Wikipedia:Sockpuppet investigations/HistorNE/Archive

03 November 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

The most recent is the probable block evasion, where an IP 46.239.10.178 edited pages Kurdish nationalism (Nov 2nd edit) and Exodus of Iran's Jews (Nov 2nd edit), both pages previously edit-warred by user HistorNE, who has meanwhile got blocked. What drew my attention was the physical location of IP 46.239.10.178, which was geographically very close to IP 88.207.89.208 - both coming from Serpska Republic, with the latter IP almost certainly identified with user HistorNE (see interwiki diff titled "Israeli vandalism", very similar to HistorNE's common editing summaries mocking US, Israel and Saudia like this, using concepts like "propaganda" and "POV pusher"). It suggests ip 46.239.10.178 is a highly possible block evasion attempt of HistorNE. HistorNE's field of interest is almost entirely Iran and Kurds (mostly Iranian Kurds). Since the beginning of his editing activity on June 11, 2013 he has been suspected as a sockpuppet of previously blocked user Shaushka (active 01 April-06 June, 2013 ); indeed, HistorNE's editing experience and knowledge of wikipedia features like this discussion on the first day of his editor experience (!) provides suspicion of his possible previous "life" on wikipedia. Finally, i would like to add suspected users Betam8 (edited between 5 July - 6 August, 2013 ) and Lastsolfa (edited between 30 July - 08 September, 2013) as additional suspected accounts, briefly used during HistorNE's editing life on wikipedia to engage in disruptive editing on Iranian and Kurdish-related topics of his interest. Lastsolfa account is especially intriguing, because it used a very similar editor summary signature "American and Israeli news outlets" on Hassan Rouhani article. GreyShark (dibra) 12:53, 3 November 2013 (UTC)
 * Another IP from same geographic location (Republica Serpska) engaged in edit-warring on HistorNE's affected pages here on October 3rd.GreyShark (dibra) 19:22, 3 November 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Looking into collateral damage associated with a rangeblock. Stand by. Sh i r ik  ( Questions or Comments? ) 21:53, 3 November 2013 (UTC)
 * CU has advised me a rangeblock would cause too much collateral damage. This will be a little more difficult. Sh i r ik  ( Questions or Comments? ) 22:04, 3 November 2013 (UTC)
 * I'm fairly convinced the two listed user accounts are not related based on behavior, and so not doing anything with them. If more evidence shows up, we should look at it. The IP range 46.239.32.0/19 is almost assuredly his, so I blocked those IPs 2 weeks and then extended block to indef due to block evasion. I'm not doing anything to 88.207.89.208 because it hasn't edited in a month. Closing this case.  Sh i r ik  ( Questions or Comments? ) 22:13, 3 November 2013 (UTC)

18 November 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Activity re-emerged on sockmaster HistorNE's affected pages (Iranian and Kurdish related topics). This time on Kurdish nationalism page by IP 89.111.253.223 (see Nov.18 edit). IP seems once again to come from Bosnia and Herzogovina (city of Banja Luka), similar to HistorNE and his associated IPs like this. Iranzamin-Iranzamin is also suspected - the user edit-warred on the page Madai on November 16-18 in a very similar manner to HistorNE (see ); in addition, it seems that wikiuser Iranzamin-Iranzamin signed-up on October 02, prior to the date HistorNE was banned; however the user re-emerged on November 12. HistorNE had previously been indefinitely banned on November 2 following a sockpuppet investigation.GreyShark (dibra) 17:45, 18 November 2013 (UTC) GreyShark (dibra) 17:45, 18 November 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I am not sock of HistorNE. You can easily investigate it. Just check our IP's. It is not hard to find whether I am sock of him or not. Iranzamin-Iranzamin (talk) 16:28, 7 December 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Closing as Iranzamin-Iranzamin has been blocked indef per the findings of a separate SPI. Mark Arsten (talk) 05:17, 16 December 2013 (UTC)

12 February 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Note: I just noticed that HistorNE was blocked last month for sockpuppetry. When HistorNE first showed up I tagged her userpage as a sock of another earlier blocked account making the same edits, User:Shaushka, but looks like nobody picked up on that. So this may be even more of a long term case. I hope this is the right place to put this in the record. Til Eulenspiegel /talk/ 00:07, 26 December 2013 (UTC)
 * Actually i noted this and it helped me to figure out that this creature is a sockmaster. It took me a long time to nail it. Unfortunately he is still active every now and then - see below. GreyShark (dibra) 17:50, 12 February 2014 (UTC)

Once again edit-warring on Kurdish and Iranian related topic (specifically Kurdish separatism in Iran article) on February 3rd. The geo-location once again shows origin from Republica Srpska, same as sockmaster HistorNE. Simultaneous activity on February 2nd also emerged on WikiData by HistorNE himself (he is blocked only on English wikipedia so far) - see. Since the IP, used here by HistorNE, has already edited in the past, it implies that this is not an only time activity. Request action against the IP.GreyShark (dibra) 18:00, 12 February 2014 (UTC) GreyShark (dibra) 18:00, 12 February 2014 (UTC)
 * - I think I have seen some similar activity coming from Istanbul IPs also...? Or is that another sockmaster? Til Eulenspiegel /talk/ 17:18, 13 February 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * IP blocked for 2 days for block evasion (whether it's HistorNE or not, they are definitely not new). Callanecc (talk • contribs • logs) 10:41, 13 February 2014 (UTC)

25 February 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

We are most probably speaking of continuing abuse by sockmaster HistorNE (probably same as User:Shaushka). I've already applied one case earlier this month - on February 12, resulting in temporal block of IP user:109.165.158.197, but apparently more puppets were engaged this time. Based on location (Telekom Srpske from Republica Srpska, 44° 48′ 50.04″ N) and habits (attraction to Islamic, Iranian and Kurdish related topics) as well as editing-time compatibility, disruptive behaviour, topic reverts which are related to activity of other sockpuppets and heavy implementation of words "propaganda", "POV" and "nonsense" in edit summaries. I want to point out the following suspects: Finally, i would like to add that SeanKesser began his wikipedia activity by very professional edits against alleged sockpuppetry of mangoeater1000 on February 14, which is highly unusual for a new wikipedia user. This caused an immediate suspicion and ban by administrator, but later SeanKesser was ublocked. I suspect we are dealing with a systematic case here.GreyShark (dibra) 18:30, 25 February 2014 (UTC) GreyShark (dibra) 18:30, 25 February 2014 (UTC)
 * user:109.165.172.137 - activity during February 7-8, including on Niqāb (Feb.7 revert mentioning Mangoeater1000) and Ali Khamenei ( Feb.7 revert) articles.
 * user:109.165.172.48 - activity on February 9-10 (previously also in 2012), engaging in edit-warring on Ali Khamenei Feb.9 mentioning Mangoeater1000, Niqāb articles.
 * user:SeanKesser - activity from 14 February, including on articles Human rights in the Islamic Republic of Iran (consequent with HistorNE and one of the IPs ), Niqāb (Feb.20 revert mentioning Mangoeater1000), Iranian gender restrictions in education (article which had previously been targeted by HistorNE ), disruptive editing and edit-warring on Hashem Shabani article (see ), and of course Ali Khamenei article.
 * user:109.165.183.50 - activity on 15 February, identifying as Sean Kesser
 * user:109.165.185.22 - activity on 19th February, at Human rights in the Islamic Republic of Iran, about 3 hours after HistorNE's edit from 2013 (before he was blocked) was reverted by me.
 * user:109.165.246.34 - activity on February 20 on wikimedia, engaging in edit-warring previously initiated by sockmaster HistorNE on February 2 (see )
 * user:Lastsolfa - already suspected as sockpuppet of HistorNE last year (investigation) and was idle for many months, but suddenly resumed activity on February 7 and 20. Previously edited Hassan Rouhani article, and engaged in criticism of user:Yintan "together" with HistorNE (see ).
 * I would like to add that apparently user:HistorNE started a campaign of disruption on many Iranian pages over wikidata (see ) and interwiki Iranian-related articles in other languages (Macedonian, Portuguese and Spanish - see ,,) during the past week and a half, which very much strengthens the suspicion of sock activity here as well. Apparently he is blocked only on English wikipedia so far. I think there might be a need to extend the block to global due to systematic disruptive editing in other languages and already existing permanent block on English wikipedia due to sockpuppetry. In addition, long-term abuse counter-measures might be required.GreyShark (dibra) 22:01, 1 March 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' It is rather absurd and even funny that I have been accused as a suspicion for Sockpuppetry as I have never used any other account. I only edit content in ways which I believe are legitimate, in articles that matter to me. I am particularly interested in Iranian politics and attempt to discuss content which I find unbiased or inaccurate. I have moved to another country in the past few months therefore using a different IP. I am not a frequent editor, hence my little activity. Please contact if you have further questions. --Lastsolfa (talk) 14:51, 26 February 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Definitely not a Mangoeater sock. But I am significantly concerned about their propensity for edit warring right off the bat, and was told by a CU that something fishy was going on with their IP address. I wouldn't be surprised if this was a sock. --Rschen7754 18:45, 25 February 2014 (UTC)
 * - - Goodness. Well, HistorNE is  on this wiki, but there's certainly enough live IP information on other wikis. The page moves at  are enough grounds for a check on SeanKesser. As far as Lastsolfa, I'm not entirely sure -  and  are concerning, for sure. As far as the crosswiki issues, that can be handled after we determine what is going on at this wiki. Rschen7754 22:32, 1 March 2014 (UTC)
 * SeanKesser is based on data in the archives and logs. Lastsolfa is ❌. . T. Canens (talk) 04:07, 5 March 2014 (UTC)
 * The likely CU result combined with behaviour is enough for me to block SeanKesser. IPs are stale and not enough evidence for Lastsolfa. Closing. Callanecc (talk • contribs • logs) 12:54, 5 March 2014 (UTC)