Wikipedia:Sockpuppet investigations/Rajumitwa878/Archive

Suspected sockpuppets

 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

See below. Bbb23 (talk) 15:01, 29 March 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ✅:
 * Blocked the unblocked accounts without tags.
 * Please tag all the above accounts plus the accounts in Category:Wikipedia sockpuppets of Mytisit.--Bbb23 (talk) 15:02, 29 March 2020 (UTC)
 * Category currently contains :
 * Blocked the unblocked accounts without tags.
 * Please tag all the above accounts plus the accounts in Category:Wikipedia sockpuppets of Mytisit.--Bbb23 (talk) 15:02, 29 March 2020 (UTC)
 * Category currently contains :
 * Blocked the unblocked accounts without tags.
 * Please tag all the above accounts plus the accounts in Category:Wikipedia sockpuppets of Mytisit.--Bbb23 (talk) 15:02, 29 March 2020 (UTC)
 * Category currently contains :
 * Blocked the unblocked accounts without tags.
 * Please tag all the above accounts plus the accounts in Category:Wikipedia sockpuppets of Mytisit.--Bbb23 (talk) 15:02, 29 March 2020 (UTC)
 * Category currently contains :
 * Blocked the unblocked accounts without tags.
 * Please tag all the above accounts plus the accounts in Category:Wikipedia sockpuppets of Mytisit.--Bbb23 (talk) 15:02, 29 March 2020 (UTC)
 * Category currently contains :
 * Blocked the unblocked accounts without tags.
 * Please tag all the above accounts plus the accounts in Category:Wikipedia sockpuppets of Mytisit.--Bbb23 (talk) 15:02, 29 March 2020 (UTC)
 * Category currently contains :
 * Blocked the unblocked accounts without tags.
 * Please tag all the above accounts plus the accounts in Category:Wikipedia sockpuppets of Mytisit.--Bbb23 (talk) 15:02, 29 March 2020 (UTC)
 * Category currently contains :
 * Category currently contains :


 * Cabayi (talk) 21:03, 29 March 2020 (UTC)


 * (Re)Tagged. Category:Wikipedia sockpuppets of Mytisit is now empty. Closing. Cabayi (talk) 21:11, 29 March 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Noto799 inserted the same spam link that Rajumitwa878 did. Other socks inserted the same link or same type of link Apparition11 Complaints/ Mistakes 18:34, 16 April 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Checkuser isn't giving me anything helpful here., for adding the same scam links. ST47 (talk) 18:47, 16 April 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

The first 3 seems to be obvious. Here is an example of a comfirmed sock's referral link. Here is Unirsyour's. Here is Siseswalsh's. Here is Sixespepin's.

The last 2 are a little more devious. He also often makes a different account to come in immediately after spamming to make small edits to try to bury his spam in the edit history. This can be seen by confirmed socks here and here. Here is Fquabbared doing this (actually pretending to revert) and here is Artstucks doing it. On top of this, he also likes to copy established users' user pages. Here is a confirmed sock stealing the personal life section of User:Davykamanzi. Here is another confirmed sock stealing User:Spleodrach. Now, here is Artstucks stealing the opening sentence of User:Ioeth. Apparition11 Complaints/ Mistakes 13:10, 22 April 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * please see Sockpuppet investigations/Buntsrode. Ivanvector (Talk/Edits) 14:42, 22 April 2020 (UTC)
 * All these socks are in group 1 of the Buntsrode report. Closing this report & IAR archiving to simplify the merge. Cabayi (talk) 10:58, 26 April 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

This month there have been several instances on the Whitepages (company) article in which the link to the company website has been maliciously replaced with a tracker link. The original vandal was blocked, but six additional accounts have engaged in near-identical behavior, with 5/6 accounts making edits regarding the malicious link. All seven accounts listed appear to be throwaway accounts. Aside from posting the malicious link, the accounts also engage in two other unassuming behaviors: changing the column width value of the reflist template, and making (constructive) minor edits to the article.

Some of the accounts attempt to conceal their vandalism by filling in the edit summary, by creating userpages, and making constructive edits to both the article and to other articles. Diffs are below with explanations.


 * Buntsrode
 * Initial addition of bad link; constructive minor edit
 * Constructive minor edit

This user's profile is deleted, so I don't know what it looked like.


 * Weptcocci
 * Addition of bad link

This user's profile redirects to an ancient editor's talk page. Malicious activity appears to be uncharacteristic of the old editor.


 * Dizzywryer
 * Constructive minor edit
 * Modification of bad link; changing table width
 * Changing table width

This user's profile is cryptic, featuring a H2 header and a bullet list. This is the same userpage style used by Quayseldon.


 * Opelmince
 * Addition of bad link

This user's profile is ripped from a message sent by the MediaWiki message delivery system. The message was timestamped 5 March 2019. This user's account was created over a month later, on 16 April 2020. This profile format is shared with Sporthulas946.


 * Quayseldon
 * Addition of bad link

This user's profile is cryptic, featuring a H2 header and a bullet list. This is the same userpage style used by Dizzywryer. The text sampled is apparently taken from JHunterJ's userpage. Malicious behavior is uncharacteristic of JHunterJ.


 * Sporthulas946
 * Changing table width; made within one minute of Quayseldon's edit

This user's profile is ripped from a talk page message template regarding Wikimedia Portugal. An example can be found here. The reference links found in the message are from July 2018. This user's account was created almost two years later, on 16 April 2020. This profile format is shared with Opelmince.


 * Stowbake
 * Addition of bad link; changing table width
 * Changing table width

This user's profile and talk page are both unique here. They use a committed identity in order to make themself look legitimate.


 * Notes:

Although Dizzywryer on the surface did no wrong, I'd like this to be taken into consideration: the user made constructive minor edits (done by malicious accounts Buntsrode, Quayseldon, and Stowbake as well); as well as engaged in changing the table width of the reflist template (done by Stowbake as well). The user also modified the malicious link in question.

Although Sporthulas946 also apparently did no wrong, the user also engaged in changing the same table widths, made an edit within 1 minute of Quayseldon on the same page, and has a userpage similar to Opelmince.

-- ElKabong888 (talk) 08:37, 22 April 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * , I noted the similarity between the reported edits, then noticed you'd reported Buntsrode's edit Special:Diff/949599183 repeatedly for each user. Good first SPI report though. Cabayi (talk) 12:17, 22 April 2020 (UTC)
 * - The spamming for whitepages.cf is blatant. Given the appearance of multiple socks on 11 April & 16 April, the appearance of only one on 21 April looks like sleepers may be lurking. Please confirm & check for sleepers. Cabayi (talk) 12:22, 22 April 2020 (UTC)
 * Group 1 are ✅ to non-stale socks of Sockpuppet investigations/Rajumitwa878:
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.
 * All.


 * Group 2 is ✅ to each other and ✅ to group 1. : these two accounts are obvious throwaway spammers but I'm not convinced they're the same person as group 1.
 * Both.
 * Both.
 * Both.


 * Group 3 is ✅ to each other and to group 1; . These are older accounts working together on a particular set of articles. One's user page says they're a "digital media journalist" and perhaps they're coworkers, but they have contribs in common on two different ISPs on what look like the same computer. See for example the history at Next Gen Political Leaders: Varsha1990 created this page and submitted it to AFC, and it was reviewed Lak2015, and it looks to me like all of that happened on the same computer.


 * In addition:
 * is using three different useragents that match with one or more of the many spam and sock rings operating on the range I checked for group 1, and has also been editing logged out in a way which certainly violates policy. I'll leave it up to the clerk to determine what should be done here.
 * is but already tagged to Sockpuppet investigations/0lesson.


 * please determine what should be done with group 3 and the "others", and please merge this report into Sockpuppet investigations/Rajumitwa878. If there turns out to be an older account please do the merge first, then move the merged case to the new location. Ivanvector (Talk/Edits) 14:40, 22 April 2020 (UTC)
 * Oldest block is, indeffed on 2020-01-27 14:34:23 - tool. Cabayi (talk) 11:06, 26 April 2020 (UTC)
 * Group3 blocked with Varsha1990 as the master. InSameer blocked. Closing. Cabayi (talk) 11:15, 26 April 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Confirmed sock Bondgypsy had inserted the usual type of spam to FICO. Unfortunately, it slipped through the cracks for over a month. Luckily, today an IP caught it. A couple of hours later, Dalesritzy was created to reinstate the spam. Apparition11 Complaints/ Mistakes 18:33, 3 May 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * . Closing. Cabayi (talk) 18:50, 3 May 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

This account tried to hijack the official link to Credit Karma again using the same type of link the previous socks did. Here is Markerhelp's spam. Here are a few samples from previous socks on the same article:. I wouldn't suggest clicking on them, but all send the user to a fake Credit Karma site that has on overlay, so anywhere one clicks sends them to mycreditscoresnow.com. I requested checkuser mainly because it has been almost a month since a sock was caught and this account put in more effort to look legitimate than the others did. I would like to ensure we're dealing with the same person and not a new person picking up the same scam. Apparition11 Complaints/ Mistakes 13:03, 30 May 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I stumbled across this SPI while deciding whether to indefinitely block the account. If it makes any difference, I support a check as well. ~ ToBeFree (talk) 00:20, 31 May 2020 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - I'm convinced enough to block on behavioral evidence. Please confirm & check for sleepers. Cabayi (talk) 16:44, 30 May 2020 (UTC)
 * It's highly . Callanecc (talk • contribs • logs) 00:23, 31 May 2020 (UTC) Callanecc (talk • contribs • logs) 00:23, 31 May 2020 (UTC)
 * Thanks!, closing. ~ ToBeFree (talk) 00:35, 31 May 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Exact MO as previous socks. Budshaze:, Zebuready:, Vestacit:, Adzesjody:. I considered requesting checkuser since it's been a minute since a sock had been caught, but one was ran last time and nothing more surfaced. It might not be a bad idea, but I'm not optimistic. Apparition11 Complaints/ Mistakes 21:59, 13 July 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - I'm dead certain from a behavioral standpoint that Budshaze, Vestacit, and Adzesjody are socks of this group. Zebuready's shown several telltales of this sock group (overlinking, especially linking US to United States, the insertion of fraudulent links on credit-related pages with bogus edit summaries), but their behavior is completely unlike anyone else in this sock ring - we haven't seen anyone else in this ring use Twinkle or generally pretend to be a useful editor. I'm concerned that this may be an indicator that they're trying to set up "legit" sleepers, so endorsing CU for a sleeper check. GeneralNotability (talk) 19:40, 29 July 2020 (UTC)
 * Also, I've blacklisted a bunch of the domains here and from past cases, see Special:Diff/970189134. GeneralNotability (talk) 20:07, 29 July 2020 (UTC)


 * Zebuready is ✅ to Markerhelp which is a blocked sock. CU isn't very helpful for Budshaze, Vestacit and Adzesjody so is the best I can do. Trust the behaviour. Callanecc (talk • contribs • logs) 08:51, 30 July 2020 (UTC)
 * Per Callanecc's findings, (Zebuready as CU-confirmed and the rest as proven based on behavior). Closing. GeneralNotability (talk) 13:06, 30 July 2020 (UTC)

This is not a stock puppet account. I seen whole case, most of the account is not related to each other. Maybe others are using same/similar kind of trick and you guys adding everyone in same puppet list. I'm not a puppet of anyone of it. I know I made mistake & I'm sorry for that. Please unblock my account zebuready. Zebuready2 (talk) 12:01, 31 July 2020 (UTC)