Wikipedia:Sockpuppet investigations/EunikaSylviane/Archive

Add links
From Wikipedia, the free encyclopedia


EunikaSylviane

EunikaSylviane (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

03 January 2021[edit]

Suspected sockpuppets[edit]


The three accounts were created today within a span of a few minutes, and display exactly same editing behaviour. They created the respective sandboxes first with the content "This is my sandbox I’m going to make a page here" or something similar "Hi This is my I’m going to make a page here." If you see the diffs of the edits made to the sandboxes, you'll find exactly similar pattern and style of editing. Here are the diffs:

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Ashleyyoursmile, I was going to tell you about something I was trialing if things went smoothly after a week, but the 'possible spambot' section of User:Pahunkat/Usernames to watch may be useful. I doubt much will come out of the SPI though since these accounts haven't done anything particularly bad yet. Thanks, Pahunkat (talk) 12:13, 4 January 2021 (UTC)[reply]
Pahunkat, thanks so much for your response, I am glad that you were also keeping an eye on them. What you are saying completely makes sense, they haven't edited anything since yesterday so I'm thinking if I made a rather impulsive decision. Maybe would've been better to wait and watch before documenting this report. --Ashleyyoursmile! 14:40, 4 January 2021 (UTC)[reply]
Ashleyyoursmile, that's fine - I think they're trying to get autoconfirmed in which case the next 4 days will be interesting. LuK3 blocked the 'user-' prefixed accounts which may be linked to these new ones, since I haven't seen any ones with the same pattern today. Thanks, Pahunkat (talk) 15:28, 4 January 2021 (UTC)[reply]
Ashleyyoursmile - knew it, they were gaming autoconfirmed and are presently targeting the article Realjamesh. Added all known accounts from the list. Pahunkat (talk) 21:16, 7 January 2021 (UTC)[reply]
CU requested to find sleepers, definitely a case of abusing multiple accounts in parallel. Pahunkat (talk) 21:22, 7 January 2021 (UTC)[reply]
Two things - firstly, I think the 'user-' prefixed accounts on 'possible spambots' are linked, because they day after they were blocked by LuK3 the above accounts were created, and after these were left alone I haven't seen any others that exhibit the same behaviour. Secondly, article has just been extended-protected (up from semi). Pahunkat (talk) 21:29, 7 January 2021 (UTC)[reply]
Pahunkat, wow, looks like they were indeed waiting to get autoconfirmed. Thanks for reporting the other socks and requesting CU. Good job in blue-locking Realjamesh. Ashleyyoursmile! 07:00, 8 January 2021 (UTC)[reply]
I would like to point out that several of these users have also been vandalizing User talk:Realjamesh, with one coming along to revert an edit that is clearly cleaning up vandalism. Builder018 (talk) 21:35, 7 January 2021 (UTC)[reply]
Yep, thanks for helping there along with JJPmaster. They might or might not know of another potential target connected to the subject, but I'll keep it watch listed per WP:BEANS instead of saying it here since I highly doubt they'll know of it's existence. Pahunkat (talk) 21:58, 7 January 2021 (UTC)[reply]
For clerks conducting behavioral investigation - look at the initial 10 edits of each of the accounts. Pahunkat (talk) 22:03, 7 January 2021 (UTC)[reply]
 Note: I seem to have intercepted a file containing names of new sock-puppet accounts, this picture appeared on a Discord chat informally hosted by some fans of James of which I nor James has any control over. Please see the picture here. It looks like the password for the accounts are their aswell and they exibit similar behavior to that of the accounts above, presumably to get 'autocomfirmed' to be used for vandalism later. I'd also like to take this opportunity to truly apologise on behalf of James and JEM for the insane disruptive editing that followed the creation of his article and talk page and I'd like to thank every volunteer that dealt with it. Thanks, (I have a COI with this topic, please see my userpage) Emmeline Williamson45 (talk) 15:57, 8 January 2021 (UTC)[reply]

I've typed out the name when I was going through their contributions if this makes it easier:

Lara Nélida Bette Henny Eugen Stelian Shantanu Tonia Jonathan Mumbi

Thanks for letting us know. This is obviously an off-wiki action rather than plain sockpuppetry. What is also interesting is that the master's been globally locked for Long-term abuse and one of the socks was just CU blocked by Ponyo. Pahunkat (talk) 16:03, 8 January 2021 (UTC)[reply]

Thanks, for context the picture was sent by an unidentified 'fan' with a comment saying he had 'bought' them, suggesting the creation of these accounts is automated? I hope this helps although I suspect if they find out about this exposure we'll have to create another discord account to gain entry! (We (JEM) nor James control the server so we rely on people allowing us in to moderate group chats) (I have a COI with this topic, please see my userpage), Emmeline Williamson45 (talk) 16:16, 8 January 2021 (UTC)[reply]


It's a shame they didn't mention the volunteers that spent time reverting the edits on this article. (I have a paid COI with JEM Media, for more details visit my userpage). --Emmeline Williamson45 (talk) 11:43, 9 January 2021 (UTC)[reply]
More socks are being created:

Pahunkat (talk) 11:52, 12 January 2021 (UTC)[reply]

Girth Summit, there are two accounts which are still active:

Pahunkat (talk) 12:35, 12 January 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

 Confirmed to each other:
AzaliyaDory (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
NarayanAyna (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) (found when checking)
The rest are  Possilikely (a mix between possible and likely). The geolocation bounces between countries, but are in the same region. They are all on the same user agent, but a very common one. Leaving case for behavioral investigation. ~Oshwah~(talk) (contribs) 22:01, 7 January 2021 (UTC)[reply]

12 January 2021[edit]

Suspected sockpuppets[edit]

Accounts created after previous socks had been blocked and tagged. Same pattern and style of editing. Opened their sandbox at first with "Hi Wikipedia I cant wait to make a page here". Looks like they are waiting to get auto-confirmed again. Diffs of first 10 edits exactly same as all previous socks.:

and same for all. Ashleyyoursmile! 14:26, 12 January 2021 (UTC)[reply]

Additional suspicious account- Peter Karoline (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
This user triggered the edit filter trying to perform edit on while editing this SPI. See special abuse log for this user. So I'm also reporting them. No similarity in contribs though. Ashleyyoursmile! 16:02, 12 January 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Sock drawer is being refilled again. Pahunkat (talk) 14:38, 12 January 2021 (UTC)[reply]
I'm going to add some more users below. I posted one example of these users earlier but now I'm going to post them all. These were originally created, then blocked by LuK3, and the day after they were blocked the new accounts came.

They exhibit the same sort of user space spamming and given the timing I'm confident they're the same person. Pahunkat (talk) 15:11, 12 January 2021 (UTC)[reply]

Girth Summit, I hate to ping you again - but would you be able to block the latest batch of socks? Thanks, Pahunkat (talk) 15:18, 12 January 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • This is a bit of a bizarre case. Via CU I can say that Peter Karoline is  Confirmed to Name.len43, Gauti Shivali, and Aris Franciszka. However, the technical data for this case suggests that this may be a coordinated effort by multiple people rather than just a single user creating a lot of accounts. It's possible this is a UPE operation in progress. All accounts  Blocked without tags, closing. Mz7 (talk) 19:51, 12 January 2021 (UTC)[reply]

13 January 2021[edit]

Suspected sockpuppets[edit]

Same behaviour going on here, expect more to come. Pahunkat (talk) 09:14, 13 January 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Lots more SPI disruption filter log entries from IPs. Pahunkat (talk) 12:10, 13 January 2021 (UTC)[reply]

  • I've added few more. Lets see how many more still left. Ashleyyoursmile! 13:05, 13 January 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

16 January 2021[edit]

Suspected sockpuppets[edit]

Doesn't this account need a CheckUser, or is it done already? 

DarkMatterMan4500 (talk) (contribs) 14:06, 16 January 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

It's been blocked, and probably should be globally locked as with the rest of the socks. The admin who blocked it probably deleted their sandbox as well, since I can see no contribs. A CU probably won't be helpful here since the last CU hinted that this was likely an off-wiki effort. Pahunkat (talk) 15:56, 16 January 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Red X Unrelated as far as checkuser evidence goes... ~Oshwah~(talk) (contribs) 01:32, 19 January 2021 (UTC)[reply]
  • When I checked this account previously, I noted that this is probably a group of multiple people coordinating together (WP:MEAT) rather than just one person, so the negative CU result doesn't surprise me. CU will probably have limited usefulness in this case moving forward. Closing as the account is already blocked. Mz7 (talk) 01:59, 19 January 2021 (UTC)[reply]

17 April 2021[edit]

Suspected sockpuppets[edit]

Sigh. See their sandbox. Bound to be others, I'll see what I can find. Pahunkat (talk) 11:04, 17 April 2021 (UTC)[reply]

Right, added more. See their sandboxes as well. Pahunkat (talk) 11:13, 17 April 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Here are some more ducks that have come post admin request by Blablubbs:

Pahunkat (talk) 20:33, 17 April 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Yep, obviously. Pink clock Awaiting administrative action – please block the lot. Redirect arrow Global lock(s) requested as well. Blablubbs|talk 11:55, 17 April 2021 (UTC)[reply]
    • @Blablubbs: All are now blocked. --Malcolmxl5 (talk) 13:21, 18 April 2021 (UTC)[reply]
      • Many thanks, Malcolmxl5 – can I ask why you blocked them all without talk page or email access? Either way,  Tagged and closing. Blablubbs|talk 14:13, 18 April 2021 (UTC)[reply]
        • I took the view that a user who is globally locked has forfeited the ability to use these functions; they will lose them in any case when these accounts are globally locked. P.S. I came here by way of AIV where three IP were bot-reported after trying to blank this page; see the filter log. --Malcolmxl5 (talk) 15:03, 18 April 2021 (UTC)[reply]
          • That's true (and I don't object) – I was just wondering if there was past abuse there. Thanks for the filter log heads-up; for future reference, I'm listing the IPs below (there are quite a few); they geolocate all over the place, though I do note that some of them are on the same range and that there's a cluster in Eastern Saudi Arabia, mostly Saudinet IPs. Best, Blablubbs|talk 16:45, 18 April 2021 (UTC)[reply]
long list of IPs

18 April 2021[edit]

Suspected sockpuppets[edit]

New phrase in sandbox, same MO. Will add more below. Pahunkat (talk) 09:20, 18 April 2021 (UTC)[reply]

More added, I think that's all but it would help if an admin/SPI clerk could sweep something that I don't have the privileges to (BEANS BEANS BEANS) which I could provide by email. Sorry if some users are duplicated. Pahunkat (talk) 09:34, 18 April 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Hey Blablubbs, these are accounts created by what appears to be a group of people who are fans of a youtuber. The accounts make ten useless edits in their sandbox to game autoconfirmed - pretty sure their next target is James Haworth (which happens to have the same name as the youtuber), previously it was the TP of the youtuber's Wikipedia account. Pahunkat (talk) 14:18, 18 April 2021 (UTC)[reply]

Blablubbs, I'm pretty certain that they use a sort of program to generate a random name and get the ten edits, with the actual person behind each account only needing to solve the captcha. Past remarks seem to indicate that the people behind these are communicating and coordinating their attempts by a discord server. Pahunkat (talk) 14:25, 18 April 2021 (UTC)[reply]
Blablubbs, sent the email. Thanks :-) Pahunkat (talk) 14:46, 18 April 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Yep, more of same. Really curious about what exactly is going on here. Pink clock Awaiting administrative action – please indef the lot. Redirect arrow Global lock(s) requested. Blablubbs|talk 14:15, 18 April 2021 (UTC)[reply]
    @Pahunkat: Interesting. What's curious to me is that per CU this is largely MEAT rather than socking proper, but they all use real names (somewhat reminiscent of spambots) and use the exact same method for gaming autoconfirmed (down to the phrases they use), which suggests extremely close coordination. Blablubbs|talk 14:21, 18 April 2021 (UTC)[reply]
    @Pahunkat: some people really do have strange hobbies... Anyway, would you mind emailing me your BEANSy sweep idea? Thanks and best, Blablubbs|talk 14:31, 18 April 2021 (UTC)[reply]
    @Pahunkat: Thanks, replied :). Blablubbs|talk 14:57, 18 April 2021 (UTC)[reply]
  • Looks like Malcomxl5 got the second group too (thanks!) –  Tagged, closing. Blablubbs|talk 16:34, 18 April 2021 (UTC)[reply]
    • And two more IPs, that’s five today; see edit filter. --Malcolmxl5 (talk) 16:37, 18 April 2021 (UTC)[reply]

19 April 2021[edit]

Suspected sockpuppets[edit]

More of the same sandbox spam. Pahunkat (talk) 18:18, 19 April 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I’ll add to that:

--Malcolmxl5 (talk) 20:47, 19 April 2021 (UTC)[reply]


Clerk, CheckUser, and/or patrolling admin comments[edit]

  • This case is being reviewed by Blablubbs as part of the clerk training process. Please allow him to process the entire case without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate.
    Yep, all them. No new IPs today. Pink clock Awaiting administrative action – please indef the lot. Redirect arrow Global lock(s) requested. Blablubbs|talk 20:53, 19 April 2021 (UTC)[reply]

21 April 2021[edit]

Suspected sockpuppets[edit]

Sandbox spam, immediately after getting autoconfirmed editing User:Realjamesh. Pahunkat (talk) 18:19, 21 April 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • This case is being reviewed by Blablubbs as part of the clerk training process. Please allow him to process the entire case without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate.
    Und täglich grüsst das Murmeltier. It's them, no other accounts seen through the method Pahunkat mentioned a few filings back. Pink clock Awaiting administrative action – please block the sock indefinitely. Thanks and best, Blablubbs|talk 18:33, 21 April 2021 (UTC)[reply]
  • Actually, we can just skip the blocking part. Lock requested and received,  Tagged, closing. Blablubbs|talk 18:54, 21 April 2021 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/EunikaSylviane/Archive&oldid=1019140707"