Wikipedia:Sockpuppet investigations/Threepoint34/Archive

Suspected sockpuppets

 * ( originally filed under this user)

Adding more from trolling Special:Users



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Incredibly similar usernames, addition of the same spam links as citations on multiple pages.

Diffs of linkspam:        Other such sockpuppets of this user might exist, I will be adding more if I come across them.  Pro lix 💬 13:26, 24 October 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - all of these.  I'll also poke COIBot.  Asking for CU to see if there's any other sleepers I've missed, and maybe even rangeblock where this crud is coming from.  Given what we have now, 3point1four is the correct master, but I'll hold off on renaming the case and/or tagging until CU results come in. -- RoySmith (talk) 14:07, 30 October 2020 (UTC)
 * These are the accounts I found with CU:
 * is on an IP from another country which doesn’t initially appear to be a proxy so, technically, I’d say have to say it’s ❌.
 * and are  to each other and the confirmed accounts above. Callanecc (talk • contribs • logs) 03:40, 31 October 2020 (UTC)
 * is on an IP from another country which doesn’t initially appear to be a proxy so, technically, I’d say have to say it’s ❌.
 * and are  to each other and the confirmed accounts above. Callanecc (talk • contribs • logs) 03:40, 31 October 2020 (UTC)
 * is on an IP from another country which doesn’t initially appear to be a proxy so, technically, I’d say have to say it’s ❌.
 * and are  to each other and the confirmed accounts above. Callanecc (talk • contribs • logs) 03:40, 31 October 2020 (UTC)
 * is on an IP from another country which doesn’t initially appear to be a proxy so, technically, I’d say have to say it’s ❌.
 * and are  to each other and the confirmed accounts above. Callanecc (talk • contribs • logs) 03:40, 31 October 2020 (UTC)
 * is on an IP from another country which doesn’t initially appear to be a proxy so, technically, I’d say have to say it’s ❌.
 * and are  to each other and the confirmed accounts above. Callanecc (talk • contribs • logs) 03:40, 31 October 2020 (UTC)
 * is on an IP from another country which doesn’t initially appear to be a proxy so, technically, I’d say have to say it’s ❌.
 * and are  to each other and the confirmed accounts above. Callanecc (talk • contribs • logs) 03:40, 31 October 2020 (UTC)
 * is on an IP from another country which doesn’t initially appear to be a proxy so, technically, I’d say have to say it’s ❌.
 * and are  to each other and the confirmed accounts above. Callanecc (talk • contribs • logs) 03:40, 31 October 2020 (UTC)
 * is on an IP from another country which doesn’t initially appear to be a proxy so, technically, I’d say have to say it’s ❌.
 * and are  to each other and the confirmed accounts above. Callanecc (talk • contribs • logs) 03:40, 31 October 2020 (UTC)
 * is on an IP from another country which doesn’t initially appear to be a proxy so, technically, I’d say have to say it’s ❌.
 * and are  to each other and the confirmed accounts above. Callanecc (talk • contribs • logs) 03:40, 31 October 2020 (UTC)


 * Tagged everybody, but given the CU result, I don't think 3point14human should be blocked. Would you object if I unblocked 3point14human? We can always reblock if it looks like it's a sockpuppet once it starts making contribs. Sro23 (talk) 06:32, 31 October 2020 (UTC)
 * , Go for it. -- RoySmith (talk) 14:10, 31 October 2020 (UTC)
 * Done. Closing. Sro23 (talk) 15:38, 31 October 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Sockpuppet of Threepoint34 Same linkspam behaviour:   

User also possesses a similar name to that of other sockpuppets of sock master. May require checkuser.  Pro lix 💬 16:01, 19 December 2020 (UTC)


 * Added two more (Muthootloan and Ppms12) who have similarly been link-spamming Muthoot Finance. -- RoySmith (talk) 16:15, 19 December 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Moving report misfiled under old master name. -- RoySmith (talk) 16:08, 19 December 2020 (UTC)
 * - It's obvious 3point14859 is the same as Threepoint34, and equally obvious that Muthootloan and Ppms12 are the same person ( vs ). What's not clear is if they're all part of the same group, which sounds like a job for CU. -- RoySmith (talk) 16:18, 19 December 2020 (UTC)
 * - Mz7 (talk) 05:24, 21 December 2020 (UTC)
 * 3point14859 is ✅ to the past Threepoint34 socks plus the following accounts:
 * Ppms12 is, bordering unlikely, to this group (same general geolocation, but that's it). Muthootloan is . Mz7 (talk) 05:34, 21 December 2020 (UTC)
 * , I believe most of these 3point accounts are coming from www.3point.in since had added a linksummary to that website on the original spi case.
 * They seem to be some sort of HR company. Their website provides a link to www.ppms.in which is the website of 3point's parent company. is probably related to the link spam events undertaken by the 3point accounts but again the evidence is somewhat circumstantial.  Pro lix  💬 09:11, 21 December 2020 (UTC)
 * Blocked/tagged all the 3points as socks. Username softblock for Muthootloan, and spam-blocked ppms.  Closing. -- RoySmith (talk) 18:29, 21 December 2020 (UTC)
 * Ideally, any accounts that are blocked as a result of private technical data should be blocked by the checkuser as they ultimately take responsibility for it. Mkdw  talk 23:44, 22 December 2020 (UTC)
 * In most cases, I do like to block obvious socks that I confirm with CU data myself in order to save SPI clerks time, and I suppose I should have done it for the 3point accounts in this case. However, in general I have a slightly different view. In my experience, checkusers at SPI routinely defer final blocking decisions to the judgment of patrolling admins and SPI clerks, especially in cases where perhaps a clerk or admin knows more about the behavioral tendencies of the master or where the CU evidence indicates a possible connection, but isn't conclusive (as it was here in the case of Ppms12). In other words, it's a bit of a team effort: I give my view of the technical findings, which an SPI clerk can factor into their broader analysis of the overall case to decide whether to block. Mz7 (talk) 00:13, 23 December 2020 (UTC)
 * Thanks . By no means I am intending to disrupt the workflow. I just wanted to doubly make sure that if a block is being issued solely on CU data, or with insufficient behavioral evidence, that those blocks were being done by the appropriate person in line with WP:BLOCKEVIDENCE. Sometimes the Arbitration Committee or the Ombudsman Commission have reviewed situations where things were a bit muddled. Mkdw  talk 04:20, 23 December 2020 (UTC)
 * All right, thanks for clarifying. In this specific case, I don't think there's a need for me to override RoySmith's blocks as checkuser blocks, although I would be happy to do so if you think it would be best. While the CU data is good extra evidence, I think there is enough behavioral evidence for administrators to review these blocks without CU access. Mz7 (talk) 09:02, 23 December 2020 (UTC)
 * , I certainly would have no objection to my blocks being redone by you. In this particular case, I was ready to block 3point14859 based on what I could see before the CU results.  As for the other 3pointers you found, I don't remember the details, but I'm pretty sure I didn't review their contributions at all; the usernames plus the CU confirmed seemed like more than enough.
 * However, reviewing them now, I did discover this edit which provides another link between ppms12 and the 3point group. And since I was already convinced that ppms12 and Muthootloan were the same actor, that ties them in too.  Had I seen that association earlier, I probably would have blocked them all as 3point socks.  Whether it's worth changing the blocks now, I'll leave up to you folks at a high pay grade. -- RoySmith (talk) 14:57, 23 December 2020 (UTC)
 * I think we're all good here. There seems to be enough here as a package between all the accounts and having this discussion about noting these circumstances will help should this ever need to be reviewed and none of us are around. Archiving. Mkdw  talk 19:12, 23 December 2020 (UTC)
 * , I certainly would have no objection to my blocks being redone by you. In this particular case, I was ready to block 3point14859 based on what I could see before the CU results.  As for the other 3pointers you found, I don't remember the details, but I'm pretty sure I didn't review their contributions at all; the usernames plus the CU confirmed seemed like more than enough.
 * However, reviewing them now, I did discover this edit which provides another link between ppms12 and the 3point group. And since I was already convinced that ppms12 and Muthootloan were the same actor, that ties them in too.  Had I seen that association earlier, I probably would have blocked them all as 3point socks.  Whether it's worth changing the blocks now, I'll leave up to you folks at a high pay grade. -- RoySmith (talk) 14:57, 23 December 2020 (UTC)
 * I think we're all good here. There seems to be enough here as a package between all the accounts and having this discussion about noting these circumstances will help should this ever need to be reviewed and none of us are around. Archiving. Mkdw  talk 19:12, 23 December 2020 (UTC)
 * I think we're all good here. There seems to be enough here as a package between all the accounts and having this discussion about noting these circumstances will help should this ever need to be reviewed and none of us are around. Archiving. Mkdw  talk 19:12, 23 December 2020 (UTC)