Jump to content

Wikipedia:Sockpuppet investigations/Highstakes00/Archive

Add links
From Wikipedia, the free encyclopedia


Highstakes00

Highstakes00 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
28 July 2012[edit]
Suspected sockpuppets

Exact same style of writing as Highstakes00, this is quite telling[1] Highstakes00 also used just darkness when referring to me. Highstakes also stalked me incessantly, the chances of a "new editor" finding such a new article seems slim to me. Darkness Shines (talk) 14:17, 28 July 2012 (UTC)[reply]

  • Further, he has now turned up at another article[2] I edit and which Highstakes00 also took an interest[3] Darkness Shines (talk) 18:50, 28 July 2012 (UTC)[reply]
  • Also this IP[4] was recently blocked by DQ as a sock, however Highstakes00 has used proxies and edited via webhosts before. Darkness Shines (talk) 18:53, 28 July 2012 (UTC)[reply]
  • Minar-e-pakistan has been edit warring on Cinema of Pakistan an IP same range and ISP as the one blocked by DQ as a sock has also edited that article.[5] Darkness Shines (talk) 19:48, 28 July 2012 (UTC)[reply]
Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I found the articles from your contributions list. You are anti-pak person. Stop damaging Pakistan pages and stick to your speciality in rape pages. Minar-e-pakistan (talk) 19:17, 28 July 2012 (UTC)[reply]
Well funnily enough that is what Highstakes00 did as well. Darkness Shines (talk) 19:24, 28 July 2012 (UTC)[reply]
So I guess highstakes and me the only two people on wikipedia to know about contributions list. Nice proof. Minar-e-pakistan (talk) 19:35, 28 July 2012 (UTC)[reply]
No but your excuses are just as bad as each others, if you got to those articles via my contributions list how do you explain getting here[6] which was actually our first interaction. Darkness Shines (talk) 20:30, 28 July 2012 (UTC)[reply]
Clerk, CheckUser, and/or patrolling admin comments[edit]

 Inconclusive. This will need to be determined via behavioral evidence. --MuZemike 20:37, 28 July 2012 (UTC)[reply]

  • I've blocked Minar-e-pakistan as sock of Highstakes00 due to behavioral evidence that strongly links the two. Dennis Brown - 2¢ © Join WER 14:25, 1 August 2012 (UTC)[reply]
20 January 2015[edit]
Suspected sockpuppets


Very bad in English. Pointing that how he came "first"[7],[8] obsessed with edit warring over maintenance tags[9][10] [11][12] with WP:TWINKLE software. Often misspelled "don't" as "dn".[13] [14] Previous SPI and block of last sock was based on behavioral similarity. OccultZone (Talk • Contributions • Log) 14:53, 20 January 2015 (UTC)[reply]

Highstakes00 had abused an IP for edit warring, like we can view in the archive.[15] In those days he had abused an IP(39.47.46.80[16] [17]) and during the last month, he was alleged by other editor to have abused an IP(223.29.225.35[18][19]) on Battle of Chawinda, both of these IPs comes from Islamabad[20][21], even the latitude(33.69) is same. OccultZone (Talk • Contributions • Log) 16:06, 20 January 2015 (UTC)[reply]
Pinging RegentsPark, Floquenbeam, who dealt with him before. OccultZone (Talk • Contributions • Log) 16:06, 20 January 2015 (UTC)[reply]
@Mike V: If you agree that 39.47.46.80 (talk · contribs · WHOIS) was blocked because Highstakes00 was socking, you must know that from yesterday, same kind of dynamic IP[22] is now changing the results of 2001–02 India–Pakistan standoff and Battle of Chawinda(where TheSawTooth was mostly active).[23][24] Why it couldn't be done before? Why it was only yesterday when TheSawTooth actually got back after 18 days? Also if you read the conversations that are made by Highstakes00 and TheSawTooth, you would find them very sloppy, it looks like that same person is speaking. And the evidence above, that he always point out how he came "first", and misspells "don't" as "dn". OccultZone (Talk • Contributions • Log) 04:39, 21 January 2015 (UTC)[reply]
He has abused his IP also on Operation Zarb-e-Azb, for edit warring.[25][26][27][28][29] Just like Highstakes00 did.[30][31][32] [33] [34] His tendency is to edit war with an IP address, whenever he would find himself near violating WP:3RR. OccultZone (Talk • Contributions • Log) 04:50, 21 January 2015 (UTC)[reply]
With this account and mostly with IPs, he was edit warring with Saadkhan12345[35][36][37] and Krzyhorse22[38] on Operation Zarb-e-Azb, he wasn't reverting the edits of any other editor like Faizan,[39] maybe because Faizan had disagreements with SaadKhan and Kryzyhorse. OccultZone (Talk • Contributions • Log) 05:55, 21 January 2015 (UTC)[reply]
Needlessly capitalizing words[40],[41][42] he consider "removal" to be same as "delete".[43],[44][45] OccultZone (Talk • Contributions • Log)
Has made objectionable edits on a number of pages, where he's sure that his edit would be removed quickly[46][47][48], such as Operation Dwarka[49], [50], Gilgit–Baltistan[51][52] and others, even with an IP he misspells "don't" as "dn"..[53] OccultZone (Talk • Contributions • Log) 05:55, 21 January 2015 (UTC)[reply]
Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]
  • I got the ping above, but I'm afraid I'm of no use; I evidently blocked Highstakes00 indef back in 2012, but I don't recall any of the details. Sorry. --Floquenbeam (talk) 22:29, 20 January 2015 (UTC)[reply]
  • The checkuser data is stale for the past accounts, so a check can't be performed. I don't think the evidence presented is strong enough to make a block based upon behavior. Mike V • Talk 04:32, 21 January 2015 (UTC)[reply]
    • Thanks for providing additional evidence. I'll take a further look tomorrow. Mike V • Talk 04:53, 21 January 2015 (UTC)[reply]
  • I haven't much to contribute directly and, unfortunately, @Darkness Shines: is no longer with us though @Salvio giuliano: might have something to say. The Battle of Chawinda has been a battle zone so socks are definitely likely and OccultZones evidence, though circumstantial, does seem compelling on the face of it. The editing pattern, the language, all seem similar. --regentspark (comment) 13:36, 21 January 2015 (UTC)[reply]
  • I've looked over the diffs provided and I now think it's likely that TheSawTooth is a sock of Highstakes00 and I've blocked the account. Mike V • Talk 18:14, 21 January 2015 (UTC)[reply]
20 March 2015[edit]
Suspected sockpuppets


I've been watching this for a while now and I was told that Saladin1987 is a sock of somebody from Brisbane. It is not really an evidence because URLs are often copied by other editors and they don't care about changing the domain extension. Saladin1987 reminds me of Highstakes00 and TheSawTooth. Similarities:-

Looks like I had completely forgotten that Highstakes00 had range of IP addresses that even CU had considered one of his sock to be unrelated with the master. I will try coming up with more evidences. OccultZone (Talk • Contributions • Log) 15:45, 20 March 2015 (UTC)[reply]
"*Summary or conversation, would write in caps.[63][64]
  • I had started this SPI only for stopping the disruption and for highlighting the similarities. I would like to withdraw this SPI in the light of this version/warning. Since my major aim was to stop disruption, I am also very sure that there are better boards to discuss this problem. Thanks. OccultZone (Talk • Contributions • Log) 17:11, 21 March 2015 (UTC)[reply]
Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Saladin1987 is unlikely to be Highstakes00 based on location. According to the previous SPI, it suggests that Highstakes00 is editing from Islamabad, Pakistan, but Saladin is located on a different continent (I believe). This is direct evidence, and since I'm not allowed to name the operator of the Islamabad IP (or Highstakes00), I'll leave it at that.--Krzyhorse22 (talk) 20:01, 20 March 2015 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

 Clerk note: Some preliminary comments. A CU may only be run against SawTooth, who is not a confirmed puppet. Saladin1987 and Mar4d were mentioned in a previous SPI Wikipedia:Sockpuppet investigations/Lagoo sab/Archive#20 November 2014 opened against Krzyhorse22. Mar4D is the oldest account (among Highstakes and Saladin). There is a short report on Mar4d at Wikipedia:Sockpuppet investigations/Mar4d.--Bbb23 (talk) 14:54, 20 March 2015 (UTC)[reply]

  • @OccultZone: without better evidence, I'll decline the CU. The thanx and bro stuff is almost useless as it's hardly distinctive, and the Pakistan evidence isn't much better. There are some very distinctive stylistic characteristics by the editors if you want to try to find more compelling evidence of that nature. Also, can someone please give me diffs of the Brisbane connection rather than just saing it?--Bbb23 (talk) 15:01, 20 March 2015 (UTC)[reply]
  • @Mar4d: I've removed your comment. This SPI is not going to devolve into the same morass of accusations that the Lagoo sab did. There was no evidence presented at the time that Krzyhorse22 was a sock of Lagoo sab: "Furthermore, from previous Kryzhorse interactions on an administrative level, I can tell you there is no evidence in CU to indicate abuse of multiple accounts."--Bbb23 (talk) 15:27, 20 March 2015 (UTC)[reply]
  • Mar4d and Krzyhorse22, I have removed all of your comments from this SPI. This is now an official warning. Neither of you is permitted to comment at this SPI unless it is in support of the allegation that Saladin1987 is a puppet of Highstakes00 or direct evidence that Saladin is not a puppet of Highstakes. Don't rope in other alleged masters. I will remove any comments that I determine are not within these boundaries, and depending on the comment, you also risk being blocked.--Bbb23 (talk) 17:55, 20 March 2015 (UTC)[reply]
  • @OccultZone: The all caps diffs are not compelling. Saladin uses caps a lot in that edit. Highstakes uses them in a brief, angry edit summary (not uncommon). The imporper capitalization after a period looks more like carelessness and impatience than anything else. Both speak poor English, which makes stylistic similarities tough to dredge up. They also write like they're texting, or at least Saladin does.--Bbb23 (talk) 21:06, 20 March 2015 (UTC)[reply]
  • Withdrawn by filer. Bbb23 (talk) 18:56, 21 March 2015 (UTC)[reply]

30 November 2015[edit]

Suspected sockpuppets

Khocon has disclosed that they are a paid editor on some articles but seemingly not for others. They wrote James Stunt which had all the hallmarks of paid editing and after a clean up by User:Variation 25.2, Skinssnapper appeared to restore the promotional version and today disclosed that they are being paid. They've both removed {{coi}}: [69] [70] [71]. Skinssnapper claims to be "new" and yet edits like [72] and hiding {{coi}} with <!-- --> suggest otherwise. SmartSE (talk) 21:28, 30 November 2015 (UTC)[reply]

Comments by other users[edit]

Thanks for the report. I'v never used the accounts mentioned above or IP(s). I always try to use my main account.

I stoped edit warring. I have no COI with the subject (James Stunt). He is a UK based billionaire. I was attracked by his life-style. Thanks for the help. --Khocon (talk) 04:43, 1 December 2015 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

The following accounts are  Confirmed to each other and to Shaleen97 (talk · contribs · count):

I'm not convinced that there isn't any meatpuppetry going on, but I don't think it's bad enough to block at this time. SmartSE (talk) 21:51, 1 December 2015 (UTC)[reply]

28 January 2016[edit]

Suspected sockpuppets

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

06 February 2016[edit]

Suspected sockpuppets

Page hijacking is ongoing, see discussions at User talk:Philg88#Weird page moves and User talk:Jenks24#The move shenanigans continue!. I've already blocked this account, but I'm taking it here because I think it would be useful to have a CU take a look to see if there are any accounts that we've missed. Jenks24 (talk) 14:53, 6 February 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  • The following accounts are  Confirmed:
Laek Shiri (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Sehry Riene (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
See See Saa Saa (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Venusmarsjupitor (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Rskauk (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
77jj (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Sonia 96i (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Rskauk (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Tikesse (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Mike V • Talk 16:58, 6 February 2016 (UTC)[reply]

06 May 2016[edit]

Suspected sockpuppets

Subtle page hijacking for spam continues. This account is already blocked but I'd appreciate a CU taking a look because previously this person has used a lot of sleepers. Jenks24 (talk) 13:51, 6 May 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

16 September 2016[edit]

Suspected sockpuppets[edit]

This is the exact same tactic used by the previous socks to introduce spammy articles. The previous accounts will be stale, but can we check for any other socks? SmartSE (talk) 14:25, 16 September 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

29 December 2016[edit]

Suspected sockpuppets[edit]


Clerk filing: updating case with recently blocked socks. Ivanvector (Talk/Edits) 15:07, 29 December 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I added User User:Carll253 to the list of accounts, because Jun3 redirected to that account.

I have reported three cases that I am told involve Highstakes00 socks:

In each of these cases, I observed some specific actions that seemed very similar. I thought I'd put the details here for the record.

On a disambiguation page:

  1. The editor removes the disambiguation template from the page.
  2. The content of the page is replaced with a basically complete article that has nothing to do with the dab page title or its entries. This is a cut-and-paste from the user's space, a user sandbox, or a draft article.
  3. The page is then moved to a whole new title.
  4. The redirect left behind is retargeted to one of the entries that had been on the dab page.

I hope this is useful. — Gorthian (talk) 04:46, 30 December 2016 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • @Ivanvector: I said that America Sal and Ranke8 were confirmed socks of each other. I never said they were connected to anyone else. I said nothing about Jcun3. Regardless of the misunderstanding, do you want me to check to see if the three accounts (+ Aneetir) are related to Highstakes?--Bbb23 (talk) 15:33, 29 December 2016 (UTC)[reply]
Corrected, thanks, I'll adjust my tags after this edit. In my opinion, the activities of these accounts are unique enough to call them "proven" to the master, unless there's very strong technical evidence to the contrary. Please do check the three accounts (+Aneetir and -Jcun3 which is stale). Ivanvector (Talk/Edits) 15:53, 29 December 2016 (UTC)[reply]
  • Aneetir is  Confirmed to Highstakes00.
  • Ameria Sal and Ranke8 are  Possible to Highstakes00. The Highstakes00 socks used nothing but webhosts. That includes Aneetir. Ameria Sal and Ranke8 used a legitimate ISP. At the same time, the user agents used by the Highstakes00 socks, Ameria Sal, and Ranke 8 are the same.
  • No other accounts seen.--Bbb23 (talk) 00:48, 30 December 2016 (UTC)[reply]
Tags updated. @Gorthian: thanks for the description of the master's behaviour, I see that it wasn't actually documented within the case yet. I am leaving Carll253 alone, the account doesn't quite match the pattern and hasn't edited in over a year; Jcun3's redirect is suspicious but it could be deliberate obfuscation. Closing. Ivanvector (Talk/Edits) 11:50, 30 December 2016 (UTC)[reply]

13 January 2017[edit]

Suspected sockpuppets[edit]


Same type of page hijacking vandalism reported before; the target this time was Dimoline, which was moved to Flick Law Firm. Mackensen (talk) 14:17, 13 January 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

16 January 2017[edit]

Suspected sockpuppets[edit]


Same pattern as I documented on December 29:

  1. Template removed from dab page Yasukawa.
  2. Content of dab page replaced.
  3. Dab page moved to Xonex Capital.
  4. Leftover redirect Yasukawa was redirected to one of the dab page entries.

I have posted a request at WP:ANI#Hijacked page to have the dab page and history restored. — Gorthian (talk) 01:49, 16 January 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Blocked and tagged. GABgab 02:20, 16 January 2017 (UTC)[reply]

26 January 2017[edit]

Suspected sockpuppets[edit]


Evidence can be found here: Wikipedia:Administrators' noticeboard/IncidentArchive944#Hijacked dab page Çağdaş. — Gorthian (talk) 21:26, 26 January 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

 Confirmed, blocked, tagged, closing.--Bbb23 (talk) 23:21, 26 January 2017 (UTC)[reply]

05 February 2017[edit]

Suspected sockpuppets[edit]

Exactly the same behavior as in earlier cases. Too stale for checkuser. Details are at Wikipedia:Administrators' noticeboard/Incidents#Hijacked dab page Kaisermühlen — Gorthian (talk) 03:49, 5 February 2017 (UTC)[reply]

Adding that Doleit claims to be "Chianan Yen" on photo uploaded for article; that name is also in the EXIF. — Gorthian (talk) 04:35, 5 February 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Added four blocked accounts subsequently mentioned in the above ANI thread. MER-C 04:24, 7 February 2017 (UTC)[reply]

Requested CU to check for sleepers/other accounts we've missed. SmartSE (talk) 09:16, 7 February 2017 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

14 February 2017[edit]

Suspected sockpuppets[edit]

Identical recreation of Back4App (variation), originally created by MissAdalie. Also added another user who created Draft:Back4App, though not identical, it is virtually the same. Chrissymad ❯❯❯ ¯\_(ツ)_/¯ 14:35, 14 February 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

@Chrissymad: how does this tie to Highstakes00? MissAdalie is tagged as a possible sock of Khocon. Am I missing something? NinjaRobotPirate (talk) 17:38, 14 February 2017 (UTC)[reply]

@NinjaRobotPirate: It appears the Khocon SPI was merged with this one, I assumed (wrongly, apparently) that Khocon was not actually socking based on the fact that they were currently unblocked and the SPI merged with this one despite being found unrelated. There is no SPI case that I can see where MissAdalie was formally tied to Khocon but I may be missing something there. Though the creation was an exact recreation of the previously deleted version by the sock listed. I'm a bit confused myself now since there is no SPI in relation to MissAdalie and Khocon. I assume the Adalie block was a CU, hence my confusion with no existing SPI. It appears I should have filed it under Khocon but followed the merged SPI wrongly. Shall I refile there? Chrissymad ❯❯❯ ¯\_(ツ)_/¯ 17:53, 14 February 2017 (UTC)[reply]

 Clerk assistance requested: It looks like Khocon was presented as a suspected sock of Highstakes00 in the archives, but a CU returned an "unrelated" result. I've proceeded accordingly from that. I blocked both accounts and tagged them as sockpupepts of Khocon. I also blocked Khocon and tagged him as the sockmaster. If I did this wrong, I apologize to the SPI clerks who will have to clean up after me. This may need to be unmerged from the Highstakes00 case and moved to one about Khocon. Again, sorry if I did this wrong, but it seems kind of bureaucratic to force someone to resubmit a case. NinjaRobotPirate (talk) 19:03, 14 February 2017 (UTC)[reply]


16 February 2017[edit]

Suspected sockpuppets[edit]

Same behavior as other socks; hijacked stub Dijkzigt by moving it to Suxcom Sro23 (talk) 01:57, 16 February 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

Blocked. NinjaRobotPirate (talk) 02:32, 16 February 2017 (UTC)[reply]

20 February 2017[edit]

Suspected sockpuppets[edit]


These accounts are clearly throwaway socks for a paid editor. All these accounts worked the same way and have no other edits.

Deikars: Develop an article in their sandbox [73]. Create a small user [74] and talk [75] page. Hijack a small European town, first posting their new article in the page [76] then moving to the new location [77] and then cleaning it up [78].

Revelat13: Develop an article in their sandbox [79]. Create a small user [80] and talk [81] page. Hijack a small European town, first posting their new article in the page [82] then moving to the new location [83] and then cleaning it up [84].

Begal Ser: Develop an article in their sandbox [85]. Create a small user [86] and talk [87] page. Hijack a small European town, first hiding their new article in comments in the page [88] then moving to the new location [89] then uncommenting their hidden article [90] and cleaning it up [91].

Spehrs: Develop an article in their sandbox [92]. Create a small user [93] and talk [94] page. Hijack a small European town, first hiding their new article in comments in the page [95] then moving to the new location [96] then uncommenting their hidden article [97] and cleaning it up [98].

Peurn: Develop an article in their sandbox [99]. Create a small user [100] and talk [101] page. Hijack a small European town, first hiding their new article in comments in the page [102] then moving to the new location [103] then uncommenting their hidden article [104] and cleaning it up [105].

Hndudic: Develop a sandbox [106]. Create a small user [107] and talk [108] page. Hijack a small European town, first hiding their new article in comments in the page [109] then moving to the new location [110] then uncommenting their hidden article [111] and cleaning it up [112].

Seamio Lieas: Develop an article in their sandbox [113]. Create a small user [114] and talk [115] page. Hijack a small European town, first hiding their new article in comments in the page [116] then moving to the new location [117] then uncommenting their hidden article [118] and cleaning it up [119].

(Note, most of the original town article were bot created, master thinking there would be less likely that the pages were on anyones watchlist?)

This may be new socks of User:New Editor 121 per Wikipedia:Sockpuppet investigations/New Editor 121/Archive#18 August 2016 (User:Namorala, [120]), noting the hijacking if a small European to to create Dennis S. Koutoudis (diffs deleted) and per Wikipedia:Sockpuppet investigations/New Editor 121/Archive#18 August 2016, User:RTamihy [121] operating as the two above but without the sandbox (already sandboxed at User:Namorala/sandbox). (User:Zestmind and User:Nimmu23 operated a very similar way back in 15).

Checkuser requested to find the master and what other spam socks are being used. duffbeerforme (talk) 03:14, 20 February 2017 (UTC)[reply]

Articles trying to be created were Bad Axe Throwing, Tracy Rawle, Mohamed Faraz Fazlet, Eton Institute Ltd (previously spammed at Eton Institute), Social Blade LLC (previously spammed at Social Blade), On Time Steam Cleaning, Inc (previously spammed at On time steam cleaning inc), Luke Lawal Jr (later at Luke Lawal created by a new account Sam-Ranem (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). duffbeerforme (talk) 11:28, 20 February 2017 (UTC)[reply]
Yes @NinjaRobotPirate: I did mean to flag it, sorry, thought I had. Does it make a difference if I'd put YES in caps. duffbeerforme (talk) 03:31, 24 February 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • Comment: User:Rebauim Kjiez does not match behaviorally. User:Deikars is a dead ringer for Highstakes00 behavior. — Gorthian (talk) 23:43, 1 March 2017 (UTC)[reply]
    • User:Kariua332 is another behavior match. I'll take their edits to ANI to get the histories untangled.
    • User:Rsigh3 is blocked.
    • User:Krrir has some definitely irregular behavior, but nothing matching Highstakes00.
    • User:Sam-Ranem doesn't have enough history to judge, but the statement on the user page doesn't match.
    • User:Zamber75 hasn't edited yet except for the user page and talk page, which do match Highstakes00 behavior. It might be a sleeper account.
    • User:Suprienia has no edit history, but their user page has been deleted on request.
— Gorthian (talk) 00:07, 2 March 2017 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

@Duffbeerforme: you mentioned checkuser; did you mean to flag this? These could be socks of Highstakes00 (talk · contribs), who seems to specialize in page hijacking. NinjaRobotPirate (talk) 19:40, 23 February 2017 (UTC)[reply]

Most things on Wikipedia are case sensitive, so it probably does matter. I flagged it for CU. NinjaRobotPirate (talk) 03:39, 24 February 2017 (UTC)[reply]
  •  Clerk endorsed - Please check these accounts against one another and these other sockfarms. Thanks, GABgab 17:51, 25 February 2017 (UTC)[reply]
  • There is extensive use of webhosts here so behavioural connections are important. magic eight ball The CheckUser Magic 8-Ball says: The following accounts are  Confirmed to each other:
  • Thanks, I figured.  Done. GABgab 22:51, 1 March 2017 (UTC)[reply]
  • Blocked and tagged all, including Rebauim Kjiez. Case closed. Vanjagenije (talk) 21:25, 2 March 2017 (UTC)[reply]

11 March 2017[edit]

Suspected sockpuppets[edit]

Recreation of Back4App (company), previously created by Acts71 Cabayi (talk) 12:50, 11 March 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Hi, I just noticed that you deleted the stub article Back4App that I just published. This is quite shocking to me because I do not understand the real motive behind it: "G5: Created by a banned or blocked user (Highstakes00) in violation of ban or block (TW)" What do I have to do with this editor? Although your motivation may be noble, I really do not deserve to be a collateral damage of this operation. Please take a second and closer look at this article and restore it. I would appreciate your cooperation given this WP advice: "Wikipedia:Please do not bite the newcomers" - https://en.wikipedia.org/wiki/Wikipedia:Please_do_not_bite_the_newcomers— Preceding unsigned comment added by Djukicivan1 (talk • contribs) 10:23, 11 March 2017 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

12 June 2017[edit]

Suspected sockpuppets[edit]


All follow the same pattern: 1) create an article in draft space, 2) add the little-used template Template:User talk page (54 transclusions in total; they are the only editors to use it in 2017), then 3) move their article out of draft space and disappear. All also edit around the same time.

A few diffs (although checking the contrib history shows the identical editing pattern better)

Sleeper check may also be required as these accounts were created in advance, some significantly so. jcc (tea and biscuits) 23:01, 12 June 2017 (UTC)[reply]

@Bbb23: Thanks for the check. Upon examining User:Exanem, a sock you listed, I believe that the following users are also part of the sockpuppet group or at least related as they exhibit the same behaviour listed above just with a different template (Template:user talk) which Exanem used instead too:
Are you able to check these? Thanks, jcc (tea and biscuits) 00:26, 13 June 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

13 June 2017[edit]

Suspected sockpuppets[edit]


Rapidly recreated an article that was just deleted due to it being created by a sock of a paid editor. Article is this one FIBO Group. Other articles created by Pozytyv are fairly promotional in nature.Spotware Systems And there is good evidence of significant concerns of paid editing in this topic area. Doc James (talk · contribs · email) 15:44, 13 June 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Closing this with no action. Is this possibly a paid editor? Yes. Is this the same paid editor? No, the MO is entirely different despite overlap in topic area. This seems more likely to be a case of "Our page got deleted, let's hire a different paid editor" to me. ~ Rob13Talk 07:31, 16 June 2017 (UTC)[reply]

13 June 2017[edit]

Suspected sockpuppets[edit]

Thanks for your efforts so far- you are indeed correct, their latest accounts have weird permutations. One more I've found that fits the pattern definitely, less sure about the second but it's definitely a sock and follows the pattern too. The last editor is the most interesting as it fits the pattern perfectly but it appears whoever's behind the accounts is onto this investigation as his latest edit changed the unique template we were previously looking out for into a message just today.

jcc (tea and biscuits) 15:49, 13 June 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]


14 June 2017[edit]

Suspected sockpuppets[edit]


Started this page SealFit that was continued by a undisclosed paid sock. Doc James (talk · contribs · email) 15:21, 14 June 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

@Doc James: Neither Wikiseal123 nor Pozytyv fits the behavioral pattern of this case. Nor have you presented any evidence that they do. They may be socks, but they don't belong here. It appears like you're trying to shoehorn users whom you believe are undisclosed paid editors into a case of a rather prolific undisclosed paid editor because it's convenient. As an aside, I can't follow the history of SealFit and who created what when.--Bbb23 (talk) 15:49, 14 June 2017 (UTC)[reply]

User:Bbb23 looking at the SealFit case more agree. An IP from [122] created it which is the location of the company in question.[123]. Than the work is continued on by a registered account User:Wikiseal123. The AFC submission was declined.
Agree they at this point likely went out and hired someone to complete the process and thus the appearance of the User:Suntai87 account. So yes likely COI editing moved to paid editing and thus these two are likely not socks of each other. Will provide further details for Pozytyv in a bit. Thanks Doc James (talk · contribs · email) 16:20, 14 June 2017 (UTC)[reply]
With respect to Pozytyv looking at [124] and [125], agree they write in different styles. I guess the question is, are they a different likely paid editor or the same as the prior? I think that is a reasonable question. Doc James (talk · contribs · email) 16:32, 14 June 2017 (UTC)[reply]
  • Closing for insufficient evidence.--Bbb23 (talk) 20:12, 16 June 2017 (UTC)[reply]

16 June 2017[edit]

Suspected sockpuppets[edit]

Couple more (sorry!) more for cataloguing purposes. Don't quite know how I missed them out the first time round. They weren't identified in previous Checkusers so more sleepers may be unveiled by checking these two but I'm fine if they're just tagged since the behaviour is exactly the same. jcc (tea and biscuits) 19:56, 16 June 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

30 June 2017[edit]

Suspected sockpuppets[edit]


The above two accounts were reported to me privately as likely socks. Bbb23 (talk) 14:40, 30 June 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

 Confirmed and blocked. @Vanjagenije: Please merge this case to Wikipedia:Sockpuppet investigations/Highstakes00. The technical evidence is a match and the behavioral evidence is persuasive. The merge will also permit the deletion of articles created by these newer accounts per G5. After the merge, either you or another clerk should retag all the newer accounts, which is a rather large task. Thanks.--Bbb23 (talk) 14:46, 30 June 2017 (UTC)[reply]

  •  Done Vanjagenije (talk) 16:27, 30 June 2017 (UTC)[reply]
    • Thanks for connecting this group with prior accounts. I have already been cleaning up their articles using G5 as it is obvious that none of the most recent accounts are new users. Doc James (talk · contribs · email) 17:37, 30 June 2017 (UTC)[reply]

22 July 2017[edit]

Suspected sockpuppets[edit]


@Bbb23: Same patterns again (clearest in initial version), but I'm less sure about this one, maybe due to the talkative edit summaries and the fact that they didn't initially create the draft, Sanjaydutt2 did. I'd like your opinion on this. jcc (tea and biscuits) 15:39, 22 July 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

Red X Unrelated.--Bbb23 (talk) 21:49, 22 July 2017 (UTC)[reply]

25 July 2017[edit]

Suspected sockpuppets[edit]


SPAs used to create BLPs and company pages. The strongest behavioural evidence links Ricky Grids and Revlaen.

  • Ricky Grids created Chronobank and Revlaen created Sergey Sergienko. Sergienko is Chronobank's CEO.
  • Crucially, both articles were subsequently edited on May 8th by the authors. Sergienko was edited at 6:58 and Chronobank was edited at 07:08. That last edit included bad-faith removal of maintenance tags.
  • Both users characteristically redirected their user pages to their talk pages.
  • Both articles were similarly bombarded with similarly formatted references. Both articles use similar formatting and markup.

The other SPAs and their articles share all of these similarities. Also:

-- Rentier (talk) 21:20, 25 July 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

@Bbb23: Looks absolutely behaviorally identical to the later socks from Wikipedia:Sockpuppet_investigations/Highstakes00- i.e. draft -> mainspace, creation of user/user talk pages prior to move. jcc (tea and biscuits) 21:30, 25 July 2017 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

07 August 2017[edit]

Suspected sockpuppets[edit]

Spamming links to dealwithautism.com and to one other website. Off-wiki evidence (can email if anyone's interested) strongly links these IPs to Wikipedia:Sockpuppet_investigations/Highstakes00. -- Rentier (talk) 18:58, 7 August 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Berean Hunter - thanks for the update. I believe this is HighStakes because there is an Upwork job to create five links to dealwithautism.com that is marked as done by the undisclosed paid editing firm previously linked to the HighStakes account and its socks. The Upwork job was posted last month, so any edits earlier than that were likely performed by either another undisclosed paid editing company or by the clients themselves. Basically, the clients plus one or more paid editing companies may be simultaneously adding links/content associated with each of the businesses that you listed. I imagine it complicates the CU work quite a bit since the various groups aren't technically related to each other. Rentier (talk) 01:11, 14 August 2017 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

Rentier the above are related. Take a look at this report to see that account and IP are the same. Then look at this report to see a bigger picture and more accounts to check (mostly stale). I haven't looked at HighStakes but I thought I'd give you what I have at the present. This edit summary suggests that Muddassarshah (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) would be a master but meatpuppetry is also possible.

Also, Kamranayyubdcs (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) and Special:Undelete/Dubai Cosmetic Surgery are going to be related as well.
 — Berean Hunter (talk) 21:16, 13 August 2017 (UTC)[reply]

  • based on this linkspam but it is a year ago so it might not be related, however other links were spammed in by that IP that I have not listed here and may be worth checking out)
  • Anon-blocked 58.65.142.0/24 range for six months and indeffed Kamranayyubdcs. Checked other ranges used but didn't see anything that stands out.
     — Berean Hunter (talk) 14:16, 14 August 2017 (UTC)[reply]
@Berean Hunter: did you mean to close this? I don't see anything else to do at the moment. Ivanvector (Talk/Edits) 13:11, 24 August 2017 (UTC)[reply]
Ivanvector, we can close this now. I left it open at the time because the COI Bot reports will update with new hits but that hasn't happened here (I haven't looked below yet :)
 — Berean Hunter (talk) 13:20, 24 August 2017 (UTC)[reply]

20 August 2017[edit]

Suspected sockpuppets[edit]


Recreated Maria de Lourdes Severny which was previously deleted as created by a sock of High. New article is promotional. Doc James (talk · contribs · email) 07:44, 20 August 2017 (UTC) Doc James (talk · contribs · email) 07:44, 20 August 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

Self-endorsed by clerk for checkuser attention - user is already blocked for recreating the promotional article mentioned above and has admitted to having been provided the source for the article by a third party. That admission, plus the absence of the usual connections to this case, gives me some doubt that they're a sock. Let's see if CU can provide any insight. Ivanvector (Talk/Edits) 13:10, 24 August 2017 (UTC)[reply]

20 October 2017[edit]

Suspected sockpuppets[edit]


Recreated the previously deleted articles Trep Camp, 'TrepCamp which were previously created by socks from this farm as TrepCamp.org. jcc (tea and biscuits) 20:41, 20 October 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  • I can confirm for any non-admin clerks that the current article is a nearly exact replica of the two deleted articles, so it looks like a DUCK to me. I'll hold off on blocking myself since I've already commented on the current AfD. Something else to consider here is whether a CU is needed for a sleeper check given the history of sleepers in the archive. TonyBallioni (talk) 20:48, 20 October 2017 (UTC)[reply]

This case is being reviewed by Sir Sputnik as part of the clerk training process. Please allow them to process the entire case without interference, and pose any questions or concerns either on their Talk page or on this page if more appropriate.

  •  Clerk endorsed - To confirm and check for sleepers. Also please be aware that the most recent confirmed socks are about to go stale in a few days, so please check this sooner rather than later. Sir Sputnik (talk) 23:19, 20 October 2017 (UTC)[reply]
    • @Sir Sputnik: as far as I can tell, everything is stale. Am I missing something? Like a dope, I ran the CU without checking the dates myself, but the last edit I see from a confirmed sock went stale around 3 weeks ago. NinjaRobotPirate (talk) 06:09, 21 October 2017 (UTC)[reply]
  •  Inconclusive w/o sleepers. But the stupid amount of DUCK here means i'll be blocking the sock. -- Amanda (aka DQ) 07:08, 21 October 2017 (UTC)[reply]

11 January 2018[edit]

Suspected sockpuppets[edit]

I'm not sure if CU is stale for this but if not, might be worth a check. Staemo created Sergei Sergienko which is a nearly identical recreation of past creations by Revlaen under either the same name or Sergey Sergienko. CHRISSYMAD ❯❯❯¯\_(ツ)_/¯ 15:35, 11 January 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

07 February 2018[edit]

Suspected sockpuppets[edit]


TripWire has been totally disruptive from the get-go just like Highstakes00 and his socks. TripWire was topic banned once from Pakistan politics and Pakistani-Indian conflicts for 6 months,[126] and topic banned from Balochistan for 3 months,[127] just like TheSawTooth, a Highstakes00 sock, who was indefinitely topic banned from India and Pakistan military articles.[128]

I could understand that this account is a sock, but because of his inactivity and the sanctions that stopped him from disrupting his favorite subject, I was never in hurry, but now it has become necessary to file this SPI.

I am also sure that most of the accounts of this SPI's archive have nothing to do with Highstakes00, the editor who edited Pakistan-related articles.

According to himself, Darkness Shines suggested that Tripwire is a sock.[129] Human3015 also mentioned HighStakes00 on SPI of Tripwire, but provided no evidence.[130]

An SPI filed by OccultZone helps in building evidence for proving TripWire as a sock of HighStakes00.

"Highstakes00 had abused an IP for edit warring, like we can view in the archive.[131] In those days he had abused an IP(39.47.46.80[132] [133]) and during the last month, he was alleged by other editor to have abused an IP(223.29.225.35[134][135]) on Battle of Chawinda, both of these IPs comes from Islamabad[136][137], even the latitude(33.69) is same. OccultZone (Talk • Contributions • Log) 16:06, 20 January 2015 (UTC)"

This above analysis by OccultZone is not different to IP socking from TripWire with 39.47.50.14. This IP also locates to Islamabad and same location.

Tripwire has edit warred in tandem[138] with this IP[139] for removing same content on Balochistan, Pakistan.
Also used IP for supporting his stance on same article on same day.[140][141]
Tag-teaming on same IP[142][143] on same day.

Claimed with both accounts that "India did not win" Kargil War.[144][145] Same POV on Kargil War, that the war had no conclusive results because Pakistan withdrew under "international pressure".[146][147]

Just like Highstakes00[148][149] Tripwire also puts dashes before signing.[150][151]

TripWire and Highstakes00 added themselves to Wikipedia:WikiProject Pakistan/Members.[152][153]

Refers people as "sir".[154][155][156] Writes "Thanks" as "Thanx". [157][158]

TheSawTooth had been warned by Widefox, but TheSawTooth reverted that warning[159] and then issued a firovolous warning to Widefox.[160]

This is same like what TripWire did today. Received a warning for edit warring by Anmolbhat, but he removed that warning[161] and then issued a firovolous warning to Anmolbhat.[162]

Same attitude of Wikihounding,[163] just like Highstakes00.[164][165]

Like Highstakes00 had problem with "Pakistan held Kashmir"[166], TripWire has problem with "Pakistani-controlled" Kashmir.[167]

Same POV pushing on Operation Zarb-e-Azb.[168][169] Capitals00 (talk) 00:36, 7 February 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

"I am also sure that most of the accounts of this SPI's archive have nothing to do with Highstakes00, the editor who edited Pakistan-related articles." Not a good way to demonstrate that TripWire is related to this master. In any event, insufficient evidence. Closing.--Bbb23 (talk) 01:15, 7 February 2018 (UTC)[reply]

23 February 2018[edit]

Suspected sockpuppets[edit]


DUCK behaviour same as before. Most recent sock (not named here): User:Coekesum jcc (tea and biscuits) 17:01, 23 February 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Two more:

Rentier (talk) 17:14, 23 February 2018 (UTC)[reply]

Connected to IMindMap draft ☆ Bri (talk) 19:47, 23 February 2018 (UTC)[reply]

A bunch more, obviously evading ACTRIAL in the same way as YA4NCY:

I fully expect them to be editing from webhosts... MER-C 20:05, 23 February 2018 (UTC)[reply]

@MER-C: think I located one logged-out edit from a webhost (NTT cloud hosting) preceding the sock ☆ Bri (talk) 21:50, 23 February 2018 (UTC)[reply]

Kennytoes is probably stale but should be roped in per DUCK -- created CardLinx Association, related to sockfarm's Silvio Tavares CEO, same process. ☆ Bri (talk) 22:01, 23 February 2018 (UTC)[reply]

Was found on Device Magic:

Some water fowl I found while trawling through move logs, all evading ACTRIAL in the same way as the majority of the socks on this page to create promotional articles on startups and business(wo)men. MER-C 22:20, 23 February 2018 (UTC)[reply]

More from MER-C's list of suspicious creations. They have the style/procedural feel of Highbrows to me. Withholding further comment due to BEANS. ☆ Bri (talk) 22:38, 23 February 2018 (UTC)[reply]

@Bbb23: Could you have another look at one account: Vani Ongaya appears behaviorally different and advertised a different service than we think Highstakes00 represents. Before I link the new service to the group I'd like to be doubly sure. Thanks ☆ Bri (talk) 17:45, 24 February 2018 (UTC)[reply]

@Bri: Good question. Vani Ongaya and Vaxbestos are clearly operated by the same person. There is technical data that absolutely matches them to Highstakes, but there is also technical data that makes it unlikely they are Highstakes. Because of the complexities of Highstakes's technical history, I decided to call them confirmed, but if you think they are behaviorally different, then trust your analysis.--Bbb23 (talk) 17:53, 24 February 2018 (UTC)[reply]
@Bbb23: If the technical data is there then I trust it. Experience is guiding me in the direction that these farms aren't strictly separated. From your side of things is it plausible that we have operators and sub-operators/sub-contractors probably swapping account logins back and forth? ☆ Bri (talk) 18:18, 24 February 2018 (UTC)[reply]
@Bri: Your ping didn't work. You must re-sign when you "add" a ping. In answer to your last question, no, at least not with the Highstakes socks. As for trusting the technical data, that's fine, but in this instance with these two accounts the technical data is somewhat contradictory, which is why I said not to trust the technical data. I hope that's clearer.--Bbb23 (talk) 18:25, 24 February 2018 (UTC)[reply]
Okay ... reversing myself now ... I think the behavior/language etc. are sufficiently different that Vani Ongaya and Vaxbestos are a new group. ☆ Bri (talk) 18:29, 24 February 2018 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

You folks have succeeded in driving me crazy. First, you added new suspected socks without pinging me. Then, when I noticed them before I was going to post my findings, I checked them. Then, as I was posting my findings, I noticed that you added even more, again without informing me. I didn't find those until I had wrapped everything up in my notes and taken into account the first addition. I had to rollback my own findings. Do you realize how hard this is? I had already created four groups of socks, only one of which was related to the master, and then you keep tossing more in endlessly. You have to stop. I'm not posting my findings now that don't incorporate the newest ones. It would be more work than going through the new ones and putting it all together in my notes. But I'm also not checking the newest ones right now. I have to take a break from this case. I should post later today or tomorrow.--Bbb23 (talk) 22:51, 23 February 2018 (UTC)[reply]

Group 4 looked fitted the UPE bill so I have  Blocked and tagged. SmartSE (talk) 18:15, 24 February 2018 (UTC)[reply]

27 March 2018[edit]

Suspected sockpuppets[edit]


Same as before. jcc (tea and biscuits) 20:38, 27 March 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • They are definitely not new users, so should be blocked and G5d regardless, but CU would be helpful to look for more. SmartSE (talk) 20:58, 27 March 2018 (UTC)[reply]
Nominated two articles for G5: Nehemiah Douglass, Apeel Sciences ☆ Bri (talk) 21:30, 27 March 2018 (UTC)[reply]
The G5 rationale spawned from the observation that these are not new accounts, creating promotional articles. The named master for one was technically incorrect but the grounds for deletion were correct. Further at WT:CSD momentarily. ☆ Bri (talk) 00:49, 28 March 2018 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Kercve is  Confirmed. Yurisurea is  Possible to Bemanraam (talk · contribs · count), whom I earlier found – and still do – to be Red X Unrelated to the master. Blocked and tagged Kercve. G5 should not be used until after an account is blocked.--Bbb23 (talk) 23:23, 27 March 2018 (UTC)[reply]
  • I can't make conclusive link for Yurisurea and it also seams to be abandoned. Case closed. Vanjagenije (talk) 20:20, 3 April 2018 (UTC)[reply]

04 June 2018[edit]

Suspected sockpuppets[edit]


DUCK same as before jcc (tea and biscuits) 21:45, 4 June 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Clerk endorsed - all these accounts are already blocked, but activity suggests possible sleepers. Ivanvector (Talk/Edits) 23:52, 4 June 2018 (UTC)[reply]

Due to proxy usage it's going to be difficult to do much in the way of confirmation. Nellte Letics is in a certain Asian country. The others are on VPNs. Confirmed to them, or at least closely related, on proxies are:

Nellte Letics is on a very spammy range. Possible associates include:

-- zzuuzz (talk) 13:43, 5 June 2018 (UTC)[reply]

05 October 2018[edit]

Suspected sockpuppets[edit]

Hassan_Bishil by Icelstox, Marek_Wójcicki by Agata Bijak, Commercial & General by Maseuicj, Oxford_Royale by Pviekte, Robyn_Alexis_Ward by Cosletesa, Courtney Allegra Welch by Swetkei are the articles identified.

Obvious DUCK. jcc (tea and biscuits) 18:54, 5 October 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

I've G5d all the articles. SmartSE (talk) 21:48, 5 October 2018 (UTC)[reply]
@Smartse: I often do that myself. It's nice to have someone else do it. Thanks.--Bbb23 (talk) 22:04, 5 October 2018 (UTC)[reply]
@Bbb23: If you can python: [173]. Trying to make it work like this. SmartSE (talk) 22:11, 5 October 2018 (UTC)[reply]

21 September 2018[edit]

Suspected sockpuppets[edit]

In March, Amymurg created Draft:Robyn Ward which was declined. In August, Cosletesa created Robyn Alexis Ward , with similar wording. For both accounts, these are their only edits. -- RoySmith (talk) 19:48, 21 September 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

The master is  Stale. CU declined.--Bbb23 (talk) 20:23, 21 September 2018 (UTC)[reply]

  • The two versions of Robyn Ward are nearly identical, so this is clearly the same person. With the new account confirmed to Haghstakes00, I've merged the case. There's not much point in blocking Amymurg after seven months of inactivity. Sir Sputnik (talk) 14:38, 22 October 2018 (UTC)[reply]

10 December 2019[edit]

Suspected sockpuppets[edit]

All edits promoting Matt Tarrant (Draft:Matt Tarrant), as per Sriolorps (talk · contribs · deleted contribs · logs · filter log · block user · block log) blocked as Highstakes00 sock. Guy (help!) 00:23, 10 December 2019 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

Reedandwrite is Red X Unrelated. Belindaowenaus is  Stale. Closing.--Bbb23 (talk) 01:03, 10 December 2019 (UTC)[reply]

06 February 2020[edit]

Suspected sockpuppets[edit]

WP:DUCK. Attacking pages, first as an IP, and then as this account, regarding blacklisted sites used by master. Then attacks the archives of this SPI page, and gets edits disallowed by the edit filter. Loud quacks. No point in a CU now as all the data is stale. JavaHurricane 06:58, 6 February 2020 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Blocked and tagged — JJMC89 (T·C) 07:02, 6 February 2020 (UTC)[reply]


06 February 2020[edit]

Suspected sockpuppets[edit]

IP address used by the recently blocked sockpuppet. Forgot to report earlier. Please block JavaHurricane 07:21, 6 February 2020 (UTC)[reply]

Also, please revert one of the IP's contributions on the spam blacklist archive. I can't revert as it triggers the edit filter and disallows the edit.-- JavaHurricane 07:22, 6 February 2020 (UTC)[reply]
@JavaHurricane: I just used rollback, that ignores the spam-blacklist. --Dirk Beetstra T C 07:30, 6 February 2020 (UTC)[reply]
@Beetstra:, thank you. -- JavaHurricane 07:34, 6 February 2020 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

Maybe of interest is MediaWiki_talk:Spam-blacklist#dubaicosmeticsurgery.com_registered_Plastic_Surgery_Clinic (permanent link) by Muddassarshah (?) and Dubaicosmeticsurgery1. --Dirk Beetstra T C 07:52, 6 February 2020 (UTC)[reply]

Please see also Dcsdubai, who tried to add dubaicosmeticsurgery.com/ (as well as abovementioned IP: logitem, logitem and logitem). --Dirk Beetstra T C 13:16, 6 February 2020 (UTC)[reply]

30 May 2020[edit]

Suspected sockpuppets[edit]

Hijacked Bošovice just like their previous sock Dregaan (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). The account was registered in 2019 so, I'm requesting CU to look into their sock-drawer. GSS 💬 14:29, 30 May 2020 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

This case is being reviewed by RoySmith as part of the clerk training process. Please allow him to process the entire case (including admin actions against suspected socks) without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate.

  •  Clerk endorsed - @Callanecc: Similar page moves by Ahmed and Dregaan make this worth blocking on sight, but let's see what else falls out from CU. -- RoySmith (talk) 15:00, 30 May 2020 (UTC)[reply]
    The interesting thing here is that while it's clear that Ahmed3lama and Dregaan are related, I don't see any mention of Dregaan in the SPI archives so I'm not sure how they're tied to Highstakes00. @MER-C: you blocked them, do you remember what made you think they were connected to this master? -- RoySmith (talk) 15:11, 30 May 2020 (UTC)[reply]
    This is the identifying behavior of this sockmaster, see the archives. MER-C 15:13, 30 May 2020 (UTC)[reply]
  • Dregaan is  Stale. I compared the Ahmed3lama account to a few of the non-stale socks in Category:Suspected Wikipedia sockpuppets of Highstakes00, and the result is  Inconclusive. The accounts are all over the place (on multiple continents), and I suspect there is a mix of proxy use and meatpuppetry/UPE involved. CheckUser is not going to be useful in this case, so I recommend proceeding on just behavior. Mz7 (talk) 19:33, 30 May 2020 (UTC)[reply]
  • @Callanecc: My original thinking was "block on sight" and there's nothing in the CU that changes that. So, I recommend indef Ahmed3lama and tag as suspected. -- RoySmith (talk) 19:51, 30 May 2020 (UTC)[reply]
    RoySmith, go for. Callanecc (talk • contribs • logs) 00:04, 31 May 2020 (UTC)[reply]
  • Blocked, tagged, closing. MER-C 10:51, 31 May 2020 (UTC)[reply]

22 January 2022[edit]

Suspected sockpuppets[edit]


Pro forma. Noting here due to a material alteration in tactics. MER-C 12:53, 22 January 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

Blocked and tagged. MER-C 12:53, 22 January 2022 (UTC)[reply]

Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Highstakes00/Archive&oldid=1079533266"