Wikipedia:Sockpuppet investigations/Sanketio31/Archive

Suspected sockpuppets
Not stale: Possibly stale:


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

We are filing this SPI on what appears to be 26 accounts who primarily operate at AfD. They vote in concert with each other and have similar unusual behavioral patterns both inside and outside of AfD, which we believe indicates that they are engaged in abusive socking or meatpuppetry. The behaviour is similar to the group previously reported at the SpareSeiko SPI, which was linked to AfD extortion. Some of these accounts were previously filed by at Sockpuppet investigations/JeepersClub. Extraordinary Writ's report contains very good explanations and some additional evidence that should be considered jointly with this report.


 * Behavioral similarities inside AfD
 * All accounts use unusual and incorrect yet similar grammar (the bolding is our own):
 * WP:Articles for deletion/Anu Singh Lather – Fails WP:NPROF and WP:GNG limited coverage CeltJungleSnake (talk)
 * WP:Articles for deletion/Sarah Law – Fails WP:GNG Previously deleted Articuno appears (talk)
 * WP:Articles for deletion/Mark Nielsen (CEO) – Fails WP:GNG lacks reliable sources Articuno appears (talk)
 * WP:Articles for deletion/Sudhir Singh – Fails WP:GNG not enough coverage Purosinaloense T/K
 * WP:Articles for deletion/Keyva King – Fails WP:GNG lacks news coverage Impeeriumalo (talk)
 * WP:Articles for deletion/Guo Yi (musician) – Fails WP:NMUSIC not enough available coverage. Sanketio31 (talk)
 * WP:Articles for deletion/Mel Sanson – Fails WP:NMUSIC not enough news coverage CeltJungleSnake (talk)
 * WP:Articles for deletion/Anu Singh Lather – Fails WP:NPROF and WP:GNG limited coverage CeltJungleSnake (talk)
 * WP:Articles for deletion/Gihan Ibrahim (2nd nomination) – Fails WP:GNG lacks coverage Patriot0239 (talk)
 * WP:Articles for deletion/Mark Nielsen (CEO) – Fails WP:GNG lacks reliable sources Articuno appears (talk)
 * WP:Articles for deletion/Robert Terell – Fails WP:GNG no indepth coverage Urartuvanking (talk)
 * WP:Articles for deletion/Wallbox (2nd nomination) – Fails notability requirements miss significant coverage. Tulkijasi (talk)
 * WP:Articles for deletion/Special Strong – Non notable fails GNG Urartuvanking (talk)

Some accounts are clearly copy-pasting the votes of previous AfD participants, examples below:


 * Keep as it does have some significant reliable sources coverage but the main reason is that the remains of a notable holy martyr Vladimir Bogoyavlensky have been interred here which gives the church historic significance in my view, Atlantic306 (talk)
 * Keep Passes GNG as it does have some significant reliable sources as per above. Articuno appears (talk)
 * Restore redirect to Newegg per previous AfD decision: I don't see enough in the announcement press-release or available product reviews to justify a distinct article on this relaunched brand. Possibly, some mention of it should be added to the Newegg history. AllyD (talk)
 * Restore redirect to Newegg per previous AfD decision. Articuno appears (talk) 09:17, 26 April 2021 (UTC) (note same formatting)
 * Delete, Fails WP:NSCHOOL and WP:NCORP, being private educational institution. Chirota (talk)
 * Delete, Fails WP:NSCHOOL and WP:NCORP as per above. Articuno appears (talk) 12:42, 22 April 2021 (UTC) (note the same odd comma and capitalization)
 * Redirect, to Linacre College, fails WP:ORG and WP:GNG, a search reveals no WP:SIGCOV. SailingInABathTub (talk)
 * Redirect, to Linacre College, as per all. Articuno appears (talk) (note the unusual comma usage)
 * Redirect, to Linacre College, as per all. Articuno appears (talk) (note the unusual comma usage)


 * Redirect to George Floyd Square, per WP:INDISCRIMINATE. ——Serial
 * Redirect to George Floyd Square, per WP:INDISCRIMINATE. RockOften (talk)
 * Delete There is no content and no sources Applus2021 (talk)
 * Delete Fails GNG There is no content and no sources. RockOften (talk) 12:05, 26 April 2021 (UTC)
 * Delete Couldn't find sufficient evidence of notability. Suonii180 (talk)
 * Delete Can't see sufficient evidence of notability for this school. RockOften (talk)
 * Keep or merge to Realtek as WP:ATD. Deletion is unwarranted. ~Kvng (talk)
 * Keep or merge to Realtek as WP:ATD as per all above. RockOften (talk)
 * Keep or merge to Realtek as WP:ATD as per all above. RockOften (talk)


 * Keep The solution to a poorly referenced article about a notable business is to improve the referencing and rewrite the article. Deletion is not the answer. Quite easily, I found this article with four paragraphs about the history of the company. Cullen328 Let's discuss it
 * Keep A notable supermarket with indepth coverage in reputable sources. As also Cullen328 pointed out The solution to a poorly referenced article about a notable business is to improve the referencing and rewrite the article. Deletion is not the answer. Has enough sources to be kept. Riteboke (talk) 14:05, 18 April 2021 (UTC)
 * Keep per Vaticidalprophet's rationale. Donaldd23 (talk)
 * Keep per Vaticidalprophet's rationale. Riteboke (talk)
 * Keep per Vaticidalprophet's rationale. Riteboke (talk)


 * Delete The sources don't satisfy WP:ORGDEPTH and WP:ORGCRIT. VV
 * Delete Sources don't satisfy WP:ORGDEPTH. Frigidpolarbear (talk)
 * Keep: The Danish equivalent article seems to indicate notability - many film and tv music credits [...] PamD
 * Keep As per PamD has many film and TV music credits. Passes WP:GNG. Frigidpolarbear (talk)
 * Delete complete rubbish WP:CRYSTAL unsupported by RS. Mztourist (talk)
 * Delete WP:CRYSTAL unsupported by RS as per Mztourist. Frigidpolarbear (talk)
 * Delete WP:CRYSTAL unsupported by RS as per Mztourist. Frigidpolarbear (talk)


 * See for more examples of copy-pasting others' votes and forgetting to close the bold markup.


 * Additionally, accounts in this group frequently nominate an article for deletion, which is followed by other accounts voting keep on it en masse. This is reminiscent of behavior documented in the SpareSeiko SPI. Below is a table which illustrates how the accounts have voted in AfDs where they have overlapped. We have also highlighted where the accounts have explicitly voted against consensus. For brevity, "Sanketio31" will refer to all accounts:
 * {{legend|#ADD8E6|Nom+keep (more than one keep vote from Sanketio31}}
 * {{legend|#E1F3FA|Nom+keep (just keep vote from Sanketio31}}
 * {{legend|#FFD700|Voting against consensus}}


 * Behavioral similarities outside of AfD
 * Most accounts were registered some time ago, but all returned to activity at the same time, in April-May 2021.
 * There was a minimum two month delay between creation and activity:               . Nine of these accounts resumed activity in April, four in May, and one in June
 * There are two exceptions:
 * JaredDaEconomist, Impeeriumalo, Rickshaw Takahashi, Tulkijasi, and Zackdasnicker all began editing in April, but without a sleeper period (they began editing swiftly after creation).
 * DmitriRomanovJr, Peneplavím, Sanketio31 were active in the month(s) preceding April.


 * A handful of accounts went inactive in late May-June (some in early July too). They all resumed activity within under 2 weeks of each other:
 * Frigidpolarbear Hypogaearoots Impeeriumalo INeedToFlyForever Jaysonsands Okaye Agongo Rickshaw Takahashi Riteboke Sanketio31 Slovenichibo Zackdasnicker
 * Accounts participate in one of a handful of gnoming activites, including but not limited to HotCat, adding to "See also" section, welcoming, wikilinking, as well as rapid-fire copyediting, often involving the word "the", adding serial commas, and removing double spaces. It is very rare for the accounts to make substantial edits to content.
 * Some accounts have used welcoming to inflate their edit count, reminiscent of from the SpareSeiko farm:
 * Frigidpolarbear INeedToFlyForever Kieem trra Peneplavím Tulkijasi


 * Using MediaWiki:Gadget-defaultsummaries.js, often with summaries that have nothing to do with the edit substance: Riteboke, Zackdasnicker, Namkongville.
 * Some accounts have an ethnic/national theme, expressed in the user name, sometimes user page, and in their non-AfD gnoming activity: Purosinaloense, Urartuvanking, Patriot0239, Grandruskiy48, Rickshaw Takahashi, Okaye Agongo, INeedToFlyForever, Slovenichibo, DmitriRomanovJr.


 * Links between specific accounts

For the AfD vote criteria, note that some accounts focus on nominating articles for deletion (which are then voted on by other members of the group), and do not vote on AfDs themselves.

Thanks,

-- Giraffer (talk·contribs) 18:48, 6 September 2021 (UTC)

--Blablubbs (talk) 18:54, 6 September 2021 (UTC)

--MarioGom (talk) 18:57, 6 September 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I wholeheartedly concur in all of the above: thanks to all three of you for putting it together. As noted above, I filed a related SPI at WP:Sockpuppet investigations/JeepersClub, and I continue to believe that all of them are connected. For instance, take a look at these rapid-fire AfDs by GermanKity: they use very similar language, including the "as per nom, fails WP:GNG" comments. There are about a half-dozen additional suspected socks at that SPI, so I hope that the CU looks at both of these SPIs together. Extraordinary Writ (talk) 19:29, 6 September 2021 (UTC)


 * Hi, I never created any page against the admin's permission. I earlier voted keep but as soon as admin MER-C and  Onel 5969  TT me voted delete because of creator's sockpuppetry. I immediately changed my vote to delete as soon as I knew that. I like music and creating music pages that's why I was given permission to recreate the page that's only why I recreated it. I never broke any rules and never gone against the admin's decision. I have done more than 5000+ edits and I never created any other account I swear. I only have this one account which I use to edit music-related pages. Please make my name out of this list because I am wrongly accused here. Riteboke (talk) 15:23, 7 September 2021 (UTC)


 * I was gathering some evidence but Spicy basically hit the nail on the head – I strongly believe Riteboke is related. Thanks, Giraffer (talk·contribs) 19:26, 3 October 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * I'm too involved in the filing to clerk this myself. I will say that even if there were to be a negative CU-result for some or all of these accounts, there is clearly coordinated behaviour going on here. Also ping who asked me to keep him in the loop a while back and, who might also be interested in this. Thanks in advance to whoever takes on this case.  --Blablubbs (talk) 19:06, 6 September 2021 (UTC)
 * I had suspected something was fishy was going on here having seen a group of 300-1000 edit accounts popping up on AFD but could not find any smoking gun to block. Riteboke recreated Gustavo Lopez (music executive) after Articles for deletion/Gustavo Lopez (music executive). Sanketio has a very strong red flag too (not saying it on-wiki). Slovenichibo appears to be a Sockpuppet investigations/Japanelemu (i.e. Wiki-PR) grade username and dates back to that era. I will not be surprised if there is more. MER-C 19:35, 6 September 2021 (UTC)
 * I will also not be surprised to learn that CU turns up nothing because the level of sophistication is such that evading Wikimedia's pathetic anti-abuse tools would be something they can do in their sleep. Nonetheless, this should be escalated to T&S. MER-C 17:18, 7 September 2021 (UTC)
 * - I have been aware of Blablubbs & co.'s work on this investigation for some time, but I have not been directly involved and consider myself sufficiently neutral to endorse. I know this is a really big filing and there's a lot of evidence and names, but I believe that the overlap is solid and that there is credible evidence of abuse here. As with SpareSeiko, this looks a lot like AfD-related extortion (nominate article for deletion, get paid by subject, brigade the AfD with keep votes after payment), which is so abhorrent that I'm almost lost for words. GeneralNotability (talk) 13:24, 7 September 2021 (UTC)
 * As an aside: it is absolutely possible that there are individual accounts in this group who match the rest of the group due to coincidental overlap; that's part of why CU is needed here. However, there is enough overlap in everyone here that this is not a fishing expedition - every account I've looked at in this list has some kind of credible connection to the rest of the group that is hard to explain by mere happenstance. GeneralNotability (talk) 19:38, 7 September 2021 (UTC)
 * I've ran checks on all the accounts. Given both technical and behavioral evidence, I believe that it is more likely than not that either one individual, or a closely connected group of individuals, is operating all of these accounts. I'd rather not elaborate more in public for reasons, but I welcome anyone interested to email me. Additional opinions on the technical evidence would be particularly welcome here.  Maxim (talk)  15:29, 10 September 2021 (UTC)
 * , thanks much. Would you like blocks here (and if so, how do you want them tagged), or do you want a second opinion on the CU data first? GeneralNotability (talk) 15:43, 10 September 2021 (UTC)
 * , I think a second opinion would be useful here before blocking or tagging.  Maxim (talk)  15:56, 10 September 2021 (UTC)
 * I don't know if this is related, but I just blocked for creating a spam article, waiting two months, then spamming AFD nominations. MER-C 17:12, 11 September 2021 (UTC)
 * I just want to note that I have started running checks in this case, but because of the number of suspected socks and its complex nature, it may be a day or two before I post my conclusions. For fellow checkusers, I've posted some notes on the CU wiki in case you want to follow along: . Mz7 (talk) 06:15, 22 September 2021 (UTC)
 * - checks have been completed per the above. Could a clerk progress this case, or mark exactly what's required currently? Many thanks ~TNT (she/they • talk) 03:07, 30 September 2021 (UTC)
 * @TheresNoTime: Per Mz7s comment, (re-)checks are still in progress – or did I miss something? --Blablubbs (talk) 11:49, 30 September 2021 (UTC)
 * I've set this to inprogress for the time being. --Blablubbs (talk) 12:22, 30 September 2021 (UTC)
 * I apologize for the delay. The potentially coordinated behavior of these accounts has been on my radar for some time (functionaries can see this May 2021 email I sent to the list), but because of the complex and novel nature of the underlying technical data, it slipped through the cracks, and I never took concrete action on the case. I thank Giraffer, Blablubbs, MarioGom, and Extraordinary Writ for raising this issue directly. From a technical standpoint, this case is complicated because it involves a novel form of CU evasion that we haven't seen a lot before this year. The following accounts haved used IPs that have been flagged as possible endpoints for this novel kind of proxy:
 * Saketio31
 * DmitriRomanovJr
 * INeedToFlyForever
 * Jaysonsands
 * Okaye Agongo
 * Slovenichibo
 * Tulkijasi
 * Zackdasnicker
 * Riteboke
 * Frigidpolarbear
 * I checked the following accounts, but their IPs were not flagged as endpoints for the novel proxy—however, this could easily be a false negative, and behavior should be the deciding factor:
 * Hypogaearoots
 * Impeeriumalo
 * JaredDaEconomist
 * Rickshaw Takahashi
 * I agree that the behavioral similarities of these accounts is highly suspicious, and the likely use of this novel proxy adds to that suspicion. However, I think a clerk should go through and carefully examine the behavior of these accounts one more time. (In particular, could we get second eyes on ? They're the only account listed that has commented here to defend themselves, and they're the only one with 5000+ edits as far as I can tell. The proxy flag could be a false positive.) It's clear to me, however, that several editors and administrators have examined the evidence here and agreed that it is suspicious. I think we should be able to proceed with blocking all of the non-stale accounts except Riteboke. If a clerk does not action this case or provide a second opinion by this weekend, I will go ahead and do this myself. Mz7 (talk) 23:16, 30 September 2021 (UTC)
 * I am strongly convinced that Riteboke is related to this group. They have voted in concert with other suspected accounts (and often against the consensus of established editors) at Articles_for_deletion/François Bergeron, Articles for deletion/Mel Sanson, and Articles_for_deletion/Gustavo_Lopez_(music_executive) (though they struck their vote and changed to 'delete' after some other keep voters were blocked as socks... as did other accounts in the filing). Recreating Gustavo Lopez after voting 'delete' at its AfD is bizarre, but makes sense if you read that AfD as a thwarted attempt at the "nomination + keep" strategy described in the filing; the copy-pasting of others' AfD votes, as noted in the table, is also highly suspect. The edit count seems to have been obtained mostly through repetitive wikignoming edits, as is typical of this group, sometimes seemingly going through a list of articles alphabetically; compare, , . I also find it interesting that the account has not edited since shortly after their comment on the SPI. Spicy (talk) 18:11, 3 October 2021 (UTC)
 * The evidence presented is compelling, especially when combined with the characteristics of deliberate CU evasion I've referred to above. All non-stale accounts, including Riteboke. I've left the stale accounts untouched for the time being—if they return to activity, they may be reported here again. Closing. Mz7 (talk) 03:01, 8 October 2021 (UTC)

Suspected sockpuppets

 * ( originally filed under this user)




 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

The more I look at this case, the more I become astonished both by how brazen and how subtle this individual is. I hope you'll bear with me as I set forth all the evidence: it's difficult to be concise when sixteen seventeen accounts are involved, but I'll do my best. Tl;dr: These accounts tend to follow this pattern: With this general pattern in mind, allow me to present the specific behavioral evidence indicting each sock:
 * 1) The account is created. Sometimes multiple accounts are created at the same time (two were created just three minutes apart), but oftentimes there is a delay of several days, months, or more. All of these are fairly new: I've yet to see any created before 2017, and most are from 2020 or later.
 * 2) After a few pro forma edits (e.g. making a user page; some formatting changes), the account goes into sleeper mode. It may not emerge for months or years. This makes the accounts appear older than they actually are.
 * 3) The account comes out of sleeper mode. It makes many, many small edits (writing an infobox parameter by parameter; fixing tiny grammatical issues one at a time; adding categories one at a time). These take almost zero effort; they are intended solely to drive up the edit count. The account may go in and out of sleeper mode.
 * 4) Eventually the account goes into deletion mode. The hallmark sign here is making short single-sentence comments in about a dozen consecutive AfDs over a short period of time. Often two or more socks will participate in the same AfD. The editor evidently has a poor grasp of the English language, so many unusual tics are repeated here, like "should pass for GNG" and "as per nom, no indication...". Other interests include draftification and speedy deletion.
 * 5) Several accounts go on to seek the new page reviewer (NPR) permission. Since the accounts are old (due to the sleeper periods) and have a high edit count (due to the lightning-speed minor edits), their request is often granted. NPR accounts tend to nominate, relist, and close many AfDs, all very quickly.


 * TheChromium: Uses the phrase "should pass for GNG". . Per this, the phrase has only ever been used by TheChronium, Jaysonsands, and Grandruskiy48. !Voted in 9 consecutive AfDs in 17 minutes. . Has the NPR permission; participated in this AfD with four fellow socks.
 * Zackdasnicker: !Voted in 11 consecutive AfDs in 29 minutes. . Account created just three minutes after fellow sock Jaysonsands; account was created in Jul 2020 but wasn't used until Apr 2021. Made scores of worthless edits like these.
 * Kieem trra: !Voted in 12 consecutive AfDs in 12 minutes. . Participated in this AfD with four other socks. Made no article-space edits until months after account creation.
 * Impeeriumalo: Didn't make any mainspace edits until three months after account creation. Started out with garbage edits like these. Participated in this AfD with (at least) two other socks. Large numbers of simultaneous AfDs.
 * Jaysonsands: another of the three "should pass for GNG" accounts. . !Voted in 13 AfDs in less than 2 hours. . Account created just three minutes before fellow sock Zackdasnicker; lay dormant for ten months. Lots of low-effort edits..
 * Grandruskiy48: one of the three "should pass for GNG" lovers. . !Voted in 12 consecutive AfDs in 26 minutes. . Account wasn't substantially used until 8 months after creation; scores of trivial edits like these.
 * Idunnox3: the already-blocked (already connected to this group via CU data) references this account on her userpage. !Voted in 16 consecutive AfDs in 39 minutes. . Scores of minor draftspace edits..
 * INeedToFlyForever: !Voted in 14 AfDs in 60 minutes. . Account lay dormant for 14 months. Makes loads of little edits..
 * Rickshaw Takahashi: !Voted in 10 AfDs in 14 minutes. . Participated in this AfD with four other socks. Lots of useless minor edits. Account wasn't used for 10 months after its creation.
 * DMySon: another NPR. Initiated, relisted, and voted in myriad AfDs in very short periods of time. . Scores of minor edits like these. In this AfD, JeepersClub himself showed up to support DMySon's nom.
 * Frigidpolarbear: !Voted in 10 consecutive AfDs in 9 minutes. . Participated in this AfD with four fellow socks. After one edit, the account went dormant for 14 months. Used Twinkle to welcome myriad new users with little effort..
 * DmitriRomanovJr: Created his account just 6 hours after fellow sock Bapinghosh. !Voted in 10 consecutive AfDs in 21 minutes. . Scores of trivial edits like these.
 * JaredDaEconomist: !Voted in 10 consecutive AfDs in 15 minutes. . Participated in this AfD with several other socks, including GermanKity. Lots of trivial edits, especially relating to categorization..
 * Bapinghosh: Created the account just 6 hours before fellow sock DmitriRomanovJr. Has a request currently pending for the NPR permission. Account lay dormant for four months. Minor edits like these abound. Heavy AfD participation..
 * Dixiku: Account lay dormant for six months. Makes edits in small drips to drive up edit count. . Participates at AfD in intervals of short duration and heavy intensity..
 * RamotHacker: !voted in 32 (!) AfDs in 3 hours, just yesterday. . Account lay dormant for 12 months.
 * Multi7001: !voted in 22 AfDs in 45 minutes. . Lots of minuscule edits. . Account dormant for weeks at a time.

I'm beyond confident that these accounts are all related. The similarities listed above (as well as a few others that I'm not disclosing right now) obviously cannot be written off as coincidence. CU can hopefully find a few more sleepers: I seem to encounter new ones almost every day, so this individual clearly has an almost inexhaustible supply of accounts. (Could a hard rangeblock work?) Please let me know if I need to provide any more information, and thanks in advance for wading through this mess. Cheers, Extraordinary Writ (talk) 00:07, 6 September 2021 (UTC), supplemented at 05:23, 6 September 2021 (UTC)
 * If I could elaborate a bit as to why I think these accounts are connected to JeepersClub et al.: The JeepersClub cluster follows the five-part pattern that I discussed above. Take, for instance, the already-blocked : the account remained dormant for almost two months after account creation (1 & 2), made myriad tiny edits to his sandbox (3), and !voted in 10 AfDs in 9 minutes  (4). The same is true for the CU-linked : made a handful of edits immediately after account creation  (1), went into sleeper mode for over three years (2), emerged to add scores of low-effort shortdescs  (3), !voted in 15 AfDs in 64 minutes  (4), and applied for and received the NPR permission  (5). Again, let me know (either here or via email) if more information would be useful. Extraordinary Writ (talk) 18:02, 6 September 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * I think all of these should be checked too. TheChronium and Dixiku were in our original Sanketio31 notes, but didn't make it into the final report. Seeing the additional evidence for these two, found independently by Extraordinary Writ, I'm quite confident about the connection. MarioGom (talk) 20:00, 11 September 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
I just want to point out that ran a check on September 2 and uncovered none of these accounts. Of course, his finding of "possilikely" may indicate that checking accounts directly is necessary in this case.--Bbb23 (talk) 13:24, 6 September 2021 (UTC)
 * Some other editors and I have been tracking this farm for quite some time now; by our count, the total number of accounts is 26. Filing with more accounts & evidence is forthcoming either tonight or tomorrow; it might make sense to hold off on actioning this for a short while. Also noting that I do not currently believe this is JeepersClub, though I am admittedly not very familiar with the master. --Blablubbs (talk) 14:37, 6 September 2021 (UTC)
 * See Sockpuppet investigations/Sanketio31. --Blablubbs (talk) 19:10, 6 September 2021 (UTC)
 * - a number of these accounts came up related in the Sanketio SPI; recommend checking these too. I'll take care of the paperwork once we've established whether these are the same group. GeneralNotability (talk) 15:38, 10 September 2021 (UTC)
 * I recommend merging this report with Sockpuppet investigations/Sanketio31. There is a overlap in named accounts, as well as behavioural and technical evidence.  Maxim (talk)  16:21, 10 September 2021 (UTC)
 * - per above ~TNT (she/they • talk) 03:08, 30 September 2021 (UTC)
 * Set to inprogress, see above. --Blablubbs (talk) 12:22, 30 September 2021 (UTC)
 * I actually haven't had the time to check the ones in this section that don't overlap with above. I've moved the status back to "open" for the time being. Mz7 (talk) 23:16, 30 September 2021 (UTC)
 * is likely this sockfarm. Shouldn't the status be endorsed, relisted or CU request? MER-C 15:28, 2 October 2021 (UTC)
 * Moved back to endorse. --Blablubbs (talk) 15:19, 3 October 2021 (UTC)
 * Moved back to endorse. --Blablubbs (talk) 15:19, 3 October 2021 (UTC)


 * I believe that JeepersClub, TheChronium, Dixiku, and Portuportu2 are related—there is evidence that these accounts have attempted deliberately to evade CU detection in the same idiosyncratic manner as other socks of the Sanketio31 variety. For technical reasons, I believe that Idunnox3, RamotHacker, and Multi7001 are most likely not related to this group. I decided not to run a check against DMySon because of insufficient behavioral evidence: that account has more than 15,000 edits and seems much more established than the other accounts listed. Kieem trra and Grandruskiy48 are now stale. JeepersClub, TheChronium, Dixiku, Portuportu2 . Closing. Mz7 (talk) 03:55, 8 October 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

As before. It's not really in doubt that they are a spammer but their edits to AFDs and the padding of their edit count concerns me. Articles for deletion/Mahir Bajramoski was the AFD that triggered this report, Articles for deletion/Kevin Fleming is also suspicious. MER-C 17:15, 8 October 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - worth a check. The SandDoctor  Talk 19:17, 8 October 2021 (UTC)
 * I agree with the suspicion. This account is using IP addresses that have been flagged as endpoints for the novel proxy mentioned in previous reports for this case. Already blocked, so I've added a sock tag. Closing. Mz7 (talk) 18:55, 9 October 2021 (UTC)

Suspected sockpuppets
This account follows the same pattern as previous members of this sockfarm. In sum, there's ample behavioral evidence to show a connection here. This sockfarm uses what called a "novel form of CU evasion"; I understand that there's information on CU-wiki about the situation. Do let me know if there's any more information that I can provide. Thanks in advance. Extraordinary Writ (talk) 21:23, 8 March 2022 (UTC)
 * 1) To quote from the archive, "Accounts participate in one of a handful of gnoming activites, including...wikilinking, as well as rapid-fire copyediting". Juggyevil's contributions contain hundreds of these minor edits, made in quick succession: see here. The history of Epeolus cruciger, where the account made 18 edits (adding wikilinks and commas) in half an hour, is typical.
 * 2) Low-quality AfD !votes. This is the sine qua non of members of this sockfarm. As noted in the archive, after the account has made hundreds of copy-edits, it "goes into deletion mode. The hallmark sign here is making short single-sentence comments in about a dozen consecutive AfDs over a short period of time." Although this latest account has spread out the !vote-spamming somewhat over multiple days, the pattern still remains: six single-sentence !votes in 8 minutes, six one-line !votes in an hour, four single-sentence !votes in 2 minutes (!)
 * 3) Linguistic tics. This account was created just days after this sockfarm was exposed at SPI, so the master has seemingly tried to avoid some of the more obvious giveaways. But some similarities still remain. Take, for instance, Articles for deletion/Oversimplified (2nd nomination), in which Juggyevil states "Fails WP:GNG not enough sources to support the article". The irregularly punctuated phrase "Fails WP:GNG not enough" has only ever been used four times in the history of Wikipedia: once by Juggyevil, once here by the blocked Sanketio31 sockpuppet, once here by , a stale Sanketio31 sockpuppet who was previously reported here, and once more here by another sockpuppet whose master is unknown. Next, I noticed the odd and rare phrase "to showcase notability" used by Juggyevil here: it's also been used by the blocked Sanketio31 socks (here) and  (here). Finally, compare Juggyevil's "Fails WP:GNG, lacks in-depth coverage" (here) with Sanketio31 sock 's "Fails WP:GNG lacks indepth sources" (here), 's "Fails WP:GNG, lacks reliable coverage" here, and 's "Fails WP:GNG lacks reliable indepth news coverage" (here), among others.
 * 4) Interest in permissions. Juggyevil requested the AfC permission, which declined, noting "minor copy-edits across multiple tiny contributions" and low-quality AfD contributions. Previous socks made similar requests for the AfC permission: see  (here and here) and  (here).

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * GeneralNotability (talk) 23:51, 8 March 2022 (UTC)
 * Hoo boy. So first off: all known socks are, not that that helps us much. This editor is not using the "novel proxy" previously mentioned, and CU has nothing else useful to share here. However, the behavioral evidence presented by is compelling, and frankly I am confident that this is a bad-faith editor of some sort (clearly engaged in WP:GAMING behavior) even if they aren't necessarily this specific sockfarm. On those grounds, I am confident in making a block that can be summarized as "obviously somebody's sock and obviously up to no good". . GeneralNotability (talk) 00:05, 9 March 2022 (UTC)

Suspected sockpuppets
First edits were to remove promotional material added by, in a manner characteristic of warring UPEs. Account came back alive after a year to create Architecture Discipline India, which is a re-creation of Architecture Discipline and has multiple portions copy-pasted therefrom. Interestingly, DMySon, part of the GermanKitty sockfarm, made a few gnome edits to that shortly after it was created; maybe that was before the two sockfarms fell out, or maybe it was an "I see you". -- Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 11:48, 24 June 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * . Also, courtesy ping KH-1, who G4-tagged the new article. (I'm actually on the fence as to whether G4 is met, owing to two sources of new coverage, and will leave it to another admin to decide... Guessing this will wind up a G5 if it isn't G4'd.) --  Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 11:48, 24 June 2022 (UTC)
 * I've taken a look at this. All the non-stale edits from this account (which were all made within half an hour of each other) are from the same IP address, which spur identifies as a residential proxy. They are using a super-generic UA. All of this would be entirely consistent with La La Kola being a member of the Sanketio31 farm, but it isn't proof positive that they are a member. I've left this as 'endorsed' in case another CU with more familiarity with this case and P2P proxies wants to take a look;, if you feel the behavioural evidence is strong enough you may of course take action based on this. Cheers  Girth Summit  (blether)  14:08, 24 June 2022 (UTC)
 * I'm not going to get too hung up on the CU data here. They've made an article that is extremely similar to a past sock's and that's plenty for me. suspected. GeneralNotability (talk) 18:47, 25 June 2022 (UTC)