Wikipedia:Sockpuppet investigations/Мадина Омарова/Archive

Suspected sockpuppets
Obvious socks, creating the same questionable templates (the master created Template:Article for move, Гулпият Мадина Омарова created Template:Article for move/doc, ditto with Template:Article for protection and Template:Article for protection/doc), nominating pages for deletion for the same questionable reasons (Гулпият Мадина Омарова, 45.132.253.56, 176.98.158.31) * Pppery * it has begun... 16:19, 4 July 2022 (UTC)


 * @Bbb23 Both IP's have now edited again, one copying and pasting an unblock request from the socks' talk page, the other making an essentially identical unblock request. 192.76.8.85 (talk) 19:49, 5 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked and tagged the named accounts. The IPs haven't edited in several days, so no action. Closing. Bbb23 (talk) 19:12, 4 July 2022 (UTC)

Suspected sockpuppets
Obvious from username. Arado Ar 196 (C✙T) 15:33, 6 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked, tagged, closing. Bbb23 (talk) 16:18, 6 July 2022 (UTC)

Suspected sockpuppets
Obvious from username and edits. Johnj1995 (talk) 18:23, 7 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked, tagged, closing. Bbb23 (talk) 18:37, 7 July 2022 (UTC)

Suspected sockpuppets
Obvious from username. Arado Ar 196 (C✙T) 12:56, 11 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked, tagged, closing. Bbb23 (talk) 13:08, 11 July 2022 (UTC)

Suspected sockpuppets
WP:DUCK. Obvious from the name and contributions. 192.76.8.85 (talk) 18:06, 14 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked, tagged, closing. Bbb23 (talk) 18:10, 14 July 2022 (UTC)

Suspected sockpuppets
Obvious from username. Can someone please do something to stop this guy from socking every three days? * Pppery * it has begun... 13:10, 17 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked, tagged, closing, but see the CU request below. Bbb23 (talk) 13:19, 18 July 2022 (UTC)

Suspected sockpuppets

 * ( original case name)

Obvious based on user name and edits. Requesting checkuser to check for other accounts and to see if it would be possible to put a range block in place. 192.76.8.85 (talk) 08:36, 18 July 2022 (UTC)
 * My request for checkuser didn't get saved for some reason (it displayed OK in the preview!) and an edit filter is now preventing me from requesting it.

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
I've added a CU request per the IP's comments.--Bbb23 (talk) 13:17, 18 July 2022 (UTC)
 * Blocked and tagged. Bbb23 (talk) 13:20, 18 July 2022 (UTC)
 * - came here via AIV, there are a load of confirmed socks, give me a minute. Girth Summit  (blether)  14:29, 20 July 2022 (UTC)
 * The following are all ✅:
 * They are all blocked already, I will tag. Closing. Girth Summit  (blether)  14:40, 20 July 2022 (UTC)
 * Moving to oldest account, retagging.  Girth Summit  (blether)  14:43, 20 July 2022 (UTC)
 * They are all blocked already, I will tag. Closing. Girth Summit  (blether)  14:40, 20 July 2022 (UTC)
 * Moving to oldest account, retagging.  Girth Summit  (blether)  14:43, 20 July 2022 (UTC)
 * They are all blocked already, I will tag. Closing. Girth Summit  (blether)  14:40, 20 July 2022 (UTC)
 * Moving to oldest account, retagging.  Girth Summit  (blether)  14:43, 20 July 2022 (UTC)
 * They are all blocked already, I will tag. Closing. Girth Summit  (blether)  14:40, 20 July 2022 (UTC)
 * Moving to oldest account, retagging.  Girth Summit  (blether)  14:43, 20 July 2022 (UTC)
 * They are all blocked already, I will tag. Closing. Girth Summit  (blether)  14:40, 20 July 2022 (UTC)
 * Moving to oldest account, retagging.  Girth Summit  (blether)  14:43, 20 July 2022 (UTC)
 * They are all blocked already, I will tag. Closing. Girth Summit  (blether)  14:40, 20 July 2022 (UTC)
 * Moving to oldest account, retagging.  Girth Summit  (blether)  14:43, 20 July 2022 (UTC)
 * They are all blocked already, I will tag. Closing. Girth Summit  (blether)  14:40, 20 July 2022 (UTC)
 * Moving to oldest account, retagging.  Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  14:43, 20 July 2022 (UTC)
 * They are all blocked already, I will tag. Closing. Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  14:40, 20 July 2022 (UTC)
 * Moving to oldest account, retagging.  Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  14:43, 20 July 2022 (UTC)
 * They are all blocked already, I will tag. Closing. Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  14:40, 20 July 2022 (UTC)
 * Moving to oldest account, retagging.  Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  14:43, 20 July 2022 (UTC)

Suspected sockpuppets

 * ( original case name)

Similar username, first edit on both accounts was to place the welcome template on their own user talk pages showcasing a familiarity with Wikipedia Lavalizard101 (talk) 11:22, 26 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - This should be moved to Sockpuppet investigations/Мадина Омарова. Bbb23 (talk) 12:28, 26 July 2022 (UTC)
 * Done. and  for sleepers; there are a bunch of obvious ones, many of which are not (yet) locally attached:
 * (unattached)
 * (unattached)
 * (unattached)
 * (unattached)
 * (unattached)
 * (unattached)
 * Some of these are blocked on Commons, so it probably makes sense to start locking them. --Blablubbs (talk) 21:19, 26 July 2022 (UTC)
 * -  Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  21:50, 26 July 2022 (UTC)
 * ✅ to :
 * is, from a technical perspective, and obviously them based on everything else. is only , based on the CU data. Accounts listed above that I haven't mentioned have not edited this project, so I can't comment on them. There are no unblocked accounts on any of the IPs I have looked at.  Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  22:10, 26 July 2022 (UTC)
 * ,, closing. --Blablubbs (talk) 22:53, 26 July 2022 (UTC)
 * -  Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  21:50, 26 July 2022 (UTC)
 * ✅ to :
 * is, from a technical perspective, and obviously them based on everything else. is only , based on the CU data. Accounts listed above that I haven't mentioned have not edited this project, so I can't comment on them. There are no unblocked accounts on any of the IPs I have looked at.  Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  22:10, 26 July 2022 (UTC)
 * ,, closing. --Blablubbs (talk) 22:53, 26 July 2022 (UTC)
 * is, from a technical perspective, and obviously them based on everything else. is only , based on the CU data. Accounts listed above that I haven't mentioned have not edited this project, so I can't comment on them. There are no unblocked accounts on any of the IPs I have looked at.  Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  22:10, 26 July 2022 (UTC)
 * ,, closing. --Blablubbs (talk) 22:53, 26 July 2022 (UTC)
 * is, from a technical perspective, and obviously them based on everything else. is only , based on the CU data. Accounts listed above that I haven't mentioned have not edited this project, so I can't comment on them. There are no unblocked accounts on any of the IPs I have looked at.  Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  22:10, 26 July 2022 (UTC)
 * ,, closing. --Blablubbs (talk) 22:53, 26 July 2022 (UTC)

Suspected sockpuppets
Similar username, first edit on both accounts was to place the welcome template on their own user talk pages showcasing a familiarity with Wikipedia, as last time. 1234qwer1234qwer4 11:07, 1 August 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Seems likely based on username, but probably can't block solely based on that, as the user has no substantive contributions. Requesting CU. <span style="font:bold 15px 'Bradley Hand','Bradley Hand ITC';color:#044;text-shadow:0 0 4px #033,0 0 10px #077;"> —&#8288;Scotty Wong &#8288;— 14:15, 1 August 2022 (UTC)
 * I'm satisfied it's them (along with ), so . CU is to look for others and see what can be done on the IP block side. I note that
 * and
 * are also likely to be connected, but I have not blocked those yet. --Blablubbs (talk) 14:30, 1 August 2022 (UTC)
 * - -- RoySmith (talk) 14:39, 1 August 2022 (UTC)
 * and are ✅ to .  As a second group,  are all ✅ to each other, but ostensibly ❌ to the first group.  Our proxy detection tools are drawing a blank on the IPv6 /128 they're all using.  My inclination would be to assume our proxy tools are just not perfect.  A couple of other random thoughts, however.  One is that it's less common to see proxies on IPv6 than on v4.  The other is that this geolocates to a city which is not someplace you would expect to see people using the Cyrillic alphabet.   I'll leave the blocking and tagging to you. -- RoySmith (talk) 15:07, 1 August 2022 (UTC)
 * Interesting. Well, the usernames (one of which includes a direct transliteration of the n-word) are pretty bad and grounds for a block on their own. the lot, don't think there's a point in tagging the original Omarova group either. Closing. --Blablubbs (talk) 15:15, 1 August 2022 (UTC)
 * Just to clarify, my comment about "not someplace you would expect cyrillic" only applies to that last group of 6 accounts on a /128. -- RoySmith (talk) 15:23, 1 August 2022 (UTC)
 * @RoySmith: Does the technical data for group two happen to be consistent with ? --Blablubbs (talk) 15:45, 1 August 2022 (UTC)
 * Yeah, good call. On the raw CU data, I'd call that /128 group  to  and  (given the passage of time, as close to ✅ as can be expected).  And  to, who I see was CU-blocked at the same time as Kiowabole.  None of these were tagged as A134 socks, but there's some data in cuwiki which suggests those accounts were looked at during a CU run for that case. -- RoySmith (talk) 16:32, 1 August 2022 (UTC)
 * - while we sort this out. -- RoySmith (talk) 23:52, 1 August 2022 (UTC)
 * Split group 2 out to Sockpuppet investigations/Architect 134. tagged as confirmed to  and locks requested. Closing. --Jack Frost (talk) 21:27, 2 August 2022 (UTC)
 * - while we sort this out. -- RoySmith (talk) 23:52, 1 August 2022 (UTC)
 * Split group 2 out to Sockpuppet investigations/Architect 134. tagged as confirmed to  and locks requested. Closing. --Jack Frost (talk) 21:27, 2 August 2022 (UTC)