Wikipedia:Sockpuppet investigations/Bule Cloud/Archive

• {{checkuser|1=Hanabangk}}
• {{checkuser|1=정지숙}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

Record filing. -- Amanda (aka DQ) 14:50, 19 October 2020 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• All three {{confirmed}} already and dealt with. -- Amanda (aka DQ) 14:51, 19 October 2020 (UTC)

----

• {{checkuser|1=Euro2024|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=Roysh Roshan Rai|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=Bule Cloud|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=AsianEuro Cungball|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=Coms225|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=Stadium129|master name={{#titleparts:{{SUBPAGENAME}}}}}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&users={{urlencode:Euro2024}}&users={{urlencode:Roysh_Roshan_Rai}}&users={{urlencode:Bule_Cloud}}&users={{urlencode:AsianEuro_Cungball}}&users={{urlencode:Coms225}}&users={{urlencode:Stadium129}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&user={{urlencode:Euro2024}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

Global deep vandalism. Disruptive multiple accounts abusing soccer related article. enwp, kowp and commons are the primary targets. Check the CentralAuth, it quacks [https://commons.wikimedia.org/w/index.php?title=File:Kit_body_daejeon20h.png&action=history e.g.]. I have also reported them at commons' ANV. - Vis M (talk) 21:34, 21 July 2021 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{u|Vis M}}, {{DiffsNeeded|moreinfo}}

Please focus on editors who are not currently blocked and have edited recently (as far as I can tell, that's only Bule Cloud) GeneralNotability (talk) 02:14, 19 August 2021 (UTC)

• No additional evidence provided. Closing. Bbb23 (talk) 00:22, 5 September 2021 (UTC)

----

• {{checkuser|1=Euro2024}} ({{clerknote}} original case name)

• {{checkuser|1=Stadium129}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

x-wiki abuse. Shared interest on, e.g., South Korea national football team. Similarities are most pronounced on Commons; compare, e.g., :c:Special:Diff/446092711 with :c:Special:Diff/604686991. See also Commons:Administrators' noticeboard/Blocks and protections#Bule Cloud a sockpuppet of globally blocked Euro2024. I am requesting checkuser because of the history of socking, and I am doing so here rather than on Commons because you have access to the checkuser logs for this master (even though they are otherwise stale). —‍Mdaniels5757 (talk • contribs) 15:13, 4 November 2021 (UTC)

• Added Stadium129 from the archive per :c:Special:Diff/573304536, not stale but going stale soon. —‍Mdaniels5757 (talk • contribs) 15:24, 4 November 2021 (UTC)
• @RoySmith: since then, Bule Cloud has continued editing the same topics as the others (like 2021 AFC Champions League group stage).
• For specific enwiki diffs: compare [https://en.wikipedia.org/wiki/Special:Diff/1031432904] with [https://en.wikipedia.org/wiki/Special:Diff/1034074470] (where Bule Cloud picks up after Stadium129 is blocked.)
• Also, everyone involved seems to love blanking their pages: Stadium129, Bule Cloud 1, Bule Cloud 2, Euro2024, Coms225.
• Finally, see Special:Diff/1024200574, where Bule Cloud cleans up after Coms225, a month after Coms225 was globally locked.

: Best, —‍Mdaniels5757 (talk • contribs) 00:25, 5 November 2021 (UTC)

::Ooh, and [https://en.wikipedia.org/wiki/Special:Diff/prev/760975532] [https://en.wikipedia.org/wiki/Special:Diff/prev/917780159] (same article, different accounts, editing the same parameters 2 years apart. —‍Mdaniels5757 (talk • contribs) 00:31, 5 November 2021 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{moreinfo}} - Both of these users were reported in 21 July 2021, which was closed for lack of evidence. What has happend since then, specifically on enwiki? As noted in that previous report, what we really need are specific diffs. -- RoySmith (talk) 15:59, 4 November 2021 (UTC)
• {{Inprogress}} - -- RoySmith (talk) 00:37, 5 November 2021 (UTC)
• Bule Cloud is {{confirmed}} to Stadium129 on technical evidence. Comparing Bule Cloud to Euro2024, the memory circuits are badly degraded, but I found enough to let me call them at least {{likely}}. {{behav}} -- RoySmith (talk) 01:06, 5 November 2021 (UTC)
• :After consultation with my associates, I'm upgrading Bule Cloud to {{confirmed}}. And I'll go ahead and retag everybody. -- RoySmith (talk) 01:56, 5 November 2021 (UTC)
• Euro is already glocked, but the other two aren't, so requesting locks for them. -- RoySmith (talk) 02:05, 5 November 2021 (UTC)

----

• {{checkuser|1=Euro2024}} ({{clerknote}} original case name)
• {{checkuser|1=AsianEuro Cungball|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=Rororogoo|master name={{#titleparts:{{SUBPAGENAME}}}}}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&users={{urlencode:AsianEuro Cungball}}&users={{urlencode:Rororogoo}}&users={{urlencode:Bule Cloud}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&user={{urlencode:AsianEuro Cungball}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

In November 2021, AsianEuro Cungball suddenly started editing after a three-year hiatus only a few days after Bule Cloud was banned; the edit pattern of the three accounts (AsianEuro Cungball, Euro2024, Bule Cloud) is the same, which includes deleting all messages from his talk page instead of replying.

• As it can be seen in this [https://en.wikipedia.org/w/index.php?title=2021_Suwon_Samsung_Bluewings_season&diff=prev&oldid=1053320611 diff 1] and [https://en.wikipedia.org/w/index.php?title=2021_Suwon_Samsung_Bluewings_season&diff=prev&oldid=1053978875 diff 2], the last page edited by Bule Cloud before being banned and the first one edited by AsianEuro Cungball after a 3-year break are the same page, 2021 Suwon Samsung Bluewings season, it is 99% the same person. It was also previously requested by someone else to check AsianEuro Cungball and his connection to Bule Cloud / Euro2024 in July 2021 ([https://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/Bule_Cloud/Archive link]) Snowflake91 (talk) 13:26, 13 January 2022 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{Clerk Request}} - Looks like this should have been filed under Bule Cloud -- RoySmith (talk) 20:36, 13 January 2022 (UTC)
• {{Clerk-note}} {{Done}}. Sro23 (talk) 00:57, 14 January 2022 (UTC)
• {{Blockedandtagged}}, {{GlobalLocksRequested}}. Close. Sro23 (talk) 05:13, 14 January 2022 (UTC)

----

• {{checkuser|1=Spurs3333}}
  • Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

  Repeating similar behavior as previous socks at South Korea national football team and 2022 FIFA World Cup qualification – AFC Third Round. Obvious WP:DUCK. Jalen Folf (talk) 19:09, 8 February 2022 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

:Diffs: [https://en.wikipedia.org/w/index.php?title=South_Korea_national_football_team&diff=prev&oldid=1064817576 1], [https://en.wikipedia.org/w/index.php?title=South_Korea_national_football_team&diff=prev&oldid=1070257237 2] Snowflake91 (talk) 10:24, 11 February 2022 (UTC)

• {{u|JalenFolf}}: {{DiffsNeeded|moreinfo}}

Thanks, Spicy (talk) 06:00, 10 February 2022 (UTC)

• Thank you for the diffs, {{u|Snowflake91}}. {{Requestandendorse}} - looks likely to be the same person, but I think it's worth a check for others, since there seems to be a history of concurrently using multiple accounts. Thanks, Spicy (talk) 13:28, 11 February 2022 (UTC)
• {{Inprogress}} - -- RoySmith (talk) 14:04, 11 February 2022 (UTC)
• Spurs and {{checkuser|Chloesuy}} are {{confirmed}} to {{noping|AsianEuro Cungball}} and {{noping|Rororogoo}} from the archives; those later two are only tagged as suspected, but I do note that :commons:User:AsianEuro Cungball is blocked as a Euro2024 sock so I don't have any serious doubts about the connection. I'm going to cu-block Spurs and Chloesuy, but I'll leave the tagging to a clerk if they want to do some fancy dual-tag. I've requested glocks. -- RoySmith (talk) 14:42, 11 February 2022 (UTC)
• Thanks. I'm not going to bother with any fancy tagging, I just tagged as proven based on the behaviour (see [https://en.wikipedia.org/w/index.php?title=2021_Suwon_Samsung_Bluewings_season&action=history]). Closing. Spicy (talk) 20:43, 11 February 2022 (UTC)

----

{{sock list|1=Nartur|2=Jolf92|tools_link=yes}}

Obvious case, [https://en.wikipedia.org/w/index.php?title=South_Korea_national_football_team&diff=prev&oldid=1064862551 diff 1] "You're not Korean", [https://en.wikipedia.org/w/index.php?title=South_Korea_national_football_team&diff=prev&oldid=1081594959 diff 2] "You're not Korean", also editing the same pages as Bule Cloud, like South Korea national football team and 2022 Suwon Samsung Bluewings season ([https://en.wikipedia.org/w/index.php?title=2022_Suwon_Samsung_Bluewings_season&diff=prev&oldid=1081593393 diff 3], [https://en.wikipedia.org/w/index.php?title=2021_Suwon_Samsung_Bluewings_season&diff=prev&oldid=1053320611 diff 4]) Snowflake91 (talk) 12:30, 8 April 2022 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• CU doesn't give me much useful, but it certainly looks ducky enough. The Jolf92 account is already globally locked for cross-wiki abuse; blocking Nartur, requesting lock. Girth Summit _(blether) 13:07, 8 April 2022 (UTC)

----

{{sock list|1=Dyib|tools_link=yes}}

Another sock of the user that was globally locked many many times, same edit pattern with disruption at 2022 Suwon Samsung Bluewings season, restoring pages to his own preferred version ([https://en.wikipedia.org/w/index.php?title=2022_Suwon_Samsung_Bluewings_season&type=revision&diff=1090792418&oldid=1090450595 diff 1], [https://en.wikipedia.org/w/index.php?title=2022_Suwon_Samsung_Bluewings_season&type=revision&diff=1081597653&oldid=1081596955 diff 2]), also the same behavior on talk pages like every single previously blocked sock, i.e. blanking the page without leaving any reply – the sock was also registered shortly after the page was semi-protected after his IP was banned ([https://en.wikipedia.org/w/index.php?title=2022_Suwon_Samsung_Bluewings_season&type=revision&diff=1083015849&oldid=1083015637 diff 3]) Snowflake91 (talk) 12:31, 31 May 2022 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• This is {{confirmed}} to {{noping|Nartur}}, who is tagged as suspected to the master; blocking, tagging, closing. Girth Summit _(blether) 13:43, 1 June 2022 (UTC)

----

{{sock list|1=Samurainippon00|tools_link=yes}}

Looking at these four articles:

• {{Pagelinks|Iraq national football team results (2020–present)}}
• {{Pagelinks|South Korea national football team}}
• {{Pagelinks|South Korea national football team results (2020–present)}}
• {{Pagelinks|Iraq national football team results (2020–present)}}

They were all semi-protected for a month by {{noping|JBW}} in December 2023, due to disruptive editing and block evasion from the following accounts and IP range:

• {{rangevandal|2001:2D8:0:0:0:0:0:0/32}}
• {{userlinks|눈송이91}}
• {{userlinks|이봄이젖}}

The 이봄이젖 account and the person behind the IP range editing those articles were highly suspected to be Bule Cloud when they were blocked by JBW after an AIV report.

With the background of previous recent sockpuppetry out of the way, this 'Samurainippon00' account also seems to be very focussed on those four articles lately, making some inaccurate changes and edit-warring against other users like they did with the previous accounts/IPs. The pages are semi-protected but they are able to edit them due to being autoconfirmed.

Let's compare some edits:

• On Iraq national football team results (2020–present):
• edit by 눈송이91
• edit by Samurainippon00
• Explanation: both added football collapsible box template under 2024 heading with almost exactly the same details, slightly different as the match had already happened. User has a habit of linking the stadium the match is taking / took place in.

• On South Korea national football team results (2020–present):
• edit by 눈송이91
• edit by Samurainippon00
• Explanation: both made edits consisting of time parameter set to UTZ 17:00 4, changed "Rashid Stadium" to "New York University Stadium", changed "Dubai" to "Abu Dhabi"

• On South Korea national football team:
• edit by 2001:2D8:0:0:0:0:0:0/32
• edit by Samurainippon00
• Explanation: both added "SUS" to player Hwang Ui-jo, added link to "New York University Stadium"

• On Iraq national football team:
• edit by 눈송이91
• edit by Samurainippon00
• Explanation: both set time of 6 January match to UTZ 17:00 4, added link to "New York University Stadium"

One more piece of supporting evidence is that they have a bit of a tendency to put the source URL – and just the URL only, no other words – in the edit summary, like the previous accounts and IP range: edit by Samurainippon00; edit 1 and edit 2 by 2001:2D8:0:0:0:0:0:0/32; edit 1 and edit 2 by 눈송이91. — AP 499D25 (talk) 03:14, 9 January 2024 (UTC)

:Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Technically {{possilikely}} to previous socks, but the behaviour makes it obvious enough. Blocked, lock requested. Thanks for the clear report. Spicy (talk) 21:28, 9 January 2024 (UTC)

----