Wikipedia:Sockpuppet investigations/Suhailsahilanzwalla/Archive

10 July 2014

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Accounts all adding personal biographical details including email and phone numbers etc to a slew of pages. Latest likely sock puppet created numerous pages under misleading names, including categories, to 'spam' their biography.
 * Example: 'Anzawalla' edit, 7 July 2014 to Anantnag
 * Example: 'Suhailsahilanzwalla' edit, 24 May 2014 to Suhail
 * 'Anzawalla' (as most recently did 'Anzwalla Anantnag') created numerous pages with misleading titles which only contained biographical information, "Oxford Presentation High School, Al Sarwat Higher Sec.School, Govt Higher Secondary School Anzwalla, and Govt Higher Secondary School", also ﺳﮩﯿﻞ ﺍﺣﻤﺪ ﺑﭧ and Anzwalla
 * 'Anzwalla Anantnag' created Category:Anzwalla Anantnag, Freedom Struggle, Rapstar Sofi Shahid and Category:Suhail sahil Anzwalla, among others.

Easily seen common info (most of edits seem to be 100% same) is email address and "I am Suhail ( ﺳﮩﯿﻞ ﺍﺣﻤﺪ ﺑﭧ‎ ) from Anzwalla Anantnag," which can be seen to be consistent with usernames used by each account. 220  of  Borg 10:38, 10 July 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * . I'm convinced that the master and the first puppet are the same person. I'm not convinced that Anzwalla Anantnag is. Although that account is clearly disruptive, it seems to be a different person (to the extent they're valid, they have a different Linkedin profile and picture from the other). Therefore, before taking any action, I'd like a CU.--Bbb23 (talk) 15:54, 12 July 2014 (UTC)
 * - The results are...challenging. This might take a while. Tiptoety  talk 19:23, 12 July 2014 (UTC)
 * Alright, for starters I am going to say: "holy cow, I have a headache." Secondly, I am going to call this . The first issue is that even the smallest possible range associated with these users results in ~200 accounts (on each range, there are two). Secondly, every single account shares an identical useragent, though most are clearly not related. Lastly, the ISP appears to be a company of some kind that is using a cloud service which geolocated to the middle of the ocean. I spent a fair amount of time running port checks to see if there are proxies at play, and there do not appear to be. All of that said, all three accounts share the same ISP and IP range. They could be socks, they could be co-workers who don't know each other (this appears to be a very large company), or they could be meatpuppets. Additionally, there are a number of blocked accounts amoungst the range, some are blocked for "block evasion," though no master account is identified and some are blocked for spamming. Either way, there are way too many accounts and far too little technical data for CheckUser to be useful here. If this starts to become a more persistent problem, I will consider filing an abuse report with the companies network administrator. Tiptoety  talk 20:11, 12 July 2014 (UTC)
 * Based on behavior, I've indeffed and tagged the master and the first puppet. I've left the other account alone because I don't think there is sufficient behavioral evidence to overcome the inconclusive CU results. Sorry for your headache,, and thanks.--Bbb23 (talk) 20:24, 12 July 2014 (UTC)