Wikipedia:Sockpuppet investigations/Smileverse/Archive#27 July 2015

;Suspected sockpuppets

• {{checkip|1=182.74.246.46}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Smileverse User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Smileverse created American Sleep Association (ASA), which I tagged for speedy deletion, and the IP removed the speedy deletion tag. After taking the article to AFD, I noticed that the IP and Smileverse had both edited a few pages in common:

• Smileverse edited Planet fashion three times on April 10 ([https://en.wikipedia.org/w/index.php?title=Planet_fashion&diff=prev&oldid=655815779], [https://en.wikipedia.org/w/index.php?title=Planet_fashion&diff=prev&oldid=655815832], [https://en.wikipedia.org/w/index.php?title=Planet_fashion&diff=prev&oldid=655815939]), and then the IP [https://en.wikipedia.org/w/index.php?title=Planet_fashion&diff=prev&oldid=656230644 edited it on April 13]. Smileverse again edited it on May 8 ([https://en.wikipedia.org/w/index.php?title=Planet_fashion&diff=prev&oldid=661371202] and [https://en.wikipedia.org/w/index.php?title=Planet_fashion&diff=prev&oldid=661392887]), and the IP [https://en.wikipedia.org/w/index.php?title=Planet_fashion&diff=prev&oldid=661795739 did so on May 11].
• Smileverse edited Greenwood High International School on [https://en.wikipedia.org/w/index.php?title=Greenwood_High_International_School&diff=prev&oldid=656855476 April 17], the same day the IP made 2 edits to that page ([https://en.wikipedia.org/w/index.php?title=Greenwood_High_International_School&diff=prev&oldid=656856448] and [https://en.wikipedia.org/w/index.php?title=Greenwood_High_International_School&diff=prev&oldid=656856642]).
• Smileverse has made numerous edits to Travertine Mart ([https://en.wikipedia.org/w/index.php?title=Travertine_Mart&diff=prev&oldid=645564648] and [https://en.wikipedia.org/w/index.php?title=Travertine_Mart&diff=prev&oldid=645564813] are a couple), which the IP has also edited ([https://en.wikipedia.org/w/index.php?title=Travertine_Mart&diff=prev&oldid=651747090] and [https://en.wikipedia.org/w/index.php?title=Travertine&diff=prev&oldid=651748666]).
• Smileverse created Custom On It [https://en.wikipedia.org/w/index.php?title=Custom_On_It&oldid=666003082 earlier today], which was tagged for speedy deletion (not by me), and the IP [https://en.wikipedia.org/w/index.php?title=Custom_On_It&diff=prev&oldid=666013462 removed the tag].
• Smileverse created American Sleep Association (ASA) [https://en.wikipedia.org/w/index.php?title=American_Sleep_Association_(ASA)&oldid=665993724 today], which I tagged for speedy deletion, and the IP [https://en.wikipedia.org/w/index.php?title=American_Sleep_Association_%28ASA%29&type=revision&diff=666007223&oldid=665997166 removed that tag].

Due to the policy against CheckUsers disclosing IPs of users, I haven't asked for a CheckUser confirmation here, but this seems like a pretty clear case of WP:DUCK. Inks.LWC (talk) 10:07, 8 June 2015 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• I blocked the IP for one week and the master for 48 hours. Closing.--Bbb23 (talk) 11:28, 8 June 2015 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=Ejhoyte}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Smileverse User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Ejhoyte recently removed a PROD tag from The Notionaries (rock band), which Smileverse created a few days ago. Smileverse has a history of using a sock account to remove CSD tags from articles that he created (although in the past, it had been done via an IP editor). What makes this instance even more suspicious is that the PROD tag removal is the only edit that Ejhoyte has made, several minutes after creating a new account earlier today. Inks.LWC (talk) 05:07, 10 June 2015 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I totally disagree with this statement "Smileverse has a history of using a sock account to remove CSD tags from articles that he created (although in the past, it had been done via an IP editor)." Now I figured out the reason why you are saying I've logged out and and removed CSD tags, that is because at my work place I do use my personal laptop and office work station simultaneously for various reasons. See, I never logged out in my personal laptop, I just removed deletion tag from my office work station, I agree i.e. because based on my research I can see the subject has notability (I'm talking about the subject you are referring as in the history). I don't have any intention of manipulating the system. One thing, I am aware of IP addresses and how it works, doesn't matter if i logged in or logged out, my IP doesn't change, even by knowing that why do I risk, if your statement is true? I would like contribute to the Wikipedia project with best of my knowledge and ability. What I've learned from this experience is passing news mentions are not acceptable all the times. Thanks for that. Honestly --Mohith:) 12:25, 10 June 2015 (UTC)

:FYI, creators of articles may not remove speedy deletion tags from those articles. So if you removed CSD tags, that was improper. When a creator of an article deletes the tag while not logged in, it really looks like the person is trying to evade the CSD policy. Inks.LWC (talk) 18:27, 10 June 2015 (UTC)

• {{user2|Smileverse}} and {{user2|Ejhoyte}} are superficially {{unrelated}}. That finding changes to {{inconclusive}} if you take into account the suspicious technical data from both accounts. However, I cannot recommend a block based on behavior given a single edit by Ejhoyte.--Bbb23 (talk) 07:41, 10 June 2015 (UTC)
• It's hard to prove anything here without a CU confirmation. Behavioral evidence is too weak. Closing the case with no action. Vanjagenije (talk) 10:12, 11 June 2015 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=Baligema}}
• {{checkuser|1=Dewimani}}
• {{checkuser|1=Hill NC}}
• {{checkuser|1=DK833hj}}
• {{checkuser|1=Rukuspukus}}
• {{checkuser|1=Ejhoyte}}
• {{checkuser|Artesianvc}}
• {{checkuser|Aljornien}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Smileverse User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Following [https://en.wikipedia.org/w/index.php?title=Wikipedia:Conflict_of_interest/Noticeboard&oldid=673326233#Smileverse this case] reported to COIN I have blocked Smileverse per WP:NOTPROMO. Others mentioned there that socking may have occurred and I have uncovered some evidence that I think is worthy of CU attention, particularly as there is a chance of sleeper accounts.

• Baligema is the most suspect - [https://en.wikipedia.org/w/index.php?title=Special%3ALog&type=patrol&user=Baligema&page=&year=&month=-1&tagfilter=&hide_patrol_log=1&hide_tag_log=1&hide_review_log=1&hide_thanks_log=1 patrolling] and [https://en.wikipedia.org/w/index.php?title=MedjetAssist&diff=666768137&oldid=666765037 removing PRODs] from articles Smileverse started. They also created Bangalorean (Website) which if you join the dots of [https://en.wikipedia.org/w/index.php?title=User_talk:Smileverse&diff=prev&oldid=445874441 Smileverse's] previous username is obviously connected (see also discussion about the site at this AFD and if you can't connect the dots, please email me, but I don't wish to get the wrong side of WP:OUTING).

• Dewimani appears to admit to being a sock [https://en.wikipedia.org/w/index.php?title=Special:Undelete&target=William+Benson+%28businessman%29×tamp=20150618045231&diff=prev here]_{(admins only)} when removing a PROD from William Benson (businessman) that Smileverse started ("I am aware of the Wikipedia notability guidelines & have contributed many with other name"). They went on to create an obvious piece of paid editing at Lancaster Insurance Services which Baligema [https://en.wikipedia.org/w/index.php?title=Lancaster_Insurance_Services&diff=668803956&oldid=668801244 also turned up at].

• Hill NC [https://en.wikipedia.org/w/index.php?title=Agent_X_%28Brand%29&oldid=672553722 created] Agent X (Brand) a few days ago, which again is obviously promotional and includes links to bangalorean.net.

• DK833hj is another new account that created Iwiss, again including links to bangalorean.net

• Rukuspukus is already blocked per this SPI from earlier this month and there are links to bangalorean.net again at Draft:William Benson which they started.

*Ejhoyte [https://en.wikipedia.org/w/index.php?title=Special:Undelete&target=The+Notionaries+%28rock+band%29×tamp=20150610044800&diff=prev removed a PROD] from The Notionaries (rock band) also started by Smileverse. SmartSE (talk) 17:21, 27 July 2015 (UTC)

::Striking this as I now realise they have already been CUd in the archives.

• Aljornien created James Presley and follows the same pattern as the rest. SmartSE (talk) 22:33, 27 July 2015 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

The sock/meat question is going to come up, I've noticed this group editing logged-out with Bangalore IPs (e.g. {{IP|117.216.188.94}}, {{IP|101.63.190.241}}, {{IP|182.74.246.46}}) that suggest they share workspaces and maybe some of them work out of the same internet cafe. I'm going to repeat {{U|TomStar81}} in this regard. In cases where meat- and sockpuppets are indistinguishable, they can all be treated administratively as socks, as we have here. As noted on the sockpuppetry page:

:::A 2005 Arbitration Committee decision established that "for the purpose of dispute resolution when there is uncertainty whether a party is one user with sockpuppets or several users with similar editing habits they may be treated as one user with sockpuppets."

Hope this helps. Brianhe (talk) 17:43, 27 July 2015 (UTC)

:Added {{U|Artesianvc}} per [//en.wikipedia.org/w/index.php?title=VentureCrowd&diff=668414647&oldid=668414329 this edit] less than 5 minutes apart from Smileverse's article creation of VentureCrowd. Brianhe (talk) 18:20, 27 July 2015 (UTC)

• {{ping|Smartse}} I will run the check, but is there a tie-in between this SPI and Wikipedia:Sockpuppet investigations/TejaswaChaudhary? If so, I don't recall it and I've worked on both SPIs.--Bbb23 (talk) 18:35, 27 July 2015 (UTC)
• Thanks. It's pretty tangental, but as I mentioned above both have written about William Benson. I couldn't spot any other links though. SmartSE (talk) 18:40, 27 July 2015 (UTC)
• Group 1 - The following accounts are {{confirmed}}:
• {{checkuser|1=Smileverse}}
• {{checkuser|1=DK833hj}}
• {{checkuser|1=Trei3782}}
• {{checkuser|1=Aljornien}}
• {{checkuser|1=Hill NC}}
• {{checkuser|1=Danielmathews72}}
• {{checkuser|1=Kpkarthikbe}}
• Group 2 - The following accounts are {{confirmed}}, and between {{unlikely}} and {{possible}} to Group 1:
• {{checkuser|1=Baligema}}
• {{checkuser|1=Dewimani}}
• {{checkuser|1=Esybukwd}}
• {{checkuser|1=Awdko00}}
• {{user2|Artesianvc}} is {{unrelated}} to Groups 1 and 2.
• Group 3 - The following accounts are {{possible}} to the {{user2|TejaswaChaudhary}} puppets. A behavioral analysis of the TejaswaChaudhary puppets and these accounts is needed.
• {{checkuser|1=Baligema}}
• {{checkuser|1=Dewimani}}
• {{checkuser|1=Rukuspukus}}
• {{checkuser|1=Awdko00}}
• --Bbb23 (talk) 23:45, 27 July 2015 (UTC)

• {{A note}} I've blocked group 1 as socks of Smileverse and group 2 as socks of Baligema. Maybe {{U|SmartSE}} can evaluate the behavioral link to see if they should be reclassified as TejaswaChaudhary socks, and then the case could be split of from here to the right target. —SpacemanSpiff 08:52, 30 July 2015 (UTC)
• Pinging the correct {{U|Smartse}}. —SpacemanSpiff 08:54, 30 July 2015 (UTC)
• Cheers. I'm not familiar with those socks, but they're clearly all undisclosed paid editors. Telling the groups apart is pretty much impossible though unless they edit the same articles. Maybe add a link to the TC case mentioning that they may be related, just for future reference. SmartSE (talk) 09:49, 30 July 2015 (UTC)
• On looking through the various accounts, behavioral evidence seems to look a lot like the technical evidence of just "possible", with the TC group. I'm marking for close now, unless the archiving CU/Clerk decides otherwise, this case can be split to Smileverse and Beligama for now. If clearer behavioral evidence comes up later Beligama can be merged to TC. —SpacemanSpiff 12:06, 30 July 2015 (UTC)
• {{clerknote}} {{ping|Bbb23}} Here, you said that Rukuspukus is Possible to the TejaswaChaudhary, but here you said that he is Confirmed. Which one is true? Vanjagenije (talk) 16:20, 30 July 2015 (UTC)

:*{{reply|Vanjagenije}} Good question but I'm not going to give you a complete answer as it's complex and I'm not comfortable disclosing the details. Let's simply say that the finding in this SPI supersedes the finding in the earlier report. I've removed the tag from the account but left the account blocked.--Bbb23 (talk) 22:27, 3 August 2015 (UTC)

• {{Requestandendorse}} - {{ping|Bbb23}} Can you check Artesianvc against Group 1? His editing history at VentureCrowd overlaps with that of Smileverse. Vanjagenije (talk) 22:47, 3 August 2015 (UTC)

:*{{reply|Vanjagenije}} Why? My finding above is the account is unrelated to Group 1.--Bbb23 (talk) 22:54, 3 August 2015 (UTC)

::*{{ping|Bbb23}} Oh, sorry. I thought that you didn't check him, because he was added to the list of suspects after your check. Vanjagenije (talk) 23:13, 3 August 2015 (UTC)

:::*{{reply|Vanjagenije}} Is there a reason why you haven't removed your CU endorsement? I'd remove it myself but I'm not sure what status you want the case to have.--Bbb23 (talk) 23:00, 4 August 2015 (UTC)

• {{ping|Bbb23}} I don't know either. Since Artesianvc was the only non-blocked account, I'm closing this. Vanjagenije (talk) 23:02, 4 August 2015 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=Adj48n}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Smileverse User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

The user discloses they are a paid editor. They uploaded an image from Binghampton Times which is a site that the socks had previously used a source of fake references (it is controlled by the master, see MediaWiki_talk:Spam-blacklist#binghamtontimes.com and MediaWiki_talk:Spam-blacklist#bangalorean.net). [https://en.wikipedia.org/w/index.php?title=Special:Undelete&target=VIIcode×tamp=20150817085308&diff=prev Here] they linked to Bangalorean.net via google news (that site's already blacklisted). SmartSE (talk) 09:52, 17 August 2015 (UTC)

:Note that I've already blocked them for advertising, but CU confirmation would be helpful to keep track. SmartSE (talk) 09:57, 17 August 2015 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{user2|Adj48n}} is {{likely}}. I've adjusted the tag to confirmed. Closing.--Bbb23 (talk) 08:30, 19 August 2015 (UTC)

----

• {{checkuser|1=Mindcap}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Smileverse User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

As I noted [https://en.wikipedia.org/w/index.php?title=Wikipedia:Articles_for_deletion/Matthew_C_Martino&diff=681476766&oldid=681475680 here] the domain thelajournal.com previously contained the same contact details as other fake references used by this group of socks. As can be seen [http://website.informer.com/email/contact.usanews@gmail.com here] the domain is now registered with the same email address as several other similar fake newspaper sites. Mindcap is already blocked per [http://website.informer.com/email/contact.usanews@gmail.com this thread] at COIN and in one of those articles several of the domains listed in the previous link are referenced. I hope this is sufficient to justify a CU on Mindcap in order to see whether there are other accounts still being used. SmartSE (talk) 21:32, 20 October 2016 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• It's been a long time, but Mindcap is {{unlikely}} Smileverse.--Bbb23 (talk) 12:16, 21 October 2016 (UTC)
• Nothing more to do. Closing. Kevin (aka L235 · t · c) 19:48, 25 October 2016 (UTC)

----

• {{checkuser|1=Riturajsim}}
• {{checkuser|1=Rahulgirnar}}
• {{checkip|1=111.93.133.74}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Smileverse User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

As with prior practice, a brand new account with similar naming features appears at a PRODded Smileverse creation to attempt to add referencing. This article has been created by the master & repeatedly groomed by suspected socks (incl Bangalore IP 111.93.133.74). Compare CU confirmed sock [https://en.wikipedia.org/w/index.php?title=Mark_Leigh&diff=prev&oldid=670359057 "Added notable references"] to new acct Rahulgirnar [https://en.wikipedia.org/w/index.php?title=Capital_Float&diff=prev&oldid=789445377 "...Added more authentic sources..."]. Similar to how sources had been added earlier by new user Riturajsim: [https://en.wikipedia.org/w/index.php?title=Capital_Float&type=revision&diff=752113499&oldid=751201534] immediately after article was tagged for notability. Expect that the new account will also de-PROD soon. Bri (talk) 16:48, 7 July 2017 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{checkuser|Singhalamit22}}
• {{checkuser|Rehanaparveen}}
• {{checkuser|Mouris_Bashir}}
• {{checkuser|Kasheeraz}}

These accounts along with the two listed by Bri also worked in tandem on AuthBridge, Draft:AuthBridge Research Services, Authbridge research services, Ajay Trehan, Mr. Ajay Trehan.
 — Berean Hunter (talk) 02:22, 9 July 2017 (UTC)

Accounts indeffed, IP blocked. Leaving open for further review.
 — Berean Hunter (talk) 02:28, 9 July 2017 (UTC)

• Closing. GAB^gab 14:51, 14 July 2017 (UTC)

----

• {{checkuser|1=RockzSandy}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Smileverse User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Returns to start the previously deleted article, Capital Float, by the master, information and sources are unchanged in advertising and this new account is equally obvious in advertising-only. SwisterTwister talk 04:39, 20 August 2017 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Looks technically {{unrelated}}. Callanecc (talk • contribs • logs) 10:28, 21 August 2017 (UTC)

{{User:Sro23/ClerkAtWork}}

• Closing with no action. Sro23 (talk) 03:11, 1 September 2017 (UTC)

----