Wikipedia:Sockpuppet investigations/Cupcake547/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Cupcake547 was indeffed by Yamla on the 25th after they created a sockpuppet account to vandalise articles, 5 days later the History of Asia account was created, and looking at their contributions it's fairly obviously the same person.
 * Both accounts use edit summaries of the style "Added [Foo]" when adding templates to articles, , ,
 * Both accounts make extensive use of edit summaries of the form "Fixed foo" when editing articles, , ,
 * Both accounts have tried to get Draft:Belaftu deleted, Cupcake547 moved it to draft space and tagged it with a speedy deletion tag, History of Asia tried to AFD it and sent it to MFD. This draft was also edited by their vandalism only sock, Qaw36 (all visible in the page history)
 * There's a huge amount of editing overlap on certian pages, e.g. a look in the page history of Cities along the Silk Road will show it being activley edited by cupcake547 up to their block, at which point it has been edited heavily by History of Asia.
 * 192.76.8.91 (talk) 21:58, 5 May 2021 (UTC)
 * Also is obviously the same person, given they admit on their talk page that they got caught in Qaw36's IP block. They've been vandalising articles as an IP then reverting as an account for some reason. 192.76.8.91 (talk) 22:14, 5 May 2021 (UTC)
 * Added QforQuartemont3, brand new account that shows up and vandalises articles, followed by History of Asia reverting, the same behaviour as their IP. See the edit history of Water resources management in Pakistan.
 * They haven't edited here, but "QXis great i man" is also obviously the same person, vandalising pages on meta with edit summaries related to bananas, before being reverted by History in Asia, just like the IP that got caught up in their sock's block https://meta.wikimedia.org/wiki/Special:Contributions/QXis_great_i_man https://meta.wikimedia.org/wiki/Special:Contributions/History_of_Asia 192.76.8.91 (talk) 02:14, 6 May 2021 (UTC)
 * One more is also clearly the same person vandalising articles with banana themed nonsense from their school's IP address, before reverting the vandalism with the Cupcake547 account. 192.76.8.91 (talk) 02:50, 6 May 2021 (UTC)
 * Just putting my thoughts on why those two IP's and three accounts are the same person into a slightly more readable form
 * All the named accounts use usernames themed around the letter Q
 * All the accounts have been vandalising articles, followed by cupcake / history of asia turning up to "save the day" and revert
 * Most of the vandalism has been performed using the visual editor
 * Overlap in focus, i.e. articles relating to history and asia.
 * Many of these accounts/IP's have performed vandalism themed around bananas, ,
 * The school IP mentioned cupcake in their unblock request
 * The domestic IP got caught up in Qaw36's autoblock.
 * 192.76.8.91 (talk) 09:03, 7 May 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Moved from talk on behalf of 192.76.8.91. &#8209;&#8209;Volteer1 (talk) 22:14, 5 May 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
I've blocked the two socks as obvious without tags. The CU request sounds like a good idea.--Bbb23 (talk) 00:28, 7 May 2021 (UTC)
 * Also found and ✅:
 * No account on the English Wikipedia:
 * Bagging and tagging confirmed accounts. . Leaving open for behavioral investigation on the remaining account...  ~Oshwah~  (talk) (contribs)   06:02, 7 May 2021 (UTC)
 * No account on the English Wikipedia:
 * Bagging and tagging confirmed accounts. . Leaving open for behavioral investigation on the remaining account...  ~Oshwah~  (talk) (contribs)   06:02, 7 May 2021 (UTC)
 * No account on the English Wikipedia:
 * Bagging and tagging confirmed accounts. . Leaving open for behavioral investigation on the remaining account...  ~Oshwah~  (talk) (contribs)   06:02, 7 May 2021 (UTC)
 * Bagging and tagging confirmed accounts. . Leaving open for behavioral investigation on the remaining account...  ~Oshwah~  (talk) (contribs)   06:02, 7 May 2021 (UTC)
 * Bagging and tagging confirmed accounts. . Leaving open for behavioral investigation on the remaining account...  ~Oshwah~  (talk) (contribs)   06:02, 7 May 2021 (UTC)


 * For QforQuartemont3, I'm convinced on behaviour – tagging that one as suspected. for the lot including QXis (who we can't action locally unless and until they attach), closing. --Blablubbs&#124;talk 09:34, 7 May 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

They're back again on the same IP as before - 12.169.103.62 has just created Draft:Dino the dinosaur which is identical to a vandalism page that was repeatedly recreated on meta by QXis great i man and 50.234.126.10. 50.234.126.10 is already on a 2 year block as a suspected school, but there was a large amount of banana themed vandalism coming out of that IP last April and it also geolocates to San Jose, California, so it's obviously been used by cupcake recently. Since these IP's seem to be fairly static can I suggest a 3 month block on 12.169.103.62? 192.76.8.73 (talk) 10:38, 1 June 2021 (UTC)
 * Also worth noting that 12.169.103.62 first created Draft:Dino the dinosaur back in January 2020, so it seems they've been vandalising for over 18 months, and that cupcake was warning this IP on their talk page about the vandalism, just like their confirmed vandalism sockpuppet. . 192.76.8.73 (talk) 10:47, 1 June 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I've blocked the IP for a year - all of the contribs I checked going were vandalism. Agree this is probably cupcake, so it's also block evasion.  Girth Summit  (blether)  11:32, 1 June 2021 (UTC)