Wikipedia:Sockpuppet investigations/Grathmy/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Pretty much a WP:Obvious sock is obvious case.

Evidences:


 * Activation dates: When user Grathmy becomes active on Wikipedia, some dubious ips with the same POV(all from the US) also become active. Grathmy, whose edits are identical to Tirgil34, became active after a long time and made his last edit on 20 June 2017. And since 21 June 2017, disruptive-dubious ips from the US has been editing various articles which are targeted topics of Grathmy/Tirgil34
 * Same form of disruptive edits: The ips from the US and Grathmy engaged in same forms of disruptive edits such as falsification of sources, POV rewordings, unexplained content deletions, etc. See previous similar disruptive edits by Grathmy
 * Same agenda: Both the ips from the US and Grathmy seem to have same agendas . E.g. rejecting or discrediting Kurgan hypothesis, rejecting steppe origin of R1a, the similar comments regarding the dates of Proto-Indo-Iranian cultures, trying to prove the accuracy of Gamkrelidze’s theory
 * Previous evidences: Dubious ips from the same location (from the US) were restoring Grathmy’s edits on various articles previously. See the edits by Grathmy and edits of ip socks from the US on BMAC. Other editors also thought that they were probably the same user. They were also socking on other articles such as Andronovo and R1a. Furthermore, the ips from the US were supporting Grathmy on talk pages and were making similar comments

For short, both their past and present edits and activation dates suggest that they are connected. I think the evidences are pretty clear, Quack.

Note to checkusers: This case, most probably, related to Tirgil34. Both Grathmy and Tirgil34 are identical to each other in any case. Grathmy was reported 3 times on the SPI and other editors agreed that Grathmy was one of the most suspicious Tirgil34 sock and escaped from the technical connection through abusing proxies

Regarding current suspected socks, see for example the timings from the early hours of 29 June 2017 UTC:

IP sock: 24.17.216.223


 * 00:28, 29 June 2017 (diff | hist) . . (-1) . . Armenian hypothesis (extra f in name removed)

Half an hour editing break, switches to suspected Tirgil34 sock Mr.Helping Hand


 * 01:03, 29 June 2017 (diff | hist) . . (+182) . . User talk:Nedim Ardoğa (→Translation help) (current)

Switches to IP sock: 207.198.105.21


 * 01:43, 29 June 2017 (diff | hist) . . (+867) . . Talk:Indo-Aryan migration theory (→Sintashta, Andronovo, BMAC, Indo-Iranians: new section)

The timings from the late hours of 01 July 2017 UTC:

IP sock: 2601:602:c302:cd3:6587:9262:ebc9:9eb4 (connected to ip sock 24.17.216.223)


 * 22:28, 1 July 2017 (diff | hist) . . (0) . . Beaker culture (current) (Tag: Visual edit)

About 40 minutes later, switches to suspected IP sock of Tirgil34: 171.99.161.244


 * 23:13, 1 July 2017 (diff | hist) . . (-31) . . Saka (→History) (Tags: Mobile edit, Mobile web edit)

185.65.245.200 (talk) 04:02, 2 July 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

, are there other ways to detect ip socking or "logging out to make problematic edits as an IP adress"? Grathmy is a notorious and suspected editor because of their previous actions and apparently engaged in ip socking to avoid scrutiny/sanctions. 185.65.245.200 (talk) 13:46, 7 July 2017 (UTC)
 * Yes, it's a form of sockpuppetry, but I can't use CheckUser to verify it. Say I do run CU, and I confirm one or more of the IPs listed here. That's a violation of the global privacy policy and the global CheckUser policy, not to mention the local policies. It's a serious privacy breach because it can pinpoint the geolocation and ISP of the named editor, among other things. We just don't do it. One of the clerks will do a behavioral investigation here. Katietalk 13:41, 7 July 2017 (UTC)
 * , okay, but just a note: probably none of those ips are physical locations of that user. 185.65.245.200 (talk) 14:00, 7 July 2017 (UTC)

On privacy policy:, there are so many such cases on WP:SPI and all of them are endorsed. It is confusing. 185.65.245.200 (talk) 14:11, 7 July 2017 (UTC)
 * Yes, but you requested CheckUser specifically. I can't run it here, but the case stays open until the behavioral analysis is done. Katietalk 14:13, 7 July 2017 (UTC)
 * , understood. Also for your interest, here is the related case. I filed it last month and still waiting for the review. Thanks. 185.65.245.200 (talk) 15:25, 7 July 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * We do not publicly associate IPs with named accounts. CU declined. Katietalk 12:42, 7 July 2017 (UTC)


 * I am not convinced these are Grathmy, and IP's haven't been active in nearly a week. Closing the case with no action. Sro23 (talk) 00:53, 14 July 2017 (UTC)
 * , did you check the "previous evidences" part? They were restoring each others, supporting each others with the same agenda and multiple editors also agreed that they belong to the same sockmaster. Also, unfortunately, it seems that your comment has encouraged the sockmaster-I know that was not your purpose/intention- They began to target the same articles via ipv6s as soon as the case closed. Dynamic ips(ipv6 in this case) hardly notice when they are alerted, as their ips constantly change. So how those ips would know when the case is closed or even they were reported? The sockmaster is watching the SPI case about him and has began to use their ip socks as soon as the case closed. Also, past and present evidences & activation dates are quite suspicious, I believe. 185.65.245.209 (talk) 10:40, 14 July 2017 (UTC)
 * I did. I actually think the evidence you gave that Grathmy was socking back in 2015 was quite strong. But there needs to be firm evidence Grathmy is socking now. Unfortunately at any given time there will always be people with a POV or agenda to push. I'm not comfortable requesting a block based on that shaky connection to the IP's from this year. Sro23 (talk) 11:19, 14 July 2017 (UTC)