- Jaktheladz (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Suspected sockpuppets
[edit]Similar edits and edit summaries. Compare Special:Diff/957361611 with Special:Diff/957363347; see also Wikipedia:Administrators'_noticeboard/Incidents#MOS DATE violations. Request CU for confirmation and sleepers. Mdaniels5757 (talk) 17:12, 4 June 2020 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
- I've added Loopylu101 (talk · contribs). I saw the ANI report mentioned above, and it rang a bell. Again, similar edits, particularly putting commas in dmy dates, and edit summaries: e.g. Special:Diff/960516744, which I reverted a day or two ago. cheers, Struway2 (talk) 19:04, 4 June 2020 (UTC)[reply]
- Wow, thanks so much for looking. Do you think a relist could be useful to determine the master, or don't bother? --Mdaniels5757 (talk) 00:38, 5 June 2020 (UTC)[reply]
- Note: FYI, working on an edit filter for this. (of course, I can't test it, but that's a matter for another time). --Mdaniels5757 (talk) 01:23, 5 June 2020 (UTC)[reply]
This case is being reviewed by RoySmith as part of the clerk training process. Please allow him to process the entire case (including admin actions against suspected socks) without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate.
- Clerk endorsed - @Callanecc: Identical edits cited by diffs. Edorsed -- RoySmith (talk) 21:25, 4 June 2020 (UTC)[reply]
- In progress - Mz7 (talk) 22:22, 4 June 2020 (UTC)[reply]
- The data for these accounts is extremely messy—nevertheless, it is one of the deepest CU rabbit holes I've ever seen. A large number of different IP ranges are involved, and I strongly suspect there is a previous master involved that we have an SPI case on, but I couldn't find who it is. The following accounts are Confirmed to each other:
- There are almost certainly more accounts than those listed above, but I am not sure whether it is worth the time to keep looking. Here are some characteristic user pages: [1][2][3][4][5][6]. Almost all of these accounts exclusively specialize in "improving grammar", "adding wikilinks", or "adding citation". Mz7 (talk) 00:16, 5 June 2020 (UTC)[reply]
- Mz7, Wow, that's crazy. This has to be something automated (bot farm?) What's really weird is I looked at most of the timecards; they're all strictly Monday-Friday, 0800-1800 UTC. Why would somebody build a bot farm that kept hours like that? And why to do silly things like insert punctuation in dates?
- Well, unless you're going to hunt for more of them, I'll rename this to Jackgknight and block the bunch of them.
- Gotta love Chasem%s as a username :-) -- RoySmith (talk) 01:08, 5 June 2020 (UTC)[reply]
- To me, this looks like Cliff1911 (talk · contribs), a longtime user who never communicated and, after finally being blocked, retired the account and began socking elsewhere. There should be some ANI threads about this. He's not the only WP:ICANTHEARYOU account I've seen blocked. I don't think it's a bot, I think it's just somebody who thinks they're doing the right thing and doesn't care how many accounts they have, or even know it's an issue. As for "they're all strictly Monday-Friday, 0800-1800 UTC. Why would somebody build a bot farm that kept hours like that?" - the obvious answer to me is it's a school or college, that all use the same externally facing IP. Ritchie333 (talk) (cont) 11:18, 5 June 2020 (UTC)[reply]
- Ritchie333, Interesting idea, but the timecard is all wrong. -- RoySmith (talk) 13:48, 5 June 2020 (UTC)[reply]
- I think the latter idea can be ruled out. Some (many?) of these users are doing weekly intercontinental travel (or some other weird thing). -- zzuuzz (talk) 18:48, 6 June 2020 (UTC)[reply]
- Could these be UPE socks? Draft:Linzi Boyd is likely to be spam in progress. MER-C 09:42, 6 June 2020 (UTC)[reply]
- I think that has to be strongly considered. -- zzuuzz (talk) 18:48, 6 June 2020 (UTC)[reply]
- @Callanecc: I don't think we're going to make any more progress here. I suggest we just block the list above as confirmed to Bowtiebandit and close this for now. -- RoySmith (talk) 01:29, 7 June 2020 (UTC)[reply]
- If no one minds, I'd like to explore this rabbit hole a bit further. I'd suggest placing it on hold for one week, and if no further progress is made by then feel free to close. In the meantime, take whatever action is deemed appropriate. For the record, without some decent explanation (and it should be a good one) I see something not good going on here. -- zzuuzz (talk) 10:53, 7 June 2020 (UTC)[reply]
- Zzuuzz, I'm torn between 1) blocking everybody that's been found so far to prevent further damage, and 2) waiting until you're done because it's likely you'll find an even older account and we'll have to rename this again; Bowtiebandit already fell to Jackgknight in the first batch, and Jackgknight to Jaktheladz in the next batch. Unless somebody has some strong opinion to the contrary, I'm going to hold off. -- RoySmith (talk) 12:44, 7 June 2020 (UTC)[reply]
- It may be easier to hold off for now. Some of these remind me of Wikipedia:Sockpuppet investigations/Kickingback77/Archive. @Bri: -- zzuuzz (talk) 12:54, 7 June 2020 (UTC)[reply]
Here's the additional Confirmed accounts. I've no doubt there are some undetected older accounts out there somewhere, but this particular CU swamp has been drained.
Indef them all. This is a highly systematic attempt to avoid scrutiny, along with some use of proxies, and the stench of UPE. Multiple people using shared accounts is a remote possibility, but I think probably not. As for the sockmaster, I remain convinced that these resemble the sock farm uncovered in the later stages of Wikipedia:Sockpuppet investigations/Kickingback77/Archive, however, that SPI is quite messy and I am not persuaded that these actually relate to the Kickingback77 account. Identification of the name of the sockmaster, and perhaps what these socks are really up to, shall be up to others. -- zzuuzz (talk) 11:06, 8 June 2020 (UTC)[reply]
- Zzuuzz, Thanks for all that work. You said, "Identification of the name of the sockmaster ... shall be up to others". My plan is to rename this to Jaktheladz. Oh, and BTW, I checked all the new ones you found, exact same timecard behavior. -- RoySmith (talk) 12:18, 8 June 2020 (UTC)[reply]
- Sounds good to me. -- zzuuzz (talk) 12:31, 8 June 2020 (UTC)[reply]
Suspected sockpuppets
[edit]
Behaviorally and per account name formula, these SPAs appear to be part of the sock group.
- Carlos Devine immediately following Chasem%s [7]
- TraceStewart immediately preceding Chasem%s [8]
- AdamSolune wedged between the other two [9]
- Time deltas between account creation:
- AS and TS: 48 hours
- ZC and SB: 24 hours
- SB and CD: 20 hours
ZoeyChandler2 and SusseBrocolli42 not so sure about, but also SPAs on same powerlifting article. ☆ Bri (talk) 22:56, 9 June 2020 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
This case is being reviewed by RoySmith as part of the clerk training process. Please allow him to process the entire case (including admin actions against suspected socks) without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate.
- @Callanecc and Bri: The socks are all stale, so there's not much we could do here. Also, of the dozens of socks we looked at previously in this case, 100% of them confined their editing to a strict time and day-of-week window, which these don't fall into. Even if we decided they were the same user based on behavior, it's unlikely we'd block an account that hadn't edited in so many months. -- RoySmith (talk) 23:16, 9 June 2020 (UTC)[reply]
- Closing, no action taken. -- RoySmith (talk) 23:17, 9 June 2020 (UTC)[reply]
- Looking at the history of the Marcus Yap article for example, and given the close overlap between the accounts, I wouldn't be at all surprised if these were also related to the group of socks. However, as RoySmith mentioned, they have not edited in several months, so although it is useful to note them in the record, I don't think we need to block them now. Mz7 (talk) 07:20, 10 June 2020 (UTC)[reply]
Suspected sockpuppets
[edit]Edit summary usage and other behaviour seem to be consistent with other members of the sockfarm; Rose Water Sailor also has a strong overlap with Jaktheladz socks here; Spekelspiegel has overlap here. Requesting CU for sleeper check. — Blablubbs (talk • contribs) 14:33, 24 September 2020 (UTC)[reply]
- Addendum: The accounts' timecards ([10] [11]) are also consistent with the farm. Monday to Friday only, and mostly in the (UTC) afternoon and evening. And once again, a hat tip to an anonymous friend whose help was invaluable. — Blablubbs (talk • contribs) 14:59, 24 September 2020 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Suspected sockpuppets
[edit]
General behaviour and edit summary usage extremely consistent with the farm (can give more details if needed, but would prefer to do so privately for BEANS reasons). Draconinae has a bunch of overlap with Jaktheladz socks on Cera Care and overlaps with Land Down Over on Jean-Paul Jauffret. Sandals With Socks (great name by the way) overlaps with ExtraSmallShirt on Pierre Omidyar. Requesting CU since a sleeper check was effective last time. Blablubbs (talk • contribs) 21:00, 25 November 2020 (UTC)[reply]
- zzuuzz, looking at Special:PageHistory/Paul-Peter Tak, Clownfish Anemone Symbiosis (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) is probably a sock as well. There are a bunch of stale socks in that history too. Mind keeping this open for a bit in case I find any others? Blablubbs (talk • contribs) 22:47, 25 November 2020 (UTC)[reply]
- also adding FlipFlopBan (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). Blablubbs (talk • contribs) 22:53, 25 November 2020 (UTC)[reply]
- I'm going with a Yes for those two. Thanks. -- zzuuzz (talk) 23:19, 25 November 2020 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
- zzuuzz, Blablubbs is Peanut Butter Wookies (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) related? Very similar style of edit summaries and overlap with Draconinae on Mahiben Maruthappu. 192.76.8.81 (talk) 00:07, 26 November 2020 (UTC)[reply]
- I've looked at this one and planned on throwing it in the ring, but I'm less sure about this one than I am for some of the others. I'd call it behaviourally likely, but there is some divergence in more recent edit summaries – but I'd say it's strong enough to merit a check. Blablubbs (talk • contribs) 00:13, 26 November 2020 (UTC)[reply]
- Blablubbs I thought the edit summaries on Mahiben Maruthappu tied the accounts together quite well; Draconinae added a section to the article, an IP removed it then Peanut Butter Wookies turns up a day later to tidy up the formatting and leave a snarky edit summary about the removal. It seemed a rather odd coincidence to me. 192.76.8.81 (talk) 00:25, 26 November 2020 (UTC)[reply]
- Technically, that one is Possilikely (a mix between possible and likely), but I also agree that it largely matches the behaviour. -- zzuuzz (talk) 00:34, 26 November 2020 (UTC)[reply]
- On second thought, yeah. Pretty convinced. Thanks. Blablubbs (talk • contribs) 00:35, 26 November 2020 (UTC)[reply]
- Blablubbs I do apologise, I made a mistake and got some diffs mixed up. It wasn't Draconinae that added that section to the article, the claim that he was the 'Founder' of the UKMSA (which the IP objected to) was added by ChocolateSprinkles42 (another Jaktheladz sockpuppet) in this diff. [12]. 192.76.8.81 (talk) 00:46, 26 November 2020 (UTC)[reply]
- zzuuzz, RoySmith, it looks to me like this swamp has largely been drained – barring any objections from 192.76.8.81, I think we can close this. Thanks for the hold. Blablubbs (talk • contribs) 01:17, 26 November 2020 (UTC)[reply]
- Can we keep it open for just a little bit longer, I might have found a few more accounts. 192.76.8.81 (talk) 01:21, 26 November 2020 (UTC)[reply]
- While we're on the Peanut butter theme Like PB and J (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) is a WP:DUCK that got missed. Not edited in a year but should probably still be blocked. Very similar edit summaries to the other accounts [13] (especially more recently) and until 2019 they had a Wikipedia adventure + sentence userpage [14], as the other accounts did, noted by Mz7 here [15]. Overlap with other socks on Paul-Peter Tak.
- Also stale but suspicious is Duckstodog1 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) Created a sentence + Wikipedia adventure Userpage [16], did a bunch of trivial edits to pages to get autoconfirmed status then made several huge additions to Paul-Peter Tak tag teaming with Like PB and J. More recent edit summaries are very similar to other socks.
- That's all I'm afraid, I though I found a non-stale account but I was mistaken. 192.76.8.81 (talk) 01:56, 26 November 2020 (UTC)[reply]
- Yep, definitely Jaktheladz. Those were the stale ones I was referring to above. Littlebowlofnuts (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) too, for what it's worth. Blablubbs (talk • contribs) 01:59, 26 November 2020 (UTC)[reply]
- Missed that one! In that case it seems the article Paul-Peter Tak has only had about 5 edits that aren't sockpuppets or bots! 192.76.8.81 (talk) 02:04, 26 November 2020 (UTC)[reply]
- Yep, it's a sock-infested nest if I've ever seen one. I know of a handful other stale Jaktheladz socks (with larger farms, you often find some accounts that were abandoned for whatever reason), but I didn't bother reporting them because reports for stale accounts usually don't get actioned. On a tangential note, I think we should actually be blocking stale UPE accounts, a) to prevent reactivation (some farms like reviving super-old sleepers) and b) for documentation purposes; having tagged socks in an article history makes it way easier for people who may examine it in the future to wrap their heads around the goings-on (and might hence help to associate future accounts with relevant farms). In case anyone with a block button wants to indulge that train of thought, I can list those accounts here. Best, Blablubbs (talk • contribs) 13:00, 26 November 2020 (UTC)[reply]
- Had time to look at my list, noting for future reference that the other stale socks are
- Blablubbs (talk • contribs) 19:57, 26 November 2020 (UTC)[reply]
- Blablubbs I just spotted Duckstodog (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) too. Seems like an obvious Duck - someone wasn't feeling particularly creative when making the Duckstodog1 account. Also wikipedia adventure + sentence userpage and similar edit summaries. 192.76.8.81 (talk) 20:02, 26 November 2020 (UTC)[reply]
- Yep, good catch. The TWA thing speaks volumes too. Blablubbs (talk • contribs) 20:04, 26 November 2020 (UTC)[reply]
- Blablubbs They couldn't even be bothered to come up with a new sentence! [17], [18].
- RoySmith Is it worth blocking these accounts before this case is archived? While they've not edited recently a lot of these are long term sock puppets (some have been here since 2015) so it's possible they might be reused in the future. 192.76.8.81 (talk) 20:32, 26 November 2020 (UTC)[reply]
- None of those have edited in at least 6 months. In general, we don't bother blocking accounts that old. -- RoySmith (talk) 21:11, 26 November 2020 (UTC)[reply]
The following accounts are Jaktheladz:
As always, it's possible there's more sleepers, so scrutiny of the edits from these accounts is welcome. -- zzuuzz (talk) 22:39, 25 November 2020 (UTC)[reply]
Suspected sockpuppets
[edit]Same distinctive edit summary patterns, timecards and other hints (recent events have really catalysed my BEANS-anxiety, please ask me off-wiki if unclear). LargeLemon is clearly part of this farm ([19][20][21]); Ms. Monopoly is a lower-confidence guess given different edit summaries, but is clearly linked to LargeLemon through overlap on rather obscure articles ([22][23]) and has some other overlap with JTL here.
--Blablubbs|talk 09:18, 5 April 2021 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Suspected sockpuppets
[edit]These three accounts overlap on Amanda Staveley and have a very distinctive edit summary style [24][25][26]. I think these accounts are related to Jaktheladz based on the edit summaries, usernames and the general MO (would rather not provide more details here per BEANS, but I can elaborate on this if you're unsure). Requesting CU for other accounts & to confirm the relationship. Thanks, Spicy (talk) 15:03, 5 August 2021 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
- In progress - ~TNT (she/her • talk) 15:32, 5 August 2021 (UTC)[reply]
- Previous socks of this master are Stale, so I've primarily tried to focus on the relationship between these three accounts. It's certainly
((possible)) they could be related to each other, but this would depend on proxy use, of which I can't see any evidence of either - my gut says given some other technical oddness, there's potentially some evasion going on. You're going to have to go on behavioural evidence alone. ~TNT (she/her • talk) 15:53, 5 August 2021 (UTC)[reply]
- Checkuser note: Noting for future CUs that this appears to be the end of the "CU data line", as all confirmed socks are now stale. ~TNT (she/her • talk) 15:53, 5 August 2021 (UTC)[reply]
- The plot thickens. I was asked to review the IPs a bit more extensively for VPN/proxy usage - I've checked a few per user, and there are strong indications that these are proxies. On that technical basis, I'd say this moves towards these listed accounts being Likely the same person. Apologies for the ping zzuuzz, but you've very familiar with this case - would you mind giving it a look? ~TNT (she/her • talk) 16:36, 5 August 2021 (UTC)[reply]
- What I've seen, everything fits. We can't use the word 'confirmed', but this is such an unlikely set of factors that we can probably use the next best word, whatever that is. -- zzuuzz (talk) 18:08, 5 August 2021 (UTC)[reply]
Suspected sockpuppets
[edit]
I'm going to have to be extremely vague because we are clearly seeing attempts to evade detection. I am happy to provide details via email, IRC or Discord though. I will say this: All of these accounts share some fairly obvious behavioural similarities with each other, and the history of some of them shows how they behaviourally diverge from the main Jaktheladz cluster over time. I am convinced that there is enough to have a look at the three accounts above; there is also Cold Omelette (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) who I am somewhat less sure about (though I think that a relationship is likely enough to mention them here), so I'll refrain from endorsing a check directly, though I would ask the reviewing checkuser to consider checking that account as well. --Blablubbs (talk) 16:24, 6 August 2021 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
CheckUser requested and endorsed by clerk and ping @Zzuuzz: In case you want to have a look. --Blablubbs (talk) 16:24, 6 August 2021 (UTC)[reply]
- Bearing in mind checkuser can sometimes be an art form, I would describe Vintage Suburbia as stale, but you gotta admit it looks likely, and the other three accounts as likely. -- zzuuzz (talk) 20:31, 9 August 2021 (UTC)[reply]
- Thank you zzuuzz. If the three non-stale ones are likely, then they are almost certainly == Jaktheladz and == Vintage Suburbia. Awaiting administrative action – please block the lot. I'm happy to provide beans off-wiki if needed. --Blablubbs (talk) 13:36, 10 August 2021 (UTC)[reply]
- Blocked, Blablubbs. Cabayi (talk) 07:59, 11 August 2021 (UTC)[reply]
- Thanks. Tagged, closing. --Blablubbs (talk) 09:06, 11 August 2021 (UTC)[reply]
Suspected sockpuppets
[edit]
Obvious match to the latest cohorts. Compare with Giant Green Olive and ThreePeaceLilies. MarioGom (talk) 09:47, 7 September 2021 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Suspected sockpuppets
[edit]
See naming pattern, identical timecard [27], edit summary change around April/May 2021. Requesting CU for a sleeper check, which was not successful in previous reports, but you never know when they'll screw up with proxy switching. MarioGom (talk) 14:15, 24 October 2021 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.