Wikipedia:Sockpuppet investigations/Mrdhimas/Archive

09 September 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

I recently started looking critically at the articles about pageants and the contestants. I quickly noticed that user:Mrdhimas was involved in the creation and/or upkeep of many of them. Suspiciously, I took a look at internet where I found that he had an undeclared professional interest in the pageants. makes loud and clear that the pageant organiser and the Wikipedia author are identical. On the other hand articles (Miss Grand International, Miss Grand International 2013,Miss Grand International 2014,are created or maintained by SPAs, doing nothing more than pageant-articles. For instance, user:Oxtoterena recreated the article Miss Grand International as a clear cut and paste recreation. That is quite remarkable, because that article was removed even before Oxtoterena became active on Wikipedia. (Logbook, Articles for deletion/Miss Grand International). Other SPAs active on the Miss Grand International are User:Millyblue, User:Conanzahaha, User:Emmy014, User:Bpd B., User:ThePageantGenie, User:Javier zm, User:Yeertn and User:Leflox. None of them ever contributed to the AfD-nomination pages, none of them has a user page. In fact, only Conanzahaha responded on an AfD, by en mass removal of AfD-templates. Combined, it give me the feeling that we are dealing here with sockpuppets and/or meatpuppets of Mrdhimas, giving the false impression that there are more editors working on the articles then there really are. What in my opinion is misusing sockpuppets. The Banner talk 11:19, 9 September 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * Can we take a look at new user Jogil9630 please? They show a lot of the same editing behaviour as the above names cited - including uploading of copyvio images of pageant competitors and instantly going straight to editing pages connected to the same subject. Seems pretty fishy to me. Mabalu (talk) 11:21, 25 September 2014 (UTC)
 * Another user who seems suspicious: Hectoryambo. Suddenly pops up from nowhere after editing three articles (on just the subjects that Mrdhimas likes) back in 2009 and 2012 - and starts editing articles on the winners of two pageants whose articles (created by Mrdhimas) were both pretty definitively deleted at AFD. It is not impossible that these are all unrelated users - but it's yet another odd coincidence in a situation which has lots of odd coincidences - it seems that whenever Mrdhimas is feeling the heat, new editors, or formerly inactive editors suddenly pop out of the woodwork to make the edits Mrdhimas would normally make. There does seem to be a developing pattern. Mabalu (talk) 01:14, 8 October 2014 (UTC)
 * User:Oxtoterena is no longer stale, and just recreated the deleted page Miss Grand International 2014. (sic). Please also check the suspicious User:Dongmin1994, who also made extensive edits to the page. -Zanhe (talk) 19:31, 8 October 2014 (UTC)
 * And User:Sora2537, who has the same editing pattern as Dongmin1994 (Miss Grand International and Thai volleyball) The Banner talk 11:48, 9 October 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Yunshui 雲 水  12:30, 16 September 2014 (UTC)
 * First of all, Oxtoterena and Emmy014 are.
 * and are ✅ to one another.
 * ThePageantGenie and Leflox are ❌, including to one another. The rest are . ​—DoRD (talk)​ 14:31, 16 September 2014 (UTC)
 * Don't link to off-wiki sites that may identify a Wikipedia editor. ​—DoRD (talk)​ 14:38, 16 September 2014 (UTC)
 * This is a difficult case, and I can see why it has been left waiting for so long. In view of the CheckUser report, I have ignored Yeertn & Leflox, but looked at the others. It is clear that most of these accounts are part of a concerted effort to publicise the pageants in question. However, it is not at all clear that they are all operated by one person, and apart from a general promotional tendency, several of them have not done any disruption, so there is no justification for taking action against them. However, some of the accounts have been disruptive, and those I have blocked. To be precise, I have blocked Millyblue, Oxtoterena, Bpd B, & Yeertn, and I have given warnings to Conanzahaha, Mrdhimas, & Emmy014. Dongmin1994 & Sora2537 look at a quick glance as though they may be the same person as one another, but not as the others listed. They might bear more investigating, but I don't think they belong in this SPI. Jogil9630 does not show enough evidence of being related to justify any action. The editor who uses the pseudonym "JamesBWatson" (talk) 15:32, 14 October 2014 (UTC)

02 December 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Mrdhimas has a real life interest in the organisation of beauty pageants. It is remarkable how many of the articles that are removed and in which he has an interest are recreated and/or edited by new or single interest editors. It gives me the idea that something fishy is going on.

Cargom recreated Miss Universe 2015 ( and has not edited outside the pageants . Then the brand new editor Papialberto15 showed up to make some edits on MU15 and other pageant related articles . Next in line is editor Osccar_d who, with his brand new account, manages to add a correct table, something most people struggle with. And followed by the slightly older  single interest account Khryztiam87. Followed by the single interest account of Albertoflood (whose name did ring me a bell with Papialberto15). After which the fresh but solftblocked MissUniverse2015Page showed up {, ), shortly after that follwed by the single interest editor Gvf23 . Followed by the old but irregular appearing single interest editor Eapa.

I know it is getting boring but followed by the brand new account single interest editor IrishFemale, who manages to add a correct table with her first edit. Followed by the single interest editor Rararawr21. Followed by the already blocked single interest editor Riza1234

I will save you the IPs...

Too many single interest editors here to make it a believable story of just interested well willing editors. The Banner talk 15:24, 2 December 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * There's a mixed bag of results here. There is extensive use of proxies and dodgy ISPs here, so the technical evidence is practically useless. What I can say is:
 * and are  related as they are editing from the same general geolocation.
 * and are ✅ to each other.  is  related to these two accounts based on geolocation.
 * and are ✅ to each other.


 * As already noted, due to the extensive use of proxies and webhosts, I can't tie the accounts more than what is set out above and the remaining accounts can be considered . It's obvious that there is a concerted effort to promote these articles and that WP:MEAT and outright socking is occurring. A behavioural review will be needed to stop/block the likely canvassed SPA's.-- Jezebel's Ponyo bons mots 19:33, 5 December 2014 (UTC)
 * blocked by for 3 months for disruptive editing;  indef-blocked for evasion of that block since the account was still active.
 * has been gone for over 3 weeks and is only possibly related from a technical viewpoint, so no action taken at the present time.
 * I am not closing the case because and  (and the others) still need to be figured out, and possibly blocked if justified (with or without the socking part). ☺ ·   Salvidrim!   ·  &#9993;  20:11, 15 December 2014 (UTC)


 * Summary of results for both cases listed at the bottom of the 19-December-2014 one. ☺ ·  Salvidrim!   ·  &#9993;  17:49, 7 January 2015 (UTC)

19 December 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

In fact a continuation of the earlier cases Sockpuppet investigations/Mrdhimas. The coincidence is to big to believe, with suddenly Mrdhimas editing again on Miss Universe 2015, together with the brand new single interest accounts Louis144XL and Mjlastimosae. Older single interest accounts active here are Dimitra megest and Jaam0121 (already blocked).

I am in doubt about User:Fm University 123. He/She fits the bill in regards to the rather recent account creation and single interest. But on the other hand it is the only account with a user page, what is not in line with the pack.

Beside the accounts, you have a number of single interest IPs active here: 93.110.1.131, 93.110.1.246, 180.249.58.194 and 197.38.100.222.

Remarkable is also the activity on Ariadna Gutiérrez where Osccar_d was active, together with Louis144XL and Mrdhimas.

Together with the earlier two SPI-cases and the comments made there, it is clear that something fishy is going on around pageants. As user:JamesBWatson states it at the case-file of 9 September 2014: It is clear that most of these accounts are part of a concerted effort to publicise the pageants in question. And they do it in a way that is disruptive and gives the false idea that there is more interest then there is in reality. The Banner talk 22:00, 19 December 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I stumbled into this while patrolling new pages. I know enough about SEO to spot that this activity is designed to build high quality links from Wikipedia to the pageant company webpages. They vary the exact links with different subpages and anchor text, or bare URL to look natural. It may well be various individuals in the direct or indirect employ of the pageant co. Comments on this talk page are VERY revealing under Your edits he says: '''I will hand off this project to Vanbros.com who are agents for Alexis. They initially set this up. I was just trying to assist with adding the information. I hope Vanbros.com knows what they are doing.'''

I've just started a group delete discussion to clean up some of this mess. Legacypac (talk) 22:34, 13 January 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Only one of the accounts listed above is newer than the last CU, which I assume was done around December 5 when you posted the results. Would you have caught the older accounts when you did the last CU, or would you have to do another one targeted at them? Your comments about webhosts and proxies are part of the reason I'm asking. Assuming another CU is needed, I'm endorsing it without changing the case status. Thanks.--Bbb23 (talk) 18:49, 4 January 2015 (UTC)
 * Checkuser is of extremely limited benefit in cases involving coordinated meatpuppetry and extensive proxy use such as appears to be the case here. What I can say is that 93.110.1.128/25 has zero collateral and can be blocked if the range is causing disruption. IP 197.38.100.222 is from TE Data in Egypt which offers VPN and proxy services and can be blocked if it's being used disruptively.
 * With regard to the named accounts, is ✅ to .  is already  indeffed (and was editing from a number  of blocked proxy ranges).  is ✅ to  and was also editing from a (now blocked) proxy. Given the extensive use of proxies, any additional connections will need to be made based on behaviour. -- Jezebel's Ponyo bons mots  20:01, 4 January 2015 (UTC)
 * Thanks, . Because another clerk worked on the first case but didn't decide anything, I (or another clerk) will have to familiarize myself with the cases, which, at least for me, will take some time and won't be today.--Bbb23 (talk) 22:44, 4 January 2015 (UTC)
 * I'll try to carve out some time later tonight to organize these results a bit. ☺ ·  Salvidrim!   ·  &#9993;  22:52, 4 January 2015 (UTC)
 * That would be nice, but I wasn't criticizing what you'd done or not done . It's not an easy case.--Bbb23 (talk) 00:13, 5 January 2015 (UTC)

Alright, here's a summary of the results:
 * ✅ to, to , and behavourially possible to the master  as well as
 * Osccar_d + Louis144XL + Cargom as socks of Mrdhimas
 * Mrdhimas as the master
 * Mjlastimosea blocked without tags


 * ✅ to
 * Fm University 123 + Magicsims123 blocked by


 * ✅ to, to , and behaviourally possible to
 * Papialberto15 + Abdiel1551 already CU-indef'ed
 * I have blocked Eapa and Alberto flood without tags


 * ✅ to, behaviourally possible to , and behaviourally likely to
 * Riza1234 originally blocked for 3 months for disruption.
 * Riza1234 + ZuleicaWilson by  as a result of another SPI
 * I have IrishFemale + Rararawr21 as socks of Riza1234


 * indef'ed due to editing from proxy ranges; behaviourially possible to
 * Jaam0120 already indef'ed by
 * Dimitra megest blocked without tags


 * is likely an isolated meat/SPA, active recently, no action taken in this SPI but there is no prejudice to other administrative action if they edit contrary to policy
 * is likely an isolated meat/SPA, inactive for over 30 days, no action taken.
 * No comment on the IPs listed, none of which has been active in the past 15 days. 197.38.100.222 has been blocked as an open proxy by . ☺ ·  Salvidrim!   ·  &#9993;  17:49, 7 January 2015 (UTC)
 * , sorry it took me this many days to find time for this case. Go ahead if you want to review it before archiving. :) ☺ ·  Salvidrim!   ·  &#9993;  18:00, 7 January 2015 (UTC)
 * I'm not examining all the details of what you did because I don't generally question the findings of another clerk. I just go through it and see if (a) what you did makes procedural sense and (b) you did what you say you did (we can all forget to do something). I want to cross-reference Sockpuppet investigations/Riza1234 because that's the only thing I want to focus on. The accounts you tagged as being puppets of Riza1234 are fine except User:Rararawr21, who is much older than the master, not just the creation date but contributions as well. I'm not sure how to handle that as I haven't examined the behavioral issues (the two accounts haven't been confirmed). What do you suggest? Also, for the moment, I'm not looking at 's comments below, but knowing HJ, I'm sure they should be addressed.--Bbb23 (talk) 20:39, 7 January 2015 (UTC)
 * Oh, you can ignore me! I'm not intending to do anything else unless new accounts or evidence arise. There are only two accounts that aren't blocked now; both are only possible and neither has edited recently. As for Rararawr21/Riza1234, not that I would dream of telling you how to do your job, perhaps get a CU to see if there's any connection between the two? But if both are indef'd, does it make much difference? HJ Mitchell  &#124;  Penny for your thoughts?  20:49, 7 January 2015 (UTC)
 * I agree with cross-referencing the other SPI but wasn't sure exactly how to do it; perhaps log the finding in a "new" SPI report under Riza1234 and close it as already handled, for the sake of documentation? As for Rararawr21 I understand what you're saying; what do you think is best: unblocking, untagging, reblocking for meatpuppetry, leaving blocked but retagging under a different master, or something else entirely? ☺ ·  Salvidrim!   ·  &#9993;  21:10, 7 January 2015 (UTC)


 * (ec) The IPs all look dodgy to me. They might not be open proxies, but they look like webhosts or something else fishy. I've blocked 197.38.100.222 and 93.110.1.128/25. Given the extensive use of proxies/dodgy ISPs and the editing patterns, it's clear that there's something suspicious going on and more blocks might well be justified. In fact, I'm wondering what we have to lose by indef'ing all the accounts. HJ Mitchell  &#124;  Penny for your thoughts?  18:04, 7 January 2015 (UTC)
 * @HJ, @Bbb23: Indef'ing everyone is pretty much what we did (save for two exceptions than can be handled on their own), and the IP block + rangeblock applied by HJ resolve the rest of the concerns. ☺ ·  Salvidrim!   ·  &#9993;  21:10, 7 January 2015 (UTC)

20 January 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

All of the listed users have solely edited the page Rosetta Cartwright. While browsing through an AFD discussion, I came upon these accounts and after seeing that the master is a regular offender, I have no doubt that these are his illegal sockpuppet accounts. As put it in the Articles for deletion/Rosetta Cartwright, "This was created by a sock puppet who created a ton of similar articles".  Ethically  Yours! 12:43, 20 January 2015 (UTC)
 * Although unrelated, I'd just like to update that  is a promotional username (there exists a website), but according to guidelines cannot be blocked as the last edit made was September 2014.  Ethically  Yours!  12:47, 20 January 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * None of these have any edits in the last 120 days, which makes CU impossible, and block/tagging non-useful. ☺ ·  Salvidrim!   ·  &#9993;  16:01, 20 January 2015 (UTC)

29 January 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Evasion of block possible: the user deletes references (habitual practice of the block user) and he edits since January 19 articles of the beauty pageants. (Mrdhimas has a real life interest in the organisation of beauty pageants). The evasion could be Mrdhimas or any users previously investigated.--Jean70000 (talk) 00:47, 30 January 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Checkuser comment:  and  are ❌.  Risker (talk) 20:30, 7 February 2015 (UTC)


 * Closing. See below. HJ Mitchell  &#124;  Penny for your thoughts?  19:35, 14 February 2015 (UTC)

30 January 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Recently, the redirect Miss Universe 2015 had to be protected to enforce an AfD outcome. user:Hectoryambo had restored the article twice in one day. As with other sock- and meatpuppets of Mrdhimas, he never engaged in discussion and is a single interest user. Before that, the article was restored by user:MWAustralia2015,another non-talking single interest user. Surprisingly, I noticed that he is already blocked as a sockpuppet belong to the case Sockpuppet investigations/FallandSpringOlympics, leaving me confused. Another user who restored the article was user:Zenjirou516. This user is a bit strange, because (s)he uses the talkpages as a kind of bin to store templates and articles and his interest is not solely pageants but also the Philippines. Prior to that, the article was restored by the single interest user:Snawple.

Other users involved in the article were user:Laastravadas2085, who has only a few 5 pageant related edits plus two probably vandalistic edits. The already blocked user:Eapa and user:Mrdhimas and the suspected-but-not-confirmed user:Gvf23 were also active here.

Interesting in this case is also the article Daryanne Lees. User:User:Wittylama AfD'ed the article and it was deleted on 31 October 2014. But on 13 November 2014 the article was back to be removed as unsourced BLP on 21 November 2014. But on 24 December 2014 the article was again restored, this time by user:Sora2537. Again, a non-talking user but this time not only with an interest in pageants but also in Thai volleyball and restoring prior deleted pages. Interestingly, she got help there from user:Dongmin1994 who has the same interest in Thai volleyball and pageants. Their edits are so similar, that user:User:Paul_012 gave him a warning/advice to look up the sockpuppet-policy! I can not see who where involved in the two removed versions, but perhaps it can be interesting to look that up. The Banner talk</i> 11:10, 30 January 2015 (UTC)

Now found evidence that the article Daryanne Lees was recreated the second time by user:Hanalees, a non-talking user with an interest in pageants and Thai volleyball link the two editors named before. <span style="font-family:'Old English Text MT',serif;color:green">The Banner <i style="color:maroon">talk</i> 11:22, 30 January 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The accounts all show a strong interest in the same topic, especially in regards to creating tabled information. Zenjirou516, Hectoryambo, Sora2537, Dongmin1994, Hanalees. <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 22:13, 2 February 2015 (UTC)
 * Also, I've removed MWAustralia2015 as it was a confirmed sock of FallandSpringOlympics in a separate case. <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 03:35, 3 February 2015 (UTC)


 * Checkuser findings:
 * The following are unrelated to each other or to any other account mentioned in this or previous SPIs related to the master:


 * The following are related to each other but ❌ to Mrdhimas:
 * and
 * and -  to be socks.  is also related to both of these accounts but is more likely to be a meatpuppet or or editing in co-ordination; significant technical differences indicate this is not the same user.


 * Specific note: None of these accounts appears to be related to Mrdhimas.  Also of note, in certain parts of the world these pageants are extremely important cultural events, and it should be no surprise that we are seeing quite a few editors working on some of these articles.  Risker (talk) 20:46, 7 February 2015 (UTC)


 * Thanks, . I think the best thing is to work on the assumption that each set of accounts is a distinct individual. I've just indef'd Hanalees, and indef'd Papialberto15 back in December which means all the alternate accounts are blocked. Other than that, it seem likely that we have (or have had) both a large sockfarm and an influx of genuine new editors, and we should be careful not to mistake the latter for the former.  you were right to report, but just be mindful that there are well-meaning but inexperienced editors active in the topic area; now we know that, perhaps assume as much good faith as possible, even if it starts to stretch credulity, and only file SPIs if you're sure there's something nefarious going on. I'm marking this as closed, since there's not really anything else to be done here.  HJ Mitchell  &#124;  Penny for your thoughts?  19:35, 14 February 2015 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Recreating some of the same pages a previous sock, but with titles that are deceptively different. The user names are similar as well. - MrX 02:00, 29 July 2016 (UTC)


 * Added 2606:6000:e70e:9c00:9126:6ea:7ad5:2512 who showed up appeared 33 minutes after a new article was created by JulioFlood.- MrX 12:09, 29 July 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
I've declined the CU request as the accounts in the archives are .--Bbb23 (talk) 13:32, 29 July 2016 (UTC)
 * Indeffed as a sock of Alberto flood. Case closed.  Vanjagenije  (talk)  21:20, 3 August 2016 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Found through Nihar POPS NPR reviewer request. Articles created by previous sockpuppets of this master flagged at User:DeltaQuad/NPP Review. Same subject area across all users -- Amanda  (aka DQ) 04:50, 24 April 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * , I’d go with between Aayat1998 and Nihar POPS. Didn’t check TheStylistic2019 as the log puts them in a different country, and I’m fairly confident of Nihar’s location.The interesting thing is that Nihar POPS is 3/3 ranges shared with  according to the CU log, and there seem to be a fair amount of behavioural similarities. Obviously can’t completely confirm because we don’t have the full CU data, but it warrants a behavioural investigation in my view. TonyBallioni (talk) 06:24, 24 April 2019 (UTC)
 * Do you want to do anything with this?--Bbb23 (talk) 22:51, 15 June 2019 (UTC)


 * I think we are good for now since everything but Aayat1998 is blocked. -- Amanda  (aka DQ) 05:07, 20 June 2019 (UTC)