Wikipedia:Sockpuppet investigations/Zavia345/Archive

Suspected sockpuppets

 * Original case name
 * Original case name


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Tony1985sept was blocked by for "advertising and copyright violations – most likely WP:UPE". Among his creations was Draft:Olga Fleming, deleted on 8 October as G11 (my nomination). Suzannah Richmond created an account at 20:22 today, 17 November 2021 and five minutes later re-posted the first part of the deleted text (word-for-word or nearly so); she then added the rest of it (again, word-for-word or nearly so). Justlettersandnumbers (talk) 19:50, 17 November 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Thanks for the ping, . Considering the identical recreation, I'm fairly certain that this is either them, or a distinct spammer hired to post the same spam, which essentially boils down to the same thing. and ; the master posted some other spam as well, I think a CU run is warranted to check if we're dealing with a farm.  --Blablubbs (talk) 19:59, 17 November 2021 (UTC)
 * - -- RoySmith (talk) 02:01, 18 November 2021 (UTC)
 * I looked at Tony1985sept, Suzannah Richmond, and Rosemarry199 (from the next report).  Lots of different IPs in use, some of which appear to be proxies.  Everything geolocates to the same region of the same country.  There's a lot of user agent similarity, but it's a very common UA, so that probably doesn't mean much.  Overall, somewhere between  and  .  -- RoySmith (talk) 02:12, 18 November 2021 (UTC)
 * PS, I didn't look for sleepers because the nature of the data made it seem unlikely to be productive. -- RoySmith (talk) 02:16, 18 November 2021 (UTC)
 * Tagged, closing. Thanks, Spicy (talk) 02:20, 19 November 2021 (UTC)

Suspected sockpuppets

 * Original case name
 * Original case name


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Tony1985sept created Draft:Samanta Liza on 26 June 2021; it was deleted as G11 (my nomination) on 7 October. On 25 October Rosemarry199 created an identical (or very nearly identical) page. Other page creations are just as promotional as those of the master. Justlettersandnumbers (talk) 20:01, 17 November 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
 
 * See previous section. -- RoySmith (talk) 02:13, 18 November 2021 (UTC)
 * Comparing (what I can see of) the previous draft to the current one, it's either socking or UPE meat (probably socking, based on some other behavioural similarities). Blockable either way, so - please indef Rosemarry199. Thanks, Spicy (talk) 02:29, 19 November 2021 (UTC)
 * blocked. I'll leave the tagging to you. -- RoySmith (talk) 15:16, 19 November 2021 (UTC)
 * Thanks, tagged as suspected, closing. Spicy (talk) 22:02, 19 November 2021 (UTC)

Suspected sockpuppets

 * ( original case name)
 * ( original case name)
 * ( original case name)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

UPE sock group. A previous group of accounts have already been blocked and tagged by based on off-wiki evidence. The two new suspected socks turned up today to move Fretello to mainspace, an article started by sock. , performed the move (the other edits from the account also give off UPE vibes), and SPA turned up shortly afterwards. Requesting a CU check, as it is likely that there are more accounts in the UPE ring. Pahunkat (talk) 21:22, 2 December 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * , I just sent you an email. Hopefully it will come in useful. Pahunkat (talk) 23:37, 5 December 2021 (UTC)


 * The abuse case is older than this. The actual case page is here: Sockpuppet_investigations/Sankhan02/Archive. They have been globally locked by, so BlaBlubbs may give their 2 cents on this. Related helpful accounts: User:Kaleem6061 (blocked account of UPE under their name) and User:Nct0081, User:Nct1350 (blocked accounts of their company). Maybe, another checkuser would be helpful to pull out more accounts from their drawer. FYI . 47.17.217.189 (talk) 06:54, 9 December 2021 (UTC)
 * , thoughts on the above IP's comment? Pahunkat (talk) 13:26, 11 December 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - to confirm and and check for other accounts. (While ElleMcF only made one edit, the fact that they signed up and edited just a few minutes after Mathew's last edit makes me suspicious enough to endorse a check). FWIW, while Kallemullah Nowshera is stale, the suspected socks and  are not. Thanks, Spicy (talk) 22:40, 5 December 2021 (UTC)
 * - -- RoySmith (talk) 02:28, 6 December 2021 (UTC)
 * Physcho711, Allenweiber, and Mathew313 are all ✅ to each other, but there's no data I can use to connect that back to Kaleemullah Nowshera.
 * ElleMcF appears to be ❌.
 * These three are on technical evidence to the confirmed group above.  If a behavioral investigation agrees, then I'd have no problem with them being tagged as confirmed to that group.
 * -- RoySmith (talk) 02:50, 6 December 2021 (UTC)
 * I'm still running a few more things down -- RoySmith (talk) 03:02, 6 December 2021 (UTC)
 * It looks like Rosemarry199 is a connection to Sockpuppet investigations/Tony1985sept. From that case, I'd say that Tony1985sept is  and Suzannah Richmond is  to the (Physcho711, Allenweiber, Mathew313) group.  . -- RoySmith (talk) 03:13, 6 December 2021 (UTC)
 * OK, I'm confident that Zavia345 and Lula Hooper are related to this group. Zavia345 is a paid editor with a similar MO to the previous accounts in this case, and Lula Hooper overlaps with Physcho711 on . I also believe, based on CU results, behaviour, and a bit of off-wiki evidence, that Tony1985sept is part of this group. I've moved the case to Zavia345, which is the oldest account out of both this case and Sockpuppet investigations/Tony1985sept. - please indef Zavia345, Mathew313 and Lula Hooper; I do not believe there is sufficient evidence to block ElleMcF at this time. I'll deal with the case merge, retagging, etc. after the blocks are done. Thanks, Spicy (talk) 05:32, 6 December 2021 (UTC)
 * . Back to you, . --Blablubbs (talk) 16:56, 6 December 2021 (UTC)
 * Thanks. Can an admin clerk please histmerge Sockpuppet_investigations/Tony1985sept here? Spicy (talk) 18:58, 6 December 2021 (UTC)
 * Done,, closing. --Blablubbs (talk) 13:03, 11 December 2021 (UTC)
 * I don't see any actionable evidence in that comment, and considering that the poster appears to be hopping around SPI on IPs belonging to a botnet, I'm not really inclined to dig for it myself. --Blablubbs (talk) 13:35, 11 December 2021 (UTC)
 * Done,, closing. --Blablubbs (talk) 13:03, 11 December 2021 (UTC)
 * I don't see any actionable evidence in that comment, and considering that the poster appears to be hopping around SPI on IPs belonging to a botnet, I'm not really inclined to dig for it myself. --Blablubbs (talk) 13:35, 11 December 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Checked per history at Anthony Soohoo (Entrepreneur). ✅ by CheckUser. – bradv 🍁  17:58, 17 December 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * . – bradv 🍁  18:00, 17 December 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same behavior, first starting the sandbox ( & ) and then blanking it when the content has been moved to draftspace ( & ) Always uses visual editing. Nelson Turner were hired on this project to paste pre-packaged material on Fulvio Bonavia. Sleeper check requested along with merge of case as per evidence.

For User:Kalim0135, (same creating and blanking of sandbox, ) see overlap/keep votes of their socks on Articles for deletion/Saeid Jamali. ScriptedDecrypted (talk) 23:20, 22 December 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ✅:


 * is but.


 * In addition, the confirmed user tried repeatedly to log in as but was not successful., this account is too old to confirm.
 * The confirmed accounts have been and their contribs have been purged. Clerks: please G5 any contribs from socks in this case, it's likely they are drafting and blanking articles in their sandboxes to be copied-and-pasted by future socks. Ivanvector (Talk/Edits) 18:06, 2 January 2022 (UTC)
 * I've been G5ing page creations and evaluated the behavioural evidence. For Techconsultant1985 it is missing some of the patterns for the other socks and doesn't have much history, so no action was taken. Javeria Tariq I would consider possible there as well, but it has some behaviour not seen in any of the previous socks so no action there either. Closing. --Trialpears (talk) 00:44, 4 January 2022 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same tactics/editing pattern i.e. using sandbox for drafting an article and then posting it in drafspace while simultaneously blanking the sandbox at the end of work completion. 80.1.188.53 (talk) 14:17, 2 February 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ plus:
 * . Ivanvector (Talk/Edits) 15:25, 2 February 2022 (UTC)
 * . Ivanvector (Talk/Edits) 15:25, 2 February 2022 (UTC)
 * . Ivanvector (Talk/Edits) 15:25, 2 February 2022 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Recreated Draft:Haian Dukhan as an exact copy of the draft created by. See below. Ivanvector (Talk/Edits) 13:15, 8 February 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I blocked earlier today when I saw the draft recreated, however they are technically ❌. This account is located on another continent from the other socks and is using a different device. However, the two drafts are bit-for-bit identical. This is probably two people competing for something like an Upwork job where copy has been supplied, but for our intents and purposes this is a sock, . Ivanvector (Talk/Edits) 13:15, 8 February 2022 (UTC)

Suspected sockpuppets
Anecdotes show that Sarah_Freedmen is part of this mass spam mill. Like this one, blanking the sandbox before putting it live. I am sure they are operating many more. 2001:8F8:1343:C225:FDD8:D3B7:F43E:4543 (talk) 16:25, 30 April 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
See Sockpuppet investigations/Sarah Freedmen.--Bbb23 (talk) 01:48, 1 May 2022 (UTC)
 * - -- RoySmith (talk) 02:10, 1 May 2022 (UTC)
 * There's probably a lot more socks here if I really wanted to go down the rabbit hole, but for now I'll just say that is ✅ to Sarah Freedmen.  I don't have much data to tie those two back to Zavia, but from what I've got, I'd say .  I'll just tag them both as suspected. -- RoySmith (talk) 02:36, 1 May 2022 (UTC)

Suspected sockpuppets
Suspicious account editing only in draftspace and making dummy edits there (wikilinking country names, changing between variations of English). On frwiki they created article Dalia AlFaghal which appears to be an exact translation of an article published some months ago on enwiki by blocked sock Allenweiber, see Special:AbuseLog/31037029. – NJD-DE (talk) 19:45, 1 August 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Yeah, looks like a duck to me. . Closing. The SandDoctor  Talk 18:42, 7 August 2022 (UTC)
 * The SandDoctor Talk 18:42, 7 August 2022 (UTC)

Suspected sockpuppets
For the record — ✅ to, check of — TheresNoTime (talk • she/her) 21:25, 15 August 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * are ✅ to . — TheresNoTime (talk • she/her) 21:26, 15 August 2022 (UTC)
 * Just noting that is  to  (pinging, possibly the same UPE group?) — TheresNoTime (talk • she/her) 21:30, 15 August 2022 (UTC)
 * , saw that. I'd say decent chance they're related, but hard to say for sure and not worth my valuable (and your less-valuable, you evil WMFer) time to run down for sure. GeneralNotability (talk) 23:42, 15 August 2022 (UTC)

Suspected sockpuppets
Classic pattern of this sock farm: use of numeral usernames, visual editor, 9-10 edits on random drafts (much like, ), and then publish their spam in mainspace, all confirmed in. Lizkwatson already, checkuser may reveal more clues. Previously, checkuser was helpful, and would likely be helpful this time too. 142.117.154.66 (talk) 09:00, 18 December 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * History is stale for comparison, but the zero edit is  technically to Saimsheikh. That and the username pattern gets me to the confidence required to block, for all the good it’ll likely do.   firefly  ( t · c ) 10:39, 18 December 2022 (UTC)

Suspected sockpuppets
Part of the Zavia345 that is trying to promote their client, Paul P. Momtaz, on multiple Wikipedias, as it is clearly obvious by this creation de:Paul P. Momtaz by Zavia345 himself (banned now). Then, they used to create articles on French, Portugese, and Hungarian Wikipedias about their client: fr:Paul P. Momtaz, pt:Paul P. Momtaz, hu:Paul P. Momtaz. And later, they published on English Wikipedia, Paul P. Momtaz, using. Now, they have discovered an obscure topic, Draft:Binghatti, to submit. Please check for sleepers. 2A02:C7C:7201:2700:2DE9:34F:E47E:513 (talk) 16:14, 24 January 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * These users are already blocked, but I'll keep it open for a while just in case someone wants to compare this case to Sockpuppet investigations/Cyrus watson. CC, , . MarioGom (talk) 19:17, 2 February 2023 (UTC)
 * , both are ✅ to known Cyrus watson accounts. I'll leave it to your discretion as to whether the two cases should be merged. GeneralNotability (talk) 02:06, 4 February 2023 (UTC)
 * Not at this time. If anyone takes the time to compare the full cases, feel free to report again or post a note to WT:SPI/C. Closing. MarioGom (talk) 11:51, 18 February 2023 (UTC)