Wikipedia:Sockpuppet investigations/NagalimNE/Archive

Suspected sockpuppets

 * ( original case name)
 * ( original case name)
 * ( original case name)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

All 3 accounts were registered on October 8th within an hour of each other, and started editing on the 27th or 28th. As is obvious from looking at their contribs pages, these three accounts seem to be going through a list of biographies alphabetically (currently on the "B"s) and making repetitive pointless edits such as creating useless infoboxes or tweaking talk page banners. Interestingly, Tylerpanes and Stacypoled seem to have stopped at exactly 100 edits. I'm confident these accounts are related to each other, and this looks very much like an attempt at ECP gaming or account farming, so I'm requesting CU to check for others. Thanks to for the tip. Spicy (talk) 23:27, 28 October 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - per above. Thanks, Spicy (talk) 23:27, 28 October 2021 (UTC)
 * - -- RoySmith (talk) 01:30, 29 October 2021 (UTC)
 * On purely technical evidence, I would call this Tylerpanes ✅ to Stacypoled, and those two both to Uptoniter, but given the obvious behavioral clues, and the fact that there's rampant proxy use, I don't have any problem calling everybody ✅. -- RoySmith (talk) 01:43, 29 October 2021 (UTC)
 * Thanks, closing. Spicy (talk) 01:46, 29 October 2021 (UTC)

Suspected sockpuppets

 * ( original case name)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Pro forma. --Blablubbs (talk) 19:28, 31 October 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * New day, new batch. . I note that is technically oldest (not sure if worth moving), and that I think this is likely  per, but it's hard to be sure (I tagged before I realised that the Sanketio link is pretty strong). I'm not going to move or merge quite yet in case others have different thoughts. I also note that I am suspicious of , but not quite enough to block. Courtesy ping , who has blocked a lot of accounts in the orbit of this group over the last few months. --Blablubbs (talk) 19:34, 31 October 2021 (UTC)
 * , who has strong overlap here, also sets off some Sanketio alarm bells for me. --Blablubbs (talk) 19:48, 31 October 2021 (UTC)
 * Also noting that my not endorsing this is not the result of me thinking they shouldn't be checked, but merely of my brain being pretty fried after going through the history of almost every article any of these accounts have ever edited. --Blablubbs (talk) 20:16, 31 October 2021 (UTC)
 * I don't see any link between When99 and Sanketio31. BTW, as far as I can tell, all the Uptoniter socks use the visual editor, although When99, when they edited in 2019, did not. Anyway, I think they are two separate cases, although I suppose a checkuser might be able to confirm that.--Bbb23 (talk) 23:37, 31 October 2021 (UTC)
 * @Bbb23: The primary link I see here is the shared and relatively unusual gaming technique of splitting things like infobox constructions into a number of unusually small edits to inflate the total count; they do it in a more repetitive way than most Sanketio socks did their gaming, but also in one that's far less work. Compare the edits of Pourswamo, who you blocked and tagged as a Sanketio sock some time ago. To me, this case looks like someone is trying to quickly restock their sleeper supply, presumably after having burnt a lot of them, and with the general pattern, the sheer number of accounts and the proxy use, I'm leaning "large UPE farm" over "unpaid LTA". Though I might just be seeing things because I've spent too much time on Sanketio. --Blablubbs (talk) 23:52, 31 October 2021 (UTC)
 * (ec) I just think they are too different to be the same person. I'm not as familiar with Sanketio. I have no idea what was going through my head with Pourswamo at the time, but in looking at it now, I think I was wrong. :) I'm gonna change the tag. I don't know about proxies, but I still think a CU would be useful. There are non-stale accounts in both cases.--Bbb23 (talk) 00:00, 1 November 2021 (UTC)
 * Welp, I looked again at Pourswamo a couple more:
 * There are also a few instances of overlap with, whose editing pattern I also find concerning (and reminiscent of Sanketio). They pick the articles they do their gaming on by the same logic as Sanketio – that could probably be interpreted as supporting either a link or a spurious connection. In any case, you're right about the usefulness of CU. a check in the hopes that we can find some sleepers, and to see if these match the technical pattern shown in Sockpuppet investigations/Sanketio31/Archive. Thanks. --Blablubbs (talk) 00:09, 1 November 2021 (UTC)
 * too. --Blablubbs (talk) 00:13, 1 November 2021 (UTC)
 * How do you find all these?? I noticed a small piece of trivia. When they edit the articles, they use the visual editor, but at least some of the ones I just looked at, when they edit the Talk pages, they don't. I also noticed that some of these accounts are much more expansive than the ones I've blocked.--Bbb23 (talk) 00:23, 1 November 2021 (UTC)
 * The visual editor thing is because it doesn't work on talk pages (yet) I think. Also, is another one. There might be a more efficient way to look for them, just not quite sure if it's feasible yet – I'll look into that tomorrow. --Blablubbs (talk) 00:34, 1 November 2021 (UTC)
 * It is possible by, but not an option in the GUI. User:1234qwer1234qwer4 (talk)  10:36, 12 November 2021 (UTC)
 * Plus, , , , , , , , , , . --Blablubbs (talk) 01:20, 1 November 2021 (UTC)
 * And, , thanks to , who shared some preliminary check results with me off-wiki (everyone aside from this group is based on behaviour only). --Blablubbs (talk) 01:40, 1 November 2021 (UTC)
 * GeneralNotability (talk) 12:53, 1 November 2021 (UTC)
 * Technical evidence suggests deliberate measures to evade scrutiny, CU is of variable use in identifying accounts. Unless I mention otherwise, the relationships between any two accounts should be considered . I can say that there is a particular fingerprint here that I didn't see any account deviate from, but said fingerprint is not especially strong.
 * Uptoniter, Bakedryad, Aboutcardy, Wotantiman, Plumaron are all basically confirmed to each other
 * Johannablurt == Aquadebbed
 * Vasesjohn == Oxbownicer == Noisevales
 * Also, Oxbownicer == ==  ==  ==
 * Banksletaq == Yearandbeast, Banksletaq is also to
 * Lateurdu ==
 * Philaudra == Palmpeaks ==  ==,  sleepers  and
 * Apselina to
 * When99equals999 is to
 * I do not believe Quarterto500 is related to this group.
 * I also found and  during the checks (inconclusive to each other and they don't share the infobox fingerprint, but both are engaging in the exact same style of image additions).
 * I found a handful of possible zero-edit sleepers, but am not doing anything with them right now; in my opinion the risk of mis-blocking is too high.
 * for the new accounts listed above, please. GeneralNotability (talk) 13:48, 1 November 2021 (UTC)
 * I have trouble reading the above results. First when you list a bunch of accounts in paragraph form rather than bullet form, my eyes glaze over. Is each paragraph of multiple users a "group"? Second, I'm lost as to the bottom line. How many masters do we have? At first, I assumed one master or maybe two (Uptoniter and Sanketio). Now I don't know if you made any technical determination on that or if there are other masters. Perhaps technically it's impossible to say, but if that's true, it would be helpful for you to say that. Sorry.--Bbb23 (talk) 13:59, 1 November 2021 (UTC)
 * , one bullet is one group of accounts that are confirmed to each other, but I am inclined to call them all Uptoniter. I'm pretty sure there is intentional evasion going on here that will make it impossible to mark most of these accounts "confirmed" and I think it would be excessive to tag them in small groups of confirmed accounts. As for Sanketio...I really can't say for sure one way or the other. There is some technical evidence linking the two, but there are enough differences that I'm not able to make a solid call. Perhaps might have more to say? GeneralNotability (talk) 14:04, 1 November 2021 (UTC)
 * Thanks, that helps.--Bbb23 (talk) 15:39, 1 November 2021 (UTC)
 * I have trouble reading the above results. First when you list a bunch of accounts in paragraph form rather than bullet form, my eyes glaze over. Is each paragraph of multiple users a "group"? Second, I'm lost as to the bottom line. How many masters do we have? At first, I assumed one master or maybe two (Uptoniter and Sanketio). Now I don't know if you made any technical determination on that or if there are other masters. Perhaps technically it's impossible to say, but if that's true, it would be helpful for you to say that. Sorry.--Bbb23 (talk) 13:59, 1 November 2021 (UTC)
 * , one bullet is one group of accounts that are confirmed to each other, but I am inclined to call them all Uptoniter. I'm pretty sure there is intentional evasion going on here that will make it impossible to mark most of these accounts "confirmed" and I think it would be excessive to tag them in small groups of confirmed accounts. As for Sanketio...I really can't say for sure one way or the other. There is some technical evidence linking the two, but there are enough differences that I'm not able to make a solid call. Perhaps might have more to say? GeneralNotability (talk) 14:04, 1 November 2021 (UTC)
 * Thanks, that helps.--Bbb23 (talk) 15:39, 1 November 2021 (UTC)


 * Here's another one: . Blocked. --Blablubbs (talk) 14:01, 1 November 2021 (UTC)
 * Along with . --Blablubbs (talk) 14:09, 1 November 2021 (UTC)
 * I blocked most of the ones that GN found. Some for obvious reasons, Lestrange and Gausbertus because they are clearly gaming, clearly related to each other, plus coming up independently from each other in relation to accounts from the Uptoniter list is highly incriminating, and Protz because both the gaming and the spamming are blatant for that one. I'd appreciate second opinions on the remaining unblocked ones:
 * the zero-edit sleepers, , and – I think they are all part of the Uptoniter group based on usernames, but I'm hesitant to block without direct CU confrimation
 * – looks both spammy and socky to me, and I think they may be related to based on, but the behavioural link to the Uptoniter group is weaker than I would like
 * – similar to the above; spammy, but I'm not sure if it's the same brand of spammy.
 * My current inclination is to block Takrekaan, Carlcarterx, and Thegreatphalanx: Having technical overlap with a massive gaming farm while engaged in behaviour that looks a whole lot like UPE is more than just suspicious – but again, input from others is appreciated. --Blablubbs (talk) 14:40, 1 November 2021 (UTC)
 * I just want to acknowledge that I am aware of this case, but I am currently swamped with work IRL, so I haven't gotten the time to dive deep here. Mz7 (talk) 04:22, 4 November 2021 (UTC)
 * I think everyone who needs blocking is blocked. Closing. GeneralNotability (talk) 01:38, 14 November 2021 (UTC)

Suspected sockpuppets

 * ( original case name)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

The usual: ... --Blablubbs (talk) 17:02, 8 November 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * – CU was partially effective last time, I'm hoping it will be again. --Blablubbs (talk) 17:03, 8 November 2021 (UTC)
 * The technical data makes me strongly suspect extensive proxy use. I compared to the master, the two confirmed socks in the archive, and some notes in cuwiki.  The best I can do is   -- RoySmith (talk) 17:44, 8 November 2021 (UTC)
 * Behavioural evidence is clear. Tagged, closing. Thanks, Spicy (talk) 23:01, 8 November 2021 (UTC)

Suspected sockpuppets

 * ( original case name)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Pro-forma filing, accounts are already blocked but I think another round of CU would be useful as it picked up some sleeper accounts last time. Usual infobox gaming behaviour. Thanks, Spicy (talk) 01:35, 14 November 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - per above. Thanks, Spicy (talk) 01:36, 14 November 2021 (UTC)
 * Ledgemasker ✅ to Noisevales, Phishtula is ✅ to, Bagsbrat is ✅ to . Not much else from a CU perspective. GeneralNotability (talk) 02:16, 14 November 2021 (UTC)
 * Thanks, tagged the untagged ones, closing. Spicy (talk) 02:18, 14 November 2021 (UTC)

Suspected sockpuppets

 * ( original case name)
 * ( original case name)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Looks like this is what happens when they're done gaming; see early contribs – exact same two rare and nontrivial gaming techniques. --Blablubbs (talk) 20:03, 22 November 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * On the off-chance this isn't Uptoniter, it's someone else blatantly gaming the system. . I also note a very likely relationship to ; the timing here is extremely suspicious, and the editing pattern fits too.  Can I bother you for a check? Also courtesy ping , who blocked GermanKity. --Blablubbs (talk) 20:15, 22 November 2021 (UTC)
 * Available CU data says probably them: same proxy service, similar unusual technical fingerprint. Their browser version appears to have gone backwards compared to the two old accounts in the archives I spot-checked, but I believe that this is hypothesized to be a farm rather than one person, so that isn't necessarily a disqualifying factor. Oh, and GermanKity is, nothing useful there. Tag as you feel appropriate, . GeneralNotability (talk) 02:28, 23 November 2021 (UTC)
 * I think a relationship to GermanKity is somewhere between possible and likely, but I'm not confident enough to move. I'll move to NagalimNE and retag everyone. Also noting for the record:, also part of this group, already blocked. --Blablubbs (talk) 17:06, 27 November 2021 (UTC)
 * Done and closing. --Blablubbs (talk) 17:21, 27 November 2021 (UTC)
 * AFC reviews undone. No concerns about the two new pages patrolled. MER-C 12:23, 28 November 2021 (UTC)

Suspected sockpuppets

 * ( original case name)

All listed accounts were created on 3 January 2022, but all made their first and last edits on 24 or 25 December 2023, many on the same two articles ( and ). Behaviors look identical, with all listed accounts making rapid incremental changes (<2 minutes between edits, all generally related to grammar, e.g. removing an extra word, changing a single word, adding a missing word, removing extra space). All of the accounts use the edit summary "Copy Edit" on exactly two of their contributions (e.g., , ). Appears to be some sort of sock farm; each account made a burst of ~15 edits in rapid succession, followed by a different account making a burst of ~15 edits, in exactly the order the accounts were registered. TheAustinMan (Talk ⬩ Edits) 21:49, 26 December 2023 (UTC)


 * Added, , WP:DUCK behavior match (e.g. "Copy Edit" edit summary on exactly 2 edits, rapid edits, editing the same pages as the other blocked users below). — TheAustinMan (Talk ⬩ Edits) 04:58, 27 December 2023 (UTC)
 * Added, , , , , – more ducks at Special:PageHistory/Avret Pazarları. — TheAustinMan (Talk ⬩ Edits) 04:58, 27 December 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

looks like I mispelled. Behavioral match, overlap with on. — TheAustinMan (Talk ⬩ Edits) 16:28, 27 December 2023 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * ... Spicy (talk) 22:44, 26 December 2023 (UTC)
 * Mikeslink and Jedislowser are ✅. Obvious technical evasion measures are in play, which means that I cannot confirm most of these to each other, but they do look similar in a distinctive way and one that strongly suggests that they are up to no good. Behaviour, of course, is obvious., closing. Thanks, Spicy (talk) 23:50, 26 December 2023 (UTC)
 * Oh and, but that doesn't mean much given the evasion measures. Spicy (talk) 23:51, 26 December 2023 (UTC)
 * As I expected, the rabbit hole goes deep. Found some more accounts with the same behaviour/technical signature.


 * As before, occasional pairs or trios of accounts are confirmed to each other despite proxy use. This is very reminiscent of Sockpuppet investigations/NagalimNE/Archive. I blocked Valveuniew plus a few other accounts a few days ago because they created a promotional article after becoming autoconfirmed, in case you're wondering what the end game is here. Oh, and for a lesson in WP:DUCK, see Special:PageHistory/National Museum of History of Azerbaijan. Setting this back to in progress - I'm not done here, but I need to sleep at some point... Spicy (talk) 02:08, 27 December 2023 (UTC)
 * , Wistoaks doesn't exist. Avoidgated shares proxies with:

- maybe incidental, maybe not. The added accounts look behaviourally and technically consistent. Spicy (talk) 11:09, 27 December 2023 (UTC) Spicy (talk) 00:21, 28 December 2023 (UTC)
 * Subslille shows up with blocked accounts
 * New day, new batch:
 * OK, I'm going to call it here. All accounts . I am convinced this is the same case as Sockpuppet_investigations/NagalimNE. The gaming strategy is slightly different this time around but it's the same overall behaviour and username pattern. Please merge to that case and (re)tag (do not tag Kspoty and Ferialnusla). Also see my notes on the filing below. Thank you, Spicy (talk) 00:29, 28 December 2023 (UTC)
 * I did the merge. Tagged, closing. Spicy (talk) 10:08, 28 December 2023 (UTC)