Wikipedia:Sockpuppet investigations/Seokochin/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Ring Master is an obvious UPE account that I'll likely take to COIN to see if a UPE block is warranted if this doesn't turn up anything, but I thought there was enough here to warrant a check to see if we have a new farm or if this is connected to an old farm.

All accounts seem connected through Ring Master, who is recreating pages that have been previously deleted at AfD with enough skill to avoid the very strict limitations of G4.

Recreations include: Nestaway, originally created by Ganeshperumalm.

Intersects with Seokochin and Gokulsupreethraj again on the deleted history of Anjali Ameer.

Semi.sofia is an SPA on the obvious commissioned work NAPAfrica created by Ring Master.

There is also some overlap with Sockpuppet investigations/Wikipedian2017, by Ganeshperumalm who created and edited Deeksha Center For Learning with, a sock that duck blocked to that SPI. Also, requesting a sleeper check and chek for other accounts as is Common in UPE cases. TonyBallioni (talk) 15:06, 12 January 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Gokulsupreethraj is . Ganeshperumalm and Semi.sofia are ❌ to each other and to the others.
 * Group 1 – the following accounts are ✅ to the list of accounts blocked here:
 * Group 2 – the following accounts are ✅ to each other:
 * Group 3 – the following accounts are ✅ to each other:
 * Group 4 – the following accounts are ✅ to each other:
 * Group 5 – the following accounts are technical matches of Group 4 but :
 * The majority of these accounts use a combination of legitimate ISPs and proxies. The Group 1 socks principally edit in one country. Within that country, they mostly edit in two different regions. The Group 2 accounts edit in one of those regions but not the other. The Group 4 socks principally edit in a completely different country, although I find the behavior between Groups 2 and 4 very similar.
 * I'm blocking without tags the accounts in Groups 1-4. Although a few things are obvious, most of this is messy. Regardless of anything else, there are too many accounts in Group 1, including the ones previously blocked, for them not to have their own case.--Bbb23 (talk) 20:44, 12 January 2018 (UTC)
 * , I've blocked Firasmasri without tags based on promotional content found at Draft:Dipndip and your technical evidence. It's slightly different in terms of content style, but the spamminess combined with the technical evidence is enough for me to feel comfortable that there is some connection, even if it is different freelancers for the same firm. I'm not seeing any evidence for a block of MartinRay33. If a clerk needs to move this, I'd ask that they leave it open for a bit so we can sort the cleanup out at COIN. TonyBallioni (talk) 21:02, 12 January 2018 (UTC)
 * Just chiming in as I was pinged, I blocked that account as a suspected sock based on the script they were working off of. Could be a different person, but definitely working in collusion with that farm. We have a lot of collusion between the many paid farms, so the block is fine I think. &mdash; Spaceman  Spiff  04:02, 13 January 2018 (UTC)
 * Doesn't seem like there's anything left to do here. Closing. --Deskana (talk) 12:34, 20 February 2018 (UTC)
 * Group 4 – the following accounts are ✅ to each other:
 * Group 5 – the following accounts are technical matches of Group 4 but :
 * The majority of these accounts use a combination of legitimate ISPs and proxies. The Group 1 socks principally edit in one country. Within that country, they mostly edit in two different regions. The Group 2 accounts edit in one of those regions but not the other. The Group 4 socks principally edit in a completely different country, although I find the behavior between Groups 2 and 4 very similar.
 * I'm blocking without tags the accounts in Groups 1-4. Although a few things are obvious, most of this is messy. Regardless of anything else, there are too many accounts in Group 1, including the ones previously blocked, for them not to have their own case.--Bbb23 (talk) 20:44, 12 January 2018 (UTC)
 * , I've blocked Firasmasri without tags based on promotional content found at Draft:Dipndip and your technical evidence. It's slightly different in terms of content style, but the spamminess combined with the technical evidence is enough for me to feel comfortable that there is some connection, even if it is different freelancers for the same firm. I'm not seeing any evidence for a block of MartinRay33. If a clerk needs to move this, I'd ask that they leave it open for a bit so we can sort the cleanup out at COIN. TonyBallioni (talk) 21:02, 12 January 2018 (UTC)
 * Just chiming in as I was pinged, I blocked that account as a suspected sock based on the script they were working off of. Could be a different person, but definitely working in collusion with that farm. We have a lot of collusion between the many paid farms, so the block is fine I think. &mdash; Spaceman  Spiff  04:02, 13 January 2018 (UTC)
 * Doesn't seem like there's anything left to do here. Closing. --Deskana (talk) 12:34, 20 February 2018 (UTC)
 * The majority of these accounts use a combination of legitimate ISPs and proxies. The Group 1 socks principally edit in one country. Within that country, they mostly edit in two different regions. The Group 2 accounts edit in one of those regions but not the other. The Group 4 socks principally edit in a completely different country, although I find the behavior between Groups 2 and 4 very similar.
 * I'm blocking without tags the accounts in Groups 1-4. Although a few things are obvious, most of this is messy. Regardless of anything else, there are too many accounts in Group 1, including the ones previously blocked, for them not to have their own case.--Bbb23 (talk) 20:44, 12 January 2018 (UTC)
 * , I've blocked Firasmasri without tags based on promotional content found at Draft:Dipndip and your technical evidence. It's slightly different in terms of content style, but the spamminess combined with the technical evidence is enough for me to feel comfortable that there is some connection, even if it is different freelancers for the same firm. I'm not seeing any evidence for a block of MartinRay33. If a clerk needs to move this, I'd ask that they leave it open for a bit so we can sort the cleanup out at COIN. TonyBallioni (talk) 21:02, 12 January 2018 (UTC)
 * Just chiming in as I was pinged, I blocked that account as a suspected sock based on the script they were working off of. Could be a different person, but definitely working in collusion with that farm. We have a lot of collusion between the many paid farms, so the block is fine I think. &mdash; Spaceman  Spiff  04:02, 13 January 2018 (UTC)
 * Doesn't seem like there's anything left to do here. Closing. --Deskana (talk) 12:34, 20 February 2018 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Recreation of Anjali Ameer, which had previously been G5'd as belonging to this farm. TonyBallioni (talk) 14:39, 19 March 2018 (UTC)
 * Sir Sputnik, it was a massive CU finding with multiple groups. It is entirely plausible that this is a part of another group that is related to the article, but would have different technical details. I have never once heard a clerk decline a recreation of an article that has been recreated multiple times. This is the definition of the type of case where CU is useful. TonyBallioni (talk) 20:22, 20 March 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * This is the fourth time an article has been created; only the third is known to be a sockpuppet and the person now appears to be notable - is the content based on a version that was deleted? Also the SPI should be renamed as it's currently at the name of a user who has never been blocked and is not mentioned in the results - sometimes the purpose of UPE is to have an article recreated after one was deleted. Peter James (talk) 19:32, 17 April 2018 (UTC)
 * There are a few groups of accounts confirmed to each other, and some with connections to each other, but no connection is mentioned between group 3 and the others, or between any of the groups and Seokochin (who isn't blocked); does the possilikely refer to Seokochin, to one or more of these groups, or to all accounts? Peter James (talk) 15:11, 23 April 2018 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Arsh 18 wasn't stale when this case was last checked in January, and didn't turn up in that check. Is there anything to suggest their technical info has changed in the intervening months? Sir Sputnik (talk) 20:11, 20 March 2018 (UTC)
 * - Given the mixed use of proxies and legit ISP's, it's possible this account was missed two months ago. Sir Sputnik (talk) 02:24, 21 March 2018 (UTC)
 * It's, but . Callanecc (talk • contribs • logs) 05:07, 21 April 2018 (UTC)
 * Seokochin is likely a UPE account with behavioral overlaps with other accounts. It was the oldest account, which is why it was named, and it hasn't edited since October. I'm familiar with a few other UPE cases where we didn't block the first account because it was stale, but it was kept at that name for reference. There were multiple groups here and the name was probably left as a container case for related farms. would you mind having a look. You're more familiar with the various South Asian UPE groups, and some of the original suspected socks had overlap with one of your blocks I believe. TonyBallioni (talk) 15:26, 23 April 2018 (UTC)
 * On evaluating, especially language etc it appears that this is part of the same group, running off of a similar script and so on, that in combination with the possilikely technical finding convinces me that a block is necessary. Also, there's no reason to leave the master unblocked due to inertia, I'm going to do that now. On a different note, some of the articles have an overlap with another farm that I've blocked -- in topic, but not in terms of content style. &mdash; Spaceman  Spiff  02:11, 24 April 2018 (UTC).
 * Closing now as I've blocked. But another stale account to look at is which also appears to have some linkage but I don't believe is a part of this set, more likely another UPE group. &mdash; Spaceman  Spiff  02:16, 24 April 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Non-identical recreation of Netcall, originally created by blocked sock and subsequently edited by SmartJack7, and Biz2Credit.com, originally created by Riverayns and deleted at Articles for deletion/Biz2Credit.com. Medi-Tate is also plainly native advertising. MER-C 17:21, 21 June 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * I am not a Native advertiser or Advertiser of any kind. I have created several articles on Wikipedia and never been paid for any. Edidiong (talk) 05:39, 23 June 2018 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Watsonboy12 and Riverayns are ❌ to this case. SmartJack7 is /. SmartJack7 is using a very odd mix of IPs, making it impossible to know their true location, but the UAs match one of the groups in the archive. Watsonboy12 and match exactly on at least one IP. Watsonboy12 has very few edits, making intersection between them and Mredidiongekong less likely. That said, the only article intersection is at Medi-Tate. Although it might appear counterintuitive to link the two accounts, tagging articles as part of curation, which is what Mredidiongekong did, is a common practice of UPE socks. I will let and/or a clerk decide the appropriate sanction, if any, of the two accounts.--Bbb23 (talk) 19:46, 22 June 2018 (UTC)
 * I believe the creations of District m, Kidbox and Fyle Technologies are enough to implicate Mredidiongekong as an undisclosed native advertiser. There were also a handful of suspect patrols. I'll ping who suggested this SPI to comment here as well. MER-C 20:09, 22 June 2018 (UTC)
 * I'm on mobile until July but I think it is nigh on impossible that Mredidiongekong is a new editor. Haven't looked at smartjack but if there is any suspicion they are UPE and are using IP tricks then I think it's safe to say that they are also a sock of someone. If you don't mind waiting I can look properly once I'm back. SmartSE (talk) 13:47, 23 June 2018 (UTC)
 * Mredidiongekong is not a new editor. They created their account on October 7, 2016. They have over 1,700 edits, and they have autopatrolled and new page reviewer rights, which is not a good thing for them to have if they are UPE.--Bbb23 (talk) 14:03, 23 June 2018 (UTC)
 * My mistake for not being clearer but I meant in the sense that it's not their first account. SmartSE (talk) 10:49, 24 June 2018 (UTC)
 * I agree with this assessment, but substituting "first" with "only". I'm blocking. MER-C 14:21, 24 June 2018 (UTC)


 * , MER-C also asked me to look at this. Would you mind saying more about the exact match (obviously only what’s allowed.) Are we talking common UA and IP with a lot of users? I find the three articles MER-C linked pretty problematic as well. TonyBallioni (talk) 19:50, 23 June 2018 (UTC)
 * The IP they both used is in a very busy range. One of the interesting things about the IPs in this range is there are often multiple users using the same IP but they rarely use the same UAs and there is no behavioral match. That's part of what made this connection stand out. The particular IP in question was not busy, but the UA is common.--Bbb23 (talk) 21:44, 23 June 2018 (UTC)


 * I’ve also blocked Watsonboy12 per the CU findings. After MER-C’s block both of these accounts are Would a clerk figure out how to tag. Closing. TonyBallioni (talk) 14:30, 24 June 2018 (UTC)
 * I have blocked as a sockpuppet of Mredidiongekong based on checkuser results from DoRD. MER-C 18:17, 25 June 2018 (UTC)
 * Considering Bbb23's comment above, I'll say that this account never edited from the same IP address as Mredidiongekong, but they did a couple of narrow, but extremely busy ranges. ​—DoRD (talk)​ 18:43, 25 June 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Identical userpages with past socks: Arsh 18, Made in IN, obvious overlap CHRISSY MAD  ❯❯❯  ¯\_(ツ)_/¯  16:42, 20 August 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
❌, closing.--Bbb23 (talk) 18:40, 26 August 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

The suspected sock was registered in 2018, but start editing last month and recreated Paddy Adenuga. GSS (talk |c|em ) 14:51, 24 July 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Sock indeffed. Case closed.  Vanjagenije  (talk)  18:37, 2 August 2019 (UTC)