WP:Sockpuppet investigations/Dewan357/Archive

{{SPIcat}}

;Suspected sockpuppets

• {{checkuser|Dewan753}}
• {{checkuser|Ashokafix}}
• {{checkip|98.109.98.30}}

;Evidence submitted by Kww

Unimaginative username, combined with editing exactly the same articles in exactly the same way.—Kww(talk) 02:53, 3 August 2009 (UTC)

:After I rolled back all of Dewan753's edits, Ashokafix was created (a scant 27 minutes after I warned Dewan753). Ashokafix has been restoring all of Dewan753's changes. Adding a checkuser because it's pretty obvious an IP block will be required to get this to stop.—Kww(talk) 04:17, 3 August 2009 (UTC)

:*98.109.98.30 seems to have joined in the party.—Kww(talk) 04:20, 3 August 2009 (UTC)

;Comments by accused parties    See Defending yourself against claims.

;Comments by other users

Update: suspected named sock accounts above indefblocked per WP:DUCK; IP seems to be stable so blocked for a few weeks. Block on master account extended for socking. EyeSerene^talk 07:40, 3 August 2009 (UTC)

{{RFCU|E|No2ndletter|Decline}}

;Clerk, patrolling admin and checkuser comments

• CU seems unnecessary. Declined for that reason. Nathan ^T 16:54, 3 August 2009 (UTC)

;Conclusions

{{SPIclose|archive}}

----{{SPIarchive notice|Dewan357}}

{{SPIcat}}

;Suspected sockpuppets

• {{checkip|159.91.150.217}}
• {{checkip|159.91.20.100}}

;Evidence submitted by Kww

Obvious socking: Dewan357 includes {{User TCNJ}}

{{clear}}

on his userpage, [http://samspade.org/whois/159.91.150.217 Whois for the IP] shows that it is at the College of New Jersey. Typical Dewan357 edits. He basically spent his recent one-week block evading his block by editing anonymously. Given his block history, Dewan357 needs his block taken to indefinite.—Kww(talk) 19:48, 7 September 2009 (UTC)

;Comments by accused parties    See Defending yourself against claims.

;Comments by other users

;Clerk, patrolling admin and checkuser comments

;Conclusions

• Indef'd by NuclearWarfare, IP blocked for a week. Nathan ^T 20:27, 7 September 2009 (UTC)

{{SPIclose|archive}}

----{{SPIarchive notice|Dewan357}}

{{SPIcat}}

;Suspected sockpuppets

• {{checkip|159.91.20.43}}

;Evidence submitted by Kww

Pretty obvious: same range as previous reports, same articles as Dewan357's normal range, began by restoring the edits reverted due to the last sockpuppet report on Dewan357.—Kww(talk) 01:40, 10 September 2009 (UTC)

;Comments by accused parties    See Defending yourself against claims.

;Comments by other users

;Clerk, patrolling admin and checkuser comments

;Conclusions

• Blocked for 48 hours. NW (Talk) 02:04, 10 September 2009 (UTC)
• Actually rangeblocking may be a more efficient solution, so I have done that instead (159.91.0.0/16). PeterSymonds (talk) 13:12, 10 September 2009 (UTC)

{{SPIclose|archive}}

----

Looks like Dewnans sock is back again after his indefinate block hes back on the same articles pushing his pov:[http://en.wikipedia.org/wiki/Special:Contributions/Aamirshkh] same old articles same pov I suggest you semiprotect the target pages to deal with his sock accounts thankyou 86.158.232.138 (talk) 16:02, 12 September 2009 (UTC){{SPIarchive notice|Dewan357}}

{{SPIcat}}

;Suspected sockpuppets

• {{checkuser|1=Aamirshkh}}

;Evidence submitted by NuclearWarfare

This was reported to be a sock of Dewan on my talk page. I really don't know the history of this SPI case too well, but it could possibly be the case from the behavioral evidence, though other factors suggest that it might not be. I'm requesting checkuser to see if we can't settle this. Oh, and I blocked [http://en.wikipedia.org/w/index.php?title=Special:Log&type=block&user=&page=User:159.91.20.0%2F22 this range] a few days ago as a sockpuppet of Dewan, if that helps any. NW (Talk) 16:17, 12 September 2009 (UTC)

;Comments by accused parties    See Defending yourself against claims.

;Comments by other users

I received the same message, and decided to wait for things to ripen further. No objection to a checkuser, though: there's a reasonable possibility that this is Dewan357.—Kww(talk) 16:55, 12 September 2009 (UTC)

;Clerk, patrolling admin and checkuser comments

{{RFCU|E||Self}}

• {{Endorse}} NW (Talk) 16:17, 12 September 2009 (UTC)

• {{unrelated}}. Brandon (talk) 18:35, 12 September 2009 (UTC)

;Conclusions

{{SPIclose|archive}}

----

{{SPIcat}}

• {{checkuser|Generalboss3}}

Strong overlap in edited articles with Dewan357, notably a strong nationalist Indian interest. Has resumed edit warring on Middle kingdoms of India, which is one of Dewan357's trademark articles, specifically edit warring over the Kushan empire ([http://en.wikipedia.org/w/index.php?title=Talk:Middle_kingdoms_of_India&curid=3849318&diff=335899588&oldid=331400954 This] is an example of him reentering one of Dewan357's disputes). If checkuser information on Dewan357 has gone stale, he originally edited from the State College of New Jersey, and then moved to libraries and internet cafes in the Trenton, New Jersey area when the college IPs were blocked. Checkuser required because Dewan357 is not the only Indian nationalist on Wikipedia.—Kww(talk) 23:57, 4 January 2010 (UTC)

Adding some more specific evidence: [http://en.wikipedia.org/w/index.php?title=Japan&diff=301801449&oldid=prev This] and [http://en.wikipedia.org/w/index.php?title=Japan&diff=330113583&oldid=prev this] come pretty close to "smoking gun" category.

There's a common locus of interest at List of mobile network operators.

There's a virtual obsession with Middle kingdoms of India and the Kushan empire.

There's a common locus of interest at Morocco.

Pantaloon Retail India is a pretty obscure article to have as a common editing point.

Template editing is pretty rare, and both editors have hit Template:History of Pakistan and Template:History of South Asia. Both editors reject the name "British Raj":[http://en.wikipedia.org/w/index.php?title=Template:History_of_Pakistan&diff=308756834&oldid=308667024][http://en.wikipedia.org/w/index.php?title=Template:History_of_Pakistan&diff=next&oldid=330140229]

Sher Shah Suri Tomb is a fairly obscure article to have as a common interest.

Vijay Sen is another obscure intersection.

—Kww(talk) 18:16, 5 January 2010 (UTC)

See Defending yourself against claims.

{{RFCU| E | No2ndletter | checked }}    Requested by —Kww(talk) 23:57, 4 January 2010 (UTC)

{{decline}} – User:Dewan357 and all other suspected socks are {{staleIP}}; there's nothing to check against. –MuZemike 16:53, 5 January 2010 (UTC)

{{endorse}} – After conferring with Nathan (who has previously looked at this case), there is sufficient reason to endorse for CU here. –MuZemike 18:51, 5 January 2010 (UTC)

• {{confirmed}}. Dewan357 has made a number of anonymous edits, generally coming from the 159.91.0.0/16 range. If you see edits to India-related articles, it may be time for another CU request. Nishkid64 _{(Make articles, not wikidrama)} 18:56, 5 January 2010 (UTC)

• Note also [http://en.wikipedia.org/w/index.php?title=Special:Log&type=block&page=User%3A209.212.23.37], blocked today as a Dewan357 IP. Nathan ^T 17:28, 6 January 2010 (UTC)

• Also note {{User|209.212.23.42}} and also blocked temporarily. Nirvana888 (talk) 18:19, 6 January 2010 (UTC)

{{SPIclose}}

----

{{SPIcat}}

• {{checkip|159.91.151.97}}

It's a WP:DUCK. Trenton State College again, editing nothing but articles about India. Can we please rangeblock [159.91.0.0 - 159.91.255.255]] until June or so? This is getting extremely tiresome.—Kww(talk) 22:10, 2 February 2010 (UTC)

See Defending yourself against claims.

{{admin-note}} 159.91.0.0/16 blocked 1 month. I think there were some unrelated edits over a month ago, so I'm a bit hesitant to block any longer than that. –MuZemike 02:04, 3 February 2010 (UTC)

{{SPIclose}}

----

{{SPIcat}}

• {{checkip|173.54.43.147}}

This is a Newark, NJ FIOS IP that is going through and restoring Dewan357's edits. Since Dewan357 is a student at College of New Jersey, this would appear to be his home account or a friend's account.—Kww(talk) 02:33, 13 February 2010 (UTC)

See Defending yourself against claims.

{{Admin-note}} Given the geo-location, and the editing-history, WP:DUCK applies. Blocked for 31 hours; can extend if needed. Abecedare (talk) 03:36, 13 February 2010 (UTC)

{{SPIclose|archive}}

----

{{SPIcat}}

• {{checkip|173.54.43.147}}

Exact same IP as last sock report, restoring edits now that block has expired. 3 months this time maybe?—Kww(talk) 03:35, 21 February 2010 (UTC)

See Defending yourself against claims.

{{Admin-note}} IP blocked for 48 hours by SpacemanSpiff. TNXMan 14:58, 21 February 2010 (UTC)

{{SPIclose|archive}}

----

;Suspected sockpuppets

• {{checkuser|1=Areapeaslol}}
• {{checkuser|1=Plotdealtiknow}}
• {{checkuser|1=Yearsclosehaveto}}
• {{checkuser|1=Swungtrade66}}
• {{checkuser|1=Typesworktodonow}}
• {{checkuser|1=Pickaroomforme}}
• {{checkuser|1=Bloodsheerthatbeen}}
• {{checkuser|1=Armytouch3best}}
• {{checkip|1=69.115.82.63}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=Dewan357 User compare report] Auto-generated every hour.

69.115.82.63 was blocked on Jul 17, 2011 by SpacemanSpiff as a sock of Dewan357. When that block expired on Aug 17, 2011, Areapeaslol immediately began editing the same group of articles. After I reverted those and reblocked 69.115.82.63, a swarm of new socks popped up to restore all of Areapeaslol's edits. Need a sweep to find any of the swarm that I missed, and a block of the underlying IP. Dewan357 is a long-term sockmaster, so any IP block should be for as long as possible on as wide of a range as the checkuser feels comfortable with. —Kww(talk) 22:05, 19 August 2011 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

One more account that appeared on the same time and made an edit to the same article editing by Areapeaslol and other accounts:

• {{checkuser|1=Rockpitchknowledge}}

--Sodabottle (talk) 05:11, 20 August 2011 (UTC)

• Wasn't aware that Kww opened this, but TnxMan did a CU yesterday based on an ANI thread: [http://en.wikipedia.org/wiki/Wikipedia:Administrators%27_noticeboard/IncidentArchive716#Template:HistoryOfSouthAsia_being_spammed_by_multiple_new_accounts Wikipedia:Administrators'_noticeboard/Incidents#Template:HistoryOfSouthAsia_being_spammed_by_multiple_new_accounts]. He blocked a lot of socks, I've asked him for the list so that I can tag them (I've already tagged a few -- {{U|Just4edit}}, {{U|Tradeupper88}}, {{U|Bengaliindian}}, {{U|Guideroadstaken}} will take care of the rest once I hear back). —SpacemanSpiff 12:29, 20 August 2011 (UTC)
• I saw that TnxMan07 had been in there: about half the socks I detected were already blocked by him. It's apparent that Dewan357 is trying a mass-creation strategy: create so many account that the patterning is difficult. I suspect that a soft-block that basically covers Trenton is probably going to be the only way out of this.—Kww(talk) 13:29, 20 August 2011 (UTC)

• {{Endorse}} - The master and confirmed socks are rather stale, but we can check the accounts against each other, as well as for sleepers. — HelloAnnyong ^{(say whaaat?!)} 23:25, 19 August 2011 (UTC)
• {{confirmed}}:
• {{checkuser|Noblealsoalways}}
• {{checkuser|Armytouch3best}}
• {{checkuser|Necknoisenowthis}}
• {{checkuser|Just4edit}}
• {{checkuser|Areapeaslol}}
• {{checkuser|Plotdealtiknow}}
• {{checkuser|Typesworktodonow}}
• {{checkuser|Swungtrade66}}
• {{checkuser|Yearsclosehaveto}}
• {{checkuser|Bloodsheerthatbeen}}
• {{checkuser|Pickaroomforme}}
• {{checkuser|Mughalboyyyyy}}
• {{checkuser|Signsamong29}}
• {{checkuser|Helo336633}}
• {{checkuser|Shortempty66}}
• {{checkuser|Sikhwatch}}
• {{checkuser|Just4edit}}
• {{checkuser|Goodraise55}}
• {{checkuser|Suremost645}}
• {{checkuser|Bengaliindian}}
• {{checkuser|Nizamboy}}
• {{checkuser|Lovemenowhaha}}
• {{checkuser|Setalhallalum}}
• That should be, I think, all of them. All are blocked, many are tagged (the ones I just massblocked at the very least). Hersfold ^(t/a/c) 05:05, 22 August 2011 (UTC)
• {{adminnote}} Tagged the untagged ones, all appear to be blocked now. —SpacemanSpiff 05:39, 22 August 2011 (UTC)

I just blocked {{checkuser|Delhiunit}}, who I encountered while trying to clean up this mess. There hasn't been any comment about IP blocks. Have none been applied?—Kww(talk) 11:31, 22 August 2011 (UTC)

:* and {{userlinks|Spitecents6}}. —Kww(talk) 11:41, 22 August 2011 (UTC)

:** and {{userlinks|Exactpitchpoint}}. —Kww(talk) 11:50, 22 August 2011 (UTC)

:***{{user|Linesthis44}} is {{confirmed}}, along with several others I've blocked and tagged. Any sort of rangeblocking doesn't appear possible at the moment- please just keep reporting them as they come in. There are several other users who match technically- I'll list them here for behavioral review.

:****{{checkuser|Masterknighted}}

:****{{checkuser|Rrsocko}}

:****{{checkuser|Wentpower000}}

:****{{checkuser|Tendsuch33}}

:****{{checkuser|Masked Mutant}} TNXMan 14:28, 22 August 2011 (UTC)

• {{adminnote}} I've blocked and tagged {{U|Linesthis44}} and {{U|Wentpower000}}. IMO {{U|Masterknighted}}, {{U|Wentworth000}}, and {{U|Masked Mutant}} are unrelated. {{U|Tendsuch33}} is possible but given that almost all editors to that article (including Dewan) are from that region it's difficult to say -- not marking for close right now as maybe Kww can check this one in particular. —SpacemanSpiff 15:51, 22 August 2011 (UTC)

::I'll look further in about 8 hours.—Kww(talk) 17:05, 22 August 2011 (UTC)

{{od}} one more sock - {{user|Proudtobeindian007}}--Sodabottle (talk) 17:57, 22 August 2011 (UTC)

:*{{confirmed}} that one too, but that's the only one. TNXMan 18:15, 22 August 2011 (UTC)

• Whoa. Uhh... I guess we're done here. — HelloAnnyong ^{(say whaaat?!)} 23:53, 22 August 2011 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=Awais141}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=Dewan357 User compare report] Auto-generated every hour.

My evidence is basically [http://en.wikipedia.org/wiki/Special:RecentChangesLinked/User:Kww/Dewan357 edits to articles that were protected due to socking by Dewan357]. A very light editor, with a major gap prior to the recent troubles with Dewan357, it seems suspicious that he is the only editor to edit two of the articles that I protected because of editing by Dewan357. Given the heavy socking level, it wouldn't hurt to run a sweep, anyway. —Kww(talk) 23:52, 2 September 2011 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{Endorse}} - If this is a sock, it's a really old one. Still, I guess we can take a look. — HelloAnnyong ^{(say whaaat?!)} 01:25, 3 September 2011 (UTC)

:* {{confirmed}}, and also:

::* {{checkuser|Usmanreddy}}

::* {{checkuser|Paranda}}

:* I note from the history that a rangeblock was declined. To more experienced CUs: please take a second look. AGK [•] 00:25, 4 September 2011 (UTC)

:Blocked and tagged.—Kww(talk) 00:33, 4 September 2011 (UTC)

::Judging from the edits that I've undone, it would appear that Dewan357 has "borrowed" some accounts from fellow students to continue his editing. Earliest edits on the accounts don't appear to be him, but recent edits certainly do.—Kww(talk) 01:15, 4 September 2011 (UTC)

• Note I also blocked {{IP|69.118.40.76‎}} an hour back as a DUCK block. —SpacemanSpiff 19:42, 4 September 2011 (UTC)
• No plausible rangeblocks that I saw. Courcelles 05:04, 5 September 2011 (UTC)
• Everyone's blocked, so I think we're good. — HelloAnnyong ^{(say whaaat?!)} 13:03, 5 September 2011 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=Truefact1979}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=Dewan357 User compare report] Auto-generated every hour.

Truefact1979 has been blocked for edit-warring on India related articles, which is behaviourally a good match. Account creation date is August 18, placing it the right timeframe. Considering the depth and breadth of this problem, it's time for a sweep, anyway. —Kww(talk) 12:05, 14 September 2011 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• There is a lot of quacking from 64.105.174.210, which, though longer-lived than the TrueFact79 account, was during the same period covering many of the same topics (and/or articles closely related), and making almost identical comments. Comparative contribs: Special:Contributions/64.105.174.210, Special:Contributions/Truefact1979.

:*IP: "It is Devar. Thevar is a backward caste under shudra varna", "all the proof of yadavs being khastriyas are being ignored: new section"

:TrueFact79: "cholans never had a title thevar. It is . thevar is backward caste under shudra varna", "evidence of yadavs being chandravanshi: new section"

:Both had a strong interest in Raja Raja Chola I, making almost identical comments around the same period, and both have had the terrible habit of creating multiple redundant new sections on Talk:Yadav to argue that Yadavs are of the Chandranvanshi Kshatriya lineage. Is there any way to smack down this clear Evasion? MatthewVanitas (talk) 15:48, 14 September 2011 (UTC)

::This issue was also raised earlier at User_talk:EdJohnston#Truefact1979_evading_block, along with that of another California-based IP in the 8.x.x.x range. It seems to be clear quacking from both of them, despite the different California locations. I know that checkuser will not link IPs to usernames but EJ suggested that a two week block might be in order. (The other IP was Special:Contributions/8.18.192.2) - Sitush (talk) 16:00, 14 September 2011 (UTC)

These IPs don't track to previous behaviour of Dewan357, who has normally been associated with Trenton, New Jersey (he claims to be a doctoral candidate at the university there). 64.105.174.219 is a hotel, though, so it may be him. Checkusers can comment on whether these IPs match up to recent contributions.—Kww(talk) 17:26, 14 September 2011 (UTC)

• {{Endorse}} - Obviously noting the master is stale, but there are recent confirmed socks in case archives. While a rangeblock has not been possible in the past, we can at least try empty their sock drawer. Steven Zhang ^{The clock is ticking....} 12:22, 14 September 2011 (UTC)
• {{confirmed}} Truefact1979 is a match. *shakes the drawer* Looks like its empty for now. - Mailer Diablo 14:52, 14 September 2011 (UTC)
• Blocked, tagged.—Kww(talk) 15:18, 14 September 2011 (UTC)
• Aw, really, not even in the secret compartment? Bummer. I'll archive this for now. Steven Zhang ^{The clock is ticking....} 20:54, 14 September 2011 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=Sutradhari2000}}
• {{checkuser|1=Balaucf}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=Balaucf User compare report] Auto-generated every hour.

Pretty much identical personal attacks at Talk:Yadav. Balaucf - [http://en.wikipedia.org/w/index.php?title=Talk%3AYadav&action=historysubmit&diff=463576468&oldid=463546681], Sutradhari2000 - [http://en.wikipedia.org/w/index.php?title=Talk%3AYadav&action=historysubmit&diff=463671882&oldid=463615370] -- Boing! said Zebedee (talk) 15:39, 2 December 2011 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

:Drat. Just missed this. Any chance of checking whether User:Cultcontri also fits the pattern? Similar stuff on the same articles. - Sitush (talk) 09:20, 3 December 2011 (UTC)

• Sutradhari2000 is a {{confirmed}} sock of Balaucf. WilliamH (talk) 09:14, 3 December 2011 (UTC)

::{{user|Frtope11}} is another match. WilliamH (talk) 09:18, 3 December 2011 (UTC)

:::This should be merged with Wikipedia:Sockpuppet investigations/Dewan357 - the paper trail leads to him as a master. WilliamH (talk) 09:24, 3 December 2011 (UTC)

:::*{{user|Cultcontri}} is a highly {{likely}} match to {{user|Asorpan}}. WilliamH (talk) 10:08, 3 December 2011 (UTC)

::::*Can you comment on those two accounts' connection to the others listed here? (I've marked this case as relist so it gets attention.) — HelloAnnyong ^{(say whaaat?!)} 14:52, 3 December 2011 (UTC)

::::::They are technically unrelated to the other three, and geographically it doesn't seem possible. Meatpuppetry might be a more likely explanation, but editorially I view them as sockish ducks. WilliamH (talk) 16:21, 3 December 2011 (UTC)

• They all are just hitting the duck line when i'm looking at them, I want to agree with the CU results, but a few things just mesh the two groups togeather. -- DQ (t) (e) 08:35, 5 December 2011 (UTC)

----