Bigneeerman (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• Expertwikiguy (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: originally filed under this user)

• Bigneeerman (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Dark Juliorik (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• 不和の林檎 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• YouVeNeverSeenBetter (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

These three have in common the phrase "Seems to be not notable and without any reliable sources" (Bigneerman[1], Dark Juliorik[2][3][4], 不和の林檎[5]) which had never been used before until this week. They all follow the standard Expertwikiguy playbook of making numerous small edits with the VisualEditor and casting a large number of low-quality AfD !votes. Requesting CU to confirm and to look for others. Extraordinary Writ (talk) 21:40, 25 September 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Clerk endorsed - the consolidated timeline is also a good match. Please, check all of them. Thank you. MarioGom (talk) 06:08, 26 September 2022 (UTC)[reply]
• Added YouVeNeverSeenBetter - very similar without the specific phrase. MER-C 17:31, 26 September 2022 (UTC)[reply]
• Comment I've taken a look at these, but would appreciate it if another CU with experience of residential proxies would be willing to take a look. These accounts are all editing out of a lot of very different IP ranges. Each account uses ranges that geolocate to a particular country; some of the IP addresses they are using show as belonging to the same set of residential proxies, and they all look similar to one another in other ways. Girth Summit _(blether) 18:06, 26 September 2022 (UTC)[reply]
• Assirian cat (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) may be another. MER-C 19:09, 29 September 2022 (UTC)[reply]
• Formally relisting this per GS's comment. I believe RoySmith is familiar with this case? Thanks, Spicy (talk) 17:57, 1 October 2022 (UTC)[reply]

  Unfortunately, I had taken a look at this a couple of days ago and didn't make any progress. -- RoySmith (talk) 18:15, 1 October 2022 (UTC)[reply]

•  In progress... ~Oshwah~^{(talk) (contribs)} 20:44, 2 October 2022 (UTC)[reply]
•  Possible:

  Bigneeerman (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

  Dark Juliorik (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

  不和の林檎 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

 Inconclusive:

YouVeNeverSeenBetter (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

The three possible users are all, without a doubt, using a VPN. They bounce all around the world geolocation-wise, and nearly all of the ranges I looked into came back positive for VPN use in reports. The user agents are mostly of the same device family, but different browsers. No IP address ranges overlapped or directly connected any of the users. The inconclusive user used one range in one geo-location, where none of the IPs used had VPN use reported. Unfortunately, that's all the information that I can give. Resetting status back to 'completed', as  Behavioural evidence needs evaluation. ~Oshwah~^{(talk) (contribs)} 21:28, 2 October 2022 (UTC)[reply]

• Some findings and requested actions:
  • Bigneeerman, Dark Juliorik, 不和の林檎, and Assirian cat voted keep on the Maropost, which has been a repeated UPE target (including Bennet43 sockfarm in a previous creation). This overlap alone is quite suspicious.
  • All of them do simple gnoming and AFD copypasta votes. This is a frequent behavior in a few sockfarms, including SpareSeiko, Sanketio31, and Expertwikiguy.
  • These accounts have occasionally copypasted the same votes in different AFDs. Some also did rapid-fire AFD noms with copypasta rationales. Here's a summary table:

• • Based on the way edits interleaved on 2022-09-25, I think it is likely that Assirian cat and Bigneeerman are not the same person.
  • Based on AFD activity (table above) and CU results with respect VPNs, I think it is likely that Bigneeerman, Dark Juliorik, and 不和の林檎 are the same person.
  • While YouVeNeverSeenBetter looks quite similar to the others, I'm not so sure about what to make of it.
  • All reported accounts deviate from the expected timecard for Expertwikiguy [33]. This is far from excluding a relation to Expertwikiguy, but in the absence of further evidence, I think we should not assume the reported accounts are Expertwikiguy.
•  Awaiting administrative action Based on the above analysis, I moved the case to Bigneeerman. I recommend indefing Bigneeerman, Dark Juliorik, and 不和の林檎 (supected to Bigneeerman). No action for YouVeNeverSeenBetter and Assirian cat, without prejudice of any admin willing to act on their behavior beyond a specific relation to Bigneeerman or Expertwikiguy (e.g. AFD coordination or UPE). MarioGom (talk) 17:41, 9 October 2022 (UTC)[reply]
• Bigneeerman, Dark Juliorik and 不和の林檎 indeffed. Will have a look at the others w/r/t UPE. Closing. firefly ( t · c ) 17:52, 9 October 2022 (UTC)[reply]

• Dlerus Us (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Filmmaniac Tomik (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

For Dlerus Us: same AfD nomination statement, "Seems to be not notable and without any reliable sources", as used before. Suddenly returned to editing today with small, rapidfire edits to various articles also using the VisualEditor: [34][35][36]. Bridget (talk) 12:34, 11 October 2022 (UTC)[reply]

Filmmaniac Tomik returned to editing today, with rapidfire edits using the VisualEditor [37][38][39][40]. First revision of their userpage is very similar to that of this confirmed sock. They also cast a vote using rationale identical to above. Bridget (talk) 14:41, 11 October 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Awaiting administrative action - Given the timing, presented evidence, and timecards:  Looks like a duck to me. Please, indef both accounts. Thank you. MarioGom (talk) 22:44, 14 October 2022 (UTC)[reply]
• Blocked and tagged. MER-C 09:18, 15 October 2022 (UTC)[reply]

• Mambo Rumbo (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: original case name)

• 24.138.27.215 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

24.138.27.215 has 11 edits on Oct 19 and no other edits since 2008. 9 of those edits are to AfDs started by Mambo Rumbo. They are all on a similar topic and, of course, this could be someone trying to seem like Mambo Rumbo. I think a CU is needed to sort this out, but I don't know the SPI rules as well as I should... A quick look showed no similar instances of this in the past. Hobit (talk) 19:53, 23 October 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Ran a check to compare Mambo Rumbo to Wikipedia:Sockpuppet investigations/Bigneeerman/Archive. Results are not entirely conclusive because everyone's on proxy, though that's a datapoint too, and the specifics here make a connection relatively  Likely. I've blocked and tagged the account.  No comment with respect to IP address(es) --Blablubbs (talk) 20:28, 23 October 2022 (UTC)[reply]
• I've merged the two cases. --Blablubbs (talk) 11:33, 24 October 2022 (UTC)[reply]
• IP had a handful of edits a week ago and nothing since. Closing. -- RoySmith (talk) 13:28, 25 October 2022 (UTC)[reply]
• Note that the oldest account so far is Filmmaniac Tomik (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). MarioGom (talk) 23:11, 30 October 2022 (UTC)[reply]

• ProotaGhunch (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Request to undelete Draft:GuarantCo created by another sock of the master. UtherSRG (talk) 20:32, 16 May 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Stale  Behavioural evidence needs evaluation. Mkdw ^talk 21:42, 4 June 2023 (UTC)[reply]
• Not much behavioral evidence to evaluate.  Closing without action. Feel free to report again if there's new evidence. MarioGom (talk) 21:43, 9 June 2023 (UTC)[reply]