Wikipedia:Sockpuppet investigations/194.30.139.109/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Obviously since these are IPs I'm obliged to provide WP:DUCK behavioral evidence. The fact is that both of the IPs belong to a Cyprus bank called Hellenic Bank. The unique ENWP article contributions over the last 30 days are near identical:
 * List of Cypriot football transfers summer 2016  Δt about 2 hours
 * Bank of Cyprus  Δt about 20 hours
 * Olympiakos Nicosia  Δt about 2 hours
 * Piraeus Bank  Δt 10 days
 * Eurobank Ergasias  Δt 10 days
 * Alpha Bank  Δt 10 days
 * Attica Bank  Δt about 40 minutes
 * Hellenic Bank  Δt about 2 hours

The only exception over the same time period is the master made one edit to Apollon Limassol.

And there are many closely spaced back-to-back edits to the same article. These two are particularly telling since one makes a change and the other comes in and corrects the same change.
 * National Bank of Greece 9 Feb 2016 at 10:46,  at 12:09 correcting last change,  at 12:18 correcting again
 * Hellenic Bank 10 January 2016 at 10:35,  at 11:20 correcting same fact

End of new case. Brianhe (talk) 20:47, 27 September 2016 (UTC)

Since filing, the master IP removed the COI tag from the Hellenic Bank article without explanation.

Also added another bank IP with same back-to-back edits like this: Note pattern in May–July of often daily updates to Hellenic Bank market share figures coming from these several IPs. thru
 * Hellenic Bank Δt about 6 minutes

End of additions. Brianhe (talk) 15:36, 29 September 2016 (UTC)

Added another Cyprus IP 62.152.15.240 with similar editing habits. Here he is editing the same Hellenic Bank market share figures as before. Ditto for 2.84.249.107 here. Ditto 46.199.26.53. Brianhe (talk) 15:09, 20 October 2016 (UTC)

This was ignored at AIV so I'll just copy it here if it is of any use. Hellenic Bank IPs, continued removal of COI templates at Hellenic Bank and talkpage like this and this and this. Brianhe (talk) 14:22, 1 October 2016 (UTC)

IP edits continued at Hellenic Bank & talkpage removing COI templates, ; then a new one 46.199.15.21 showed up doing same. Added to list above. - Brianhe (talk) 22:45, 8 October 2016 (UTC)

IP removal of COI templates continues. - Brianhe (talk) 16:11, 13 October 2016 (UTC)

Added 213.7.1.119 who has edited another sock suspect's userpage. They clearly do not want the obvious association with Hellenic Bank to be known. - Brianhe (talk) 00:52, 19 October 2016 (UTC)

115.129 is still actively trying to remove information linking him to Hellenic Bank. - Brianhe (talk) 18:54, 20 October 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Note: Cypriot IP removing the shared static IP template from User talk:212.31.115.129  — Preceding unsigned comment added by Gricehead (talk • contribs) 14:00, 4 October 2016 (UTC)

I think we should agree here. Can we block them? 73.77.246.29 (talk) 15:06, 7 October 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * the following group have all recently removed the COI notice from Talk:Hellenic Bank and/or the shared IP notice from each other's talk pages:
 * The last is blocked 2 weeks and the others are clearly the same user (or meatpuppets, same thing) editing around that block. Please [re-]block all of them for 1 month. If disruption resumes, it would be better to request page protection at WP:RFPP. Ivanvector (Talk/Edits) 23:37, 20 October 2016 (UTC)
 * The last is blocked 2 weeks and the others are clearly the same user (or meatpuppets, same thing) editing around that block. Please [re-]block all of them for 1 month. If disruption resumes, it would be better to request page protection at WP:RFPP. Ivanvector (Talk/Edits) 23:37, 20 October 2016 (UTC)
 * The last is blocked 2 weeks and the others are clearly the same user (or meatpuppets, same thing) editing around that block. Please [re-]block all of them for 1 month. If disruption resumes, it would be better to request page protection at WP:RFPP. Ivanvector (Talk/Edits) 23:37, 20 October 2016 (UTC)
 * The last is blocked 2 weeks and the others are clearly the same user (or meatpuppets, same thing) editing around that block. Please [re-]block all of them for 1 month. If disruption resumes, it would be better to request page protection at WP:RFPP. Ivanvector (Talk/Edits) 23:37, 20 October 2016 (UTC)
 * The last is blocked 2 weeks and the others are clearly the same user (or meatpuppets, same thing) editing around that block. Please [re-]block all of them for 1 month. If disruption resumes, it would be better to request page protection at WP:RFPP. Ivanvector (Talk/Edits) 23:37, 20 October 2016 (UTC)


 * I'm declining to block these IPs because none of them are still in use, and I see no evidence that they're likely to be used by the same editor again in the near future. Unfortunately, there are no obvious rangeblocks here. I have blocked, which was used earlier today, and I'm placing a brief period of semi-protection on the talk page. An abuse filter may be preferable to long-term semi-protection of a talk page here, and I'll look into that. ~ Rob 13 Talk 18:34, 23 October 2016 (UTC)
 * thanks, that seems fine. The IPs appeared to still be active when I requested blocks, and I see that semiprotection was requested today already. Ivanvector (Talk/Edits) 18:36, 23 October 2016 (UTC)
 * Yes, it's understandable. I looked into rangeblocks, which would be more useful, but the ranges are too large and would likely result in an entire city unable to edit based on the geolocation. ~ Rob 13 Talk 18:37, 23 October 2016 (UTC)