- Bodiadub (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Older archives were moved to an archive of the archive because of the page size and are listed below:
24 June 2022
Suspected sockpuppets
Pro forma. GeneralNotability (talk) 01:53, 24 June 2022 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
- All confirmed to one another and past socks.
Blocked and tagged,
Global lock(s) requested. GeneralNotability (talk) 01:54, 24 June 2022 (UTC)[reply]
02 July 2022
Suspected sockpuppets
Not entirely sure about these, so listing here for a second opinion. Some telltale signs present but not all plus some differences.
Articles:
СтереПашка made substantial edits to uk:Playrix which is a known Wikibusines client. See m:Talk:Wikiproject:Antispam#Wikibusines_round_3/m:Wikiproject:Antispam/Archives/2021/Wikibusiness. I also blocked a swathe of accounts last month that have been locked but not checked:
- Probably stale
[end] MER-C 12:50, 2 July 2022 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
- @RoySmith: Hello, could you please explain what Confirmed means and why you put me next to user RedyyLed? As for me, I don't use proxies, but mobile traffic mainly of Ukrainian telecom operators like Kyivstar. Maybe it will help, I don't know. I used to edit on Jan and Feb this year, and then paused due to well know circumstances. Please carefully check all my edits and what laptops and internet providers I use since my first edits and till now. I can send my ID if needed. --(W)rid(t)ing High (talk) 07:42, 7 July 2022 (UTC)[reply]
Clerk, CheckUser, and/or patrolling admin comments
Clerk endorsed - СтереПашка and Валентин Карпенко are probably stale and Geniemarket is not attached on enwiki. Of the other accounts, I see enough similarities to previous Bodiadub socks in editing patterns and cross-wiki behaviour to warrant a check (can explain why to CUs privately if it's not clear). Please CU to confirm and check for others. Note that three of these accounts have also been reported at WP:Sockpuppet investigations/Kuba Ali; I'll wait for CU results to determine whether or not these cases should be merged. Thanks, Spicy (talk) 23:06, 6 July 2022 (UTC)[reply]
In progress - -- RoySmith (talk) 01:55, 7 July 2022 (UTC)[reply]
- I'm afraid CU isn't going to help a lot here. I can say that RedyyLed is
Confirmed to (W)rid(t)ing High, but nothing else matches (spanning the two cases). My hunch is that most of the traffic is via proxies, so that's not going to help much. My suggestion is to (except for the two confirmed) ignore the CU data and look at the behavior. -- RoySmith (talk) 02:02, 7 July 2022 (UTC)[reply]
- Blocked СтереПашка, (W)rid(t)ing High and RedyyLed. The rest I am not sure of. MER-C 17:23, 7 July 2022 (UTC)[reply]
- OK, coming back to this. I'm confident Kuba Ali, Flytermit and Leksunski are related to each other and this case based on the obvious collaboration to keep a spam article as detailed by Rosguill below; the topic area (Ukranian companies); messy/spoofed CU data (consistent with previous results, e.g. Wikipedia:Sockpuppet_investigations/Bodiadub/Archive/1#07_February_2022); and the crosswiki editing pattern. Geniemarket is a cross-wiki SPA who created a Wikidata item for Hum3D and uploaded related images to Commons - this account is not attached here so there's nothing we can do about it, but it furthers the impression that this is cross-wiki spam. Tadeusz Wróblewscy made 2 somewhat promotional edits to the Hum3D article on enwiki (now deleted), but his crosswiki contributions are more interesting: see [1]. He created a page for Praca.pl on pl.wiki, which was created only two days later on ukwiki, by Валентин Карпенко... who also created uk:Hum3D! I am confident that all of these are Bodiadub socks.
Awaiting administrative action - please indef Kuba Ali, Leksunski, Flytermit, Tadeusz Wróblewscy, and Валентин Карпенко. The last one has no edits on enwiki but the cross-wiki evidence is obvious and a block will make it easier to request a lock. Thanks, Spicy (talk) 23:02, 27 July 2022 (UTC)[reply]
Blocked and tagged. Closing. --Blablubbs (talk) 23:11, 27 July 2022 (UTC)[reply]
- Thanks.
Global lock(s) requested. Spicy (talk) 23:17, 27 July 2022 (UTC)[reply]
06 July 2022
Suspected sockpuppets
Similar patterns of speech at Wikipedia:Articles for deletion/Hum3D, Flytermit's activity has been almost entirely limited to edits to the related article, Hum3D, created by Kuba Ali. Meanwhile, Leksunski appears to bee engaged in clear meatpuppetry with respect to the other two, as they disclose on their user page that they are a former employee of Hum3D and all of their efforts have been focused towards keeping that article. signed, Rosguill talk 17:32, 6 July 2022 (UTC)[reply]
- Given that the CU ended up inconclusive, I think that there is sufficient behavioral evidence for a block, but as I'm nominally involved due to participation at Wikipedia:Articles for deletion/Hum3D I'll leave it to someone else to make the call. signed, Rosguill talk 16:31, 7 July 2022 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
Clerk endorsed - These accounts have also been reported at WP:Sockpuppet investigations/Bodiadub. Besides the relationship between these accounts described in the filing, there are similarities to Bodiadub in the subject matter of their edits and the cross-wiki activity. Please compare these accounts to each other and the Bodiadub case. Thanks, Spicy (talk) 22:56, 6 July 2022 (UTC)[reply]
In progress - -- RoySmith (talk) 01:49, 7 July 2022 (UTC)[reply]
- Ostensibly
Unrelated, but perhaps better would be
Inconclusive due to proxy use. -- RoySmith (talk) 02:04, 7 July 2022 (UTC)[reply]
- After taking another look at this, I'm confident that this is Bodiadub, so I'm merging the case there. Spicy (talk) 22:57, 27 July 2022 (UTC)[reply]
Awaiting administrative action - see above. Thanks, Spicy (talk) 23:03, 27 July 2022 (UTC)[reply]
Blocked and tagged. Closing. --Blablubbs (talk) 23:14, 27 July 2022 (UTC)[reply]
20 July 2022
Suspected sockpuppets
While working on the CCI for KatBet, I came across this addition that was copied from Rivalry (film), and originally added by OrlaBan in March 2022 (OrlaBan was later blocked as a Bodiadub sock). I'm not familiar with this case overall, but looking into it some more I saw some similarities between KatBet and OrlaBan, including rapid additions of plot sections to film articles, copyright concerns, and the tendency to add a bunch of text across multiple edits, and then append a citation as a separate, final edit. DanCherek (talk) 17:00, 20 July 2022 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
- Seems plausible but I would wait until they create a spam page. MER-C 18:41, 20 July 2022 (UTC)[reply]
Inconclusive, obvious use of proxies. GeneralNotability (talk) 01:40, 21 July 2022 (UTC)[reply]
- They're very similar to OrlaBan, proxy use seals the deal.
Blocked and tagged. Closing. --Blablubbs (talk) 23:21, 27 July 2022 (UTC)[reply]
- Requested lock for this one too. Spicy (talk) 23:26, 27 July 2022 (UTC)[reply]
14 September 2022
Suspected sockpuppets
Seemingly a sockring of UPEs. Master creates Dominic McGregor, Pesding uploads image to commons. Pesding also edits Thomas Schaller (artist) which was edited and moved to mainspace by Ajaxauden. Requesting CU to see if it can uncover any more editors. SmartSE (talk) 14:32, 14 September 2022 (UTC)[reply]
- FYI @Praxidicae: SmartSE (talk) 14:47, 14 September 2022 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
Clerk endorsed - per filer's rationale. There's another behavioural similarity between these accounts that make me think they are related. Thanks, Spicy (talk) 23:55, 14 September 2022 (UTC)[reply]
In progress Dreamy Jazz talk to me | my contributions 08:52, 15 September 2022 (UTC)[reply]
Confirmed:
Likely to the above is Taratagaytayo (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Per WP:BEANS CU evidence suggests that these socks are Bodiadub. Dreamy Jazz talk to me | my contributions 09:21, 15 September 2022 (UTC)[reply]
Clerk assistance requested: - please determine whether this case is a behavioural match to Bodiadub. CU evidence supports the connection, but ensuring that the connection is also made by their edits is useful. Any clerk/CU/admin can contact me off-wiki to get the beans evidence. Dreamy Jazz talk to me | my contributions 09:24, 15 September 2022 (UTC)[reply]
- Not a clerk, but I've taken a look at these accounts and the Bodiabub ones and I do see some obvious similarities. I'll drop you an email to explain and you can share with any clerks. SmartSE (talk) 12:00, 15 September 2022 (UTC)[reply]
- Any CUs wanting to review the connection can check checkuser wiki under Taratagaytayo. Dreamy Jazz talk to me | my contributions 09:46, 15 September 2022 (UTC)[reply]
- Hmm, I'm fairly familiar with Bodiadub and I came to the conclusion that they don't really look like that case. They are editing about American topics rather than European ones, and there's not a lot of cross-wiki activity. I'd be interested in seeing Smartse's evidence. Thanks, Spicy (talk) 17:09, 15 September 2022 (UTC)[reply]
- I will email you Spicy with said evidence. Dreamy Jazz talk to me | my contributions 17:19, 15 September 2022 (UTC)[reply]
- OK, based on the additional information I've received I think this probably is Bodiadub and should be merged to that case. The merge will require an admin clerk. Thanks, Spicy (talk) 20:31, 15 September 2022 (UTC)[reply]
- If said admin clerk wants to see why, I can forward / I give permission to Spicy to forward on to said admin clerks. Dreamy Jazz talk to me | my contributions 20:32, 15 September 2022 (UTC)[reply]
- Moved the case myself. Dreamy Jazz talk to me | my contributions 21:41, 16 September 2022 (UTC)[reply]
- Tagged, requested locks, closing. Thanks, Spicy (talk) 21:51, 16 September 2022 (UTC)[reply]
01 November 2022
Suspected sockpuppets
See below. --Blablubbs (talk) 16:20, 1 November 2022 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
- Behavioural match to KatBet (talk · contribs)/OrlaBan (talk · contribs). On proxy, though there is something that somewhat corroborates a connection (notes on cuwiki).
Blocked and tagged,
Global lock(s) requested, closing. --Blablubbs (talk) 16:25, 1 November 2022 (UTC)[reply]
13 February 2023
Suspected sockpuppets
M.M.Kargan has been making edits to IATA (edit | talk | history | protect | delete | links | watch | logs | views), seeking to downplay sourced content about the its history. The IATA page was previously edited by Freoanlsji (talk · contribs · deleted contribs · logs · filter log · block user · block log), a confirmed sock of Bennet43.
M.M.Kargan has also edited other low traffic articles targeted by this sockmaster. See interaction timeline.
Finally, like other socks of Bennet43, M.M.Kargan has been active on low traffic pages of the simple English wiki in areas that are vulnerable to UPE. — BillHPike (talk, contribs) 23:07, 13 February 2023 (UTC) — BillHPike (talk, contribs) 23:07, 13 February 2023 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
Endorsed by a checkuser - this account is using proxies, but not exclusively I think; there is also some overlap with a couple of globally locked accounts. I'm not super familiar with this case - Blablubbs, any thoughts? Girth Summit (blether) 13:46, 14 February 2023 (UTC)[reply]
In progress. --Blablubbs (talk) 14:21, 14 February 2023 (UTC)[reply]
- @Girth Summit:
The CheckUser Magic 8-Ball says: It looks like they are consistently spoofing their technical information in ways not entirely inconsistent with Bennet43, but I can't be sure whether it's them. The overlap with the two globally locked accounts is probably a result of a shared proxy pool – those belong to ByteOr, cf. [2]. The username seems somewhat out of place for Bennet. I'd love to hear MarioGom's thoughts on behaviour. --Blablubbs (talk) 14:35, 14 February 2023 (UTC)[reply]
- Blablubbs: While there's a large overlap in gnomed articles by previous socks like Kerianshil, Treinakis, Einterhal, or Freoanlsji, and the simplewiki contribs are in-character, I'm not seeing any of the stronger signals I noticed most other socks. MarioGom (talk) 09:57, 18 February 2023 (UTC)[reply]
- Blablubbs and MarioGom: M.M Kargan's behaviour, especially prior to fall 2022, strikes me as very similar to certain Bodiadub socks such as KatBet (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) and OrlaBan (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). Spicy (talk) 16:35, 25 February 2023 (UTC)[reply]
- Good catch, Spicy. Blocked. --Blablubbs (talk) 11:50, 27 February 2023 (UTC)[reply]
- Thanks. Moved, tagged, requested lock, closing. Spicy (talk) 13:36, 27 February 2023 (UTC)[reply]
30 March 2023
Suspected sockpuppets
Same promotional cruft added to Softeq as previous sock Fairou (talk · contribs). [3] vs [4]. DatGuyTalkContribs 21:08, 30 March 2023 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
CheckUser requested and endorsed by clerk. MarioGom (talk) 22:07, 30 March 2023 (UTC)[reply]
- Somewhere between
Unrelated and
Inconclusive -- RoySmith (talk) 02:04, 31 March 2023 (UTC)[reply]
Awaiting administrative action - I think LarkJohn behavior is very ducky to Fairou: the overlap, the timeline between the previous block and the sign up, the edit summary style. It is somewhat different from some other past Bodiadub. It could be a different person (this is a company with, at least, two different editors, but probably more), or a different UPE. Either way, a block for sockpuppetry is due here. MarioGom (talk) 21:23, 12 April 2023 (UTC)[reply]
Blocked and tagged as suspected.
Global lock(s) requested, closing. Thanks, Spicy (talk) 22:51, 12 April 2023 (UTC)[reply]
03 July 2023
Suspected sockpuppets
F1 Anton (re)created Tomas Fiala, a founder of Ukrainian Dragon Capital (company), article about the company was created by Bodiadub sockpuppet Wellring. Wellring also edited article about Fiala in Ukrainian Wikipedia. F1 Anton also created Tokar.ua that is affiliated with the ukrwiki admin whom Wikibusnes tries to discredit regularly (case) and it seems to be part of some tricky game. Anntinomy (talk) 18:59, 3 July 2023 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
Inconclusive due to proxy use RoySmith (talk) 22:22, 3 July 2023 (UTC)[reply]
- Blocked as suspected. Closing. MER-C 16:54, 4 July 2023 (UTC)[reply]
04 November 2023
Suspected sockpuppets
Noonbecks created 18 September. First edit was precocious creation of a draft in sandbox 20 Oct, then moved quickly to main space. No further edits till 4 November: precocious recreation of Jason Dady at Jason Dady (chef), last created by blocked sock User:Coolscohan. Not sure if this merits a CU. Wikishovel (talk) 11:30, 4 November 2023 (UTC)[reply]
- Comment: COIN entry mentioned by Anntinomy below archived to Wikipedia:Conflict_of_interest/Noticeboard/Archive_190#Jeanie_Roland_and_her_restaurants. Wikishovel (talk) 20:18, 7 November 2023 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
17 December 2023
Suspected sockpuppets
Checked Puloylang for recreating Eric Sim at Eric Sim (lecturer). Spicy (talk) 00:51, 17 December 2023 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
- Puloylang is between
Confirmed and
Highly likely to the following accounts:
As a whole, this group is
Highly likely to Elizabethhope89 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) from the previous filing. All accounts
Blocked and tagged, closing. Thanks, Spicy (talk) 00:57, 17 December 2023 (UTC)[reply]
- Noting the following sockpuppets on Commons (uploading images used in deleted spam articles):
Special:Undelete/Draft:Tobias Zwingmann references the existing Wikibusines client Rapyd. There is no doubt this Elizabethhope89 group is Wikibusines. MER-C 02:24, 17 December 2023 (UTC)[reply]
03 January 2024
Suspected sockpuppets
- One account has written a promotional page about an app [5], and the other wrote about the founder [6], despite having no previous overlap.
- Both pages were created in unreasonably short amounts of time after the creator's last edit: BetterMe was written in three minutes, and Victoria Repa was written 18 minutes after the user's last edit.
- Both accounts were dormant (>3mo with no edits) until resurfacing within 8 days of each other [7] [8].
- Both accounts appear to have been engaging in some kind of rapid-fire gnoming [9] [10], including editing multiple articles in the same minute.
I suspect there is UPE going on here, so a check may be useful (but I'll leave that for the clerks to decide). Giraffer (talk·contribs) 12:49, 3 January 2024 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
In progress... As a start, these are technically
Inconclusive to each other: Unclear accident is probably using proxies, and AlexAmberst isn't. I thought this looked like Bodiadub behaviourally, based on the subject matter and the editing pattern (compare accounts like BoldBlueBike and OrlaBan). There are technical indications that this may very well be the case: AlexAmberst is using a range previously used by Bodiadub, although the range is large and busy. Keeping in mind the nature of the range, I have this group
Confirmed to each other and
Possilikely (a mix between possible and likely) to Alex, with behaviour that looks at least plausible:
- Macgrav sometimes uses proxies. Via RRingy, we have this
Technically indistinguishable group:
- These are all on the same Bodiadub range and most of them occasionally use proxies as well. Iknir bak looks a bit different behaviourally, and their userpage is interesting. The technical data for that account could indicate either account sharing or proxy use. I'm not done here and will return later. I would appreciate a more experienced CU looking over my shoulder; this is a rabbit hole, and there's a lot of activity on the main range that just seems odd. Spicy (talk) 02:14, 4 January 2024 (UTC)[reply]
Relisted for 2O on the relationship of these accounts to each other and Bodiadub and a check for anything I've missed. As I mentioned above, there's a lot of unusual activity on these ranges and I'm not sure what to make of it. Thanks, Spicy (talk) 11:24, 4 January 2024 (UTC)[reply]
- Noting that I've seen the ping; happy to take a look, though it might take me until tomorrow. --Blablubbs (talk) 16:49, 4 January 2024 (UTC)[reply]
- Thanks, Blablubbs. Here are some more thoughts from another angle:
- I'm fairly sure that this is Bodiadub now but I'll wait for your 2O. Spicy (talk) 21:58, 4 January 2024 (UTC)[reply]
- @Spicy: I'll follow up with some more specifics in private in a second, but the public TLDR is:
Thanks for making me run this; I am now stuck with 50 open tabs and at least as many questions
- Agree with your findings
- Also agree it's likely to be Bodiadup given behaviour and technical data
- The technically indistinguishable group is interesting, and I'm leaning blocks for most, but maybe not all
- You didn't miss any obvious others, but I see what you're talking about. The usefulness of CU there is limited to rough pre-selection, and behaviour will have to be the name of the game. --Blablubbs (talk) 15:21, 5 January 2024 (UTC)[reply]
- After consulting with Blablubbs, I've blocked most of these. I have left a few accounts unblocked because the combination of the technical and behavioural data was not quite enough to convince me, but I will leave this on checked in case someone sees something I don't. There's also
- who is
Possilikely (a mix between possible and likely) to everything above; they created Oleksii Buriachenko which was previously created on ukwiki by IgorTurzh, who is blocked for proxying for Bodiadub. See also wikidata:Q71385679 and Nouiop-i-i (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) (who is also Nouiop Bui (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)). Spicy (talk) 16:37, 5 January 2024 (UTC)[reply]
- Found and blocked:
Global lock(s) requested for all tagged accounts so far. MER-C 13:20, 6 January 2024 (UTC)[reply]
- I think I'm going to close this at this point, no objection to other admins blocking any of the unblocked accounts if they see something I do not. Spicy (talk) 23:45, 25 January 2024 (UTC)[reply]
- On reflection, I've blocked Genueze because the MO is identical to the accounts in the filing below. Spicy (talk) 10:45, 26 January 2024 (UTC)[reply]
12 January 2024
Suspected sockpuppets
I noticed that all 3 accounts were created only in 2023 and they don't have much consistent activity. They all have a few days of activities and then there's nothing. I also noticed they engage in disruptive behavior by constantly nominating articles for WP:PROD without proper justification. The most obvious being nominating article for having no references when there clearly is. For example two of the accounts nominated Georgy Darakhvelidze for PROD stating the same reason it had no source despite this being untrue.1&2
I also noticed they do not respond when people try to engage them in the talk page.
I am pretty sure there are other accounts as well but I haven't encountered them yet.
More examples:
34
5
6
7
8
9
Imcdc Contact 15:53, 12 January 2024 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
- CU is welcome to be as conclusive or inconclusive as it likes, as even without it these are obviously the same person, in view of various pieces of evidence, most of it not mentioned here. I might have blocked the first account for a limited time and the others indefinitely, had sockpuppetry been the only problem, but there is also a history of disruptive editing, so I shall block all three indefinitely. JBW (talk) 22:07, 24 January 2024 (UTC)[reply]
25 January 2024
Suspected sockpuppets
I'm filing this after a brief discussion at MediaWiki talk:Spam-blacklist#impossible.sg (permalink). These accounts, all listed in order of creation, were created, edited for a day or so, disappeared for a spell, then returned for 1 more day to make more edits. On this final day, somewhere in their edits, they sneaked in a spam link to impossible.sg, a digital marketing agency.
Given the patterns, both behavior and the timings of creation and the returns (2 on December 13, 1 on December 15, 1 on December 21, 1 on January 8, 1 on January 12, 1 on January 18, and final 1 on January 24), I believe these to be the actions of 1 or more people representing this digital marketing company. The link has been blacklisted and these accounts are unlikely to ever edit again, but would request checkuser in the likely case that there are sleepers and to see if any other links have been spammed by this company. Thanks! Apparition11 Complaints/Mistakes 14:11, 25 January 2024 (UTC) Apparition11 Complaints/Mistakes 14:11, 25 January 2024 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
In progress... Spicy (talk) 23:18, 25 January 2024 (UTC)[reply]
- Proxies, proxies everywhere.
- Nonetheless, these are
Confirmed to each other:
- Other accounts are technically
Inconclusive/possible MEAT, but the behavioural evidence is strong enough to block. (Thanks for the thorough filing).
- I think this is probably Bodiadub because of certain technical data and the vibes. See for example [20]. Spicy (talk) 23:27, 25 January 2024 (UTC)[reply]
Global lock(s) requested, closing. Thanks, Spicy (talk) 23:44, 25 January 2024 (UTC)[reply]
26 January 2024
Suspected sockpuppets
Following a thread of spamming the link oneidentity.com, these accounts turned up, largely with the same MO.
The accounts already blocked as socks who were spamming the link are:
Table of suspected socks:
oneidentity.com, dates are MDY
User |
Created on |
First edits |
Returning edits |
Spam diff |
Has edited since that day? |
Fits pattern?
|
Kuvullauri |
09/09/2022 |
09/09/2022 |
08/10/2023 |
[21] |
3 edits on 11/17/2023 |
Except for returning for 3 edits
|
TaniaJol |
09/04/2023 |
09/04/2023 |
09/04/2023, same day, no return |
[22] |
No |
No break, all edits on same day
|
AsterAski |
06/07/2023 |
06/07/2023 |
12/11/2023 |
[23] |
No |
Yes
|
Cultured Connoisseur |
02/13/2023 |
02/13/2023 |
09/19/2023, then 09/21/2023 |
[24] |
15 edits on 10/07/2023 |
Except for 2 edits 2 days before spam and came back for a few edits 15 edits on 10/07/2023
|
ShipaBenz |
11/08/2023 |
11/08/2023 |
11/08/2023, same day, no return |
[25] |
No |
Except for no break, all edits on same day
|
Lost in Social Media |
08/29/2023 |
08/29/2023 |
09/13/2023 |
[26] |
No |
Yes
|
3-2-4 start |
08/30/2023 |
08/30/2023 |
09/16/2023 |
[27] |
No |
Yes
|
Creatordrit |
10/26/2022 |
10/26/2022 |
08/09/2023 |
[28] |
No |
Yes
|
Gree0eerG |
02/09/23 |
02/10/2023 & 02/15/2023 |
08/17/2023, then 09/18/2023 |
[29] |
No |
Except for returning early for 6 edits on 08/17
|
AssiduousArchivist |
02/04/2023 |
02/04/2023 |
09/19/2023 |
[30] |
No |
Yes
|
DUstone Pack |
02/05/2023 |
02/05/2023 |
09/20/2023 |
[31] |
No |
Yes
|
Inquisitive inspector |
02/04/2023 |
02/04/2023-02/10/2023 |
08/17/2023, then 10/10/2023 |
[32] |
No |
Except for returning early for 12 edits on 08/17/2023
|
DedicatedDataDiver |
02/06/2023 |
02/06/2023 & 02/09/2023 |
10/11/2023 |
[33] |
No |
Yes
|
OperWordst |
04/06/2023 |
04/06/2023 & 05/21/2023 |
10/12/2023 |
[34] |
No |
Yes
|
Priteless |
08/13/2021 |
08/13/2021 & 08/27/2021 (7 edits), then 08/28/2023 |
12/11/2023 |
[35] |
No |
Except for waiting 2 years to finish their first round of edits
|
LoverOfHiking |
09/22/2023 |
09/22/2023 |
12/11/2023 |
[36] |
No |
Yes
|
Yiovy |
05/17/2023 |
05/17/2023-5/20/2023 |
12/12/2023 |
[37] |
No |
Yes
|
Naiwaar |
05/30/2023 |
05/30/2023-05/31/2023 |
12/13/2023 |
[38] |
No |
Yes
|
Création mythique |
06/13/2023 |
06/13/2023-06/14/2023 |
12/14/2023 |
[39] |
No |
Yes
|
Alioneidentity |
07/03/2023 |
07/03/2023 |
07/03/2023, , same day, no return |
[40][41] |
No |
No, only 2 edits, both spamming the link
|
Thanks! Apparition11 Complaints/Mistakes 21:01, 26 January 2024 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
onelogin.com is a clearly related domain that has also been spammed:
PakisOne has their own SPI: Wikipedia:Sockpuppet investigations/PakisOne (spam here: [42]).
Noting for the record that I have blocked recently:
See m:Talk:Wikiproject:Antispam#Wikibusines (2024). All are stale except for LotosL.
More spammers:
There are other signs that suggest Bodiadub is a plausible explanation for this spamming. MER-C 10:51, 27 January 2024 (UTC)[reply]
In progress... Spicy (talk) 15:22, 27 January 2024 (UTC)[reply]
Inconclusive due to proxy use, but sharing an interesting technical fingerprint with one another:
-
- This technical fingerprint does not match what I have previously seen from Bodiadub, but there's certainly a possibility that it could be the same operator. MEAT is another possibility.
Inconclusive due to proxy use, data more in keeping with Bodiadub, but generic:
-
- Same profile as above but
Confirmed to each other via shared proxy:
Confirmed to each other, not on proxy, technically
Unrelated to Bodiadub, but does not rule out MEAT:
-
Possilikely (a mix between possible and likely) to SarahYeasyLife group and internally
Confirmed, note editing pattern:
- I d like watch etc: this lot are behaviorally similar to the confirmed socks on 25 January 2024.
- SarahYeasyLife: ditto.
- UnTixic group: ditto.
- I think I've seen enough. I will block all as suspected that are not already blocked. Closing. MER-C 16:39, 28 January 2024 (UTC)[reply]
09 February 2024
Suspected sockpuppets
The first report performed a check but proxy usage prevented any further checking. All three accounts were banned based upon looking up the habits. I brought this information to ANI at the link here. There was some additional info I would like to bring up.
- This tickled a memory of a few accounts I saw in 2022, like <this one>. They would mass edit for stretches of time, all visual edits, and just add content to multiple pages - we eventually figured it was machine translated edits (or just sources) taken from other language versions of pages.
- These* edits* by UnTixic: <diffs>* are translating content from the German version of that page, some lines are exact matches to Google Translate output.
- These edits by PakisOne: <diffs> are translating content from the Swedish version of the page, the citation is also taken from there.
- This edit by Wyndhan Han: <diff> is a translated edit from the Swedish version of the page, translation is an 100% match to Google Translate output. The citations however are not from the Swedish version.
- I'm not claiming it's the same person, and I haven't looked deeply into most edits, a lot of the behaviour mentioned so far was not something I noticed in those 2022 accounts, but it just reminded me, so I'm mentioning it.
2804:F14:8085:6F01:B8CB:B95D:1E39:A7B1 (talk) 01:30, 19 January 2024 (UTC) (*edited 01:21, 20 January 2024 (UTC))
Now lets look at what13Joker13 (talk · contribs · deleted contribs · logs · filter log · block user · block log) has in common with previous ones:
I'm sure I can find more. But basically this seems to be another one of these accounts except now for Georgia. Wonder what checkuser will show this time.
Edit: Although not related to my investigation, I see PakisOne (talk · contribs · deleted contribs · logs · filter log · block user · block log) has also been connected to Spilled gunpowder (talk · contribs · deleted contribs · logs · filter log · block user · block log) and Omonaki Baula (talk · contribs · deleted contribs · logs · filter log · block user · block log) via Bodiadub (talk · contribs · deleted contribs · logs · filter log · block user · block log)
-
Imcdc Contact 13:08, 9 February 2024 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
- I merged this case to Bodiadub. 13Joker13 is on a proxy, as expected.
Blocked and tagged based on behavioural evidence,
Global lock(s) requested. Spicy (talk) 10:19, 10 February 2024 (UTC)[reply]
20 February 2024
Suspected sockpuppets
Another one of these users. Wonder how many are there? Basically has the same profile and posting habits as the one from last time (refer to that to get what can of posting style these accounts have) . Another 2023 low posting account that has disruptive edits. Here are some similar disruptive edits: 1,2 and 3 .Also have the check the validity of articles created too. I see one of the swedish articles is a direct google translate copy from Swedish wikipedia. Similar to the above banned user.
Guess he didn't like me getting his other accounts banned so he's trying to target my articles. Will the checkuser produce another proxy result? Imcdc Contact 12:08, 20 February 2024 (UTC)[reply]
Edit: User has been banned for vandalism now per ANI. - Imcdc Contact 02:06, 25 February 2024 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Adding sock Hndi Uui. Four minutes after account creation today, recreated Victoria Repa at Draft:Repa Victoria. Victoria Repa was last created by blocked sock User:AlexAmberst in January. Requesting checkuser, based on the weight of activity above. Wikishovel (talk) 09:55, 22 February 2024 (UTC)[reply]
- Comment: User:Marble cliffs should be checked w.r.t this case. They created BetterMe, which was previously deleted multiple times and recreated in multiple names. Victoria Repa is the CEO of BetterMe. Jeraxmoira🐉 (talk) 17:20, 25 February 2024 (UTC)[reply]
Clerk, CheckUser, and/or patrolling admin comments
- Hndi Uui is using a range previously used by Bodiadub.
Blocked and tagged,
Global lock(s) requested. လူကောင်း is
Inconclusive,
Behavioural evidence needs evaluation for tagging/locks. Spicy (talk) 17:05, 25 February 2024 (UTC)[reply]
Administrator note There are enough behavioral differences for လူကောင်း to skip tagging. Already indeffed as WP:NOTHERE. The WordsmithTalk to me 20:48, 4 March 2024 (UTC)[reply]
29 February 2024
Suspected sockpuppets
Looking here, it looks obvious. Shabukoy and Comasjeans777 were blocked as a sock of this farm. Tehonk (talk) 18:45, 29 February 2024 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
26 February 2024
Suspected sockpuppets
New account Lobster555 created 17 February. Three days after account creation, precocious creation of spammy Draft:Daniel Illescas, then moved to main space. No further edits, then five days later creates Mark Shaw (author), a nearly identical copy of Mark E. Shaw, created by the briefly busy new account Mushroom1498 (created 7 January), and deleted 23 February following AFD. Writing and editing styles of the two accounts are very similar. Both accounts are almost certainly part of a much larger sockfarm. Wikishovel (talk) 10:02, 26 February 2024 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
07 March 2024
Suspected sockpuppets
Checked Another day in the trench due to similar behaviour to the 26 January 2024 group and attempts to spam oneidentity.com [43][44]. Technical data is as expected. Correcting dwarf is
Technically indistinguishable with similar behaviour. Spicy (talk) 11:25, 7 March 2024 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
Blocked and tagged,
Global lock(s) requested, closing. Spicy (talk) 11:25, 7 March 2024 (UTC)[reply]
07 March 2024
Suspected sockpuppets
Created promotional page Jean-Michel Cazabat, Correcting dwarf is the only other major contributor. Similar edit pattern, likely spam here: [45].
Webedebe and Daphnerudler created fr:Jean-Michel Cazabat.
I also blocked Marble cliffs two days ago for recreating BetterMe, a known Wikibusines article. There is a clear Ukraine connection. MER-C 17:20, 7 March 2024 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
- Marble cliffs shares a range with the Elizabethhope89 group from past filings.
- The following are technically distinct from Bodiadub but very unambiguously
Confirmed to each other:
- Webedebe is likely on proxies
- There's not enough data for Daphnerudler to be sure of anything. Spicy (talk) 21:44, 7 March 2024 (UTC)[reply]
- Blocking the confirmed group, leaving open for behavioural investigation re. tagging & evaluation of the other two accounts. Spicy (talk) 21:53, 7 March 2024 (UTC)[reply]
- Insufficient behavioral evidence to block the remaining two accounts. Sockpuppetry is possible, but there are also other possibilities. Closing this with no prejudice against filing a new one if those accounts start acting suspect.
Requested actions completed, closing The WordsmithTalk to me 02:42, 8 March 2024 (UTC)[reply]
23 March 2024
Suspected sockpuppets
Author of the suspected UPE article Rentberry Inc.. They were one of the two of the substantial contributors to Biosphere Corporation, the other one is the Bodiadub sock Wellring (talk · contribs · deleted contribs · logs · filter log · block user · block log). (I am not providing specific diffs, the histories of the mentioned article provide a better view than individual diffs.) Janhrach (talk) 18:53, 23 March 2024 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
Add
as authors of interwiki versions. I have also blocked the following accounts for historical spam:
There is one recent account:
blocked for recreating Englishdom (platform) (see m:Wikiproject:Antispam/Archives/2021/Wikibusiness#E). MER-C 10:14, 24 March 2024 (UTC)[reply]
Add Telegramjbwwiki (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) for recreating Wowcube cross-wiki. MER-C 20:14, 24 March 2024 (UTC)[reply]
- Behavioral evidence isn't strong enough to suggest a link to Bodiadub.
Closing without action The WordsmithTalk to me 23:31, 4 April 2024 (UTC)[reply]
15 April 2024
Suspected sockpuppets
Very first action was to request undeletion of Eren-Verdi Asrin. Which has been edited by numerous Bodiadub-linked socks.
JohnGomezDeSantos created Eren-Verdi Asrin. JohnGomezDeSantos very first action was to edit Shota Nakajima who is a chef in Top Chef. Wikiwarrior222's edits also deal with Top Chef /celebrity chefs.
Possible that JohnGomezDeSantos and Wikiwarrior222 are part of Bodiadub's sock network, or are related to each other.
Either way there is possible UPE. Classicwiki (talk) If you reply here, please ping me. 00:06, 15 April 2024 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
- The following are
Highly likely to the Elizabethhope89 group in the archives:
23 April 2024
Suspected sockpuppets
Both accounts created Dragon Capital (company). Equine-man (talk) 07:05, 23 April 2024 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
19 May 2024
Suspected sockpuppets
SPA Zuri K23 created 10 May, only edits so far are spammy recreation of Stewart Kyasimire at Stewart Kyasimire (filmmaker) via draft. Last created by blocked sock User:CosmicJourneyer. Wikishovel (talk) 07:14, 19 May 2024 (UTC)[reply]
- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
Confirmed to each other and
Highly likely to this case:
- Dreamy Jazz talk to me | my contributions 21:15, 19 May 2024 (UTC)[reply]