Kambliyil (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

22 September 2021

– A checkuser has completed a check on relevant users in this case, and it is now awaiting administration and close.

Suspected sockpuppets

• Mehboob Nambrath (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Jabirkdh11 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Arjun Muraleedharan Madathiparambil (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Arjun Madathiparambil Muraleedharan (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Sreein Sreedhar (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Noncreativephotographer (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Nikhilnarayanan (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Shaheed Hemukalani (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Kambliyil was recently blocked for an extensive history of sockpuppetry, with speculation that there was more than we were seeing. I think I've found a bit of that. Here are the users whose userpages Kambliyil created. In all cases, there is no record of any of them asking Kambliyil to do so. There are two not listed here: Satya prakasham (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), already confirmed; and Alandyept (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), already ruled unlikely.

Some more notes on individualized suspicion:

• As you may notice, both of the Messrs. Arjun M. M. have essentially the same name, just with the second and third names reversed. Both somehow got past 1,000 edits this way; I can only assume people seeing both usernames didn't realize they weren't the same account.
• Three pages were created with the content I am a Malayali and a follower of Communism. Of those three:
  • One account (Nikhilnarayanan) has already been indeffed as a sock of Adhithya Kiran Chekavar (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Sreein Sreedhar ‎yesterday changed that text, but expressed no objection to someone else having created their userpage.
  • 24 hours later, Arjun Madathiparambil Muraleedharan did the same, here just removing the communist bit—again, apparently unperturbed that someone else created their userpage.

More generally, all of these accounts are heavily involved in the topic area of Indian politics, specifically Kerala politics, often with a focus on the far left.

I suspect we're on the tip of an iceberg here, one that may see a few cases merged. More notes on that shortly. Requesting CU for all of these to sort out this madness. I can't rule out the chance that Kambliyil was creating userpages for editors they liked, or whom they knew personally off-wiki, and given that one of the users they did this for is Alandyept, the userpage creations on their own aren't enough. -- Tamzin^{[cetacean needed]} (she/they) 09:00, 22 September 2021 (UTC)[reply]

Adding Shaheed Hemukalani, who edited Draft:All India Bank Officers' Association with the two Arjuns, and who stopped editing a few days after Arjun Muraleedharan Madathiparambil. -- Tamzin^{[cetacean needed]} (she/they) 09:09, 22 September 2021 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

This case is being reviewed by Tamzin as part of her training as a clerk. Please allow her to process the entire case without interference. You may pose any questions or concerns either on her talk page or on this page.

• Self-endorsed by clerk for checkuser attention. Two notes here:
  1. If Noncreativephotographer is confirmed/likely, we will need to merge this into Wikipedia:Sockpuppet investigations/Adhithya Kiran Chekavar. (There's some question of what username to use, I suppose, given Kambliyil's five-figure edit count.)
  2. If a significant proportion of these are confirmed, we should consider whether Occam's razor cuts in favor of a conclusion that Alandyept et al. are part of the same sock/meatfarm, CU or not. That would also mean revisiting the decision not to block Boschanot (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), although I haven't personally reviewed the argument there.

-- Tamzin^{[cetacean needed]} (she/they) 09:07, 22 September 2021 (UTC)[reply]

• For what its worth, my observation was that Alandyept and Kambliyil were in an editorial dispute and that both resorted to abusively using multiple accounts to gain the upper hand. In the case of Kambliyil, this was not an isolated incident. They showed an extensive history of deceptively using their accounts to revert to their preferred version, provide an illusion of consensus, gaslighting editors they were in a dispute with, et cetera. Kambliyil has access to at least two different internet providers with large IP ranges, presumably one is a home network connection and the other is mobile. In any case I do not believe Alandyept and Kambliyil share a relationship outside of their on-wiki dispute. With respect to Boschanot and all the other accounts listed in this recent report, would defer to a CU administrator for their review and feedback. Regards, Yamaguchi先生 (talk) 18:44, 22 September 2021 (UTC)[reply]

• I have run some checks but can't confirm any accounts out of the list submitted above. The only discovery I made is Anobob, who is  Confirmed to Akmal Hashim Kapat (talk · contribs), an account which was blocked indef by Berean Hunter in 2019 but is not the subject of this SPI:

• Anobob (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

In addition to having a technical match, Anobob also too the step of moving Akmil Hashim Kapat's user page to a new user name which does not exist! I have moved the page back and blocked Anobob (talk · contribs) indef.

In terms of the real subject of this SPI, Kambliyil (talk · contribs), Yamaguchi's main evidence is that the above set of user pages were all created by the same guy. This is not quite the same as noticing misbehavior by the individual accounts listed. There could still be something here even though I was not able to find it. I looked in detail only at the first two in the list, but saw nothing wrong with their edits and found them to be technically  Unrelated to Kambliyil. Any other checkuser is welcome to continue screening the above listed accounts to see if they can find something. EdJohnston (talk) 02:29, 25 September 2021 (UTC)[reply]

• Thank you EdJohnston. Was not aware of Akmal Hashim Kapat and Anobob until recently. It may be a moot as the accounts are both blocked, but Anobob is a rather obvious WP:DUCK of Kambliyil as well. Regards, Yamaguchi先生 (talk) 19:26, 29 September 2021 (UTC)[reply]
• Having reviewed the contributions and logs of Akmal Hashim Kapat (talk · contribs) I am certain that they and Kambliyil are one and the same. Akmal Hashim Kapat predates the Kambliyil account, so perhaps this SPI should be renamed accordingly. Regards, Yamaguchi先生 (talk) 20:32, 29 September 2021 (UTC)[reply]
• Just want to clarify, since I'm aware this case is a bit of a mess, that the ones I'm most suspicious of here are the two Arjuns and Sreein Sreedhar, for the reasons described in the filing. I remain suspicious of the final three as well, and the topic overlap plus Kambliyil interacting with them in a way they also interacted with their own sox is, in my opinion, still enough evidence to justify a check; but it's the Arjuns and Sreein for whom there's the strongest evidence of something being up. -- Tamzin^{[cetacean needed]} (she/they) 01:25, 5 October 2021 (UTC)[reply]
• Though December 2019 is a long time ago, see this version of Akmal Hashim Kapat's talk page for all the socking evidence accumulated by User:Berean Hunter. It seems possible that Kambliyil is the same person as Akmal Hashim Kapat. Whether that helps us or not is another question. Berean Hunter was very concerned about UPE by this editor. This SPI would benefit from more content explanation of what POV each person was trying to advance, or what their reverts were about. For example, are the socks of Kambliyil trying to push UPE? EdJohnston (talk) 04:29, 6 October 2021 (UTC)[reply]
•  In progress - right, let's tackle this one ~TNT (she/her • talk) 20:09, 9 October 2021 (UTC)[reply]
• In reviewing this case, I performed checks on the following accounts:
  • Kambliyil (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Arjun Madathiparambil Muraleedharan (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Sreein Sreedhar (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Mehboob Nambrath (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Jabirkdh11 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Boschanot (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Anobob (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• I selected these accounts as they were not stale. Any other accounts should be behaviourally reviewed.
  • Kambliyil appears to have recently used webhosts/proxies (this is solely based on open ports and Shodan's classification, as said IPs are not online currently). The organisation the IPs are registered to does not appear to offer hosting/co-location.
    • No other accounts appear on these ranges.
  • Arjun Madathiparambil Muraleedharan appears technically  Unrelated to the master, and other checked accounts.
    • Other accounts visible on these ranges.
  • Sreein Sreedhar appears technically  Unrelated to the master, and other checked accounts.
    • Other accounts visible on these ranges.
  • Mehboob Nambrath appears technically  Unrelated to the master, and other checked accounts.
    • Other accounts visible on these ranges.
  • Jabirkdh11 is definitely technically  Unrelated to the master, and other checked accounts.
    • Other accounts visible on these ranges.
  • Boschanot appears technically  Unrelated to the master, and other checked accounts.
    • Other accounts visible on these ranges.
  • I concur with the previous findings for Anobob, and note the marked differences i/r/t the above.

• Unfortunately the results here are not helpful. If Kambliyil was using a webhost/proxy, then we could potentially assume some sort of evasion is at play, if you believe this master would attempt to evade?
• (TL;DR)  In summary, my checks have not yielded any useful information ~TNT (she/her • talk) 20:44, 9 October 2021 (UTC)[reply]
• Thanks, Sam. This is... all very perplexing. I'm going to leave this open for now while I take a look at the two Arjuns. -- Tamzin^{[cetacean needed]} (she/they) 20:58, 9 October 2021 (UTC)[reply]

  @Tamzin I took a look at this (just the publicly-available data). My inclination would be to assume that the two Arjuns are indeed the same person. However, given the name similarity, it's hard to make a convincing argument for deception. So I'd be tempted to close this with no action, or maybe uw-agf-sock, or a more polite hand-written note to make sure they're aware of our policies and ask them to resolve any questions by putting an explanatory note on one or both of the user pages. -- RoySmith (talk) 18:26, 30 October 2021 (UTC)[reply]

  @RoySmith: Yeah, sorry I've left this open for so long. I've just wanted to take a closer look to figure out whether any sort of warning is needed. But, looking at the dates here, gosh, didn't realize I'd let it get to three weeks. I'll sort this in the next day or two. -- Tamzin^{[cetacean needed]} (she/they) 04:39, 31 October 2021 (UTC)[reply]

• Okay, I've given Arjun an AGF half-warning/half-query, and think that's all there is to do there. It seems likely to me that there is some sort of off-wiki coördination going on regarding the topic area of leftist politics in Kerala, but I can't say for sure that it's bad faith coördination, so I don't think there's anything else to be done here, but I do think it's worth keeping in mind for the future. Anyways, sorry again for the mess and the delays.
  This leaves us with the question of merging. @Yamaguchi先生: I've taken a long look at the two sets of sox' contribs, and see lots of similarities, more than enough to endorse a check on had one not already been run. I'm not seeing, though, the sort of smoking gun I'd need to call this proven and thus merge, especially in the face of a "technically unrelated". Is there something in particular that makes you certain they're the same? -- Tamzin^{[cetacean needed]} (she/they) 02:43, 5 November 2021 (UTC)[reply]

  @Tamzin if you're looking at the two Arjuns, you should also look at Wikipedia:Sockpuppet investigations/Arjun Muraleedharan Madathiparambil, which I see I was involved in, and had totally forgotten about the last time I chimed in on this case. -- RoySmith (talk) 03:15, 5 November 2021 (UTC)[reply]

  @RoySmith: Welp, wish I'd noticed that before I warned them, but oh well, two AGF warnings can't hurt. Does make me wonder, should ((checkuser)) link to an SPI if there is one? Something like ((#ifexist:Wikipedia:Sockpuppet investigations/(({1))}|· '''[[Wikipedia:Sockpuppet investigations/(({1))}|SPI]]''')), right at the front before "talk". -- Tamzin^{[cetacean needed]} (she/they) 04:28, 5 November 2021 (UTC)[reply]

  Yeah, it would be there was some easily visible notice of other cases of interest. A case titled for the account is certainly one, but also other cases where the account was mentioned would be cool too. My template-fu is rather weak, so I have no idea how feasible it would be to implement that. -- RoySmith (talk) 14:41, 5 November 2021 (UTC)[reply]