Wikipedia:Sockpuppet investigations/Ross kramerov/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Confirmed by at Sockpuppet investigations/Mochee, but appear unrelated to Mochee so filing here. The SandDoctor Talk 04:01, 17 October 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * (Abovo777 and Kreplah blocked already by ). Closing. The SandDoctor  Talk 04:07, 17 October 2019 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

blocked as a suspected sock of Ross kramerov. Kosherplanet is non-stale, could we see if this could be confirmed by a CU? The SandDoctor Talk 04:13, 17 October 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Did this account come up in your search/CU check? -- The SandDoctor Talk 04:14, 17 October 2019 (UTC)
 * Nope - A l is o n  ❤ 04:57, 17 October 2019 (UTC)
 * Kosherplanet is to the set of socks Alison has blocked from the other case. As they're already blocked, I think this case can be closed, unless one of you intended that it be left open for some reason? ST47 (talk) 18:08, 17 October 2019 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

2019112410000185 ST47 (talk) 19:13, 24 November 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
✅, . ST47 (talk) 19:13, 24 November 2019 (UTC)
 * Cleanup finished, closing. ST47 (talk) 19:19, 24 November 2019 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Jada1234 was registered a day after BhasSpeak was blocked. I have shared some evidence with to confirm BhasSpeak's connection with the master. GSS &#x202F;&#128172; 14:02, 25 February 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * This edit makes it pretty clear that Jada1234 = BhasSpeak, and the off-wiki evidence makes it equally clear that BhasSpeak = Skyfallbvm = Ross kramerov. Blocked without a CU check; the behavioural evidence is sufficient. Yunshui 雲 水 14:14, 25 February 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

As per off-wiki evidence user Healsbeat belongs to the same sockfarm and was hired to create Keishorne Scott. Rhetorician1217 and Bingley Bates were registered recently after Healsbeat was blocked by to vote on the AfD. Requesting CU to see their technical relation and for accounts, they have in their sock drawer. GSS &#x202F;&#128172; 08:09, 20 July 2020 (UTC)


 * Their most recent sock was blocked last month by Yunshui. GSS &#x202F;&#128172; 08:23, 20 July 2020 (UTC)
 * , please check your inbox and let me know if you need more details. Thank you, GSS &#x202F;&#128172; 13:43, 28 July 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The connections are mediocre at best with CU, but the evidence indicates that the accounts are comprised or being shared in some way...I don't exactly understand how. That said, Healsbeat = Sophiedub = Bingley Bates. Seperately, Simeonscott = Rhetorician1217 = DamselDove. Bring me back more possibles and i'd be happy to check for other relateds. -- Amanda  (aka DQ) 07:00, 25 July 2020 (UTC)
 * picked up where Simeonscott left off at Michael H. Forde and voted keep at the respective AFD. The page was created by . I blocked the six confirmed accounts. MER-C 11:23, 26 July 2020 (UTC)
 * WikiFixer337 is Michaforde which also comes from the same range Healsbeat is from. Huedsacr uses a standard area we see proxies in. -- Amanda  (aka DQ) 04:49, 27 July 2020 (UTC)
 * Blocked WikiFixer337 as a sock and Huedsacr as spam-only. Leaving open for a clerk to check tags. MER-C 18:34, 27 July 2020 (UTC)
 * , any preferences on how you want these tagged? Do you want the subgroups (Healsbeat/Sophiedub/Bingley Bates/Michaforde/WikiFixer337, Simeonscott/Rhetorician1217/DamselDove/Michaforde) tagged as separate groups or do you want these all tagged as suspected socks of kramerov? GeneralNotability (talk) 20:08, 27 July 2020 (UTC)
 * How ever you wish to mix and bake is fine by me. I don't even have an idea myself with the CU results. -- Amanda  (aka DQ) 04:06, 28 July 2020 (UTC)
 * I'll just block them all as a group, since they clearly are working together in some way. Before I do that -, could you please send me the off-wiki evidence linking Healsbeat to the kramerov farm? Want to make sure they should be part of this case. GeneralNotability (talk) 13:17, 28 July 2020 (UTC) GeneralNotability (talk) 13:17, 28 July 2020 (UTC)
 * Per 's email, agreed that this group is related to kramerov. Retagged everyone as "proven" to Ross kramerov (per DQ, the relationships are wonky here, so I'm not ready to say "confirmed," but I am certain that these accounts are somehow working together) and filed for global locks. GeneralNotability (talk) 15:54, 28 July 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same person as per and Draft:AwardWallet. please match the details I sent you last week with link on my talk page. any idea if it worth using your tool again? The user is inactive since June 30th. GSS &#x202F;&#128172; 04:32, 3 August 2020 (UTC)


 * do you mind hitting the button as proven based on evidence in hand? Thank you in advance. GSS &#x202F;&#128172; 06:58, 5 August 2020 (UTC)
 * It's possible because I have seen these freelancers subconracting on various platforms. GSS &#x202F;&#128172; 13:27, 5 August 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Based on GSS's information, Offalsiang is almost certainly part of the kramerov farm. Might as well take a look with CU, they have enough jobs in progress on Upwork that there are probably more out there. GeneralNotability (talk) 13:31, 3 August 2020 (UTC)
 * ❌ as far as I can tell, and no other accounts seen. Ivanvector (Talk/Edits) 13:48, 4 August 2020 (UTC)
 * , yeah, . I'm wondering if the job was subcontracted out or something since previous CUs have at least come back as "possible". GeneralNotability (talk) 13:23, 5 August 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

As per off-wiki evidence, this account linked to the same freelancer profile which Ross kramerov use for paid editing and was hired to create Spencer Charnas. As per their work history, they completed a number of projects this and last month so I was wondering if a CU can look into their sock drawer using their special goggles. Bothering again. GSS &#x202F;&#128172; 19:18, 18 September 2020 (UTC)


 * with subject "Ross kramerov SPI" - no ticket number yet. GSS &#x202F;&#128172; 04:42, 21 September 2020 (UTC)


 * As per the CU result, it's possible that either they have subcontracted someone to post this page or they are now using different ISP and devices so meat puppetry is possible IMO. Thank you, GSS &#x202F;&#128172; 05:22, 21 September 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Acknowledging that I've seen an email from GSS with the evidence (upwork post which ties this particular page to the upwork account connected to this sock group), so I'm convinced that Draft:Spencer Charnas is a paid job and UstoKusto is likely related to the kramerov group. Self-endorsing for a sleeper check. GeneralNotability (talk) 23:05, 18 September 2020 (UTC)
 * - If Ivanvector is able to see the evidence and is willing to run a check based on it, he's certainly able to, but if you would like the next available CU to run this check it would be helpful to send the evidence to paid-en-wp and link the ticket here. Best, Kevin ( aka L235 · t · c) 16:45, 20 September 2020 (UTC)
 * Technically ❌. Sleeper check inconclusive. Kevin ( aka L235 · t · c) 04:57, 21 September 2020 (UTC)
 * Blocked as suspected UPE, closing. GeneralNotability (talk) 14:47, 8 October 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Alanzie appears to be another sock in this spam farm, they've recreated Dimetri Hogan, known to be a paid for piece, previously by Rxypro, and their first edits to start gaming for ACperm was to Chethallur making the same pointless "fixes" as UstoKusto. They also share a lot of the same weird grammar with JigzoJo who tried to get around the Hogan salt by creating Dimetri Hogan (creative director) like Alanzie did initially with Dimetri Imani Hogan. Praxidicae (talk) 14:13, 30 October 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Alanzie JigzoJo, UstoKusto ❌. --  Amanda  (aka DQ) 19:56, 30 October 2020 (UTC)


 * Both already blocked indef. Closing. Callanecc (talk • contribs • logs) 05:19, 8 November 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

This belongs to the same sock farm as per off-wiki evidence that I have shared with paid-en-wp as well as with and. GSS &#x202F;&#128172; 15:09, 17 November 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked as suspected Kramerov sock (or someone he sub'd the job out to)/UPE., in future emails it would help if you can also include a screenshot of the job. GeneralNotability (talk) 01:25, 22 November 2020 (UTC)

Suspected sockpuppets

 * ( original case name)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Extremely strange editing behaviour by Cookiethepug - they have made several hundred edits, almost all of which are trivial typographic changes made with the summary "Grammar correction" or "Word correction". These changes are generally additions of optional commas or changing false titles (neither of these are "errors") or minor genuine corrections. Many of their early edits were in draftspace. This would strike me as a covert attempt at getting extended confirmed rights had the user not made more than 500 edits in less than 30 days.

I see exactly five things they've done that are not of this form (and one deleted edit, presumably trivial). First, creation of a userpage. Second, two Teahouse questions about drafts that they were making these minor "corrections" to. Third, a response to a talk page message. Fourth, constructive (but imperfect) edits to a page I created. Fifth, these (partially constructive) edits to James Veitch (comedian) with a clear intention towards whitewashing of sexual harassment allegations, on a page with a history of very suspicious activity in the same direction (including doxxing of an accuser).

I slept on this to think about if I was being overly paranoid, but there are too many red flags being hit here.
 * Creation of a userpage very early on (done by socks to minimise scrutiny).
 * Trivial draft edits as the primary early contributions (where would a newbie discover indices of drafts from?; also seems like a way to make very low-profile edits).
 * Mass typographical changes at rapid pace.
 * Familiarity with Wikipedia lingo on first usage at James Veitch (comedian) ("undue weight"), without having participated in discussions where it was mentioned.
 * Consistently referring to BLP wrongly as "BPL" was what the IP did in discussion, even after correction. I have never seen anyone else refer to the policy as BPL, ever. It's not a common mistake.

"BPL" is the strongest and indicates to me at least meatpuppetry. I wouldn't be filing the SPI without it.

Note that Tompg has not been connected to the IP, though the IP was CU blocked (I think with a rangeblock as I'm struggling to find the block notice) and though a CU won't connect an IP to an account, I think the connection there is obvious. Bromberg721 was blocked as a sock. Some of the connections between accounts could be meatpuppetry (I'm suspecting UPE because we know Bromberg721's owner was engaged in it), but something suspicious is happening. — Bilorv ( talk ) 14:21, 17 August 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Hello, I categorically deny all the accusations in sockpuppetry listed by Bilorv and I have no relation to Ross kramerov - I haven't heard of the user until I discovered Bilorv's notice on my Talk page. Also, I'm a new user and don't have much experience in the disputes but it looks like a personal attack of Bilorv based on my edits. I have a good faith in what I'm doing and my intentions were to improve the article of James Veitch and make it more neutral. I believe Bilorv's accusations are ridiculous at best or "paranoid" as the user called my edits: Consistently referring to BLP wrongly as "BPL" was what the IP did in discussion, even after correction. I have never seen anyone else refer to the policy as BPL, ever. It's not a common mistake. - '''This is indeed paranoid. I did misspell it and this is proof of sockpuppetry? Is Mr. Bilorv a forensic expert or something to make the conclusion?''' All I do is try to find my pace here. --Cookiethepug (talk) 17:00, 18 August 2021 (UTC)
 * Trivial draft edits as the primary early contributions (where would a newbie discover indices of drafts from?; also seems like a way to make very low-profile edits). - I'm doing my best to help to the best of my knowledge and experience, mostly getting used to complex Wikipedia code.
 * Mass typographical changes at rapid pace. - When did Wikipedia forbid doing grammar corrections?
 * Familiarity with Wikipedia lingo on first usage at James Veitch (comedian) ("undue weight"), without having participated in discussions where it was mentioned. - I encountered the page accidentally and read the discussions on the Talk page of the articles also learning about the terms from the links.

Clerk, CheckUser, and/or patrolling admin comments
This should be merged into Sockpuppet investigations/Ross kramerov. Bromberg721 was blocked as a sock of Ross kramerov. The behavior of Cookiethepug looks very much like the Ross kramerov socks. Special:contributions/2601:1C0:CB01:2660:0:0:0:0/64, which also looks like an Rk sock, was CU-hard-blocked for six months on November 20, 2020 (the block expired before Cookiethepug started editing). I don't think we need concern ourselves with Tompg, who is older than the master and is now very stale, unless they resume editing.--Bbb23 (talk) 23:57, 17 August 2021 (UTC) Both share a number of behavioural similarities with the account above and the Kamerov farm, they have near-identical user pages and Habibiroyal overlaps with the /64 on this obscure draft talk page. --Blablubbs (talk) 18:55, 21 August 2021 (UTC)
 * Merged as suggested by Bbb23. GeneralNotability (talk) 13:36, 19 August 2021 (UTC)
 * - there is enough here to merit a check; the archives are probably, but I'm hoping for good log data. In addition, please compare to
 * and
 * Cookiethepug is to Ross kramerov via sharing a range with WikiFixer337 and Healsbeat, but it's a pretty large range with multiple sockmasters and even more likely-legit users.
 * (not originally reported) is to Ross kramerov via logs for Sictransitgloriamundi7, on a much smaller/more personal range. KevinL ( aka L235 · t · c) 19:00, 21 August 2021 (UTC)
 * Habibiroyal is . Rupertdonovan is . KevinL ( aka L235 · t · c) 19:03, 21 August 2021 (UTC)
 * What about the technical connection between Cookiethepug and Soggydemur, although I realize that Soggydemur has only two edits? Behaviorally, I should point out that one of Soggydemur's two edits was to a draft also edited by Cookiethepug.--Bbb23 (talk) 19:32, 21 August 2021 (UTC)
 * No technical connection between those two that I can see. Best, KevinL ( aka L235 · t · c) 19:36, 21 August 2021 (UTC)
 * I've blocked and tagged Cookiethepug and Soggydemur based on the CPU log evidence and the strong behavioral evidence. I'll leave the fate of Rupertdonovan and Habibroyal to . Bbb23 (talk) 19:40, 21 August 2021 (UTC)
 * I agree that Habibiroyal and Rupertdonovan are suspiciously similar, and both have the whiff of UPE. Blocked both as UPE, uncertain of their connection to this farm. Closing. GeneralNotability (talk) 15:55, 1 October 2021 (UTC)

Suspected sockpuppets

 * Active


 * Possibly stale


 * Already blocked


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

-- MarioGom (talk) 20:49, 3 September 2021 (UTC)
 * Same tells as previous accounts. Many similarities between the accounts in this batch, and to previous accounts: MichaelGrossmanjr, Sictransitgloriamundi7, also to Rupertdonovan in the previous report.
 * Overlaps, including Rupertdonovan and Habibiroyal:

--MarioGom (talk) 21:06, 3 September 2021 (UTC)
 * Added GreenPastures17 and Gunkhalve:


 * Moved Beltroad714 and Gunkhalve to possibly stale. Added Chartwind to the active section. Chartwind is relatively old and even better connected to older socks. MarioGom (talk) 16:33, 1 October 2021 (UTC)


 * Added Riperminus, which overlaps with other blocked socks on drafts, has consistent timecards, and shares style quirks. Moved Siftsirwin to stale. MarioGom (talk) 20:56, 20 October 2021 (UTC)
 * Also note that Riperminus created pt:AwardWallet and GreenPastures17 created AwardWallet. MarioGom (talk) 21:01, 20 October 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * There's a decent amount of weirdness in the logs here, I'm pretty sure that some of the accounts in the archive aren't Ross kramerov (though my notes in the archives suggest subcontracting...so maybe that's what's going on?). Paisavassul, GreenPastures17, Chartwind, and Riperminus are to each other (they geo to the same general area, but common UAs and wide ranges are involved). I'd also call -possilikely on the relationship between these accounts and the archives (particularly Gustav Stockton and, to a lesser extent, Soggydemur). I'll block this lot, leaving tagging to a clerk. GeneralNotability (talk) 02:17, 21 October 2021 (UTC)
 * Tagged, closing. -- RoySmith (talk) 22:25, 5 November 2021 (UTC)

Suspected sockpuppets

 * Similar timecards to previous socks.
 * Interesting overlaps:
 * Onetimememorial overlaps at Barbara Nevins Taylor (with Bormenthalchik82 and previously reported but stale Browssobs), Teal Swan (with Riperminus), Draft:Digits (company) (with Riperminus), Draft:Savage (Shan Vincent de Paul song) (with Cookiethepug), 1inch Network/Talk:1inch Network (with Bormenthalchik82), Draft:Clerici family (with Riperminus).
 * Bormenthalchik82 overlaps at Anthony Czarnik (with Browssobs), Admirals (company) (with Chartwind, Rothwarms7), Barbara Nevins Taylor (see above), World Financial Group (with Rothwarms7), 1inch Network (see above).
 * Rothwarms7 overlaps at Admirals (company) (see above), World Financial Group (see above).
 * Similar edit summary stiles (e.g., , ).
 * There is a pattern of account alternation in more or less contiguous days (or same day, contiguous hours) without interleaving.
 * Onetimememorial re-added some text originally added by previous sock to Barbara Nevins Taylor . Same text was added by Bormenthalchik82 to Ice Cube.
 * Also compare the timing of the following edits: by Onetimememorial and Bormenthalchik82 to the topic of Barbara Nevins Taylor/Ice Cube.
 * Note that I added Rothwarms7, but since it's stale, and evidence is not so abundant, I do not expect it to be actionable. MarioGom (talk) 18:42, 25 December 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * to compare to the case logs and check for sleepers. Note that I'll probably be requesting blocks for the first 2 anyway. MarioGom (talk) 18:43, 25 December 2023 (UTC)
 * Rothwarms7 is stale. I'd say both of the other two are a to the group in the 3 September 2021 archive based on historicals, but no higher confidence than that. Izno (talk) 19:20, 25 December 2023 (UTC)
 * - Please, indef Bormenthalchik82 and Onetimememorial as suspected to the master. Rothwarms7 can probably be left alone as long as it's stale. Thank you. MarioGom (talk) 10:16, 2 January 2024 (UTC)
 * ✅  Vanjagenije  (talk)  11:46, 3 January 2024 (UTC)
 * Closing. MarioGom (talk) 17:26, 3 January 2024 (UTC)