Wikipedia:Sockpuppet investigations/Bule Cloud/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Record filing. -- Amanda  (aka DQ) 14:50, 19 October 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * All three ✅ already and dealt with. -- Amanda  (aka DQ) 14:51, 19 October 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Global deep vandalism. Disruptive multiple accounts abusing soccer related article. enwp, kowp and commons are the primary targets. Check the CentralAuth, it quacks. I have also reported them at commons' ANV. - Vis M (talk) 21:34, 21 July 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments


Please focus on editors who are not currently blocked and have edited recently (as far as I can tell, that's only Bule Cloud) GeneralNotability (talk) 02:14, 19 August 2021 (UTC)
 * No additional evidence provided. Closing. Bbb23 (talk) 00:22, 5 September 2021 (UTC)

Suspected sockpuppets

 * ( original case name)




 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

x-wiki abuse. Shared interest on, e.g., South Korea national football team. Similarities are most pronounced on Commons; compare, e.g., c:Special:Diff/446092711 with c:Special:Diff/604686991. See also Administrators' noticeboard/Blocks and protections. I am requesting checkuser because of the history of socking, and I am doing so here rather than on Commons because you have access to the checkuser logs for this master (even though they are otherwise stale). —&#8205;Mdaniels5757 (talk &bull; contribs) 15:13, 4 November 2021 (UTC)
 * Added Stadium129 from the archive per c:Special:Diff/573304536, not stale but going stale soon. —&#8205;Mdaniels5757 (talk &bull; contribs) 15:24, 4 November 2021 (UTC)
 * @RoySmith: since then, Bule Cloud has continued editing the same topics as the others (like 2021 AFC Champions League group stage).
 * For specific enwiki diffs: compare with  (where Bule Cloud picks up after Stadium129 is blocked.)
 * Also, everyone involved seems to love blanking their pages: Stadium129, Bule Cloud 1, Bule Cloud 2, Euro2024, Coms225.
 * Finally, see Special:Diff/1024200574, where Bule Cloud cleans up after Coms225, a month after Coms225 was globally locked.
 * Best, —&#8205;Mdaniels5757 (talk &bull; contribs) 00:25, 5 November 2021 (UTC)
 * Ooh, and  (same article, different accounts, editing the same parameters 2 years apart. —&#8205;Mdaniels5757 (talk &bull; contribs) 00:31, 5 November 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Both of these users were reported in 21 July 2021, which was closed for lack of evidence. What has happend since then, specifically on enwiki?  As noted in that previous report, what we really need are specific diffs. -- RoySmith (talk) 15:59, 4 November 2021 (UTC)
 * - -- RoySmith (talk) 00:37, 5 November 2021 (UTC)
 * Bule Cloud is ✅ to Stadium129 on technical evidence. Comparing Bule Cloud to Euro2024, the memory circuits are badly degraded, but I found enough to let me call them at least .    -- RoySmith (talk) 01:06, 5 November 2021 (UTC)
 * After consultation with my associates, I'm upgrading Bule Cloud to ✅. And I'll go ahead and retag everybody. -- RoySmith (talk) 01:56, 5 November 2021 (UTC)
 * Euro is already glocked, but the other two aren't, so requesting locks for them. -- RoySmith (talk) 02:05, 5 November 2021 (UTC)

Suspected sockpuppets

 * ( original case name)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

In November 2021, AsianEuro Cungball suddenly started editing after a three-year hiatus only a few days after Bule Cloud was banned; the edit pattern of the three accounts (AsianEuro Cungball, Euro2024, Bule Cloud) is the same, which includes deleting all messages from his talk page instead of replying.
 * As it can be seen in this diff 1 and diff 2, the last page edited by Bule Cloud before being banned and the first one edited by AsianEuro Cungball after a 3-year break are the same page, 2021 Suwon Samsung Bluewings season, it is 99% the same person. It was also previously requested by someone else to check AsianEuro Cungball and his connection to Bule Cloud / Euro2024 in July 2021 (link) Snowflake91  (talk) 13:26, 13 January 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Looks like this should have been filed under Bule Cloud -- RoySmith (talk) 20:36, 13 January 2022 (UTC)
 * ✅. Sro23 (talk) 00:57, 14 January 2022 (UTC)
 * , . Close. Sro23 (talk) 05:13, 14 January 2022 (UTC)

Suspected sockpuppets

 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.
 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Repeating similar behavior as previous socks at South Korea national football team and 2022 FIFA World Cup qualification – AFC Third Round. Obvious WP:DUCK. Jalen Folf  (talk)  19:09, 8 February 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * Diffs: 1, 2 Snowflake91  (talk) 10:24, 11 February 2022 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Thanks, Spicy (talk) 06:00, 10 February 2022 (UTC)
 * Thank you for the diffs, . - looks likely to be the same person, but I think it's worth a check for others, since there seems to be a history of concurrently using multiple accounts. Thanks, Spicy (talk) 13:28, 11 February 2022 (UTC)
 * - -- RoySmith (talk) 14:04, 11 February 2022 (UTC)
 * Spurs and are ✅ to  and  from the archives; those later two are only tagged as suspected, but I do note that commons:User:AsianEuro Cungball is blocked as a Euro2024 sock so I don't have any serious doubts about the connection.  I'm going to cu-block Spurs and Chloesuy, but I'll leave the tagging to a clerk if they want to do some fancy dual-tag.  I've requested glocks. -- RoySmith (talk) 14:42, 11 February 2022 (UTC)
 * Thanks. I'm not going to bother with any fancy tagging, I just tagged as proven based on the behaviour (see ). Closing. Spicy (talk) 20:43, 11 February 2022 (UTC)

Suspected sockpuppets
Obvious case, diff 1 "You're not Korean", diff 2 "You're not Korean", also editing the same pages as Bule Cloud, like South Korea national football team and 2022 Suwon Samsung Bluewings season (diff 3, diff 4) Snowflake91  (talk) 12:30, 8 April 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * CU doesn't give me much useful, but it certainly looks ducky enough. The Jolf92 account is already globally locked for cross-wiki abuse; blocking Nartur, requesting lock.  Girth Summit  (blether)  13:07, 8 April 2022 (UTC)

Suspected sockpuppets
Another sock of the user that was globally locked many many times, same edit pattern with disruption at 2022 Suwon Samsung Bluewings season, restoring pages to his own preferred version (diff 1, diff 2), also the same behavior on talk pages like every single previously blocked sock, i.e. blanking the page without leaving any reply – the sock was also registered shortly after the page was semi-protected after his IP was banned (diff 3) Snowflake91  (talk) 12:31, 31 May 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * This is ✅ to, who is tagged as suspected to the master; blocking, tagging, closing.  Girth Summit  (blether)  13:43, 1 June 2022 (UTC)

Suspected sockpuppets
Looking at these four articles:

They were all semi-protected for a month by in December 2023, due to disruptive editing and block evasion from the following accounts and IP range:

The 이봄이젖 account and the person behind the IP range editing those articles were highly suspected to be Bule Cloud when they were blocked by JBW after an AIV report.

With the background of previous recent sockpuppetry out of the way, this 'Samurainippon00' account also seems to be very focussed on those four articles lately, making some inaccurate changes and edit-warring against other users like they did with the previous accounts/IPs. The pages are semi-protected but they are able to edit them due to being autoconfirmed.

Let's compare some edits:
 * On Iraq national football team results (2020–present):
 * edit by 눈송이91
 * edit by Samurainippon00
 * Explanation: both added football collapsible box template under 2024 heading with almost exactly the same details, slightly different as the match had already happened. User has a habit of linking the stadium the match is taking / took place in.


 * On South Korea national football team results (2020–present):
 * edit by 눈송이91
 * edit by Samurainippon00
 * Explanation: both made edits consisting of time parameter set to UTZ 17:00 4, changed "Rashid Stadium" to "New York University Stadium", changed "Dubai" to "Abu Dhabi"


 * On South Korea national football team:
 * edit by 2001:2D8:0:0:0:0:0:0/32
 * edit by Samurainippon00
 * Explanation: both added "SUS" to player Hwang Ui-jo, added link to "New York University Stadium"


 * On Iraq national football team:
 * edit by 눈송이91
 * edit by Samurainippon00
 * Explanation: both set time of 6 January match to UTZ 17:00 4, added link to "New York University Stadium"

One more piece of supporting evidence is that they have a bit of a tendency to put the source URL – and just the URL only, no other words – in the edit summary, like the previous accounts and IP range: edit by Samurainippon00; edit 1 and edit 2 by 2001:2D8:0:0:0:0:0:0/32; edit 1 and edit 2 by 눈송이91. — AP 499D25  (talk)  03:14, 9 January 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Technically to previous socks, but the behaviour makes it obvious enough. Blocked, lock requested. Thanks for the clear report. Spicy (talk) 21:28, 9 January 2024 (UTC)