Wikipedia:Sockpuppet investigations/Jafaz/Archive

Jafaz

Jafaz (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

07 March 2022

Suspected sockpuppets

• Koraduba (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

This is an account created 2 years ago whose first edit was today to create a userpage and !vote on Wikipedia:Articles for deletion/Russian fascism (ideology), the same page that Jafaz and CU-blocked sock Adam Darque (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) were focusing on.

The similarity to Adam Darque gives me probable cause to suggest the account is a sockpuppet. Asking for CU for confirmation as was done with Adam Darque. EvergreenFir (talk) 16:19, 7 March 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

• CU data isn't going to be helpful here. The edits are coming from a different country from the previous ones; then again, their first edit was to their userpage, asserting that they have left Ukraine as a refugee, so if they are the same person one might expect the edits to be coming from a different country. Certainly they don't look like a new user, but behavioural evaluation would be needed to make the connection, which with just one substantive edit is tricky. Girth Summit _(blether) 17:08, 7 March 2022 (UTC)
• I agree this is probably not a new user, but with just one edit, not worth investing any effort. Closing. -- RoySmith (talk) 17:28, 16 March 2022 (UTC)

---

10 March 2022

Suspected sockpuppets

• Tsans2 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• 91.192.183.13 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• EricLewan (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Jafaz is a known sockmaster who has been banned indefinetly on 6 March for this reason. As for their behaviour, the user has repeatedly tried to POV-push idea that "Z" is a symbol of Russian fascism at the Russian fascism (ideology) article ([1], [2]). Jafaz is also known for editing numerous versions of Wikipedia (see my comment here).
On 10 March, Tsans2 also pushed this POV in the same article on multiple versions of Wikipdia (at WP en: [3]; WP ca: [4]; WP pt: [5]; WP uk: [6], WP ro: [7]).
An IP on the Spanish Wikipedia version of Russian fascism (ideology) also pushed this POV on 10 March ([8]).
On 3 March, EricLewan also tried to POV-push this opinion at the Russian fascism (ideology) article ([9]).
This really look like WP:DUCK to me. Veverve (talk) 18:50, 10 March 2022 (UTC)

It seems both Jafaz ans Tsans2 both have a strange way of speaking English, likely due to it not being their native language. Tsans2: [10], [11]; Jafaz: [12]. Veverve (talk) 22:32, 11 March 2022 (UTC)

Romesea (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), just like Koraduba mentioned in the previous investigation, is an account created recently whose sole and first contributions are to defend the existence of the Russian fascism (ideology) article at its AfD; see [13] and [14]. This of course is not enough to prove suckpuppeting, but it is still to be noted. Veverve (talk) 21:36, 12 March 2022 (UTC)

On 11 March, Tsan2 added back the unsourced claim the "Z" is a symbol of Russian Fascism on WP ca after it had been removed. Veverve (talk) 18:15, 17 March 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

•  In progress - -- RoySmith (talk) 22:25, 10 March 2022 (UTC)
• On the raw CU data, Tsans2 is  Possible and EricLewan is  Unlikely, but there's indication of proxy use for both, so  Inconclusive is probably a better call.  Behavioural evidence needs evaluation -- RoySmith (talk) 22:36, 10 March 2022 (UTC)

  PS, FWIW, EricLewan is the oldest account. -- RoySmith (talk) 22:37, 10 March 2022 (UTC)

• I came back and took another look, including running a check on Romesea, who is  Unrelated. This is obviously a topic which attracts much attention right now, so it's not surprising that multiple people might be pushing the same viewpoints. Nor is it surprising that editors from Russia might not be totally fluent in English. I don't see any particular reason to believe any of the accounts listed here are socks, and the CU data supports that, so I'm going to close this. -- RoySmith (talk) 14:45, 19 March 2022 (UTC)

---

03 December 2022

Suspected sockpuppets

• Vitaliif235 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Jafaz vas known as Vitalyf261 before being renamed; the new account is again interested in East European topics. Ymblanter (talk) 19:09, 3 December 2022 (UTC)

@Ymblanter I'm trying to understand the history better. Do you have a log entry for the rename? -- RoySmith (talk) 21:43, 4 December 2022 (UTC)

Not immediately, I guess it was done centrally on Meta, but I have this diff. Ymblanter (talk) 21:50, 4 December 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• CheckUser requested - there should be data in the logs for this one. —‍Mdaniels5757 (talk • contribs) 21:05, 4 December 2022 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

• Vitaliif235 is  Confirmed, along with
  • Uliana245 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  -- RoySmith (talk) 22:43, 4 December 2022 (UTC)

---

30 December 2022

Suspected sockpuppets

• Janeznaju (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

New account, created four days ago, a few days after the last known sock of Jafaz was blocked. Aggressive, when an article was moved to draft moved it back. Interest only in Ukrainian topics, mainly in Ukrainian language similar to that of Jafaz. Removal of Russian name of a predominantly Russian-populated locality here. Also, poor command of English, visible, for example, here. Ymblanter (talk) 22:25, 30 December 2022 (UTC)

On the other hand, they also moved Ivano-Frankivsk Municipality which was previously moved and edited by two socks of Dolyn. I think I will block them now anyway, too much disruption. Ymblanter (talk) 08:15, 31 December 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Also I can see that they have jumped immediately into creating articles translated from Ukrainian Wikipedia such as Calendar reform in Ukraine as Jafaz would do and expanding the article Derussification in Ukraine created by a previous sock. Clearly not a new user anyway. Mellk (talk) 22:55, 30 December 2022 (UTC)

This account also expanded Deliatyn (expanded by Jafaz and sock Uliana245), Roman Ratushnyi (created by sock Uliana245), Orthodox Church of Ukraine (expanded by Jafaz), Kastuś Kalinoŭski Regiment (edited by Uliana245), Columns of Gediminas (edited by Jafaz). Mellk (talk) 01:44, 31 December 2022 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

• CheckUser requested - per above to try and figure out which master this account belongs to. Callanecc (talk • contribs • logs) 00:06, 1 January 2023 (UTC)
•  In progress - -- RoySmith (talk) 14:57, 1 January 2023 (UTC)
• Janeznaju is  Confirmed to Jafaz.  No sleepers immediately visible -- RoySmith (talk) 15:05, 1 January 2023 (UTC)

---

12 February 2023

Suspected sockpuppets

• Ті що хдуть (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

New account created several days ago, about a month after the last sockpuppet User:Janeznaju was blocked. That sock created the article Calendar reform in Ukraine (now deleted) and this account also makes the same edits in the same area. For example adding to Orthodox Church of Ukraine#Calendar like the previous sock did.[15][16] Also created the article Eustratius (Zoria) and moved it from draftspace to mainspace, and also expanded the article Stauropegion of the Ecumenical Patriarchate in Ukraine which was created by Jafaz.[17] Mellk (talk) 00:39, 12 February 2023 (UTC)

Also the same focus on transliterations.[18][19] Mellk (talk) 08:03, 12 February 2023 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

•  Blocked and tagged  Global lock(s) requested, closing. DatGuy^Talk_Contribs 16:55, 12 February 2023 (UTC)

---

10 April 2023

Suspected sockpuppets

• JimSeUa (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

A new account that has jumped straight into the same topics that Jafaz and their socks edited. The last known sock User: Ті що хдуть was blocked in February. Their very first edit was on Holodomor genocide question [20]. Interestingly the last known sock's very first edit was on Holodomor in modern politics making the same type of edit[21] and their second edit was also on Holodomor genocide question making the same kind of edit[22]. Their second edit[23] was to Deliatyn settlement hromada which Jafaz and their previous account User:Adam Darque edited multiple times over the years and related pages. See also the history of Deliatyn for example, they focus on this particular settlement. They created the article Verkhovyna settlement hromada which they quickly moved from draftspace to mainspace. They also make an edit to List of villages in Ivano-Frankivsk Oblast which Jafaz made an edit before. They then expanded Derussification in Ukraine and Derussification both created by the sock User:Uliana245 and expanded by previous socks.[24][25] They also focus on Ukrainian church articles about the calendar[26] that Jafaz and all their socks were interested in, compare for example [27] with the last known sock. This account also heavily edits Ukrainian Wikipedia and other language wikis just like the previous accounts on the same topics. Mellk (talk) 14:24, 10 April 2023 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

• JimSeUa is  Likely -- RoySmith (talk) 15:39, 10 April 2023 (UTC)
•  Blocked and tagged,  Global lock(s) requested, closing. Thanks, Spicy (talk) 20:49, 10 April 2023 (UTC)

---

09 June 2023

Suspected sockpuppets

• 95.47.59.245 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 92.253.239.82 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

The last known sock of Jafaz was blocked a couple months ago. The IP 95.47.59.245 created the article uk:Закон України «Про засудження та заборону пропаганди російської імперської політики в Україні і деколонізацію топонімії» on the Ukrainian Wikipedia and added interlanguage links to it in the article Derussification in Ukraine which was created by the sock Uliana245 (talk · contribs) and worked on by other socks. This IP also made a lot of similar edits on other projects, especially Russian Wikipedia and Ukrainian Wikipedia, just like Jafaz and the socks.

Another IP 92.253.239.82 also made edits on church calendars (Revised Julian calendar) which Jafaz and the socks focused on. Compare for example edits on Orthodox Church of Ukraine created by Jafaz by the IP [28] and [29] by sock JimSeUa (talk · contribs) and [30] by sock Ті що хдуть (talk · contribs) and [31] by sock Janeznaju (talk · contribs). This IP also makes similar edits on other wikis (especially Ukrainian and Russian). Also similar edits on Holodomor in modern politics and Holodomor genocide question e.g. [32][33] which was a focus of socks[34][35][36] These edits are practically identical. Mellk (talk) 08:42, 9 June 2023 (UTC)

Also looking at the range 95.47.59.0/24 there are large edits on articles created by socks such as [37] on Russian occupation of Crimea created by sock Uliana245 and [38] on Demolition of monuments to Alexander Pushkin in Ukraine created by sock Uliana245 after the sock Uliana245 was blocked and globally locked but before other known socks were created. Also edits[39] (about Pushkin monument, what a coincidence) on Deliatyn by IP 95.47.59.249 (not long after one sock was blocked and before another was created) that Jafaz and socks focused on[40][41][42]. Mellk (talk) 08:49, 9 June 2023 (UTC)

Also the uk.wiki user page of Jafaz says they study at the Ivan Franko National University of Lviv which may explain why the IP 92.253.239.82 geolocates to Lviv by the university, and they said they are a native of Galicia, where 95.47.59.x IPs geolocate to nearby Ivano-Frankivsk in the same region. Mellk (talk) 09:57, 9 June 2023 (UTC)

Also another Lviv IP 92.253.238.211 that made large edits including on articles previously edited by Jafaz and socks such as Zarichchia, Nadvirna Raion, Ivano-Frankivsk Oblast after a sock was blocked. Mellk (talk) 09:28, 10 June 2023 (UTC)

(Turns out there was another sock User:Їжак2022 which was globally locked on 25 April and they were warned about continuing to make socks on uk.wiki). Mellk (talk) 05:16, 23 June 2023 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

• Neither IP has edited in a while. Closing. Bbb23 (talk) 12:23, 16 July 2023 (UTC)

---