- NagalimNE (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Suspected sockpuppets
[edit]All 3 accounts were registered on October 8th within an hour of each other, [1][2][3] and started editing on the 27th or 28th [4][5][6]. As is obvious from looking at their contribs pages, these three accounts seem to be going through a list of biographies alphabetically (currently on the "B"s) and making repetitive pointless edits such as creating useless infoboxes [7][8][9] or tweaking talk page banners [10][11][12]. Interestingly, Tylerpanes and Stacypoled seem to have stopped at exactly 100 edits. I'm confident these accounts are related to each other, and this looks very much like an attempt at ECP gaming or account farming, so I'm requesting CU to check for others. Thanks to Russ Woodroofe for the tip. Spicy (talk) 23:27, 28 October 2021 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
- CheckUser requested and endorsed by clerk - per above. Thanks, Spicy (talk) 23:27, 28 October 2021 (UTC)[reply]
- In progress - -- RoySmith (talk) 01:30, 29 October 2021 (UTC)[reply]
- On purely technical evidence, I would call this Tylerpanes Confirmed to Stacypoled, and those two both Possible to Uptoniter, but given the obvious behavioral clues, and the fact that there's rampant proxy use, I don't have any problem calling everybody Confirmed. -- RoySmith (talk) 01:43, 29 October 2021 (UTC)[reply]
- Thanks, closing. Spicy (talk) 01:46, 29 October 2021 (UTC)[reply]
Suspected sockpuppets
[edit]Pro forma. --Blablubbs (talk) 19:28, 31 October 2021 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
- New day, new batch. Blocked and tagged. I note that When99equals999 is technically oldest (not sure if worth moving), and that I think this is likely Sanketio31 per [13][14], but it's hard to be sure (I tagged before I realised that the Sanketio link is pretty strong). I'm not going to move or merge quite yet in case others have different thoughts. I also note that I am suspicious of Jennffarzi (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), but not quite enough to block. Courtesy ping Bbb23, who has blocked a lot of accounts in the orbit of this group over the last few months. --Blablubbs (talk) 19:34, 31 October 2021 (UTC)[reply]
- Peneplavím (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), who has strong overlap here, also sets off some Sanketio alarm bells for me. --Blablubbs (talk) 19:48, 31 October 2021 (UTC)[reply]
- Also noting that my not endorsing this is not the result of me thinking they shouldn't be checked, but merely of my brain being pretty fried after going through the history of almost every article any of these accounts have ever edited. --Blablubbs (talk) 20:16, 31 October 2021 (UTC)[reply]
- @Blablubbs: I don't see any link between When99 and Sanketio31. BTW, as far as I can tell, all the Uptoniter socks use the visual editor, although When99, when they edited in 2019, did not. Anyway, I think they are two separate cases, although I suppose a checkuser might be able to confirm that.--Bbb23 (talk) 23:37, 31 October 2021 (UTC)[reply]
- @Bbb23: The primary link I see here is the shared and relatively unusual gaming technique of splitting things like infobox constructions into a number of unusually small edits to inflate the total count; they do it in a more repetitive way than most Sanketio socks did their gaming, but also in one that's far less work. Compare the edits of Pourswamo, who you blocked and tagged as a Sanketio sock some time ago. To me, this case looks like someone is trying to quickly restock their sleeper supply, presumably after having burnt a lot of them, and with the general pattern, the sheer number of accounts and the proxy use, I'm leaning "large UPE farm" over "unpaid LTA". Though I might just be seeing things because I've spent too much time on Sanketio. --Blablubbs (talk) 23:52, 31 October 2021 (UTC)[reply]
- (ec) @Blablubbs: I just think they are too different to be the same person. I'm not as familiar with Sanketio. I have no idea what was going through my head with Pourswamo at the time, but in looking at it now, I think I was wrong. :) I'm gonna change the tag. I don't know about proxies, but I still think a CU would be useful. There are non-stale accounts in both cases.--Bbb23 (talk) 00:00, 1 November 2021 (UTC)[reply]
- Welp, I looked again at Pourswamo a couple more:
- There are also a few instances of overlap with Quarterto500 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), whose editing pattern I also find concerning (and reminiscent of Sanketio). They pick the articles they do their gaming on by the same logic as Sanketio – that could probably be interpreted as supporting either a link or a spurious connection. In any case, you're right about the usefulness of CU. CheckUser requested and endorsed by clerk a check in the hopes that we can find some sleepers, and to see if these match the technical pattern shown in Wikipedia:Sockpuppet investigations/Sanketio31/Archive. Thanks. --Blablubbs (talk) 00:09, 1 November 2021 (UTC)[reply]
- Wingsswamp too. --Blablubbs (talk) 00:13, 1 November 2021 (UTC)[reply]
- How do you find all these?? I noticed a small piece of trivia. When they edit the articles, they use the visual editor, but at least some of the ones I just looked at, when they edit the Talk pages, they don't. I also noticed that some of these accounts are much more expansive than the ones I've blocked.--Bbb23 (talk) 00:23, 1 November 2021 (UTC)[reply]
- The visual editor thing is because it doesn't work on talk pages (yet) I think. Also, Lateurdu is another one. There might be a more efficient way to look for them, just not quite sure if it's feasible yet – I'll look into that tomorrow. --Blablubbs (talk) 00:34, 1 November 2021 (UTC)[reply]
- Plus Muirpuget, Morindefae, Presrenh, Philaudra, Yankelgar4u, Apselina, Podiaamit, Lirablock, Palmpeaks, Oscarpeffr, Gougeraced. --Blablubbs (talk) 01:20, 1 November 2021 (UTC)[reply]
- And Plumaron, Aboutcardy, Bakedryad thanks to GeneralNotability, who shared some preliminary check results with me off-wiki (everyone aside from this group is based on behaviour only). --Blablubbs (talk) 01:40, 1 November 2021 (UTC)[reply]
- In progress GeneralNotability (talk) 12:53, 1 November 2021 (UTC)[reply]
- Technical evidence suggests deliberate measures to evade scrutiny, CU is of variable use in identifying accounts. Unless I mention otherwise, the relationships between any two accounts should be considered Inconclusive. I can say that there is a particular fingerprint here that I didn't see any account deviate from, but said fingerprint is not especially strong.
- Uptoniter, Bakedryad, Aboutcardy, Wotantiman, Plumaron are all basically confirmed to each other
- Johannablurt == Aquadebbed
- Vasesjohn == Oxbownicer == Noisevales
- Banksletaq == Yearandbeast, Banksletaq is also Possible to Takrekaan (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Lateurdu == Culscohen (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Philaudra == Palmpeaks Gildablinks (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) == Oakstrouts (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) == Gildablinks (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), Possible sleepers Messyplough (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) and Roachwoman (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Apselina Possible to Seppel Protz (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- When99equals999 is Possilikely (a mix between possible and likely) to Thegreatphalanx (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- I do not believe Quarterto500 is related to this group.
- I also found Adolphe Lestrange (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) and Gausbertus (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) during the checks (inconclusive to each other and they don't share the infobox fingerprint, but both are engaging in the exact same style of image additions).
- I found a handful of possible zero-edit sleepers, but am not doing anything with them right now; in my opinion the risk of mis-blocking is too high.
- Behavioural evidence needs evaluation for the new accounts listed above, please. GeneralNotability (talk) 13:48, 1 November 2021 (UTC)[reply]
- @GeneralNotability: I have trouble reading the above results. First when you list a bunch of accounts in paragraph form rather than bullet form, my eyes glaze over. Is each paragraph of multiple users a "group"? Second, I'm lost as to the bottom line. How many masters do we have? At first, I assumed one master or maybe two (Uptoniter and Sanketio). Now I don't know if you made any technical determination on that or if there are other masters. Perhaps technically it's impossible to say, but if that's true, it would be helpful for you to say that. Sorry.--Bbb23 (talk) 13:59, 1 November 2021 (UTC)[reply]
- Bbb23, one bullet is one group of accounts that are confirmed to each other, but I am inclined to call them all Uptoniter. I'm pretty sure there is intentional evasion going on here that will make it impossible to mark most of these accounts "confirmed" and I think it would be excessive to tag them in small groups of confirmed accounts. As for Sanketio...I really can't say for sure one way or the other. There is some technical evidence linking the two, but there are enough differences that I'm not able to make a solid call. Perhaps Mz7 might have more to say? GeneralNotability (talk) 14:04, 1 November 2021 (UTC)[reply]
- @GeneralNotability: Thanks, that helps.--Bbb23 (talk) 15:39, 1 November 2021 (UTC)[reply]
- Here's another one: Imageseine (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). Blocked. --Blablubbs (talk) 14:01, 1 November 2021 (UTC)[reply]
- Along with Codysall (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). --Blablubbs (talk) 14:09, 1 November 2021 (UTC)[reply]
- Clerk note: I blocked most of the ones that GN found. Some for obvious reasons, Lestrange and Gausbertus because they are clearly gaming, clearly related to each other, plus coming up independently from each other in relation to accounts from the Uptoniter list is highly incriminating, and Protz because both the gaming and the spamming are blatant for that one. I'd appreciate second opinions on the remaining unblocked ones:
- My current inclination is to block Takrekaan, Carlcarterx, and Thegreatphalanx: Having technical overlap with a massive gaming farm while engaged in behaviour that looks a whole lot like UPE is more than just suspicious – but again, input from others is appreciated. --Blablubbs (talk) 14:40, 1 November 2021 (UTC)[reply]
- I just want to acknowledge that I am aware of this case, but I am currently swamped with work IRL, so I haven't gotten the time to dive deep here. Mz7 (talk) 04:22, 4 November 2021 (UTC)[reply]
- I think everyone who needs blocking is blocked. Closing. GeneralNotability (talk) 01:38, 14 November 2021 (UTC)[reply]
Suspected sockpuppets
[edit]The usual: [16][17][18][19]... --Blablubbs (talk) 17:02, 8 November 2021 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Suspected sockpuppets
[edit]Pro-forma filing, accounts are already blocked but I think another round of CU would be useful as it picked up some sleeper accounts last time. Usual infobox gaming behaviour. Thanks, Spicy (talk) 01:35, 14 November 2021 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Suspected sockpuppets
[edit]Looks like this is what happens when they're done gaming; see early contribs – exact same two rare and nontrivial gaming techniques. --Blablubbs (talk) 20:03, 22 November 2021 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
- On the off-chance this isn't Uptoniter, it's someone else blatantly gaming the system. Blocked but awaiting tags. I also note a very likely relationship to GermanKity; the timing here is extremely suspicious ([20][21]), and the editing pattern fits too. @GeneralNotability: Can I bother you for a check? Also courtesy ping Rosguill, who blocked GermanKity. --Blablubbs (talk) 20:15, 22 November 2021 (UTC)[reply]
- Available CU data says probably them: same proxy service, similar unusual technical fingerprint. Their browser version appears to have gone backwards compared to the two old accounts in the archives I spot-checked, but I believe that this is hypothesized to be a farm rather than one person, so that isn't necessarily a disqualifying factor. Oh, and GermanKity is Stale, nothing useful there. Tag as you feel appropriate, No sleepers immediately visible. GeneralNotability (talk) 02:28, 23 November 2021 (UTC)[reply]
- I think a relationship to GermanKity is somewhere between possible and likely, but I'm not confident enough to move. I'll move to NagalimNE and retag everyone. Also noting for the record: Keriwands (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), also part of this group, already blocked. --Blablubbs (talk) 17:06, 27 November 2021 (UTC)[reply]
- Done and closing. --Blablubbs (talk) 17:21, 27 November 2021 (UTC)[reply]
- AFC reviews undone. No concerns about the two new pages patrolled. MER-C 12:23, 28 November 2021 (UTC)[reply]
Suspected sockpuppets
[edit]All listed accounts were created on 3 January 2022, but all made their first and last edits on 24 or 25 December 2023, many on the same two articles (Atmospheric convection (edit | talk | history | protect | delete | links | watch | logs | views) and Audience measurement (edit | talk | history | protect | delete | links | watch | logs | views)). Behaviors look identical, with all listed accounts making rapid incremental changes (<2 minutes between edits, all generally related to grammar, e.g. removing an extra word, changing a single word, adding a missing word, removing extra space). All of the accounts use the edit summary "Copy Edit" on exactly two of their contributions (e.g. [22], [23], [24]). Appears to be some sort of sock farm; each account made a burst of ~15 edits in rapid succession, followed by a different account making a burst of ~15 edits, in exactly the order the accounts were registered. TheAustinMan(Talk ⬩ Edits) 21:49, 26 December 2023 (UTC)[reply]
- Added Wistoaks (talk · contribs), Roachherod (talk · contribs), WP:DUCK behavior match (e.g. "Copy Edit" edit summary on exactly 2 edits, rapid edits, editing the same pages as the other blocked users below). —TheAustinMan(Talk ⬩ Edits) 04:58, 27 December 2023 (UTC)[reply]
- Added Avoidgated (talk · contribs), Subslille (talk · contribs), Quacknimbi (talk · contribs), Dockbidet (talk · contribs), Zaireraftew (talk · contribs), Weakdeans (talk · contribs) – more ducks at Special:PageHistory/Avret Pazarları. —TheAustinMan(Talk ⬩ Edits) 04:58, 27 December 2023 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
@Spicy: looks like I mispelled Wistsoaks (talk · contribs). Behavioral match, overlap with Rhymehedge (talk · contribs) on Jung Bahadur Rana. —TheAustinMan(Talk ⬩ Edits) 16:28, 27 December 2023 (UTC)[reply]
- In progress... Spicy (talk) 22:44, 26 December 2023 (UTC)[reply]
- Mikeslink and Jedislowser are Confirmed. Obvious technical evasion measures are in play, which means that I cannot confirm most of these to each other, but they do look similar in a distinctive way and one that strongly suggests that they are up to no good. Behaviour, of course, is obvious. Blocked and tagged, closing. Thanks, Spicy (talk) 23:50, 26 December 2023 (UTC)[reply]
- As I expected, the rabbit hole goes deep. Found some more accounts with the same behaviour/technical signature.
- Subslille shows up with blocked accounts
- maybe incidental, maybe not. The added accounts look behaviourally and technically consistent. Spicy (talk) 11:09, 27 December 2023 (UTC)[reply]
Spicy (talk) 00:21, 28 December 2023 (UTC)[reply]