Wikipedia:Sockpuppet investigations/Dwaro/Archive

Dwaro

Dwaro (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

07 June 2020

Suspected sockpuppets

Throwawiki (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Throwawiki joined the day after Elfin's block and has now (over a year later!) recreated an identical version of WooPlus Praxidicae (talk) 16:49, 7 June 2020 (UTC)[reply]

I've also sent an email to functionaries about this as I don't want to fall afoul of outing. Praxidicae (talk) 17:18, 7 June 2020 (UTC)[reply]

Praxidicae, On the top, the editor has also making request to remove speedy delete tag on my talk page User_talk:Amkgp#WooPlus ~ Amkgp ✉ 17:24, 7 June 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
When this name suppression happened in this edit in midst of edits involving one of those alleged accounts, I had a strange feeling. I am curious if this one could be related to the whole deal? and also Special:Contributions/Thomastheo when the account suddenly came out of a nearly two year hiatus to participate in AfD, then suddenly went off the radar again. Graywalls (talk) 19:33, 8 June 2020 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

Putting this on hold to discuss on checkuser-l. TonyBallioni (talk) 18:11, 7 June 2020 (UTC)[reply]
The following accounts are either Confirmed to one another:
- Elfinshadow (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Afvalbak (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Eoppa (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- DwaroPublic (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
The following account is Likely to the above:
- Streepjescode (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
The following account has been linked to this case by being on the same static IP previously according to the CU log. It is Possilikely (a mix between possible and likely) technically if I had to use a template:
- MeneerTijn (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Note that this does not appear at first glance to be a shared IP. The only reason I didn't confirm Streephescode is that there is a difference in browser version on the same day, which indicates a different device (i.e. they were using an older browser a few hours after one of the confirmed socks was using a newer one). At the same time, they'd previously used the newer browser version the day before on the same system, so it's clear they have access to both devices.

Anyway, I've

Blocked and tagged all the confirmed socks for violating WP:PROJSOCK and also likely being related to COI and UPE editing via evasion of scrutiny. In case there's the argument that Throwawiki was a legitimate alt, the engaging in WP:PROJSOCKing nullifies that, as does the apparent UPE/COI editing. Also based on the time of account creation and similar subject, I think Elfinshadow likely is the same, but the CU log there shows a potential proxy, so I can't tie technically and the account is stale.

Would a clerk move this to Dwaro, and a clerk or patrolling admin assess behaviourally the two I haven't blocked and tag as neccesary? Thanks. TonyBallioni (talk) 17:53, 8 June 2020 (UTC)[reply]

MER-C, pinging you since you blocked the account that led to this check. TonyBallioni (talk) 18:00, 8 June 2020 (UTC)\[reply]

I had been alerted to this prior to the filing of the SPI and have seen some of the private evidence too. I agree Elfinshadow is a sock. MER-C 18:09, 8 June 2020 (UTC)[reply]

They emailed me admitting to the socking but said that Elfinshadow wasn't them and that it was oddly a coincidence. Doesn't really impact much here as its still a policy violation what happened, but I'll remove the tag so there isn't confusion. Based on the email as a whole, I believe them. TonyBallioni (talk) 22:36, 8 June 2020 (UTC)[reply]

Clerk note: On it's own, the interaction evidence wouldn't be enough, but together with the technical evidence, I think it's enough to call them behavioral socks. The unusual use of "j" in both their usernames is another hint connecting those two, although it may be nothing more than "j" being a common letter in Dutch, which from their shared interest in Noordwijk Climate Conference, I'm guessing they are. Blocked and tagged both of those. -- RoySmith (talk) 23:48, 11 June 2020 (UTC)[reply]
Closing. -- RoySmith (talk) 23:50, 11 June 2020 (UTC)[reply]

27 September 2020

Suspected sockpuppets

Hakz77 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Similar interest in Osmocom as blocked sock User:Afvalbak, and the account was created a few weeks after Afvalbak was blocked. The behavioral evidence could be a coincidence, so I'd like a CU check. _signed,Rosguill ^talk 19:45, 27 September 2020 (UTC) _signed,Rosguill ^talk 19:45, 27 September 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

Clerk endorsed but not with a lot of enthusiasm - The short gap between when Afvalbak was blocked and Hakz77 created, and picking up editing on Osmocom seems like enough to justify CU. They also both edited Replicant (operating system), as did Dwaro. And, the timecards look pretty similar. MeneerTijn is the only account in the archives that's not stale, and their behavior doesn't really fit the pattern, so I'm not too optimistic anything will come of this. -- RoySmith (talk) 21:17, 27 September 2020 (UTC)[reply]
Everything is Stale, so I'm declining the check. $Salvio$ 08:45, 28 September 2020 (UTC)[reply]
Salvio giuliano, From what I can see neither Hakz77 or MeneerTijn (in the archives) are stale. Am I missing something? -- RoySmith (talk) 14:00, 28 September 2020 (UTC)[reply]
RoySmith I'm sorry, it was my mistake. I had missed the MeneerTijn account, which isn't stale, as you correctly point out. Therefore, I have restored your endorsement. $Salvio$ 15:50, 28 September 2020 (UTC)[reply]
In progress - Mz7 (talk) 22:56, 28 September 2020 (UTC)[reply]
I see that MeneerTijn was blocked previously as a sockpuppet of this master, but was later unblocked on appeal [1], so unless I'm mistaken, my understanding is that they are currently not a part of this sock group. There is, however, archival information about Dwaro on CU wiki [2] that is useful here. From that I can conclude Hakz77 is Possilikely (a mix between possible and likely) to Dwaro and Possible to MeneerTijn. Mz7 (talk) 23:05, 28 September 2020 (UTC)[reply]
Clerk note: Between Roy's comments at endorsement time and Mz7's findings, I don't think the evidence is strong enough to support a block. Closed without action. GeneralNotability (talk) 23:16, 28 September 2020 (UTC)[reply]
GeneralNotability, Hmmm, interesting. I was thinking more like it justified a block for Hakz77, and was trying to figure out if I was going to do that on my own or seek a second opinion. I guess the second opinion beat me to it :-) I will note for the sake of future clerks that Hakz77 had declared their COI. -- RoySmith (talk) 23:37, 28 September 2020 (UTC)[reply]
RoySmith, if you want to override my close, you're welcome to - I just don't think possilikely is enough here without fairly good behavioral evidence, but if you think it's worth a block go for it. GeneralNotability (talk) 23:38, 28 September 2020 (UTC)[reply]
GeneralNotability, No, this is fine. I was on the fence, so I'll just go with your judgement. -- RoySmith (talk) 23:42, 28 September 2020 (UTC)[reply]