Wikipedia:Sockpuppet investigations/Lachskai/Archive

Suspected sockpuppets
The Jfjrj account was created less than an hour after Lachskai was blocked indefinitely (Special:Log/Jfjrj), and both mainly edit Template:Infobox Cyrillic letter, adding many unsourced letters, most often without leaving an edit summary. All letters added by Jfjrj were also added by Lachskai. Jfjrj also submitted Draft:Dotted I with acute for review, a page that Lachskai originally created. It can be seen on the edit filter log that Jfjrj attempted to create User:Lachskai. All edits from both accounts are tagged with ‘mobile edit’ and ‘mobile web edit’. — Preceding unsigned comment added by SlimyGecko7‎ (talk • contribs) 18:15, 25 November 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ plus the following sleeper accounts:
 * Although LACHLAN menzies is technically the oldest account, let's keep this under Lachskai since that is the first account to have edits., closing. Mz7 (talk) 19:40, 25 November 2022 (UTC)
 * Although LACHLAN menzies is technically the oldest account, let's keep this under Lachskai since that is the first account to have edits., closing. Mz7 (talk) 19:40, 25 November 2022 (UTC)
 * Although LACHLAN menzies is technically the oldest account, let's keep this under Lachskai since that is the first account to have edits., closing. Mz7 (talk) 19:40, 25 November 2022 (UTC)
 * Although LACHLAN menzies is technically the oldest account, let's keep this under Lachskai since that is the first account to have edits., closing. Mz7 (talk) 19:40, 25 November 2022 (UTC)
 * Although LACHLAN menzies is technically the oldest account, let's keep this under Lachskai since that is the first account to have edits., closing. Mz7 (talk) 19:40, 25 November 2022 (UTC)

Suspected sockpuppets
Editing Draft:Dotted I with acute, which the sockmaster had created and one of the sockmaster's sockpuppets, Jfjrj had edited.  User:Noobicus had also made edits that seemed like they had previous experience in Wikipedia, such as:
 * 2nd edit was adding the R from shortcut template to a redirect.
 * Changing "Rcat" to "Redirect Category" in Minecraft Pocket Edition
 * Adding the stub template to their own userpage?
 * Requesting an increase of page protection for the article Belarus
 * Changing to   ‍ ‍ Helloheart ‍  ‍  22:48, 22 February 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


 * Seen this user and their socks recently—definitely matches behaviorally. ~ Pbritti (talk) 07:05, 23 February 2023 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Please see the discussion between and myself over at User talk:Yamla. I tied a slew of vandal socks together and Bbb23 pointed out the oldest account on my list is . As many of the socks were previously identified as belonging to this sockmaster, Lachskai, I think that means we are going to need to move this SPI around. I'd like a clerk's opinion on that. Before we take any action, though, I think an even deeper dive is necessary. There were some possible sleeper accounts and I'm not convinced I have identified the oldest account yet. This may be a case where we need two checkusers, too, given the sheer amount of information involved. I plan on diving in to the technical details tomorrow and welcome thoughts in advance of that effort. --Yamla (talk) 22:13, 23 February 2023 (UTC)

I'm not done yet, though. I'm leaving this inprogress at least until tomorrow. This is a pretty significant sock farm and it's time to shut it down, but that will require more effort and investigation, and definitely more socks. --Yamla (talk) 22:22, 24 February 2023 (UTC)
 * Provisionally confirmed, but I'll seek out a second opinion:


 * This investigation is still in progress. --Yamla (talk) 20:13, 26 February 2023 (UTC)
 * Any update on this? This case has been in the "inprogress" status for some time now. Mz7 (talk) 20:22, 11 March 2023 (UTC)
 * Uggh, thanks. This had fallen off my radar. I have obtained a second opinion and will wrap it up within 24 hours. --Yamla (talk) 20:25, 11 March 2023 (UTC)
 * The nature of the IP addresses involved mean that we may inevitably have some false positives, so behavioural evidence needs to be taken into account. That's somewhat subjective, though pretty clear here. Tying back to the original sockmaster,, is a bit challenging as the data is stale. However, the historical data does tie in sufficiently that I'm comfortable with that as the original sockmaster.
 * and based on (somewhat subjective) behavioural evidence and historical technical data, sockpuppets of Lachskai:


 * but either a sleeper or not abusive, so which I'm not comfortable tagging and blocking at this time:


 * Within the next 24 hours, and hopefully within the next 12, I will (re-)tag and block the first set of accounts and unblock and untag the second set of accounts. --Yamla (talk) 15:36, 12 March 2023 (UTC)
 * (you forgot to sign) Forgive me, but I'm puzzled why you wouldn't block or leave blocked the second set of accounts. When we block socks, we block the person. It's irrelevant if one particular account is not abusive because the person is abusive with at least one account. As long as you're confident that these other accounts are in fact the same person (technically), I don't understand why you wouldn't block. Accounts without contributions are also normally blocked, obviously only by CheckUsers, but, otherwise, they might start contributing and we wouldn't necessarily notice. You're in charge here, but I thought I should tell you what I think before you put this baby to bed.--Bbb23 (talk) 14:01, 12 March 2023 (UTC)
 * (Thanks, signed) The problem is the nature of the IP address. Think: school. Both sets of accounts are technically indistinguishable, but there's still a chance there's one sockmaster and a few innocent users caught up here. In a normal SPI, we'd see technical evidence showing pretty clearly there are multiple people involved and we do not see that here, but a small number of the accounts have contributed constructively, which leads me (WP:AGF) to suspect there is a prolific sockpuppeteer and a small number of people trying to be constructive. Happy for more feedback. --Yamla (talk) 15:36, 12 March 2023 (UTC)
 * Understood, thanks for the explanation.--Bbb23 (talk) 15:46, 12 March 2023 (UTC)
 * Thanks, Bbb23. This was the largest and one of the stranger SPI I've ever looked at and I appreciated all your thoughts on this case. --Yamla (talk) 15:49, 12 March 2023 (UTC)
 * All socks in group 1 tagged and blocked, any existing blocks on users in group 2 (in all cases placed by me) lifted. Nothing more to do here except watch out for new socks. Phew, time to celebrate with shepherd's pie. --Yamla (talk) 21:06, 12 March 2023 (UTC)

Suspected sockpuppets
Similar interest in templates and redirect as previous sockpuppets, e.g. ->  or  ->. This doesn't seem like a coincidence as well. Johannnes89 (talk) 09:47, 11 April 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - same interest in Cyrillic letters too. I actually noticed this account yesterday and meant to file it but got distracted. Please CU to confirm and check for others given the results of the last check. Thanks, Spicy (talk) 20:12, 11 April 2023 (UTC)
 * I'm going to call this ✅, but like noted in 22 February 2023, there's something a bit odd going on. -- RoySmith (talk) 21:39, 11 April 2023 (UTC)

Suspected sockpuppets
Just for the record, I've re-blocked Sssssssuuu on the basis of this move. The account was among those unblocked by as uncertain. Justlettersandnumbers (talk) 10:43, 25 April 2023 (UTC)


 * Excellent, thanks. Very much appreciated. -- Yamla (talk) 10:48, 25 April 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * --Jack Frost (talk) 11:38, 25 April 2023 (UTC)