Wikipedia:Sockpuppet investigations/Elsen Eor/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

The following is largely taken from a prior sockpuppetry investigation; I am opening this per 's recommendation, as this appears to be the sockmaster.

Regarding Elsen Eor, I am strongly concerned regarding the use of proxies and IPs as socks. My reasoning follows from the status of each of the four IPs that came to back up their edits on the Assassination of Anna Politkovskaya article. The following pattern indicates a use of proxies and a mobile device in association with the user's edits. While I understand that a checkuser cannot formally comment due to privacy policy concerns except in exceptional circumstances, the following demonstrates a preponderance of the evidence that the edits constitute the use of IPs as sockpuppets. The edits made by suspected IP sockpuppets and Elsen Eor are as follows (UPDATE: after reviewing additional edits, I have revised the below list to include an additional edit that follows this pattern): Based upon this pattern of behavior and the public technical evidence, this looks like a heck of a lot like coordinated effort by a single actor. I believe that Elsen Eor is related to the IPs in some way that constitutes prohibited sockpuppetry. However, if the user is pulling proxy stunts like this, I'd also be concerned regarding the possibility that this is a highly sophisticated WP:LTA case. — Mikehawk10 (talk) 01:59, 8 June 2021 (UTC)
 * , in March, makes an edit that replaced the name of "Vladimir Putin" with that of "Desmond Tutu".
 * flags as a proxy (on proxycheck.io, GetIPIntel, and IPQualityScore) and was responsible for this edit that replaced the name of "Vladimir Putin" with that of "Desmond Tutu". The ISP is listed as "Hurricane Electric". The edit is made in May. This is the same edit that Elsen Eor had previously made to the page in March.
 * made this edit, which each removed a section involving the association of the date of the assassination with the birthday of Vladimir Putin.
 * flags as a proxy (on proxycheck.io, GetIPIntel, and IPQualityScore), and was responsible for this edit to the page, replacing the name of "Vladimir Putin" with that of "Desmond Tutu". The ISP is listed as "Hurricane Electric". This is the same edit that Elsen Eor had previously made to the page in March and that had made in May.
 * made this edit, which each removed a section involving the association of the date of the assassination with the birthday of Vladimir Putin.
 * does not flag as a proxy, but it is responsible for this edit, which removed a section involving the association of the date of the assassination with the birthday of Vladimir Putin. It was the exact same section as was deleted by Elsen Eor. The ISP is listed as "Orange France Mobile".
 * does flag as a proxy (on proxycheck.io, GetIPIntel, and IPQualityScore), and was responsible for this edit, which removed a section involving the association of the date of the assassination with the birthday of Vladimir Putin. It was the exact same edit that was made by 92.184.100.180. The ISP is listed as "Hurricane Electric".

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I'm not 100% sure what's going on here, but I left uw-login (a mix of WP:AGF and WP:ROPE) and semi-protected Assassination of Anna Politkovskaya for 3 months. Also,  who is better at proxy identification than I am. -- RoySmith (talk) 01:16, 28 June 2021 (UTC)
 * @RoySmith, the best answer I can give you is, leaning . The ISP here is Hurricane Electric, which is anonymising (and hence sometimes blocked), but you don't necessarily use it deliberately. If there is proxy use, it's relatively sophisticated; the last SPI had a mix of HE and the proxy from , and the person on these HE IPs is hopping across ranges, which hints at deliberate evasion to me. 92.184.100.180 is – it's too late to tell. The IP edits are old-ish, but, assuming you can tie them to a named user, my inclination would be to indef at the first hint of continued logged-out editing. I hope this helps. --Blablubbs&#124;talk 07:58, 28 June 2021 (UTC)
 * It does, thanks. -- RoySmith (talk) 12:59, 28 June 2021 (UTC)