Wikipedia:Sockpuppet investigations/SANIRA

SANIRA

SANIRA (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Populated account categories: confirmed

30 June 2024[edit]

– A user has requested CheckUser. An SPI clerk will shortly look at the case and endorse or decline the request.

Suspected sockpuppets[edit]

SMSIndigo (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
RahulBodke (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Aryan Patil 2022 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Yellowsnowman123 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Tools: Editor interaction utility • Interaction Timeline • SPI Tools

SINARA blocked on May 12, 2024 for continued addition of unsourced content. That user created the page Antarapata which went through a [https://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletion/Antarapata deletion discussion with a decision to redirect. User SMSIndigo creates account on May 26, 2024 and creates page under disambiguation Antarapata (TV series) which I sent to draft today. That user then creates it again under a different disambiguation Antarapata (Kannada TV series). Which I also just sent to draftspace. Both users exhibiting same editing patters across same topics on same pages. Clearly here to promote the show and DUCKish as far as being the same person. CNMall41 (talk) 05:35, 30 June 2024 (UTC)[reply]

Adding RahulBodke as users are working on page created by this now blocked UPE. --CNMall41 (talk) 05:39, 30 June 2024 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

@JBW:, if you look at RahulBodke, user creates redirects which are then almost immediately removed by LOUTSOCKs to place articles. This could also be tied to the current SPI for Nauman335 which has the same behavior. They are doing so as they know G5 may not apply if its an IP who creates the page and not the redirect. They are getting smarter (not by much though). --CNMall41 (talk) 19:08, 30 June 2024 (UTC)[reply]

@JBW:, thank you for digging deeper. I brought this up in another SPI for RahulBodke but don't recall it being checked that deep. They are still here as I see some IPs removing redirects now. --CNMall41 (talk) 16:34, 3 July 2024 (UTC)[reply]

Also noting the same pattern with Aryan Patil 2022 which is an account that was created February 2022 so is the oldest so far but did not start editing until January 2024 and blocked on May 30th for UPE. They created several redirects with Abeer Gulal and Antarpat (TV series) turned into articles a couple so times by IPs (43.242.226.42, 116.50.84.117) which I reverted. Ponyo EC protected them. After I had reverted them an IP, 49.33.251.21, complained (User talk:S0091#Reverting new articles?). Also, the day they were created by Aryan, May 22nd, an IP (49.32.248.214) corrected them as the targets had nowiki tags (see User talk:Aryan Patil 2022#Please stop creating redirects using Visual Editor) so no doubt that IP was Aryan. S0091 (talk) 15:52, 4 July 2024 (UTC)[reply]

Thanks for the help here. There is also a relevant discussion for CUs and admins on my talk page here. I truly think a CU would expose a huge farm and a ton of pages that were created under UPE.--CNMall41 (talk) 21:31, 4 July 2024 (UTC)[reply]

Also adding two more here as they may be connected. User Aryan Patil 2022 was blocked for UPE on May 30, 2024. They created a redirect for Drama Juniors Marathi to Zee Marathi. The next day, an IP changed the redirect to List of programmes broadcast by Zee Marathi. Today, a similar IP changed the redirect to Drama Juniors (Marathi reality show), a disambiguated name that is not necessary. Note that this page was created by User Yellowsnoman123. These are all accounts attempting to use redirects to circumvent the NPP process. Note that the IP that changed the redirect is in the list provided at the bottom of this SPI so it is connected. Also note that user Yellowsnowman123 had made only approximately 20 edits before creating a long article Chandra (song) (showing they likely have edited Wikipedia previously from a different account). And now with 1,000 edit they have created 84 pages which is NOT typical of a new user. --CNMall41 (talk) 05:25, 5 July 2024 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

CNMall41's comment "Both users exhibiting same editing patterns across same topics on same pages" says it all; the same editing patterns in several different ways, including identical pattern of unsuitable file uploads and identical pattern of unsuitable article creation, on the same subjects. Administrators may like to compare the following creations by SANIRA: [1] [2] [3] (and more of the same) with these from SMSIndigo: [4] [5] (and more of the same). Sounds like a duck quacking into a megaphone to me, so I'll block SMSIndigo. I have already deleted a number of pages created by SMSIndigo as copyright infringements, but this makes it easier, because I can delete the rest as created by a block-evader, without spending time individually checking each one for copyright. JBW (talk) 09:03, 30 June 2024 (UTC)[reply]

I don't see any real evidence of a connection to RahulBodke, but I have made only a fairly brief check, so I may have missed something. However, I don't feel that it is worth investigating further, since all the accounts are indefinitely blocked anyway. JBW (talk) 18:58, 30 June 2024 (UTC)[reply]

@CNMall41: OK, now that you have given that additional information (19:08, 30 June 2024) I have checked again, and I see that you are right. There was a consistent pattern of RahulBodke creating a redirect, and then an IP making the page into an article. Every single time the IP address geolocates to Maharashtra; usually to Mumbai, less often to other cities in Maharashtra (Pune, Nagpur, Dombivli). It seems almost certain that the reason for this is the one you have mentioned. That would make no sense unless RahulBodke is a sockpuppet of an already blocked editor, so I think a CheckUser to search for such an earlier sockmaster would be very welcome. Finding one might lead to finding further sockpuppets, but even if it didn't, it would make it possible to delete pages created by RahulBodke as created while evading a block.