Wikipedia:Sockpuppet investigations/Marshalb/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

has edited and tried to appeal block on behalf of this banned user - there is already a range block in place which was appealed in 2011 (see user talk for a master sock) Ed 6767   talk!  14:37, 28 July 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * I thought that the use of open proxies and VPNs was disallowed? Beyond My Ken (talk) 08:32, 31 July 2020 (UTC)

Note the Albuera article mentioned by the master is the Battle of Albuera, which is among the first articles edited by Snagemit when he first created the account, and which the two sockpuppets edited within 2 hours apart, a very obscure article which the master has been editing since at least 2008. And with an account that goes all the way back to 2007 that was already previously warned and blocked for sockpuppetting. The fact he is using a VPN means he is fully aware of what he was doing and trying to avoid scrutiny.

Also an interesting read would be Administrators' noticeboard/IncidentArchive1042 in which El C indefinitely blocked him for "disruptive editing (communication is required)", and this was before he revealed his sockpuppet. EtherealGate (talk) 08:50, 31 July 2020 (UTC)


 * A major characteristic of this rogue editor was the speed with which they moved from one article to the next - there was clearly no time to consult any sources, barely enough to read the paragraphs being edited. Presumably searching for such behaviour in such quantities could be automated. (A genuine editor might edit several related articles in a short time if these all arise from a small group of sources - but that is different.) Is this sort of rogue common enough for someone to automate this? Such a task is way outside my capabilities, but I thought it worth floating the idea. I vaguely recollect seeing a rogue editor with this sort of characteristic behaviour before (or perhaps it was just an unidentified sock of the same person?)ThoughtIdRetired (talk) 11:20, 31 July 2020 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Mz7 (talk) 03:04, 30 July 2020 (UTC)
 * because Snagemit appears to be using a VPN. Mz7 (talk) 03:13, 30 July 2020 (UTC)
 * I've just blocked Marshalb per WP:DUCK, in particular this edit where they outed themselves. Nick-D (talk) 10:39, 31 July 2020 (UTC)
 * Closing. Mz7 (talk) 15:11, 31 July 2020 (UTC)

Suspected sockpuppets

 * ( original case name)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

According to User:KeithD, account was created after the blocking of Marshalb and Snagemite. The interaction is particularly convincing. —— Serial  15:20, 4 August 2020 (UTC) (BTW, this is meant to be at Sockpuppet investigations/Marshalb, but I hit the wrong radio button. Apologies, but ) ——  Serial  15:28, 4 August 2020 (UTC)
 * , your local should approve of my work creation scheme :)   ——  Serial  03:17, 5 August 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * If they're using a VPN, given the behaviour of other socks that should be a clear WP:DUCK and evidence enough imo. Ed 6767   talk!  17:48, 5 August 2020 (UTC)


 * Added Tomaten05 created around the same time as Snagemit's block. Same characteristic jumping from one article to another at lightning-speed as mentioned by ThoughtIdRetired, racking up hundreds upon hundreds of edits in literally the span a few days. Same characteristic adding of useless blank spaces or other stupid nonsense in battle infoboxes. Compare for example Tomaten05 and Snagemit. The user interaction is also pretty breathtaking as if he is not even trying to hide it. EtherealGate (talk) 14:06, 6 August 2020 (UTC)
 * For an account that goes all the way back to 2007, I wonder how many more socks this disruptive editor has, as the ones he has revealed thus far are pretty new. EtherealGate (talk) 14:12, 6 August 2020 (UTC)
 * Yes but I'm on nights so it will be a couple of days. Regards Keith-264 (talk) 15:04, 6 August 2020 (UTC)
 * Removal of year, within an article section, characteristic of Snagemit. Keith-264 (talk) 07:27, 11 August 2020 (UTC)
 * Is this the same person? What I recognise is the high volume of edits in a short time span, and it is a similar, though not identical, type of article. I saw comment on this at  If it's not the same person I think we may be looking at a (perhaps unidentified) syndrome. ThoughtIdRetired (talk) 15:57, 12 August 2020 (UTC)
 * Mz7 mentioned in the previous SPI, after the unsuspecting Marshalb accidentally outed himself, that "Snagemit appears to be using a VPN", but isn't the use of Tor and VPNs, open proxies banned by wikipedia? How has Snagemit/Marshalb found a work-around or a way to bypass this when it technically shouldn't be possible? He obviously knows what he's doing (which shouldn't be surprising coming from an account from 2007. EtherealGate (talk) 11:25, 14 August 2020 (UTC)
 * Nonevehorion (who I think is Snagemit) has changed modus operandi to one constructive edit followed by Snagemit's removal of years within a paragraph/section and changing per cent/percent to % . I've been rv-ing these edits under "rv suspected sock" but would like to know if I should continue or not? Regards Keith-264 (talk) 11:40, 24 August 2020 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * , sigh, do I have to do everything around here? Merged case per filer request. GeneralNotability (talk) 15:32, 4 August 2020 (UTC)
 * - The heavy overlap in topis of interest seems sufficiently suspicious to warrant a check. Endorsed, I know that the last check came back "inconclusive" because of VPN use, but as Ed points out the use of VPN is itself a clue. Separately:, you seem to be pretty familiar with the editing patterns of both. Can you please provide paired diffs showing how Ninevehorion is "making the same mistakes"/otherwise making similar edits to past Marshalb iterations? GeneralNotability (talk) 21:22, 5 August 2020 (UTC)
 * Technically speaking, all of these accounts are . Only Snagemit is using an obvious VPN, and they are all pretty widely geographically dispersed and each using a different device. It may be useful to know that each one only uses a single IP and single device.
 * Snagemit was continuing to edit logged-out on their VPN up to about 12 hours ago. I have put a stop to that.
 * It may have been noted already but Marshalb very oddly responded on Snagemit's user talk after that account received a block notice . That's kind of a giveaway, but no technical help there.
 * I can't say Ninevehorion is definitely unrelated because of Snagemit's VPN but their device is one I haven't seen before, and they're also in a different country.
 * Tomaten05 is on a connection which geolocates to the same country as Snagemit's VPN, but that's not really a conclusive result.
 * , I don't think I've been much help here. Ivanvector (Talk/Edits) 22:16, 7 August 2020 (UTC)
 * This is a fairly tough case. My analysis:
 * Despite the heavy overlap in articles between Snagemit and Ninevehorion, I don't think they are the same person. Ninevehorion is almost exclusively removing years from articles, which I don't see Snagemit doing that much of. Also, while both seem allergic to edit summaries, Ninevehorion leaves the edited section in their summary while Snagemit either is editing the entire article at once or removing the section indicator.
 * As for Snagemit and Tomaten05...I'm just not seeing strong enough behavioral evidence to prove anything. They both like messing around with infoboxen and neither one uses edit summaries, but I don't see any slam-dunk evidence to link the two. Also, I note that Snagemit really likes flagdeco, which I haven't seen Tomaten05 use.
 * Finally, there's Ivanvector's final comment to consider - Snagemit was editing anonymously from their VPN. If they're editing like that, I don't see a ton of need to create an account.
 * Overall, my verdict is that there is not enough evidence to prove a link. Closing without further action. GeneralNotability (talk) 01:51, 17 August 2020 (UTC)