Jump to content

Wikipedia:Sockpuppet investigations/Dyhp612/Archive

Add links
From Wikipedia, the free encyclopedia


Dyhp612

Dyhp612 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

17 July 2017

[edit]

Suspected sockpuppets

[edit]
  • Similar usernames: "2017" as suffix, "Dx" + two letters + 2 numbers + 1
  • Similar page creations and interests. NuestraBelleza2017 and Greatbritain2017 both created articles on Miss Universe 2017 delegates, Alisson Abarca and Anna Burdzy. Dxdc621, UnitopPH, and Dxow981 have all created pages in the format "[Country] at major beauty pageants." GABgab 00:41, 17 July 2017 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

[edit]
  •  Clerk endorsed - Self-endorsing my own request. Thanks, GABgab 00:41, 17 July 2017 (UTC)[reply]
  • Nice catch. Two groups,  Likely to each other based on ISP, UA, and geolocation.
  • Group 1:
  • Group 2:

02 August 2017

[edit]

Suspected sockpuppets

[edit]


Similar usernames and similar interest in beauty pageants. Rentier (talk) 17:37, 2 August 2017 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

[edit]

27 November 2017

[edit]

Suspected sockpuppets

[edit]

Please see sample article history: strong overlap with Special:Contributions/Taurus2017 (both on 19 Nov) and Special:Contributions/Radioph (both on 10 Aug). Taurus was discussed as connected to Dyhp612 here: User_talk:Taurus2017#November_2017_2; Radioph was confirmed to Taurus. Same topic area for the tree accounts: beauty pageants; please see comparison between Radioph and Medianadia and between Taurus2017 and Medianadia. K.e.coffman (talk) 02:08, 27 November 2017 (UTC)[reply]

Added Ndgdtw due to the overlap in the same topic area, specifically in Veruska Ljubisavljevic. Also adding Hpcidaniello due to the same concerns. K.e.coffman (talk) 02:49, 27 November 2017 (UTC)[reply]
Medianadia deleted a Speedy deletion tag from an article developed by Taurus2017: [3]. There have been no edits by other on the article. K.e.coffman (talk) 03:22, 28 November 2017 (UTC)[reply]
  • Behavioural evidence for a connection between AnnLivinova sock farm and Medianadia: I randomly clicked on one of the socks from the investigation, Special:Contributions/Torrie1975, and I find that their edits are very similar in nature – mostly gnomish edits relating to updates of pageant results. These two edits are identical:
    • [5] by Torrie1975: “As the winner of Miss Universe Serbia, Radosavljević represented Serbia at Miss Universe 2015 pageant but Unplaced.”
Notice “but Unplaced” in both cases – it’s grammatically incorrect, also with the strange capitalization of “Unplaced”. I believe these two accounts to belong to the same editor. K.e.coffman (talk) 00:09, 1 December 2017 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

[edit]

11 January 2018

[edit]

Suspected sockpuppets

[edit]

New additions

A newly created account with a focus on beauty pageants, similar to Special:Contributions/Taurus2017 and Special:Contributions/Radioph. The account name is peculiar: Frøken Norge is Norwegian name of Miss Norway, but the first edits are to Vietnamese pageants and pageant winners. Same as Taurus and Radio, FrøkenNorge uses "Mobile edit, Mobile web edit".

This article's history contains edits by all three accounts: [6]. Frøken Norge created a number redirects from names of pageant winners to pageants: sample; if memory serves me right, Radioph / Taurus also created redirects. The redirect linked is for the subject whose article has been recently deleted as G5, so it seems unusual that FrøkenNorge would pick two of the creations by Radioph / Taurus to create redirects. Here's another example of same: [7]. K.e.coffman (talk) 00:52, 11 January 2018 (UTC)[reply]

Also adding Special:Contributions/Universo2008 due to similar concerns. This account is a bit older (created in early Dec 2017), but exhibit similar pattern of editing -- laser-focused on beauty pageants, while also using "Mobile edit, Mobile web edit". Similar to FrøkenNorge, the first edit was to sandbox. Special:Contributions/Shakira2017 & Special:Contributions/Nguyenquochieu2107 have a similar editing pattern, so adding them as well. K.e.coffman (talk) 05:59, 11 January 2018 (UTC)[reply]
Update: I added Special:Contributions/Jourdan Ann and Special:Contributions/Sasha Boudville. They exhibit similar style as Frøken Norge / Radioph / Taurus: same topic area; no edit summaries; "Mobile web edit". K.e.coffman (talk) 02:19, 13 January 2018 (UTC)[reply]

Behavioral evidence

I ran user interaction reports on the new additions. What's interesting is that there's some overlap between Medianadia (a sock of AnnLivinova) and the Jourdan Ann account: [8]. There's overlap between Jourdan Ann and Sasha Boudville: [9]. I'm not sure if this information is meaningful; socks are perhaps so entrenched in the beauty pageant area that they would inevitably edit the same pages if given enough time. K.e.coffman (talk) 06:12, 13 January 2018 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

[edit]
  • I should add that although I could not match them, they are in the same country using similar ranges as the accounts in the archive. I can't see the UAs for the two groups in July's report because they are stale.
     — Berean Hunter (talk) 13:39, 11 January 2018 (UTC)[reply]

30 October 2018

[edit]

Suspected sockpuppets

[edit]


I notice his edits in Tara De Vries are same, and his name end in 2018. FPP (talk) 07:56, 30 October 2018 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

[edit]
  •  Additional information needed - @FPP: In order to facilitate and expedite your request, please provide diffs to support your case. Please give two or more diffs meeting the following format:
  1. At least one diff is from the sockmaster (or an account already blocked as a confirmed sockpuppet of the sockmaster), showing the behaviour characteristic of the sockmaster.
  2. At least one diff per suspected sockpuppet, showing the suspected sockpuppet emulating the behaviour of the sockmaster given in the first diff.
  3. In situations where it is not immediately obvious from the diffs what the characteristic behaviour is, a short explanation must be provided. Around one sentence is enough for this. Vanjagenije (talk) 09:50, 1 November 2018 (UTC)[reply]

 Technically indistinguishable + Dzbb594 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki).  Blocked and tagged.  Clerk assistance requested: Please move case to Dzbb594.--Bbb23 (talk) 14:36, 1 November 2018 (UTC)[reply]

10 November 2018

[edit]

Suspected sockpuppets

[edit]

Ridiculously loud duck. See Vania Herlambang and specifically YesTheBest2018 there is also significant xover with another master, Dzbb594 in terms of topic and naming similarities so the cases may be related. Praxidicae (talk) 10:13, 10 November 2018 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

[edit]

17 November 2018

[edit]

Suspected sockpuppets

[edit]

he made same edits in Tara De Vries article --FPP (talk) 07:14, 17 November 2018 (UTC) FPP (talk) 07:14, 17 November 2018 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

[edit]

26 November 2018

[edit]

Suspected sockpuppets

[edit]


same edits in Tara De Vries article FPP (talk) 12:43, 26 November 2018 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

[edit]

 Clerk assistance requested: Please move to correct case.--Bbb23 (talk) 16:05, 26 November 2018 (UTC)[reply]

18 January 2019

[edit]

Suspected sockpuppets

[edit]

A month old user with a focus on beauty pageants. The suspected sock was registered two weeks after SaintJude2019 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) was blocked and recreated their deleted articles Fernanda Alves (model) (Fernanda Alves (Miss International)) and Erica De Matteis. GSS (talk|c|em) 11:50, 18 January 2019 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

[edit]
@GeneralizationsAreBad: Is it okay to mark this as 'close'd now? --TheSandDoctor Talk 01:52, 26 January 2019 (UTC)[reply]

11 September 2020

[edit]

Suspected sockpuppets

[edit]

Requesting that Wikipedia:Sockpuppet investigations/RadyoUkay819 be folded into this SPI. Another editor noted when opening the Dyhp612 case 17 July 2017: Similar usernames: "2017" as suffix, "Dx" + two letters + 2 numbers + 1. RadyoUkay819 appears to be likely the same master, with CU confirmed socks User:Dxic711, User:Dxma929, User:Dxoc1494 following that convention or nearly so. Other behavioral evidence is a match as well. ☆ Bri (talk) 17:05, 11 September 2020 (UTC)[reply]

Pls consider newly discovered sock User:Dyth990, looks like similar or same naming formula. ☆ Bri (talk) 01:41, 22 September 2020 (UTC)[reply]
I don't know if this has been pointed out before:
  • RU819 <---> Dyhp612 behavioral matches include the blockquote construction of userpages e.g.: [10], [11] vs [12], [13].
  • They also have the right amount of (non) overlap to be consistent with (non) linkage via CU technical evidence; see graphical representation at WP:COIN.
  • It was suggested earlier in the investigation that one of the accounts was associated with logged-out editing. Of course I'm not privy to the same things CU saw, but I think that I have seen some similar PLDT use [14][15] between the two that might point in the right direction.
☆ Bri (talk) 01:34, 29 September 2020 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

[edit]
  •  Clerk note: @Bri:, you mentioned the possible connection between these two cases a month ago, under the RadyoUkay819 case (01 September 2020). Is there any evidence beyond what was available then? FWIW, I did a little digging. Here's the users with the common naming pattern in the two cases:
  • RadyoUkay819:Dxoc1494
  • RadyoUkay819:Dxic711
  • RadyoUkay819:Dxil1031
  • RadyoUkay819:Dycm1152
  • RadyoUkay819:Dxma929
  • Dyhp612:Dyhp612
  • Dyhp612:Dxrr1017
  • Dyhp612:Dxum819
  • Dyhp612:Dyrb540
  • Dyhp612:Dxow981
  • Dyhp612:Dxdc621
  • Dyhp612:Dzbb594

It looks like the only one that's not stale is Dxma929, so other than the obvious similarity in user names, there's really not much to go on. Theres's no doubt this is a huge pile of spammy socky UPE, but I'm not sure what value there is in investing a huge amount of effort to figure out if these are really the same farm as each other. -- RoySmith (talk) 00:11, 28 September 2020 (UTC)[reply]

  • no Declined and closed. Confirmed socks in both cases each have a consistent geolocation, and those locations are on different continents. They're probably working together based on the username evidence, but they are different users. Ivanvector (Talk/Edits) 14:54, 7 October 2020 (UTC)[reply]

01 October 2020

[edit]

Suspected sockpuppets

[edit]

Same ISP, very close to 2001:4455:42F:F200:A504:BF36:56D4:DA45 just recently CU blocked by Berean Hunter for same sort of editing on beauty pageant articles. These articles have been plagued by socks and logged-out socks as described at conflict of interest noticeboard and WP:AN. Note that IPs first edit [16] directly follows RadyoUkay819 sock [17]; I can't reliably tell the two sockfarms apart. Bri.public (talk) 22:54, 1 October 2020 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

[edit]
  • Closing; the IP is already blocked, and checkusers will not connect an IP to a named case. @Bri: we have pretty good private notes on which IPs are associated with which of the beauty pageant sockfarms, but the privacy policy forbids us from disclosing those connections publicly, so there's not much we can actually do with IP reports in these cases. Since they're all behaviourally similar, I think that reporting IPs here is only serving to confuse the clerks. Can I suggest if you see an IP sock similar to one of these cases, you email a checkuser (you can email me), and/or make a request at WP:RFPP to apply WP:GS/PAGEANT sanctions? Ivanvector (Talk/Edits) 15:05, 7 October 2020 (UTC)[reply]

06 October 2020

[edit]

Suspected sockpuppets

[edit]


A new disruptive beauty pageant SPA with signs of WP:DUCKage: no edit summaries, mobile edits only, camelcase name (note four CU-confirmed socks at Category:Wikipedia_sockpuppets_of_DevilBlack69 named MissXxxx). It could be RadyoUkay819 as easily, I can't tell them apart.

  • They appeared at Miss Earth 2020 a few days after a logged-out block evader 95.39.235.87 [18][19]
  • Directly followed a block evader 95.39.211.22 at Miss Earth Thailand [20][21]
  • Directly followed CU-confirmed RadyoUkay sock at Miss Earth China, exactly repeating their reverted edit [22][23]

- Bri.public (talk) 15:57, 6 October 2020 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

[edit]

26 September 2021

[edit]

Suspected sockpuppets

[edit]

Primarily based on beauty pageant SPA history and the account naming convention this sockfarm has been known to use (Dxdc621 for one, fuller list at WP:Sockpuppet investigations/Dyhp612/Archive#11 September 2020).

These two accounts are the only two other than me editing Maristella Okpala , when I noticed them. ☆ Bri (talk) 22:07, 26 September 2021 (UTC) ☆ Bri (talk) 22:10, 26 September 2021 (UTC)[reply]

Added PLDT IP address that looks like same person logged-out editing on Maristella Okpala several times, e.g. here a few minutes after dxcm and here a few minutes after dxds. ☆ Bri (talk) 22:42, 26 September 2021 (UTC)[reply]

Another likely logged-out IP in range edited two minutes after dxds here and one minute after here, just after a four-minute interaction between the named accounts here.

Another IP in range one minute after dxds here and another 5 minutes after dxcm here. ☆ Bri (talk) 03:38, 27 September 2021 (UTC)[reply]

Added new named user Vermont helper, also pageant SPA, on the early edit history Miss Supranational 2022, especially as little as 1 minute interval with IP in PLDT range like this.

Both named accounts took identical actions as their first two edits on enwp:

  1. Add project templates (erroneously) to user talkpage: [24][25]
  2. Add identically formatted pageant contestant quip to user page: [26][27]

☆ Bri (talk) 05:00, 27 September 2021 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • There are an awful lot of IP accounts that helped the sockpuppets build up a couple of dozen articles on beauty pageant contestants besides those listed here. Is a range-block possible or would that be ineffective? Liz Read! Talk! 21:04, 27 September 2021 (UTC)[reply]
  • Please notify me, ideally on my talk page, when this case is closed. I'd like to protect all pageant-related pages edited using the IP addresses per WP:GS/PAGEANT if they're found to be sockpuppets. Thank you very much in advance. ~ ToBeFree (talk) 22:13, 5 October 2021 (UTC)[reply]
    @ToBeFree I don't see anthing else to do here, so I'll close this. A lot of this is coming from 49.146.32.0/20, but it also looks like there's a lot of legitimate editing on that range. -- RoySmith (talk) 22:34, 5 October 2021 (UTC)[reply]
    Hm, okay. I was referring to "Behavioural evidence needs evaluation for the IP addresses"; in this specific case, even if they're not editing anymore, a "yes, sockpuppet" or "no sockpuppet" would have a pretty severe effect. ~ ToBeFree (talk) 22:36, 5 October 2021 (UTC)[reply]
    Well, I think the best I can tell you is that it looks like a lot of the traffic on 49.146.32.0/20 is related to this sock, but there's enough that looks like it's not that I'm not comfortable blocking. If you want to semi-protect various pages, that might be a reasonable thing to do. -- RoySmith (talk) 22:39, 5 October 2021 (UTC)[reply]
    All right, thank you very much. 🙂 ~ ToBeFree (talk) 22:40, 5 October 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

[edit]
  • Dxcm1089 and Dxds1161 are  Confirmed to each other, and while the case is stale it's pretty obvious they're the same user as Dyhp612.  Blocked and tagged. Vermont helper is Red X Unrelated.  Behavioural evidence needs evaluation for the IP addresses. Ivanvector (Talk/Edits) 16:31, 27 September 2021 (UTC)[reply]
  • Blocked 49.149.138.0 for a month. As noted above, 49.146.32.0/20 looks like it has a lot of legitimate editing, so not going to do anything there. Closing. -- RoySmith (talk) 22:36, 5 October 2021 (UTC)[reply]

05 August 2024

[edit]

Suspected sockpuppets

[edit]

Pretty similar case to this January 2018 case: https://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/Dyhp612/Archive#11_January_2018 User is habitually editing Vietnamese beauty pageant articles similar to previous Dyhp612 socks, with similar redirect manipulation, though this time, they deleted a redirect rather than created a new one. Requesting CU due to the long-term nature of the case. AshleySerana is not a new account, but a good amount of their edits are in this topic area and are similar to other socks from this farm. Jdcomix (talk) 15:54, 5 August 2024 (UTC)[reply]

Comments by other users

[edit]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Dyhp612/Archive&oldid=1240196566"