Wikipedia:Sockpuppet investigations/Stefka Bulgaria/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Alright, let's do this. Taking Arbitration Committee/Noticeboard/Archive 13#Iranian Politics disruption continues into consideration, these accounts have participated in a very long term coordinated POV pushing scheme on articles related to People's Mojahedin Organization of Iran (MEK). There have been various POV pushing socks and evidence of coordination on both sides of the debate, and today we're cleaning out the pro-MEK socks. These accounts are likely related to Sockpuppet investigations/SalmanZ and the Fad Ariff/Iraniangal777 accounts blocked last month and were likely engaging in coordinated editing with them as well. Whether this is actual socking or meatpuppety, no matter-- it's still inappropriate coordinated editing. I do not believe that the coordination here is just limited to the listed accounts, but these are the ones easiest to tie together. I will deal with other accounts participating in this coordinated editing separately. There are more that follow the general playbook I outline below, and hopefully this SPI will be used to deal with future meatpuppets/socks in the area. Additionally, functionaries have further details about coordinated editing in the area. Here's the evidence:


 * There's the obvious: all listed accounts edit(ed) primarily around Talk:People's Mojahedin Organization of Iran, and push a positive POV of MEK. They frequently revert and restore old revisions of the article (SB vs PJ on the talk, SB vs PJ on the main), and act in a coordinated fashion with each other (see the current history of the article and what PJ and Alex-h are doing.
 * Outside of MEK related articles, they focus on gnomery around academics and minor spelling changes. Voting in AfDs is a consistent side habit. These edits are often poorly worded or nonsensical, or are otherwise useless spelling changes, and are edited further to make sense.
 * These minor edits they make in mass helps them to appear more legitimate and lets them edit more protected articles.
 * They have trouble with copyright early on.
 * User pages are often very similar-- several userboxes, usually declaring a leftist slant (ParadaJulio vs. Stefka Bulgaria)
 * They rarely touch fawiki, despite the topic area.
 * They often launch large, overly complicated talk page discussions and RfCs and include several sources of questionable relevance in their edits and when pushing changes on the talk. These can be seen littered throughout the MEK archive, and the current version of the talk page. There's a reason for this-- creating unnecessary complexity around a debate makes it less likely the wider community will care to get involved with issues, and makes sanctions against the accounts less likely. This behavior is also covered at Arbitration/Requests/Case/Iranian_politics. Stefka was warned about this behavior by Icewhiz of all editors back in 2018, but other editors including Alex-h and ParadaJulio have resumed it.
 * There's some overlap with Sockpuppet_investigations/Atlantic12/Archive, a similar pro-MEK sockmaster in the area. TheDreamBoat (TDB), User:London Hall (LH, someone who is very likely the original master here), and Stefka Bulgria (SB) were all suspected of being socks there but were technically unrelated, or reports were derailed by other issues. The November 2018 report here was likely enough to block Stefka as a sock, but it was too verbose.
 * We know there is coordinated editing on the pro-MEK side due in part to TDB accidentally pasting in part of an email they received, directing them to paste a comment into a talk page discussion. "Hi Tia, Could you please click on this link, and add the following there (at the bottom)"... As a result of this comment, they were indefinitely topic banned from the area. TDB's editing is odd, as they were partially blocked over competency concerns related to mass-pasting votes into AfDs and didn't seem to be completely fluent in English but could be pretty verbose in talk page discussions involving MEK. The likely reason is that the comments they made on those talk pages were being pasted in from emails that someone else had written. This tracks with other edits TDB made to talk pages with broken formatting-- the edits were pasted from emails without accounting for Wikipedia's layout.
 * It also tracks with a major quirk all of the accounts share regarding their use of the  template. The pro-MEK accounts almost always add an extra "|" at the end of the template, so it looks like  . This is a highly uncommon thing and is only widespread practice mong these editors. This was first done on a MEK related page by LH in March 2018. It became a staple of pro-MEK accounts on the page over the years, with SB doing it first in November 2018 and then going on to do it over 200 times (more examples   )! TDB, who we know is involved in coordinated editing, does the same. ParadaJulio (PJ) does the same too, over 12 times. This indicates to me that whoever is behind the SB/LH account is the one writing the coordinating emails.
 * The way ParadaJulio and Stefka talks to others is quite similar. Note the use of the word "observed" by Stefka and then Parada.
 * Parada and Stefka (before really getting engulfed in disputes on the MEK talk page edit in very similar fashion outside of the MEK articles-- small gnome edits to biographies, short references, very fond of "further reading" sections and translations.
 * Edit by Parada with odd formatting, which can be attributed to them being pasted from an email:
 * Most importantly: the area has a history of pro-MEK accounts being "replaced" once they are sanctioned or blocked, repeating the same behavior previous accounts engaged in that has been described here. As part of the above 2021 IRANPOL case, Stefka Bulgaria, BarcrMac, and Idealgic, two other pro-MEK editors, were topic banned from the area, and discretionary sanctions were implemented. Later, the pro-MEK accounts Ypatch and TheDreamBoat were topic banned from the area in early 2022. These accounts are subsequently abandoned, or otherwise significantly decrease their activity. Keeping these dates it mind, it fits into a pattern with "replacement accounts" appearing in the area; Fad Ariff makes tons of minor copyedits, then begins editing in the area in October 2021, a few weeks after the IRANOL case closed, and Iraniangal777 began editing around the same time. ParadaJulio had registered in the late 2016-- early 2017 range other accounts also did... and began making major edits in April 2022, not too much after Ypatch and TDB were sanctioned.
 * Tellingly, Parada and Alex-h only became on the main MEK talk page after Fad Ariff/Iraniangal777 were blocked in June. After ParadaJulio and Alex-h are kicked off the article, there will likely be new accounts following the same playbook to fill the void. And they will be sanctioned too.
 * (misc note-- Stefka, Ypatch, and Alex-h all have similar bios on their userpages, with brief details about their beliefs and educational backgrounds.)
 * Comparing old logs from the TheDreamBoat to Stefka Bulgaria and ParadaJulio is insightful. TDB's ips geolocate to two different countries, ones you would not associate with an Iranian political party. Stefka and Parada each geo locate to the first and second country respectively, near to where TheDreamBoat locates. Also, Stefka's engaged in strange logged out editing. I would say CU makes this, but combined with the behavioral evidence I am 100% certain there is a connection.
 * With this, I come to the conclusion that this is a complex and multi-person operation being used to evade several sanctions and systematically subvert Wikipedia's guidelines to promote a particular POV. A block has been overdue.

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I confess I am not very surprised to see this. I got utterly sick of the IRANPOL arena and stepped away, but even the few watchlist notices I still get make it clear some socking was ongoing (and I would be surprised if this was the limit of it). I cannot see your technical evidence, of course, but I struggle to believe that Alex-h and Stefka Bulgaria are socks of one another. I don't oppose your block; you could justify it for disruption alone; but I believe that off-wiki coordination is a much likelier explanation for what you are seeing. Vanamonde (Talk) 23:11, 28 July 2023 (UTC)


 * @Vanamonde93 fwiw I agree, I didn’t tag Alex-h as a sock for similar reasons, although they’re certainly a meat puppet via coordination offsite. Although it begs the question of where to document such operations in the future. Since you’re a functionary, I could email you additional evidence regarding this, if you’re interested. Moneytrees🏝️(Talk) 23:36, 28 July 2023 (UTC)
 * That makes complete sense to me. I will take you up on that offer; it's not impossible that I will go back to adminning IRANPOL subjects, and additional context would be quite useful if I do so. Thank you for looking into this morass. Vanamonde (Talk) 23:53, 28 July 2023 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * . There is even more evidence I am not adding here but am willing to provide. Will leave this open for a bit for any interested comments, and then it can be closed. Alex-h has engaged in all of the above behaviors and also could have been blocked as a result of this SPI, but I'll leave him with a block for disruptive editing for now-- I may change my mind. Any admin is free to change his block to an indefinite one. Moneytrees🏝️(Talk) 00:46, 27 July 2023 (UTC)
 * I changed my mind looking over the evidence here again and the sum of Alex-H's editing career. Moneytrees🏝️(Talk) 01:10, 27 July 2023 (UTC)


 * Closing as accounts are now blocked. Thanks, Spicy (talk) 23:58, 29 July 2023 (UTC)