 2 (Repetitive gnoming methods)
Account Gnoming method Link
Articuno appears Wikilinking [33]
CeltJungleSnake HotCat, Rapid-fire copyediting [34] [35]
DmitriRomanovJr Rapid-fire copyediting [36]
Frigidpolarbear Rapid-fire copyediting [37]
GooeyMitch Rapid-fire copyediting [38]
Grandruskiy48 Rapid-fire copyediting [39]
Hypogaearoots HotCat [40]
Impeeriumalo HotCat [41]
INeedToFlyForever Rapid-fire copyediting [42]
JaredDaEconomist HotCat [43]
Jaysonsands Rapid-fire copyediting [44]
Kieem trra HotCat [45]
Namkongville Rapid-fire templateing [46]
Okaye Agongo Rapid-fire copyediting [47]
Patriot0239 Rapid-fire copyediting [48]
Peneplavím HotCat, wikilinking [49] [50]
Purosinaloense Rapid-fire copyediting [51]
Rickshaw Takahashi HotCat [52]
Riteboke Wilinking [53]
RockOften Wikilinking [54]
Sanketio31 Wikilinking [55]
Slovenichibo HotCat [56]
Tulkijasi HotCat [57]
Urartuvanking See also [58]
Zackdasnicker Rapid-fire copyediting [59]
Links between specific accounts
Table 3 (Behavioral comparison)
User Nom on Nom+Keep AFD Keep vote on Nom+Keep AFD 4 or more AFD votes in 5 minute timespan Copy-paste votes Typical vote rationale[4] Repetitive gnoming[5] Ethnic theme
Sanketio31 [60][6] N [61] [62] [63] [64] N
Articuno appears [65] [66] [67] [68][7] [69] [70] [71] N
CeltJungleSnake [72][73][74] [75] [76] [77][78] [79] [80] N
DmitriRomanovJr N [81] [82] [83][84] [85] [86] Y
Frigidpolarbear N [87] [88] [89][90][91] [92] [93] N
GooeyMitch N [94] [95] [96] [97] [98] N
Grandruskiy48 N [99] [100] [101] [102] [103] Y
Hypogaearoots N [104] [105] [106] [107] [108] Y
Impeeriumalo [109][110] N N N N [111] N
INeedToFlyForever N N [112] [113] N [114] N
JaredDaEconomist N [115] [116] N [117] [118] N
Jaysonsands N [119] [120] [121] [122] [123] N
Kieem trra [124][125] [126] [127] N [128] [129] N
Namkongville N [130] [131] [132][7][133] [134] [135] Y
Okaye Agongo [136] [137] [138] [139][140] N [141] Y
Patriot0239 [142][143] N [144] [145] [146] [147] Y
Peneplavím N [148] [149] [150][151] [152] [153] N
Purosinaloense [154] [155] [156] N [157] [158] Y
Rickshaw Takahashi N [159] [160] [161] [162] [163] Y
Riteboke N [164] [165] [166][167] N? [168] N
RockOften N [169] [170] [171][172] [173] [174] N
Slovenichibo N [175] N[8] [176] [177] [178] Y
Tulkijasi [179][180] N [181] N [182] [183] N
Urartuvanking [184] N N N N [185] Y
Zackdasnicker N [186] [187] [188][189] [190] [191] N

For the AfD vote criteria, note that some accounts focus on nominating articles for deletion (which are then voted on by other members of the group), and do not vote on AfDs themselves.

  1. ^ A third number indicates the total number of redirect votes
  2. ^ 3rd number here indicates draftify votes
  3. ^ It was originally 4/2 (both Sanketio31 accounts voting keep), but after MER-C voted delete with a valid rational, one (unrelated) account was indeffed and the others switched from keep to delete.
  4. ^ Diffs for votes containing the phrase "as per [x]", which is frequently used across the accounts.
  5. ^ Refer to Table 2 for the type of gnoming each account engages in ‒ the diffs here are a copy of the ones there.
  6. ^ Other listed accounts struck their keep votes after Viewhexes was blocked as a sock.
  7. ^ a b This could be an ordinary vote but it is likely copy-paste due to the unusual comma placement.
  8. ^ Close to 4 per 5 minutes, but not reaching that speed.

Thanks,

--Giraffer (talk·contribs) 18:48, 6 September 2021 (UTC)[reply]

--Blablubbs (talk) 18:54, 6 September 2021 (UTC)[reply]

--MarioGom (talk) 18:57, 6 September 2021 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • Hi, I never created any page against the admin's permission. I earlier voted keep but as soon as admin MER-C and Onel5969 TT me voted delete because of creator's sockpuppetry. I immediately changed my vote to delete as soon as I knew that. I like music and creating music pages that's why I was given permission to recreate the page that's only why I recreated it. I never broke any rules and never gone against the admin's decision. I have done more than 5000+ edits and I never created any other account I swear. I only have this one account which I use to edit music-related pages. Please make my name out of this list because I am wrongly accused here. Riteboke (talk) 15:23, 7 September 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit
  • I'm too involved in the filing to clerk this myself. I will say that even if there were to be a negative CU-result for some or all of these accounts, there is clearly coordinated behaviour going on here. Also ping Drmies who asked me to keep him in the loop a while back and MER-C, who might also be interested in this. Thanks in advance to whoever takes on this case. --Blablubbs (talk) 19:06, 6 September 2021 (UTC)[reply]
  • I had suspected something was fishy was going on here having seen a group of 300-1000 edit accounts popping up on AFD but could not find any smoking gun to block. Riteboke recreated Gustavo Lopez (music executive) after Wikipedia:Articles for deletion/Gustavo Lopez (music executive). Sanketio has a very strong red flag too (not saying it on-wiki). Slovenichibo appears to be a Wikipedia:Sockpuppet investigations/Japanelemu (i.e. Wiki-PR) grade username and dates back to that era. I will not be surprised if there is more. MER-C 19:35, 6 September 2021 (UTC)[reply]
    • I will also not be surprised to learn that CU turns up nothing because the level of sophistication is such that evading Wikimedia's pathetic anti-abuse tools would be something they can do in their sleep. Nonetheless, this should be escalated to T&S. MER-C 17:18, 7 September 2021 (UTC)[reply]
  •     CheckUser requested and endorsed by clerk - I have been aware of Blablubbs & co.'s work on this investigation for some time, but I have not been directly involved and consider myself sufficiently neutral to endorse. I know this is a really big filing and there's a lot of evidence and names, but I believe that the overlap is solid and that there is credible evidence of abuse here. As with SpareSeiko, this looks a lot like AfD-related extortion (nominate article for deletion, get paid by subject, brigade the AfD with keep votes after payment), which is so abhorrent that I'm almost lost for words. GeneralNotability (talk) 13:24, 7 September 2021 (UTC)[reply]
    As an aside: it is absolutely possible that there are individual accounts in this group who match the rest of the group due to coincidental overlap; that's part of why CU is needed here. However, there is enough overlap in everyone here that this is not a fishing expedition - every account I've looked at in this list has some kind of credible connection to the rest of the group that is hard to explain by mere happenstance. GeneralNotability (talk) 19:38, 7 September 2021 (UTC)[reply]
  •   Checkuser note: I've ran checks on all the accounts. Given both technical and behavioral evidence, I believe that it is more likely than not that either one individual, or a closely connected group of individuals, is operating all of these accounts. I'd rather not elaborate more in public for reasons, but I welcome anyone interested to email me. Additional opinions on the technical evidence would be particularly welcome here. Maxim(talk) 15:29, 10 September 2021 (UTC)[reply]
    Maxim, thanks much. Would you like blocks here (and if so, how do you want them tagged), or do you want a second opinion on the CU data first? GeneralNotability (talk) 15:43, 10 September 2021 (UTC)[reply]
    GeneralNotability, I think a second opinion would be useful here before blocking or tagging. Maxim(talk) 15:56, 10 September 2021 (UTC)[reply]
  • I don't know if this is related, but I just blocked Sawada Katsuo (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) for creating a spam article, waiting two months, then spamming AFD nominations. MER-C 17:12, 11 September 2021 (UTC)[reply]
  • I just want to note that I have started running checks in this case, but because of the number of suspected socks and its complex nature, it may be a day or two before I post my conclusions. For fellow checkusers, I've posted some notes on the CU wiki in case you want to follow along: [192]. Mz7 (talk) 06:15, 22 September 2021 (UTC)[reply]
  •   Clerk assistance requested: - checks have been completed per the above. Could a clerk progress this case, or mark exactly what's required currently? Many thanks   ~TNT (she/they • talk) 03:07, 30 September 2021 (UTC)[reply]
    @TheresNoTime: Per Mz7s comment, (re-)checks are still in progress – or did I miss something? --Blablubbs (talk) 11:49, 30 September 2021 (UTC)[reply]
    I've set this to inprogress for the time being. --Blablubbs (talk) 12:22, 30 September 2021 (UTC)[reply]
  • I apologize for the delay. The potentially coordinated behavior of these accounts has been on my radar for some time (functionaries can see this May 2021 email I sent to the list), but because of the complex and novel nature of the underlying technical data, it slipped through the cracks, and I never took concrete action on the case. I thank Giraffer, Blablubbs, MarioGom, and Extraordinary Writ for raising this issue directly.
    From a technical standpoint, this case is complicated because it involves a novel form of CU evasion that we haven't seen a lot before this year. The following accounts haved used IPs that have been flagged as possible endpoints for this novel kind of proxy:
    • Saketio31
    • DmitriRomanovJr
    • INeedToFlyForever
    • Jaysonsands
    • Okaye Agongo
    • Slovenichibo
    • Tulkijasi
    • Zackdasnicker
    • Riteboke
    • Frigidpolarbear
  • I checked the following accounts, but their IPs were not flagged as endpoints for the novel proxy—however, this could easily be a false negative, and behavior should be the deciding factor:
    • Hypogaearoots
    • Impeeriumalo
    • JaredDaEconomist
    • Rickshaw Takahashi
  • I agree that the behavioral similarities of these accounts is highly suspicious, and the likely use of this novel proxy adds to that suspicion. However, I think a clerk should go through and carefully examine the behavior of these accounts one more time. (In particular, could we get second eyes on Riteboke (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)? They're the only account listed that has commented here to defend themselves, and they're the only one with 5000+ edits as far as I can tell. The proxy flag could be a false positive.)
    It's clear to me, however, that several editors and administrators have examined the evidence here and agreed that it is suspicious. I think we should be able to proceed with blocking all of the non-stale accounts except Riteboke. If a clerk does not action this case or provide a second opinion by this weekend, I will go ahead and do this myself. Mz7 (talk) 23:16, 30 September 2021 (UTC)[reply]
    • Mz7: I am strongly convinced that Riteboke is related to this group. They have voted in concert with other suspected accounts (and often against the consensus of established editors) at Wikipedia:Articles_for_deletion/François Bergeron, Wikipedia:Articles for deletion/Mel Sanson, and Wikipedia:Articles_for_deletion/Gustavo_Lopez_(music_executive) (though they struck their vote and changed to 'delete' after some other keep voters were blocked as socks... as did other accounts in the filing). Recreating Gustavo Lopez after voting 'delete' at its AfD is bizarre, but makes sense if you read that AfD as a thwarted attempt at the "nomination + keep" strategy described in the filing; the copy-pasting of others' AfD votes, as noted in the table, is also highly suspect. The edit count seems to have been obtained mostly through repetitive wikignoming edits, as is typical of this group, sometimes seemingly going through a list of articles alphabetically; compare [193], [194], [195]. I also find it interesting that the account has not edited since shortly after their comment on the SPI. Spicy (talk) 18:11, 3 October 2021 (UTC)[reply]
  • The evidence presented is compelling, especially when combined with the characteristics of deliberate CU evasion I've referred to above. All non-stale accounts   Blocked and tagged, including Riteboke. I've left the stale accounts untouched for the time being—if they return to activity, they may be reported here again. Closing. Mz7 (talk) 03:01, 8 October 2021 (UTC)[reply]

06 September 2021

edit

Suspected sockpuppets

edit
Collapsing accounts duplicated by the other 06 September 2021 report. Mz7 (talk) 04:02, 8 October 2021 (UTC)[reply]

The more I look at this case, the more I become astonished both by how brazen and how subtle this individual is. I hope you'll bear with me as I set forth all the evidence: it's difficult to be concise when sixteen seventeen accounts are involved, but I'll do my best. Tl;dr: These accounts tend to follow this pattern:

  1. The account is created. Sometimes multiple accounts are created at the same time (two were created just three minutes apart), but oftentimes there is a delay of several days, months, or more. All of these are fairly new: I've yet to see any created before 2017, and most are from 2020 or later.
  2. After a few pro forma edits (e.g. making a user page; some formatting changes), the account goes into sleeper mode. It may not emerge for months or years. This makes the accounts appear older than they actually are.
  3. The account comes out of sleeper mode. It makes many, many small edits (writing an infobox parameter by parameter; fixing tiny grammatical issues one at a time; adding categories one at a time). These take almost zero effort; they are intended solely to drive up the edit count. The account may go in and out of sleeper mode.
  4. Eventually the account goes into deletion mode. The hallmark sign here is making short single-sentence comments in about a dozen consecutive AfDs over a short period of time. Often two or more socks will participate in the same AfD. The editor evidently has a poor grasp of the English language, so many unusual tics are repeated here, like "should pass for GNG" and "as per nom, no indication...". Other interests include draftification and speedy deletion.
  5. Several accounts go on to seek the new page reviewer (NPR) permission. Since the accounts are old (due to the sleeper periods) and have a high edit count (due to the lightning-speed minor edits), their request is often granted. NPR accounts tend to nominate, relist, and close many AfDs, all very quickly.

With this general pattern in mind, allow me to present the specific behavioral evidence indicting each sock:

Extended content
  • TheChromium: Uses the phrase "should pass for GNG". [196]. Per this, the phrase has only ever been used by TheChronium, Jaysonsands, and Grandruskiy48. !Voted in 9 consecutive AfDs in 17 minutes. [197]. Has the NPR permission; participated in this AfD with four fellow socks.
  • Zackdasnicker: !Voted in 11 consecutive AfDs in 29 minutes. [198]. Account created just three minutes after fellow sock Jaysonsands; account was created in Jul 2020 but wasn't used until Apr 2021. Made scores of worthless edits like these.
  • Kieem trra: !Voted in 12 consecutive AfDs in 12 minutes. [199]. Participated in this AfD with four other socks. Made no article-space edits until months after account creation.
  • Impeeriumalo: Didn't make any mainspace edits until three months after account creation. Started out with garbage edits like these. Participated in this AfD with (at least) two other socks. Large numbers of simultaneous AfDs [200].
  • Jaysonsands: another of the three "should pass for GNG" accounts. [201] [202]. !Voted in 13 AfDs in less than 2 hours. [203]. Account created just three minutes before fellow sock Zackdasnicker; lay dormant for ten months. Lots of low-effort edits. [204].
  • Grandruskiy48: one of the three "should pass for GNG" lovers. [205]. !Voted in 12 consecutive AfDs in 26 minutes. [206]. Account wasn't substantially used until 8 months after creation; scores of trivial edits like these.
  • Idunnox3: the already-blocked GermanKity (already connected to this group via CU data) references this account on her userpage. !Voted in 16 consecutive AfDs in 39 minutes. [207]. Scores of minor draftspace edits. [208].
  • INeedToFlyForever: !Voted in 14 AfDs in 60 minutes. [209]. Account lay dormant for 14 months. Makes loads of little edits. [210].
  • Rickshaw Takahashi: !Voted in 10 AfDs in 14 minutes. [211]. Participated in this AfD with four other socks. Lots of useless minor edits. Account wasn't used for 10 months after its creation.
  • DMySon: another NPR. Initiated, relisted, and voted in myriad AfDs in very short periods of time. [212]. Scores of minor edits like these. In this AfD, JeepersClub himself showed up to support DMySon's nom.
  • Frigidpolarbear: !Voted in 10 consecutive AfDs in 9 minutes. [213]. Participated in this AfD with four fellow socks. After one edit, the account went dormant for 14 months. Used Twinkle to welcome myriad new users with little effort. [214].
  • DmitriRomanovJr: Created his account just 6 hours after fellow sock Bapinghosh. !Voted in 10 consecutive AfDs in 21 minutes. [215]. Scores of trivial edits like these.
  • JaredDaEconomist: !Voted in 10 consecutive AfDs in 15 minutes. [216]. Participated in this AfD with several other socks, including GermanKity. Lots of trivial edits, especially relating to categorization. [217].
  • Bapinghosh: Created the account just 6 hours before fellow sock DmitriRomanovJr. Has a request currently pending for the NPR permission. Account lay dormant for four months. Minor edits like these abound. Heavy AfD participation. [218].
  • Dixiku: Account lay dormant for six months. Makes edits in small drips to drive up edit count. [219]. Participates at AfD in intervals of short duration and heavy intensity. [220].
  • RamotHacker: !voted in 32 (!) AfDs in 3 hours, just yesterday. [221]. Account lay dormant for 12 months.
  • Multi7001: !voted in 22 AfDs in 45 minutes. [222]. Lots of minuscule edits. [223]. Account dormant for weeks at a time.

I'm beyond confident that these accounts are all related. The similarities listed above (as well as a few others that I'm not disclosing right now) obviously cannot be written off as coincidence. CU can hopefully find a few more sleepers: I seem to encounter new ones almost every day, so this individual clearly has an almost inexhaustible supply of accounts. (Could a hard rangeblock work?) Please let me know if I need to provide any more information, and thanks in advance for wading through this mess. Cheers, Extraordinary Writ (talk) 00:07, 6 September 2021 (UTC), supplemented at 05:23, 6 September 2021 (UTC)[reply]

If I could elaborate a bit as to why I think these accounts are connected to JeepersClub et al.: The JeepersClub cluster follows the five-part pattern that I discussed above. Take, for instance, the already-blocked Johnson Wagart (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki): the account remained dormant for almost two months after account creation (1 & 2), made myriad tiny edits to his sandbox [224] (3), and !voted in 10 AfDs in 9 minutes [225] (4). The same is true for the CU-linked GermanKity (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki): made a handful of edits immediately after account creation [226] (1), went into sleeper mode for over three years (2), emerged to add scores of low-effort shortdescs [227] (3), !voted in 15 AfDs in 64 minutes [228] (4), and applied for and received the NPR permission [229] (5). Again, let me know (either here or via email) if more information would be useful. Extraordinary Writ (talk) 18:02, 6 September 2021 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • I think all of these should be checked too. TheChronium and Dixiku were in our original Sanketio31 notes, but didn't make it into the final report. Seeing the additional evidence for these two, found independently by Extraordinary Writ, I'm quite confident about the connection. MarioGom (talk) 20:00, 11 September 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit

I just want to point out that ST47 ran a check on September 2 and uncovered none of these accounts. Of course, his finding of "possilikely" may indicate that checking accounts directly is necessary in this case.--Bbb23 (talk) 13:24, 6 September 2021 (UTC)[reply]

is likely this sockfarm. Shouldn't the status be endorsed, relisted or CU request? MER-C 15:28, 2 October 2021 (UTC)[reply]
Moved back to endorse. --Blablubbs (talk) 15:19, 3 October 2021 (UTC)[reply]
  • I believe that JeepersClub, TheChronium, Dixiku, and Portuportu2 are related—there is evidence that these accounts have attempted deliberately to evade CU detection in the same idiosyncratic manner as other socks of the Sanketio31 variety. For technical reasons, I believe that Idunnox3, RamotHacker, and Multi7001 are most likely not related to this group. I decided not to run a check against DMySon because of insufficient behavioral evidence: that account has more than 15,000 edits and seems much more established than the other accounts listed. Kieem trra and Grandruskiy48 are now stale. JeepersClub, TheChronium, Dixiku, Portuportu2   Blocked and tagged. Closing. Mz7 (talk) 03:55, 8 October 2021 (UTC)[reply]

08 October 2021

edit

Suspected sockpuppets

edit


As before. It's not really in doubt that they are a spammer ([230][231]) but their edits to AFDs and the padding of their edit count concerns me. Wikipedia:Articles for deletion/Mahir Bajramoski was the AFD that triggered this report, Wikipedia:Articles for deletion/Kevin Fleming is also suspicious. MER-C 17:15, 8 October 2021 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

edit

08 March 2022

edit

Suspected sockpuppets

edit

This account follows the same pattern as previous members of this sockfarm.

  1. To quote from the archive, "Accounts participate in one of a handful of gnoming activites, including...wikilinking, as well as rapid-fire copyediting". Juggyevil's contributions contain hundreds of these minor edits, made in quick succession: see here. The history of Epeolus cruciger, where the account made 18 edits (adding wikilinks and commas) in half an hour, is typical.
  2. Low-quality AfD !votes. This is the sine qua non of members of this sockfarm. As noted in the archive, after the account has made hundreds of copy-edits, it "goes into deletion mode. The hallmark sign here is making short single-sentence comments in about a dozen consecutive AfDs over a short period of time." Although this latest account has spread out the !vote-spamming somewhat over multiple days, the pattern still remains: six single-sentence !votes in 8 minutes, six one-line !votes in an hour, four single-sentence !votes in 2 minutes (!)
  3. Linguistic tics. This account was created just days after this sockfarm was exposed at SPI, so the master has seemingly tried to avoid some of the more obvious giveaways. But some similarities still remain. Take, for instance, Wikipedia:Articles for deletion/Oversimplified (2nd nomination), in which Juggyevil states "Fails WP:GNG not enough sources to support the article". The irregularly punctuated phrase "Fails WP:GNG not enough" has only ever been used four times in the history of Wikipedia: once by Juggyevil, once here by the blocked Sanketio31 sockpuppet Namkongville, once here by Purosinaloense, a stale Sanketio31 sockpuppet who was previously reported here, and once more here by another sockpuppet whose master is unknown. Next, I noticed the odd and rare phrase "to showcase notability" used by Juggyevil here: it's also been used by the blocked Sanketio31 socks Hypogaearoots (here) and Frigidpolarbear (here). Finally, compare Juggyevil's "Fails WP:GNG, lacks in-depth coverage" (here) with Sanketio31 sock Hypogaearoots's "Fails WP:GNG lacks indepth sources" (here), Zackdasnicker's "Fails WP:GNG, lacks reliable coverage" here, and TheChronium's "Fails WP:GNG lacks reliable indepth news coverage" (here), among others.
  4. Interest in permissions. Juggyevil requested the AfC permission, which Blablubbs declined, noting "minor copy-edits across multiple tiny contributions" and low-quality AfD contributions. Previous socks made similar requests for the AfC permission: see TheChronium (here and here) and Riteboke (here).

In sum, there's ample behavioral evidence to show a connection here. This sockfarm uses what Mz7 called a "novel form of CU evasion"; I understand that there's information on CU-wiki about the situation. Do let me know if there's any more information that I can provide. Thanks in advance. Extraordinary Writ (talk) 21:23, 8 March 2022 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

edit
  •   In progress GeneralNotability (talk) 23:51, 8 March 2022 (UTC)[reply]
  • Hoo boy. So first off: all known socks are   Stale, not that that helps us much. This editor is not using the "novel proxy" previously mentioned, and CU has nothing else useful to share here. However, the behavioral evidence presented by Extraordinary Writ is compelling, and frankly I am confident that this is a bad-faith editor of some sort (clearly engaged in WP:GAMING behavior) even if they aren't necessarily this specific sockfarm. On those grounds, I am confident in making a block that can be summarized as "obviously somebody's sock and obviously up to no good".   Blocked without tags. GeneralNotability (talk) 00:05, 9 March 2022 (UTC)[reply]

24 June 2022

edit

Suspected sockpuppets

edit

First edits were to remove promotional material added by GermanKitty, in a manner characteristic of warring UPEs. Account came back alive after a year to create Architecture Discipline India, which is a re-creation of Architecture Discipline and has multiple portions copy-pasted therefrom. Interestingly, DMySon, part of the GermanKitty sockfarm, made a few gnome edits to that shortly after it was created; maybe that was before the two sockfarms fell out, or maybe it was an "I see you". -- Tamzin[cetacean needed] (she|they|xe) 11:48, 24 June 2022 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

edit
  •   Self-endorsed by clerk for checkuser attention. Also, courtesy ping KH-1, who G4-tagged the new article. (I'm actually on the fence as to whether G4 is met, owing to two sources of new coverage, and will leave it to another admin to decide... Guessing this will wind up a G5 if it isn't G4'd.) -- Tamzin[cetacean needed] (she|they|xe) 11:48, 24 June 2022 (UTC)[reply]
  • I've taken a look at this. All the non-stale edits from this account (which were all made within half an hour of each other) are from the same IP address, which spur identifies as a residential proxy. They are using a super-generic UA. All of this would be entirely consistent with La La Kola being a member of the Sanketio31 farm, but it isn't proof positive that they are a member. I've left this as 'endorsed' in case another CU with more familiarity with this case and P2P proxies wants to take a look; Tamzin, if you feel the behavioural evidence is strong enough you may of course take action based on this. Cheers Girth Summit (blether) 14:08, 24 June 2022 (UTC)[reply]
  • I'm not going to get too hung up on the CU data here. They've made an article that is extremely similar to a past sock's and that's plenty for me.   Blocked and tagged suspected. GeneralNotability (talk) 18:47, 25 June 2022 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Sanketio31/Archive&oldid=1138679071"