Wikipedia:Sockpuppet investigations/Bigneeerman/Archive

Suspected sockpuppets

 * ( originally filed under this user)

These three have in common the phrase "Seems to be not notable and without any reliable sources" (Bigneerman, Dark Juliorik, 不和の林檎) which had never been used before until this week. They all follow the standard Expertwikiguy playbook of making numerous small edits with the VisualEditor and casting a large number of low-quality AfD !votes. Requesting CU to confirm and to look for others. Extraordinary Writ (talk) 21:40, 25 September 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - the consolidated timeline is also a good match. Please, check all of them. Thank you. MarioGom (talk) 06:08, 26 September 2022 (UTC)
 * Added YouVeNeverSeenBetter - very similar without the specific phrase. MER-C 17:31, 26 September 2022 (UTC)
 * Comment I've taken a look at these, but would appreciate it if another CU with experience of residential proxies would be willing to take a look. These accounts are all editing out of a lot of very different IP ranges. Each account uses ranges that geolocate to a particular country; some of the IP addresses they are using show as belonging to the same set of residential proxies, and they all look similar to one another in other ways. Girth Summit  (blether)  18:06, 26 September 2022 (UTC)
 * may be another. MER-C 19:09, 29 September 2022 (UTC)
 * Formally relisting this per GS's comment. I believe is familiar with this case? Thanks, Spicy (talk) 17:57, 1 October 2022 (UTC)
 * Unfortunately, I had taken a look at this a couple of days ago and didn't make any progress. -- RoySmith (talk) 18:15, 1 October 2022 (UTC)
 * ...  ~Oshwah~  (talk) (contribs)   20:44, 2 October 2022 (UTC)
 * The three possible users are all, without a doubt, using a VPN. They bounce all around the world geolocation-wise, and nearly all of the ranges I looked into came back positive for VPN use in reports. The user agents are mostly of the same device family, but different browsers. No IP address ranges overlapped or directly connected any of the users. The inconclusive user used one range in one geo-location, where none of the IPs used had VPN use reported. Unfortunately, that's all the information that I can give. Resetting status back to 'completed', as .  ~Oshwah~  (talk) (contribs)   21:28, 2 October 2022 (UTC)
 * The three possible users are all, without a doubt, using a VPN. They bounce all around the world geolocation-wise, and nearly all of the ranges I looked into came back positive for VPN use in reports. The user agents are mostly of the same device family, but different browsers. No IP address ranges overlapped or directly connected any of the users. The inconclusive user used one range in one geo-location, where none of the IPs used had VPN use reported. Unfortunately, that's all the information that I can give. Resetting status back to 'completed', as .  ~Oshwah~  (talk) (contribs)   21:28, 2 October 2022 (UTC)
 * The three possible users are all, without a doubt, using a VPN. They bounce all around the world geolocation-wise, and nearly all of the ranges I looked into came back positive for VPN use in reports. The user agents are mostly of the same device family, but different browsers. No IP address ranges overlapped or directly connected any of the users. The inconclusive user used one range in one geo-location, where none of the IPs used had VPN use reported. Unfortunately, that's all the information that I can give. Resetting status back to 'completed', as .  ~Oshwah~  (talk) (contribs)   21:28, 2 October 2022 (UTC)
 * The three possible users are all, without a doubt, using a VPN. They bounce all around the world geolocation-wise, and nearly all of the ranges I looked into came back positive for VPN use in reports. The user agents are mostly of the same device family, but different browsers. No IP address ranges overlapped or directly connected any of the users. The inconclusive user used one range in one geo-location, where none of the IPs used had VPN use reported. Unfortunately, that's all the information that I can give. Resetting status back to 'completed', as .  ~Oshwah~  (talk) (contribs)   21:28, 2 October 2022 (UTC)
 * The three possible users are all, without a doubt, using a VPN. They bounce all around the world geolocation-wise, and nearly all of the ranges I looked into came back positive for VPN use in reports. The user agents are mostly of the same device family, but different browsers. No IP address ranges overlapped or directly connected any of the users. The inconclusive user used one range in one geo-location, where none of the IPs used had VPN use reported. Unfortunately, that's all the information that I can give. Resetting status back to 'completed', as .  ~Oshwah~  (talk) (contribs)   21:28, 2 October 2022 (UTC)
 * The three possible users are all, without a doubt, using a VPN. They bounce all around the world geolocation-wise, and nearly all of the ranges I looked into came back positive for VPN use in reports. The user agents are mostly of the same device family, but different browsers. No IP address ranges overlapped or directly connected any of the users. The inconclusive user used one range in one geo-location, where none of the IPs used had VPN use reported. Unfortunately, that's all the information that I can give. Resetting status back to 'completed', as .  ~Oshwah~  (talk) (contribs)   21:28, 2 October 2022 (UTC)
 * The three possible users are all, without a doubt, using a VPN. They bounce all around the world geolocation-wise, and nearly all of the ranges I looked into came back positive for VPN use in reports. The user agents are mostly of the same device family, but different browsers. No IP address ranges overlapped or directly connected any of the users. The inconclusive user used one range in one geo-location, where none of the IPs used had VPN use reported. Unfortunately, that's all the information that I can give. Resetting status back to 'completed', as .  ~Oshwah~  (talk) (contribs)   21:28, 2 October 2022 (UTC)


 * Some findings and requested actions:
 * Bigneeerman, Dark Juliorik, 不和の林檎, and Assirian cat voted keep on the Maropost, which has been a repeated UPE target (including Bennet43 sockfarm in a previous creation). This overlap alone is quite suspicious.
 * All of them do simple gnoming and AFD copypasta votes. This is a frequent behavior in a few sockfarms, including SpareSeiko, Sanketio31, and Expertwikiguy.
 * These accounts have occasionally copypasted the same votes in different AFDs. Some also did rapid-fire AFD noms with copypasta rationales. Here's a summary table:


 * Based on the way edits interleaved on 2022-09-25, I think it is likely that Assirian cat and Bigneeerman are not the same person.
 * Based on AFD activity (table above) and CU results with respect VPNs, I think it is likely that Bigneeerman, Dark Juliorik, and 不和の林檎 are the same person.
 * While YouVeNeverSeenBetter looks quite similar to the others, I'm not so sure about what to make of it.
 * All reported accounts deviate from the expected timecard for Expertwikiguy . This is far from excluding a relation to Expertwikiguy, but in the absence of further evidence, I think we should not assume the reported accounts are Expertwikiguy.
 * Based on the above analysis, I moved the case to Bigneeerman. I recommend indefing Bigneeerman, Dark Juliorik, and 不和の林檎 (supected to Bigneeerman). No action for YouVeNeverSeenBetter and Assirian cat, without prejudice of any admin willing to act on their behavior beyond a specific relation to Bigneeerman or Expertwikiguy (e.g. AFD coordination or UPE). MarioGom (talk) 17:41, 9 October 2022 (UTC)
 * Bigneeerman, Dark Juliorik and 不和の林檎 indeffed. Will have a look at the others w/r/t UPE. Closing. firefly  ( t · c ) 17:52, 9 October 2022 (UTC)

Suspected sockpuppets
For Dlerus Us: same AfD nomination statement, "Seems to be not notable and without any reliable sources", as used before. Suddenly returned to editing today with small, rapidfire edits to various articles also using the VisualEditor:. Bridget (talk) 12:34, 11 October 2022 (UTC)
 * Filmmaniac Tomik returned to editing today, with rapidfire edits using the VisualEditor . First revision of their userpage is very similar to that of this confirmed sock. They also cast a vote using rationale identical to above. Bridget (talk) 14:41, 11 October 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - Given the timing, presented evidence, and timecards: . Please, indef both accounts. Thank you. MarioGom (talk) 22:44, 14 October 2022 (UTC)
 * Blocked and tagged. MER-C 09:18, 15 October 2022 (UTC)

Suspected sockpuppets

 * ( original case name)

24.138.27.215 has 11 edits on Oct 19 and no other edits since 2008. 9 of those edits are to AfDs started by Mambo Rumbo. They are all on a similar topic and, of course, this could be someone trying to seem like Mambo Rumbo. I think a CU is needed to sort this out, but I don't know the SPI rules as well as I should... A quick look showed no similar instances of this in the past. Hobit (talk) 19:53, 23 October 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Ran a check to compare Mambo Rumbo to Sockpuppet investigations/Bigneeerman/Archive. Results are not entirely conclusive because everyone's on proxy, though that's a datapoint too, and the specifics here make a connection relatively . I've blocked and tagged the account. --Blablubbs (talk) 20:28, 23 October 2022 (UTC)
 * I've merged the two cases. --Blablubbs (talk) 11:33, 24 October 2022 (UTC)
 * IP had a handful of edits a week ago and nothing since. Closing. -- RoySmith (talk) 13:28, 25 October 2022 (UTC)
 * Note that the oldest account so far is . MarioGom (talk) 23:11, 30 October 2022 (UTC)

Suspected sockpuppets
Request to undelete Draft:GuarantCo created by another sock of the master. UtherSRG (talk) 20:32, 16 May 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * . Mkdw  talk 21:42, 4 June 2023 (UTC)
 * Not much behavioral evidence to evaluate. . Feel free to report again if there's new evidence. MarioGom (talk) 21:43, 9 June 2023 (UTC)