Wikipedia:Sockpuppet investigations/EunikaSylviane/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

The three accounts were created today within a span of a few minutes, and display exactly same editing behaviour. They created the respective sandboxes first with the content "This is my sandbox I’m going to make a page here" or something similar "Hi This is my I’m going to make a page here." If you see the diffs of the edits made to the sandboxes, you'll find exactly similar pattern and style of editing. Here are the diffs:


 * EunikaSylviane:, , , , , , , , , and


 * BrandrChryses:, , , , , , , and so on.


 * NarayanAyna:, , , , , , , and so on. Ashley  yoursmile!  09:42, 3 January 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * , I was going to tell you about something I was trialing if things went smoothly after a week, but the 'possible spambot' section of User:Pahunkat/Usernames to watch may be useful. I doubt much will come out of the SPI though since these accounts haven't done anything particularly bad yet. Thanks, Pahunkat (talk) 12:13, 4 January 2021 (UTC)
 * Pahunkat, thanks so much for your response, I am glad that you were also keeping an eye on them. What you are saying completely makes sense, they haven't edited anything since yesterday so I'm thinking if I made a rather impulsive decision. Maybe would've been better to wait and watch before documenting this report. -- Ashley yoursmile!  14:40, 4 January 2021 (UTC)
 * , that's fine - I think they're trying to get autoconfirmed in which case the next 4 days will be interesting. LuK3 blocked the 'user-' prefixed accounts which may be linked to these new ones, since I haven't seen any ones with the same pattern today. Thanks, Pahunkat (talk) 15:28, 4 January 2021 (UTC)
 * - knew it, they were gaming autoconfirmed and are presently targeting the article Realjamesh. Added all known accounts from the list. Pahunkat (talk) 21:16, 7 January 2021 (UTC)
 * CU requested to find sleepers, definitely a case of abusing multiple accounts in parallel. Pahunkat (talk) 21:22, 7 January 2021 (UTC)
 * Two things - firstly, I think the 'user-' prefixed accounts on 'possible spambots' are linked, because they day after they were blocked by LuK3 the above accounts were created, and after these were left alone I haven't seen any others that exhibit the same behaviour. Secondly, article has just been extended-protected (up from semi). Pahunkat (talk) 21:29, 7 January 2021 (UTC)
 * Pahunkat, wow, looks like they were indeed waiting to get autoconfirmed. Thanks for reporting the other socks and requesting CU. Good job in blue-locking Realjamesh. Ashley  yoursmile!  07:00, 8 January 2021 (UTC)
 * I would like to point out that several of these users have also been vandalizing User talk:Realjamesh, with one coming along to revert an edit that is clearly cleaning up vandalism. Builder018 (talk) 21:35, 7 January 2021 (UTC)
 * Yep, thanks for helping there along with JJPmaster. They might or might not know of another potential target connected to the subject, but I'll keep it watch listed per WP:BEANS instead of saying it here since I highly doubt they'll know of it's existence. Pahunkat (talk) 21:58, 7 January 2021 (UTC)
 * For clerks conducting behavioral investigation - look at the initial 10 edits of each of the accounts. Pahunkat (talk) 22:03, 7 January 2021 (UTC)


 * , question: are any of the edits made to the talk page worthy of revdel as "purely disruptive material"? JJP...MASTER![talk to] JJP... master? 21:56, 7 January 2021 (UTC)
 * Pictogram voting comment.svg Note: I seem to have intercepted a file containing names of new sock-puppet accounts, this picture appeared on a Discord chat informally hosted by some fans of James of which I nor James has any control over. Please see the picture here. It looks like the password for the accounts are their aswell and they exibit similar behavior to that of the accounts above, presumably to get 'autocomfirmed' to be used for vandalism later. I'd also like to take this opportunity to truly apologise on behalf of James and JEM for the insane disruptive editing that followed the creation of his article and talk page and I'd like to thank every volunteer that dealt with it. Thanks, (I have a COI with this topic, please see my userpage) Emmeline Williamson45 (talk) 15:57, 8 January 2021 (UTC)

I've typed out the name when I was going through their contributions if this makes it easier: Lara Nélida Bette Henny Eugen Stelian Shantanu Tonia Jonathan Mumbi

Thanks for letting us know. This is obviously an off-wiki action rather than plain sockpuppetry. What is also interesting is that the master's been globally locked for Long-term abuse and one of the socks was just CU blocked by Ponyo. Pahunkat (talk) 16:03, 8 January 2021 (UTC)
 * Thanks, for context the picture was sent by an unidentified 'fan' with a comment saying he had 'bought' them, suggesting the creation of these accounts is automated? I hope this helps although I suspect if they find out about this exposure we'll have to create another discord account to gain entry! (We (JEM) nor James control the server so we rely on people allowing us in to moderate group chats) (I have a COI with this topic, please see my userpage), Emmeline Williamson45 (talk) 16:16, 8 January 2021 (UTC)


 * The vandalism has re-begun. JJP...MASTER![talk to] JJP... master? 19:30, 10 January 2021 (UTC)
 * It's a shame they didn't mention the volunteers that spent time reverting the edits on this article. (I have a paid COI with JEM Media, for more details visit my userpage). --Emmeline Williamson45 (talk) 11:43, 9 January 2021 (UTC)
 * More socks are being created:

Pahunkat (talk) 11:52, 12 January 2021 (UTC)

, there are two accounts which are still active: Pahunkat (talk) 12:35, 12 January 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ to each other:


 * ✅ to each other:
 * (found when checking)
 * (found when checking)


 * The rest are . The geolocation bounces between countries, but are in the same region. They are all on the same user agent, but a very common one. Leaving case for behavioral investigation.  ~Oshwah~  (talk) (contribs)   22:01, 7 January 2021 (UTC)


 * Blocked a few related accounts and put EC protection on user talk:Realjamesh. Lots of sleeper personal attacks here. Best Wishes,  Lee Vilenski (talk • contribs) 21:55, 7 January 2021 (UTC)


 * Behaviour is identical for each account. Blocking, tagging, requesting global lock, closing. Girth Summit  (blether)  12:25, 12 January 2021 (UTC)
 * Thanks - agreed, blocked, tagged. Girth Summit  (blether)  12:38, 12 January 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Accounts created after previous socks had been blocked and tagged. Same pattern and style of editing. Opened their sandbox at first with "Hi Wikipedia I cant wait to make a page here". Looks like they are waiting to get auto-confirmed again. Diffs of first 10 edits exactly same as all previous socks.:


 * Oyibo Ain:, , , , , , , , , and.


 * Kelemen Valorie:, , , , , , , , , and.
 * Branislava Valentina:, , , , , , , , and.

and same for all. Ashley yoursmile!  14:26, 12 January 2021 (UTC)
 * Additional suspicious account-
 * This user triggered the edit filter trying to perform edit on while editing this SPI. See special abuse log for this user. So I'm also reporting them. No similarity in contribs though. Ashley  yoursmile!  16:02, 12 January 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Sock drawer is being refilled again. Pahunkat (talk) 14:38, 12 January 2021 (UTC)
 * I'm going to add some more users below. I posted one example of these users earlier but now I'm going to post them all. These were originally created, then blocked by LuK3, and the day after they were blocked the new accounts came.

They exhibit the same sort of user space spamming and given the timing I'm confident they're the same person. Pahunkat (talk) 15:11, 12 January 2021 (UTC)
 * , I hate to ping you again - but would you be able to block the latest batch of socks? Thanks, Pahunkat (talk) 15:18, 12 January 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * This is a bit of a bizarre case. Via CU I can say that Peter Karoline is ✅ to Name.len43, Gauti Shivali, and Aris Franciszka. However, the technical data for this case suggests that this may be a coordinated effort by multiple people rather than just a single user creating a lot of accounts. It's possible this is a UPE operation in progress. All accounts, closing. Mz7 (talk) 19:51, 12 January 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same behaviour going on here, expect more to come. Pahunkat (talk) 09:14, 13 January 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Lots more SPI disruption filter log entries from IPs. Pahunkat (talk) 12:10, 13 January 2021 (UTC)
 * I've added few more. Lets see how many more still left. Ashley  yoursmile!  13:05, 13 January 2021 (UTC)
 * Another batch incoming today. Added above. Ashley  yoursmile!  14:44, 14 January 2021 (UTC)
 * I think 's blocked the socks. Pahunkat (talk) 11:11, 16 January 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * All accounts blocked. Closing SPI...  ~Oshwah~  (talk) (contribs)   01:30, 19 January 2021 (UTC)

Suspected sockpuppets


Doesn't this account need a CheckUser, or is it done already? DarkMatterMan4500 (talk) (contribs) 14:06, 16 January 2021 (UTC)
 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

It's been blocked, and probably should be globally locked as with the rest of the socks. The admin who blocked it probably deleted their sandbox as well, since I can see no contribs. A CU probably won't be helpful here since the last CU hinted that this was likely an off-wiki effort. Pahunkat (talk) 15:56, 16 January 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * ❌ as far as checkuser evidence goes...  ~Oshwah~  (talk) (contribs)   01:32, 19 January 2021 (UTC)
 * When I checked this account previously, I noted that this is probably a group of multiple people coordinating together (WP:MEAT) rather than just one person, so the negative CU result doesn't surprise me. CU will probably have limited usefulness in this case moving forward. Closing as the account is already blocked. Mz7 (talk) 01:59, 19 January 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Sigh. See their sandbox. Bound to be others, I'll see what I can find. Pahunkat (talk) 11:04, 17 April 2021 (UTC)
 * Right, added more. See their sandboxes as well. Pahunkat (talk) 11:13, 17 April 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Here are some more ducks that have come post admin request by : Pahunkat (talk) 20:33, 17 April 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Yep, obviously. – please block the lot.  as well.  Blablubbs&#124;talk 11:55, 17 April 2021 (UTC)
 * All are now blocked. --Malcolmxl5 (talk) 13:21, 18 April 2021 (UTC)
 * Many thanks, – can I ask why you blocked them all without talk page or email access? Either way,  and closing.  Blablubbs&#124;talk 14:13, 18 April 2021 (UTC)
 * I took the view that a user who is globally locked has forfeited the ability to use these functions; they will lose them in any case when these accounts are globally locked. P.S. I came here by way of AIV where three IP were bot-reported after trying to blank this page; see the filter log. --Malcolmxl5 (talk) 15:03, 18 April 2021 (UTC)
 * That's true (and I don't object) – I was just wondering if there was past abuse there. Thanks for the filter log heads-up; for future reference, I'm listing the IPs below (there are quite a few); they geolocate all over the place, though I do note that some of them are on the same range and that there's a cluster in Eastern Saudi Arabia, mostly Saudinet IPs. Best, Blablubbs&#124;talk 16:45, 18 April 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

New phrase in sandbox, same MO. Will add more below. Pahunkat (talk) 09:20, 18 April 2021 (UTC)
 * More added, I think that's all but it would help if an admin/SPI clerk could sweep something that I don't have the privileges to (BEANS BEANS BEANS) which I could provide by email. Sorry if some users are duplicated. Pahunkat (talk) 09:34, 18 April 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Hey, these are accounts created by what appears to be a group of people who are fans of a youtuber. The accounts make ten useless edits in their sandbox to game autoconfirmed - pretty sure their next target is James Haworth (which happens to have the same name as the youtuber), previously it was the TP of the youtuber's Wikipedia account. Pahunkat (talk) 14:18, 18 April 2021 (UTC)
 * , I'm pretty certain that they use a sort of program to generate a random name and get the ten edits, with the actual person behind each account only needing to solve the captcha. Past remarks seem to indicate that the people behind these are communicating and coordinating their attempts by a discord server. Pahunkat (talk) 14:25, 18 April 2021 (UTC)
 * , sent the email. Thanks :-) Pahunkat (talk) 14:46, 18 April 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Yep, more of same. Really curious about what exactly is going on here. – please indef the lot. .  Blablubbs&#124;talk 14:15, 18 April 2021 (UTC)
 * Interesting. What's curious to me is that per CU this is largely MEAT rather than socking proper, but they all use real names (somewhat reminiscent of spambots) and use the exact same method for gaming autoconfirmed (down to the phrases they use), which suggests extremely close coordination. Blablubbs&#124;talk 14:21, 18 April 2021 (UTC)
 * some people really do have strange hobbies... Anyway, would you mind emailing me your BEANSy sweep idea? Thanks and best, Blablubbs&#124;talk 14:31, 18 April 2021 (UTC)
 * Thanks, replied :). Blablubbs&#124;talk 14:57, 18 April 2021 (UTC)
 * Looks like Malcomxl5 got the second group too (thanks!) –, closing. Blablubbs&#124;talk 16:34, 18 April 2021 (UTC)
 * And two more IPs, that’s five today; see edit filter. --Malcolmxl5 (talk) 16:37, 18 April 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

More of the same sandbox spam. Pahunkat (talk) 18:18, 19 April 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I’ll add to that: --Malcolmxl5 (talk) 20:47, 19 April 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Yep, all them. No new IPs today. – please indef the lot. .  Blablubbs&#124;talk 20:53, 19 April 2021 (UTC)
 * All blocked, Blablubbs. --Malcolmxl5 (talk) 20:57, 19 April 2021 (UTC)
 * Thanks., closing. Blablubbs&#124;talk 20:59, 19 April 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Sandbox spam, immediately after getting autoconfirmed editing User:Realjamesh. Pahunkat (talk) 18:19, 21 April 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Und täglich grüsst das Murmeltier. It's them, no other accounts seen through the method mentioned a few filings back.  – please block the sock indefinitely. Thanks and best,  Blablubbs&#124;talk 18:33, 21 April 2021 (UTC)
 * Actually, we can just skip the blocking part. Lock requested and received,, closing. Blablubbs&#124;talk 18:54, 21 April 2021 (UTC)