Wikipedia:Sockpuppet investigations/Noahmoretz/Archive

Suspected sockpuppets
Ayaena is registered 4 days after Noahmoretz was blocked for socking. All accounts listed here tried to promote (spam) same person at some point (NF Ravi - Silentze) https://en.wikipedia.org/wiki/User:Wescleeey/sandbox/NF_Ravi_(rapper)

Ayaena uploaded same spam images for NF Ravi - Silentze which were also uploaded by Noahmoretz

https://commons.wikimedia.org/wiki/Special:Log/Ayaena

https://commons.wikimedia.org/wiki/Special:Log/Noahmoretz

(added deletion tag to them on commons, should be deleted soon but logs should stay)

Images have "wescleysilva37426" in metadata (see the Wescleeey user in Suspected sockpuppets list): https://commons.wikimedia.org/wiki/File:Sillentze_in_2022_from_Instagram_01.jpg

If you look at editing pattern of Ayaena, they're trying to conceal themselves with "Welcome to Wikipedia" kind of edits and trying to make themselves look like a longstanding user, adding deceptive "This user has been on Wikipedia for 13 years" template to user page etc. all in attempt to conceal sockpuppetry and paid, promotional editing. Tehonk (talk) 12:14, 26 July 2023 (UTC)
 * @TonyBallioni first listed suspected sockpuppet is still active, edited last week, couldn't that be checked for other possible socks? Tehonk (talk) 01:37, 28 July 2023 (UTC)
 * @TonyBallioni (just trying to understand the logic) When I check other cases I see a lot of reports like this, I mean someone reports a possible new account of a blocked sockmaster based on behaviour, calling it obvious or duck etc.. then a checkuser finds it likely and checks the suspected sock and also lists other sleeper accounts, despite that sockmaster would be "stale" too as you call it and it would not be possible to link the new reported account and the master technically because master would be blocked long time ago anyway, but it still gets checked and sleepers, socks getting found and tagged, blocked. So bottom line is, I don't see how this report is being different to these cases I'm seeing and why finding sleepers or other socks of a blocked sockmaster would be a bad thing here. I presented behavioural evidence (which would be what is called as "duck") and I think there's a good reason to believe there can be other accounts or sleepers based on the evidence, so why would it not be OK to find these socks of a blocked sockmaster? Tehonk (talk) 20:05, 1 August 2023 (UTC)
 * @MarioGom Both of my comments were about the case, I could ask why "there is enough weight against it here to move it out of the CU request queue" to TonyBallioni after his last reply because there is still no justification for that thought when there was enough evidence provided for multiple account usage at the same time, but I didn't ask anything anymore, I also found another sock account later but I refrained from posting that as well. So I'm already refraining from posting further comments because I don't care anymore, so you didn't need to say this when there was no comment or anything for 20 days. Tehonk (talk) 15:01, 19 August 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments
- nothing thats not stale. Moving to open so it gets attention sooner than the declined pile. TonyBallioni (talk) 01:22, 28 July 2023 (UTC)
 * Tehonk, moved your comment up to the filer section. There is only one non-stale account here. I can't compare this account to any of the listed socks, and I'm not going to do a check on the possibility that there might be other socks if I can't possibly connect it technically to the accounts you've listed. That's too close to fishing for my tastes. This can be evaluated on behaviour. TonyBallioni (talk) 00:43, 30 July 2023 (UTC)
 * Tehonk: okay so the named master you reported was blocked over a year ago. There are no edits from any recent account, and while there is a log entry with a range, the most it would tell us is if they were in the same geography or used the same network a year ago. Basically the best I could get you to is possible. For a first time SPI without multiple suspected socks going at the same time, where the master was blocked over a year ago, and two of the three suspected puppets are stale, there is little of value CU would tell us and it isn't worth the time it takes to run a CU investigation when there is nothing recent to compare to and there isn't reasonable cause to believe there are more accounts out there.In terms of how CU is run: each individual CheckUser has absolute discretion over when they run checks and are accountable for it to other CUs, ArbCom, and the Ombuds commission. There is no policy that says I have to run a check, only one that permits me to if certain conditions are met. CUs also have discretion on how to handle SPIs. Based on the things I mentioned above, I determined that I did not believe a check would turn anything up and that without anything to compare it to and with no reason to believe there are multiple socks of the same person going at the same time, this was too close to fishing for my taste, and I'm usually one of the more liberal CUs when it comes to reading the policy in favour of checks when there's a reasonable chance that something might come up.Another CU is of course, free to make their own judgement call and run one on their own, but I think there is enough weight against it here to move it out of the CU request queue. I moved it to "open" so a clerk or patrolling admin can assess behaviour. Ordinarily they go to "declined" to rot for a few months before being closed as not actionable reports. A patrolling admin or clerk or another CU will come by in time and decide how to process this. But I'm not going to run a check and I'm also not going to move it back to the CU queue. TonyBallioni (talk) 01:31, 2 August 2023 (UTC)


 * Please, refrain from posting further comments in this SPI case. These meta-discussions only make handling the case harder. If you have any further doubt, feel free to post it in my talk page. MarioGom (talk) 10:50, 19 August 2023 (UTC)
 * . Most accounts are stale and Ayaena has not edited for a while. Feel free to report again if they become active and there is new evidence. MarioGom (talk) 13:53, 17 September 2023 (UTC)

Suspected sockpuppets
This is really curious, when I reported this with clear DUCK evidence, there was only one week between the last edit of Ayaena and the report time, yet it was called stale and closed with no action and was said "Feel free to report again if they become active", he became inactive when the case was opened, and he became active as soon as the case was closed. I'm pretty sure even he was surprised by that. There are clear and good duck evidence on this archived case to support abusive multiple account usage of a blocked sockmaster: https://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/Noahmoretz/Archive and there is no good reason provided by the checkuser or clerk to dismiss all the evidence. Tehonk (talk) 01:34, 3 October 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * There was some old CU data in the logs for, so I compared against Ayaena. They are using a different IP range, but geolocate to the same city. Taken with the behavioural evidence, I see enough to block as suspected. I'll leave the other accounts (noting that the NorahCoel account doesn't exist on enwiki), since they haven't edited in over a year - we can take another look at them if they reactivate. Girth Summit  (blether)  15:53, 3 October 2023 (UTC)