Wikipedia:Sockpuppet investigations/Ghumen/Archive

13 December 2014

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Uses socks to edit-war on British diaspora. Single-edit IPs support his reversions on the article, diff1, diff2 which are not supported by the citation given on which the table is based. He does not discuss or explain his reversions despite warnings. Δρ.Κ. λόγοςπράξις 02:50, 13 December 2014 (UTC)
 * IP 93.109.179.224 alerted me to the irregularities and having checked the edits it was clear to me that IP 93.109.179.224 was correct. Semiprotecting the page prevents IP 93.109.179.224 from fixing the problems with OR and SYNTH which are present in the article. Please see my talkpage for more details. By the way, I never edit logged out. Δρ.Κ. λόγοςπράξις 06:13, 14 December 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

There's 3 different IPs from Peru (Dr.K. left out ) + Ghumen performing the same or very similar edits, all of whom are uncommunicative. You might wanna recheck your "logic". Also, counter-accusing a long-time editor in excellent standing is inappropriate, no matter how flimsy you consider their evidence to be. [93.109.179.224] 31.153.50.47 (talk) 12:55, 14 December 2014 (UTC)


 * Thank you anonymous editor. I saw the other IPs but I just added the ones which participated in the edit-war. There are many more. Non-exhaustive example:, , , , . I still think that Ghumen should have been warned at a minimum and the article not semiprotected so that you could do your cleanup of the table as we discussed. Δρ.Κ. λόγοςπράξις 16:11, 14 December 2014 (UTC)
 * And what we are talking about is not rocket science and is verifiable by any editor who cares to check these facts. At issue here is keeping a list which ranks the population of Britons abroad based on a single BBC reference. Since that list is based on the BBC reference, one cannot go and start changing the rank of the populations based on other reference(s) in a piecemeal way, because noone knows the methodology of the other source(s) and if the BBC source ranking, which dates from 2006, has not changed in the meantime. This is simple due dilligence in presenting a ranked table. Yet, due to the semi-protection, the constructive anon editor is prevented from carrying out the cleanup due to the edit-warring IP socks of Ghumen. Δρ.Κ. λόγοςπράξις  18:10, 14 December 2014 (UTC)
 * Thank you Mike for the the followup. I agree with your warning to Ghumen and also for the reasons for not blocking the IPs involved and in that sense your semiprotection of the page is justified. As far as the anonymous editor, I can't speak for them, but there is a percentage of editors who don't like registered accounts, one reason being, as I have seen in past comments, that they don't like to create a wiki personality which carries with it several constraints. As far as your comment about me, I had realised it was tongue-in-cheek, but I thought I had better make my disclaimer, just in case. :) In this murky world dominated by the shadows of the socks one cannot be too careful. :) All the best and Season's Greetings to you. Δρ.Κ. λόγοςπράξις 19:34, 14 December 2014 (UTC)


 * I agree that blocking them for SP would've been excessive. I see no substantive evidence that they were trying to game the system, or, even, fool anyone. I think a watchful eye would've been better than a two-week edit protection. If they keep edit-warring, just block them/their IP for an appropriate length of time. Edit protection is best reserved for persistent vandalism or content disputes. This has proven to be neither. A content dispute where one party makes no effort to communicate is better described as disruption on their part. 31.153.50.47 (talk) 20:38, 14 December 2014 (UTC)
 * Well, the two edit-warring IPs were actually trying to avoid scrutiny during the edit-warring and avoid getting blocked for 3RR, so that's gaming the system. But the problem lies with blocking them since they are dynamic IPs. So they would have theoretically continued edit-warring by changing their address. Since a range-block does not appear to be a good option, semi doesn't look that bad, except it prevents you from directly doing your edits. The lack of communication along with the use of IPs in an edit-war is a sure sign of disruptive editing, and that's the reason I opened this SPI. If you have any ideas on how to improve this table please let me know and I'll try to implement them. Δρ.Κ. λόγοςπράξις 23:56, 14 December 2014 (UTC)
 * "Well, the two edit-warring IPs were actually trying to avoid scrutiny ... " We assume. It could be, for example, that the "sockpuppet" was on data. I remain unconvinced that edit protection was the best remedy, but I won't argue this further. 31.153.50.47 (talk) 00:11, 15 December 2014 (UTC)
 * Not sure what "the sockpuppet was on data" refers to, but yes, the other alternative would have been to block the master if they continued socking through other IPs. I'm not sure how much better an option this could have been, given that these IPs were dynamic and in effect, short of a range block,  unblockable. Δρ.Κ. λόγοςπράξις  00:21, 15 December 2014 (UTC)
 * A mobile data service. Like I said, a watchful eye. They hadn't continued to edit war after this investigation was started. If they do again in the future, then block their IP. If they hop on another IP, then, and only then, edit-protect the page. It had been longer than 24 hours between your edit and the protection of the page. 31.153.50.47 (talk) 00:46, 15 December 2014 (UTC)
 * Thanks clarification. Your proposal sounds fair. Hopefully the semi can be reduced and then we can see what happens. Δρ.Κ. λόγοςπράξις 01:13, 15 December 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Well, by that logic one might argue that you logged out while editing too. :) 1, 2, 3, 4, 5. I've decided that it's best to just semi-protect the page for 2 weeks. Mike V  •  Talk  04:53, 14 December 2014 (UTC)
 * The original comment that I made was tongue in cheek and I didn't have any serious thoughts that Dr. K was editing while logged out. However, the "evidence" I provided was not much different from what was provided when this case was opened. Sockpuppet investigations have a higher burden of proof than most things on Wikipedia because of the consequences that are involved. Sockpuppet accounts are blocked indefinitely and the nature of the block makes it quite difficult to be appealed. We need to be sure that the accounts and/or IPs that are blocked are indeed related to the master account or else we risk alienating unintended users. (Consider: AN/3RR requires at least 4 diffs demonstrating the concerning behavior for only a 24 hour block.)
 * I've looked through the contributions of the IPs that you have provided. It helps show that there might be a longer standing issue than once thought. I think it's fair to issue Ghumen a warning and I have done so. However, the range of the IPs is too large to perform a range block, there's just too much collateral damage. Blocking the IPs individually isn't helpful as most of the edits are months old and the individual no longer uses those addresses. As such, I still think that semi-protection is the best option available. If your anonymous friend wishes to update the table, he or she is welcome to make use of the   template. Also, he or she seems to be interested in helping to build and improve the encyclopedia. Why not consider creating an account?  Mike V  •  Talk  19:09, 14 December 2014 (UTC)

06 June 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Ghumen, new account Oursourson.nouvelle, and IP editors have repeatedly inserted identical or similar text in two small parts of article Marseille: a specific population table and a hatnote. (The hatnote directs readers through various redirects to Religion in Marseille, an article created by Ghumen on 16 May 2015). The disruptive editing has continued in the face of reverts and warnings; none of the editors have responded to attempts to engage them in discussion. From latest to earliest edits:

Worldbruce (talk) 01:02, 6 June 2015 (UTC)
 * Oursourson.nouvelle adds Spain, Germany, Belgium to table
 * revert
 * Oursourson.nouvelle adds UK 11 minutes after Ghumen
 * Ghumen adds Spain, Germany, Belgium
 * revert
 * 190.237.240.53 adds Spain, Germany, Belgium, UK, Romania, Russia
 * revert
 * 2001:1388:49c5:623a:251d:2a73:cbdb:1716 adds Spain, Germany, Belgium, UK, Romania, Russia
 * revert
 * 2001:1388:49c4:ffe6:a9fc:5fc0:3caa:6e8d adds China
 * revert
 * Ghumen adds changes Armenian Apostolic to red link Armenian Apostolic in Marseille in hatnote 2 minutes after IP editor
 * 201.240.70.181 modifies Spain, adds Judaism in Marseille and Armenian Apostolic to hatnote
 * revert
 * 190.235.61.220 adds Islam in Marseille to hatnote
 * revert latest edit
 * adds Armenia, modifies Poland and Spain to table
 * 190.236.207.116 adds Spain to table

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * is ✅. I'm indeffing and tagging Oursourson.nouvelle. Blocking Ghumen for one month. I'll look at the IPs in a moment.--Bbb23 (talk) 01:43, 6 June 2015 (UTC)
 * Some of the IPs haven't edited since May. A few haven't edited for a few days. I don't think it makes sense to block them as my assumption is there's more where they came from. I've semi-protected Marseille for two weeks. Let's see if that brings down the disruption. Closing.--Bbb23 (talk) 01:46, 6 June 2015 (UTC)

20 August 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Clear similarity in usernames and type of articles edited, plus copying within Wikipedia. There also appear to be some Peruvian (see archived investigation) IPs making similar edits. Cordless Larry (talk) 14:24, 20 August 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  18:02, 1 September 2015 (UTC)
 * Ok, probably the same user, but I don't see overlap in edits. Might have forgotten his password, etc.  As for IPs, people will edit logged out, you would have to explain how he is using these accounts to abuse the system here.  Dennis Brown - 2&cent; 23:03, 28 August 2015 (UTC)
 * Closing for now. Please refile if there is more evidence.

18 October 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Guhmen created many "X people in France" articles. Two were redirected and recreated to avoid AfD [//en.wikipedia.org/w/index.php?title=Austrians_in_France&diff=686291247&oldid=686291188] by User: Irishmen122 origina article created by  and [//en.wikipedia.org/w/index.php?title=Lithuanians_in_France&diff=686292068&oldid=686292025] by User:TatuKFrUk original article created by. All three SOCKs were created in the last week with the two that did the redirects being created today. J bh Talk  13:24, 18 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Thisistheremix43 popped up to do the same at Dutch people in France. Cordless Larry (talk) 14:33, 18 October 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ✅:
 * The master is now indefinitely blocked and tagged. The puppets are blocked/tagged. There will continue to be a significant amount of disuption by IPs across many articles. Range blocks aren't feasible without collateral damage, and there would have to be more than one. Given the number of articles, semi-protection will be tough, but as much as possible, I recommend it, as well as reopening this SPI with individual IPs who are recently editing. Closing.--Bbb23 (talk) 14:55, 18 October 2015 (UTC)
 * The master is now indefinitely blocked and tagged. The puppets are blocked/tagged. There will continue to be a significant amount of disuption by IPs across many articles. Range blocks aren't feasible without collateral damage, and there would have to be more than one. Given the number of articles, semi-protection will be tough, but as much as possible, I recommend it, as well as reopening this SPI with individual IPs who are recently editing. Closing.--Bbb23 (talk) 14:55, 18 October 2015 (UTC)
 * The master is now indefinitely blocked and tagged. The puppets are blocked/tagged. There will continue to be a significant amount of disuption by IPs across many articles. Range blocks aren't feasible without collateral damage, and there would have to be more than one. Given the number of articles, semi-protection will be tough, but as much as possible, I recommend it, as well as reopening this SPI with individual IPs who are recently editing. Closing.--Bbb23 (talk) 14:55, 18 October 2015 (UTC)
 * The master is now indefinitely blocked and tagged. The puppets are blocked/tagged. There will continue to be a significant amount of disuption by IPs across many articles. Range blocks aren't feasible without collateral damage, and there would have to be more than one. Given the number of articles, semi-protection will be tough, but as much as possible, I recommend it, as well as reopening this SPI with individual IPs who are recently editing. Closing.--Bbb23 (talk) 14:55, 18 October 2015 (UTC)
 * The master is now indefinitely blocked and tagged. The puppets are blocked/tagged. There will continue to be a significant amount of disuption by IPs across many articles. Range blocks aren't feasible without collateral damage, and there would have to be more than one. Given the number of articles, semi-protection will be tough, but as much as possible, I recommend it, as well as reopening this SPI with individual IPs who are recently editing. Closing.--Bbb23 (talk) 14:55, 18 October 2015 (UTC)
 * The master is now indefinitely blocked and tagged. The puppets are blocked/tagged. There will continue to be a significant amount of disuption by IPs across many articles. Range blocks aren't feasible without collateral damage, and there would have to be more than one. Given the number of articles, semi-protection will be tough, but as much as possible, I recommend it, as well as reopening this SPI with individual IPs who are recently editing. Closing.--Bbb23 (talk) 14:55, 18 October 2015 (UTC)
 * The master is now indefinitely blocked and tagged. The puppets are blocked/tagged. There will continue to be a significant amount of disuption by IPs across many articles. Range blocks aren't feasible without collateral damage, and there would have to be more than one. Given the number of articles, semi-protection will be tough, but as much as possible, I recommend it, as well as reopening this SPI with individual IPs who are recently editing. Closing.--Bbb23 (talk) 14:55, 18 October 2015 (UTC)
 * The master is now indefinitely blocked and tagged. The puppets are blocked/tagged. There will continue to be a significant amount of disuption by IPs across many articles. Range blocks aren't feasible without collateral damage, and there would have to be more than one. Given the number of articles, semi-protection will be tough, but as much as possible, I recommend it, as well as reopening this SPI with individual IPs who are recently editing. Closing.--Bbb23 (talk) 14:55, 18 October 2015 (UTC)

21 October 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Creating 'X in Y' country articles cf Syrians in Sweden and concentrating on this type of article. Same pattern as master account. J bh Talk  02:07, 21 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Syrians in Sweden shows some of the same characteristics of Ghumen's editing, such as the fact that it is largely copied from Syrians in Germany (with the editor forgetting to replace one instance of "Germany" with "Sweden"). Cordless Larry (talk) 07:13, 21 October 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * The account is ❌.--Bbb23 (talk) 04:06, 21 October 2015 (UTC)
 * The suspect is now blocked as a sock of another master. Closing the case.  Vanjagenije  (talk)  18:58, 24 October 2015 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

This IP has popped up and tried to recreate Irish people in France, which is a Ghumen creation previously deleted. Also seems to have the same interest in country pairings as previous socks. Cordless Larry (talk) 17:43, 6 December 2021 (UTC)
 * Given the mix of accounts and IP addresses in the case archive, I suspect there are sleepers, but if it's not possible within policy or technical limitations then there's not much that you can do, . Cordless Larry (talk) 19:59, 7 December 2021 (UTC)
 * Policy restrictions mean I can only publicly note the connections between accounts, so if I was to run a check on the IP (which is technically possible) I would not be able to disclose any found accounts due to only the IP being a possible sock which has CU data. As such, even if I was to run a CU and found accounts which were definitely sleepers / socks I would need to block them without noting a connection to this case. As such, even if I have ran a sleeper check, I cannot disclose any results here and thus it makes CU with regards to this report not possible. Dreamy <i style="color:#d00">Jazz</i> talk to me &#124; my contributions 22:38, 7 December 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - CUs cannot link IP addresses and accounts per the privacy policy. As such, even if accounts were found on this IP, we could not publicly detail these accounts. As the accounts in the archive are probably stale for comparison (reports from 2015), a sleeper check probably won't be able to run. As such I see no need for CU in this case. If you have a reason for CU, do ping detail it. Dreamy <i style="color:#d00">Jazz</i> talk to me &#124; my contributions 01:55, 7 December 2021 (UTC)
 * The IP hasn't edited in 10 days, and looking at the /18 range it is part of, there's a lot of other legitimate traffic, so I don't see that there's much to do there. I semi-protected Irish people in France for a while, and I'll leave it at that. -- RoySmith (talk) 17:45, 19 December 2021 (UTC)

Suspected sockpuppets
New editor restoring text originally introduced by Ghumen. Cordless Larry (talk) 14:05, 28 February 2022 (UTC)
 * I've added PolacyWeFrancji22, who has created Ukrainians in France in part by copy-pasting from the Ukrainians in the United Kingdom article (see the religion section), in the same way as was done here. Cordless Larry (talk) 21:49, 28 February 2022 (UTC)
 * More likely socks added based on username similarities and overlaps in articles edited. Cordless Larry (talk) 22:11, 28 February 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - -- RoySmith (talk) 00:47, 2 March 2022 (UTC)
 * The accounts listed above are all ✅ to each other, plus -- RoySmith (talk) 01:25, 2 March 2022 (UTC)
 * I don't have enough data to call them confirmed to Ghumen, but there's enough hints in the logs, plus the obvious behavioral similarities, that I'm comfortable calling them proven -- RoySmith (talk) 01:28, 2 March 2022 (UTC)

Suspected sockpuppets
Three new editors have popped up at Ukrainians in France after the recent round of blocks that related to that article. There's also overlap with sock LituanianinFrance at Ukrainian refugee crisis, and use of identical edit summaries (e.g. this and this). Cordless Larry (talk) 13:32, 11 March 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - -- RoySmith (talk) 15:01, 11 March 2022 (UTC)
 * ✅ to each other and to various prior socks, calling them proven to Ghumen. -- RoySmith (talk) 15:11, 11 March 2022 (UTC)

Suspected sockpuppets
Compare this with this. Cordless Larry (talk) 07:47, 23 February 2023 (UTC)
 * Adding WP:DUCK editors from Ukrainians in France. Cordless Larry (talk) 07:54, 23 February 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ to each other:
 * to the above:
 * Remaining accounts . Non-stale accounts . ST47 (talk) 20:41, 25 February 2023 (UTC)
 * Tagging with dual taggs and closing.  Vanjagenije  (talk)  13:14, 26 February 2023 (UTC)
 * to the above:
 * Remaining accounts . Non-stale accounts . ST47 (talk) 20:41, 25 February 2023 (UTC)
 * Tagging with dual taggs and closing.  Vanjagenije  (talk)  13:14, 26 February 2023 (UTC)
 * Remaining accounts . Non-stale accounts . ST47 (talk) 20:41, 25 February 2023 (UTC)
 * Tagging with dual taggs and closing.  Vanjagenije  (talk)  13:14, 26 February 2023 (UTC)
 * Tagging with dual taggs and closing.  Vanjagenije  (talk)  13:14, 26 February 2023 (UTC)

Suspected sockpuppets
Similar username pattern as previous socks, restoring their edits. Cordless Larry (talk) 21:29, 3 March 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * . MarioGom (talk) 09:49, 4 March 2023 (UTC)
 * Tacking technical and behavioural evidence into account, I'm calling this ✅. Closing.  Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  13:49, 4 March 2023 (UTC)