Wikipedia:Sockpuppet investigations/BIGDAWGDIONYSUS/Archive

Suspected sockpuppets
The Ateez page was first seen vandalised on May 24 by BIGDAWGDIONYSUS. All the users and IPs above kept disruptively editing the names of the band members after that. (page protection was set finally while I'm filing this)

Edits by users Samanthasmith152 / Owoitslance / Namarcuskim / The toilet your mom shits in (username violated rules too)

and IPs 2603:8001:1c02:4fd2:4179:73ef:b584:545c / 82.42.79.131 / 122.104.1.178 / 2600:1700:ce20:8600:548f:967e:49c1:1461 / 50.127.114.115

basically were the same thing as BIGDAWGDIONYSUS. They are all clearly socks + trolls, logged in to made 1-2 edit(s) only. And BIGDAWGDIONYSUS' username goes by the edit they did, so the "master" very likely is also a sock + troll. Have no idea what other accounts they link to unfortunately.

The rest of the users and IPs listed also vandalised the page with the same pattern, deliberately adding or changing names in the infobox & 'Member' section. May not be the same person as IPs are diff., but the IP changes are quite intentional at this point. All are single-purpose accounts, most only made 1 edit. (see full history)
 * IP 5 & 7 are in similar location
 * all have same kind of edits as IP 2

Accounts that logged on 1 by 1 to made edit within short time period:
 * Ateezluvrgirl > IP 1
 * Lolololodang > IP 2 > IP 3
 * Samanthasmith152 > IP 5 > Owoitslance > 122.104.1.178 > Namarcuskim > IP 7
 * 119.224.63.142 > 50.127.114.115 > Ateezluvrgirl > The toilet your mom shits in > IP 10 > Y2k kpop15 Alykr81 (talk) 05:42, 25 May 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Something's going on though it's unclear whether this is a boring meme or sockpuppetry; particularly given how wide the IP ranges are. Although the geolocation is so broad that I question whether there's some form of proxy use going on (P2P?). The page is already protected and these strike me as being throwaway accounts. - Please compare the named accounts and consider the viability of an underlying rangeblock if they are connected. Though if the geolocation & other technical data is as varied as it is with the IPs then don't bother looking too hard; we can manage via page protection and blocks where necessary. --Jack Frost (talk) 12:57, 25 May 2022 (UTC)
 * - -- RoySmith (talk) 18:03, 27 May 2022 (UTC)
 * I'm afraid CU's not going to be of much help here. I checked all the named accounts; they're all on different IP ranges, scattered locations, and (mostly) different operating systems.  Our proxy detection tools draw a blank on all the IP ranges, but my hunch is they're just using a proxy service that we don't detect.  I supposed I could call them all ❌, but my gut tells me  due to proxy use is more like it.  My first guess was that this is related to Sockpuppet investigations/Bennydadawg just from the username similarity, but the two cases turn out to be nothing like each other.  . -- RoySmith (talk) 18:14, 27 May 2022 (UTC)
 * This looks more like a bunch of kids participating in some sort of dumb meme than socking. Finding an unblocked, undetectable residential proxy network is a non-trivial task and most people with the resources to do such a thing would have a more complex goal in mind than vandalizing a boy band article. The page was semi-protected at the time and none of these accounts/IPs have edited since May 25th, so I'm closing this without further action. Thanks, Spicy (talk) 18:21, 12 June 2022 (UTC)