Wikipedia:Sockpuppet investigations/Cianzera/Archive

Suspected sockpuppets
, who has been indef blocked on Russian Wikipedia, runs several socks. One of them,, has just been blocked on enwiki for racial slurs and personal attacks. The other socks, as confirmed by, include , and. The first piece of evidence comes from the Russian Wikipedia, where all of these accounts have been blocked. The reason provided for all of these blocks is sock puppetry: Lauriswift911, Th3Shoudy, Foggy kub, and Kozaryl.

This issue was first raised on the English Wikipedia last month by, who pointed out that Lauriswift911 admitted to using multiple accounts (or sharing an account?). He basically wrote "Foggy kub is my friend, and he just went to my account, do not be offended by your story, you lost and won, this article has the right to be." At the time replied by saying that his account had been compromised and that it had to be reported. It seems no action was taken.

The issue was brought up again on enwiki by on February 3, 2023, although on an AfD discussion page. There Bogomolov.Pl wrote as follows:

User:Lauriswift911 is a sock-puppet of the User:Cianzera (checkuser test in Russian Wikipedia): blocked indefinitely in Russian Wikipedia (2 September 2022) with reason Wikipedia:Sockpuppetry [29] The English Wikipedia on the personal page of this account User:Lauriswift911 says that his nickname in social networks is @cianzera and his ideology is Nationalism. 23 January 2023 account Lauriswift911 attempted to create a duplicate account called Cianzera911 [30]. This account created the article Kyrgyz Confederation 20 January 2023.

He also wrote that this person has numerous other sock-puppets, including Foggy254, Torsva45, Teodor342 ftk, X-man super, Konstanta.A, Лис По, Xakasya911.

This issue was again discussed on the Administrator's Noticeboard last week. As has rightly pointed out, some of the articles created by Lauriswift911 are potentially hoaxes. After Bogomolov.PL commented by writing I guess we are dealing with a cross-wiki vandal who has created a whole "team" of sockpuppets. He works on the subject of Kyrgyzstan, primarily the history of Kyrgyzstan, the discussion was simply archived and no action was taken.

While discussing Lauriswift911's behavior on the Administrators' Noticeboard today on February 10, 2023, I was advised to file an FTI here. The discussion there also includes relevant information and comments, including by Q-bit array.

The second piece of evidence comes from the contributions of these accounts. Take Th3Shoudy and Lauriswift911, for instance. Both have edited the articles on the Kyrgyz Khanate (this article could potentially be a hoax, by the way), List of wars involving Kyrgyzstan, Yenisei Kyrgyz Khaganate, List of wars involving Tajikistan, 2022 Isfara missile attacks, and Kyrgyzstan. Or take the improbable 'coincidence' on Commons, also pointed out by Bogomolov.PL:

Outside of the English Wikipedia, the "kinship" of accounts may indicate that these accounts uploaded maps of the same type to Wikimedia Commons: Cianzera: ; Kozaryl:Kyrgyz khanat.png

Last week's discussion on the Administrator's Noticeboard also has some useful comments, inducing by and Salvio giuliano. The latter reprimanded Bogomolov.PL for not filing an SPI, so here we go. I hope I got everything. One final thing: all these accounts contribute in broken English, so maybe that's also an indication of some shenanigans (although a rather tenuous one, I must say). بلاد ما وراء النهر (talk) 20:11, 10 February 2023 (UTC)


 * Regarding IP addresses, in Central Asia, including Kyrgyzstan, a majority of the population access the Internet using their phones. Even when using a computer, their use their phone as a mobile hotspot, as landline Internet connection is not common (many people simply can't afford it). I've noticed that when you use your phone as a mobile hotspot, your IP address changes a bit each time, but the initial figures remain more or less the same. That explains why when doing a user check IP ranges that geolocate to the same area can be observed. As for behavioral evidence, I'll share some initial thoughts. Both users first registered on the Russian Wikipedia: Th3Shoudy on 11 March 2022, Lauriswift911 on 6 April 2022. What are the odds of two people registering on the Russian Wikipedia within less than a month and then actively editing more or less the same articles on the English Wikipedia? Also, let's consider actual edits. This edit made by Lauriswift911 is remarkably similar to this one made by Th3Shoudy. And consider this: both users do this weird thing where they write Bars-Kagan instead of just writing Bars Bek or Bars-Kagan : Lauriswift911 and Th3Shoudy. Again, what are the odds of that happening by pure chance? Finally, Th3Shoudy made an edit at 10:22, 10 February 2023; Lauriswift911 made his last edit before being blocked at 13:21, 10 February 2023; then Th3Shoudy frantically started editing enwiki at 13:36, 10 February 2023, meaning 15 minutes later. And so on. بلاد ما وراء النهر (talk) 00:13, 11 February 2023 (UTC)
 * Th3Shoudy has been rightly blocked. I believe a global ban as suggested by Rosguill below is not a bad idea. The guy seems to be currently trying to become a sysop on the Kyrgyz Wikipedia! Imagine what a self-proclaimed nationalist would do there if given admin rights! بلاد ما وراء النهر (talk) 00:46, 11 February 2023 (UTC)
 * The user is now back with his another account, namely . and, now that it's clear that we're dealing with the same person with dozens of socks (see the additional evidence provided by other users below), do you think all of his accounts should now be blocked? The guy just can't seem to refrain from spreading unsourced, unverified and potentially false claims about the history of the Kyrgyz. بلاد ما وراء النهر (talk) 15:00, 12 February 2023 (UTC)


 * I am not someone's puppet, my style of amendment is different from the corrections of the offenders. In the article "[List of wars involving Kyrgyzstan]" you removed information about the Basmachi, the question is why?  Keep your nationalistic inclinations to yourself, saying that the Kyrgyz as a nation did not exist then.  I dare to suggest that you are also someone's puppet, it is painfully suspicious that after almost a year you began to become active. Foggy kub (talk) 15:14, 12 February 2023 (UTC)
 * And potentially a Nazi, as Bogomolov.PL has written below. This guy is something. I'd say all of his contributions should be carefully scrutinized. بلاد ما وراء النهر (talk) 15:10, 12 February 2023 (UTC)

Thank you for your work and analysis. We are dealing with a very politicized and nationalist user who aims to spread false hoaxes. And sometimes not even intentionally (He does not know that it is impossible to invent new names for battles or states). Apparently, due to the lack of personal life, the user continued to create puppets even after the main account was blocked, so you need to identify it right away. Sometimes he pretended to be a Moscow programmer or the guy interested in Russian aristocrats. But suddenly he abandoned his topics and edited articles on Kyrgyzstan. Kazman322 (talk) 17:37, 12 February 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

To begin with, you need to clarify. I'm, not affiliated with the above mentioned accounts in any way, I know user by sight, nothing more. The user showed complete incompetence by blocking me on the Russian Wikipedia without trial, in my defense I will ask you to compare my IP and IP. About the article Kyrgyz Khanate, they already tried to remove it as a "mystification", but the article was protected as a result, you can check this by reading the archive of the nomination for deletion. — Preceding unsigned comment added by Th3Shoudy (talk • contribs)

I was pinged here, but I believe nothing I can do here. I don't have any other evidence to submit. Regards. --Lemonaka (talk) 10:16, 11 February 2023 (UTC)


 * Hi. I can confirm to the evidence presented here. First I want to note how this check coincided with my one carried out today. I've had my suspicions about puppetry for a long time. But before that I didn't want to deal with it all. But, today, checking the edits of Lauriswift911 for February 9, I realized that I need to act.


 * The story starts with Cianzera. The account had massive, to some extent marginal (in terms of vocabulary, history, and others) edits without indicating sources. I started a discussion with him about one of his edits. In this regard, the insults were sent to my email address indicated on my user page. As a result, he was banned on February 28, 2022 (UTC+6) In connection with this, one of the participants contacted me about this blocking. One of the respondents was the TAUZULE account. Today I checked his edits, they are very similar to the others mentioned here.


 * After a while, a very active contribution began from the Lauriswift911 account. Moreover, the themes of edits and the style were the same as those of Cianzera.
 * Since the Kyrgyz Wikipedia is not very active it is easy to detect.


 * Next, I want to list the signs I noticed.:
 * 1) The accounts in question edit the same articles or create articles on the same topic.
 * This is the history of Kyrgyzstan, the clans and tribes of the Kyrgyz, the list of wars of the Kyrgyz, modern historical events, regions and countries.


 * Speaking of the Kyrgyz Wikipedia, they are all edited and edited via a mobile phone. Moreover, editing takes place in the mobile view mode (because if you make edits from a mobile phone in the computer view mode, then no record is made about editing from a mobile phone).


 * Also, from those accounts that aroused my suspicions, mass edits can be traced without specifying the source of information, new articles are created short (mostly only the definition of the concept), and images of flags and coats of arms are placed in a table, not in a template.


 * 2) You can notice that one of the accounts is the main one (after blocking Cianzera in several projects, Lauriswift911 became the main one). Other minor ones. So I noticed that to upload files, it is used: Torsva45


 * For example, on February 9, an image of the flag or symbol of the Solto tribe (not the state or something else) is included in this article. This image was uploaded on February 9 from the account Torsva45. The same has been done with other articles about Kyrgyz tribes in recent days. In addition to this case, maps of the same style are also specially created for a number of articles.


 * Cianzera: ; Kozaryl:Kyrgyz khanat.png; Torsva45:

--Bosogo (talk) 17:30, 11 February 2023 (UTC)


 * One of the maps shows this community: https://vk.com/ateo_kr
 * The author of this community is probably the author of the uploaded images. Read the comments. The proposal to create flags for 40 Kyrgyz tribes is also mentioned there. Bosogo (talk) 08:34, 12 February 2023 (UTC)
 * This community was created on April 6, 2021. The author of the map is Barys Sultanov, he himself indicates this in the posts: "I draw myself, the style, all the colors I came up with myself." It seems that this name was indicated by Lauriswift911 on his personal page in the English Wikipedia. Thus, the maps in the style of Barys Sultanov prove that the author of all the maps is the same person, but with different accounts. Bogomolov.PL (talk) 10:32, 12 February 2023 (UTC)
 * It is enough to look at such a post in this community: and was only one comment to this post: . Not deleted. It is enough. Bogomolov.PL (talk) 15:06, 12 February 2023 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
This case is fairly complicated, so I'll be as clear as I can. All the accounts I am about to list appear to be editing from the same country; to be even more precise, they edit from IP ranges that geolocate to the same area, but I'm not sure how reliable geolocation is in the context of this country (as I am fairly unfamiliar with it) and some of the ranges appear to be proxies, while others do not appear to be. Furthermore, the UAs seem to be all over the place even in relation to the same user. That said, the following accounts seem to be very operated by the same person: The following accounts are ✅ to one another: If we accept that the two groups are operated by the same person, then is also a sock of theirs. Finally, we also have who appears to be editing on the same IP ranges as Foggy kub and the others, but the technical similarities end there. All the rest is stale. In the end,. Salvio giuliano 21:21, 10 February 2023 (UTC)


 * Looking at the WMF editor interaction logs, I am very confident that Th3Shoudy and Lauriswift911 are either the same person or working together, and will block accordingly. There's a remarkably striking pattern on both ru.wiki and en.wiki. There's also enough different accounts, on multiple projects, that I think we should consider escalating this to a global lock (or at least notifying ky.wiki where Lauriswift11 is quite active. I haven't investigated any of the other accounts listed yet. signed,Rosguill talk 00:27, 11 February 2023 (UTC)
 * OK, having looked at the Foggy kub cluster, while a little less obvious than the Th3Shoudy interactions, there's pretty clearly still a connection here. Blocking accordingly. signed,Rosguill talk 17:57, 12 February 2023 (UTC)
 * We edit-conflicted, and you blocked some, and I blocked others. The ones I blocked I did so without tags (and also with a comment, which never made it here), leaving the tags for others to sort out. I should also mention that I don't think you should be using confirmed tags to the master, because, unless I misunderstood, they were not.--Bbb23 (talk) 18:05, 12 February 2023 (UTC)
 * , gotcha, I mistakenly thought that socks blocked following conclusive behavioral evidence would also count as confirmed, but I see from the template documentation that that's not the case. I'll adjust accordingly. signed,Rosguill talk 18:08, 12 February 2023 (UTC)
 * From a technical standpoint, the accounts within each group can be tagged as confirmed to the other members of the same group, beyond that I can't really tell. In addition, they could all be double tagged as suspected or even proved sock of the master, depending on how strong you think the behavioural evidence is (this applies to Th3Shoudy as well). Salvio giuliano 18:23, 12 February 2023 (UTC)
 * My sense is that as long as we have a tag that links back to this discussion the paper trail will be sufficiently clear? I'm fine leaving it as suspected across the board. signed,Rosguill talk 18:26, 12 February 2023 (UTC)
 * I like double-tagging when it's appropriate, but I usually ask a clerk to do it. As far as proven vs. suspected, I don't much care as I'm not the one doing the behavioral analysis here. That said, you are not using the right parameters on the suspected tags. It should be .--Bbb23 (talk) 18:55, 12 February 2023 (UTC)
 * I've gone and fixed the suspected tags. signed,Rosguill talk 19:10, 12 February 2023 (UTC)


 * And with that, I'd say we can close the case. Thank you all. Salvio giuliano 19:16, 12 February 2023 (UTC)

Suspected sockpuppets
New account created last month 14 days after the last sock, User:Th3Shoudy was banned and 6 days after their unban request was denied. Continued substantial editing of Kyrgyz Khanate similar to previous accounts. See overlapping edits. Seems like a WP:DUCK to me. Qiushufang (talk) 00:49, 5 March 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


 * Comment - See also history of Alp Sol Tepek and Draft:Alp Sol Tepek. Robert McClenon (talk) 05:37, 5 March 2023 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - seems likely to be a sock, endorsing CU since the previous check found a large number of accounts. Thanks, Spicy (talk) 21:26, 6 March 2023 (UTC)
 * -  Girth Summit  (blether)  11:57, 7 March 2023 (UTC)
 * I can't easily tell whether this is two people operating out of the same IP ranges (all accounts overlap on multiple fairly narrow ranges), or one person using two different devices on those ranges. is ✅ from ;  is ✅ to . Blocking both, I'll ask  to consider what tags to apply.  Girth Summit  (blether)  12:11, 7 March 2023 (UTC)
 * It seems like we've just been tagging these as suspected to the master, so I've done that. Closing. Thanks, Spicy (talk) 23:02, 9 March 2023 (UTC)

Suspected sockpuppets

 * ( original case name)

All users single purpose editors whose only contribution is reinstating the same old version of article Yenisei Kyrgyz Khaganate 10mmsocket (talk) 09:36, 11 March 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - please compare to each other and Sockpuppet investigations/Cianzera. DatGuyTalkContribs 11:32, 11 March 2023 (UTC)
 * -  Girth Summit  (blether)  12:10, 11 March 2023 (UTC)
 * OK, comparing these to each other, I see that and  are operating on different ranges and with different UAs, but also that they geolocate to the same city - as such, they are certainly  to one another.  appears technically ❌, and I can't detect any use of proxies.
 * Comparing them to the Cianzera socks, I'd say that is exceedingly  to .  is operating out of a fairly narrow range that has a number of blocked Cianzera socks on it, (e.g., ). I'm prepared to say that  is technically very  to Lauriswift911, as are all of the following:
 * (which is ✅ to Palmbeach)
 * (no edits)
 * (✅ to ElviraILY above)
 * I'm going to CU block all of the above as socks of Cianzera, request locks, and merge this report into that case. Girth Summit  (blether)  12:58, 11 March 2023 (UTC)
 * (no edits)
 * (✅ to ElviraILY above)
 * I'm going to CU block all of the above as socks of Cianzera, request locks, and merge this report into that case. Girth Summit  (blether)  12:58, 11 March 2023 (UTC)
 * I'm going to CU block all of the above as socks of Cianzera, request locks, and merge this report into that case. Girth Summit  (blether)  12:58, 11 March 2023 (UTC)
 * I'm going to CU block all of the above as socks of Cianzera, request locks, and merge this report into that case. Girth Summit  (blether)  12:58, 11 March 2023 (UTC)

Suspected sockpuppets
All these accounts have been going at entries that have something to do with the Kazakh, such as the List of wars involving Kazakhstan (but not Borat, obviously). I remember reading on one of Cianzera's gazillion accounts that he was half Kazakh. Now that he cannot really edit entries on the Kyrgyz, he seems to be focusing on his other defining half. Batykhan: this person has been editing more or less the same articles as Cianzera. Check out this edit, for instance. Looks like fiction to me. Qaznat: this nationalistic edit summary is telling. He literally called Tajiks "dirty" and monkeys. Shoqan Ualikhan: this person has been spotted as a potential sock by. This Cianzera guy just cannot let go of (real and unreal) wars involving the Kyrgyz/Kazakh. بلاد ما وراء النهر (talk) 21:24, 23 March 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - is ✅ to  and  - I've blocked them. Comparing the others.   Girth Summit  (blether)  15:00, 25 March 2023 (UTC)
 * and look different - their geolocations are in a different country, but it's a nearby part of adjacent country. I obviously can't rule out MEAT or cross-border travel, but I don't think these are the same person. Some behavioural analysis would probably be in order.  Girth Summit  (blether)  15:10, 25 March 2023 (UTC)
 * Noting that is confirmed to; while they are editing the same articles, I don't consider that a clearcut WP:BADSOCK violation - the usernames are so similar as to make an attempt to evade scrutiny unlikely. I am going to block them for that outrageously offensive edit summary.  Girth Summit  (blether)  15:15, 25 March 2023 (UTC)
 * I don't see enough evidence to block Batyikhan in light of the CU results. Could be a different person with a similar POV. The other two accounts have been indeffed. Closing. Spicy (talk) 17:43, 31 March 2023 (UTC)
 * the master. MarioGom (talk) 07:50, 6 April 2023 (UTC)