Wikipedia:Sockpuppet investigations/Buuqalert/Archive

Suspected sockpuppets
Suspicious ducky behaviour between all accounts. They have been vandalising the name, birth of date, and adding content eligible for WP:RD2 on Nayeon, Jihyo and Jeongyeon as seen with diffs: 1, 2, 3, 4, 5, and 6. All 3 users are likely previously editing as IP (2001:4453:54b:8300:1137:22b6:fd3c:4f8e) as their actions shows similar behaviour as seen with diffs: 1, 2, 3, 4, 5, 6, 7, 8, and 9. The IP has been blocked for 31 hours hence suspected block evasion, a range block may be necessary. I have not encountered them editing beyond the 3 mentioned articles of which the 3 mentioned person are members of Twice.  — Paper9oll  (🔔 • 📝)  13:14, 5 August 2022 (UTC)
 * Update 1 – They seem to be using VPN as IP (41.214.11.58) with similar behavior (1) just edited Nayeon.  — Paper9oll  (🔔 • 📝)  13:38, 5 August 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * I don't think this is socking per se - this looks to be some sort of silly social media campaign the kind of which is depressingly common in the K-pop area. I've semi-protected the articles concerned for a week and blocked these accounts as NOTHERE for good measure. Not at all convinced that CU is necessary or will show anything useful. If the disruption spreads elsewhere I'd recommend requesting page protection. firefly  ( t · c ) 13:45, 5 August 2022 (UTC)
 * Not sure if it was some sort of silly social media campaign as I tried finding on Twitter for such activities which is quite common in the past. Anyway, thanks for blocking all 3 of them and protecting the pages.  — Paper9oll  (🔔 • 📝)  14:04, 5 August 2022 (UTC)
 * Everybody's already blocked, so closing per Firefly's comment above. -- RoySmith (talk) 14:55, 5 August 2022 (UTC)

Suspected sockpuppets
Same ducky behaviour as mentioned above. This time on Momo Hirai and Choi Ye-na as seen with diffs: 1, 2, and 3. I do think it is worth checking if there anymore of them lying around even though the previous ones disrupted Twice's members article, Choi Ye-na isn't a Twice member, overall still K-pop related.  — Paper9oll  (🔔 • 📝)  15:16, 5 August 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * I'll leave this in CU Requested in case anybody wants to take a go at it, but see the comment in the previous filing for why I declined this the first time. -- RoySmith (talk) 15:55, 5 August 2022 (UTC)
 * is already blocked as WP:NOTHERE. . Closing --Jack Frost (talk) 01:29, 6 August 2022 (UTC)

Suspected sockpuppets
They just kept popping up ... another one with same ducky behaviour as previous ones, targeting Twice's member article like with previous ones.  — Paper9oll  (🔔 • 📝)  14:58, 6 August 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. Although this is most likely a meme and therefore CU is unlikely to be useful, given we're up to the 5th account in 48 hours a CU check can tell us one way or the other whether these accounts are technically related. - Please compare the accounts. --Jack Frost (talk) 15:14, 6 August 2022 (UTC)
 * - -- RoySmith (talk) 15:15, 6 August 2022 (UTC)
 * All of the accounts listed here and in previous reports for this case are ❌ on the CU data. One thing I do note, however, is a large overlap in which edit filters they've hit, which may or may not be meaningful.  For future reference, I suspect WP:AIV will be able to respond faster than SPI can on stuff like this.  I see that some of the targeted pages have already been semi-protected; I would urge any admin working this to be aggressive about protecting any page that's touched, especially seeing how it's all WP:BLP violations. -- RoySmith (talk) 15:32, 6 August 2022 (UTC)