Wikipedia:Sockpuppet investigations/Abrah4125/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Clearly either socking or meat, but I'd feel better with a CU. I'm at the point where I have zero tolerance for Indian film sockpuppetry so I might be a little quick to indef both of these accounts on general principle. I short-blocked Rahm for continuing the edit war. Thanks. Cyphoidbomb (talk) 17:25, 6 November 2017 (UTC)
 * Abrah4125 was created 24 January 2017
 * Rahm3371 was created a few days later on 31 January 2017.
 * There are six areas of intersection.
 * Both have similar name schemes with name + 4 digits
 * On at least four occasions, Abrah seems obsessed with using one particular image in the infobox at Mersal (film). For instance here, here, here, and here.
 * Rahm pops out of an 8 month semi-retirement to make this change and this change, continuing the moronic edit war at Mersal.

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
✅, yup. -- zzuuzz (talk) 13:58, 8 November 2017 (UTC)
 * - Per evidence provided, to confirm socking. Sro23 (talk) 20:08, 7 November 2017 (UTC)
 * Thanks for checking. Sockpuppet indeffed and tagged, master blocked for two weeks. Closing. Cyphoidbomb (talk) 16:34, 8 November 2017 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

The user Abrah4125 has been involved in disruptive editing by removing sources and replacing them with primary sources like Twitter. Then, there are IP addresses repeating the same edits after the edits had been reverted, with the similar behaviour indicating that it's the same person.

Action 1: It first began in the article "Weathering with You" where the user added two credible sources (we call these sources A and B) (Special:Diff/920674282). That is not an issue.

Action 2: After that, the user added two other sources in another statement (we call these sources C and D) where the sources are not recommended to use (one is like a database and another one is from Twitter) (Special:Diff/921220577). Note that the said statement had already been properly sourced so this may very well be WP:OVERCITE too.

Action 3: Then, the user removed the first two reliable sources (A and B) AND one existing source and replaced it with a primary source (source E) (Special:Diff/921223025).

Actions 4-5: After the edit was reverted, the user replaced the SAME two sources (A and B) with a source from Twitter (source F) (Special:Diff/921592634). The user then went on to re-add sources C and D, plus one new appropriate source (source G) (Special:Diff/921594278).

That is all for the sockpuppeteer (the main account). The user ceased activity ever since 19 October 2019 and that's when suspected sockpuppets started to appear.

Action 6: With the edits being reverted, the first listed suspected sockpuppet (2001:8F8:146D:186A:940A:7BCB:46FE:5CA6) repeated actions 4 and 5 (removing A and B; adding F, C, and D) (Special:Diff/922015380).

Action 7: I reverted action 6 but the second suspected sockpuppet (2001:8F8:146D:186A:45B0:44F5:F8EE:9470) reverted my action (Special:Diff/922214376), which was in turn reverted by another user.

Action 8: The third suspected sockpuppet (5.178.210.167) made a number of edits to the article. One of them repeated action 4 (albeit not exactly the same but was using the same source F) (Special:Diff/923161303), which was then reverted by me.

Actions 9-10: The same sockpuppet participated in edit warring by first reverting back my edit and another user's revert (Special:Diff/923378011 and Special:Diff/923384224). Their edits were reverted by two users.

Action 11: The fourth suspected sockpuppet (91.151.137.47) did the same thing as actions 9 and 10 (Special:Diff/923403778).

UPDATE: Sockpuppet number 3 (5.178.210.167) made a revert again (Special:Diff/923453785).

This is all for the article "Weathering with You" and the revision history of the article is here:.

Action 12-14: Additionally, the third and fourth sockpuppets also made edits the same as each other at the article "One Piece: Stampede", also participating in edit warring (Special:Diff/923066280, Special:Diff/923092996, and Special:Diff/923229333). That is another sign of sockpuppetry.

The revision history of the article "One Piece: Stampede" is here:.

All of this is behavioural evidence of sockpuppetry. LightKeyDarkBlade (talk) 17:34, 28 October 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Ivanvector (Talk/Edits) 18:01, 28 October 2019 (UTC)
 * Based on editing history, I'm 100% convinced the two IPv4's are socks of each other. I'm not as certain, that they're socks of Abrah4125, but reasonably so.  Blocked the two IPv4.  Blocking individual IPv6's seems kind of pointless, so I'm just going to close this as is and we can see how things roll out in the future.  -- RoySmith (talk) 00:52, 29 October 2019 (UTC)
 * is there a particular reason that you blocked both IPv4s for 6 months? That seems a bit excessive to me given the dynamic nature of most IPs, but I could be missing something? -- The SandDoctor Talk 01:23, 29 October 2019 (UTC)

Good point. As I look closer, I see: inetnum:       91.151.137.0 - 91.151.137.255 netname:       GEOCELL-MOBILE-PACKET-CORE-NAT-POOL so that's almost certainly dynamic. But inetnum:       5.178.192.0 - 5.178.255.255 netname:       MAGTI-BROADBAND-3 I'm guessing might be quasi-static. I'm open to suggestions for better time spans. -- RoySmith (talk) 02:25, 29 October 2019 (UTC)
 * The standard that I use for SPI IP sock blocks is typically between 31 and 72 hours as that is typically enough time for IPs to reassign and seems effective overall. In the case of the 5.178 IP, perhaps 1-2 months (absolute max IMO - I'd prefer less) would be more appropriate? 6 months seems far too long - regardless of whether or not it is static - for a "first offense" of sorts (block log otherwise completely clean). -- The SandDoctor Talk 03:43, 29 October 2019 (UTC)
 * done. -- RoySmith (talk) 03:50, 29 October 2019 (UTC)
 * Thank you. -- The SandDoctor Talk 03:53, 29 October 2019 (UTC)


 * Both IPs DUCK by . 5.178.210.167 blocked for 2 weeks, 91.151.137.47 for 72 hours.  The SandDoctor  Talk 03:56, 29 October 2019 (UTC)