Jump to content

Wikipedia:Sockpuppet investigations/Çelebicihan

Add links
From Wikipedia, the free encyclopedia
< Wikipedia:Sockpuppet investigations

This is an old revision of this page, as edited by Blablubbs (talk | contribs) at 12:16, 5 April 2021 (set case status to |completed). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Çelebicihan

Çelebicihan (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Populated account categories: confirmed · suspected

For archived investigations, see Wikipedia:Sockpuppet investigations/Çelebicihan/Archive.

This SPI case may involve cross-wiki abuse. Please consider reporting the results on Meta; checkusers can send an email to the interwiki checkuser mailing list if required.



20 March 2021

– A checkuser has completed a check on relevant users in this case, and it is now awaiting administration and close.

Suspected sockpuppets


Recreation of Svitlana Bevza at Bevza Svitlana. We haven't seen this sockpuppeteer in a while, and this account suggests the tactics, techniques and procedures have changed. MER-C 15:27, 20 March 2021 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • Dear @Blablubbs, what do you mean by putting me here in that list? I read the section Defending yourself against claims and feel good as I didn't violate any of the wikipedia rules. But I'm pretty much confused of your statement "The following accounts are on the same connection". Can you please explain what is "the same connection"? To make things clear I state that I don't know any of the mentioned accounts. However, I do see that some of them have edited English wikipedia articles about politicians related to Ukraine. Is that the case or something else? I ask you and anyone else to remove any suspicions from me. And if possible to explain what do I violate. If it can help, I live in Ukraine and edit from here. @TonyBallioni - thank you for suggesting a deep look. It all looks strange.

P.S. in order to facilitate the process of discussion I ping here the accounts and ask them to explain what they could do wrong. @Breaking Sir, @Braduman, @Tarabono00, @Inkitrinky, @Inger Berg18, @Pestrolim, @Pysatel, @Olga Malozhvanets, @Nameitgood --Щіпальця (talk) 09:22, 23 March 2021 (UTC)[reply]

thank you for explaining @Blablubbs. So, that is a question for me too, why @TonyBallioni put me on a list. If same connection means same IP - why TonyBallioni didn't state that clearly? Talking about IP, I'm sure enough it is a mistake as I use it from my mobile phone (and it provides a dynamic IP). My brothers and sisters don't edit or create wikipedia profiles. Maybe my IP range is in a blacklist or something? Can I ask someone else to investigate the results of the CU too? --Щіпальця (talk) 13:31, 23 March 2021 (UTC)[reply]
@Blablubbs, your last sentence made me frustrated. You pointed below: I do note that all of the accounts listed certainly do have an interesting familiarity with Wikipedia for new users, and an interesting fascination with promoting things across multiple wikis for users who have no relationship to one another. I didn't get your point at all. It seems like you want to accuse my behaviour or myself of violationg some wikipedia rules :( Let's wait the checkuser who could explain what he/she meant by "the same connection". --Щіпальця (talk) 14:03, 23 March 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

Please examine cross-wiki behaviour before blocking. I'm not confident enough to block any of these accounts with doing a deep dive through other projects, and I don't have the time for that right now, so reporting and letting clerks and patrolling admins look at it. TonyBallioni (talk) 19:38, 20 March 2021 (UTC)[reply]
  • Щіпальця, I have moved your comment again. Please put new ones in the "comments by other users" section. I do note that all of the accounts listed certainly do have an interesting familiarity with Wikipedia for new users, and an interesting fascination with promoting things across multiple wikis for users who have no relationship to one another. Blablubbs|talk 13:41, 23 March 2021 (UTC)[reply]
  • I don't see any behavioral evidence for Щіпальця socking. Inger Berg18 is a bit odd: all those useless spaces, that's often someone who tries to get autoconfirmed, but it wasn't enough edits and they stopped, so I don't know what to make of it. Mind you, I have not looked at the CU evidence and see no reason to. I don't know what the IP/IP range is; it might well be a location that explains similar interests. Drmies (talk) 16:14, 23 March 2021 (UTC)[reply]
    • Drmies, they are inserting the same promotional material about the same person into wikis in 3 languages uk, ru, en while demonstrating pretty good proficiency with Wikimarkup for someone who registered two weeks ago – given that this a UPE sockmaster and the other accounts demonstrate similar patterns for similar people (e.g. nameitgood on ru, pl, en; Pestrolim on eo, cy and be), I'm a tad bit suspicious here. Blablubbs|talk 16:34, 23 March 2021 (UTC)[reply]
      • I haven't looked at the other wikis, but I'll take your word for it. Sorry, but I don't know what UPE stands for. I'm suspicious too, but I don't see any evidence for Щіпальця on the en-wiki, that's all I'm saying. IngerBerg, I just looked at their global contributions, and that seems to be a case of paid editing on the ru-wiki, so maybe my "they're trying to get autoconfirmed" makes even more sense. But I do not have experience or expertise here. MER-C is probably better at this here. BTW I have no idea why Щіпальця pinged me. Drmies (talk) 16:41, 23 March 2021 (UTC)[reply]
        • Drmies, UPE is "undisclosed paid editing" in this context – there is indeed a lack of overlap both here and xwiki, but they all have the same MO (at least the ones that have enough edits for me to be able to tell): Creating spammy pages about Ukranian people and entities on wikis where they don't exist and inserting identical promotional content into existing articles. They seem to segregate topics by account, which accounts for the overlap, but the xwiki pattern, coupled with the CU results, makes me hear avian noises here. Blablubbs|talk 16:49, 23 March 2021 (UTC)[reply]
  • @Щіпальця: apologies for any stress. You shared an IP with one of the accounts listed above and had a relatively similar (but common) device. I listed you here because there was enough of a technical connection to list it, but not enough to block. This is a Common way en.wiki handles cases like this, especially when the CheckUser doesn't want to get involved with the behavioural evidence. I re-ran the check on you, and while the technical connection I mention above does exist, I would say it is not the most likely one.
    Also, to be clear, I felt saying "same connection with different device" was probably the most clear I could be. I specifically didn't use any of the SPI templates because I wanted to be as precise as I could. More clarity would be: you share one IP with 4elopuck, but that is separated by time, and the useragent is different. The useragent difference is easily explainable, though, so because of the overlap and the large number of accounts on other IPs with 4elopuck, as well as the limited number of IPs that account used, your account was reported here so that a behavioural investigation could occur. TonyBallioni (talk) 00:18, 26 March 2021 (UTC)[reply]
  • This case is being reviewed by Blablubbs as part of the clerk training process. Please allow him to process the entire case without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate.
    Whew, that was a fair bit to wade through. I'm confident that these accounts are part of an organised UPE effort: The MO is xwiki promotion, usually of Ukranian entities; new articles are created and existing ones are rewritten and "brought in line". For some, there is insufficient evidence to block (except if someone wants to do so based on CU results and the fact that e.g. Pysatel seems to be engaged in promotional editing elsewhere ([1]). The accounts where I did find evidence of being part of the same sockrings are
  • Tarabono00 and Inkitrinky; both have been involved in xwiki promotion: Compare es vs. en; the version that Tarabono created on eswiki ([perma), was brought in line on en by Inkitrinky, see [2].
  • Nameitgood has also been involved in xwiki promotion: PL: [3][4][5] EN: [6] RU:[7])
  • Shipalzya (Щіпальця) promoted Ihor Umansky on uk, ru and en.
  • Pestrolim created, or attempted to create, articles about Igor Cherezov on eo, cy and be.

The rest of the farm follows the same xwiki pattern; see e.g. the master here, here and here. There are some formatting quirks that all these accounts have (BEANS) that serve as additional evidence of socking. Pink clock Awaiting administrative action – please block Tarabono00, Inkitrinky, Nameitgood, Щіпальця and Pestrolim. Thanks and best, Blablubbs|talk 19:04, 4 April 2021 (UTC)[reply]

Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=Wikipedia:Sockpuppet_investigations/Çelebicihan&oldid=1016105964"