Wikipedia:Sockpuppet investigations/Welbens488/Archive

Suspected sockpuppets

 * ( original case name)
 * ( original case name)



Block evasion by a blocked IP. Same pattern of disruptive edits: randomly inflating the number of sections in articles with non-sensical and/or unnecessary primary headings. Examples: edit to Sino-Vietnamese War by the original IP, subsequent edit by a new IP, and another one by a sock account. Centre Left Right ✉ 02:06, 4 May 2022 (UTC)


 * Another account which was made today: . Compare this edit by Emdur6539 and this one by Zaden4842. Similar usernames (random name + four numbers) and wording in their edits. Single-use accounts made to circumvent a block and make one edit to the same article(s) before being discarded. Centre Left Right  ✉ 17:23, 4 May 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - CheckUser evidence cannot be used to connect registered accounts to IP addresses. Sir Sputnik (talk) 03:00, 4 May 2022 (UTC)
 * I think there are a number of other accounts involved here, which I've added to the list above. Alany148 repeated the blocked IP's edit here, Alderaa4828 made a very similar edit to the IP here , and Uculele, Gerred, Zennel and Ollens seem to be continuing the blocked IP's work on List of heritage registers. All of these are new, single purpose accounts with the same username pattern. I think it's reasonable to suspect that there are more, so CU for a sleeper check (I'm aware there will be no comment on the IPs, of course). There are some other accounts that I am suspicious of but that I did not quite have enough evidence to report here. Thanks, Spicy (talk) 07:22, 13 May 2022 (UTC)
 * I've also moved the case to the oldest named account (for now). Spicy (talk) 07:24, 13 May 2022 (UTC)
 * -  Girth Summit  (blether)  11:38, 13 May 2022 (UTC)
 * These accounts are being formed in groups, each set in a very narrow range (IPv6 /64), all of them in a wider range (/32). Given other technical and username similarities, I'd be happy to call them all ✅ to one another:
 * Group 1
 * Group 2
 * Group 3
 * Group 4
 * Group 5
 * Group 6
 * Group 7
 * The /32 range that all of the above were operating out of is currently blocked; they seem to have moved to a different IP (which geolocates to the same area). The following account uses both the blocked /32, and the new range, and is otherwise identical to the group above:
 * I don't see any other obvious accounts there. Also using the /32, and a different IP is:
 * On that same IP, I see another set of accounts that are using a different UA, and have a slightly different username format (three digits at the end rather than four), but I'm pretty confident that they're the same person (or at the very least they are coordinating):
 * It's possible that there are other accounts that I've missed - the IPv6 /32 range is very busy. Please report any similar new behaviour (especially with usernames in this format) and we can take another look. Girth Summit  (blether)  12:23, 13 May 2022 (UTC)
 * I've moved the case to the oldest account, Welbens488, and tagging all as ✅. Closing.  Girth Summit  (blether)  12:32, 13 May 2022 (UTC)
 * Group 4
 * Group 5
 * Group 6
 * Group 7
 * The /32 range that all of the above were operating out of is currently blocked; they seem to have moved to a different IP (which geolocates to the same area). The following account uses both the blocked /32, and the new range, and is otherwise identical to the group above:
 * I don't see any other obvious accounts there. Also using the /32, and a different IP is:
 * On that same IP, I see another set of accounts that are using a different UA, and have a slightly different username format (three digits at the end rather than four), but I'm pretty confident that they're the same person (or at the very least they are coordinating):
 * It's possible that there are other accounts that I've missed - the IPv6 /32 range is very busy. Please report any similar new behaviour (especially with usernames in this format) and we can take another look. Girth Summit  (blether)  12:23, 13 May 2022 (UTC)
 * I've moved the case to the oldest account, Welbens488, and tagging all as ✅. Closing.  Girth Summit  (blether)  12:32, 13 May 2022 (UTC)
 * Group 5
 * Group 6
 * Group 7
 * The /32 range that all of the above were operating out of is currently blocked; they seem to have moved to a different IP (which geolocates to the same area). The following account uses both the blocked /32, and the new range, and is otherwise identical to the group above:
 * I don't see any other obvious accounts there. Also using the /32, and a different IP is:
 * On that same IP, I see another set of accounts that are using a different UA, and have a slightly different username format (three digits at the end rather than four), but I'm pretty confident that they're the same person (or at the very least they are coordinating):
 * It's possible that there are other accounts that I've missed - the IPv6 /32 range is very busy. Please report any similar new behaviour (especially with usernames in this format) and we can take another look. Girth Summit  (blether)  12:23, 13 May 2022 (UTC)
 * I've moved the case to the oldest account, Welbens488, and tagging all as ✅. Closing.  Girth Summit  (blether)  12:32, 13 May 2022 (UTC)
 * Group 5
 * Group 6
 * Group 7
 * The /32 range that all of the above were operating out of is currently blocked; they seem to have moved to a different IP (which geolocates to the same area). The following account uses both the blocked /32, and the new range, and is otherwise identical to the group above:
 * I don't see any other obvious accounts there. Also using the /32, and a different IP is:
 * On that same IP, I see another set of accounts that are using a different UA, and have a slightly different username format (three digits at the end rather than four), but I'm pretty confident that they're the same person (or at the very least they are coordinating):
 * It's possible that there are other accounts that I've missed - the IPv6 /32 range is very busy. Please report any similar new behaviour (especially with usernames in this format) and we can take another look. Girth Summit  (blether)  12:23, 13 May 2022 (UTC)
 * I've moved the case to the oldest account, Welbens488, and tagging all as ✅. Closing.  Girth Summit  (blether)  12:32, 13 May 2022 (UTC)
 * Group 6
 * Group 7
 * The /32 range that all of the above were operating out of is currently blocked; they seem to have moved to a different IP (which geolocates to the same area). The following account uses both the blocked /32, and the new range, and is otherwise identical to the group above:
 * I don't see any other obvious accounts there. Also using the /32, and a different IP is:
 * On that same IP, I see another set of accounts that are using a different UA, and have a slightly different username format (three digits at the end rather than four), but I'm pretty confident that they're the same person (or at the very least they are coordinating):
 * It's possible that there are other accounts that I've missed - the IPv6 /32 range is very busy. Please report any similar new behaviour (especially with usernames in this format) and we can take another look. Girth Summit  (blether)  12:23, 13 May 2022 (UTC)
 * I've moved the case to the oldest account, Welbens488, and tagging all as ✅. Closing.  Girth Summit  (blether)  12:32, 13 May 2022 (UTC)
 * The /32 range that all of the above were operating out of is currently blocked; they seem to have moved to a different IP (which geolocates to the same area). The following account uses both the blocked /32, and the new range, and is otherwise identical to the group above:
 * I don't see any other obvious accounts there. Also using the /32, and a different IP is:
 * On that same IP, I see another set of accounts that are using a different UA, and have a slightly different username format (three digits at the end rather than four), but I'm pretty confident that they're the same person (or at the very least they are coordinating):
 * It's possible that there are other accounts that I've missed - the IPv6 /32 range is very busy. Please report any similar new behaviour (especially with usernames in this format) and we can take another look. Girth Summit  (blether)  12:23, 13 May 2022 (UTC)
 * I've moved the case to the oldest account, Welbens488, and tagging all as ✅. Closing.  Girth Summit  (blether)  12:32, 13 May 2022 (UTC)
 * I don't see any other obvious accounts there. Also using the /32, and a different IP is:
 * On that same IP, I see another set of accounts that are using a different UA, and have a slightly different username format (three digits at the end rather than four), but I'm pretty confident that they're the same person (or at the very least they are coordinating):
 * It's possible that there are other accounts that I've missed - the IPv6 /32 range is very busy. Please report any similar new behaviour (especially with usernames in this format) and we can take another look. Girth Summit  (blether)  12:23, 13 May 2022 (UTC)
 * I've moved the case to the oldest account, Welbens488, and tagging all as ✅. Closing.  Girth Summit  (blether)  12:32, 13 May 2022 (UTC)
 * It's possible that there are other accounts that I've missed - the IPv6 /32 range is very busy. Please report any similar new behaviour (especially with usernames in this format) and we can take another look. Girth Summit  (blether)  12:23, 13 May 2022 (UTC)
 * I've moved the case to the oldest account, Welbens488, and tagging all as ✅. Closing.  Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  12:32, 13 May 2022 (UTC)
 * It's possible that there are other accounts that I've missed - the IPv6 /32 range is very busy. Please report any similar new behaviour (especially with usernames in this format) and we can take another look. Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  12:23, 13 May 2022 (UTC)
 * I've moved the case to the oldest account, Welbens488, and tagging all as ✅. Closing.  Girth Summit <sub style="font-family:Segoe print;color:blue;"> (blether)  12:32, 13 May 2022 (UTC)

Suspected sockpuppets
New account with similar username pattern (cf., ) picking up where socks left off at List of heritage registers. Spicy (talk) 17:59, 3 June 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - for a sleeper check since the last one found dozens of socks. Thanks, Spicy (talk) 18:00, 3 June 2022 (UTC)
 * - -- RoySmith (talk) 23:00, 3 June 2022 (UTC)
 * Ewens5838 is ✅. All of these are ✅ from Ewens5838, but it's a common enough user agent that I'd like somebody to go over them and verify that the behavior matches.  Feel free to tag as ✅ any which are behavioral matches.   -- RoySmith (talk) 23:35, 3 June 2022 (UTC)
 * My guess from their edit history is that is not a sock, but if they are, they would be the oldest account. -- RoySmith (talk) 23:36, 3 June 2022 (UTC)
 * - I've looked at all of these. Please indef
 * based on CU and behavioural evidence. I don't believe the other accounts are related. Thanks, Spicy (talk) 00:09, 4 June 2022 (UTC)
 * Only tagged Sekann as suspected due to lack of edits, but username pattern's clear enough to justify blocking. --  Tamzin  [ cetacean needed ] (she/they) 02:05, 4 June 2022 (UTC)
 * based on CU and behavioural evidence. I don't believe the other accounts are related. Thanks, Spicy (talk) 00:09, 4 June 2022 (UTC)
 * Only tagged Sekann as suspected due to lack of edits, but username pattern's clear enough to justify blocking. --  Tamzin  [ cetacean needed ] (she/they) 02:05, 4 June 2022 (UTC)
 * based on CU and behavioural evidence. I don't believe the other accounts are related. Thanks, Spicy (talk) 00:09, 4 June 2022 (UTC)
 * Only tagged Sekann as suspected due to lack of edits, but username pattern's clear enough to justify blocking. --  Tamzin  [ cetacean needed ] (she/they) 02:05, 4 June 2022 (UTC)
 * based on CU and behavioural evidence. I don't believe the other accounts are related. Thanks, Spicy (talk) 00:09, 4 June 2022 (UTC)
 * Only tagged Sekann as suspected due to lack of edits, but username pattern's clear enough to justify blocking. --  Tamzin  [ cetacean needed ] (she/they) 02:05, 4 June 2022 (UTC)

Suspected sockpuppets
Three accounts with similar usernames, making similar edits to United States in short succession. -- Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 01:45, 8 September 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * This is Awolf58's usual stomping grounds, but doesn't seem like his M.O. One of the edits had a typo that was corrected by, which is blocked on enwikivoyage as a loutsock of ; behaviorally it seems plausible that it could be him, but he has no previous activity on enwiki that I can see, so it might be that the typo correction was coincidental. . --  Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 01:45, 8 September 2022 (UTC)
 * ...  ~Oshwah~  (talk) (contribs)   01:51, 8 September 2022 (UTC)
 * ✅ to one another:
 * Also found and ✅ to the above:
 * Same exact IP address and user agents; a classic open-and-shut case with these accounts. However, I didn't find any any other accounts that these looked to be explicitly linked to that were blocked as as sock puppets; the trail effectively ends here. I'm going to reset the status to completed, since  to connect these users to a possible larger master (if there is one).  ~Oshwah~  (talk)  (contribs)   02:10, 8 September 2022 (UTC)
 * Also found and ✅ to the above:
 * Same exact IP address and user agents; a classic open-and-shut case with these accounts. However, I didn't find any any other accounts that these looked to be explicitly linked to that were blocked as as sock puppets; the trail effectively ends here. I'm going to reset the status to completed, since  to connect these users to a possible larger master (if there is one).  ~Oshwah~  (talk)  (contribs)   02:10, 8 September 2022 (UTC)
 * Same exact IP address and user agents; a classic open-and-shut case with these accounts. However, I didn't find any any other accounts that these looked to be explicitly linked to that were blocked as as sock puppets; the trail effectively ends here. I'm going to reset the status to completed, since  to connect these users to a possible larger master (if there is one).  ~Oshwah~  (talk)  (contribs)   02:10, 8 September 2022 (UTC)
 * Same exact IP address and user agents; a classic open-and-shut case with these accounts. However, I didn't find any any other accounts that these looked to be explicitly linked to that were blocked as as sock puppets; the trail effectively ends here. I'm going to reset the status to completed, since  to connect these users to a possible larger master (if there is one).  ~Oshwah~  (talk)  (contribs)   02:10, 8 September 2022 (UTC)
 * Same exact IP address and user agents; a classic open-and-shut case with these accounts. However, I didn't find any any other accounts that these looked to be explicitly linked to that were blocked as as sock puppets; the trail effectively ends here. I'm going to reset the status to completed, since  to connect these users to a possible larger master (if there is one).  ~Oshwah~  (talk)  (contribs)   02:10, 8 September 2022 (UTC)


 * Moved SPI report to the correct master as identified from the CU check performed above.  ~Oshwah~  (talk) (contribs)   02:14, 8 September 2022 (UTC)
 * Spicy points out that this is probably Welbens488. Based on username pattern and edits like those of Special:Contributions/Sallens4839, that seems very likely, so I've merged there. all as confirmed to Urten, suspected to Welbens. Closing.  --  Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 02:33, 8 September 2022 (UTC)

Suspected sockpuppets
Typical account naming scheme, typical additions of 'history' section headings where they have no business being. These run in packs, please look for any others. FYI, this SPI page says further cases should be placed under Urten5384. The Urten5384 SPI page says they should go here. Not sure which is correct. MrOllie (talk) 22:34, 9 September 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Fixed inconsistency. This is the correct place to file. --  Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 22:37, 9 September 2022 (UTC)
 * Sure looks like them (compare username to, compare edits ). to check for others as they consistently create numerous accounts. Thanks, Spicy (talk) 01:14, 10 September 2022 (UTC)
 * ✅ plus . . GeneralNotability (talk) 02:04, 10 September 2022 (UTC)
 * A wider search also turned up the following:
 * Not that blocking these reeeeeally matters much, since this person seems to use accounts as throwaways. Regardless, . GeneralNotability (talk) 02:11, 10 September 2022 (UTC)
 * Acknowledging your comment above, for consistency I think missed the blocklist. --Jack Frost (talk) 00:27, 11 September 2022 (UTC)
 * Whoops. Thanks. Blocked. GeneralNotability (talk) 01:20, 11 September 2022 (UTC)
 * Not that blocking these reeeeeally matters much, since this person seems to use accounts as throwaways. Regardless, . GeneralNotability (talk) 02:11, 10 September 2022 (UTC)
 * Acknowledging your comment above, for consistency I think missed the blocklist. --Jack Frost (talk) 00:27, 11 September 2022 (UTC)
 * Whoops. Thanks. Blocked. GeneralNotability (talk) 01:20, 11 September 2022 (UTC)
 * Not that blocking these reeeeeally matters much, since this person seems to use accounts as throwaways. Regardless, . GeneralNotability (talk) 02:11, 10 September 2022 (UTC)
 * Acknowledging your comment above, for consistency I think missed the blocklist. --Jack Frost (talk) 00:27, 11 September 2022 (UTC)
 * Whoops. Thanks. Blocked. GeneralNotability (talk) 01:20, 11 September 2022 (UTC)
 * Whoops. Thanks. Blocked. GeneralNotability (talk) 01:20, 11 September 2022 (UTC)