Wikipedia:Sockpuppet investigations/Hiyob346/Archive

21 November 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

I contend that Hiyob, who was edit warring on Eritrea, created Skypernow1 (first edit) on 15 November, a couple of hours after the article was protected by, a couple of hours after they got blocked for copyvios. They're currently blocked for edit warring, which only adds to this report's credibility. Skypernow1 makes a bunch of little-bitty edits to get autodonfirmed, so they can take over from Hiyob in an edit war over coffee, beer, and language. For example, Hiyob's last edit, Skypernow1's first edit. (Scroll down for the similarities, and note how Skypernow1 has remarkable knowledge for an editor with a dozen edits.) In other words, block evasion etc. I'm asking for CU because I have the feeling that Hiyob didn't come out of nowhere, and there are possibilities of earlier, similar edits in that history; I'm interested in what else might turn up. Drmies (talk) 03:18, 21 November 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - to confirm, and sleeper chekc. Rschen7754 07:20, 21 November 2013 (UTC)
 * I found the following to be ✅ to each other and the master:


 * as well as the following to be
 * Looking at CU logs there isn't anything related, and I don't recall anything of this nature, but it does seem unlikely these are their first edits. NativeForeigner Talk 09:10, 21 November 2013 (UTC)
 * Looking at CU logs there isn't anything related, and I don't recall anything of this nature, but it does seem unlikely these are their first edits. NativeForeigner Talk 09:10, 21 November 2013 (UTC)


 * Blocked, tagged, closing. Rschen7754 09:13, 21 November 2013 (UTC)
 * ,, thank you so much. Ha, I'm not surprised to see that Birdwatcher pop up in that list. Thanks again for your quick action. Drmies (talk) 14:47, 21 November 2013 (UTC)
 * Followup note, Chkc46 is now confirmed to the other accounts. -- DQ   (ʞlɐʇ)  20:34, 23 November 2013 (UTC)

22 November 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

In the time since the previous investigation was closed yesterday (11/21), new account Freedomfwe was created, and they proceeded with the same edits as confirmed sock Birdwatcherblue (compare with  at Injera). After Freedomfwe was blocked (today), 5.243.54.147 (which I've already blocked) continued the same pattern. That's the same ISP (but not the same subnet) as 37.196.49.40 a couple of days ago (11/20; ). Given that Freedomfwe was created after the previous check, and that the edits evidently occur on different parts of the same ISP's network, I have to wonder whether there are more in the drawer. -- Gyrofrog (talk) 16:50, 22 November 2013 (UTC)


 * P.S. At least for the sake of future reference: I believe all of these (including Hiyob346) may be the same person behind Category:Suspected Wikipedia sockpuppets of Ser3e1, from a 2010 dispute over Injera (see Talk:Injera). The IPs in that case are from the same geographic area, but different ISP. -- Gyrofrog (talk) 17:17, 22 November 2013 (UTC)


 * Also just blocked 5.243.79.174, same ISP. But a rangeblock encompassing both 5.243.54.147 and 5.243.79.174 (i.e. 5.243.0.0/17) up to 32768 users. -- Gyrofrog  (talk) 21:10, 22 November 2013 (UTC)
 * And 37.2.241.79, 37.3.231.162... -- Gyrofrog (talk) 21:15, 22 November 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Freedomfwe is using the same mobile range as a previous sock, but on a different device. Behavoir will have to determine this one. -- DQ   (ʞlɐʇ)  20:36, 23 November 2013 (UTC)
 * Master and sock both blocked indef. Apparently no further technical evidence of ongoing socking is available. Closing now. Mark Arsten (talk) 20:59, 24 November 2013 (UTC)

26 November 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

The Canevino16 account was created today, shortly after the last Hiyob346 sock accounts and ips were blocked. He/she has no edits other than a series of personal attacks connected with Hiyob346. Canevino16 also has identical gripes (all Eritrea-related), arguments, links, writing style, posting times, and pages of interest as Hiyob346,. Additionally, Canevino16's first edit was made within hours of more ip disruption by a .se geolocated ip on Tigre people and Agaw people,. Both pages have now also been placed under protection. Middayexpress (talk) 22:23, 26 November 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * This is  editing via mobile device/tablet; combined with the behavioural evidence I'd block it as a sock. (No comment with regard to the IP).--Jezebel's Ponyo bons mots  17:14, 27 November 2013 (UTC)
 * Confirmed sock blocked indef and IP's targets semi-protected. Closing now. Mark Arsten (talk) 19:11, 27 November 2013 (UTC)

01 December 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same .se geolocated ip as Hiyob346 performing the same reverts on the same otherwise quiet Injera and Saho people  pages. Newly registered account Mbvkop99 then shows up a few hours later on Injera to continue reverting the same material in the ip's place. Middayexpress (talk) 23:08, 1 December 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Adding apparent suspected socks. I'll mention to the reporting user that it's his/her responsibility to do this in future.  —  Rich wales (no relation to Jimbo) 05:17, 2 December 2013 (UTC)


 * ✅. User:Mbvkop99 shows same technical information as User:Hiyob346, except that one is editing through the a university portal and the other from a mobile network in the same geopolitical entity. The IP shows the same technical stats as the mobile device used by User:Hiyob346 on the same network (but different IP). -- Avi (talk) 16:23, 2 December 2013 (UTC)
 * Mbvkop99 tagged and blocked indef, IP blocked one week for block evasion. Closing now. Mark Arsten (talk) 16:27, 2 December 2013 (UTC)

22 December 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Likely Hiyob346 again per WP:DUCK. Same reverts by new accounts on same otherwise quiet page, all within days of each other. Also again Swedish geolocated (link-thrus here ). Middayexpress (talk) 19:19, 22 December 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following are discovered as ✅ socks of Hiyob346:

- Mailer Diablo 23:03, 22 December 2013 (UTC)
 * All blocked and tagged, closing now. Mark Arsten (talk) 01:27, 23 December 2013 (UTC)

29 October 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Similar general behavior and Eritrea-related interests as Hiyob346. User is currently blocked for edit warring on same Eritrea page. He/she has also attempted to remove the same particular paragraph from there ("Besides convergent culinary tastes...", ). Additionally, he/she appears to be using ips with the same .se geolocation (130.237.177.13, 77.218.240.73). Middayexpress (talk) 17:33, 29 October 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
After reviewing the account's contributions, I noticed many similarities with the master account including their topic of interest, their editing style, and having similar tone and dialect. (For instance, the users both use the regional spelling of coffe. 12) As such, I have blocked the account as a sock. I think the IPs are a bit stale now to take any action. Mike V •  Talk  16:36, 12 November 2014 (UTC)
 * A quick CU note prior to archiving. is an extreme likely, bordering ✅ sock of Hiyob346. I've also blocked the following as socks and/or sleepers:,  and .-- Jezebel's Ponyo bons mots  23:59, 12 November 2014 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Richard0048 has many similarites with the banned user Hiyob346 and their various puppets, including both their behavior and edits. Things that I have observed include:


 * 1. Removing content regarding the similarities that Eritrea has with other Horn of Africa countries:
 * Richard0048:, puppet/master account:


 * 2. Making similar changes on content about Eritrean Cusine:
 * Richard0048:, puppet/master account: and


 * 3. Removing Egypt and Sudan from Eastern Africa
 * Richard0048:, puppet/master account:


 * 4. Requesting the removal of an image depecting a Saho woman:
 * Richard0048:, puppet/master account: . Their also aware that the image was disputed before despite having an account for less than a year:


 * 5. Adding the same image of a Kunama man that was long requested by the master and their puppets:
 * Richard0048:, puppet/master account:


 * 6. Edits focus exclusively on things related to Eritrea. This is highlighted by other users:
 * Richard0048:, puppet/master:.


 * 7. Similar editing times:
 * Richard0048:, puppet/master:


 * 8. Occasionally using the regional spelling of "coffe":
 * Richard0048:, puppet/master account:


 * 9. An issue with consensus:
 * Richard0048:, puppet/master account:


 * 10. Third opinion shopping in the same fashion (ie. one admin, one user with extensive Wikipedia User Rights, and one forum) when  a dispute doesn't go in their favor:
 * Richard0048:, , and ; puppet/master account: , , and.

AcidSnow (talk) 00:50, 28 July 2016 (UTC)
 * Although we do disagree on content regarding Eritrea, this report has nothing to do with it. Connecting the report to a dispute on Eritrea is also what Hioyb346 has done before: . This connected statement isn't WP:DUCK though, but is nonetheless relavant. AcidSnow (talk)
 * Important Side Note: For those unaware a ""mysterious" Swedish IP has nominated the Saho image for deletion due to copyright violations on Wiki Commons. The nominating IP comes from the same exactly location as one of Hioyb46's IP sock. This image has also in the past been nominated for deletion by another Swedish IP from the same city. This whole event comes at a time when Richard0048 is engaging in a dispute on the Eritrea page about the same image. AcidSnow (talk) 14:40, 2 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

The accuser is involved in a disupute with me over the geograpical naming of Eritreas location. See case on the dispute resolution board[]. The accusations are far-fetched. My stance when it comes the alligations is that it's related to the dispute over content on the Eritrea talk page []. Richard0048 (talk) 18:50, 28 July 2016 (UTC)


 * on one hand both edit roughly the same articles, however, the time between the first edit of richard and the last edit of, hiyob346 is almost 2 years, i am going through the list of every sockpuppet known or suspected of hiyob to see if I can find a correlation. Iazyges (talk) 22:30, 12 September 2016 (UTC)

Richard did start editing when a lot of the suspected and blocked accounts did, around november, december or october, he also edits on very similar pages, however he would have to be very patient to wait a year to continue, if he is hiyob. Iazyges (talk) 23:04, 12 September 2016 (UTC)
 * Breakdown by Iazyges
 * Mrgreqoox (blocked) no edits.
 * Guftinee55 (blocked) no edits.
 * Jukfeela02 (blocked) no edits.
 * Mastermind4000 (blocked) no edits.
 * 2013
 * Chkc46 (blocked) edited entirely on 2nd of november 2013.
 * Mikeleberh (blocked) entirely on 12th of november 2013.
 * Skypernow1 (blocked) 15th of to 21st of november 2013.
 * Hiyob edited entirely in 17th of november of 2013.
 * Johan892 (blocked) 17th of november 2013.
 * Johneri01 (blocked) 17th of november 2013.
 * Birdwatcherblue (blocked) 17th through 20th november 2013.
 * 37.196.49.40 (suspected) edited entirely on 20th of november 2013.
 * 5.243.54.147 (suspected) edited entirely in 22nd of november of 2013.
 * 37.2.241.79 (suspected) also edited entirely in the 22nd of november of 2013.
 * 5.243.79.174 (suspected) also edited on 22nd november of 2013.
 * 37.3.231.162 (suspcted) edits entirely on 22nd of november of 2013.
 * 83.186.211.147 (suspected) edited entirely on 22nd of november 2013.
 * 5.243.139.238 (suspected) edited entirely on 24th of november, 2013.
 * Canevino16 (blocked) edited on 26th through 28th of november 2013.
 * 37.196.146.141 (Suspected) edited entirely on 29th of november 2013.
 * Mbvkop99 (blocked) 1st of december 2013.
 * 37.199.51.104 (Suspected) edited entirely on 3rd of december 2013.
 * Djigadjiga (blocked) edited entirely on 5th of december 2013.
 * Bnp2019 (blocked) edited entirely on 6th of december 2013.
 * ERBV33q (blocked) edited on 12th of december 2013.
 * Bvhutret (blocked) edited on 13th of december, 2013.
 * Nhfbj (blocked) edited from 16th of december to 19th of december 2013.
 * 2014
 * Fty1876a (blocked) edited from 22nd of september 2014.
 * CdR1256 (blocked) edited from 14th to 16th of october, 2014.
 * SEMeri10 (blocked) edited from 14th to 15th of october 2014.
 * Vetrisimino0 (blocked) 12th to 18th of november 2014.
 * 2016
 * (suspected) edits started october 8th, 2015.
 * Comments


 * Addendum
 * 77.218.253.11, the "mysterious swedish editor" shares the same IP as suspected sockpuppet 37.196.49.40. So he should be blocked regardless of the outcome of this case. Iazyges (talk) 23:10, 12 September 2016 (UTC)
 * Summoning . Iazyges (talk) 23:14, 12 September 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * but I would like to get some other clerks' input; pinging and  who have dealt with this case in the past, and  because it looks like Iazyges tried to ping you but I don't think the user template generates a ping. I collapsed Iazyges' analysis because it contains flaws and I believe draws an incorrect conclusion. AcidSnow's analysis is compelling; to it I'll add two things:
 * this account and the most recent blocked sock,, both made edits concerning images on Eritrea among their first edits: , (more examples in contribs)
 * see this Commons image DR history: it has been nominated twice seemingly frivolously by IPs which geolocate to the same city, and which match geolocation of several IPs named in this case's history. In the second request, Richard0048 removed the permission link after the IP had requested deletion, and was the only named editor supporting the clearly spurious request.
 * There was a CU done on the last case almost a year after the previous run, with a "confirmed" result. That says to me there must be info in the logs that can be used here. I would also like to see a check for sleepers given this sockmaster's history. Ivanvector (Talk/Edits) 15:42, 9 October 2016 (UTC)


 * is editing from the same geolocation as . The following accounts are the same user as Richard0048:


 * If Richard0048 is blocked as a sock, the four additional accounts should be blocked as well.-- Jezebel's Ponyo bons mots 21:46, 11 October 2016 (UTC)
 * please block all of these accounts. There is enough behavioural overlap that along with the geolocation match, I'm convinced these are Hiyob's socks. If a patrolling admin would like more info, please change the status to "hold" and email me. Ivanvector (Talk/Edits) 13:06, 12 October 2016 (UTC)
 * Due to the SPI backlog I've gone ahead and blocked the accounts. Please tag them as you see fit.-- Jezebel's Ponyo bons mots 21:54, 12 October 2016 (UTC)
 * all tagged. Case closed. Ivanvector (Talk/Edits) 13:39, 13 October 2016 (UTC)