TheEdgarBox ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)

05 September 2021

Suspected sockpuppets

• Thesamuelclemens ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Alleged sock was created after the alleged master's block and very quickly began editing their Draft:Marin Hopper. Similar edit summaries ( [1] [2]), similar use of literary references (c.f. TheEdgarBox's userpage/username and Thesamuelclemens' username). GAB ^gab 23:11, 5 September 2021 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

•  Clerk endorsed - Endorsing my own request. Thanks, GAB ^gab 23:11, 5 September 2021 (UTC) reply
•  Confirmed, along with Vgoldstone, though I guess it's possible this is meat puppetry or something else similar. NinjaRobotPirate ( talk) 18:13, 6 September 2021 (UTC) reply
• Tagged the master. -- Blablubbs ( talk) 12:45, 9 September 2021 (UTC) reply

04 May 2022

Suspected sockpuppets

• Hunterstrawberry ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki) (  Clerk note: originally filed under this user)

• VoicesofSyria ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• EricArtBlair ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• USIranrelations ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Suspicious pattern of editing. Jordan Hattar is created by Hunterstrawberry, then edited by VoicesofSyria (which appears to be connected) the same day [3] [4]. Then new user EricArtBlair shows up at the AfD. Both EricArtBlair and Hunterstrawberry have edits to H.D. Wright.

From this behavior, I think more socks are likely, so requesting CU. agtx 21:08, 4 May 2022 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• The behavioral evidence for the connection seems clear to me. Without getting too much into offwiki information, March 28 would also line up with the first day of classes at an academic institution connected to the likely sockmaster. agtx 17:24, 6 May 2022 (UTC) reply

Clerk, CheckUser, and/or patrolling admin comments

• I added USIranrelations, who overlaps with these accounts on a number of articles and whose edits were restored by Hunterstrawberry: [5].  Clerk endorsed - please CU to confirm and check for others. BTW, I suspect the master is actually WP:Sockpuppet investigations/TheEdgarBox, but I'll hold off on merging until CU is completed. Thanks, Spicy ( talk) 08:05, 5 May 2022 (UTC) reply
•  In progress - These are all  Confirmed to each other; on first pass, it looks like there are probably some other accounts too, but I don't have time right now to do a thorough sweep. I will come back to this unless someone else gets there first; blocking these four for the time being, we can figure out the tags later. Girth Summit _(blether) 10:08, 5 May 2022 (UTC) reply
• Coming back to this now. They are mostly (but not exclusively) editing out of IPs that appear to belong to an educational establishment, and there are lots of accounts that might be them. Based on timings of edits when they overlap on specific IPs however, and on overlap on multiple different ranges, plus the overlap in editing interest, I am calling all of the following  Confirmed to one another with an very high degree of confidence:
  • Hunterstrawberry ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
  • USIranrelations ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
  • Thevillagesunphoto ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki) (sleeper)
  • EricArtBlair ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
  • VoicesofSyria ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
  • LoganRoy ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• I'll note that there have also been multiple attempts to log into other Wikipedians' accounts from these IPs - I interpret these as being malicious attempts to hack into accounts from the person behind these socks. I can't shed much light on whether this is TheEdgarBox or not. The accounts in that case are stale; based on the CU logs, I observe that most of the contributions from the accounts above seem to be coming from IPs in a very different part of the same large country as TheEdgarBox, but a few of their IPs do match the geolocation for TheEdgarBox's IPs. I guess all I can say on that is  Possible,  Behavioural evidence needs evaluation. Spicy, I'm going to block those accounts that haven't been handled yet, can I ask you to check the behaviour and merge/tag accordingly? Cheers Girth Summit _(blether) 16:53, 6 May 2022 (UTC) reply
• Afterthought: looking again at the timings, the IP usage would be consistent with them being in TheEdgarBox's geolocation up to 28 March, and then relocating - all their IPs prior to that date consistently geolocate to where the CU logs suggest TheEdgarBox was, and all their edits after that date are from the new location. I have no new evidence that would tip be beyond 'possible' however. Girth Summit _(blether) 17:09, 6 May 2022 (UTC) reply
• Thanks for the thorough check, Girth Summit. I'm convinced all of these accounts are TheEdgarBox based on the overlap (especially on this draft) and some other behavioural cues. I'll move this case there. Spicy ( talk) 19:37, 6 May 2022 (UTC) reply
• Tagged, closing. Thanks, Spicy ( talk) 19:41, 6 May 2022 (UTC) reply

06 May 2022

Suspected sockpuppets

• 1080pwrong ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Another user whose only edits are to Draft:Marin Hopper and is suspiciously familiar with the subject matter. Firestar464 ( talk) 05:04, 6 May 2022 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

• Probably, but they haven't edited since November of last year so I don't see the point in blocking them now. You can re-report if they start editing again. Thanks, Spicy ( talk) 19:44, 6 May 2022 (UTC) reply

22 May 2022

Suspected sockpuppets

• 169.232.70.99 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser ( log))
• Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Edits involving Davidkhanian family and H.D. Wright. agtx 04:28, 22 May 2022 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims. @ Bbb23: It's more problematic than that. The editor is defending the master's source forging at AfD. This is abusive if socking and I'd like other editors at the AfD to be aware of what's going on. agtx 16:32, 22 May 2022 (UTC) reply

Clerk, CheckUser, and/or patrolling admin comments

• One edit two days ago. Closing. Bbb23 ( talk) 12:36, 22 May 2022 (UTC) reply

23 November 2022

Suspected sockpuppets

• ActivistFan1 ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Gamed autoconfirmed, then recreated Marin Hopper in a format that is almost identical to deleted versions by Hunterstrawberry and TheEdgarBox. Spicy ( talk) 19:09, 23 November 2022 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

•  Awaiting administrative action - please indef ActivistFan1 as a suspected sock. Without CU, it's not entirely clear if this is a sock or a different UPE taking the same job, but per policy, the distinction doesn't matter. Thanks, Spicy ( talk) 19:10, 23 November 2022 (UTC) reply
•  Blocked and tagged. Closing. For the record, they are fairly  Likely to past socks.  No sleepers immediately visible. -- Blablubbs ( talk) 19:18, 23 November 2022 (UTC) reply

08 December 2022

Suspected sockpuppets

• مرد ایرانی ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Strong behavioral evidence in editing pattern. Nearly entire history is Davidkhanian related articles, such as: [6] [7] [8] [9] agtx 22:04, 8 December 2022 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

•  Confirmed to ActivistFan1. Blocked and tagged. This SPI can be closed. ~Oshwah~ ^{(talk) (contribs)} 02:11, 9 December 2022 (UTC) reply

23 March 2023

Suspected sockpuppets

• Camelotsucks ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Immediate editing on pages associated with TheEdgarBox agtx 20:52, 23 March 2023 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

•  Technically indistinguishable but shared IP. TonyBallioni ( talk) 22:59, 23 March 2023 (UTC) reply
• Blocked and tagged. Courcelles ( talk) 13:25, 24 March 2023 (UTC) reply