Wikipedia:Sockpuppet investigations/Xdeluna/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

The alleged sock was created less than an hour after Xdeluna received a 1-month CU-block from for sockpuppetry. According to the handy Editor Interaction Utility, the two accounts share a whopping 155 page intersections. This includes page creations and obscure categories and templates. A couple of examples should suffice:


 * Legend of the Naga Pearls was created by Xdeluna in April. Besides page creation, it has received precisely 14 edits. Subtracting Xdeluna's 6 further edits, we see that the alleged sock has made 62% (5/8) of the edits made to the page in the 2 months since Xdeluna stopped editing it. The page has fewer than 30 watchers and has an average of 38 views per day, having never received more than 101 on its busiest day.

GABgab 20:18, 23 June 2017 (UTC)
 * The Glory of Tang Dynasty was another Xdeluna creation from April. It also has fewer than 30 watchers, although its average daily viewing figure of 95 is higher (its busiest day had it receive 208 views). Besides a bot edit, the addition of a refimprove tag, and an IP's changing a couple of numbers, no one but Xdeluna edited this page until June 15, when Zeynxth edited it twice. For what it's worth, the IP (115.66.100.205) has 5 overlaps with Xdeluna, and is located in Singapore, Xdeluna's self-identified location.

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Please compare these accounts. I am requesting CU to confirm block evasion, since I understand there has been impersonation of Xdeluna in the past by in the past. If confirmed, this extensive and flagrant block evasion warrants a much longer block, especially considering the past sockpuppetry incident. Thanks,  GABgab 20:20, 23 June 2017 (UTC)
 * ✅ + . Blocked and tagged. Master's block is now indefinite. Closing.--Bbb23 (talk) 21:14, 23 June 2017 (UTC)

Suspected sockpuppets
Removed deletion tag here on an article created by User:Zeynxth. Other edits are also strikingly similar to Xdeluna/Zeynxth. Personally I see nothing wrong with her edits/contributions, so I don't understand why she doesn't just request for an unblock. Timmyshin (talk) 01:59, 1 July 2017 (UTC)

I just added more IPs and 1 user, which all began editing this past week on Chinese celebrity/TV series articles. I'm sure I'm still missing a lot. Timmyshin (talk) 03:42, 2 July 2017 (UTC)



Should be very obvious. Editor Interaction Analyser NJHSKA created hundreds of redirects and the various IPs have turned some of the redirects to articles, probably to avoid detection. Timmyshin (talk) 18:59, 12 July 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  18:15, 16 July 2017 (UTC)
 * - Please, compare two named accounts to the master.  Vanjagenije  (talk)  17:39, 14 July 2017 (UTC)
 * The following accounts are ✅, blocked, and tagged:
 * Qwang0628 is ❌.--Bbb23 (talk) 19:36, 14 July 2017 (UTC)
 * Closing.
 * Qwang0628 is ❌.--Bbb23 (talk) 19:36, 14 July 2017 (UTC)
 * Closing.
 * Closing.

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Pretty obvious  Timmyshin (talk) 04:56, 11 August 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * What happens is this:
 * NJHSKA will create a redirect
 * An IP shows up to expand the redirect into an article. There is clearly some IP-hopping involved, since I'm seeing Taiwan, Hong Kong, Ghana, Ivory Coast, etc. It also makes it difficult to discern what can/should be G5'd.
 * Songlia comes along and adds a photo.

Or, with another sock:


 * Sock creates and expands the article
 * IPs from everywhere keep working on it
 * Songlia pops up to make minor tweaks (categories, templates, etc.)

Either way,. Let's keep an eye on this unusual behavioral pattern. GABgab 15:43, 11 August 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Modus operandi resembles sockpuppet Xdeluna permanently blocked three months ago. It is probably its new avatar. Massive pseudo edits consisting of cutting and copy pasting of the same content around serve to conceal intended manipulations. Deals mostly with South Korean entertainment related entries. Evidence suggests a local PR or publicity company. Please note that together with its previous incarnation it has already created huge and mostly irreversible damage since there are few editors with appropriate language skills and market knowledge to remedy. It would be advisable to establish some permanent watch over this area since it will surely reappear once blocked. I hope this will suffice. Thank you. Benevolens Ariadne (talk) 13:15, 7 September 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Please compare to past socks and check for sleepers. Also, Xdeluna is using proxies in prodigious quantities, so please block those, too. Thanks, GABgab 15:21, 7 September 2017 (UTC)
 * - Katietalk 19:19, 7 September 2017 (UTC)
 * ✅ to each other and the master are:


 * There was a rangeblock which I extended and changed to a hardblock. All blocked and tagged; closing. Katietalk 19:41, 7 September 2017 (UTC)
 * Blocked and  as suspected proxies used by Xdeluna. GABgab 21:44, 7 September 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Editor interactions: Xdeluna x Seoulite, Xdeluna x wwandawoman. Seoulite created Category:South Korean espionage television series, and Xdeluna created Category:South Korean family television series, Category:South Korean workplace drama, Category:South Korean slice-of-life television series etc. — all deleted via CFD. Wwandawoman created Draft:Jay Walk Studio and made over 50 edits, and Xdeluna created Category:Jay Walk Studio and Category:Television series by Jay Walk Studio. Timmyshin (talk) 21:42, 5 November 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Please compare to previous socks and check for sleepers. Thanks, GABgab 04:08, 6 November 2017 (UTC)
 * - Katietalk 21:42, 8 November 2017 (UTC)
 * Eep – I stepped on Berean Hunter. Never mind. Katietalk 21:43, 8 November 2017 (UTC)
 * ✅ to each other and the master via :



— Berean Hunter   (talk)  21:50, 8 November 2017 (UTC)
 * ❌ technically
 * - Please block the four confirmed accounts. No action against the rest; the behavior doesn't quite match up and I'm not confident those users are Xdeluna. Sro23 (talk) 01:13, 9 November 2017 (UTC)
 * TonyBallioni (talk) 03:56, 9 November 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Overlapping Xdeluna-style edits, and engaging in a pet peeve war across a couple of IPs. Also, please refer to Administrators'_noticeboard/Incidents. Timmyshin (talk) 01:31, 4 December 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * , I can't easily take your word for this. For the edits on Zhang Xinyi, for instance, I need to have some kind of evidence that these are sock edits. Unfortunately I don't think there's much we can do with these IPs right now, like in terms of a rangeblock, but thanks for documenting this. Drmies (talk) 03:09, 4 December 2017 (UTC)
 * IP's are stale. Closing. Sro23 (talk) 03:42, 17 December 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:Drmies I understand that evidence is required to file SPIs but it's time-wasting to enumerate them if no actions can be taken. But the behavior is pretty obvious. I am just listing some IPs she used since the filing yesterday (I'm sure I'm still missing many) so that people can have an idea of her damages' extent. I don't think it's exaggerating to say that she made tens of thousands of edits under various accounts since being banned a few months ago, and WP's inability (or rather, unwillingness) to protect those celeb/entertainment pages just because they are on non-western subjects, is disappointing. Timmyshin (talk) 04:14, 5 December 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
, I doubt there is some bias here that causes admins to be "unwilling" to protect such articles. The thing is, you see, I suppose, how these are all the work by the same person, but I don't. If they are indeed all IP-socks, all that we are (or I am) asking of you is that you nail the IP to the editor with one or two diffs. Socks return to their old haunts like dogs to vomit: they make the same kinds of edits on the same kinds of topics with the same idiosyncrasies--but "non-Western celeb/entertainment pages" is just too vague. We have thousands of editors and IPs working on K-pop and J-pop, for instance; they're not all the same. If you want me and people like me to help, then help us. And I can't go and protect all such articles: if you want any protected, propose them; I do not see where you placed any requests to RFPP in your last 1000 edits. (Similar with this edit--I had to go look around to discover that you were talking about user:Mengnan Gao, who is not blocked or tagged, and I don't have any proof that they are a sock or a meat. You have to help us. Update: I saw it on User talk:Mengnan Gao.) Thank you, Drmies (talk) 15:17, 5 December 2017 (UTC)
 * , do you have a minute to check if maybe there's proxy use here too? I clicked on a couple and they don't seem to be, but I could easily be wrong. Thanks! Drmies (talk) 15:25, 5 December 2017 (UTC)
 * IP's are too old. Closing. Sro23 (talk) 03:43, 17 December 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Xdeluna's daily accounts. User:Drmies The behavior can be characterized thus: the IP edits for a brief period of time (a few hours) and then disappears (for good, that is). Most other IPs edit just 1-2 articles, but for her it's almost always rapid-fire editing of a dozen or more (there are exceptions in the ones I'm filing today, but there are exceptions). Don't you think it's unusual for an IP to edit so many articles at one time and disappear? (You may go through the IPs on this page, and you'll see.) She doesn't edit any J-pop articles, her "field" is active (typically younger, Under-40) actors based in Mainland China and South Korea, and to this end she also edits TV series (mainly) and films produced in these 2 countries. By the way, I've been on WP for years and I can finger-count the number of editors who have ever edited a large number of articles on Chinese celebrities. PS: How possible is it that someone from Ghana, Ivory Coast, Saudi Arabia, Yemen, etc. is so knowledgeable about Chinese actors? Timmyshin (talk) 07:19, 6 December 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I didn't say there were anything bad with these edits. Nor were Xdeluna's edits bad as a matter of fact. I won't pursue this any further. Regards. Timmyshin (talk) 00:43, 7 December 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Timmyshin, I'm sorry, but you are no more specific than you were before. And are these edits bad?, I mistyped your name above; can you see if there is proxy usage? and do you have magic skills that reveal more than I can see? Drmies (talk) 16:41, 6 December 2017 (UTC)
 * These IPs are obviously suspect, but I can't find anything to tie them together. I don't like using the word botnet unnecessarily but if it's the same user - and that remains an 'if' - then it's possibly an unknown or not easily accessible network, and/or rapidly reassigned addresses. And that has the consequence that, regardless of behaviour, blocks are not a real possibility. -- zzuuzz (talk) 19:56, 6 December 2017 (UTC)
 * Thank you --, that is why we can't easily start blocking. Drmies (talk) 20:54, 6 December 2017 (UTC)


 * Closing. Sro23 (talk) 03:43, 17 December 2017 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Panwink created two redirects to be filled by IPs, a classic Xdeluna/Boyhoodjams behavior. Both Zhu Yilong and Xing Zhaolin had been G5ed before (by User:Ged UK and User:RHaworth respectively). Innercircle17 and Yapqianyin created redirects for the same actors, and have both been blocked by User:BU Rob13. MinJiGuan created a redirect for the same actors as Innercircle17, and has been blocked by User:Bbb23. Timmyshin (talk) 14:01, 4 September 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The only unblocked account is, closing. GABgab 22:52, 7 September 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same kind of redirects (Lareina Song is the English name of Song Zuer = Song Zu'er). Also had several edits involving a redirect for Moonshine & Valentine, notice Moonshine and Valentine had been deleted twice by User:TonyBallioni for sockpuppetry. Timmyshin (talk) 20:01, 2 September 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  11:07, 3 September 2018 (UTC)
 * , this has some overlap with Sockpuppet investigations/Xdeluna, which you dealt with last year. The data there is stale, but not sure if there is anything in the logs that might be useful in connecting to other sleepers. TonyBallioni (talk) 02:53, 3 September 2018 (UTC)
 * 's description accurately describes what I'm seeing which leads me to think that Yysy may be Xdeluna. Yysy changes between disparate IPs on different continents rapidly. They do not show as proxies, webhosts/collocation hosts, etc. but quite obviously they are something like that regardless of what tools say. Blocking underlying IPs does not look practical and they are getting in a few anon edits before switching, too. Using semi-protection on some articles may be effective.
 * Given the overlap and the technical similarities, I’ve as a suspected sock of Xdeluna.  could a clerk move this report to the one I linked to above? Might need to archive the two above cases first. TonyBallioni (talk) 22:00, 3 September 2018 (UTC)
 * ✅, closing. GABgab 17:58, 14 October 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Classic Xdeluna/Boyhoodjams behavior: create nonsensical redirects (e.g. Spy Hunter (TV series) to In the Name of the People (2017) when the latter has nothing to do with the former) so that IPs (often from Cote d'Ivoire and Ghana) can work on them later. Timmyshin (talk) 20:44, 8 February 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * on behaviour. Closing. TonyBallioni (talk) 05:06, 19 February 2019 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Classic Xdeluna/boyhoodjams behavior, second edit was creating the redirect What's Wrong With Secretary Kim which was worked on and expanded to an article by an IP from Ghana 6 days later. Also notice the last 2 edits from Janauary: the redirects have nothing to do with the articles. Timmyshin (talk) 15:55, 19 February 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
The behavioural evidence is compelling. Given the recent uptick in activity from this master & the previous uncovering of sleepers, Cabayi (talk) 22:21, 27 February 2019 (UTC)
 * The technical results are not helpful. See 's comments in the 02 September 2018 report in the archive. Based on the check I just ran, his comments are spot-on. I've blocked Mirudor without tags based on behavior and a smidgen of technical evidence.  First, welcome! Second, if you wish to tag Mirudor (I don't care one way or the other), please use a suspected tag.--Bbb23 (talk) 23:43, 27 February 2019 (UTC)
 * , thanks for the welcome & the pointer to BH's comments. Tagged, creations tagged G5, closing. Cabayi (talk) 07:46, 28 February 2019 (UTC)