Bri.public (talk | contribs) No edit summary |
Ivanvector (talk | contribs) (→11 September 2020: comment, close) |
||
Line 5: | Line 5: | ||
===11 September 2020=== |
===11 September 2020=== |
||
{{SPI case status| |
{{SPI case status|close}} |
||
====Suspected sockpuppets==== |
====Suspected sockpuppets==== |
||
Line 44: | Line 44: | ||
It looks like the only one that's not stale is Dxma929, so other than the obvious similarity in user names, there's really not much to go on. Theres's no doubt this is a huge pile of spammy socky UPE, but I'm not sure what value there is in investing a huge amount of effort to figure out if these are really the same farm as each other. -- [[User:RoySmith|RoySmith]] [[User Talk:RoySmith|(talk)]] 00:11, 28 September 2020 (UTC) |
It looks like the only one that's not stale is Dxma929, so other than the obvious similarity in user names, there's really not much to go on. Theres's no doubt this is a huge pile of spammy socky UPE, but I'm not sure what value there is in investing a huge amount of effort to figure out if these are really the same farm as each other. -- [[User:RoySmith|RoySmith]] [[User Talk:RoySmith|(talk)]] 00:11, 28 September 2020 (UTC) |
||
*{{declined}} and closed. Confirmed socks in both cases each have a consistent geolocation, and those locations are on different continents. They're probably working together based on the username evidence, but they are different users. [[User:Ivanvector|Ivanvector]] (<sup>[[User talk:Ivanvector|Talk]]</sup>/<sub>[[Special:Contributions/Ivanvector|Edits]]</sub>) 14:54, 7 October 2020 (UTC) |
|||
----<!--- All comments go ABOVE this line, please. --> |
----<!--- All comments go ABOVE this line, please. --> |
||
===01 October 2020=== |
===01 October 2020=== |
Revision as of 14:55, 7 October 2020
Dyhp612
- Dyhp612 (talk · · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser (log) · investigate · cuwiki)
11 September 2020
– This SPI case is closed and will be archived shortly by an SPI clerk or checkuser.
Suspected sockpuppets
- Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.
Requesting that Wikipedia:Sockpuppet investigations/RadyoUkay819 be folded into this SPI. Another editor noted when opening the Dyhp612 case 17 July 2017: Similar usernames: "2017" as suffix, "Dx" + two letters + 2 numbers + 1
. RadyoUkay819 appears to be likely the same master, with CU confirmed socks User:Dxic711, User:Dxma929, User:Dxoc1494 following that convention or nearly so. Other behavioral evidence is a match as well. ☆ Bri (talk) 17:05, 11 September 2020 (UTC)
- Pls consider newly discovered sock User:Dyth990, looks like similar or same naming formula. ☆ Bri (talk) 01:41, 22 September 2020 (UTC)
- I don't know if this has been pointed out before:
- RU819 <---> Dyhp612 behavioral matches include the blockquote construction of userpages e.g.: [1], [2] vs [3], [4].
- They also have the right amount of (non) overlap to be consistent with (non) linkage via CU technical evidence; see graphical representation at WP:COIN.
- It was suggested earlier in the investigation that one of the accounts was associated with logged-out editing. Of course I'm not privy to the same things CU saw, but I think that I have seen some similar PLDT use [5][6] between the two that might point in the right direction.
- ☆ Bri (talk) 01:34, 29 September 2020 (UTC)
- I don't know if this has been pointed out before:
Comments by other users
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
- Clerk note: @Bri:, you mentioned the possible connection between these two cases a month ago, under the RadyoUkay819 case (01 September 2020). Is there any evidence beyond what was available then? FWIW, I did a little digging. Here's the users with the common naming pattern in the two cases:
- RadyoUkay819:Dxoc1494
- RadyoUkay819:Dxic711
- RadyoUkay819:Dxil1031
- RadyoUkay819:Dycm1152
- RadyoUkay819:Dxma929
- Dyhp612:Dyhp612
- Dyhp612:Dxrr1017
- Dyhp612:Dxum819
- Dyhp612:Dyrb540
- Dyhp612:Dxow981
- Dyhp612:Dxdc621
- Dyhp612:Dzbb594
It looks like the only one that's not stale is Dxma929, so other than the obvious similarity in user names, there's really not much to go on. Theres's no doubt this is a huge pile of spammy socky UPE, but I'm not sure what value there is in investing a huge amount of effort to figure out if these are really the same farm as each other. -- RoySmith (talk) 00:11, 28 September 2020 (UTC)
- Declined and closed. Confirmed socks in both cases each have a consistent geolocation, and those locations are on different continents. They're probably working together based on the username evidence, but they are different users. Ivanvector (Talk/Edits) 14:54, 7 October 2020 (UTC)
01 October 2020
Suspected sockpuppets
- Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.
Same ISP, very close to 2001:4455:42F:F200:A504:BF36:56D4:DA45 just recently CU blocked by Berean Hunter for same sort of editing on beauty pageant articles. These articles have been plagued by socks and logged-out socks as described at conflict of interest noticeboard and WP:AN. Note that IPs first edit [7] directly follows RadyoUkay819 sock [8]; I can't reliably tell the two sockfarms apart. Bri.public (talk) 22:54, 1 October 2020 (UTC)
Comments by other users
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.