This should have been filed with the named account as master. A clerk should move it. In any event, we don't publicly disclose the IP(s) of named accounts. The CU request is declined.--Bbb23 (talk) 18:14, 1 December 2017 (UTC)[reply]
I've blocked the /22, which is engaged in the same kind of combative edit-warring. Closing. GABgab 01:19, 2 December 2017 (UTC)[reply]
CheckUser requested and endorsed by clerk - Delotrooladoo socks are known for ownership on Arab–Israeli conflict pages. See diffs: [3][4]. Sockmaster has a history of operating numerous accounts at once. Sro23 (talk) 03:26, 11 December 2017 (UTC)[reply]
CheckUser requested and endorsed by clerk - Please compare to previous socks and check for sleepers. Thanks, GABgab 16:01, 18 December 2017 (UTC)[reply]
@Triggerhippie4: Your only "proof" is that me and other editors edited the same articles. This is laughable, I'm seriously considering reporting you for being a sock puppet since you edited the same article as SupremeDeliciousness... [18][19] Also, why don't you add yourself as a suspect in this investigation? We have both edited this article, that must mean you're a sock puppet as well... LMFAO! :D Dank Chicken (talk) 23:32, 2 January 2018 (UTC)[reply]
After investigating this I'm sure all of those are your socks. I'll give more proof when I'm not busy. I expect other users will have something to say soon, as well. --Triggerhippie4 (talk) 23:39, 2 January 2018 (UTC)[reply]
Not just the same articles but similar edits. --Triggerhippie4 (talk) 23:42, 2 January 2018 (UTC)[reply]
Hahaha, I don't care what you call "proof". Nobody is seriously gonna belive me editing the same article as someone else means we're the same person. But go ahead, continue your little investigation by all means. I couldn't care less what you spend your time on. Btw, what do you mean by "similar edits"? Dank Chicken (talk) 23:45, 2 January 2018 (UTC)[reply]
Comment I pointed out my view that this user is a replicant of a previously banned set of accounts at [20]. Please ping me if clearer diffs are required. Onceinawhile (talk) 23:49, 2 January 2018 (UTC)[reply]
Comment When this account appeared in November 2017 its mature editing knowledge was plain for all to see. It is not proof but it is cause for suspicion. Zerotalk 00:55, 3 January 2018 (UTC)[reply]
If this sock got extended-confirmed status, it would have wasted a vast amount of honest editors' time. Thank you, Bbb23, for taking prompt care of it. Zerotalk 03:26, 3 January 2018 (UTC)[reply]
This is proposterous. I haven't done anything wrong, please stop slandering me. If you disagree with my edits, then tell me. But don't make up unsubstantiated allegations! Dank Chicken (talk) 23:56, 2 January 2018 (UTC)[reply]
@Bbb23: Thank you! Don't close it yet. I guess now we should determine whether AndresHerutJaim and Delotrooladoo are the same. --Triggerhippie4 (talk) 01:30, 3 January 2018 (UTC)[reply]
@Bbb23: after you grouped them, we have three groups: AndresHerutJaim, Delotrooladoo and Dank Chicken.
Relations of AndresHerutJaim and Delotrooladoo: ([21], [22]).
Relations of Delotrooladoo and Dank Chicken: ([23], [24]), ([25], [26]).
Based on the checkuser results below, I'm submitting all accounts in the first group plus Mr. Dodo'sss for a global lock. -★-PlyrStar93. →Message me. ← 03:06, 3 January 2018 (UTC)[reply]
AmirSurfLera is unusual but I've reblocked him as a sock of Delotrooladoo.--Bbb23 (talk) 01:16, 3 January 2018 (UTC)[reply]
@Triggerhippie4: Mr. Dodo'sss is Confirmed to the Dank Chicken group.--Bbb23 (talk) 01:25, 3 January 2018 (UTC)[reply]
@Triggerhippie4: An excellent question, and I have a not-as-excellent answer. The AndresHerutJaim archive accounts are Stale. However, based on the CU logs, AndresHerutJaim and Delotrooladoo are editing from the same country. I think it most likely they are the same person (AndresHerutJaim is the older account). However, the Dank Chicken group is editing from a different continent, and although one of the two user agents that group uses is the same (it's a common UA), the other has never been used by Delotrooladoo, and I've done more checks on Delotrooladoo than on almost any other sockmaster (the person is incredibly prolific). Also, Delotrooladoo socks don't normally edit the SPI and rant the way Dank Chicken did here. So, I think it likely that the Dank Chicken group is operated by a different master. I'm leaving this open for more analysis by others if they care to wade in.--Bbb23 (talk) 01:43, 3 January 2018 (UTC)[reply]
Clerk assistance requested: Based on my analysis, please merge the Delotrooladoo case into this one. It's not necessary to retag any accounts as we no longer tag anyway and haven't been for some time. Please create a new case with the Dank Chicken group, whichever is the oldest account. Those accounts may be tagged.--Bbb23 (talk) 13:33, 3 January 2018 (UTC)[reply]
@Triggerhippie4: Don't bother bringing more behavioral evidence. The technical evidence is too strong, and there are behavioral cues that support the technical data. Dank Chicken is unrelated to AndresHerutJaim. They will be treated as two different masters. The Mariolis MG case can be put into this one or not. There's not a helluva lot of value to it and it's already referenced here. Up to the clerk. Finally, please do not ping me twice in a row; once is enough.--Bbb23 (talk) 13:47, 3 January 2018 (UTC)[reply]
I tagged all the Willschmut socks and filed them under that SPI. I also Range blocked a Delotrooladoo /18 range. I'm going to close this case and then archive it, so I can merge the Delotrooladoo and Mariolis MG cases. GABgab 03:35, 4 January 2018 (UTC)[reply]
Filed for the record, Blocked and tagged. I noticed that Category:Wikipedia sockpuppets of Delotrooladoo still exists with 157 socks in it. That SPI was merged here, as the two sockmasters are one and the same. Could a clerk fix the tags on all of them (sorry!) before closing this? ~ Rob13Talk 22:51, 8 January 2018 (UTC)[reply]
@BU Rob13: When these were merged at my direction, I specifically told the clerk not to retag the socks. We had stopped tagging Delotrooladoo socks some time ago per WP:DENY, and it seemed both unnecessary and self-defeating to retag any sock that predated that or that slipped through the cracks.--Bbb23 (talk) 23:34, 8 January 2018 (UTC)[reply]
And please don't tag new socks as you did. Thanks.--Bbb23 (talk) 23:36, 8 January 2018 (UTC)[reply]
@Bbb23: Ah, gotcha. I wasn't aware of the history here. ~ Rob13Talk 23:38, 8 January 2018 (UTC)[reply]
OK Bbb23, I'm going to have to leave this one to you--which SPI is this supposed to be under anyway? Drmies (talk) 02:59, 11 January 2018 (UTC)[reply]
@Drmies: Haven't checked yet (will), but it's easy: here. @Triggerhippie4: I don't understand your question about "the template".--Bbb23 (talk) 03:12, 11 January 2018 (UTC)[reply]
They meant that Largest cities of Israel template; I semi-protected it, also after seeing that Krakatoa Katie has protected it earlier. Drmies (talk) 03:15, 11 January 2018 (UTC)[reply]
It takes a village. :-) Confirmed and closing.--Bbb23 (talk) 03:20, 11 January 2018 (UTC)[reply]
The usual restoration of sockpuppet edits ([29][30]) and rapid dummy edits to user sandbox in order to be autoconfirmed ([31]). Sro23 (talk) 21:02, 11 February 2018 (UTC)[reply]
I am VwM.Mwv's mentor. There is hardly any overlap here - editor interaction - and what little there is is explained by Israel related editing (in particular, VwM.Mwv has been updating 2019 Israeli election articles - which explains Benny Gantz who is running. AndresHerutJaim probably edited them in an IDF context (7 years ago - he was chief of staff). Absent solid evidence (and MehrdadFR's assertions - an account with 694 edits - do not sound convincing) - this should be closed. Icewhiz (talk) 14:20, 10 March 2019 (UTC)[reply]
Clerk declined - This case is StaleSir Sputnik (talk) 14:11, 10 March 2019 (UTC)[reply]
@MehrdadFR: If you file a report like this one or the one at Plot Spoiler again, you risk being blocked for disruption. You presented no evidence in either report, and your retaliatory motive for the filings is obvious. Closing.--Bbb23 (talk) 16:03, 10 March 2019 (UTC)[reply]
Silveter is now the oldest blocked account. Should the case be moved to Silveter? — JJMC89 (T·C) 03:55, 1 November 2019 (UTC)[reply]
Yaniv is the most prolific (and despite the non-Latin characters) likely the one people will remember, so I think it’s fine here. Closing. TonyBallioni (talk) 02:06, 2 November 2019 (UTC)[reply]
New account's first edits was to revert others on Jewish-related articles. They know how to sign a post and message really fast hence my talk page but complete silence when I mentioned WP:SOCK. Jerm (talk) 19:03, 2 November 2019 (UTC)[reply]
The sock has only been registered since Dec. 22 2019 but already knows how to participate in AfDs, and users edit history seems to focus on Jewish related articles or Israel. In this AfD, the editor seems to know about Wiki policy via this edit which I find impressive for someone who's only been editing for less than a month. Jerm (talk) 19:07, 2 January 2020 (UTC)[reply]
@Bbb23: I found that either a blocked sock or the master as edit one of the articles as the suspected sock. However, the types of edits aren't similar enough for a connection. Because of that, I'm withdrawing this report. Jerm (talk) 19:55, 2 January 2020 (UTC)[reply]
@Jerm: All you've said is that the user is suspicious because they're new and are took knowledgeable. You must provide comparison diffs showing similarities between the user and the master or socks.--Bbb23 (talk) 19:27, 2 January 2020 (UTC)[reply]
These fairly new accounts had suddenly been participating in an edit war on Alberto Nisman with the same patterns as each other: FerFeluchi, Neutralwatch Behavior resembles the master, who also participated here: [32][33] —{ CrypticCanadian } 20:52, 13 June 2020 (UTC)[reply]
Shortly after the last couple of socks were blocked Aroma Stylish began patrolling the same articles. See Alberto Nisman (FerFerluci, NeutralWatch, followed by Aroma Stylish, and prior to that יניב הורון. Same editing time (AS vs sockmaster, both keeping the Sabbath from Fri night to Sat night. See here for a more comprehensive listing of the intersections, but the breadth of articles the user patrols and reverts is common across past socks. nableezy - 22:47, 13 August 2020 (UTC) 22:47, 13 August 2020 (UTC)[reply]
Blocked both as likely. They have both engaged in editing while logged out to edit war and email access removed per WP:STEALTH because of the email canvassing. — Berean Hunter(talk) 13:58, 15 August 2020 (UTC)[reply]
New user nearly exclusively focused on ARBPIA, immediately reverting edits regarding Iran and Israel-related subjects: 123 and having fourteen pages which Yaniv Horon also edited. : MatryoshkaNL (talk) 21:44, 5 September 2020 (UTC)[reply]
It seems probable that Lana Ryback is יניב הורון, a repeat sockmaster. Perusal of Lana Ryback's talk page gives the distinct impression of a user who's been around for a while. The Editor Interaction Analyzer shows a 42 article overlap between the two accounts, [34] despite the fact that Lana Ryback has only 66 article edits. Further, the Lana Ryback account was created on 6 September 2020, which is just when יניב הורון's previous sock report was being processed. SPI report filed 5 September. That sock was blocked on the 7th, which is when Lana Ryback started editing. [35]Beyond My Ken (talk) 23:24, 14 September 2020 (UTC)[reply]
I believe these IPs are sockpuppets of the subject because they're quick to reinstate the blanking done by a blocked suspected-sockpuppet of the subject on a relatively obscure article that is not directly related to Israel (Israel only constitutes a very small section of the article). Chain of events: ip1 undoes (my) revision that undid a blanking by a blocked suspected-sockpuppet of the subject Special:Diff/977632347/977874578, then another IP restores said revision, only for an extremely similar IP (ip2) to quickly re-blank it Special:Diff/978545967/978594080. 100.16.5.65 (talk) 06:27, 19 September 2020 (UTC)[reply]
Similar timecard as past socks (focusing on Aroma Stylish and יניב הורון here): WIO, AS, יניב הורון with all not editing between Friday 17:00 to Saturday 16:00. All users generally patrol Israel-related topics making reverts without much in the way of any new content generation. The reverts are at a range of articles that would take some sort of coincidence to occur with some very obscure articles common between them. Full listing here, with peculiar interactions below:
Abby Martin, about 400 views a day, has seen reverts by all three [36]
Sabbatai Zevi with about 400 page views a day, all three have edited [37]
Clerk declined: the archive and tagged socks are Stale. — JJMC89 (T·C) 06:09, 1 March 2021 (UTC)[reply]
Blocked and tagged per extensive interaction and timecard similarity. It seems these socks all have copied the same watchlist or otherwise keep track of all recent related changes to the same types of articles. Sro23 (talk) 15:14, 1 March 2021 (UTC)[reply]
While I do have a 'very terrible' habit of typing lengthy [non-work] communications, I shall try my Best to keep it concise: this latest IP-edit appears to be a result of socking not just because of my geolocation-investigation of their IP address, but because of days of edit-warring with multiple IP-edits at Israel-Qatar relations through their now-suspended User:Watchlonly for vague reasons like badEnglish trope followed by its rewording when once warned over their UTP, given their refusal to fix the said "bad" in the English of a clearly constructive-edit (which gives nuance to the background of the subject, to be concise) and when undid yet-again by another, shifted the goalpost in the ES for very same edit to bad geography now. It appears the following undo does appear with a bad English ES, perhaps they were too hurried or some other technical-factor, their words were cut short: Resulting in incomplete-rendering. But frankly.. After seeing that this editor is a devout or shall I be blunt, an obsessive WP:ONLYREVERT vandal, who can only be WP:SNEAKY so many times. Quite admirably in a twisted-way or in a far more level-headed way: Very frustrating and quite infuriating as while their vandalism might be restricted to the topic-areas of ‘Is'rāel’ and ‘World Jewry’, they've committedly set their eyes upon quite a number of low-traffic articles which are sparingly-maintained, if at all. Leaving their sneaky-vandalism repeatedly undetected for long period-of-times, leaving their unstable-revisions intact. Above all, I can't contain my shock that while innumerable editors get banned/blocked merely for discretionary conduct-violations, including those who've seemingly crossed their path, they're still here for past 2+ years: At the very least. And nevertheless, nobody is in a mood to take enough of punitive-measures to get them off their kick of treating Wikipedia like a stereotypical YouTube comments-section. I strongly file for IP-range block from whatever IP they utilise to make their edits from now onwards, if not the pre-existing assortments of IP ranges of addresses banned as results of multiple SIs and counting. Because, frankly: An off-Wiki intervention for them would be the ideal, but this is not one of patrolling-remits of higher-UAL editors, right? As in, not to personally intervene in the lives of 'Wikivandals'. Therefore, IP-range blocks are justified and an inescapable-necessity now, given they aren't anywhere near remotely-close to stopping their sitewide vandalism. 203.192.236.116 (talk) 08:08, 5 March 2021 (UTC)[reply]
Having had a number of my edits fiddled with by User:Watchlonly - mostly harmless, one or two I have issues with - I am staggered at the number of edits appear on this editors history. My first thought is can this be the work of one person? 30+ edits day after day on multiple articles is epic. Padres Hana (talk) 20:01, 5 March 2021 (UTC)[reply]
IP's on this range do seem to be Watchonly, but they're very dynamic and I'm just not comfortable with issuing a rangeblock. Sro23 (talk) 06:39, 8 March 2021 (UTC)[reply]
This user registered few days after blocking of previous sock, Watchlonly, and now send me an e-mail asking to restore edits made by that sock. Triggerhippie4 (talk) 05:12, 7 March 2021 (UTC)[reply]
Clerk endorsed - to confirm sockpuppetry. Also, would a rangeblock of the underlying IP be feasible? Sro23 (talk) 16:43, 7 March 2021 (UTC)[reply]
Possible. They're on a couple of the same ranges as Watchlonly, but the ranges are quite busy (i.e. shared by a large number of unrelated users), and they have a very common device configuration. With that being said, I can confirm that Ahmed Abdullah Khardurallah sent a bunch of emails (checkusers can see that emails were sent, but not the content of the emails or the recipients), and combined with Triggerhippie4's statement above and the technical data, I think a block is justified. Blocked and tagged, closing. Mz7 (talk) 06:20, 8 March 2021 (UTC)[reply]
Blocked for extensive logged out editing in violation of policy, but on closer examination of the log and the behaviour, this is pretty clearly יניב הורון. Tagged as suspected, filing here for the record, closing. TonyBallioni (talk) 03:46, 12 July 2021 (UTC)[reply]
Identical mass nonsensical edits (removing empty lines in seemingly random articles). Possibly to quickly raise edit count? Accounts created within a day from each other. BlameRuiner (talk) 21:38, 16 August 2021 (UTC)[reply]
This is weird. I don't know why they'd make two accounts, but the similarity in...whatever they're doing...is impossible to ignore, as are the close account creation dates. CheckUser requested and endorsed by clerk - while the two accounts have not actually violated our sockpuppetry policy at this time (no evasion of scrutiny, no tag-teaming), my gut feeling is that a) these are socks of somebody else we're already familiar with and/or b) there are more accounts operated by the same person engaged in this behavior (perhaps working toward gaming EC?). Either way, the two accounts are headed for NOTHERE blocks, but I'm hoping CU might have some more information on what's going on. GeneralNotability (talk) 02:17, 17 August 2021 (UTC)[reply]
SoaringLL gamed the ARBPIA General Sanctions: "500/30" Rule and did hundreds of space edits to reach the 500 count before he started editing within the A-I conflict: [40]
The Amir Khanas Forever account has done the exact same thing, look at his first 500 edits:[41], 500 edits consisting of only a single space: to reach 500 edits and then starts to edit within the A-I conflict:[42][43][44]
SoaringLL is tagged as a sock of יניב הורון, so I've merged this case there. --Blablubbs (talk) 11:06, 7 October 2021 (UTC)[reply]
I've stripped Amir Khanas Forever's extended confirmed permission in the meantime as it was clearly gamed. Cabayi (talk) 11:10, 7 October 2021 (UTC)[reply]
Clerk endorsed - The proximity of dates & the shared trait of gaming of ECo seem to show יניב הורון priming a fresh ECo sock. Please confirm. Cabayi (talk) 11:20, 7 October 2021 (UTC)[reply]
In progress - ~TNT (she/her • talk) 22:35, 9 October 2021 (UTC)[reply]
Edit history consistent with all previous socks of this user: mass removal of empty lines to reach a certain edit count. BlameRuiner (talk) 15:04, 19 October 2021 (UTC)[reply]
This case is being reviewed by Spicy as part of the clerk training process. Please allow him to process the entire case without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate.
CheckUser requested and endorsed by clerk - it's almost certainly them, especially looking at the content of the few edits that aren't spacing tweaks, but worth a CU to confirm and check for sleepers. Thanks, Spicy (talk) 15:33, 19 October 2021 (UTC)[reply]
Inconclusive. Compared to a bunch of non-stale confirmed socks in the archives, it's the same user agent, but an extremely common one, so that doesn't say much. Extensive proxy use precludes any better analysis. Behavioural evidence needs evaluation -- RoySmith(talk) 19:34, 19 October 2021 (UTC)[reply]
Thanks, I'm satisfied it's them based on the use of the same ECP gaming tactic & same subject matter interests outside of that. Awaiting administrative action - please indef Jason Greenbaum. Spicy (talk) 21:26, 19 October 2021 (UTC)[reply]
Just like my previous SPI:[45] this account gamed the system and made 500 useless space edits to reach the 500 count and then started editing withing the A-I conflict:[46], please also check this account with all those socks in the previous SPI, Amir Khanas Forever, SoaringLL. Supreme Deliciousness (talk) 05:53, 27 October 2021 (UTC)[reply]
Comments by other users
It’s so obvious, please block as soon as possible. - GizzyCatBella🍁 07:40, 27 October 2021 (UTC)[reply]
Straight forward - Same as previously --> [47] The account makes 500 useless space edits to reach the 500 counts and then commenced reverting to the version of previously blocked sock-puppet -->
Due to extensive proxy use, it's hard to say anything more than Inconclusive from a CU point of view, but I have no qualms about tagging this as proven. -- RoySmith(talk) 23:27, 2 November 2021 (UTC)[reply]
Same as previously, edit history consistent with previous socks. Registers account and commence making useless removal of empty lines:
[58][59],[60],[61] etc.
Then moves for the revert journey and edit war to the articles יניב הורון was previously involved in with familiar edit summary such as - "reverting vandalism", "miss me?", etc.
..and so on, same for every article VIP Alanya edited. Taking under consideration removal of empty lines later reverted substance, choice of the articles and similarities in edits summaries, I have no difficulties identifying this account as another sock-puppet of יניב הורון. GizzyCatBella🍁 11:46, 8 November 2021 (UTC)[reply]
Confirmed, partly from the behavioral description, partly from the cu-wiki notes. I left some additional notes there as well. -- RoySmith(talk) 14:10, 8 November 2021 (UTC)[reply]
An Israeli IP promptly dives into reverting[87],[88] to the version of recently blocked sock puppet of יניב הורון [89]GizzyCatBella🍁 13:08, 8 November 2021 (UTC)[reply]
Check declined by a checkuser - CU cannot connect IPs to accounts. -- RoySmith(talk) 14:13, 8 November 2021 (UTC)[reply]
This case is being reviewed by Tamzin as part of their training as a clerk. Please allow them to process the entire case without interference. You may pose any questions or concerns either on their talk page or on this page.
An Israeli IP promptly dives into reverting[90], to the version of recently blocked sock puppet of יניב הורון [91]GizzyCatBella🍁 13:17, 8 November 2021 (UTC)[reply]
PS - There are more instances of sock-puppetry to report but I don’t want to overload you folks. I’ll bring them up later.
Check declined by a checkuser - CU cannot connect IPs to accounts. -- RoySmith(talk) 14:14, 8 November 2021 (UTC)[reply]
This case is being reviewed by Tamzin as part of their training as a clerk. Please allow them to process the entire case without interference. You may pose any questions or concerns either on their talk page or on this page.
Same as before, edit history consistent with previous socks. Registers account, begins making fruitless elimination of blank lines and a few months later proceeds to the revert journey.
Blocked and rolled back. CU - is there anything we can do as regards IP blocks for this persistent issue, please? Black Kite (talk) 19:10, 8 November 2021 (UTC)[reply]
This case is being reviewed by Tamzin as part of their training as a clerk. Please allow them to process the entire case without interference. You may pose any questions or concerns either on their talk page or on this page.
Clerk endorsed per history of sleepers and per Black Kite. -- Tamzin[cetacean needed] (she/they) 07:13, 9 November 2021 (UTC)[reply]
Unfortunately the nature of the CU data makes it impractical to either do an effective sleeper search or to implement any kind of IP blocking. For the same reason, the best I can do on this particular account is appears to be Unrelated but most of the data is suspect so InconclusiveBehavioural evidence needs evaluation is probably a better call. -- RoySmith(talk) 13:36, 9 November 2021 (UTC)[reply]
Thanks, Roy and BK. Tagging as proven based on behavioral evidence. (There's a specific tell that gets it past suspected in my book.) Closing. -- Tamzin[cetacean needed] (she/they) 16:40, 9 November 2021 (UTC)[reply]
@ Tamzin - Before someone archives, here is a continuous instance of likely sock-puppetry. (a good example for practice since such situations occur frequently)
Right after the other IP has been blocked -->[100], another IP arrives to revert -->[101]GizzyCatBella🍁 17:31, 9 November 2021 (UTC)[reply]
This case is being reviewed by Tamzin as part of their training as a clerk. Please allow them to process the entire case without interference. You may pose any questions or concerns either on their talk page or on this page.
Awaiting administrative action: Please block 76.65.0.16 with expiry 1 month (anon. only, account creation disabled): open proxy. (See [102]; feel free to contact me off-wiki for further evidence that it is one.) @GizzyCatBella: Sadly, your better bet here might be WP:RFPP for some of these articles. I don't foresee a point in the near future where we're not playing Whac-a-Mole on the IPs. Not to say you shouldn't report (at the very least it can help us find open proxies that the bots have missed), but just a general note. -- Tamzin[cetacean needed] (she/they) 17:42, 9 November 2021 (UTC)[reply]
Administrator note IP blockedclpo13(talk) 17:57, 9 November 2021 (UTC)[reply]
@Clpo13: Thanks, and thanks for catching my mistake on anon. only. :)-- Tamzin[cetacean needed] (she/they) 18:06, 9 November 2021 (UTC)[reply]
The above behaviour matches this brand new account (Ajajy Kumar) that also migrates the section to the bottom of the article [110] recently chosen by the blocked sock puppet [111].
Please notice that edits of Ajajy Kumar[112] and OMIR Pandey[113] are 7 minutes apart and that both accounts were created within 3 days from each other.
I'm concluding that the above edits were composed by the same person. - GizzyCatBella🍁 11:38, 19 November 2021 (UTC)[reply]
On a purely technical data basis, I'd have to call OMIR Possilikely (a mix between possible and likely) and Ajajy Possible, but there's so much proxy use that InconclusiveBehavioural evidence needs evaluation probably makes more sense. -- RoySmith(talk) 17:58, 19 November 2021 (UTC)[reply]
This case is being reviewed by Tamzin as part of her training as a clerk. Please allow her to process the entire case without interference. You may pose any questions or concerns either on her talk page or on this page.
OMIR fits the M.O. of past Horon sox, including waiting till autoconfirmed to start making POV edits, even on non-semi-protected pages. (Presumably done because reasons.) Their edit summary in the main edit at issue also matches those of HTYbeker (talk · contribs). Awaiting administrative action: Please block OMIR Pandey indefinitely as a suspected sock.Ajajy seems more likely than not a Horon sock, and did also wait till AC before touching PIA stuff, but I don't think we've quite reached the confidence interval for a block, absent CU evidence. CNo action for now on Ajajy Kumar. @GizzyCatBella: Please feel free to re-file and ping me if Ajajy continues to make Horonesque edits. -- Tamzin[cetacean needed] (she/they) 00:21, 20 November 2021 (UTC)[reply]
Administrator note Blocked and tagged. Closing.clpo13(talk) 00:23, 20 November 2021 (UTC)[reply]
I could go on with diff's but will stop here. Please also note that the original account has been banned (among other things) for accusing an editor of vandalism:
2 - Basically, every single article edited by AshiK Jonathan has been previously edited by blocked sockpuppets:
AshiK Jonathan -->[125] Blocked sock puppet -->[126]
AshiK Jonathan -->[127] Blocked sock puppet -->[128]
AshiK Jonathan -->[129] Blocked sock puppet -->[130]
AshiK Jonathan -->[131] Blocked sock puppet -->[132]
AshiK Jonathan -->[133] Blocked sock puppet -->[134]
AshiK Jonathan -->[135] Blocked sock puppet -->[136]
Again, I could go on with diff's and more comparisons but will stop here since I believe this should be enough and that the know-how of Arbitration Enforcement Request filing requires WP:DUCK utilized as well. GizzyCatBella🍁 20:21, 26 November 2021 (UTC)[reply]
Check User just confirmed extensive proxy use. Previously blocked sock puppets also used proxies extensively, which is yet additional clue. - GizzyCatBella🍁 21:15, 26 November 2021 (UTC)[reply]
I have non-public evidence that I believe is relevant to this case. I submitted it to the Arb email list. If I should also email a SPI-master, let me know. Firefangledfeathers 02:46, 27 November 2021 (UTC)[reply]
You could mail it to me. No promise what I'll do with it, however. -- RoySmith(talk) 02:56, 27 November 2021 (UTC)[reply]
Inconclusive due to extensive proxy use. Behavioural evidence needs evaluation -- RoySmith(talk) 21:08, 26 November 2021 (UTC)[reply]
RoySmith, are you saying that the suspected sick or the suspected master is using proxies? Happy to take an email of you're not comfortable elaborating on-wiki. HJ Mitchell | Penny for your thoughts? 02:12, 27 November 2021 (UTC)[reply]
The master account is long since stale, so I have no data on proxy use by the master. My statement was specifically regarding the AshiK Jonathan account, but as can be seen from the archives, such behavior has been common with many past socks. Please note that it's not possible to say with certainty that any particular edit was done through a proxy, but there are many clues that, in aggregate, proxies are being used. I can't really say more than that. -- RoySmith(talk) 02:24, 27 November 2021 (UTC)[reply]
I'm satisfied, based on the behavioural evidence and the use of proxies. At the very least this is not a new editor with clean hands and very likely this master. Account blocked. HJ Mitchell | Penny for your thoughts? 03:32, 27 November 2021 (UTC)[reply]
Tagged, closing. Noting for future reference that AshiK Jonathan appears to be using the same VPN service as past socks - not conclusive, I think it's a fairly popular service, but it's a data point. GeneralNotability (talk) 14:54, 27 November 2021 (UTC)[reply]
I'm rather convinced this is Yanniv Horon because of the clear attempt to quickly gain 500/30 status by making useless edits + proxies usage. This behaviour is matching most previous sock puppets. If you folks have still doubts, then wait for him to make their first edit into the Israel/Palestine or Holocaust in Poland area. Then you will know for sure. My prediction is they will now abandon this particular account anyway, blocked or unblocked. - GizzyCatBella🍁 22:17, 29 November 2021 (UTC)[reply]
It is going to resemble something like that --> once 500/30 his reached, they will go from useless edit about Alabama native plants [137] to this [138] - GizzyCatBella🍁 23:13, 29 November 2021 (UTC)[reply]
Gaming extendedconfirmed is not sufficiently distinctive behavior for a block or check, but the specific tendency of doing so by removing empty lines is fairly distinctive. CheckUser requested and endorsed by clerk. If this isn't Horon, it's probably another LTA. (To reviewing CU, please note the findings of the last filing here, vis-à-vis proxy use.) -- Tamzin[cetacean needed] (she/they) 21:35, 29 November 2021 (UTC)[reply]
Much like 26 November 2021, none of the specific data matches anything useful, but the overall pattern of common user agent and extensive proxy use mimics what we've seen before. So somewhere between Inconclusive and Likely. Behavioural evidence needs evaluation -- RoySmith(talk) 21:56, 29 November 2021 (UTC)[reply]
@RoySmith: Is it the same VPN as it has been for Horon in the past? -- Tamzin[cetacean needed] (she/they) 22:00, 29 November 2021 (UTC)[reply]
Not always, but for the most part, yes. -- RoySmith(talk) 22:52, 29 November 2021 (UTC)[reply]
Same VPN service. Sleeper engaged in clear ECP gaming behavior using the same technique as past socks from this master. If they're not Horon, they're almost certainly another long-term sockpuppeteer. Blocked and tagged suspected. GeneralNotability (talk) 01:27, 30 November 2021 (UTC)[reply]
Similar name to FocusinJabotito, a confirmed sock. I would strongly prefer not to provide further evidence, even confidentially to arbcom, as it would out me. Their privacy policy is not particularly encouraging in that respect. That said, I have received an almost identical WP:STEALTH canvassing email from this user and the blocked sock Martal Borman. You can see the suspected sock's talk page history for further confirmation of that. AlexEng(TALK) 01:39, 12 January 2022 (UTC)[reply]
Damn. I had hoped that the CU review would be conclusive. Bearing in mind my previous reservations, this is the level of evidence that I am comfortable providing. Please review this screenshot of my mail client. The top two emails are from Focusin Tarambana while the last email is from Martal Borman. If there is a link between MB and the sock master, then I think it stands to reason that there is a link between this account and the same sock master. Please also consider the use of the same terminology to refer to Counterpunch. AlexEng(TALK) 23:50, 12 January 2022 (UTC)[reply]
Given the stealth canvassing to the RFC on CounterPunch that Alex brought to light (see User_talk:AlexEng#Yaniv), and another confirmed Yaniv sock reverting over that same topic yesterday (see here) would suggest a check on DoraExp. nableezy - 14:42, 12 January 2022 (UTC)[reply]
Added another one as per this edit [139] --Shrike (talk) 19:22, 12 January 2022 (UTC)[reply]
RoySmith can you say if behaviorally the account shares the similarity of sending emails to a number of users? Other Yaniv socks have had their email access removed due to stealth canvassing, see for example Berean Hunter's comment in /Archive#13_August_2020. nableezy - 01:58, 13 January 2022 (UTC)[reply]
@Nableezy I just want to acknowledge that I've seen your question (and Tamzin's below). I apologize for being mysterious, but I am unable to provide any additional information. -- RoySmith(talk) 03:00, 14 January 2022 (UTC)[reply]
No worries, RoySmith, I realize there are limits to what can be shared. nableezy - 03:52, 14 January 2022 (UTC)[reply]
Tamzin it just doesnt make any sense to canvass that user off of their WP contribs. 12 edits the day they registered in Sept 2020, 3 more in August, and then the CP RFC 5 months later. Floral suffrage had a similar profile, 6 edits the day they showed up, mostly innocuous simple copy edits, just as DoraExp, though after that dove in to ARBPIA related with Steven Salaita in October 2020 and then doesnt show up until now about CP. There isnt much, given they all have a handful of edits, but looking at the contribs which kinda scream out sleeper sock and the repeated interest in the CP RFCs just strike me as too many coincidences. nableezy - 02:20, 14 January 2022 (UTC)[reply]
Tamzin all good, though I dont suspect this one will be picking back up any time soon tbh. nableezy - 03:54, 14 January 2022 (UTC)[reply]
I know this isn't going to be useful, but depending on how I look at this, I could call it either Possible, or Inconclusive. Behavioural evidence needs evaluation -- RoySmith(talk) 23:09, 12 January 2022 (UTC)[reply]
@RoySmith: Can you verify that Focusin Tarambana sent an email on the 11th (Pacific time, per Alex' userpage)? IMO an account sending an email about a divisive RfC before making a single edit is so unmistakably socklike that it hardly matters who they're a sock of. -- Tamzin[cetacean needed] (she/they) 01:03, 14 January 2022 (UTC)[reply]
@Nableezy: Are there any writing-style similarities or other behavioral tells that make you think DoraExp is Yaniv? (You're welcome to email me if you don't want to spill the BEANS.) Otherwise, given that they've had an account for over a year, I don't think there's grounds to block without CU confirmation—AGF doesn't get me so far as to think this is innocent, but it could be someone who got canvassed from somewhere, which is not per se blockable for the canvassee. -- Tamzin[cetacean needed] (she/they) 01:11, 14 January 2022 (UTC)[reply]
@Nableezy: So, I didn't so much mean targeted canvassing (yes, implausible) as I meant if this is someone who saw a general call to arms somewhere, logged into the Wikipedia account they use a few times a year, and took up that call. We have that happen fairly often. Meanwhile the argument they're making doesn't seem distinctly Yaniv (nor Icewhiz, NoCal, etc.). I only see one person having previously referenced Shamir in CounterPunch discussions at RSN, and that's BobFromBrockley at Wikipedia:Reliable sources/Noticeboard/Archive 355 § CounterPunch and Al Bawaba. My take is: ~0% chance that this is a new user who wasn't canvassed, ~50% chance this is a sock of Yaniv or someone else. I realize the last time you and I disagreed on a PIA sock, you were proven right. You may well be right again here, but I think it falls short of the confidence threshold required for a block. Now, if the account continues to make edits like this, that's a different matter. -- Tamzin[cetacean needed] (she/they) 02:56, 14 January 2022 (UTC)[reply]
I'm just going to block Tarambana as it looks like they also canvassed Dunutubble and probably others as well. If it's not Yaniv then it's some other sock. There isn't enough evidence against the DoraExp account at this time, feel free to refile if the more evidence comes to light. Closing. Sro23 (talk) 03:55, 14 January 2022 (UTC)[reply]
Adding info that had previously been added by a sock of the user to the article Air battle of Mansoura ― Blaze WolfTalkBlaze Wolf#6545 15:41, 27 January 2022 (UTC)[reply]
@Blaze Wolf It really helps us if you provide specific diffs, so we can find the edits quickly. -- RoySmith(talk) 17:54, 27 January 2022 (UTC)[reply]
I would also add 'Vasyl pal who made the same edit. ― Blaze WolfTalkBlaze Wolf#6545 15:43, 27 January 2022 (UTC)[reply]
@RoySmith: Apologies I'm not all that used to having to find difs (mainly because I'm told there's an easy way to link them but I can't figure it out). For Michael P. Gamble see [140] compared to [141] (2nd diff is the edit of the blocked sock). For 'Vasyl pal see [142] compared to the diff of the blocked sock. ― Blaze WolfTalkBlaze Wolf#6545 17:58, 27 January 2022 (UTC)[reply]
@Blaze Wolf: To link to a diff, click the prev link next to a timestamp in a page's history, or click the leftmost prev link in the header when viewing an old revision of a page. See Help:Diff for more information.'Vasyl pal is stale, and I don't recall Yaniv having a history of long-dormant sleepers, so no action there. Blaze, please don't report stale sox unless a master has that kind of history, although it's fine to mention them as reference points for behavioral evidence.Per Blaze' diffs, Michael P. Gamble has restored a Yaniv edit, which is characteristic Yaniv behavior. Clerk endorsed with respect to that account and non-stale sleepers in the archives. I'll note in advance: Due to Yaniv's history of extensive proxy use, and the fairly strong behavioral evidence we already have, I would consider a finding of "inconclusive due to proxy use" tantamount to a finding of socking. -- Tamzin[cetacean needed] (she/they) 18:10, 27 January 2022 (UTC)[reply]
From a purely technical evaluation, Michael P. Gamble appears Unrelated, but there is evidence of proxy use, so Inconclusive is also a possibility. 'Vasyl pal is Stale. -- RoySmith(talk) 23:43, 27 January 2022 (UTC)[reply]
Gamble is 100% Yaniv on behaviour. Blocked and tagged. Vasyl pal hasn't edited in forever and I'm not sure. Re-report if disruption continues. Closing. TonyBallioni (talk) 23:57, 28 January 2022 (UTC)[reply]
Also, at this point, block on behaviour. He's easily one of the top 5 easiest socks to spot without running CU. Running CU for sleepers is useful because historically he's created dozens of accounts, but we shouldn't let the fact that he's discovered basic and unsophisticated location masking software get in the way of blocking him before sleepers are checked. TonyBallioni (talk) 10:08, 29 January 2022 (UTC)[reply]
Created a few hours after Focusin Tarambana was reported here and continues with the stealth canvassing to Israel related discussions, see end of comment here and here. nableezy - 22:32, 14 February 2022 (UTC)[reply]
RoySmith would you want to disable email access for this account? nableezy - 03:46, 15 February 2022 (UTC)[reply]
The same email-bombing behavior as has been seen earlier, combined with extensive proxy use is enough to block on. -- RoySmith(talk) 02:34, 15 February 2022 (UTC)[reply]
Behavorial evidence is as follows: It's the same edit over and over again. There is not really any behavior to analyse, more like a robotic pasting of the same thing. casualdejekyll 18:57, 9 May 2022 (UTC)[reply]
Inconclusive due to proxy use, however, what I can gather from the CU weakly supports a connection. Dreamy Jazztalk to me | my contributions 10:20, 9 May 2022 (UTC)[reply]
Awaiting administrative action - please indef all 3 as suspected socks of one another based on the obvious edit-warring to restore the same content ([143]). BTW, I suspect these may be socks of Wikipedia:Sockpuppet investigations/יניב הורון, but I'm not confident enough to merge the cases. Thanks, Spicy (talk) 01:13, 12 May 2022 (UTC)[reply]
Added Madalyn Turgoose based on reverting as their first and only edit at an article with multiple Yaniv socks, including LL listed here, the same Pinkwashing article nableezy - 03:14, 15 May 2022 (UTC) 03:14, 15 May 2022 (UTC)[reply]
On hold - Possible, I'm running down some things off-wiki for a bit. -- RoySmith(talk) 20:38, 10 August 2022 (UTC)[reply]
I've blocked as an obvious returning troll. I'll leave it to Roy and others to decide whether it's Yaniv or someone else but either way their contributions are not conducive to the project. HJ Mitchell | Penny for your thoughts? 20:47, 10 August 2022 (UTC)[reply]
@RoySmith: Not sure where you're at on the off-wiki stuff, but I'm prepared to tag as suspected and close, based on the mass-revert M.O. and the behavioral overlap with open proxies at Special:PageHistory/Paul Craig Roberts. -- Tamzin[cetacean needed] (she|they|xe) 07:09, 13 August 2022 (UTC)[reply]
Oh, sorry, I should have taken this off hold. The CU I consulted with said, "not enough information from a technical perspective to make a strong call", so go ahead with your proposed action. -- RoySmith(talk) 14:19, 13 August 2022 (UTC)[reply]
Just noticed the Capital punishment in Iran edits are inserting the same image with the same rationale, would have just asked for a duck block had I paid more attention to begin with. nableezy - 15:27, 25 August 2022 (UTC)[reply]
Similar to past socks, rapid trivial edits to reach 500, then returns to focus on Israel related articles. See nearly all of the contributions prior to 9/29, all minor edits performed at a rapid rate. Immediately upon hitting 500 edits, returns to old hotspots, such as Yom Kippur War (past sock, current), History of Israel (past, current), War of Attrition (past, current) nableezy - 03:35, 18 October 2022 (UTC) 03:35, 18 October 2022 (UTC)[reply]
Comments by other users
Not a single edit summary until 500 trivial edits and then classic Yaniv in the edit summary Rv vandalism:
I don't want to expose more for obvious reasons. In my humble opinion there is not the slightest doubt that this account belongs to Yaniv. - GizzyCatBella🍁 05:22, 18 October 2022 (UTC)[reply]
Similar to past Yaniv socks, rapid low character count edits to get to 500 then immediately to EC articles. See for example this series of non-substantive edits, [173], [174], [175], or this and this where he introduces and reverts his own error in short order. Since getting to 500 articles has focused entirely on Israel, with no more 0-10 byte edits. nableezy - 05:09, 3 January 2023 (UTC) 05:09, 3 January 2023 (UTC)[reply]
Similar to the last check, rapid minor edits, including introducing his own error to revert again, see error introduced, reverted; error, reverted. Then once 500 edits achieved, back to patrolling I/P, eg [176], [177], [178]nableezy - 07:18, 5 January 2023 (UTC) 07:18, 5 January 2023 (UTC)[reply]
Per this message from a user who was emailed about an I/P discussion, this user appears to be another in the line of socks attempting to canvass to a number of I/P discussions (see also this about Dur Godiva). Connection in edits as well, see for example past sock, current. nableezy - 18:11, 12 January 2023 (UTC) 18:11, 12 January 2023 (UTC)[reply]
Notice this edit to Poland-related area and the nickname.
Jannat and bella, from GizzyCatBella. Together: Jannatbella
Sockpuppets of Icewhiz and Yaniv were harrasing me for years. This might be one of those two. Unless it’s a coincidence, but I doubt it. - GizzyCatBella🍁 19:04, 12 January 2023 (UTC)[reply]
Icewhiz never been stupid enough to email every single editor they think might be on their side, while Yaniv has done that repeatedly, including to the same discussion that this sock emailed for. So thats my guess, nableezy - 19:12, 12 January 2023 (UTC)[reply]
It's worth pointing out that Icewhiz and Yaniv are by no means the only people socking in the Holocaust in Poland area. Partofthemachine (talk) 07:16, 13 January 2023 (UTC)[reply]
Yes, correct. Sometimes, we have copycats also, who deliberately act a certain way pretending to be them (they pretend to be Icewhiz especially), but I don’t think this is the case here. - GizzyCatBella🍁 07:54, 13 January 2023 (UTC)[reply]
Additional information needed - Lots of users match "editing Israel-related topics + boosting edit count". What specifically about this user makes you think they're יניב הורון? -- RoySmith(talk) 15:54, 21 February 2023 (UTC)[reply]
The behavior is reminiscent of Yaniv, and there's overlap with sock Michael ben Zvi at Special:PageHistory/Supreme Leader of Iran, but there's also overlap with Zhomron and NoCal, and I wouldn't put Icewhiz out of the running either. I'm inclined to just block as NOTHERE/"sock of someone", but will await BlameRuiner's response. -- Tamzin[cetacean needed] (she|they|xe) 16:23, 21 February 2023 (UTC)[reply]
I'm afraid I've nothing more to add. I'm unfamiliar with the other users mentioned besides Yaniv/Zvi. --BlameRuiner (talk) 17:28, 21 February 2023 (UTC)[reply]
Well, at this point, another CU has already run a check and blocked them, so I'll just close this. If anybody wants to tag them, I have no objection. -- RoySmith(talk) 17:46, 21 February 2023 (UTC)[reply]
I haven't looked at the CU data, but saw this after I linked to the SPI elsewhere - just looked at the sock. This is definitively Yaniv on behaviour and isn't any of the other masters that fall in the area. TonyBallioni (talk) 05:52, 22 February 2023 (UTC)[reply]
Similar username style. Similar editing interests. The user is likely operating a sockpuppet, as he used another account to revert an edit he was not allowed to make: [179], [180] (similar arguments/wording in the two diffs). Likely has more sockpuppets that I have not yet encountered. Makeandtoss (talk) 11:36, 23 March 2023 (UTC)[reply]
Four edits from a proxy and raking over old Israel-Palestine disputes? Yaniv or not, that's not a new editor, nor somebody we want to keep around, so I've blocked. HJ Mitchell | Penny for your thoughts? 16:40, 23 March 2023 (UTC)[reply]
Behaviour (including proxy use) is consistent. Tagged, closing. Spicy (talk) 20:14, 24 March 2023 (UTC)[reply]
Account created to edit war over same content as master account,[181][182][183][184] because the suspected master account was recently blocked for prolonged edit warring on this page.[185]Aman Kumar Goel(Talk) 10:57, 31 March 2023 (UTC)[reply]
Lanesass is Unrelated to IceFrappe. Instead, based on a combination of behavioral and technical factors, Lanesass is very Likely to be Yaniv Horon (Wikipedia:Sockpuppet investigations/יניב הורון). Blocked and tagged: I will merge this case into Yaniv Horon before blocking. No action needed regarding IceFrappe—seems like Yaniv Horon was merely imitating them. Closing. Mz7 (talk) 05:25, 1 April 2023 (UTC)[reply]
"Both of them are similar, especially regarding the Lebanon article. They have the same contributions and style of handling the topic. If you examine the article's historical record, you will find that they made the same contributions." 12345Sarah SchneiderCH (talk) 06:52, 27 April 2023 (UTC)[reply]
Agasirt has been blocked as a sockpuppet of Yaniv Horon. Merged to that case. Insufficient evidence has been presented against Red Phoenician, who is an established user. Closing. Spicy (talk) 00:01, 12 May 2023 (UTC)[reply]
Red Phoenician is almost certainly not Yaniv (not based on CU, but its extremely obvious they're different people.) Spicy, you might consider deleting the redirect to the original case name if there is one so people don't accidentally make the connection with this case. TonyBallioni (talk) 05:23, 12 May 2023 (UTC)[reply]
Already done. :) Spicy (talk) 09:38, 12 May 2023 (UTC)[reply]
Exhibits identical behavior with previous socks, with a focus on often obscure Jewish / Israeli / Middle Eastern-related articles, including re-introducing edits made by previous socks (e.g. Gilles Ouaniche (talk·contribs) for one). The account, which was dormant since July, was also suddenly "resurrected" after their non-constructive edits were recently reverted, some of which were first introduced by previous socks of this sockmaster. John Yunshire (talk) 11:50, 24 September 2023 (UTC)[reply]
Yah, it's him. Also on proxies so CU doesn't show any sleepers, but I'm sure they're out there. Blocked and tagged. Closing. TonyBallioni (talk) 01:12, 25 September 2023 (UTC)[reply]
A bunch of accounts with similar editorial behavior and significant overlaps from previous socks and the sockmaster. John Yunshire (talk) 15:28, 17 October 2023 (UTC)[reply]
Blocked a few. They definitely match previous socks. I've left four (I think) I'm not absolutely sure on the others. HJ Mitchell | Penny for your thoughts? 16:55, 19 October 2023 (UTC)[reply]
Blocked some more. Closing. KevinL (aka L235·t·c) 03:18, 21 October 2023 (UTC)[reply]
In this comment, Orgullomoore says they were email canvassed by GS6. For me, sockpuppet email canvassing in the Israel-Palestine topic area is a big neon arrow pointing at this sockmaster.
G6 has some edit overlap with blocked socks including
New accounts whose only edits are to restore the edits of previous sock account Virief. Given the earlier reports on this user, it's clearly more of the same.
Likely. No sleepers immediately visible, which isn't to say there aren't any. Blocked and tagged. Closing. --Blablubbs (talk) 17:27, 1 November 2023 (UTC)[reply]
Another new account going straight into contentious editing and restoring edits by previous socks. One such example - Neilgartigan: 1 Anclafina: 2John Yunshire (talk) 21:06, 1 November 2023 (UTC)[reply]
This one clearly matches Neilgarigen and Fagerbakke, both of which are CU confirmed to Yaniv/AJH. Blocked. HJ Mitchell | Penny for your thoughts? 21:19, 1 November 2023 (UTC)[reply]
Tagged, closing. KevinL (aka L235·t·c) 16:58, 5 November 2023 (UTC)[reply]
Their last two edits look like WP:DUCK behaviour, reinstating edit-warring edits by the previous sock accounts: [196], [197]. (Compare first diff with [198] and [199], and compare second diff with [200] and [201], all made by blocked sock accounts.)
They do have a long-ish editing history before this, so it's possible this is an unrelated user, but given AndresHerutJaim's prolific socking it still looks plausible to me. The first diff linked above is especially difficult to explain away as unrelated.
CU can hopefully clear up, or perhaps some of the editors/clerks more familiar with AndresHerutJaim can confirm whether this account's earlier history also looks similar. R Prazeres (talk) 18:00, 3 November 2023 (UTC)[reply]
Pinging John Yunshire: if you have a moment to spare a quick look, maybe you'd have a better sense of whether this account's earlier history looks like AHJ. (I assume you have longer experience with this case than I do.) R Prazeres (talk) 18:06, 3 November 2023 (UTC)[reply]
To be honest I don't exactly have much of an experience with AHJ, it's only been a few weeks haha. Nevertheless, one of the few hints I realised is that AHJ often doesn't bother with user pages for their sock accounts, even those that have been around for quite sometime. However, there's no doubt that AHJ is lurking on this SPI, and they may change their modus operandi after reading this. While I'm not 100% on Homerethegreat, them restoring sock edits without any proper explanation such as on Who is a Jew? is quite telling. John Yunshire (talk) 22:25, 3 November 2023 (UTC)[reply]
Update: Another editor, Daveout, has continued the edit-warring of AHJ's socks at Who is a Jew? (see [202]). Unlike AHJ, they seem to be more chatty (see edit summary and their subsequent comments at Talk:Who is a Jew?), so I suspect it's more of shared POV issue than another sock, but noting here in case. R Prazeres (talk) 06:47, 4 November 2023 (UTC)[reply]
Neither of those are Yaniv/AHJ (its going to take some getting used to going back to AHJ) like in multiple ways. nableezy - 18:38, 4 November 2023 (UTC)[reply]
Gentle reminder that diffs should be included of the same behavior from already-blocked socks (e.g., diffs of the previously confirmed socks making the same edits). KevinL (aka L235·t·c) 06:19, 4 November 2023 (UTC)[reply]
Thanks for the reminder, I've inserted (underlined) the diffs to compare with. R Prazeres (talk) 06:37, 4 November 2023 (UTC)[reply]
Homerethegreat has restored edits made by previous socks; they restored an edit made by Patraviam (blocked by me per this SPI, 2 November section) that appears to originate with Gilles Ouaniche (CU blocked by Firefly as Yaniv) but they also have a longer and broader edit history than most of the obvious socks we've seen so far. @Kevin, what does the magic 8 ball say? HJ Mitchell | Penny for your thoughts? 12:53, 4 November 2023 (UTC)[reply]
Unlikely, CU says, compared with some patterns for other recent socks. Best, KevinL (aka L235·t·c) 18:30, 4 November 2023 (UTC)[reply]
Closing without action. KevinL (aka L235·t·c) 16:59, 5 November 2023 (UTC)[reply]
Merged and cleaned and tagged. Might be worth going through and systematically applying 500/30 protection. Closing. KevinL (aka L235·t·c) 06:20, 16 October 2023 (UTC)[reply]
Clerk assistance requested: I have just merged יניב הורון into AndresHerutJaim based on convincing evidence available on cuwiki ([203]). I'll leave it to clerks to determine whether changing tagging for all the accounts in the archive would be appropriate. I would also suggest that, given that (1) a number of users in the archive are locked already and so all of the socks constitute lock evasion and (2) the abuse here includes email abuse, a clerk consider requesting locks for all outstanding accounts in this archive that are not yet locked. Best, KevinL (aka L235·t·c) 22:42, 20 October 2023 (UTC)[reply]
Having talked with a steward, I'll back off the lock request. I also think re-tagging isn't necessarily worth it, but leave that to someone else's discretion. The one thing I'd still like a clerk to do is think about whether revoking email and TPA on all blocked socks would be worth doing. Best, KevinL (aka L235·t·c) 17:02, 5 November 2023 (UTC)[reply]
Restoring edits made by previously blocked socks above. They also include one-off accounts targeting individual articles to revert, but there are also accounts that have made multiple edits but nevertheless in identical behaviors in the Middle Eastern/Israeli/Abrahamic religions topic area. John Yunshire (talk) 06:32, 23 October 2023 (UTC)[reply]
CheckUser requested, Given this masters history, they are known to create accounts in the dozens, like above. CU is warranted just given that. Seawolf35 (talk) 22:31, 23 October 2023 (UTC)[reply]
Also, wouldn't the master be 3X banned by now. Seawolf35 (talk) 00:26, 24 October 2023 (UTC)[reply]
@Seawolf35: Out of curiousity, which master are you referring to? Makeandtoss (talk) 12:33, 24 October 2023 (UTC)[reply]
@Seawolf35: Ah, I just realized this lengthy page is one discussion about the same master, exceptional. These are dozens of users, something that is unlikely to be the work of a single individual. I will delay elaborating on a potential explanation until the check is completed. Makeandtoss (talk) 12:53, 24 October 2023 (UTC)[reply]
@Makeandtoss I am assuming you mean that this is part of a larger sock farm. Even so, the User who is the namesake of all of these cases is most likely behind at least 3 different instances of it. Anyway, doesn’t matter because they aren’t getting unblocked anytime soon. Seawolf35 (talk - email) 13:53, 24 October 2023 (UTC)[reply]
I am afraid sock farming, which describes individuals creating numerous accounts, is too conservative to describe the situation here (if it is confirmed fully). These are more than 50+ accounts, which is in no way one individual's work; this is sock puppetry on an industrial scale. Again, I will be waiting for the check before presenting my case. Makeandtoss (talk) 13:58, 24 October 2023 (UTC)[reply]
Additional information needed. Please provide diffs to substantiate your assertions. A quick glance suggests that there are probably grounds for suspicion for many of these, but – as e.g. the editnotice prominently points out – evidence is still required in order for us to justify a check. --Blablubbs (talk) 15:12, 1 November 2023 (UTC)[reply]
Just blocked two that appear to have been created to restore an edit made by a previous sock. HJ Mitchell | Penny for your thoughts? 15:18, 1 November 2023 (UTC)[reply]
Fred bowen-smith os interesting. Clearly not a new editor but his edits were reverted by various AJH/Yaniv socks. I've blocked another cluster that are all clearly related to Virief, who is related to previously blocked socks. HJ Mitchell | Penny for your thoughts? 15:36, 1 November 2023 (UTC)[reply]
Historicallibrarian keeps coming up in close proximity to a lot of the other accounts, including some I've blocked and some that are CU blocked, but their edits don't seem to be be the same. They're editing the same articles but I can't see them restoring the edits from previous socks. HJ Mitchell | Penny for your thoughts? 21:39, 1 November 2023 (UTC)[reply]
@Seawolf35: On the whole, we're still awaiting some additional diffs that might be helpful, if you have a moment to provide those. KevinL (aka L235·t·c) 18:39, 5 November 2023 (UTC)[reply]
No response. Checked accounts are blocked. Closing. Vanjagenije(talk) 10:30, 12 November 2023 (UTC)[reply]
TheDoodbly is often present in the usual articles infested by AHJ/Yaniv Horon's socks (e.g. Bar Kokhba revolt), with an identical behavioral stance. The rest are a bunch of one-off accounts restoring edits made by previous socks. Some are dormant (but Yaniv often returns to dormant accounts after their more recent ones are blocked), and the current active ones are Patraviam, ToaTahuNuva, Dedeborya and Joemb1977. Also notice how some accounts, such as, Patraviam, often engages in nonsensical editing 1, 2, 3 to up their edit count so that the account could edit semi-protected articles and restore sock edits (e.g. Patraviam, Gilles Ouaniche on Who is a Jew?) with their goal being able to disrupt extended-protected articles. John Yunshire (talk) 19:58, 2 November 2023 (UTC)[reply]
@John Yunshire I've blocked two. I'm struggling with the rest more than the other batches. I'd appreciate some help connecting the dots with these and the remaining unblocked accounts above. Thanks, HJ Mitchell | Penny for your thoughts? 23:14, 2 November 2023 (UTC)[reply]
Hi there, for one Dedeborya is now restoring edits made by previous socks especially on Bar Kokhba revolt. AHJ often returns to dormant accounts after their more active ones gets blocked, and that's how more concrete evidence of them gets established. I'm sure if I look further into them I could find more but considering the sheer amount of socks that they have, it seems futile and feels like playing Whac-A-Mole. Hence, I guess it's better to just deal with the more obvious ones until they eventually slip up. John Yunshire (talk) 22:39, 3 November 2023 (UTC)[reply]
@John Yunshire Please don't take this as criticism, I'm just trying to work out what criteria you used to come up with this list of accounts. The only thing I can tell that they all have in common is that they've all edited Bar Kokhba revolt at some point. Do you have diffs of any of the other accounts restoring sock edits? I've blocked Dedeborya, ToaTahuNuva, and Patraviam so far. HJ Mitchell | Penny for your thoughts? 14:07, 4 November 2023 (UTC)[reply]
I see that there is a long and sordid backstory to this, going back many years. I am new to this particular case but, from looking at the history of Association of German National Jews, I think that I can see a couple more possible socks: User:Gwslibrary and User:Clararudy. I'm not 100% sure but it might be worth checking those? Maybe run a checkuser? Also, I think it would be worth making a LTA case for this so that people know what to look out for. --DanielRigal (talk) 02:07, 3 November 2023 (UTC)[reply]
Note: for what it's worth, I reported Gwslibrary below (just a few minutes before the above comment). R Prazeres (talk) 02:11, 3 November 2023 (UTC)[reply]
Inclined to leave this unless there's evidence of a connection beyond new accounts editing the same article. For the record, from this list I've blocked:
I don't see a compelling case for any of the others, at least based on what's been presented so far. HJ Mitchell | Penny for your thoughts? 22:29, 5 November 2023 (UTC)[reply]
@HJ Mitchell: What about ToaTahuNuva? Why didn't you block that account? Are they not connected? Vanjagenije(talk) 10:31, 12 November 2023 (UTC)[reply]
Registered at 22:46, 5 November 2023 and in the same minute edits a template here, and again a couple of days later. AHJ has historically had troves of socks to make edits in CT topics that are not extended confirmed, see for example Dedeborya, registered at 03:07, 30 October 2023 and immediately edits in the topic. Nableezy 15:32, 7 November 2023 (UTC)[reply]
Jo-Jo Eumerus, sorry for the misspelling. nableezy - 19:16, 7 November 2023 (UTC)[reply]
Accounts such as Mokedbitar and Joemb1977 are definitely not new, with a focus particularly on Genocides in history (1946 to 1999) (1, 2, 3, 4, 5, 6) and Template:Genocide navbox (1, 2, 3) which is one of the primary topics (Israel-Palestine area) that the sockmaster feels strongly about. It is also suspicious that these accounts would often appear to reinforce and establish a false consensus, as well as to avoid the image of Dovidroth's edit warring, which makes me think they could be some meatpuppetry at play here as well, unless they could very well be all the same person. John Yunshire (talk) 23:50, 8 November 2023 (UTC)[reply]
Thank you for bringing this up. I was going to say something myself, but couldn't write up a sufficient enough request for my own standards. Salmoonlight (talk) 14:02, 9 November 2023 (UTC)[reply]
Mokedbitar and Joemb1977 are Likely, and now blocked. Dovidroth has previously been blocked in connection with this case and then unblocked (Special:Permalink/1184251242#Blocked). Reversing yet again would need more evidence than is on display here, in my opinion. CC Tamzin. --Blablubbs (talk) 15:21, 12 November 2023 (UTC)[reply]
Dovidroth is, on private evidence, verifiably a specific real-world person who I'm fairly sure is not AHJ. Doesn't mean this couldn't be meatpuppetry (again...), but as you say more evidence would be needed. -- Tamzin[cetacean needed] (they|xe|she) 15:52, 12 November 2023 (UTC)[reply]
I'm not seeing it with Dovidroth. They don't seem to fit the pattern of AHJ socks whichis why I didn't block them after the 23 October report. HJ Mitchell | Penny for your thoughts? 16:58, 12 November 2023 (UTC)[reply]
Restoring edits made by previous socks (JohnFroelich, Virief and Amichagoren; Dedeborya and Theadkr). Requesting CU as sockmaster is known to use multiple one-off accounts to restore sock edits in different articles. John Yunshire (talk) 15:39, 9 December 2023 (UTC)[reply]
Both very consistent with past socks from a technical perspective. Blocked. No unblocked sleepers immediately visible. Closing. --Blablubbs (talk) 22:44, 12 December 2023 (UTC)[reply]
IP from Buenos Aires who has suddenly appeared to helpremove content that goes against their presumably pro-Israel viewpoint on the article for Indigenous peoples. Salmoonlight (talk) 11:00, 18 December 2023 (UTC)[reply]
If it is AHJ, they'll likely never use this IP again, and the page has been ECP'd indef, so I don't see a need for a formal finding of fact here. (Although at a glance, behavorially "possilikely", as the CUs would say.) Closing. -- Tamzin[cetacean needed] (they|xe|she) 07:28, 22 December 2023 (UTC)[reply]
Special:Contributions/Cheezlander has only made 35 edits (many of which violate ECR for ARBPIA) and yet the 2 editors have edited 12 articles in common.
Obviously there may be many more accounts. Looking at a DB replica (up to end 2023) it looks like there are 34 blocked AHJ socks that registered after 2023-10-01 (listed below).
The Cheezlander account was created on 2023-12-27. I assume several undetected accounts were created in December looking at the account creation rate at the time. Sean.hoyland - talk 12:55, 19 January 2024 (UTC)[reply]
Likely from the technical side. Combined with the behavioural evidence I'm more than satisfied. HJ Mitchell | Penny for your thoughts? 14:08, 20 January 2024 (UTC)[reply]
I have received emails requesting edits on Israel-Palestine topics from this user at the same time as receiving emails from Patraviam and Ismuchon - likely part of this same sockpuppeteer. Apologies for not reporting this earlier as I do not usually use my email for Wikipedia - happy to forward any evidence on if required. GnocchiFan (talk) 18:00, 21 January 2024 (UTC)[reply]
Account apparently created to restore the edit of a previous sock, Cheezlander. This brand-new account also casually mentioned the BLP policy in its first edit summary, which is odd, and that edit summary was phrased somewhat similarly to the edit of the now-blocked sock whose edit it was restoring. I could be wrong, this could just be a random person who agreed with the edit in question, but it looks fairly odd. AntiDionysius (talk) 00:36, 31 January 2024 (UTC)[reply]
On the other hand, the first edit on this new account was a mobile edit, which does not appear to be this vandal's MO. AntiDionysius (talk) 00:40, 31 January 2024 (UTC)[reply]
I'm gonna say Possilikely (a mix between possible and likely). A single edit it not a lot of behavioural evidence to go on but there are technical similarities. I'd like a second opinion from someone who has more experience checking AHJ. Kevin, are you around today? HJ Mitchell | Penny for your thoughts? 14:41, 31 January 2024 (UTC)[reply]
I would call this Likely. Blocking. KevinL (aka L235·t·c) 17:10, 31 January 2024 (UTC)[reply]
Putting this on hold for now pending further investigation as I have failed to even convince myself of the evidentiary basis for the report. Sean.hoyland (talk) 03:52, 26 February 2024 (UTC)[reply]
Editor Interaction reports with blocked AndresHerutJaim socks.
I know this is closed, but having edited with Daveout before the name change this really surprised me. My best guess from the timeline here is created User7681 as a clean start and handed this account off. Cant explain the 0 edit sock though. nableezy - 00:38, 27 February 2024 (UTC)[reply]
I also had a look at this. I want to note that it looks like this account is either compromised or, more likely, being shared. It should be obvious why if you look at the CU data and behaviour with this in mind. BanyanClimber also has the following Confirmed accounts:
It doesn't look like these accounts have ever been operated by AndresHerutJaim, but given that the other account is either compromised or sharing their password I'm going to block them as well. Closing. Thanks, Spicy (talk) 22:47, 26 February 2024 (UTC)[reply]