Wikipedia:Sockpuppet investigations/ShreyashBhakare/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Two accounts created at the exact same time. Each userpage is a copypaste of the lead section of Open-source software. Drm310 🍁 (talk) 14:39, 30 August 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Looks like this may be a class, there are a slew of accounts created just to make one edit on Open-source software, and presuming that some of them are using their year of birth in their username their ages are about right for high school comp sci.
 * - please check the following accounts, but please don't block (unless you find a blocked master or something warranting a block outside of the policy):


 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)
 * Ivanvector (Talk/Edits) 16:02, 30 August 2019 (UTC)

Group 1 are ✅ on a webhost:

Group 2 are ✅ on a different webhost with an exception that Hrithik sawant is on the same machine profile but using a different browser:
 * see edit filter
 * see edit filter
 * see edit filter
 * see edit filter
 * see edit filter
 * see edit filter

Group 3 are on wireless broadband using the same single IPv6 IPv4 address:
 * from Group 2 is ✅ to . Using a different device on that same IP is

Group 4 are ✅ on a different wireless broadband:

(not part of Group 4)
 * Kumarkodi2001 is on multiple wireless broadband crossing with Group 3 range with matching UA to Group 1 and 2 but also using two additional, different phones


 * Hrithik sawant from Group 2 is ✅ to on a uncommon phone UA

Group 5 are ✅ with a different UA from the above groups:

Group 6 are ✅ (not same UA as Group 5 where Siva0624 used that OS in that grouping):
 * from Group 5
 * ...and he attempted to reset the password for user "Aths2041" from group 4
 * ...and he attempted to reset the password for user "Aths2041" from group 4

Group 7 are on the same IP using two close machine profiles (different browsers) with some accounts created on one while their edit is on the other:

— Berean Hunter   (talk)  18:42, 30 August 2019 (UTC)
 * I did not see any info (whois, geolocate or other editors that seemed to be editing from a school) that would lead me to believe that this is a class and no instructors or veteran editors present in their groupings. Accounts were created in different spurts at different times on different ranges with an array of ISPs and a couple of webhosts mixed in. Single session IPv6 addresses (not /64 addresses) for some of the groups/devices detract from it being a class. Mitailbu is using a different OS from any of the above. SourabhSatam and Shruti2001 are in the same city but using different phones than used in the groups above. The above groups are crossing into ranges used by Vishalinfidigit which seems to have a different modus operandi but similar naming conventions.


 * Ivanvector (Talk/Edits) 19:26, 5 September 2019 (UTC)
 * Well this is bonkers. Basically all of these accounts have made (at most) one edit, something about open source software in similar broken English and not always at open-source software as it turns out, as though maybe this is partially bot-driven. But I don't really know what to do about it - I can block all these accounts easily for clear extensive sockpuppetry and disruptive editing, but they're all obviously throwaways. can you block the webhosts and common IPs?  any chance an edit filter could catch these edits? Ivanvector (Talk/Edits) 19:34, 5 September 2019 (UTC)
 * Bonkers indeed! There are some similarities in the edits, but the subjects of the articles would likely mean we could only put a filter in log-only. They all look like relevant, good-faith edits at quick glance. The userpages are small potatoes, and nearly all of the other edits are to open-source software. You could semi it, but frankly as it stands now this all seems like a minor annoyance and may not be worth the time of maintaining a filter. I guess let's see what Berean can do first. &mdash; MusikAnimal  talk  20:08, 5 September 2019 (UTC)
 * Another ✅ account on webhost of Group 2 above:


 * Group 8 account creations (has Fusergod 2019 account creation, he is in Group 7 because that is when he edited and I missed this bunch before, accounts created every few minutes, several UAs but multiple accounts are created on a few of them, all phones)

— Berean Hunter   (talk)  01:42, 6 September 2019 (UTC)
 * Webhosts blocked along with some IPs/ranges. Not all ranges are blocked due to possible collateral versus the amount that the ranges are used.


 * I'm going with my original assumption that this is a class, or maybe several classes, where an instructor has directed their students to edit open source software but without any instruction as to what Wikipedia is actually for. These edits are (largely) good faith but well outside the norms we expect for editing. The article has has pending changes enabled and that seems to have helped somewhat, but if there is another wave of many accounts trying to edit the article, we should try long-term semiprotection. Closing. Ivanvector (Talk/Edits) 14:20, 29 September 2019 (UTC)