Wikipedia:Sockpuppet investigations/TheEdgarBox/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Alleged sock was created after the alleged master's block and very quickly began editing their Draft:Marin Hopper. Similar edit summaries, similar use of literary references (c.f. TheEdgarBox's userpage/username and Thesamuelclemens' username). GABgab 23:11, 5 September 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Endorsing my own request. Thanks, GABgab 23:11, 5 September 2021 (UTC)
 * ✅, along with, though I guess it's possible this is meat puppetry or something else similar. NinjaRobotPirate (talk) 18:13, 6 September 2021 (UTC)
 * Tagged the master. --Blablubbs (talk) 12:45, 9 September 2021 (UTC)

Suspected sockpuppets

 * ( originally filed under this user)

Suspicious pattern of editing. Jordan Hattar is created by Hunterstrawberry, then edited by VoicesofSyria (which appears to be connected) the same day. Then new user EricArtBlair shows up at the AfD. Both EricArtBlair and Hunterstrawberry have edits to H.D. Wright.

From this behavior, I think more socks are likely, so requesting CU. agt x 21:08, 4 May 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * The behavioral evidence for the connection seems clear to me. Without getting too much into offwiki information, March 28 would also line up with the first day of classes at an academic institution connected to the likely sockmaster. agt x  17:24, 6 May 2022 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * I added, who overlaps with these accounts on a number of articles and whose edits were restored by Hunterstrawberry: . - please CU to confirm and check for others. BTW, I suspect the master is actually WP:Sockpuppet investigations/TheEdgarBox, but I'll hold off on merging until CU is completed. Thanks, Spicy (talk) 08:05, 5 May 2022 (UTC)
 * - These are all ✅ to each other; on first pass, it looks like there are probably some other accounts too, but I don't have time right now to do a thorough sweep. I will come back to this unless someone else gets there first; blocking these four for the time being, we can figure out the tags later.  Girth Summit  (blether)  10:08, 5 May 2022 (UTC)
 * Coming back to this now. They are mostly (but not exclusively) editing out of IPs that appear to belong to an educational establishment, and there are lots of accounts that might be them. Based on timings of edits when they overlap on specific IPs however, and on overlap on multiple different ranges, plus the overlap in editing interest, I am calling all of the following ✅ to one another with an very high degree of confidence:
 * (sleeper)
 * I'll note that there have also been multiple attempts to log into other Wikipedians' accounts from these IPs - I interpret these as being malicious attempts to hack into accounts from the person behind these socks. I can't shed much light on whether this is TheEdgarBox or not. The accounts in that case are stale; based on the CU logs, I observe that most of the contributions from the accounts above seem to be coming from IPs in a very different part of the same large country as TheEdgarBox, but a few of their IPs do match the geolocation for TheEdgarBox's IPs. I guess all I can say on that is, . , I'm going to block those accounts that haven't been handled yet, can I ask you to check the behaviour and merge/tag accordingly? Cheers Girth Summit  (blether)  16:53, 6 May 2022 (UTC)
 * Afterthought: looking again at the timings, the IP usage would be consistent with them being in TheEdgarBox's geolocation up to 28 March, and then relocating - all their IPs prior to that date consistently geolocate to where the CU logs suggest TheEdgarBox was, and all their edits after that date are from the new location. I have no new evidence that would tip be beyond 'possible' however. Girth Summit  (blether)  17:09, 6 May 2022 (UTC)
 * Thanks for the thorough check, Girth Summit. I'm convinced all of these accounts are TheEdgarBox based on the overlap (especially on this draft) and some other behavioural cues. I'll move this case there. Spicy (talk) 19:37, 6 May 2022 (UTC)
 * Tagged, closing. Thanks, Spicy (talk) 19:41, 6 May 2022 (UTC)
 * I'll note that there have also been multiple attempts to log into other Wikipedians' accounts from these IPs - I interpret these as being malicious attempts to hack into accounts from the person behind these socks. I can't shed much light on whether this is TheEdgarBox or not. The accounts in that case are stale; based on the CU logs, I observe that most of the contributions from the accounts above seem to be coming from IPs in a very different part of the same large country as TheEdgarBox, but a few of their IPs do match the geolocation for TheEdgarBox's IPs. I guess all I can say on that is, . , I'm going to block those accounts that haven't been handled yet, can I ask you to check the behaviour and merge/tag accordingly? Cheers Girth Summit  (blether)  16:53, 6 May 2022 (UTC)
 * Afterthought: looking again at the timings, the IP usage would be consistent with them being in TheEdgarBox's geolocation up to 28 March, and then relocating - all their IPs prior to that date consistently geolocate to where the CU logs suggest TheEdgarBox was, and all their edits after that date are from the new location. I have no new evidence that would tip be beyond 'possible' however. Girth Summit  (blether)  17:09, 6 May 2022 (UTC)
 * Thanks for the thorough check, Girth Summit. I'm convinced all of these accounts are TheEdgarBox based on the overlap (especially on this draft) and some other behavioural cues. I'll move this case there. Spicy (talk) 19:37, 6 May 2022 (UTC)
 * Tagged, closing. Thanks, Spicy (talk) 19:41, 6 May 2022 (UTC)
 * Tagged, closing. Thanks, Spicy (talk) 19:41, 6 May 2022 (UTC)

Suspected sockpuppets
Another user whose only edits are to Draft:Marin Hopper and is suspiciously familiar with the subject matter. Firestar464 (talk) 05:04, 6 May 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Probably, but they haven't edited since November of last year so I don't see the point in blocking them now. You can re-report if they start editing again. Thanks, Spicy (talk) 19:44, 6 May 2022 (UTC)

Suspected sockpuppets
Edits involving Davidkhanian family and H.D. Wright. agt x 04:28, 22 May 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' It's more problematic than that. The editor is defending the master's source forging at AfD. This is abusive if socking and I'd like other editors at the AfD to be aware of what's going on. agt x 16:32, 22 May 2022 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * One edit two days ago. Closing. Bbb23 (talk) 12:36, 22 May 2022 (UTC)

Suspected sockpuppets
Gamed autoconfirmed, then recreated Marin Hopper in a format that is almost identical to deleted versions by and. Spicy (talk) 19:09, 23 November 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - please indef ActivistFan1 as a suspected sock. Without CU, it's not entirely clear if this is a sock or a different UPE taking the same job, but per policy, the distinction doesn't matter. Thanks, Spicy (talk) 19:10, 23 November 2022 (UTC)
 * For the record, they are fairly to past socks. . --Blablubbs (talk) 19:18, 23 November 2022 (UTC)

Suspected sockpuppets
Strong behavioral evidence in editing pattern. Nearly entire history is Davidkhanian related articles, such as:    agt x 22:04, 8 December 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ to . Blocked and tagged. This SPI can be closed.  ~Oshwah~  (talk) (contribs)   02:11, 9 December 2022 (UTC)

Suspected sockpuppets
Immediate editing on pages associated with TheEdgarBox agt x  20:52, 23 March 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ but shared IP. TonyBallioni (talk) 22:59, 23 March 2023 (UTC)
 * Blocked and tagged. Courcelles (talk) 13:25, 24 March 2023 (UTC)