Wikipedia:Sockpuppet investigations/2636z/Archive

30 May 2015

 * Suspected sockpuppets
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm
 * Longterm


 * User compare report Auto-generated every hour.
 * Editor interaction utility

The main evidence is at User:Taketa/Investigation, written up by.

The Sockmaster in this case is chosen because they have the most edits. Lor Talk 07:52, 30 May 2015 (UTC)

Found a large amount of accounts who all made 1 article about related topics. All make the same typos. Unknown if the content is good or false. Found using the following search:. They edit the same articles. Happening since at least 2013. Further investigation is needed. Long term accounts: 2636z, 434241x. He talks on discussion pages Connection between accounts:
 * All account have few edits, mostly a single article
 * All names contain random numbers, and one or several late letters of the alphabet
 * All edits are portugal, Spanish, Italian or Argentinian nobility/history related topics
 * Listed are names who made the same typo (noblemen instead of nobleman for the singular), and accounts that edited the same page and have the same sort of name
 * Also used alot is saying that a person "is a military".
 * All articles have foreign language, mainly spanish, sources
 * They made several dozen articles with names ending in "ys" which they changed to "is".


 * 1) 354667889zzz
 * 2) 263637378927262zz
 * 3) 2435366777zz
 * 4) 35171822asz
 * 5) 3435366777zz
 * 6) 25363377zz
 * 7) 35435366zz
 * 8) 237377aezz
 * 9) Hugh3458zz
 * 10) 454637677zz
 * 11) 243535656zz
 * 12) Juliodealdobonzi
 * 13) 3546477888zz
 * 14) 454647737zz
 * 15) 25363377zz
 * 16) 35464477488zz
 * 17) 4536788zzz
 * 18) 3536337798zz
 * 19) 34527289090zz
 * 20) 344654647777zz
 * 21) 34353566der6zz
 * 22) 3546466zz
 * 23) 3546477zz
 * 24) 354363667zz
 * 25) 98777733381233zx
 * 26) 3533636777zz
 * 27) 45638908211zz
 * 28) 36464677zz
 * 29) 5464634777zz
 * 30) 335353666zz
 * 31) 365467999zz
 * 32) 46447777zz
 * 33) 25363778zz
 * 34) 3488812399sx
 * 35) Fredsilver12
 * 36) 4664777388zz
 * 37) 172373838zzz
 * 38) 6567848899zz
 * 39) Tomás de Sousa Athayde e Noronha (possible)
 * 40) Ver445663zz
 * 41) 2636z
 * 42) 4647748878zz
 * 43) 23444zzz
 * 44) 4546777zz
 * 45) 343536677zz
 * 46) BeatrizmariaT
 * 47) Roberto1ad
 * 48) 3435363ys
 * 49) 3536666789zzz
 * 50) 17777zz
 * 51) 354667889zzz
 * 52) Hughdavid345n
 * 53) 5677799zz
 * 54) 3546477888zz
 * 55) 3546464777zz
 * 56) 354642177zz
 * 57) 45463737378zz
 * 58) 35363777zz
 * 59) 34355355zz
 * 60) Gre45677az
 * 61) 3435364789zz
 * 62) 734z
 * 63) 346466878zz
 * 64) 3536337798zz
 * 65) 343536367zz
 * 66) 3244255zz
 * 67) 35171822asz
 * 68) 3546466zz
 * 69) 354646661227zz
 * 70) 3546464777zz
 * 71) 123338732zz
 * 72) 5464764747zz
 * 73) 454647737zz
 * 74) 35464777zz
 * 75) Hectorgonzalezderivas23
 * 76) 35346362288zz
 * 77) 34353566der6zz
 * 78) 4353636zz
 * 79) 3536637zz
 * 80) 253636677zz
 * 81) JoaoGutierrez2
 * 82) Enter456zzz
 * 83) GabrielGalvan34zz
 * 84) 354667788zz
 * 85) 546367777zz
 * 86) 4546377zz
 * 87) 54636637828789zz
 * 88) 454637377zz
 * 89) 45456333zzz
 * 90) 887564888885588aaa
 * 91) Mariasilvia234z
 * 92) Enter456zz
 * 93) 435252521zzz
 * 94) 534267782897zzz
 * 95) 546737377zz
 * 96) 123337777zz
 * 97) 343526267778zz
 * 98) 3536337738aaa
 * 99) 454733889zzz
 * 100) 3536367778zz
 * 101) Josephcastillon345zz
 * 102) Redhouse444
 * 103) 3546466677zz
 * 104) 3543536677788zz
 * 105) Rerdtdttzz
 * 106) 353636677zz
 * 107) Lopez1915z
 * 108) 2341zz
 * 109) 4563zz
 * 110) Ramon1974z
 * 111) HectorRosseto345zz
 * 112) 19811981zz
 * 113) 345z
 * 114) TheEnd123zz
 * 115) 34554asd
 * 116) 186433zzz
 * 117) 34355366777zz
 * 118) 2535z
 * 119) 1625zz
 * 120) 2636zz
 * 121) Retetetegs
 * 122) Gonzalezgustavo34z
 * 123) MarioRoberto2345zz
 * 124) Ent364777zz
 * 125) FedeLea1111
 * 126) Gutierrez1111
 * 127) 434241x
 * 128) Milan212z (on second thought, may not be a sock considering the return to the same page in 2015)
 * 129) 234312zz
 * 130) 647678388zzz
 * 131) 343553zz
 * 132) 3242562gd (possible)
 * 133) 24365366zz
 * 134) 2312zz
 * 135) Joseph345zz
 * 136) 435535356zzz
 * 137) 43552626zz
 * 138) 435261za
 * 139) 34251z
 * 140) 65675787627z
 * 141) Kissmeass (blocked account that edited sock page with similar study remark to )
 * 142) 6478389398zz
 * 143) 24345wzz
 * 144) 53634663z
 * 145) Greco32zz
 * 146) 33565366zz
 * 147) 33535663677zz
 * 148) 545363277zz
 * 149) 54646377zz
 * 150) 34353566sdd
 * 151) 174118201s
 * 152) 534566667zz
 * 153) 81828282929zz
 * 154) 4658768989zzz
 * 155) Trentino345zz
 * 156) 34535361116ezz
 * 157) 3535662667zzz
 * 158) 25363636777zz
 * 159) 78337378zz
 * 160) 34526111aaaz
 * 161) 927363836272819191zz
 * 162) 45363777zz
 * 163) Enter453z
 * 164) 3435636677zz
 * 165) 43443525252zz

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Hi all, please note that I added a few dozen more accounts at User:Taketa/Investigation. All the best, Taketa (talk) 08:36, 30 May 2015 (UTC)
 * Response after block: All recently active accounts are now blocked, but I wonder if this will suffice. As you can see at he is quite able to edit with a sock, and return with the same sock to the same page after 7 months of using 100 different socks. So I wonder if we should not block them all. Also based on that, I think that Milan212z is probably one of the socks after all. Sincerely, Taketa (talk) 15:30, 30 May 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - While I think it's unlikely any have been missed with the filer's thoroughness, sleeper check or possible rangeblock would be handy here. Have fun :) Steven   Zhang  Help resolve disputes!  07:57, 30 May 2015 (UTC)
 * Will someone please separate the stale accounts from the main list of suspects? Thanks ​—DoRD (talk)​ 13:21, 30 May 2015 (UTC)




 * The accounts I saw are listed above. If there are any non-stale suspects that don't appear in my list, please let me know so that I can take another look. ​—DoRD (talk)​ 14:20, 30 May 2015 (UTC)
 * Another CU has taken care of the non-stale accounts, and a rangeblock has been placed. ​—DoRD (talk)​ 15:36, 30 May 2015 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

How the accounts are used abusively

Block evasion in order to use Wikipedia as a genealogy website.

Behavior

Ford489 is the active sockpuppet. The other two are what I believe to be dormant survivors of the 2015 mass block.

Commonalities between Ford489 and the 2015 sockpuppets


 * Same thematic interests.The 2015 sockpuppets showed particular interest in Argentinian settlers, patricians, and militarymen. To a minor extent, they also covered Spanish and Portuguese nobles in some way to related to them. Ford489 also shares this interest, and has carried on the work begun by the 2015 confirmed sockpuppets. Examples: 1, 2.
 *  One in three edits made by Ford489 are from pages previously managed by socks.  Out of 8,992 edits in English Wikipedia, Ford489 has made 3,036 edits in pages created or edited by confirmed 2636z sockpuppets. These represent 33.76% of his total edits. This was calculated by me using the Editor Interaction Analyser. See my spreadsheet.
 * A lot of past interaction with confirmed 2636z sockpuppets. In my preliminary investigation, I analyzed 119 confirmed sockpuppets from 2015. Ford489 has improved pages created or edited by 80 of them (67.23% of the total). See my spreadsheet for a matrix of interactions.
 * Suspicious awakening. 7 months after the end of the sockpuppet investigation of 2015 which resulted in the indefinite block of 140+ accounts, Ford489 came back to Wikipedia after four years of no activity (2011-2015). This suggests that Ford489 was a dormant sock account.
 * Ford489 edits at the same time of the day as the 2015 socks . Using Xtools, I am able to see that Ford489 uses wikipedia between 23:00 and 7:00 UTC (xTools) and almost never between 8:00 and 16:00. This hourly behavior is comparable to the one of previous socks, such as 2636z and Ramon1974z.
 * Broken English similarities. Take a look at the edit summaries: "is" instead of "it's" from an old sock, another old sock, and Ford489 himself. This suggests that they are all one user.

Why CheckUser evidence is needed

There may be more sleeper accounts sitting around. Past behavior suggests a repeat of the current situation in the future unless tackled promptly. Furthermore, the suspicions cited above need to be corrobated with IP addresses to confirm sockpuppetry.

Likely motivation behind sockpuppetry

I suspect that 2636z's/Ford489's motivation is to use Wikipedia as a genealogy website. This is based upon my understanding of the type of pages that have been created and edited in the past, in particular the pages related to the Category:Canaveri family. For example, prolific sock Ramon174z only edited pages related to the Canaveri family. Similarly, the most edited pages of Ford489 are related to the Canaveri family: the article to which he has made the most edits is the Juan de Canaveris page, where Ford489 has made 517 edits (over half of the total).

The Canaveri family lived in Argentina, and Ford489 has written on his userpage that he is from Buenos Aires. The subject of his genealogy is likely his own ancestry.

Ford489 has shown that he knows his pages aren't inherently notable and that they are an attempt at using Wikipedia as a genealogy website. When asked why he wanted to delete his own articles, he replied to one user: "Genealogy is not remarkable? I think you're confused. I wonder which who is remarkable for you?" Between the lines, one can read that Ford489 knows that his attempts are at establishing a genealogy on Wikipedia, and that they might not all be so remarkable. Pilaz (talk) 23:47, 3 November 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
I endorse, and had a quick look, but can't follow up and delve deeper into it. Drmies (talk) 01:03, 4 November 2021 (UTC)
 * To start with the trivial part, Suarez12 ✅ to Ford489. Suarez12 is now the oldest account, but we can decide later if we want to rename the case. -- RoySmith (talk) 17:32, 4 November 2021 (UTC)
 * Just to clarify, these two are confirmed to each other. Not yet clear if they're also confirmed to 2636z. -- RoySmith (talk) 17:37, 4 November 2021 (UTC)
 * I went down the rabbit hole a bit and decided to come back up for air before I got covered in rabbit poop from head to toe. If somebody wanted to go on a quest to hunt down long-dead socks and have a G5 fest, there's enough public data available to do that.  It would probably make a nice term project for a second-semester programming course ("Using the Wikipedia API for fun and profit").  But I've got more important rabbit holes to explore, so I'll just leave this at blocking the two active accounts.  Please open a new SPI report and ping me if any more emerge.  Now that I've explored the space a bit, new ones will be easy to recognize (and I left some notes in cuwiki).  Assuming I actually got all the buttons and checkboxes set right, I'm going to tag Ford489 as a confirmed sock of Suarez12 and both of them proven to 2636z.  Realistically, I guess all the others are proven to 2636z as well, but given that they've been dormant for years, feh. -- RoySmith (talk) 19:39, 4 November 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

I've found a few extra socks, so I'm reopening this SPI and pinging RoySmith as suggested by RoySmith in the previous SPI. I went on a selective speedy G5 deletion spree (roughly 30% of the articles), and I spotted these few surviving single purpose accounts which seem to fit the pattern established previously. The socks with names are all inactive. The two IP addresses from Buenos Aires, Argentina, left angry messages (diff, diff2) on my Talk page in the past two weeks following my deletion spree, so I have reason to believe that it's the same sockpuppeteer. Pilaz (talk) 23:36, 16 November 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * All the named accounts are long since stale, and the IPs haven't edited in a month, so I don't see that there's anything useful to do here (as frustrating as that may be). When I said in the last episode, "Please open a new SPI report and ping me if any more emerge", what I really meant was, "if any active ones emerge" :-) -- RoySmith (talk) 00:35, 14 December 2021 (UTC)