Wikipedia

Wikipedia:Sockpuppet investigations/Icewhiz/Archive

< Wikipedia:Sockpuppet investigations‎ | Icewhiz


Icewhiz

Icewhiz (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

01 November 2019

edit

Suspected sockpuppets

edit


New account activated around the time ArbCom was passing a topic ban on Icewhiz (and consider the text added to Silveter's userpage at that time: When life gives you lemons, make lemonade). On the first day displayed knowledge of talk pages, user talk pages, and being able to request an edit to a semi-protected page using templates, etc. [1], while at the same time creating userpage, talk page with a note "'Leave you message below", and to muddle things, a giberish-filled sandbox. (Congrats on moving from fssffg in sandbox to fixing code errors and editign templates in few hours, super newbie, eh?). On day two uses undo button a lot and edits with summaries like rv vandalism.

Activity on many of same articles that Icewhiz, all withing a very short period of time. In this edit, the new account restores text originally added by Icewhiz. Also restoring Icewhiz edits in [2] ([3]). Or [4] vs [5]. Most of the articles that are listed in the Wikipedia Interaction utility are like that, and note many of those are pretty obscure topics.

There is also a lot of similarity in edit summaries: rv unexplained changes and removal to revert, unexplained removal and several others (see [6]). Or "per multiple sources", exactly the same edit summary used in [7] and few other times ([8]). if you must, rare construction also used by Icewhiz several times, ex if we must. unreliable source: [9]. Other words used in common: qualify ([10]), justify/justifies ([11]), replacement ([12]), commentary/commentaries: [13], stretching ([14]), given ([15]), meaningless ([16]), per source ([17]), lede ([18]), chronological ([19]), redundant ([20]), add ([21] - note here numerous summaries with just this single word), simpler ([22], again, same one word summary), verbatim ([23]), irrelevant ([24]), cut down ([25]), unnecessary ([26]), already ([27]), horrible ([28]), not true ([29]), specific ([30]) not in source ([31]), shared interest in galleries ([32], [33] vs [34], [35]), Unrelated ([36]), original research ([37]). ... Sure, a few may be an accident, but so many repeated words and even phrases in edit summary in an account that is just one month old and edits many overlapping articles? Quack, quack?

Also, still waiting to hear anything about connection between Icewhiz and User:JolantaAJ? Another new account that displays similar interest in User:Batbash, which I just noticed got blocked recently by User:Mkdw with the statement "Block evasion". Is it ok to ask "block evasion by whom"? Can we create Category:Wikipedia sockpuppets of Icewhiz or Category:Suspected Wikipedia sockpuppets of Icewhiz and tag the relevant accounts?

Lastly, I think the last report from Wikipedia:Sockpuppet_investigations/Smmurphy/Archive#21_October_2019 should be moved here (or to Wikipedia:Sockpuppet_investigations/Icewhiz/Archive) as it was about Icewhiz, not Smmurphy. That report also contains a numer of IPs that I understand are 'under investigation', even if the results cannot be declared (but I also notice that many categories like Category:Wikipedia sockpuppets of Runtshit for example list numerous IPs...?).


--Piotr Konieczny aka Prokonsul Piotrus| reply here 01:36, 1 November 2019 (UTC) Piotr Konieczny aka Prokonsul Piotrus| reply here 01:47, 1 November 2019 (UTC)[reply]

@ST47 and Joe Roe: I did. I was unaware that Silveter was blocked after my original report (nobody told me this happened and I didn't think to check since I all I was told is that the report was deleted on procedural grounds, so I spend 20 minutes recreating/reformatting it, instead of doing something else like writing a new article...). There is still not a single word of confirmation that either of the reported socks (or IPs) are connected to Icewhiz. I thought that community members are encouraged to help with identification of socks, but the impression I am getting is that reports of possible socking are not welcome (my report is first deleted, then I am accused of gravedancing). Since I thought we are dealing with a new disruptive sockmaster with whose edit pattern I am somewhat familiar with, I thought I'd help out a bit by reporting this to SPI, but perhaps I am wasting my and everyone else's time? Please tell me what I should if I see another account that fits this pattern, if anything? In related news, there is also Wikipedia:Sockpuppet investigations/יניב הורון which mentions Silveter, which I find confusing as יניב הורון was active long before the established account Icewhiz got banned (@Mkdw, Sro23, and JJMC89:. I'd appreciate comments on whether there is a connection or whether the evidence I presented above is insufficient/unhelpful, so that I know what to do, if anything, next time I see a similar account. I have no idea how to clear this mess, but I have to say my motivation to report further socks is dropping rapidly. And for the third time, can we create Category:Wikipedia sockpuppets of Icewhiz or Category:Suspected Wikipedia sockpuppets of Icewhiz and tag the relevant accounts in one place (if, indeed, there is a connection, because it's now ~2 weeks in after User:Gdarin made his report and I reported suspicious IPs/socks to User:JzG and User:Bradv and still there is no a single word of whether there is any connection (the accounts/IPs all get blocked, yes, but what for is never made clear; is Icewhiz related or is he innocent; outside of a single block log entry on 176.221.108.218 no admin has to be best of my knowledge commented on this clearly)? I thought such grouping is helpful for establishing behavioral patterns and helps identify future socks more easily. So yes, I thought this is a constructive outcome to work for, but again, perhaps I misunderstand the purpose of SPI? PS. Lastly, I think User:Bbb23 deleted this page in an attempt to split the cases of Icewhiz and Smmurphy. But I see this confusion has been restored. For the pity's sake, nobody is suggesting that Smmurphy is connected to Icewhiz, some report was misfiled long ago. Those two are almost certainly separate individuals and should not be confused. I don't want to undo an SPI editor but this edit again introduced the confusing error suggesting that I or someone else is trying to connect Silveter to Smmurphy. No, no and no. The only thing I am trying to establish is whether Icewhiz is socking or not, and whether Silveter/JolantaAJ/Batbash are his socks (and I guess whether I should bother with further reports, or just give up and let him return despite the indef ban, since so far trying to report possible socks is a very frustrating experience; I spent several hours compiling this info and looking into how SPI works and instead of a 'thank you for you report' I am getting accused of gravedancing; what's next - warning that I am harassing an indef banned editor by suggesting he is socking, perhaps? Seriously, please let me know if I am violating some policy with my reports here, I don't want to get blocked for doing what I thought was encouraged by WP:HSOCK which states "If you believe someone is using sock puppets or meat puppets, you should create a report at Wikipedia:Sockpuppet investigations."). --Piotr Konieczny aka Prokonsul Piotrus| reply here 07:39, 1 November 2019 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

edit
  • I'm betting that when you asked @Bbb23: for the content of this deleted page, his intention wasn't for you to re-create this immediately after it had been deleted. (If that was your intention, it would have been more honest to ask him to restore it.) Every account related to this case is blocked indefinitely. Is this just gravedancing, or is there some productive outcome you're looking for here? ST47 (talk) 04:33, 1 November 2019 (UTC)[reply]
    @ST47: That seems to be exactly what Bbb23 wanted Piotrus to do [38]. Silveter was blocked after Piotrus filed his original report and shortly before this refiling, so I'm guessing he simply didn't notice. I'm not familiar with the ins-and-outs of SPI procedure, but it would seem helpful for future enforcement, appeals etc., to have Icewhiz's sockpuppets (if that's what they are) appropriately archived under his username. – Joe (talk) 06:57, 1 November 2019 (UTC)[reply]
  • @Piotrus: to answer all of your questions that I'm able to at the moment, no, do not create the categories. A clerk will create them if they need to be created. In the most recent report that was filed under Smmurphy there in fact was a finding related to that case, and not to this one, so in my opinion it should stay there. If there are connections to Icewhiz or the other accounts here a clerk will note it. Thanks for taking the time, and sorry this has been a frustrating experience, but please be patient. Ivanvector (Talk/Edits) 12:17, 1 November 2019 (UTC)[reply]
  • Silveter is highly   Unlikely. JolantaAJ is   Unrelated. Batbash is using a proxy, which is not something Icewhiz normally did. I'm not sure if Mkdw wishes to comment.--Bbb23 (talk) 13:10, 1 November 2019 (UTC)[reply]

24 November 2019

edit

Suspected sockpuppets

edit

One of Icewhiz's major topics of interest was discrediting the academic Marek Jan Chodakiewicz. This was even included, with diffs, in the ArbCom finding Wikipedia:Arbitration/Requests/Case/Antisemitism_in_Poland#BLP_violations (and you can see his interest in this topic just through a quick glance at its edit history or talk page). So the edits by the new account AstuteRed are a major REDFLAG here. Two weeks after registration (the account was only active for a few days then took a wikibreak for over a week) out of the blue the account created About the Civilization of Death, a nicely formatted article that would be extremely hard for a new account to write; this makes it quite clear it is a not a new editor but someone who is quite familiar with editing English Wikipedia. Said article is also a very clear attack piece against that BLP subject. And then shortly after we have this edit: [39]: also well formatted, and also with a clear agenda of smearing said BLP subject. What are the odds that an obscure Polish author like that would get a new experienced Wikipedia editor with an axe to grind shortly after an experienced editor with an axe to grind got indef banned? --Piotr Konieczny aka Prokonsul Piotrus| reply here 05:29, 24 November 2019 (UTC) Piotr Konieczny aka Prokonsul Piotrus| reply here 05:29, 24 November 2019 (UTC)[reply]

@Oshwah: The account hasn't made that many edits, so it's hard to find much similarity that's statistically significant (both accounts use the word 'added' in edit summaries, bu that's hardly much to work with). But also consider that Icewhiz was very interested in Polish-Jewish history, and in this article, which has nothing to do with this topic (it's about LGBT issues) we have in the lead "a book by World War II historian Marek Jan Chodakiewicz. Chodakiewicz is considered an authority on Jewish-Polish relations by right-wing Poles and serves on the council of the Museum of the Second World War." Why add this? The only reason I can think of is that is a topic-ban bait for Volunteer Marek, an editor who got topic banned from Polish-Jewish topic ban area in the same arbcom (Icewhiz got the same topic ban shortly before other issues led to his inded ban). And Icewhiz and VM had so many disagreements that arbcom issued an interaction ban for the two as well. Same for [40], why mention that the subject is a WWII historian? Plausibly so that if VM took the bait and reverted this or edited the other article, an AE report could be made for a topic ban violation against him. So in addition to being interested in the same niche topic and clearly not being a new account, there is also a plausible connection to the WWII PJ topic area, another big one for Icewhiz, and a bait for an editor he has an ax to grind with. Very quack quack for me... --Piotr Konieczny aka Prokonsul Piotrus| reply here 07:40, 24 November 2019 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

edit
  • Other than having the same apparent agenda against Marek Jan Chodakiewicz, are there any specific behavioral similarities that can be used to identify and connect these two accounts? Similar edit summary usage, grammar, formatting, verb use, anything that connects them in this manner? I believe that this agenda-based editing behavior is enough to request a CU review this SPI report, but it would also be nice to have evidence and similarities that can be pointed to with diffs and in-depth comparisons. ~Oshwah~(talk) (contribs) 06:11, 24 November 2019 (UTC)[reply]
Endorsing CU review. ~Oshwah~(talk) (contribs) 06:11, 24 November 2019 (UTC)[reply]
Piotrus - I understand. Sometimes big picture actions and behaviors speak louder than individual diffs and subtle comparisons, which is why I endorsed a CU request. While having diffs, specific comparisons, and a preponderance of evidence would be a "nice to have", I still feel that there's enough big picture behaviors here to assert that enough discretion exists for a checkuser to investigate this. ~Oshwah~(talk) (contribs) 08:10, 24 November 2019 (UTC)[reply]
  •   Unrelated/  Inconclusive. AstuteRed is using a probable proxy. Icewhiz does not normally use proxies. In addition, AstuteRed's user agent does not match any of Icewhiz's user agents.--Bbb23 (talk) 14:47, 24 November 2019 (UTC)[reply]
  • I agree it's likely not a new user, but I don't know who it is, and I don't think this is Icewhiz. Closing with no action for now. Feel free to re-report if there's a clearer connection than just one historian. TonyBallioni (talk) 02:34, 25 November 2019 (UTC)[reply]

07 December 2019

edit

Suspected sockpuppets

edit

Same activity on Home Army(Armia Krajowa or AK) page and comments about Polish resistance and Home Army as indef banned user Icewhiz did on this page and others, remarks about Poles killing more Jews than Nazi Germany,use of same source, comments Polish sources being "low quality" "for schools", same interest in removing information about Soviet atrocities against Polish population in World War 2.Uses same language as Icewhiz.I asked for checkuser check, but I believe evidence based on behaviour is strong enough and I expect this user to use different IP, but it doesn't hurt to check.

Please note the use of the same source, the same comment, and the same numbers:

  • Icewhiz:

[41]Poles killed more Jews (100,000-200,000 per Gross) than Poles killed Germans (at most 30,000 per Gross).)

  • Icewhiz:

[42]the Polish movement (outside of the failed Warsaw uprising mentioned in the text in 1944 where it is relevant) had little impact on war (if were are to mention it - perhaps it bears mentioning estimates that killed more Jew than Germans

  • JoeZ451:

[43]Gross tells Poles killed more Jews than Germans. Germans killed are 17000 in the 1939 invasion, 5000 in next four years, 5000 in Warsaw uprising. So at most 10000 for Polish resistance. The book tells that these crimes and inconsequential effect on Germans are politically sensitive in Poland itself

Note use of the same use of language by Icewhiz and JoeZ451 in edit summaries and comments.

  • JoeZ451:

[44]Wild claims from Home Army veteran organization.

Icewhiz:

[45] contains rather wild upper limits for the AK's

  • Icewhiz:

[46]including the IPN Bulletin - mainly distributed in schools, full of hero worship and religious styled text..

  • JoeZ451:

[47]Wikipedia should not use Polish schoolbooks parroting Home Army veterans.

  • Icewhiz:

[48]UNDUE weight to small minority opinion, low quality sources

  • JoeZ451:

[49]Replaced low-quality Polish language

  • Icewhiz:

[50]Right-wing media - tag better source. [51] reliable sources as opposed to blogs

  • JoeZ451:

[52] Polish blogs and right-wing media

Same removal of information on topics regarding Soviet atrocities against Poles in territories annexed by Soviets from Poland, including removal of information that they were annexed and occupied:

  • Icewhiz:

[53] [54]

  • JoeZ451:

[55]


MyMoloboaccount (talk) 20:56, 7 December 2019 (UTC)[reply]

Amusingly the below reply by JoeZ451 is copying Icewhiz choice of words a well: I wrote low-quality blog because "London Branch of the Polish Home Army Ex-Servicemen Association"

Icewhiz: [56] is not a RS (being published by London Branch of the Polish Home Army Ex-Servicemen Association)' --MyMoloboaccount (talk) 22:01, 7 December 2019 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I do not know who Icewhiz is. In Soviet annexation of Eastern Galicia, Volhynia and Northern Bukovina the article was tilted to Polish viewpoint, I modified to also show Ukrainian side. I copied Gross from book because of discussion on casualties: [57] started by Piotrus. I also quoted historian Marcin Zaremba. The two I found searching. I wrote schoolbooks because Polish language schoolbooks were used. I wrote low-quality blog because "London Branch of the Polish Home Army Ex-Servicemen Association": [58] was used. — Preceding unsigned comment added by JoeZ451 (talk • contribs) 21:13, 7 December 2019 (UTC)[reply]

Proving I am myself, never thought this would be Wikipedia. I wrote "London Branch of the Polish Home Army Ex-Servicemen Association" because I copied that from the reference text in the article. Blame the person who wrote that to begin with. — Preceding unsigned comment added by JoeZ451 (talk • contribs) 22:28, 7 December 2019 (UTC)[reply]

Could you tell is why you chose to use a proxy while editing Wikipedia? --Piotr Konieczny aka Prokonsul Piotrus| reply here 03:02, 8 December 2019 (UTC)[reply]

I concur with Molobo that this is not a new account. Using proxies is never a good sign; and this is the third (at least) new account that appeared in this topic area in the last two months that shares similar POV to the indef banned Icewhiz AND is using a proxy. Something smells rotten here, but whether it is Icewhiz, I am a bit less sure, there is some similarity to another indef banned editor, User:Jacob Peters (see Wikipedia:Sockpuppet_investigations/Jacob Peters; I'll ping User:My very best wishes who seems to be more familiar with this editor). It may be more of a case of meatpuppetry of sorts rather than sockpuppetry. PS. Also: Account created: 13:30, October 30, 2019 First edit: 21:40, November 14, 2019; in my experience (I teach students and run edit-a-thons and help newbies) most new users will edit as soon as they create an account, not wait few weeks. PPS. Also, Joe seems to have picked up right where another short lived account Gunter888 (talk · contribs) dropped off, both share similar areas of topic interest plus seem to use the same intermediate level of English; I find behavioral similarities between those rather strong; through as far as editing topic area Gunter is also an almost 100% match for Icewhiz, much more clearly than Joe. --Piotr Konieczny aka Prokonsul Piotrus| reply here 03:02, 8 December 2019 (UTC)[reply]

This is hard to tell. The pro-Soviet bias is similar to the bias by Jacob Peters. But it means little. I can only say that such edits (also note edit summary) were made by the user specifically to enrage users (like you) who are familiar with the history, and they certainly do NOT improve the content. WP:NOTHERE. My very best wishes (talk) 03:20, 8 December 2019 (UTC)[reply]
  • But there is something else. Consider this edit summary by Joe. This "low-quality" versus "high-quality" sources. User:Paul Siebert just discussed the same using same wording [60] ("many non-controversial and low importance topics, even ordinary newspapers, journals and magazines can be considered as "reliable but low-quality sources"... "the sources that are considered reliable may be of higher and lower quality", etc.). Now, let's compare the schedule editing by Paul [61] and Joe [62]. Both edited continuously, but had a break between November 20-22 and December 5-7. Also note that Paul Siebert acted as a "defender" of blocked user Batbash (aka Joe): [63] (here he asks about sockmaster). There is definitely a coordination here. My very best wishes (talk) 04:45, 8 December 2019 (UTC)[reply]
  • Or consider edit summary here [64] "extraordinary claims based on low quality sources", or here "Replace with neutral high quality source" (note that Joe in fact removes claims sourced to good sources [65]). This is exactly the argument by Paul Siebert on ARCA and above, which were made next day after the comments by Joe. My very best wishes (talk) 16:04, 8 December 2019 (UTC)[reply]
So, just to summarize, (a) I think that Joe is Batbash, and (b) I do not blame Paul of sockpuppetry (perhaps he simply reads comments by Joe, and it is Joe who coordinates his activity with Paul). My very best wishes (talk) 16:31, 8 December 2019 (UTC)[reply]
Since you mention Batbash, I think he was blocked as a sock of Wikipedia:Sockpuppet investigations/יניב הורון. I'll ping User:Mkdw. --Piotr Konieczny aka Prokonsul Piotrus| reply here 09:57, 9 December 2019 (UTC)[reply]

Is this encyclopedia? Or House of Cards (American TV series) show? I am not Icewhiz or Jacob Peters or Gunter888 or BatBash or Paul Siebert. I am not their proxy. My name is Joe. I registered this account after I saw Home Army told mass killing of helpless Ukrainian civilians in the Great Patriotic War was justified while mass killing of helpless Polish civilians was murder. I think Wikipedia and people generally outside of Wikipedia should treat other people equally. That was my trigger to register, but I have been working on other topics too. — Preceding unsigned comment added by JoeZ451 (talk • contribs) 06:08, 8 December 2019 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit

  Unrelated/  Inconclusive (using a proxy).--Bbb23 (talk) 02:17, 8 December 2019 (UTC)[reply]

  • Bbb23 no objections here. I’ll email you re: the other accounts.

10 December 2019

edit

Suspected sockpuppets

edit

Ok, here we go again with behavioral evidence (since I am betting IP check will be yet another proxy; btw why are those proxies not getting blocked?). Account created: November 9 (a month ago). Made 3 edits on Nov 9, then went dark for a week, and from Nov 15, started doing numerous edits undoing minor vandalism (recent changes-related?). After few days of editing (Nov 16, 23, 28) and ~100 edits IDOM starts using WP:TWINKLE. On Nov 30 he comments in several AfDs displaying advanced knowledge of deletion system (well formatted vote) as well as GNG (he cites WP:NEVENT, [66], concepts like "redirect and merge", [67]). On December 1 he files two SPI reports Wikipedia:Sockpuppet investigations/Pastsheld, Wikipedia:Sockpuppet investigations/Couper2802. On Dec 3 he demonstrates familiarity with deletion sorting ([68]; and it was a specific del sort field where Icewhiz was active in before - in general Icewhiz was pretty active in AfDs and did a lot of del sorting). On Dec 7 comments in a WikiProject talk discussion ([69], note that Icewhiz had made comments on that WP talk page before, see comparison tools). Shall we say, "clearly not a new account"?

Now, what is the connection with Icewhiz, besides familiarity with (gender) del sort and milhist project talk? This AfD edit (user's first of 4 AfD edits they made, all in a single day) is to defend an article created by another suspected sock of Icewhiz reported and archived here (AstuteRed who stopped editing after the SPI report was made...). That article is about a very niche topic (BLP subject Marek Jan Chodakiewicz) that Icewhiz edited significantly and was even sanctioned in the ArbCom (see archive, links in AstuteRed report). That day and next day he restored AstuteRed edit in related article ([70]). Note that IDOM did not show any interest or knowledge in those topics before. Coincidence? Well, on Dec 6 he restores another suspicious account (see this page or its archive, through as I said that account looks IMHO more like meat than sock) edit at [71] (article on Home Army which Icewhiz edited extensively before) but the clincher is this talk page comment which quotes obscure REDFLAG/UNDUE/FRINGE research (sourced to a German language interview) with extreme anti-Polish claims ‘Poles killed more Jews than they did Germans during the occupation’. This is the type of baiting/fringe extremism that Icewhiz was very fond of. But if we need one more piece of evidence, on another obscure article (Stefan Michnik) IDOM restores Icewhiz's edit ([72]->[73])

IMHO, per evidence presented above, this is very likely Icewhiz, using an account which specializes in innocent recent changes ‘vandal reversion’ to rack up edit counts and make cursory analysis of similarities difficult. Clearly not a new account (recent changes, SPI knowledge, etc.). Telling sings is that the account suddenly jumps into very fringe topics of interest to Icewhiz, in particular such as Chodakiewicz (plus Stefan Michnik). Talk page comment at HA with “Poles killed more Jews than they did Germans” is “pure Icewhiz”, nobody else in this topic area represented such extreme fringe bias.

Finally (and this is a bit stretching), maple is an association with Canada, and Icewhiz was banned for offwiki harassment of certain editors who live in Canada (I won't say anything more since this veers into outing, email me or better, ArbCom, if you need further information). The point is that the very name of this account could be seen as a veiled dig at some of his opponents.

So, quack, quack, quack, I think it is enough quacks to make a WP:DUCK.

I will note that I am not the only one who sees a behavioral connection: [74], ping User:El_C, also User:Volunteer Marek who I think can offer an opinion now that his interaction ban is rescinded.

PS. I also predict that other accounts that fit this pattern will be created or already have been. Said pattern being making semi-automated, easy to replicate edits to specialized areas to rack up edit counts (AfDs, categories, various cleanup backlogs) then after reaching edit/age treshold for autoconfirmed they will appear in topics of Icewhiz interest to continue the fight :(

PPS. Some related SPI reports also show possible coordination between Icewhiz and Yaniv (Wikipedia:Sockpuppet investigations/יניב הורון). A CU may also want to investigate that dimension as well. --Piotr Konieczny aka Prokonsul Piotrus| reply here 04:40, 10 December 2019 (UTC) Piotr Konieczny aka Prokonsul Piotrus| reply here 04:40, 10 December 2019 (UTC)[reply]

But Piotrus, you restored Seedsdough's edit [75] → [76] at Home Army, an article that you have edited extensively before. And at Gerbilling, your edit was restored by Pastsheld, Rayonlada, and Idreamofmoneytransfers [77] → [78] [79] [80]. Gerbilling is an obscure article and I'd say a fringe topic of interest. Patsheld and Rayonlada even used the same edit summary as you did ("UNDUE"), and Idreamofmoneytransfers's edit summary also accused IdreamofMaple of socking. Coincidence? Does that mean, quack, quack, quack ... enough quacks to make a WP:DUCK? Are these your socks? No, of course they're not. – Levivich 05:18, 10 December 2019 (UTC)[reply]
As the editor who got HA to A-class, you won't be surprised I have HA watchlisted, and as for Gerbling, I started monitoring suspected sock AstuteRed after their About the Civilization of Death thinly disguised attack page (that AfD will need a revisit after relevant socks are officially blocked), which popped up on WP:POLAND new article alerts, which I've been monitoring for over a decade... As for the obvious socks in question, I am somewhat curious who can this be, maybe User:Tatzref or someone else with little love lost for Icewhiz, stalking his edits (through the fact that someone is stalking those accounts suggests that someone else has made the same connection, see this edit summary...)? Shrug. There is also a possibility of a false flag type of operation, just to create some confusion (or an image of a martyr). Or some random sock troll might be just having random fun to make CU job more difficult. Roll a die, chose a result, what is one supposed to do with throw away accounts like that that have no behavioral evidence to tie it to anyone? But for the record, I give full permission to any CU to run comparison between those socks and me. I am not running any, nor am I using any proxies, and as an editor who disclosed his real name from day one, I have nothing to hide. Do you? Of course not, I am sure. --Piotr Konieczny aka Prokonsul Piotrus| reply here 05:34, 10 December 2019 (UTC)[reply]
Yes, I agree, that's exactly the point. The socks that are restoring your edits are not necessarily you; the socks that are restoring IW's edits are not necessarily IW. It could be a false flag on either side, or just the same troll playing both sides. It could be me (sure, I give consent to CU me as well). It could be anyone. This is not DUCK, this is TROLL. – Levivich 05:46, 10 December 2019 (UTC)[reply]

I will note that at least one admin thinks IDOM is behaviorally similar to Icewhiz, enough to throw a topic ban based on this rationale: User_talk:I_dream_of_Maple#Eastern_Europe_topic_ban. --Piotr Konieczny aka Prokonsul Piotrus| reply here 02:41, 11 December 2019 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

edit

  Unrelated/  Inconclusive. I do not buy that this user is Icewhiz behaviorally. Closing.--Bbb23 (talk) 16:00, 10 December 2019 (UTC)[reply]

24 April 2020

edit

Suspected sockpuppets

edit

I don't go out of my way to look for Icewhiz socks, but few hours ago I had a run in with a new account that looks mighty suspicious. Short version of this report: recent account (Feb'20) that is a very quick learner of the wiki-ways, 100% of edits are innocent and SPA about coronavirus... then today it suddenly jumped into an obscure Polish history topic with fringe antisemitism arguments. Effectively looks like a sleeper account which build up credibility with a bunch of simple edits / comments and now is revealing its "true colors". Here is the more in-depth analysis with diffs:

  • 1st Feb 2020: account created. In his first few edits on the talk page he "doesn't know" how to WP:SIGN but...
  • 4th Feb 2020: first red flag: he pings an editor. He would not do it again later - I think this was an accident, too much knowledge shown, that didn't fit the 'I am a n00b learning the ropes' pattern
  • he makes few dozen of innocent minor edits and simple talk page comments, nothing too time consuming, all minor stuff.
  • late MArch: he clicks through Wikipedia:Adventure. The account then lies dormant for a month (might be worth checking if this coincides with wide range blocks affecting known Israel VPNs which are likely related to a bunch of his previously reported sock going offline)
  • 31st March: comes back and now he now signs his talk properly. Good job retaining the WP:ADV skills from a month ago that he never had the opportunity to put in practice :>
  • same day: he correctly formats a vote in a RM and indents it using a *: [81]
  • same day: he posts in a WikiProject talk discussion, indenting it with a : [82]. As someone who has taught many new editors through educational and outreach initiatives, I know that it is very rare for a new editor to even know about WikiProjects, much less to engage in talk page discussions or such. Or RM votes...
  • April 11: now he discovers template talk namespace [83], another strange place for a new editor to stumble upon. Oh, and he uses the wiki-term stub. Another slip.
  • same day: he also knowns how to link to a subsection of a talk discussion: [84]
  • April 24: [85] proper formatting of an EL in a discussion
  • same day: comments in another WikiProject talk discussion: [86]
  • same day: [87] He adds controversial content (but it is referenced, I believe this is the first time he made such an extensive edit and used references). Also uses the blockquote template, another advanced skill.
  • here is where the plot thickens further: I revert him (no undo, just edit old version). A new account with no history of revert warring or such, new to a topic area, would likely take several days before checking... but our 'genius n00bie' knows this is not how things work here. He reverts back within an our, I revert him the second time and mention BRD, and he reverts back within two minutes [88] and posts on talk [89] within another two minutes. Even through I didn't link WP:BRD in my edit summary, he knows what is expected - engage in discussion, another sign of experience (or intuitive wiki genius...?). As he is reverted once again by another editor this time, our young genius 'evolves' again, [90] this time not reverting, no, he wouldn't want to get to 3RR, right? Instead he adds another controversial claim to the article, as well as, lo and behold, {{POV}} just like Icewhiz - diff/[91] and {{unreliable sources}}
  • then I got to file this report per WP:DUCK :) Extremely unlikely to be a new account and fits patterns of previous likely socks of Icewhiz.
  • (update) next day: he dodges the question how he arrived at this topic, he however dredges a diff from... 2005, suggesting advanced wiki skills (I am not even sure what tool you need to find such obscure piece of info in an archival history of someone's userpage!). [92]. In the next edit he uses {{quote}} properly.
  • [93] Makes a comment at a Good Article discussion (that requires more clicking through than normal talk page, and even noticing such a review is in progress).
  • From that day he finally tries to 'diversify' his edits, making edits to several WWII-related topics.

Do note that it just takes him a few edits to learn a new advanced trick. Having taught hundreds of students, well, if he is not a sock he is a rare wiki genius. Anyway, the above shows that 1) he is not a new editor but 2) he is trying to pretend he is. Through of course we can AGF and assume he is a rare 1% genius but... the problem is why this editor, interested solely in cornavirus (where he build up his edit count with minor edits and short talk comments) suddenly becomes interested in a niche Polish history topic? And how he discovers that there is a recent discussion (inside a Good Article review too boot) related to antisemitism (which is a major area of interest to Icewhiz's)? The odds of a new editor stumbling into such an esoteric area are abysmally low. Further, this account fits the pattern of other suspicious accounts reported here which I'll note I was told, privately by several Checkusers, are very likely Icewhiz but due to privacy reasons (or because they don't want to publicly disagree with another CU) they cannot admit it here: all created recently, making few dozens of minor 'good' edits in short spurts lasting a day or so with several days of break in between (alternating with another sock account, possibly?) before suddenly veering into a topic area that Icewhiz was interested in. All also stopped editing shortly after being reported here (burned...?) or after being hit by a wide range block covering Isreal's VPNs. How much WP:DUCK coincidences we need before someone will say openly those are likely Icewhiz socks? For what it is worth, I had spend dozens of hours before he got his indef talking to him and became familiar with his pattern of edits, and what topics I can expect him to appear, and what kind of edits/arguments he will make. This is classic Icewhiz, adding UNDUE claims about subject's antisemitism. Evidence of this being a common pattern in his edits can be seen at Wikipedia:Arbitration/Requests/Case/Antisemitism_in_Poland/Evidence#WP:BLPVIO, Wikipedia:Arbitration/Requests/Case/Antisemitism_in_Poland/Evidence#Anti-Polish_POV_of_Icewhiz, both of those sections discuss a number of edits similar to the diff above. But also since a direct diff is often good rather than a list of them, consider [94]: Icewhiz adds claims of antisemitism to another biography of Kot's contemporary (WWII-era) Polish person; note similar reference style too. Similar topic, similar POV, similar wiki editing skills. Again, this is not an exception, see linked ArbCom sections. Also, one more interesting match: in [95] PU cites a book by Zimmerman; Icewhiz was well aware of that book and cited in on numerous occasions: [96], [97], [98], [99], [100]. What are the odds, eh? Oh, and to dig this hole deeper, in [101] he references an article by Polonsky, another scholar Ice cited and extensively used in the past: [102], [103], [104], [105], [106] and edited his bio [107]... So to be clear: not only PU jumps into a new topic area making edits fitting Icewhiz POV and modus operandi, he also uses virtually the same sources (Polonsky, Zimmerman - those are not household names; they are academic authors only people with a deep interest in this topic area would know; I want to stress that as someone who cites them myself in this context I can think only of a dozen of so Wikipedians who are familiar with this niche literature...).

Also please note, Icewhiz, just like PU, didn't use citation templates much in references, he formatted them manually. Compare [108]/[109] (I) to [110]/[111] (PU, note similar manual style of noting page ranges). Through this can be easily changed, I fully expect the next sock to use automatic citations... still, it's telling PU knows he needs to provide page ranges, and despite learning a lot of advanced wiki skills. has not surpassed Icewhiz when it comes to mediocre formatting of references.

Lastly, I will inform several other editors familiar with Icewhiz pattern of edits and ask them to comment here, so let's see if others familiar with that editor will think I am over-reacting, or am I right about the behavioral pattern discussed here.--Piotr Konieczny aka Prokonsul Piotrus| reply here 12:58, 24 April 2020 (UTC) Piotr Konieczny aka Prokonsul Piotrus| reply here 12:58, 24 April 2020 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

This is also obviously the same person as the one behind this account User:Muddymuck. Note the peculiar overlap in interests (edits on the Coronavirus pandemic [112] [113] + Icewhiz style interest in Eastern Europe, same as this Pestilence account) and also the “fake bad English” comments and edit summaries that skip words like “have” or use wrong tense “I rearranged” “I remove” (despite using pristine articulate English, big words and all, elsewhere [114]. Pestilence has done the same thing (as have other Icewhiz socks) [115] (and elsewhere) and for articulate English see their user page [116]. It’s the same person behind both accounts. Volunteer Marek 08:22, 26 April 2020 (UTC)[reply]

But what is the connection to Icewhiz of all those account except interest in Polish topics and having opposite POV?--Shrike (talk) 09:25, 26 April 2020 (UTC)[reply]
Muddymuck is not that clear yet, I don't see a "smoking gun", so I wouldn't report it (yet). Worth monitoring further though. But for PU, I explained things above in quite a lot of detail. Obviously a sock (too quick of a learner), same POV and inexplicable interest in fringe topics combined with knowledge of the same obscure academic sources make it very likely - 99% or such. As I said, as someone active in this topic are and familiar with editors and their POV, and editing patters, I can only think of 2-3 other people, over the period of 10+ years, who would fit this pattern. And Icewiz is the only one who got banned... and he demonstrated willingness to create socks like this before, numerous times (see earlier reports here). Editing beind a proxy is a very bad sign and consistent with previous reports, too. PS.I think it is clear that his strategy is to create semi-SPAs (like AstuteRed) editing topics he is interested in (one for LBGT issues, one for Poland, probably there are others for US politics, Isreali-Palestinian topics, and such, plus 'other in training'. Interest in Covid can be random false flag to throw us off and to build edit count (note that all of those edits are 'fast', nothing complicated - just racking up edit count with simple edits/comments), just like other socks played with some random topic ideas or simple patterns. Or just like you noted, Covid is popular, maybe he really is interested in it. You can never prove behavioral stuff at 100%, not unless you expect one of them to admit it :) --Piotr Konieczny aka Prokonsul Piotrus| reply here 01:58, 27 April 2020 (UTC)[reply]

And we have another one [117], this time trying to claim Polish government was tied to German Final Solution[118]...before the war even started. Very similar to Icewhiz behaviour and claims.--MyMoloboaccount (talk) 12:26, 28 April 2020 (UTC)[reply]

I added it to the list above, it is suspicious but like with Muddymuck, too few edits to for me to call it as obvious as in the case of the PU account. Could be a sock of Janj9088 instead? --Piotr Konieczny aka Prokonsul Piotrus| reply here 14:26, 28 April 2020 (UTC)[reply]
Comments by Shrike
edit

I did some research in those accounts Fist of all Covid is issue number one in the wold today so its only natural that many users will edit those articles

  • Muddymuck (who have almost not edited covid at all) - [119] - supports removal of leakage from Wuhan lab.
  • Pestilence Unchained (who seems to be focused on covid , other pandemics, and death) - [120]- think that the Wuhan lab is mostly known for the covid leakage conspiracy.
  • So they have opposing POV about Covid. Hard to find much else as they edit totally different topics.
  • The editing times of MuddyMuck (11:00-16:00 UTC) and Pestilence Unchained (02:00-10:00 UTC) are totally different.

About older reports of alleged socks

  • AstuteRed - wp:SPA on LGBT issues.
  • JoeZ451 - mostly edited Ukraine, local Kansas, conflict between Ukraine/Poland, and the Ukrainian Orthodox Church. Appears to have a devout Christian of Ukrainian background - its difficult to see how they connected to icewhiz --Shrike (talk) 19:23, 26 April 2020 (UTC)[reply]
Regarding 1 and 2, that is incorrect. The comments by Pestilence and Muddymuck are NOT contradictory. In fact they are both vague "not enough information" statements. Muddymuck says "It is a plausible scenario". Pestilence says "There is no "Wikimafia ", but I agree that the institute is best known for this controversy or speculation". 'Plausible scenario' and 'best known for' are actually pretty similar. This is NOT "opposing POV about Covid" at all.
While we're here I think the statement from Pestilence about "there is no "Wikimafia"" is also another indication (as we needed more) that this is a sock puppet. He's been here 2 months. How would he know?
As far as the difference in editing times - Muddymuck seems to have edited almost exclusively on Sundays between 10:00 and 16:00 UTC. That actually lines up almost exactly with "taking over" from Pestilence who made edits on Sundays between 6:00 and 10:00 UTC. In fact, this shows that the person behind accounts would just edit with Pestilence first, then switch socks at around 10:00 AM each Sunday. And the pattern is quite strong (if they were two different people you'd expect to see more randomness and overlap) so this point actually reinforces the suspicion that they're the same person (lack of overlap is usually taken to increase the probability of sock puppetry since presumably it's messy and difficult to edit with two accounts at the same time - experienced sock puppeteers know that this makes it easier to make a mistake which reveals their sockpuppetry)
There is a clear connection between Icewhiz's edits and Pestilence, already documented exhaustively by Piotrus above. There's also a pretty strong connection between Muddymuck's mass removals of "Jewish atheists" category from many articles [121] and many Icewhiz edits where he made similar arguments (this actually came up during the ArbCom case). (And that's not in any way a judgement regarding whether such categories belong or do not belong in these articles - I have no opinion on the matter)
Bottomline - there's a pretty clear connection between Pestilence and Icewhiz behaviorally. We know Pestilence is using proxies to hide their IP, just like many other socks in the topic area. We know Pestilence build up an "innocent" edit history for two months and then all of sudden jumped into Poland related topics, made POV comments and edits that match Icewhiz exactly AND tried to torpedo Piotrus' GA nomination. And Piotrus was also one of Icewhiz's targets. I think there's very little doubt here.
As for Muddymuck - simple question: is this account ALSO editing from behind a proxy? If not, I would revise my assessment that this account and Pestilence/Icewhiz are the same. But if Muddymuck IS editing from behind a proxy, then yeah, it's the same dude. Volunteer Marek 21:19, 26 April 2020 (UTC)[reply]
Didn't we conclude that Joe was a sock of Ice's buddy Yaniv? Or was it Kaiser von Europa? It was a while ago, so that one is not very relevant here anyway. --Piotr Konieczny aka Prokonsul Piotrus| reply here 01:52, 27 April 2020 (UTC)[reply]

@Reaper Eternal: note that in my comment above I predicted that Muddymuck was using a proxy. All these socks are using proxies, and yes, they are using several ones. Before he started creating named sock puppets, right after his indef ban, Icewhiz used several anonymous IP addresses with proxies as well. And those also involved several different proxies. This guy is serious about his sock puppetry.

But in each case the pattern is the same. Use proxy server. Make a bunch of legit edits to an unrelated topic to build edit history. Then jump into some Poland-related controversy. Follow a pretty well defined anti-Polish POV. Oh and also this whole "In one place I'm going to use perfect English with fancy words and all but in another place I am going to pretend I no speak good English" is another peculiar feature all these socks have in common (I think he forgets the fictional backstory to a specific sock cuz he's created so many of them). User:I dream of Maple (see also [122]) was another one that fit this pattern and there were at least half a dozen others though I can't remember their usernames right now. Volunteer Marek 20:02, 27 April 2020 (UTC)[reply]

    • IIRC he was also interested in LGBT, US politics and Israeli issues. I expect that if we keep catching his socks that are designed for Poland topics, we may see him into those, and they would be doing more than just fast/minor edits in those areas. Just a prediction in the areas of content that future socks may appear to have. Anyway, yeah, "what are the odds" of so many new accounts getting interested in obscure Polish history, sharing Ice's POV and sources, and using VPN... --Piotr Konieczny aka Prokonsul Piotrus| reply here 02:06, 28 April 2020 (UTC)[reply]
      • Piotrus, aren't you tired of these wild goose chases? You and VM have been crying "socks" for months now, with little to show on SPI. You went as far as accusing editors on AE without any evidence whatsoever![123] You're buck-shotting editors who present a range of POVs, on a range of subjects Icewhiz never showed any interest in. Don't you think it would be better - not least for the benefit of good faith - if you stopped throwing these accusations around as easily as you do?
Oh, and by the way: people use VPNs and proxy servers for a range of reasons, including privacy, security, speed, access to "walled" content, and others. There's not much to it, especially now.[124] François Robere (talk) 16:39, 28 April 2020 (UTC)[reply]
Annnnddd, right on cue. Volunteer Marek 01:16, 29 April 2020 (UTC)[reply]
You mean like the other week when you dropped out of the blue into my TP and joined Piotrus, GCB and MMA in a flurry of PAs against me when an admin was watching? Gosh, that was a strange coincidence! François Robere (talk) 08:55, 29 April 2020 (UTC)[reply]
Please link the diff of any personal attack I have made against you or apologize for the false accusation directed at myself. Thank you in advance. Oh, and what "admin was watching" this? How come they didn't intervene? Please ping them here so they can explain themselves. --Piotr Konieczny aka Prokonsul Piotrus| reply here 09:45, 29 April 2020 (UTC)[reply]
"a range of POVs, on a range of subjects Icewhiz never showed any interest in" <-- completely false. These are *precisely* the subjects (Poland, anti-semitism, LGBTQ) and *precisely* the POV that Icewhiz "showed interest in". Volunteer Marek 01:22, 29 April 2020 (UTC)[reply]
Right, it is just a coincidence that all of those new accounts, sharing Icewhiz POV and style, just happen to be on VPNs. And it is also a coincidence, surely, that a number of times you supported them in reverting / comments. You know, this is not helping dissipate the suspicions of meatpuppeting raised recently at AE... --Piotr Konieczny aka Prokonsul Piotrus| reply here 01:11, 29 April 2020 (UTC)[reply]
These are *precisely* the subjects... that Icewhiz "showed interest in" I don't recall Icewhiz concerning himself with Finland, Russia or the "Wikipedia Adventure", whatever the hell that means.
sharing Icewhiz POV and style Have you seen Fireslow's edits? Those are hardly Icewhiz's typical style, so either Icewhiz is intentionally trying to look like an idiot (and he did have a sense of humor, you must admit), or it's someone else. Incidentally, "Fireslow" was blocked by Guy for being an (apparently) unrelated "puppet", so naming them here is redundant. Incidentally, PiotrusW - another editor you accused of "socking" for Icewhiz - also ended up getting blocked for "socking" for someone else.
But anyway, that's not the point. The point is you and VM have been busy with "defending" the TA (from which VM is banned, I should add) from editors you don't know nor like, instead of focusing on building constructive relations with anyone willing to contribute. How did your accusations against Tino Cannst end up? And the quadruple assault against me that other week? This approach isn't very conducive to WP:AGF. François Robere (talk) 08:55, 29 April 2020 (UTC)[reply]

As a general question, it has been my understanding that editing via proxy is generally prohibited, per WP:NOPROXY, and that in fact Wikipedia preemptively blocks proxy IP ranges - which means that in order to successfully edit via proxy the user in question has had to gone to considerable effort to find an unblocked ip range. It is has also been my understanding that the only way you can edit from behind a proxy or vpn is if you apply for special permission/exemption. I’m assuming that none of the accounts listed above has done that. Is this correct? Volunteer Marek 07:24, 29 April 2020 (UTC)[reply]

WP:NOPROXY explicitly concerns itself with abusive editing and block avoidance, not with legitimate use. François Robere (talk) 09:35, 29 April 2020 (UTC)[reply]
Well, block avoidance and abusive editing is the issue here. --Piotr Konieczny aka Prokonsul Piotrus| reply here 09:45, 29 April 2020 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit

14 May 2020

edit

Suspected sockpuppets

edit

I am filling this, expecting the finding that this account operates under a proxy as well, confirming that we are resigned to dealing with an army of abusive socks infesting the topic area (despite prior reports and the fact that several editors familiar with Icewhiz such as User:Volunteer Marek and User:MyMoloboaccount concur with me that the behavioral evidence is pretty clear; this really should be listed under a WP:LTA). I understand there are concerns with privacy (outing due to IP addresses reported here) and/or fear that a block based on behavioral evidence will be challenged and one will be criticized by their peers, but the mop and bucket are supposed to be used - and right now I am watching with more and more concern as this topic area deteriorates with socking at a level that I haven't seen in a decade or so, if ever. But here we go, again. I will also add a summary of the prior sock reports so you can see the patterns more clearly if you have not been following this closely.

  • background note: Icewhiz was topic banned by ArbCom from EE TA on 22/23 September 2019 and indef banned for harassment or such a week later. Now, quoting from this newspaper interview published shortly after: "Icewhiz admits he can be a bit obsessive, and over the past year and a half he has documented almost fanatically what he claims is a systematic attempt by a handful of editors to rewrite the history of the Holocaust [article links to ArbCom case here]... Though Icewhiz has earned a bad reputation on Wikipedia, due to his combative personal style and aggressively pro-Israel position... Icewhiz says that he brought his story to Haaretz because he has all but lost the battle against Polish revision on Wikipedia." Do you think that a person who was invested enough to get a journalist interested in their story is just going to walk away from this?
  • (1) AstuteRed (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) (account created October 26 2019) he went dormant after my sock report here but reactivated on April 30). This account specializes in the LGBT topics that Icewhiz was interested in and overlapped at the obscure Polish historian who is both anti-LGBT and arguably anti-semitic (Chodakiewicz). Note that at an AfD of an article this account created, Wikipedia:Articles for deletion/About the Civilization of Death, we see the participation of another suspected sock I reported shortly after and will discuss below (User:I dream of Maple)
  • (2) I dream of Maple (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) aka IDOM (account created November 9) I refer to my extensive evidence at Wikipedia:Sockpuppet_investigations/Icewhiz/Archive#10_December_2019. While this account was ruled 'inconclusive' by CU (sigh), User:El C was also concerned that it raises many red flags and topic banned them from the TA for a good measure (thank you). That account has been inactive since; I assume that the topic ban removed their reason for existing (and switching to another TA of interest to Icewhiz would be too obvious...). However, for additional behavioral evidence, please note the pattern of quickly racking up edit count through what seems to be a recent change patrol, as well as quick adoption of Twinkle. Clearly 'not a new account' (rapid learner, adopts advanced jargon (BLP, etc.) and tools within a few weeks). Also, note the edit pattern of a few days of activity followed by breaks, shared by other socks as well. Those patterns started with this account and has been repeated by all main suspected sock accounts since.
  • (3) Pestilence Unchained (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) (account created Feb'20) See my evidence at Wikipedia:Sockpuppet_investigations/Icewhiz/Archive#24_April_2020. Nearly identical pattern to IDOM above (recent changes edit ramp, Twinkle, off and on every few days). Note that the account went dormant as soon as the SPI was filled, like others, but was reactivated on 8 May, shortly after the SPI case was closed. This is worrying and suggests Icewhiz came to the conclusion that the SPI reports here are just noise and having found access to unblocked proxies, he can now operate with impunity - and with multiple simultaneous accounts as well. Note that almost half of his recent edits relate to the EE/Jewish topic area. His edits there have a very aggressive POV that continues to match Icewhiz ([125] -> further behavioral evidence). Learning from IDOM's red flags, this account tries to pass off as a new user by Wikipedia:Adventure module (Feb 22). But another suspected sock I'll discuss below discovered this module earlier.
  • (4) So, KasiaNL (the main star of today's report). The account was created on November 19. That is a month after another suspicious account with the same naming pattern (Polish female name and two capital letters; Kasia is a Polish name), JolantaAJ (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log), was created (it was an SPI created solely to harass me and got quickly blocked by User:SQL; Jolanta is a Polish name too). And on that naming pattern, note also Urszula73 (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log). This one made just a single edit, but in addition to matching the naming pattern (female Polish name + two symbols), it intersets with Icewhiz LGBT interests (the article it edited is also related to AstuteRed's and IDOM's activity: [126], [127]). Btw, I've been monitoring User:AlexNewArtBot/PolandSearchResult for 10+ years and this is a pretty unique naming pattern. But the naming pattern is not a problem (just a tale). Let's look at more.
    • Nearly identical pattern to IDOM and PU above (recent changes edit ramp, Twinkle, off and on every few days). Within a week of the creation, the account settles in the pattern of undoing minor vandalism ([128]), not raising a single red flag (clearly not a new user, what n00b knows what vandalism is and how to undo it, 100% error-free, within their first week here, without a single missstep?). This account quickly makes a Wikipedia:Adventure edit too (Jan 6) which is IMHO a way that Icewhiz attempts to deflect the IDOM's red flags of not being a 'new user'; PU was reported earlier but in the hindsight that account is just following the path cleared by Kasia. Unfortunately for him (err, her/them, I don't think Icewhiz ever disclosed their gender, and this account uses a feminine name...) they still learn way too quickly. By December 4 (so before IDOM is reported) Kasia knows how to report vandalism on a dedicated Wikipedia namespace page, using complex templates ([129], [130]). Kasia is a bit impatient and starts using Twinkle on the same day she did the Aventure ([131]). Since in my educator capacity I have taught over 1000 students the basics of Wikipedia editing, I can say it with somewhat of a professional air that 99.9% new editors will need years before they even become aware of Twinkle. Or of Wikipedia: Adventure module, for that matter. Or the Recent Changes tool (in all my years as an educator I never ever had a single one of my students ask me about any of those features). Anyway, Kasia goes full ham on recent pages patrol, not raising any red flags - for three more days, then goes inactive until April (I expect Icewhiz is operating a number of accounts that way, racking edit counts and waiting for the socks to mature and get auto-confirmed rights and such). Before the account goes dormant, she doesn't know how to sign on talk pages [132]. The account resumes minor mass production of recent changes Twinkle-powered undos in early April. During her break, she somewhow mastered the concept of signing talk pages ([133]. [134]). Within days she is active in technical areas such as AfDs ([135]) or RSN ([136]). At this point I think there is enough behavioral evidence to conclude that just like all previously discussed accounts, this is not a new user (I would also expect that admins/CUs would be familiar with such patterns as I am sure multiple sock masters employ similar strategies).
    • Anyway, being a non-disruptive sock doesn't usually warrant an SPI or such, so let's take a look at what ties this account to Icewhiz's patterns:
      • May 7th: [137] displays knowledge of SPLC and hate groups which is a TA overlap with Icewhiz, see for example Icewhiz's comments here Talk:Marek_Jan_Chodakiewicz#Activist
      • May 7th: [138] undoes my edit which added Category:Polish Jews to an obscure article that this user never edited before. They also don't have much history undoing category additions or asking for references for categories, as so far they stuck to undoing simple vandalism so far. Additionally, my edit there was related to the name of the subject being mentioned at Talk:Stanisław Kot, where PU was active shortly before and would make more edits, including talk pages, a day later ([139]). So this edit raises red flags as follows: a) Polish-Jewish TA, second obscure TA overlap b) connected to the area known to be of interest to a suspected sock (PU) c) challenging my edit (reminder: me and Icewhiz are not 'best buddies'...). In fact, I think in the last few weeks, starting with PU's involvement in the SK article, Icewhiz decided that it's time to harass me (since all his other regular opponents are topic banned or inactive). But one edit can be an accident, so I just marked it as intriguing and waited for more. And oh boy, the diffs just come pouring in even as I am writing this up.
        • Also compare both the category removal and the broken English (which I'll discuss more below) to [140], another account recently reported here
      • May 13: an IP editor removes some content from an article Icewhiz was active in before: [141] (this fits Icewhiz POV of minimizing Polish victimhood). I undo this per WP:BRD. May 13 Kasia revert me and gives me a talk page warning ([142]). Within two minutes I receive a personal attack "warning" from an IP on my talk page ([143]). Harassment angle: I also teach with Wikipedia and my students regularly post on my talk page.
      • May 13: makes a c/e edit to History of Israel. [144]. Icewhiz has edited that page before making copy editing-type edits as well ([145]), so that's another TA matched and a direct article overlap.
        • The above is also interesting as a big chunk of Kasia's edit there is copyediting for English prose/clarity (Icewhiz spoke fluent English). Contrast it with broken English used on my talk page [146]/[147] or here [148]. Seems like an attempt to obscure one's fluence on purpose ("Icewizh was fluent so account X which speaks broken English can't be Icewhiz, right?"). But the account is inconsistent and can make normal comment even ones with advanced and perfectly correct English: [149], [150], [151], "delve deeper", (here discusses the word psychedelic and knows English expression "to be high"), likewise discusses language here. As I work with ESL students I can say this is very irregular. Also, edit to Broken English page suggests an interest in this very topic ("how can I sound more natural while pretending I am not good at English?" Riight).
        • The inconsistent pattern of broken English can also be seen in edits by other accounts reported here. Consider PU [152] ("You think he a patriot? You approve of him?", tone very similar to [153], same style of personal attack (loaded question - and I am still wondering how that 'new account' was able to find and link a diff from 2005...).
      • May 13-14: the IP editor made a number of disruptive/controversial edits related to the Polish-Jews history (see 2601:585:8200:F310:6CAB:E042:A5F3:F54A (talk · contribs · (/64) · deleted contribs · filter log · WHOIS · RBLs · http · block user · block log), 2601:585:8200:F310:B0C1:24F1:303:F986 (talk · contribs · (/64) · deleted contribs · filter log · WHOIS · RBLs · http · block user · block log) 2601:585:8200:F310:94AB:237E:EFDB:F025 (talk · contribs · (/64) · deleted contribs · filter log · WHOIS · RBLs · http · block user · block log), some with clearly abusive edit summaries or claims on talk (WP:NPA: [154], [155]; all three IPs where blocked shortly ago by User:Materialscientist for disruptive editing). One would have thought that Kasia, interested in recent changes patrol, would help undo them since this was her bulk of edits (simple clicking undo button on disruptive edits). Nope. As I revert the anon editor, she quickly reverts every single of my edits: [156], [157], [158]. With regards to the last diff, that article was protected following my request at RfPP, and I suggested to the admin User:Anarchyte on his talk that changing it to semi may reveal a likely sock. He did so, and within minutes Kasia edited the article.
        • I also want to stress that the IP/Kasia edits above are related to a particular subtopic of the Polish-Jewish TA that Icewhiz was very active in and that was presented as evidence in the ArbCom: namely challenging / removing content about Polish Righteous and helping Jews in the ghettos (just CTRL+F for keywords ghetto or righteous in Wikipedia:Arbitration/Requests/Case/Antisemitism in Poland/Evidence). Also [159] shows the account is familiar with some very obscure/niche literature in the TA (Icewhiz, of course, was familiar with those sources)
      • May 14: She also nominates a category I just created ([160]) suggesting the concept of a Jewish merchant is anti-semitic... and then starts badgering me on talk including threats of getting me banned ([161] - that probably warrants a NPA warning, if anyone still belives they do a damn).
    • Editor Interaction Analyser also adds that both Ice and Kasia frequently edited Wikipedia:Neutral point of view/Noticeboard (Ice 43, Kasia 8 - impressive considering the account's age) and both posted on Talk:Ben Shapiro (interestingly, all in surveys/RfC: [162]+[163] vs [164]. Also on Talk:Donald Trump, but this is a high profile page, so - shrug.

On a side note, there is always a possibility some of the accounts here overlap with banned sockmaster User:יניב הורון (see that account and Icewhiz tag teaming at Talk:Marek_Jan_Chodakiewicz#Activist for example). And at least one sock reported in this SPI was found to be related to Wikipedia:Sockpuppet investigations/יניב הורון. I think the broken English is more reminiscent of יניב הורון and was quite visible in edits of the account reported at Wikipedia:Sockpuppet_investigations/Icewhiz/Archive#07_December_2019 (ping User:My very best wishes; I am not very familiar with יניב הורון but it also stands to reason that two indef banned editors sharing POV, one of whom is clearly confirmed to be socking, can exchange tips and otherwise coordinate some actions), but regardless, I think that in this case, the broken English is fake and simply an attempt to 'muddy' the waters and throw a wrench in the behavioral evidence (not that it needs much derailing...).

I will also ping admins/CU who commented on this issue before: User:Ivanvector, User:El C, User:Mkdw, User:Bbb23, User:Oshwah, User:TonyBallioni, User:Bradv. Guys, this is really getting serious, the ArbCom issued topic and indef bans for a reason, and they appear to be ignored or worse, treated with contempt. The socks are now so emboldened they are harassing me on my talk page... --Piotr Konieczny aka Prokonsul Piotrus| reply here 10:07, 14 May 2020 (UTC)[reply]

So the excuse that "I looking at Piotrus's edits since 13 May, because of this edit" is also a red flag. Kasia has been doing uncontroversial RC patrol since Day 1, without making a single 'wrong' or 'controversial' edit (until now), which in itself is unlikely for a new account. Crucially, she never reverted or otherwise challenged or criticized any established user, she has been doing only the no-brainer rvv-type of edits. Regarding the two other category reverts presented as a defense - one is for a new user, another is for a user with no userpage and a block log (I assume there are some RC flags for this kind of stuff); on a sidenote - how many of you understood category system and that they require references in your month 4 on Wikipedia? And we are assuming she read those articles and confirmed those categories are unreferenced, really? Yet more high-level wiki skills not commonly found in a new editor; challenging controversial categories is not even the usual RC type of an edit). The closer we look, the more apparent it is we are not dealing with a new account, just someone pretending to be one (don't forget the inconsistent English fluency, either).
Anyway, I just reviewed her talk page edit log, again, and she never left a warning message on a talk page of any regular account (just IPs/new accounts). Since adopting Twinkle she also never left a non-template additional warning to anyone except me ([165]), nor engaged in any talk exchange outside her talk page. So what are the odds she reverts me several times in a few days, all on the Icewhiz-favorite TA? And that I became the first regular editor to receive her custom warning? My editing pattern is clearly totally different from the regular new account vandal/n00b she has been warning till now. So I am the first regular account that made an edit that made her interested in edits of a regular Wikipedian? Also, a good-faithed RC n00b, if we can imagine such a rare type of an editor, would likely be cautious and polite, and would not engage in aggressive badgering and ban threats in their first talk page interaction with a regular. Kasia's attitude towards me is very aggressive - again, perfectly reminiscent of Icewhiz's attitude towards those he wanted to pick a fight with (don't forget, he was indef banned for harassment in the end). And it's not like she is aggressive towards others, from what I can see of her limited interactions. Why attack me (or nominate my category for deletion in her first deletion nomination ever)? Coincidences, again?
Mind you, I am a very active user, and "since 13 May" I made ~200 edits or so. Which is why another red flag is the claim that "I got to this report, looking at Piotrus's edits." What are the odds that in my ~200 edits in those ~2 days she would find my post to this page of interest (edit summary did not mention her and she has no history of being interested in SPI investigations; also on the subject of the log, she can see my post here was very large, +22,267, c'mon, how many people want to review or even read long posts in Wikipedia space unless they specialize in this aspect of the project or are otherwise involved in the issue)? Vandalism to W-namespaces is super rare, what are the odds she would want to review this edit in more detail due to RC (I don't think she ever reverted any vandalism to RC pages)? Particularly given the volume of my daily edits? Most RC patrollers, or new users, would just ignore it (and ignore me). Unlikely innocent coincidence? Number 10 for this account? I lost track already. --Piotr Konieczny aka Prokonsul Piotrus| reply here 01:52, 15 May 2020 (UTC)[reply]
Thank you, FR, for bringing up the time cards. Icewhiz was a very active editor, and if he just tried to create an account that was identical in time and scope, we wouldn't have to worry about catching such a sock, it would be very easy to spot. But he is also smart enough to realize that this would happen so instead of one sock, we have a regiment of them, each with a slightly different focus in topic areas, and each editing on different days/hours. You are right that in time cards, [166] =/= [167]. But how about this equation: [168] = [169] + [170] + [171] + [172]? They feel in rather nicely when we start adding them up, it's surprising how little overlap there is between them (account A is for Mondays, account B is for Thursdays and Thursdays, C is for Saturdays, etc.). If there are any gaps, I am reasonably sure there may also be socks active in topic areas of Icewhiz that I never deal with (US and Israeli politics) or that simply haven't joined the fray yet (it would be too obvious if 2+ new accounts moved from ~2 months of RC patrol to making the same POV edits in the same topic area). And there is also the pattern of few months breaks before, which may be a sign of the second+ generation of socks being trained with the usual RC patrol method (or perhaps this is related to proxy/VPN switching, or wide range proxy blocks cutting large proxy ranges).
Oh yeah, about those time cards - regardless of day/hour/TA pattern, one thing that is really hard to cover up is the simple fact one needs to sleep. Icewhiz is dedicated, but its reasonable to assume he has some job/life outside wiki, and he is not ready to regularly edit in the middle of the night. And voila: Icewhiz and all of the suspected socks reported here drop off the grid from ~UTC 1800 to ~UTC 0400. What are the odds? Let me heartily thank you for bringing this fascinating tool (time cards) to our attention, I think it wonderfully strengthens the case here, particularly now when we can compare not just one but multiple accounts. --Piotr Konieczny aka Prokonsul Piotrus| reply here 13:38, 15 May 2020 (UTC)[reply]
Re: FR: Thank you for combining the time cards. I have some trouble loading the website but what displays indicates that the combined image looks much closer to Icewhiz's pattern, so I think it shows what I expected. We are dealing with just few months of data here, so it's not going to be as smooth (averaged) as the 3-4 years for an older and more active account. Crucial fact, however, is the time zone. What are the odds all five share the same one? If we were flailing around accusing random people, well, the time zones should be random too... yet each identified account has the same time zone -and, let's not forgoted, edits under a proxy, too, something which is very rare. Same TA, same time zone, all proxies. How many of those unlikely coincidences do we need? Shrug. Each new sock adds the missing piece of the puzzle, and I hope we have enough this time. Mills of God... --Piotr Konieczny aka Prokonsul Piotrus| reply here 15:31, 15 May 2020 (UTC)[reply]

Just a minor ping to User:TonyBallioni, can you also look at this SPA which just made an edit in a contentious area? Seems pretty quack, quack... PS. Since you also asked for specific diffs comparing accounts: [173] vs [174]. --Piotr Konieczny aka Prokonsul Piotrus| reply here 06:24, 16 May 2020 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Comments by MyMoloboaccount
Joe in regards to your comment , what level of behavioural evidence is needed to link an account to him?

last time I reported a suspected sock-puppet JoeZ45 we had pretty damning behavioural evidence but it was ignored by Bbb23 for reasons unknown to me See:

  • Icewhiz:

[175]Poles killed more Jews (100,000-200,000 per Gross) than Poles killed Germans (at most 30,000 per Gross).)

  • Icewhiz:

[176]the Polish movement (outside of the failed Warsaw uprising mentioned in the text in 1944 where it is relevant) had little impact on war (if were are to mention it - perhaps it bears mentioning estimates that killed more Jew than Germans

  • JoeZ451:

[177]Gross tells Poles killed more Jews than Germans.

Note use of the same use of language by Icewhiz and JoeZ451 in edit summaries and comments.

  • JoeZ451:

[178]Wild claims from Home Army veteran organization.

Icewhiz:

[179] contains rather wild upper limits for the AK's

  • Icewhiz:

[180]including the IPN Bulletin - mainly distributed in schools, full of hero worship and religious styled text..

  • JoeZ451:

[181]Wikipedia should not use Polish schoolbooks parroting Home Army veterans.

  • Icewhiz:

[182]UNDUE weight to small minority opinion, low quality sources

  • JoeZ451:

[183]Replaced low-quality Polish language

  • Icewhiz:

[184]Right-wing media - tag better source. [185] reliable sources as opposed to blogs

  • JoeZ451:

[186] Polish blogs and right-wing media

The above behavioural evidence was pretty damning in my view. I struggle to understand why Bbb23 ignored this. This really needs to stop. --MyMoloboaccount (talk) 10:29, 14 May 2020 (UTC)[reply]

TonyI believe the account Fireslow was Icewhiz, he had a terrible outburst of rage off-Wikipedia when it was blocked.He wouldn't be below trying to create a fake image before pursuing the usual harassment.

Also user MozeTak [187] was definitely Icewhiz, same editing style, same modus operandi, manipulated and cherry picked sources to create an attack article against Poland presenting it as dictatorship [188] just like Icewhiz [189];this was favourite pet peeve of Icewhiz who compared Poland to North Korea and Russia--MyMoloboaccount (talk) 23:41, 15 May 2020 (UTC).[reply]

Also regarding this statement considering we've had five SPIs on the guy and zero confirmations

This is only partially true, I recall that at least one sockpuppet was indef banned as one by admin, however without revealing who it was sockpuppeting for. I believe it was one of the first ones reported by Piotrus-they are dozens by now.Update, there were at least two socks blocked before this report JolantaAJ[190] and Batbash[191]--MyMoloboaccount (talk) 00:00, 16 May 2020 (UTC)[reply]

Another obvious example Gunter888 [192];just as Icewhiz removal of information about Polish rescue of Jews, focus on Warsaw concentration camp, poorly imitated bad English, vanishes after couple of edits.(talk) 14:03, 16 May 2020 (UTC)[reply]
Comments by KasiaNL

Idea I editing from south Florida, where IP from: [193] is funny.

This filing is vindictive and retaliatory, response to posting concerns on Piotrus's page: [194].

I am looking at Piotrus's edits and got involved in few articles where Piotrus reverted the IP, after I discovered edit: [195]. In this edit Piotrus absuses a source (otwarta.org), and places: "In 2001, PhD Andrzej Leszek Szcześniak published Judeopolonia - the Jewish state in Poland, explaining the origins of pre-war Jewish saying 'our tenements, your streets'.".

But otwarta.org does not mention the book, the book is by an extremist nutjob, and "our tenements, your streets" ("Wasze ulice, nasze kamienice") is not a "Jewish saying" but "popular Polish saying, which anti-Semites ascribe to Jews"[196][197][198]. I give sources, but anyone who know little Polish understand how bad this is without sources. "Wasze ulice, nasze kamienice" known by everyone. I think this was good cause to look at Piotrus's edits.--KasiaNL (talk) 10:36, 14 May 2020 (UTC)[reply]

Evidence of my doing Wikipedia adventure, installing Twinkle, user warnings on January 6th is funny. I do all that after it was all suggested to me: [199]. --KasiaNL (talk) 10:49, 14 May 2020 (UTC)[reply]

So much false statements by Piotrus above, but I will refute his claim I "don't have much history undoing category additions". I remove imporper sourced categories all the time: [200] or [201] (which how I edit Shapiro to start with). I get to these from RC patrol or forking from other contribs. Once Piotrus put source for category, all good. I can refute more, but I feel Piotrus trying to deflect from his edit I described above.--KasiaNL (talk) 13:10, 14 May 2020 (UTC)[reply]

@MrClog:, I looking at Piotrus's edits since 13 May, because of this edit: [202] I described above. I got to Piotrus from meeting the IP/64 at RC patrol (I think this edit: [203] on 12 May), and I've been watching the IP/64's edits, as I have some concerns but also think IP/64 is trying being contructive. I got to this report, looking at Piotrus's edits.--KasiaNL (talk) 13:48, 14 May 2020 (UTC)[reply]

Question from MrClog

How exactly did KasiaNL find out about this report? They haven't been notified about the report. --MrClog (talk) 13:38, 14 May 2020 (UTC)[reply]

@Ivanvector: "if the mention is not on a completely new line with a new signature, no notification will be sent" (WP:PING). KasiaNL was not mentioned in the same line as Piotrus's signature. See also their above reply, according to Kasia, they have been watching Piotrus's edits since May 13. (Although I will note I'm not an expert on the Echo extension.) --MrClog (talk) 15:30, 14 May 2020 (UTC)[reply]
Comment by Nihil novi

No Polish person that I have ever spoken with has used such outlandish English vocabulary, grammar, and syntax – alternating with perfectly normal English usage – as KasiaNL has been favoring us with. I wonder: what is the purpose of such transparent misdirection? Nihil novi (talk) 10:59, 15 May 2020 (UTC)[reply]

Comment by François Robere
  • @Joe Roe: Forgive my legalese, but it's a good basis for this decision. The standard of evidence in common law countries is (analogous to) "99% certainty" for criminal cases, and ">50% certainty" for civil ones; in civil law it's the same for the former, but much higher for the latter.[204] I submit that here the standard of evidence should be between the two, as SPIs are punitive in nature and can result in indef blocks and damage to editors' reputations. Of course, there's a cost-benefit trade off here: the higher the standard, the less "socks" you'll catch; the lower, the more false positives you'll have. Barring an all-out assault by "socks", and given the current state of the TA, I think we should be more worried about false positives - we don't want to throw out potentially good contributors just because their POV or interests intersect with those of a blocked editor, especially when there's no evidence of the sort of misconduct that got that editor blocked.
  • A couple of things no one brought up yet are time sheets[205][206] and top edits.[207][208] François Robere (talk) 12:20, 15 May 2020 (UTC)[reply]
  • @Berean Hunter: So Janj9088 -> Fireslow -> Bartosz True, none of which using a proxy or a VPN? François Robere (talk) 19:00, 16 May 2020 (UTC)[reply]
IRT {{CheckUser}} template
Comment by SarahSV

Something for the checkusers to bear in mind. On 28 February this year, the Holocaust historian Jan Grabowski alleged, in an article in the Polish daily newspaper Gazeta Wyborcza, that Polish nationalists are distorting Holocaust history on the English Wikipedia (Google Translate). He named several accounts he believed were responsible for this. It is therefore a real possibility that people in Poland have been trying to counter this (although at least one was doing the opposite).

It would make sense for those accounts to use proxies because of the Poland's controversial "Holocaust law", which makes it a civil offence to damage the "good name" of Poland by implying that it was involved in the Holocaust. If you assume that new accounts using proxies at these articles are all Icewhiz, you risk cutting off people who may be responding to the newspaper article. SarahSV (talk) 21:54, 15 May 2020 (UTC)[reply]

One of the accounts, Bartosz True, removed the POV tag from Stanislaw Kot. [212] (Icewhiz would not have done that.) It was one of the other accounts that Poitrus has accused, Pestilence Unchained, who added the tag in the first place. [213] Another account, Fireslow, that you're saying is confirmed as Bartosz True, also added it. [214] SarahSV (talk) 22:16, 15 May 2020 (UTC)[reply]

Tony, thanks for the reply. Would you also consider checking Szymon Frank? That was another SPA at Talk:Stanisław Kot with a view similar to Bartosz True. SarahSV (talk) 23:21, 15 May 2020 (UTC)[reply]

Berean Hunter, thank you for checking that. Another account associated with Fireslow was Janj9088. Can you also check him, please? He was blocked in April for sockpuppetry and other issues by JzG and El C following this AE complaint by MyMoloboaccount. SarahSV (talk) 19:28, 16 May 2020 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit
  • I agree that we need to find a solution to this issue. If we accept that Icewhiz is perfectly capable of obscuring CU results using proxies, and it was always very likely that he would try and evade his ban, what level of behavioural evidence is needed to link an account to him? – Joe (talk) 10:14, 14 May 2020 (UTC)[reply]
  • I got the ping and will try to look at this tonight. TonyBallioni (talk) 13:54, 14 May 2020 (UTC)[reply]
  • @MrClog: the {{checkuser}} template pings users. Ivanvector (Talk/Edits) 15:24, 14 May 2020 (UTC)[reply]
  • For now, I have blocked 2601:585:8200:F310::/64 who is somebody that is evading a block and they will not be named in this case by any CU.
  • Bartosz True (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) is   Confirmed to Fireslow and blocked. KasiaNL is   Possible to those accounts and as surmised is using a proxy.
  • Joe, I've put some info on the cu wiki. Would someone from Arbcom (or another checkuser) please place additional info there for comparison?
     — Berean Hunter (talk) 20:19, 15 May 2020 (UTC)[reply]
  • SlimVirgin, Bartosz True and Fireslow aren't Icewhiz, I agree with that. They are one another, though, as weird as that might sound. I'm talking to BH and some others about how we deal with this case in general. I think we have two issues here: some Icewhiz socks probably were not blocked on the likely incorrect assumption he didn't use proxies early after the ban. The other is that not everyone who is a sock in this area is Icewhiz, and anytime we have a likely sock showing up it is being reported here, which muddies the waters. I don't doubt that many of the Icewhiz socks in the archives are socks of someone, and some of them may be him, but I'm also pretty sure not all of them are him. That makes sorting this out difficult for CUs and patrolling admins. Not to mention the back and forth between people that occurs at this SPI which makes people not want to deal with it.
    You raise a valid point about privacy alts, which are allowed, but typically those are expected to be declared in private to either ArbCom or a CU since editing in a way that evades scrutiny in a content area under sanctions isn't allowed. There needs to be a way to deal with what looks to be a socking problem in this area where we can't really figure out who is who because of the proxy issue. Some of these accounts may be legitimate, but there are also some that probably aren't. TonyBallioni (talk) 22:29, 15 May 2020 (UTC)[reply]
    • TonyBallioni, it seems that ARE is always full of the wrong requests filed by the wrong people. Greater monitoring of this area, which still falls under BALKANS, would be a good thing; that's what DS is for... Drmies (talk) 22:48, 15 May 2020 (UTC)[reply]
      • Drmies and SlimVirgin, see WP:ARCA (and anyone else) where I’ve basically proposed 500/30 to deal with the “Icewhiz” problem without blocking legitimate users. Sarah, I’ll look at that account later tonight or tomorrow.
        Everyone else: extended analysis at the point of past accounts and current accounts isn’t going to help much. I can likely guess what all of you are going to say based on your “side” here so further commenting without specific diffs comparing accounts won’t add much. BH and I are talking about this over email and I hope we’ll get some resolution. I agree this case hasn’t been handled well all around, but hopefully ARCA will help in some way, even if not 500/30. I’m also going to note that I’ve blocked I dream of Maple because after talking to another CU, I think the historical data on that account plus the behaviour is enough to say it’s likely the Whiz. TonyBallioni (talk) 00:01, 16 May 2020 (UTC)[reply]
  • @Berean Hunter and TonyBallioni: I've copied all the CU data we had on the ArbCom wiki to the CheckUser wiki. @Mkdw: Might have/know more. Thanks for your work on this. – Joe (talk) 10:43, 16 May 2020 (UTC)[reply]
  • Thank you, Joe. Sarah, Szymon Frank (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) is not using a proxy but is using the same telecom company for the proxy that was used by Bartosz True/Fireslow. They are using different devices in the same OS family and their location is only 14 miles apart. I'm calling it   Likely because this is coming from a very unlikely place outside of Europe or the Middle East and there are no Polish or Jewish settlements there. They are considered temporary visitors and non-existent in the indigenous population. I would endorse blocking based on both the location as well as the behavioral evidence.
     — Berean Hunter (talk) 15:41, 16 May 2020 (UTC)[reply]
Szymon Frank   Blocked without tags on behaviour and BH's findings. TonyBallioni (talk) 00:06, 17 May 2020 (UTC)[reply]

@François Robere and SlimVirgin: The account Janj9088 did not use a proxy while Fireslow/Bartosz True did. While I cannot absolutely rule out that they are the same person, I find it technically   Unlikely. I did not see socking in Janj9088's range and I don't see anything that links Janj9088 technically to anyone else. Fireslow has since socked and there is something wrong there so I believe that Fireslow should remain blocked.
 — Berean Hunter (talk) 19:55, 16 May 2020 (UTC)[reply]

4 October 2020

edit

Suspected sockpuppets

edit


KasiaNL has been blocked as a sockpuppet of permanently banned user Icewhiz


- All accounts share identical user page features as KasiaNL. [215] Which is a brief intro with a bolded user name, accompanied by the link to the area of interests and furnished with the Wikipedia adventure icons: [216] [217] [218]

- All either begin [219] or edit random articles eventually hopping into Poland’s Jewish related area [220],[221],[222] (*please note - some of the diffs I omitted due to my topic ban limitations, refer to each one's editing history.)

- All accounts rarely use edits summaries.

- Both KasiaNL[223] and PRL Dreams[224] edited an obscure article of Microprocessor chronology

- Both KasiaNL[225] and Pestilence Unchained [226] edited an article of 1854 Broad Street cholera outbreak

- Both Pestilence Unchained[227] and Twilight Tinker[228] edited an article of Zoonosis

The above accounts most likely use proxy services, which, if confirmed, would be another indication that the same person operates them. (Note - Sockpuppets activity resulted in 500/30 restriction on May 2020[229]) - GizzyCatBella🍁 21:23, 4 October 2020 (UTC)[reply]

Quick note - A large number of freshly new accounts follow me from the time shortly after Icewhiz had been banned in October 2019. [230] The above report is a part of the broader harassment issue I'll soon bring to the administrative team's attention. The accounts I now carried forward demonstrate visible similarities such as identically structured user pages and diffs in controversial Polish-Jewish relations matters. I kept it short for ease of presentation, but it might also be worth noting other similarities, such as accounts opening dates. PRL Dreams first entry is on November 15, 2019, <--> KasiaNL first entry is November 18, 2019, [231], creation of a flawlessly structured and correctly referenced article on their seventh day of editing[232] (spread over six months - Nov. 15 first entry --> May 5th article creation), awareness of page protection procedure on the 9th day of editing with the skill on how to insert link into edit summary [233] and the fact that some overlap with other already blocked sock puppets[234]<-->[235] - GizzyCatBella🍁 06:11, 5 October 2020 (UTC)[reply]

I'm just going to add another already blocked sock-puppet account of Icewhiz, I dream of Maple, that meets the above history's first entry times - November 2019. This ones first edit is November 9 [236] - GizzyCatBella🍁 06:24, 8 October 2020 (UTC)[reply]
Sorry, maybe one more thing I'll add since RoySmith brought JoeZ451 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) below. JoeZ451's earliest record is November 14th, 2020 [237], which is in line with the rest. - GizzyCatBella🍁 06:24, 8 October 2020 (UTC)[reply]
@ RoySmith - I'm making a conjecture based on prior investigations and socks that have already been banned. - GizzyCatBella🍁 19:23, 8 October 2020 (UTC)[reply]

Please note - I'll be filing an additional report but related to this, involving different parties. I seek to display that as transparently as possible; therefore need some time to do that. Work is in progress. - GizzyCatBella🍁 01:21, 10 October 2020 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Hmmm. I had major suspicions regarding Pestilence Unchained, but they have went inactive a while ago; anyway, few months ago CU already confirmed PU as using a proxy but noted the behavioral evidence is inconclusive, and I think the account went dormant shortly after that. I am honestly not familiar with Twilight Tinker, which did not cross my radar at all (and is inactive as well). As for PRL Dreams that account seems to be active, but if it is Icewhiz, than it suggests he is creating accounts that are focused on only one aspect of his POV. In any case, there is still socking in EE topics (no surprise), but the 500/30 is helping a lot (which is why I think Icewhiz, if he hasn't given up, is nurturing accounts with semi-automated edits to go around it, but they haven't surfaced yet - we will see in few months if any new users appear that are a ~year old or less, made a lot of simple semi-automated edits and then suddenly veered into making controversial edits in Icewhiz sweet spots). Or maybe he is not doing anything so difficult and is aiming for low-hanging fruit with throw-away accounts; ff anyone wants to look at one recent WP:DUCK, I'd suggest checking the following for being on a proxy: Carpathian fox (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), a new account whose POV (comparing a Polish prison to a Nazi concentration camp) fits Icewhiz a bit - but frankly, it could be someone elsem and the sock is likely already retired... smoke and mirrors as usual (and throw-away socks accounts). Shrug. --Piotr Konieczny aka Prokonsul Piotrus| reply here 03:57, 5 October 2020 (UTC) PS. User:Ivanvector, User: Reaper Eternal - can you add the account I linked above to the check here? It is not stale. --Piotr Konieczny aka Prokonsul Piotrus| reply here 01:11, 9 October 2020 (UTC) PPS. User:TonyBallioni, does your comment below addresses the CF account too? If so, can it be added to the top of this page as one of the acocunts under discussion, or should we launch a new thread dedicated to this account only? I notice that Roy did comment on it (thanks).--Piotr Konieczny aka Prokonsul Piotrus| reply here 00:58, 10 October 2020 (UTC)[reply]

What caused his ban? Is we know that, we can find his socks easily. How did he manage to get foundation banned? 4thfile4thrank (talk) 14:34, 8 October 2020 (UTC)[reply]

@4thfile4thrank: I can answer that: real-life harassment of several volunteers, including myself, and even impersonation of living individuals. This helped with some socks, but not all of the accounts at Category:Suspected Wikipedia sockpuppets of Icewhiz engaged in this behavior, for obvious reasons - any account that does so will be blocked very quickly, with no need for an SPI. Here we are dealing with accounts which focus on Wikipedia editing, not kamikaze harassment. --Piotr Konieczny aka Prokonsul Piotrus| reply here 01:09, 9 October 2020 (UTC)[reply]

If it isn't doing anything bad, we can just ignore it, as blocks are not. If it is vandalizing, but the vandalism is unrelated to the harassment, then just block for vandalism. If it harasses or give any hint that it is Icewhiz, then globally lock it immediately. Blocks aren't for social justice, but for the protection of the encyclopedia. 4thfile4thrank (talk) 02:02, 9 October 2020 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit
I don't know if any of that is enough to block on, but that's as far as I've got. -- RoySmith (talk) 14:42, 9 October 2020 (UTC)[reply]
  •   Clerk note: This case is obviously not progressing on the evidence available, so closing for now. I received an off-wiki communication from somebody who is still looking into this and requesting that it be kept open, but if they find new evidence, they can just file a new report. -- RoySmith (talk) 13:54, 15 October 2020 (UTC)[reply]

27 July 2021

edit

Suspected sockpuppets

edit



Soon after Viking Drummer's block, multiple IP's started to appear, presenting the view of the forbidden sockpuppet.

  • IP 213.81.182.119, located in Slovakia, reverting [266] with an edit summary: I have the same rights as you to comment
  • Then the same person appears 15 minutes later in Israel under IP 194.90.89.69 reverting the same content [267] with identical edit summary: I have the same rights as you to comment. You are allowed to admire your hero. Please note the Slovakia IP 213.81.182.119 with the equal comment here [268]: ...Stan is attempting to sandblast all scandals from his political hero...
  • Seven minutes later, another IP 89.231.35.1, this time registered in Poland, arrives to revert an Israeli IP [269]. I believe the banned user performed this to cover the previous edit that accidentally revealed their Israeli IP.


The above demonstrates that it is the same person Icewhiz/VikingDrummer using a third-party service to generate multiple IPs. GizzyCatBella🍁 23:19, 27 July 2021 (UTC)[reply]

Yet another suspect
  • Mazhat (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) - After I reverted a couple of above IPs in the talkpage discussed, a fresh account popped up, and very experienced, too, to very professionally AfD a bio about a Polish historian Marek Haltof I have just created, while I was still working on it. Surprized with the vitriol in the nomination, I got a hunch that this guy of this bunch. He seemed to be well versed in Polish affairs and I puzzled why he was so jumpy. While writing I did some reading :-) and soon noticed that Haltof is kinda on the Polish conservative side in Polish-Jewish relations, i.e., he is of people strongly hated by Icewhiz. So I guess there is a chance we have a duckpuppet here. Lembit Staan (talk) 06:43, 28 July 2021 (UTC)[reply]
Yes, totally possible a new sock of Icewhiz; that's a standard modus operandi of that individual. They follow and harass their chosen victim for months sometimes, and they are highly annoying. Since you were involved in the article Jan Żaryn they were trying to troll; it seems to me that you are on their radar now. Sorry about that. - GizzyCatBella🍁 07:04, 28 July 2021 (UTC)[reply]

And all continues - The user who reverted IP 91.233.157.54 [270] on the same article four minutes later received insults and threats[271] on his talk page from this IP 102.176.125.220 in broken, google translated Polish that reads in English: I curse you forever and ever, in the name of the blood of Jesus, you stupid. You ruined this important info; instead of letting you kiss your name. SHB2000 super vandal wrote you will not have forgiveness, and I will hack your account. I CURSE YOU like WTM, circular, Wiki Polish whores! - GizzyCatBella🍁 08:22, 3 August 2021 (UTC) (unrelated) - GizzyCatBella🍁 09:10, 3 August 2021 (UTC)[reply]

@GizzyCatBella: also, that is not unrelated, but per the duck test, that is also Wikinger. SHB2000 (talk) 09:13, 3 August 2021 (UTC)[reply]
@SHB2000: - Wikinger’s real location is in Poland [272], so they would speak Polish. The insults he wrote were google translated into very bad Polish; it might not be them, actually, because they would write in good Polish. This requires a further investigation. - GizzyCatBella🍁 09:27, 3 August 2021 (UTC)[reply]
But I doubt that. Wikinger uses a VPN so their location is quite unknown. SHB2000 (talk) 10:11, 3 August 2021 (UTC)[reply]
That Wikinger is in Poland was established by CU evidence well before he moved onto the VPN service. FWIW, Icewhiz is not the LTA impersonating GRP and Wikinger; it's another LTA, but WP:DENY and WP:BEANS prevent me from going further. JavaHurricane 10:25, 10 August 2021 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

This is not Icewhiz, but this is WP:LTA/Wikinger, who is Ljupco's impersonator (copies all of Ljupco's attacks, and makes it even worse). The main difference is that Ljupco doesn't know any other language apart from English. Both are IP hopping vandals, and regardless who it is, they're both banned by the WMF. Pinging @Antandrus: since they know a lot more about these vandals than I do. SHB2000 (talk) 09:08, 3 August 2021 (UTC)[reply]
Ljupco (i.e. WP:LTA/GRP) speaks Polish and Serbian. The latter is his native language. I think both 102.176.125.220 and 5.109.23.209 are both GRP. Yes, Wikinger is in Poland; I thought he was in a city east of Warsaw, but could be wrong; anyway his home IP range starts with 83, Orange something-or-other. Wikinger imitates Ljupco all the time, and I've thought for a while there might be a third one imitating them both. Antandrus (talk) 14:54, 3 August 2021 (UTC)[reply]
I'll probably start on Icewhiz's LTA page soon. SHB2000 (talk) 06:54, 5 August 2021 (UTC)[reply]
Just a note that Icewhiz was known to speak limited Polish (either that or was not shy about machine translation back and forth). Piotr Konieczny aka Prokonsul Piotrus| reply here 07:02, 5 August 2021 (UTC)[reply]
Also, to the IP, I suggest you create an account because Ljupco may edit war with me anytime here. SHB2000 (talk) 09:10, 3 August 2021 (UTC)[reply]
I've just added 185.127.21.114 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)). What are the odds an IP found a Wikipedia talk page discussing whether some content added by Icewhiz should be removed, and is sounding exactly like him? Behaviorally, in my experience, this is exactly something Icewhiz would say. Of course, it might be someone imitating him for lolz, shrug. --Piotr Konieczny aka Prokonsul Piotrus| reply here 07:00, 5 August 2021 (UTC)[reply]
Oh, and while we are looking at suspicious accounts, here's one more: Gunter888 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) SPA active in one topic area that speaks a weird mix of German and English that seems almost intentionally fake and funny. He has already been reported (but not checked AFAIK) here before (CTRL+F for Wikipedia:Sockpuppet investigations/Icewhiz/Archive) and Wikipedia:Sockpuppet investigations/Smmurphy/Archive. If it's not Ice it's pretty ducky he is someone else having fun here. --Piotr Konieczny aka Prokonsul Piotrus| reply here 07:08, 5 August 2021 (UTC)[reply]
@Piotrus and Antandrus, this looks more like a jupco edit to me. SHB2000 (talk) 09:26, 9 August 2021 (UTC)[reply]
@SHB2000 What or who is a "jupco"? It's hard to judge much with a single edit. I agree that the other account I report with it on the same day looks much more Icewhizhy... this one is 50/50. Could be someone else indeed. Piotr Konieczny aka Prokonsul Piotrus| reply here 09:46, 9 August 2021 (UTC)[reply]
Sorry. Typo. I meant Ljupco aka GRP. SHB2000 (talk) 09:51, 9 August 2021 (UTC)[reply]
@Piotrus - Yes, Gunter888 is using the same tactics as previously blocked sock-puppet of Icewhiz - KasiaNL (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)).

Both are pretending to speak bad English and blaming their mistakes on "typing fast."

Here are the diff's of KasiaNL (already blocked sock puppet of Icewhiz) justifying making mistakes on "typing fast":

But speaking or typing fast, I can mess up[273] ...big difference if I write fast[274]

And here is Gunter888 with the same story - "typing fast":

Sometimes when I type fast ...my German comes out of the cracks. . from mixing German in when I type faster.[275]

KasiaNL was hiding behind a proxy, Gunter888 is expected also to be using a VPN. - GizzyCatBella🍁 10:35, 5 August 2021 (UTC)[reply]

More: 72.179.185.130 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) --Piotr Konieczny aka Prokonsul Piotrus| reply here 15:15, 5 August 2021 (UTC)[reply]

Yeah, looks like another peer-to-peer proxy IP. - GizzyCatBella🍁 10:57, 6 August 2021 (UTC)[reply]
Wikipedia:Administrators'_noticeboard#Recent_proxy_blocks? --Piotr Konieczny aka Prokonsul Piotrus| reply here 00:04, 7 August 2021 (UTC)[reply]

I've added two more, both SPAs posting on talk in areas of Icewhiz's interest, both sounding like he (ChristianDWP (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)), XN Kowalczyk (talk+ · tag · contribs · filter log · WHOIS · Kowalczyk.html RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))). --Piotr Konieczny aka Prokonsul Piotrus| reply here 16:51, 8 August 2021 (UTC)[reply]

@RoySmith: You guys can still check the non-IP named accounts, right? Volunteer Marek 21:28, 8 August 2021 (UTC)[reply]

I'm sure somebody will do that. I'm not sure I have time to dig into this one beyond the ECP I did to stem the ongoing disruption. -- RoySmith (talk) 00:28, 9 August 2021 (UTC)[reply]

And here's another one, KonsTomasz (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)). Edits a city I live in, then makes few votes endorsing my votes. Seems like some sort of joe job targeting me. Of course, it could be some other sock master having fun too, shrug. --Piotr Konieczny aka Prokonsul Piotrus| reply here 05:21, 10 August 2021 (UTC)[reply]

Regarding ALevy at MOTJ (talk+ · tag · contribs · filter log · WHOIS · at MOTJ.html RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) commenting about Kurek (a topic Icewhiz was very interested in, see Talk:Ewa Kurek), please note that Icewhiz has been known to impersonate living people (particularly activists, see the old Purski (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)); likewise, IIRC KasiaNL (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) claimed to be an activist too). If needed, further details are available from ArbCom/Trust&Safety/myself.--Piotr Konieczny aka Prokonsul Piotrus| reply here 07:20, 18 August 2021 (UTC)[reply]

Please note the same accusation of the Holocaust denial concerning the WP:BLP:

(follow up) 118.43.239.183 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) comments promptly following ALevy at MOTJ block. - GizzyCatBella🍁 22:55, 19 August 2021 (UTC)[reply]

Found a new likely one: Ravisihing Laura (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). Account created in 2020, made two innocent edits, nine more in Feb 2021. And today it jumped both feet in into an article I am expanding for GA, seizing upon an ethnicity/nationality controversy, edit warring and making several edits and talk page arguments that the subject is not Polish (or Polish-British, whatever). Here's the clincher: when citing sources on talk, slipped and linked to an Israeli Google Book domain: [278]. Quack, quack, WP:NOTHERE, quack, quack. --Piotr Konieczny aka Prokonsul Piotrus| reply here 09:11, 12 September 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit
  •   Clerk note: I doubt there's much we can do in the way of IP blocking that would be useful, but I've just put ECP on Jan Żaryn. Less Unless I see you declined that request at WP:RFPP, so pinging you here to let you know of my action. -- RoySmith (talk) 17:39, 8 August 2021 (UTC)[reply]
  • I know this hasn't been fully resolved, but as a practical matter, this report has grown by accretion to the point where it's difficult to do anything with. I'm going to close it now. Please feel free to open a new case, but limit it to specific accounts with good evidence to show those particular accounts must be Icewhiz socks. Diffs would be the best way to demonstrate that. -- RoySmith (talk) 15:23, 1 October 2021 (UTC)[reply]

19 October 2021

edit

Suspected sockpuppets

edit

Hippeus has, when engaged in the WP namespace, focused on the same two topics as Icewhiz, the Holocaust and the dispute with editors related to the Holocaust in Poland, and the Arab-Israeli topic. The way he formats his posts, the way he attempts to redirect discussions, and some phrasing consistent across these accounts suggest that this is latest incarnation of Icewhiz. For example:

Both accounts will redirect discussions and request sanctions against the filer, with the request often in bold.

  • Icewhiz, ending, in bold "Tony should be desysoped for unfair misuse of admin tools, and refer this to ARBCOM".
  • Icewhiz, in bold, requests "Boomerang/regular admin action against Nableezy".
  • Hippeus, in bold, "sanction Nableezy for this retaliatory behaviour".
  • Hippeus, in bold in attempting to redirect sanctions to the filer, "Onceinawhile's unclean hands scream bloody murder"

Some common phrasings between the two stand out:

Both accounts use "no where":

The flourish of "is not particularly"

"ARBPIA relevance:"

Nableezy 03:42, 19 October 2021 (UTC)[reply]

As far as editing in the WP namespace, the efforts have been largely on removing opponents of Icewhiz in those topic areas. See him continuing his long-standing grudges with E-960 (very much in that topic area) and as Hippeus requesting an even more expansive topic ban (and again as Hippeus). In the Arab-Israeli and in the British Labour antisemitism areas he has continued his grudges with ZScarpia, requesting sanctions as Hippeus (though that should honestly be oversighted for outing as he not so cleverly gives a map to a blog that outs an editor). With Huldra, again requesting sanctions as as Hippeus. nableezy - 13:32, 19 October 2021 (UTC)[reply]

In addition to the common "enemies", there is the common thread of who Hippeus shows up to support, including in some not exactly well attended discussions.

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • Note to concerned editors:

Please do not attach any further potential Icewhiz sock accounts to this report, instead please open a new case. See -->[296] and Roy's closing comment - GizzyCatBella🍁 13:16, 19 October 2021 (UTC)[reply]

  • This is retaliatory harassment. I commented on Nableezy harassing another user and then he posts this? Nableezy is also lying. I have not edited about the Holocaust in the WP namespace. Or at least I don't remember anything like that, there are no diffs. I edit about Indian and Israeli topics. Other than that lie this request is based on bolding text in Wikipedia discussions (common practice) and very short phrases, nothing here. If I do get checked by CheckUser, 'I edited from guesthouses in India during the summer. I have no idea how those will show up for CU, they might be shared by many people.--Hippeus (talk) 04:24, 19 October 2021 (UTC)[reply]
If you are under the impressions that because you make some wild and inane accusation that means your target may never report your socking then I guess that explains why youve been making so many wild and inane accusations, but no that is not the case. It is not harassment to report somebody for violating our policies. I do not intend to engage with you or any other user who attempts to obfuscate from the purpose of this page. I await a clerk and/or a checkuser. Toodles. nableezy - 12:47, 19 October 2021 (UTC)[reply]
No Hippeus, it’s not a retaliatory harassment at all (see below). - GizzyCatBella🍁 12:03, 19 October 2021 (UTC)[reply]
  • Please note Hippeus' inactivity for the last 3 days and immediate arrival at this report, 24 minutes after it was filed. It is because Icewhiz operates various sock accounts (many already blocked) and monitors Wikipedia constantly.
  • I'll also refresh Hippeus's memory since they "don't remember" editing World War/Holocaust/Antisemitism in Poland. Here you go -->[297]

Additional evidence:

  • On August 11/2020, Hippeus, out of the blue, reported Polish user E-960,[298] with whom before Icewhiz had endless disputes with. [299]

Please note that Hippeus never interacted with E-960 before the above report.[300] Hippeus never edited the same articles as E-960. Hippeus fixed the report completely out of the blue. This proves that sock account Hippeus was following E-960 awaiting an opportunity to report them.

See prior, extensive interaction record between Icewhiz and E-960 [301] including these persistent but unsuccessful AE reports against E-960 prepared by Icewhiz.

To reassume - combining the pieces of evidence presented by Nablezny with the fact that Hippeus was editing about Antisemitism in Poland area[305] (the topic area Icewhiz was globally banned for). Plus the fact that Hippeus, out of the blue, reported Polish user Icewhiz had prior disagreements with. Plus my recent observation regarding Hippeus here [306]. Plus his immediate arrival despite days of inactivity to counter Nablezny should clear all uncertainties and assure concerned editors that Hippeus is an account managed by the same individual who operated the account Icewhiz - GizzyCatBella🍁 12:03, 19 October 2021 (UTC)[reply]

PS - I'm certain that Hippeus, as ussual, is using a VPN provider to control this account.

Except Selfstudier never used the phrase "ARBPIA relevance"? That phrase, until this page, was used on Wikipedia exactly three times. Twice by Icewhiz, and once by this account. Me opening an SPI account against you was a product of having recognized some peculiarities, like using "no where", and then looking into it more deeply. When I was fairly certain you were the same I asked on your talk page and kept looking. And when I felt that the evidence was reaching conclusive that you and Icewhiz were the same I filed this. nableezy - 19:08, 19 October 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit

Maxim(talk) 01:22, 20 October 2021 (UTC)[reply]

23 October 2021

edit

Suspected sockpuppets

edit


I don't know if its icewhiz himself or someone else trolling but I think its important to know who cause the disruption Shrike (talk) 17:12, 23 October 2021 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

edit

20 October 2021

edit

Suspected sockpuppets

edit

Icewhiz has obviously continued their disruption and headhunting in the Israel-Palestine area. Free1Soul recently created a vexatious AE request that seemed calculated to do nothing but silence an opponent in this same area. The only editors that supported the AE request were 11Fox11 and Geshem Bracha, both now blocked as Icewhiz socks. It strains credulity to believe that such a report would not have been created by another sock. Eggishorn (talk) (contrib) 17:09, 20 October 2021 (UTC)[reply]

I'd also like to note that other Icewhiz socks have targeted Nableezy through disciplinary mechanisms and that Free1Soul appeared to abandon editing once the AE was filed. The number of behavioural consistencies between Icewhiz and their socks and Free1Soul makes other explanations doubtful. Eggishorn (talk) (contrib) 19:01, 20 October 2021 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • I suspect this is correct. The fact that the account was created on the same day as Astral Leap (one of the other blocked socks) is a bit too much of a coincidence. Also, this large set of edits by Free1Soul is almost identical to this large set of edits by Astral Leap (one changing "a" to "an" and the other vice-versa). Both I suspect were to rack up edits to get over the 30/500 hurdle. Number 57 18:44, 20 October 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit

03 December 2021

edit

Suspected sockpuppets

edit

Previously blocked sock-puppets of Icewhiz (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) utilized changing "a" to "an" and vice versa to reach 500/30 status. See:

[308] [309] [310] [311] [312][313] [314] [315] [316] [317] etc, etc, dozens more of the same

Recurring such edits can be seen in the edit history of Viking Drummer -->[318]

[319] [320] [321] [322] [323] [324] [325] [326] etc, etc, dozens more of the same.

Recurring such edits in bulk (one after another) can be seen in the edit history of Astral Leap --> [327]


  • Today we have RCatesby, who opened an account on Nov. 08/20 - [328]

Then went on to make the same type of edits as blocked sock puppets of Icewhiz (changing "a" to "an" and vice versa to reach 500/30 status) [329] [330] [331] [332] [333] [334] [335] [336] [337] [338] [339] [340] [341] [342] [343] [344] [345] [346] and so on... one after another.


Recurring such edits in bulk (one after another) can be seen in the edit history of RCatesby --> [347]

They reached 500/30 status around Sept.14/21 [348] and went to "sleep".

  • Then they reactivated the account today (Dec.3/21) [349], made a few initial masking edits to arrive at the intended area, which is currently a highly disputed Israel/Palestine (WP:PIA) conflict area (article for deletion) to add !vote in line with what would be Icewhiz's POV. -->[350] Please also note that this edit is not only the first-ever to the WP:PIA area, but it is also the most extensive that account has ever made. Clearly the area of importance.

I believe this is just another sock puppet of Icewhiz. They most likely used a VPN service to make those edits in line with most of his sock puppets. Check User (if granted) will confirm proxy use. I'm %99.9 sure. GizzyCatBella🍁 12:01, 3 December 2021 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

edit

03 December 2021

edit

Suspected sockpuppets

edit

Previously blocked sock-puppets of Icewhiz (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) utilized changing "a" to "an" and vice versa to reach 500/30 status. See:

[351] [352] [353] [354] [355][356] [357] [358] [359] [360] etc, etc, dozens more of the same

Recurring such edits can be seen in the edit history of Viking Drummer -->[361]

[362] [363] [364] [365] [366] [367] [368] [369] etc, etc, dozens more of the same.

Recurring such edits in bulk (one after another) can be seen in the edit history of Astral Leap --> [370]

[371] [372] [373] [374] [375] [376] [377] [378]

Recurring such edits in bulk (one after another) can be seen in the edit history of RCatesby --> [379]

Then !voted here -->[380] after Free1Soul.



Free1Soul !votes in line with recently blocked RCatesby at the same discussion:

  • Free1Soul -->[381] - (Notable authority on antisemitism..)
  • RCatesby-->[382] - (..highly regarded antisemitism expert..)

Free1Soul utilized the same tactic as the previously blocked sock puppets, which is --> changing "a" to "an" and vice versa to reach 500/30 status: [383] [384] [385] [386] [387] [388] [389] [390] [391] [392] [393] [394] [395] [396] etc, dozens more of the same.

Recurring such edits in bulk (one after another) can be seen in the edit history of Free1Soul: [397]

I believe this is just another sock puppet of Icewhiz. They most likely used a VPN service to make those edits in line with most of his sock puppets. GizzyCatBella🍁 21:59, 3 December 2021 (UTC)[reply]

Pinging the administrator who just examined the latest report -->@Maxim - GizzyCatBella🍁 22:12, 3 December 2021 (UTC)[reply]

Thepharoah17 --> Please notice new behavioural indications such as !voting at the same discussion with the same substance (the same argumentation - antisemitism expert/authority). I’m aware of the previous report but this time please notice behavioural. I have no doubts these 4 accounts are connected and operated by the same person or pair of banned editors. - GizzyCatBella🍁 00:31, 4 December 2021 (UTC)[reply]


Additional note: (reacting to Sro23 remarks)

What are the chances of two entirely unrelated editors to inaugurate accounts on the same day 6 hours apart?

  • Free1Soul - Feb. 08/2020 [398]
  • Astral Leap - Feb.08/2020 [399]

What are the chances that Free1Soul performs 100's of identical edits changing "a" to "an" before reaching 500/30 status (one after another) in line with other blocked sock puppets of Icewhiz. These kinds of edits end when they get to the confirmed status. Again, perfectly in line with other blocked sock puppets of Icewhiz.

What are the chances that all of them eventually end up at WP:PIA or WP:APLECP with comments matching the same POV?

  • Free1Soul -->[404] - (Notable authority on antisemitism..)
  • RCatesby-->[405] - (..highly regarded antisemitism expert..)
  • Astral Leap -->[406]
  • VikingDrummer -->[407]

I believe it is logical and safe to conclude that we are dealing with abuse here and I encourage the administrating team to act on shown pieces of evidence to prevent additional disruption. If a deterrent step isn't taken again, the Free1Soul account will become legitimized and further disturbance/confusion are to be expected. - GizzyCatBella🍁 19:51, 5 December 2021 (UTC)[reply]

Post scriptum:

Free1Soul account may also be connected to/shared with Yanniv -->[408] (meatpuppetry) since both master accounts cooperated occasionally. Icewhiz was highly engaged in defending Ynniv's block[409] to the point of calling it a shameful episode -->[410] - GizzyCatBella🍁 22:02, 5 December 2021 (UTC)[reply]

Post scriptum numerus duo:

Free1Soul resumed editing [411] 8 minutes after Sro23 posted his/hers remark ..I'm not saying I personally believe a block would be appropriate at this time. In this case, I'm inviting Free1Soul to explain and answer my accusations --> @Free1Soul please defend yourself. - GizzyCatBella🍁 22:20, 5 December 2021 (UTC)[reply]


@User:Maxim and Sro23:

Okay, so we have a response from Free1Soul now. Please notice the composition, English abilities and Wikipedia formatting skills. Notice intentionally dropped "a" and "the" in the writing etc. Notice the way the diff's are presented etc.


I dont understand problem. User:Maxim checked almost same evidence on 20 October.

Over year ago I fixed a few dozens errors in nationality. It "a Jordanian", not "an Jordanian". It is "an Israeli" not "an Israelian" or "a Israeli". I fixed also other errors than just a and and an, like:

Iraqian; https://en.wikipedia.org/w/index.php?title=Arab_culture&diff=prev&oldid=974526506 https://en.wikipedia.org/w/index.php?title=Mahmoud_Amnah&diff=prev&oldid=974526028 and more

Arabian; https://en.wikipedia.org/w/index.php?title=Sameer_Abdulshaker&diff=prev&oldid=974708457 https://en.wikipedia.org/w/index.php?title=Mohammed_Al-Husain&diff=prev&oldid=974708643 and more..


Now compare the above with one written by Free1Soul on October 16 [412] which is clearly those of a fluent English speaker, with excellent knowledge of Wikipedia formatting.

Icewhiz has a history of faking poor English abilities to avoid detection. Please take a look at my conversation with one of his now blocked sock puppets KasiaNL (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) here --> [413] - GizzyCatBella🍁 07:53, 6 December 2021 (UTC)[reply]


(update)

Free1Soul corrected the bad gramma now:

−
I dont understand problem. [[User:Maxim]] checked almost same evidence on 20 October.
+
I don't understand the problem. [[User:Maxim]] checked almost the same evidence on 20 October.
−
Over year ago I fixed a few dozens errors in nationality. It "a Jordanian", not "an Jordanian". It is "an Israeli" not "an Israelian" or "a Israeli". I fixed also other errors than just a and and an, like:
+
Over a year ago I fixed a few dozens errors in nationality. It is "a Jordanian", not "an Jordanian". It is "an Israeli" not "an Israelian" or "a Israeli". I fixed other errors, not just a and an, like:
−
This is not the most of my editing. Most of my edits were to food articles. Probably most editors here fixed some a and an errors, it is common error.
+
This is not most of my editing, most of my edits were to food articles. Probably most editors here fixed some a and an errors, it is a common error.

Full changes can be seen here -->[414]. I'm done here for now. I might add more pieces of evidence later if required, but I believe those presented so far are satisfactory. - GizzyCatBella🍁 10:59, 6 December 2021 (UTC)[reply]


Post scriptum:

Perhaps one more piece of evidence will help:

  • Here is Free1Soul accusing user of introducing a hoax into Wikipedia:

In one case in these mass changes Nableezy introduced a hoax [415]

  • Here is Icewhiz doing the same:

..Wikipedia was one of several outlets in which the hoax was promoted.. [416]

Icewhiz is famous for unjustly accusing editors of adding hoaxes into the Wikipedia -->[417] - GizzyCatBella🍁 08:46, 6 December 2021 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

@GizzyCatBella: This has already been checked before. It was the last case in the archive. Thepharoah17 (talk) 23:24, 3 December 2021 (UTC)[reply]

@Thepharoah17:, not entirely accurate. The CU was checked for F1S before but no admin ever made a definitive comment on the behavioral evidence, which GCB has presented in even more stark terms. There can really be no doubt at this point there is sock or meat puppeting. That makes this report ripe for evaluation. Eggishorn (talk) (contrib) 03:36, 6 December 2021 (UTC)[reply]

I don't understand the problem. User:Maxim checked almost the same evidence on 20 October.

Over a year ago I fixed a few dozens errors in nationality. It is "a Jordanian", not "an Jordanian". It is "an Israeli" not "an Israelian" or "a Israeli". I fixed other errors, not just a and an, like:

Iraqian to Iraqi; [418] [419] and more

Arabian to Saudi or Arab; first in [420] and then fixed [421] [422] and more

Israelian; [423] [424]


This is not most of my editing, most of my edits were to food articles. Probably most editors here fixed some a and an errors, it is a common error.

I voted in Collier deletion just like I vote in other Israeli deletion like Isaak Hayik recently

36 editors edited the Collier deletion page. The word expert is 14 times on the page, including first keep and first delete votes.

I just watch the Israeli deletion listings, how is that wrong? Free1Soul (talk) 04:28, 6 December 2021 (UTC)[reply]

@Free1Soul you are saying above that: Probably most editors here fixed some a and an errors. Editors such as PRL Dreams (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)? They did a lot of such edits, one after another. Exactly the same as you -->[425] I'm sorry Free1Soul, perhaps that was a bad example. That one might be another sock puppet of Icewhiz. -->[426]


  • @GizzyCatBella: is absolutely correct when they say that the user Free1Soul appears to have few issues with their grammar when they don't want to, such as when making statements about other users, when they tend to be highly fluent and coherent, see any of [431], [432], [433] ... or just look for any instance where Free1Soul is engaged in a dispute and you will find little trace of the apparent language issues above.Iskandar323 (talk) 09:48, 6 December 2021 (UTC)[reply]
(Self-striking following a complaint about my TBAN) Iskandar323 (talk) 13:17, 6 December 2021 (UTC)[reply]

Personally, unconvinced. Might be wrong, the KasiaNL one would have had me unconvinced as well. And apparently would have been wrong there. nableezy - 04:31, 7 December 2021 (UTC)[reply]

@Nableezy - You think it's Yaniv, I know. Icewhiz used to compose writings for Yaniv such as this Block Review that Yaniv later posted as written by him --> [434] <-- see? %100 written by Icewhiz. So I would not be astonished if Yaniv composes things for Icewhiz to post. But this particular sock-puppet is Icewhiz. - GizzyCatBella🍁 07:07, 7 December 2021 (UTC)[reply]
Getting a bit more convinced. nableezy - 03:34, 8 December 2021 (UTC)[reply]
Thanks - GizzyCatBella🍁 05:04, 8 December 2021 (UTC)[reply]
Yes, I do think that somebody can have both a good and bad hand account at the same time. Why is he running them? Well, look at Wikipedia:Reliable_sources/Noticeboard/Archive_337#Jewish_Chronicle. By using so many accounts he was able to shift "consensus" on a topic he cares about. So no, not "obviously not", but "obviously yeS", because he has influenced RFCs, and AFDs, enforcement requests, with these so called throwaway accounts. By keeping Eostrix clean, and on its path to admin and CU, he would have been able to further influence the coverage of those topics that he cares about. Am I more concerned about the next Eostrix than I am the next Hippeus? Yes. But let's not forget that as Hippeus and 11fox11 and and and he was able to get a number of users topic-banned and warned. All these accounts serve the same ultimate purpose, that he uses different tactics with each does not change that. Im not entirely sure the point of this rant though, this page has a specific purpose, that being to investigate abusive sockpuppetry by a banned editor. If you dislike striking a sockpuppet's comments then you can raise that at some project page and give your argument for why a globally banned user's comments should be retained. I for one will continue striking the comments and reverting the edits of any sock of a banned editor I see, and I have a policy that supports that. nableezy - 17:47, 13 December 2021 (UTC)[reply]
  Clerk note: Leaving the first few replies in this thread (15:38 12 Dec. – 17:47 13 Dec.) since they relate to identifying Icewhiz sox. Hatting mostly off-topic continuation. Please keep comments related to the topic of Icewhiz and his sockpuppets. There are any number of other venues to discuss the general philosophy of countering LTAs. Thank you. -- Tamzin[cetacean needed] (she/they) 20:51, 14 December 2021 (UTC)[reply]
The following discussion has been closed. Please do not modify it.
Levivich; as I said when the Eostrix. +++other accounts were unmasked; "I was 90%++ sure that Fox and Geshem were socks; but I thought that, say, 11Fox11 was far too stupid/emotional to be Icewhiz: he has either "loaned" that account out to others, or Icewhiz is really good a "dumbing down"."
And yeah; Icewhiz is good at "dumbing down"; I recall thinking about Icewhiz, that sometimes he acted like he had an IQ of 60; other times he edited as if he had an IQ of 140: I don't know any other contributor in the IP area who have had such a -varied- set of contributions. And yeah; stopping him and Nocal is the work of Sisyphus, but the alternative is worse: it is leaving Wikipedia to them. Huldra (talk) 20:56, 13 December 2021 (UTC)[reply]
Icewhiz has engaged in straight up harassment accounts, like their session from the 15 February 2021, where they created multiple accounts like WhizICE that posted material outing VM (since oversighted). Hemiauchenia (talk) 03:13, 14 December 2021 (UTC)[reply]
I realized that I actually posted my comment in the wrong SPI, I had both open, it was in relation to NoCal100 like Special:Contributions/Inf-in_MD, however both were open when following tracks of some recent events, not completely randomly. But IRT WP:BE, if LTAs can simply create more socks and resume where the last one left, what do these already less than ideal and repetitive processes serve? —PaleoNeonate – 04:40, 14 December 2021 (UTC)[reply]
Is there even a functional difference between one lta and the next? "What do these already less than ideal and repetitive processes serve?" is the same question I have, and it applies equally to any lta but just to take one example from inf-in_md, who was an obvious sock, looking at Talk:Scottish Palestine Solidarity Campaign#Yet again?, I don't see the benefit of striking all those comments, it only draws more attention. Rather what I see is experienced editors arguing endlessly with an obvious lta sock. And I don't understand why, year and year, sock after sock, some editors argue with the LTAs, respond to their RfC comments, post in the AEs they start, go to their user talk pages, amass evidence like Perry Mason, and then strike out all the text they just helped write over the past however many weeks/months, only do it allll over again with the next round of obvisocks. How many hours did certain editors spend arguing with jungermanchipsahoy (or whatever that name was), across multiple pages for months, only to later do the same damn thing with inf-in and the others? I've been watching this for years now... why don't we all just try ignoring them? Like seriously, don't respond to their RFCs, don't comment on their AEs, just ignore them. Trust that (legit) voters and closers of RFCs and admins patrolling AE and ANI aren't going to get tricked by obvisocks. Anyway, that's why I don't think striking comments is one of the best ways to discourage socking; I think it might be one of the worst. I think it feeds the trolls. Levivich 05:20, 14 December 2021 (UTC)[reply]
https://www.conservapedia.com/Israel_Apartheid_slur <- What you get when ideologues have a free hand.Selfstudier (talk) 10:08, 14 December 2021 (UTC)[reply]
why don't we all just try ignoring them? Many editors agree with the spirit of this (so does WP:DENY), but with WP:AGF and the way SPI requires behavioral evidence, it's always a time sink, of course... And when an editor unfamiliar with a particular article immediately notices previously struck comments with a note about who it was, it's clueful to evaluate future discussions by new (or "new") editors. —PaleoNeonate – 13:43, 14 December 2021 (UTC)[reply]
Whereas I think sowing suspicions like that is counterproductive to building an encyclopedia and is what the trolls want to happen. Levivich 14:31, 14 December 2021 (UTC)[reply]
Nobody is asking you to comment or otherwise waste your time on this or any other sockpuppet. This page has a specific purpose, to investigate prohibited uses of alternate accounts, in this case by a globally banned editor. Why do we argue with them? Because until they are blocked as banned editors their comments do impact our articles. You know that as well as I do. You know there are several instances where AE closers, AFD closers, RFC closers all were "tricked", and pretending that we should just have faith that they will not is disingenuous. Yes, Inf-in MD was an obvious sock. I knew it was NoCal from early September. And I reported him, and he remained unblocked, impacting articles, voting at AFDs, and manipulating AE (the game where NoCal reverts a 1RR violation to disallow any self-revert and another editor make the report is an old re-run, and it appears to have new participants). If you have some solution to the "obvisocks" besides letting them do whatever they want without consequence, Im all ears. But somewhere else. If you would like to discuss any topic besides whether or not these accounts are reincarnations of Icewhiz then please do it elsewhere. Can a clerk clean up this unrelated mess? I know User:Tamzin volunteered to aggressively clerk another SPI where users wax lyrical about things that are off-topic to them matter at hand, might that extend here? nableezy - 15:30, 14 December 2021 (UTC)[reply]
Every comment below 15:38, 12 December 2021 (inclusive) has nothing to do with this SPI report. I requested hat'ing on the talk page. The only waste of time here is this off-topic thread, which should stop. MarioGom (talk) 18:25, 14 December 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit
  •   Clerk declined - CU was already run on this account not too long ago. This investigation will have to be behavior based. FYI, aside from CU sockpuppetry blocks, "meatpuppetry" blocks (when two separate editors behave in the same manner), blocks for disruption, and WP:Here blocks are still all on the table, though I'm not saying I personally believe any of those would be appropriate at this time. Leaving that up to the judgement of the closing clerk/admin/CU. Sro23 (talk) 16:36, 5 December 2021 (UTC)[reply]
  • While I did make an unlikely determination, I've reviewed it again. I looked at it again, and it probably ought to have been a   Possible at the time. These cases are fairly complex, such that CheckUser is unlikely to return anything strongly conclusive. (And in general,   CheckUser is not magic pixie dust is something to keep in mind.) I'd say that CU evidence doesn't rule out a connection, and if the behaviour is compelling, then a block is justifiable. As for the second account, it's almost stale, but from what I have, it's another   Possible. Maxim(talk) 14:14, 6 December 2021 (UTC)[reply]
  • Free1Soul is clearly not new, and has clearly gamed the 30/500 requirement, which in this topic area normally means they're evading a ban. Not entirely convinced they're Icewhiz, though there are some similarities. PRL Dreams has also gamed the 30/500 requirement in a remarkably similar way and has an interest in Poland, which is common to previous Icewhiz socks. I'm inclined to block both, though possibly not tag, but I'd appreciate any more admin/CU eyes. HJ Mitchell | Penny for your thoughts? 13:18, 7 December 2021 (UTC)[reply]
    • Sod it. Nobody else has chimed in, which makes this more difficult, but I've blocked both accounts. There's ample evidence that they're not new editors and they've gamed the 30/500 restriction, which in this topic area almost always means they're evading a ban. Whether they're Icewhiz specifically, I'm less sure (probably 60% convinced versus the 90%+ that they're someone's socks). HJ Mitchell | Penny for your thoughts? 21:36, 14 December 2021 (UTC)[reply]
  • Nyx86 is   Possible to   Likely related to other Icewhiz socks based on technical evidence. With the behavioural evidence, I've blocked the account. Maxim(talk) 19:17, 7 December 2021 (UTC)[reply]
  • Droid I am has the same   Possilikely (a mix between possible and likely) technical determination as Nyx86. With the behavioural similarity, I've indeffed the account. Maxim(talk) 14:28, 8 December 2021 (UTC)[reply]
  • Everyone's blocked and I don't think tags are needed at this time. Closing. Sro23 (talk) 22:55, 14 December 2021 (UTC)[reply]

22 December 2021

edit

Suspected sockpuppets

edit


Consistently votes alongside other Icewhiz socks in a variety of discussions, notably at RSN. Has the same "no where" tic as past socks ([508] [509], see 19 Oct 2021 archive for Icewhiz/Hippeus links)

Nableezy 23:17, 22 December 2021 (UTC)[reply]

The common interests span a large set of articles and topic areas. Examples:

The above RSN threads were largely ARBPIA focused. As are:

nableezy - 03:53, 23 December 2021 (UTC)[reply]

Honestly Maxim, that is the one thing that gave me pause here. But 11Fox11+Icewhiz show editing at basically all hours of the day. But yeah, that was the one thing that stood out as potentially exculpatory, but with the editing time of confirmed socks showing that there was editing basically at any time I did not think it ruled it out entirely. nableezy - 15:32, 23 December 2021 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • I think this is a serious misfire. The Swaggster doesn't strike me as a likely Icewhiz sock. For one thing, they are mostly interested in American politics. There is almost no editing related to the Holocaust in Poland, a key 'Whiz haunt. Hemiauchenia (talk) 23:41, 22 December 2021 (UTC)[reply]
Thats been true for other socks as well, eg 11Fox11. Icewhiz likewise edited many of the same American politics articles, eg Ilhan Omar, Joni Ernst, Trump, a satire book with average daily views under 100. nableezy - 00:16, 23 December 2021 (UTC)[reply]
  • Comment. This is a waste of time. Swag Lord is the last person I would peg as an Icewhiz sock unless we think he is taking trips to other countries now just to edit Wikipedia. –MJL ‐Talk‐☖ 23:43, 22 December 2021 (UTC)[reply]
  • Don't know if this is Icewhiz or not but the account was quoting WP:RSSM, using abbreviations, day after they created their account [510]. On the day they created their account they were referring to "Many of our so-called reliable sources", showing familiarity with WP:RS and the perennial disputes [511]. Two days after they created their account they're already invoking WP:BLP (acronym) to get their way in a content dispute [512]. Etc. Not a new editor for sure. Volunteer Marek 00:51, 23 December 2021 (UTC)[reply]
    It's at this point; this conversation has become actively harmful. To shut this whole thing down right now, I will state here and now that I am actively social with SL. I'm probably the only person on this site who knows his IRL identity. Swag Lord is not Icewhiz. End of story. –MJL ‐Talk‐☖ 01:58, 23 December 2021 (UTC)[reply]
Do you know Icewhiz's real life identity? If not then I dont see how you can be that certain that the two are not the same. We have a process here, and I feel that the evidence is sufficient to merit a check. A clerk or CU will decide if they agree and then take it from there. The process however is not one of the user's pals saying End of story as though that were the end of the story. If DSL is not Icewhiz this will be closed as unrelated. Your proclamations dont really add anything to the process, but do you if thats what you want to do. nableezy - 02:18, 23 December 2021 (UTC)[reply]
@Nableezy - sorry, I have no time to study it at this time, but I trust your judgement. (please examine it per Nableezy) - GizzyCatBella🍁 02:26, 23 December 2021 (UTC)[reply]
@Nableezy: I know Icewhiz lives in Israel based on the publicly available information. –MJL ‐Talk‐☖ 04:12, 23 December 2021 (UTC)[reply]
You know Icewhiz said that he is Israeli. You know nothing else. I dont know if this is Icewhiz or not, I saw enough things that made me think that there is a reasonable suspicion for a check. I dont see the point in arguing with you about this though, you arent in a position to decide anything here. nableezy - 04:41, 23 December 2021 (UTC)[reply]
I have no strong views here, and I am symphatetic to "misfires" (while Icewhiz is socking a lot, not every new editor in the TA of his interest has to be him...). But since you claim you know SL IRL, can you - os SL themselves - address the issues VM raises, which is that SL does not appear to be a new user, based on their familiarity with Wikipedia concepts/jargon from their first days? Piotr Konieczny aka Prokonsul Piotrus| reply here 12:12, 23 December 2021 (UTC)[reply]
There are a lot of recycled users, in my experience. This is a low entropy characteristic that doesn’t help identify what their prior account might have been. Is the user doing anything bad? Are they being obnoxious? I know MJL and can vouch that they usually know what they are talking about. Jehochman Talk 12:39, 23 December 2021 (UTC)[reply]
Forgive me, but the quality of your recent evidence ("private email from Icewhiz") or arguing that the number of times someone's name appaers at AE is correlated to their status as a "problem" on this project has been less than impressive. Piotr Konieczny aka Prokonsul Piotrus| reply here 13:36, 23 December 2021 (UTC)[reply]
@Piotrus: I will explain over email. –MJL ‐Talk‐☖ 16:43, 23 December 2021 (UTC)[reply]
@MJL Thank you. Taking your information at face value, per AGF, I concur that this is probably not Icewhiz, just someone who occasionally shares some views (and discussions) with him. I recommend you provide all details possible to the CU so they can make up their own mind. Piotr Konieczny aka Prokonsul Piotrus| reply here 16:54, 23 December 2021 (UTC)[reply]
On the contrary @Maxim:, if an editor is obsessed enough, he can go several hours without sleep. If the off-Wiki stories I've been reading about are true? Such an individual could easily do it. GoodDay (talk) 15:23, 23 December 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit

21 January 2022

edit

Suspected sockpuppets

edit


In the RSN RFC on Polish sources, the people who commented in multiple parts of that RFC were: Volunteer Marek, Piotrus, Szmenderowiecki, Mellow Boris, GizzyCatBella, Francois Robere, Jurisdicta, Darwinek, MyMoloboaccount, Astral Leap, V.A. Obadiah, Kathy262, PRL Dreams, Nadzik, Droid I am, BeZet

Of those, the ones that voted in the original CP RFC were Nyx86, Droid I am and Kathy262 (Szmenderowiecki commented but about process and did not vote). The only other users besides Kathy262 active in both were Icewhiz socks. Note the similarity in reasoning between Kathy262 and Hippeus, another confirmed Icewhiz sock.

All of Kathy262's votes lined up across both topic areas with the rest of the Icewhiz socks in either discussion, and while there are not a lot of edits to go off of on the timecard, but it does line up with Icewhiz when combined with the other sporadic socks like Droid I am in the morning, PRL Dreams after that, Nyx86 shortly after, and Kathy262 following. Those two topic areas were Icewhiz's primary foci, and given that only Icewhiz socks were active in both I find Kath262's participation and timeline to match. For the throwaway accounts meant to vote stack he seems to be editing in shifts. nableezy - 00:45, 21 January 2022 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

edit

21 March 2022

edit

Suspected sockpuppets

edit

This is a sequel to Wikipedia:Sockpuppet investigations/Störm a couple of days ago which also concerned BilledMammal (BM). Please see that SPI for additional information. After it was found that Störm cannot be the sock master, the matter of BM's attitude and behaviour shifted to this ANI discussion. Earlier today, [513] a new sub-section was opened at the ANI which advised us to name Icewhiz as the sock master. As you can see, the suggestion was made by 219.89.87.76 and there has been some positive interest by Number 57, GiantSnowman, Shibbolethink, Malcolmxl5 and A. C. Santacruz who are all welcome to contribute here, as is BM, of course.

As explained in the Störm SPI, BM is suspected of SOCK because of his evident familiarity with aspects of the site, especially AfD, when opening the account in April 2019. The IP says that there is a dates fit between Icewhiz and BM. Also, targeting Nableezy is shared with Icewhiz. The IP adds that: BilledMammal's top edited talk pages: Talk:Wehda Street airstrikes and Talk:2021 Israel–Palestine crisis are Palestine. Talk:Łódź is Poland. In response, Number 57 commented: Interesting that I'm not the only person whose mind this had crossed. Being anti-NSPORTS was another Icewhiz trait, but doing a load of mass edits, then editing an IP (Israel/Palestine) article shortly after passing the 500 edit mark is often a giveaway.

It would seem that we have a clear case of WP:DUCK here and, given the WP:DE and WP:HARRASS reported at ANI, I strongly recommend an indefinite block to settle this matter. Please ping me if I can be of further help. Thank you. No Great Shaker (talk) 15:31, 21 March 2022 (UTC)[reply]

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • Without filibustering, I strongly recommend that any checkuser review the ANI discussion on the matter before rendering judgment. I'm not alone in feeling that this complaint involves a great deal of innuendo, largely without merit or evidence. Especially given the prior failed investigation and the ANI complaint, it seems that the OP and his cadre are looking for some excuse, any excuse, to run BilledMammal out of town. Ravenswing 15:48, 21 March 2022 (UTC)[reply]
  • Personally I have suspected this for a while. When this editor first came onto my radar, I checked their early contributions, and like many Icewhiz socks, they make a load of minor edits (in this case, 244 edits/moves of Ethiopian districts on 3 July 2021[514][515]) to cross the 500 edit threshold and then jump into editing an Israel/Palestine-related article (559th edit). The relentlessness in various discussions is also reminiscent of Icewhiz, an editor who would never drop the stick (and also had a serious apathy towards NSPORTS, which has been one of the areas of relentlessness). Number 57 16:02, 21 March 2022 (UTC)[reply]
  • Lots and lots of editors have antipathy for Wikipedia being flooded by pernastubs on non-notable people. Trying to claim everyone with this view is the same person just because they have this same view is absurd.John Pack Lambert (talk) 16:06, 21 March 2022 (UTC)[reply]
    But we're not claiming it's "everyone" Lambert, just this one case. Lugnuts Fire Walk with Me 16:09, 21 March 2022 (UTC)[reply]
    Except that's not really true, is it. Yesterday No Great Shaker was convinced that BM was a sockpuppet of Störm, and filed an extensive complaint to that effect. Today No Great Shaker is convinced that BM is a sockpuppet of Icewhiz instead. I can't wait to see which puppet master will be linked to the next accusation. Ravenswing 17:14, 21 March 2022 (UTC)[reply]
      Clerk note: Regarding all three comments in this chain: Please keep comments focused on the question of whether BilledMammal is a sockpuppet of Icewhiz. All other concerns, about BilledMammal, No Great Shaker, or anyone else, belong in the ANI thread. -- Tamzin[cetacean needed] (she/they) 17:31, 21 March 2022 (UTC)[reply]
  • As I raised in the ANI thread, I don't personally enough topic overlap or issues that would indicate BM being a sock. I think this report is more of a consequence of the animosity in the current RSN thread (as can be seen in the ANI thread) than an actual analysis of the user's contributions and behaviour. In essence, it's a hammer looking for a nail. A. C. Santacruz ⁂ Please ping me! 16:43, 21 March 2022 (UTC)[reply]
    So you don't think making a huge number of edits in a single day, then jumping onto an Israel/Palestine-related article shortly after passing the 500 article threshold (which is what several other Icewhiz socks have done) isn't rather suspicious? In this previous SPI the fact that there was "ample evidence that they're not new editors and they've gamed the 30/500 restriction, which in this topic area almost always means they're evading a ban." resulted in blocks for the suspected socks put forward then. Nableezy was also unconvinced about that one :) Number 57 17:03, 21 March 2022 (UTC)[reply]
    I dont think he really jumped in to the PIA topic, it was centered around some esoteric altname/naming convention stuff, like here or here in other topics. All his involvement in the PIA topic areas have to do with naming, barely anything at all to do with the actual content. nableezy - 17:52, 21 March 2022 (UTC)[reply]
    Tamzin, fair enough, most not all. nableezy - 18:41, 21 March 2022 (UTC)[reply]
  • It doesnt really feel like IW to me, but I have been wrong in the past. The involvement in the Wehda article was on a minor point regarding altnames, same argument carried out elsewhere. If I would be looking for sockmasters I wouldnt be thinking an I/P editor, more a policy page editor. nableezy - 16:53, 21 March 2022 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit
  •   Clerk note: Since this filing has the potential to balloon into an extensive discussion, I would like to preemptively remind participants that
    • SPI is not a vote
    • We can only litigate issues relating to sockpuppetry here
    • The recommended evidence format is paired diffs showing direct behavioural similarities between the alleged sock and the master or previous blocked socks of the master, and assertions about behavioural similarities that are made without evidence may be ignored (see User:Blablubbs/How to file a good SPI for guidance)
  • Thanks. --Blablubbs (talk) 16:25, 21 March 2022 (UTC)[reply]
  • My recollection, borne out by Category:Wikipedia sockpuppets of Icewhiz, is that we've never found a confirmed/proven sock of Icewhiz that predates his indef. That of course does not mean there couldn't be sleepers created before 1 October 2019, but the filer or others may wish to discuss why Icewhiz, then a user in good standing, would have created a sock in April of '19. If this is Icewhiz' first sock, I'd expect some naïveté early on, but I'm not seeing obvious tells like blatant edit summary matches (here's Icewhiz' 5,000 edits prior to BilledMammal's registration; BilledMammal's 17 edits prior to Icewhiz' indef). Likewise the timecard doesn't seem very Icewhizzy, and the EIA is, per Nableezy, mostly projectspace stuff. Also seems like this would have been the smarter account to RfA with, if this is Icewhiz... but maybe that's too much trying to get into his head. -- Tamzin[cetacean needed] (she/they) 17:21, 21 March 2022 (UTC)[reply]
    @Nableezy: Just in point of fact, there is stuff like this, one of BM's earliest edits. However, making an XCP ER on a high-profile page with an account that already meets the age requirement, all to say something that doesn't easily fit into any one POV, doesn't seem very Icewhiz to me. In that context I'd expect Icewhiz to game the 500 edits and then make that edit himself, probably with some subtle POV-pushing mixed in. Rather to me it reads as a pretty genuine "I saw something on the news, but it isn't on Wikipedia; let's fix this". So, mostly agreeing with your assessment, but did want to note that there is at least some non-naming-related PIA stuff. -- Tamzin[cetacean needed] (she/they) 18:06, 21 March 2022 (UTC)[reply]
  • I'm closing this before it attracts the usual Icewhiz peanut gallery. Timecard doesn't match. Editor interaction is unconvincing. This whole SPI was triggered by an IP who has made exactly one edit (to ANI) and their range has zero edits to projectspace before that, which I file under "generally suspicious". Not everyone in this damned topic area is Icewhiz, folks. GeneralNotability (talk) 18:41, 21 March 2022 (UTC)[reply]

20 June 2022

edit

Suspected sockpuppets

edit

I'm still not totally convinced Free1Soul is Icewhiz, but I think the evidence shows that Seggalion is Free1Soul and Free1Soul is blocked as an Icewhiz sock so here goes:

Comments by other users

edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Nableezy, please remember that Icewhiz and Yaniv collaborated in the past (Yaniv posting text written entirely by Icewhiz and vice versa), hence Free1Soul confusion. Both individuals (Yaniv and Icewhiz) are still laboriously engaged in editing. This particular account, no doubts a sock-puppet, is, for example, attempting to conceal competence of Wiki formatting by intentionally posting raw, unformatted links despite reveling know-how in previous comments. Something Icewhiz’s sock puppets used to do. - GizzyCatBella🍁 06:07, 20 June 2022 (UTC)[reply]

..our sockmaster has a great taste in music, I must add [516] <--> [517] - GizzyCatBella🍁 06:35, 20 June 2022 (UTC)[reply]

Additional hint:
I'm not sure if it's even worth my time typing (or your reading), but perhaps I'll show it to you since things like that happen to me regularly.
  • Shortly after my comment here, a new account has been created -->[518]
What the new account does?
  • After making two edits, within 4 minutes, proceeds to this revert -->[519]
Why am I showing you this, you would ask?
  • Well, take a look:
- I removed Yaniv's sock puppet edit -->[520]
- My removal has been reverted by a user who felt sockpuppet's edit is useful -->[521]
- The newly created account arrives and reverts to my version -->[522] with an edit summary: Bad visual 🤔
So? You would ask. What's so unusual?
  • Well, notice the emotional face --> 🤔
Who just used exactly the same emotional face in their edit summary? -->[523]. Yes, it was me.
Coincidence? No. The emotional face has been inserted by the new account intentionally to suggest socking. I bet you would have extremely challenging time locating any other user utilizing that identical emotional face in their edit summary, if at all.
I faced such things in the past, and it was Icewhiz doing it, so it's likely them again. - GizzyCatBella🍁 16:15, 20 June 2022 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit
  • I've had similar suspicions. I think Nableezy's third bullet point is, in particular, a compelling enough similarity to justify a check.   Clerk endorsed. -- Tamzin[cetacean needed] (she/they) 05:09, 20 June 2022 (UTC)[reply]
  •   In progress - -- RoySmith (talk) 14:22, 20 June 2022 (UTC)[reply]
  • I ran some checks, which basically came back   Inconclusive, but that's not surprising for this case. I've recorded some data in cuwiki, but other than that I'm going to just leave this alone and let somebody who is better versed on the case history take a look. -- RoySmith (talk) 15:04, 20 June 2022 (UTC)[reply]
  • The similarities in manner of gaining extendedconfirmed (essentially as low-effort as you can get without getting XC pulled for gaming) and in responding to accusations of misconduct make me think it is significantly more likely than not that this is Icewhiz. I think that's the best we're going to get here; if this were a case of an editor otherwise not acting sock-like, I'd be a bit hesitant to block, but heightened scrutiny is warranted of those who make a beeline into PIA territory, as they are much more likely to be sox than your run-of-the-mill new editor. Blocked indefinitely as suspected. And while I'm in the neighborhood, blocked GCB's new admirer, FuzzyMuzzly (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), for joe-jobbing; don't really care who the master is, and I doubt a check would elucidate. -- Tamzin[cetacean needed] (she|they|xe) 22:48, 20 June 2022 (UTC)[reply]
  • As a note for future reviewers about this account, ArbCom had a 6-0 majority in support of an arbcom block for this account lined up before this filing was made. --Izno (talk) 23:06, 20 June 2022 (UTC)[reply]

03 August 2022

edit

Suspected sockpuppets

edit

PrisonerB's editing pattern corresponds with the last two blocked socks of Icewhiz, Free1Soul and Seggalion. PrisonerB editing in April-May 2020, stopping then with F1S editing from May-December 2020 and stopping. All three were quiet through the first three months of 2021 (which to my suggests another sleeper to be activated later was building up their 500 edits then), a spurt of activity got PrisonerB over 500 edits in April and then mostly quiet until after both F1S and Segallion were blocked, with PrisonerB picking back up editing in earnest on July 11 of this year, a few weeks after Seggalion was blocked. Among the diffs that stand out to me the most is this at Smolensk air disaster, a diff about Rafał Pankowski, a page Icewhiz started, on a page Icewhiz had previously edited. The timing with the other socks suggests this to be in the same set, and Id hazard a guess there are several more in that set as well. The timecards in the links above also show similar editing times. nableezy - 20:02, 3 August 2022 (UTC)[reply]

Comments by other users

edit
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I agree %100, this is yet another sock puppet of Icewhiz and this edit is a smoking gun. With multiple sock puppet accounts, it’s challenging to maintain them separated and not connect Palestine/Israel and Poland-related areas. - GizzyCatBella🍁 20:20, 3 August 2022 (UTC)[reply]

Here is Icewhiz praising Pankowski on other talk page --> [524]
He did that on many other occasions, (I can look for more diff’s if needed) that’s why he removed this critical note of Pankowski from the page about the Smoleńsk Crash - Icewhiz edited before that page. - GizzyCatBella🍁 20:38, 3 August 2022 (UTC)[reply]
Here is another example of Icewhiz praising Pankowski -->[525] Pankowski is cited as an expert...He is furthermore extensively published in an academic setting. GizzyCatBella🍁 20:45, 3 August 2022 (UTC)[reply]
Here is another one -->[526] and another one -->[527] there is more, but you get the picture. It is extremely unlikely that someone with the same POV in the Palestine/Israel area as Icewhiz suddenly hops to Poland-related area to remove critical information about Icewhiz's favoured individual. Pankowski in not that well known. His Wiki page gets 140 views per year (Icewhiz created that page in 2019 and patrolled for any critisism ever since). One has to know the person to be interested in Pankowski. That's Icewhiz. - GizzyCatBella🍁 21:04, 3 August 2022 (UTC)[reply]

@RoySmith if you have time please take a look at what I wrote above. - GizzyCatBella🍁 21:28, 3 August 2022 (UTC)[reply]

I had looked here for RoySmith's reply but it turns out it was given at GCB's talk page. For the record:

Hi, I saw your ping on the SPI, but not until it had already been archived, so responding here. The CU data was quite strong indicating that PrisonerB is not Icewhiz. And when I looked at the behavioral evidence presented, I wasn't convinced there was anything that was strong enough to contradict the CU data. If they really are a sock, they will probably provide more evidence, and you can file a new case then. -- RoySmith (talk) 17:44, 4 August 2022 (UTC)

Firefangledfeathers (talk / contribs) 19:39, 11 August 2022 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit
  •   Unrelated -- RoySmith (talk) 20:20, 3 August 2022 (UTC)[reply]
    I have been asked to clarify what "unrelated" means (see talk page). I've basically got two types of data to look at; the IP address(s) used, and the user agent string reported by the browser, which indicates a combination of what software and hardware was used to make a particular edit. There's no hard and fast rules for how similar they have to be to get translated into the generic "confirmed", "likely", "possible", etc terms that are used in a CU report. In general, "unrelated" means something like "Neither the user agent(s) nor the IP range(s) in use match the historical data we have for this case, nor can the differences reasonably be explained by the passage of time, i.e. sequential browser upgrades".
    Both IP addresses and user agents can be falsified by use of proxies. We often get clues that proxies might be in use, and if that seems likely, the CU will often hedge with something like "inconclusive". In this particular case, I didn't see any evidence that proxy use could reasonably explain away the differences.
    Is it still possible that PrisonerB is Icewhiz? Of course. They could be using some proxy service which eludes our detection, but I don't think that's the case (for a variety of reasons I won't go into details about). Could they have gotten on a plane, flown to another part of the world, and logged into wikipedia using a type of device they don't normally use? Of course, and I would have no way to tell if that happened. In short, one can always construct scenarios to justify ignoring an "unrelated" finding from CU. But, if you're going to do that, why bother asking for CU at all? -- RoySmith (talk) 20:06, 11 August 2022 (UTC)[reply]

12 October 2022

edit

Suspected sockpuppets

edit

There isnt a ton to go off of here, but in the span of 53 edits this account has reverted the usual Icewhiz targets across a range of topic areas. Volunteer Marek multiple times (Special:Diff/982341161, Special:Diff/985139641, Special:Diff/985141813), Nishidani (Special:Diff/1072437946), Iskandar323 multiple times (Special:Diff/1045441629, Special:Diff/1045439553), and myself (Special:Diff/1115706293). The timing of the edits is also consistent with Icewhiz (IW timecard vs CZUQZ) though again, not a ton to go off of. But the reverts across several disparate topic areas, showing up months in between specifically to revert users that Icewhiz has repeatedly edit-warred or made reports against with sockpuppets is suggestive of yet another IW sock. nableezy - 20:09, 12 October 2022 (UTC) 20:09, 12 October 2022 (UTC)[reply]

Comments by other users

edit
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Editing out a modern pinyin transcription of Chinese and reverting it to a clumsy and outdated system that gives the reader no idea of the pronunciation, to back another (excellent) editor who disagreed with me, as happened at Khazars (most of which I wrote), and without talk page engagement and then going for another frequent editor in the IP area to revert him on an equally obscure article Whaling in the Faroe Islands is just coincidental only if one suspends the logic of probabilities. These are recondite articles with no common thread other than IP editors who respectively tweaked them were reverted by the same guy. Nishidani (talk) 21:38, 12 October 2022 (UTC)[reply]

@Nableezy That could be NoCal100, you know 🤔..
[528] <--> [529]
[530] <--> [531] - GizzyCatBella🍁 05:21, 13 October 2022 (UTC)[reply]
Possible I guess, but the timing was more IW and the editing in opposition to VM to start with is what drew my attention. Will keep an eye out I guess. nableezy - 05:22, 13 October 2022 (UTC)[reply]
Actually, RoySmith is that worth a look or filing a separate case? nableezy - 05:24, 13 October 2022 (UTC)[reply]
@Nableezy They are actually well aware of VM and comments against him --> [532] User:NoCal100 is IW's pal, you know. - GizzyCatBella🍁 05:45, 13 October 2022 (UTC)[reply]
..Yeah, I believe this one is User:NoCal100. They reverted VM (Special:Diff/985141813) on October 24/20 using User:CZUQZ account and one year later comments against VM using User:Inf-in MD. The edit count is so small but the connection to you folks is overwhelming. If unrelated to IW (per Roy’s check) then that’s User:NoCal100 - GizzyCatBella🍁 06:13, 13 October 2022 (UTC)[reply]
@GizzyCatBella would you please file a new report under NoCal100? Thanks. -- RoySmith (talk) 14:18, 13 October 2022 (UTC)[reply]
Okay, later today. - GizzyCatBella🍁 14:37, 13 October 2022 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit

14 February 2023

edit

Suspected sockpuppets

edit

As pointed out by GizzyCatBella at WP:A/R, this user made about a dozen edits before abruptly jumping into the Polish history area to revert Volunteer Marek, on a page that another sock of Icewhiz (User:Bob not snob) had edited only a day before. I'm not entirely sure this is Icewhiz, but it definitely is not this editor's first account. Partofthemachine (talk) 21:32, 14 February 2023 (UTC)[reply]

Comments by other users

edit
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

edit

27 August 2024

edit

Suspected sockpuppets

edit

I've suspected for a while that O.maximov and UnspokenPassion were socks, but I wasn't sure who the master was. When I read Sean.hoyland's recent comment linking to this chart, which lists O.maximov and some IW socks, I checked some IW socks and found similarities.

Mvqr was blocked as an IW sock on Jan 20, 2024. O.maximov was created Feb 8, UnspokenPassion Mar 28.

The timecards of O.maximov and UnspokenPassion match each other, and also match the timecards of some confirmed IW socks, e.g. Mvqr, Hippeus, and Geshem Bracha.

As a sort of baseline example, note the similarity of POV, language, and "drive by" editing pattern of confirmed IW socks Hippeus and Geshem Bracha at Talk:Israel:

  • Hippeus ("Already covered sufficiently ... The lede devotes ridiculous amount of space to the conflict while omitting other content.")
  • Geshem Bracha ("Already excessively covered. There is too much on the Arab-Israeli conflict in the lead. Much too much. The content needs to be reduced, not increased, as there are many other topics that are missing from the lead.")
  • Both of those are votes to exclude criticism of Israel's occupations/annexations from the lead of the article
  • That is Hippeus's only edit to the article talk page, no edits to the article itself
  • Geshem Bracha has 3 edits to the talk page: the one above, another one about not mentioning settlements, and this one about the Palestinian-Nazi connections; their only article edit was to remove content about illegality of Israeli settlements

O.maximov and UnspokenPassion show the same basic POV, similarity of comments, and "drive-by" habit, as Hippeus and Geshem Bracha. Examples:

  • Israel
    • O.maximov ("if the Israeli War of Independence isn't mentioned, then it makes no sense to mention the Nakba")
    • UnspokenPassion ("If we include Nakba, we’d have to bring in more narratives, like the Independence War, as mentioned above.")
    • This is the only edit UnspokenPassion has made to the talk page, no edits to the article; O.maximov has edited both
  • Genocide of indigenous peoples
    • O.maximov ("We're looking at two groups, both with historical ties to the land, both claiming indigenity.")
    • UnspokenPassion ("The Israeli-Palestinian conflict is generally understood as a struggle between two ethnic groups, both laying claim to being indigenous.")
    • These are the only edits either account made to that article's talk page. O.maximov made one edit to the article; UnspokenPassion has made no edits to the article.
  • Palestinian suicide terrorism - an article created by UnspokenPassion
    • UnspokenPassion ("... the term 'terrorism' is entirely appropriate (for instance, see examples like Islamic terrorism, Jewish extremist terrorism, etc.).")
    • O.maximov ("It is unclear to me why there are calls to remove the term from this article while its usage in the above mentioned articles like Jewish extremist terrorism, Islamic terrorism, and, I will add, Israel and state-sponsored terrorism is accepted.")
    • This is the only edit O.maximov has made to this article or its talk page

FWIW, EIA turned up two articles where Mvqr's only edit was to revert a change, which O.maximov later expanded: Economy of New York City (EIA) and Knowledge economy (EIA)

There are other accounts that I believe are also socks, but O.maximov and UnspokenPassion are the ones where I have the clearest evidence. I don't know if this is enough evidence to warrant further investigation but I figured I'd start here. If this is enough and reviewing admin want to see more, I can post more. If this is not enough then it's probably not even worth me bringing up any other suspicions I have. Thanks for taking a look, Levivich (talk) 19:24, 27 August 2024 (UTC)[reply]

Comment by ABHammad

edit

@HJ Mitchell:, I have to say this is one of the weakest sock-puppet blocks I have ever encountered. The block seems to be based only on the fact that two accounts agreed on several topics, worked during similar timeframes (shared by an entire hemisphere), and shared some interests with a third blocked user (in a totally speculative way). If those were valid criteria, we could block half of the active, experienced editors in the ARBPIA area.

To me it is pretty clear that these editors are not the same person, and I don't see any strong connection to Icewhiz's editing either. Their writing styles (compare O.Maximov's [533] and UnspokenPassion's [534]) and edit summaries differ, and so their main topics of interest. Both have created new articles that look completely different (compare UnspokenPassion's Palestinian suicide bombings and O.Maximov's Video game industry in Israel and Bank of Israel Law).

The circumstances surrounding this complaint are also extremely questionable. The filer, Levivich, has previously expressed strong opinions on the topic ("We are witnessing the last gasps of Zionism") and has recently filed complaints against any editor with fewer than 1,500 edits who disagrees with their views. The last of those was now dismissed as "unconvincing" and escalated to ARBCOM by four admins for a broader discussion on the conduct of all parties involved, including Levivich themselves. The rush to delete this editor's contributions right after the block shows exactly what I'm concerned about, and once I said this block seems wrong, Sean.Hoyland was quick to attack me too with heavy aspersion castings [535]. I think that proves my point well.

If every new editor on this topic is automatically labeled as a sockpuppet by the existing experienced editors and quickly blocked without evidence, the current problematic situation will never improve. If this continues, with new editors being blocked as socks without solid evidence again and again, it might be fair to say that Wikipedia is finally ruined. This block should be overturned unless stronger evidence is presented. ABHammad (talk) 07:56, 3 September 2024 (UTC)[reply]

Tagging the referring admins: @Red-tailed hawk, @ScottishFinnishRadish, @Barkeep49, @Theleekycauldron. I would appreciate your feedback on this matter. This case appears to be a direct continuation of recent events. ABHammad (talk) 07:59, 3 September 2024 (UTC)[reply]
@ABHammad the behavioural evidence was almost "by the way". It's enough to justify a check. What I found when I performed the check was consistent with a sophisticated bad actor. We have several of those and these accounts have been careful to obfuscate their identity so I can't say conclusively that they're Icewhiz but they are very clearly not good-faith new users. HJ Mitchell | Penny for your thoughts? 11:10, 3 September 2024 (UTC)[reply]
@HJ Mitchell. As I said above, I am pretty confident these are different editors for the reasons I provided, and I don't see the link to Icewhiz. I'm unsure what else could define someone as a 'sophisticated bad actor,' especially since I haven’t seen any violations from O.Maximov that are worse than what's already occurring in this area (or any violations from UnspokenPassion at all). If we continue removing every new user using a VPN on the slim chance they might be socks, we're only perpetuating the existing issues. At a minimum, I believe the blocks should be overturned until a more thorough review is conducted and stronger evidence is presented. ABHammad (talk) 14:00, 3 September 2024 (UTC)[reply]
@HJ Mitchell, I'll appreciate some input here. ABHammad (talk) 11:47, 8 September 2024 (UTC)[reply]
You've had all the input you're going to get from me, I'm afraid. HJ Mitchell | Penny for your thoughts? 12:22, 8 September 2024 (UTC)[reply]

Comment by Sean.hoyland

edit

ABHammad, I only asked you whether you used to edit as Tundrabuggy/Stellarkid. It's because I'm looking at results like these that suggest your account is a close match and would like to know whether they are accurate. Are they? Help a brother out. Sean.hoyland (talk) 08:15, 3 September 2024 (UTC)[reply]

And by the way, that's not me casting aspersions, that's functions in high dimensional metric spaces casting aspersions, so blame math. Sean.hoyland (talk) 08:30, 3 September 2024 (UTC)[reply]

Red-tailed hawk, yes, sorry about that. The plots aren't really built for public consumption. There's a bit of background here as RoySmith asked me about it related to an Irtapil sock case.

  • There are legends at the top of each plot, but that probably doesn't help much.
  • Each plot has 6 rectangular areas, 2 at the top, 2 at the bottom and the longest 2 in the middle. To keep things simple, you can ignore everything apart from the large middle area on the left.
  • That area is made of a series of rows. Each row is a Wikipedia account. The area contains information about how much each account resembles the reference account e.g. ABHammad. By 'resembles', I mean how close or similar are vector representations of the accounts in various metric spaces. The closer the color is to the left side of the colorbar of the legend, the closer or more similar the vectors are to each other. The reference user will be pink because it resembles itself.
  • Each plot uses a different method to compare vectors.
  • The machine decides the details of the colorbar e.g. where it transitions from color to monochrome etc. automatically based on the statistics of the spaces.

So, rows (accounts) with colors towards the left side of the legend colorbar for each plot are the accounts that mostly strongly resemble the reference user.

  • There is a bit more going on than that for each row (account) in the plot because they are made up of many cells, and each cell represents a different vector representation of the account, but that is getting into the weeds.
  • Let's say, if accounts resemble each other, the colors of the cells in a row will tend to move towards the pink end of the spectrum as you move along the row to the right. So, if you look at the ABHammad row you see that it becomes pinker towards the right. That's it in a nutshell.

The test dataset currently looks at about 320-ish accounts made up of active accounts, blocked accounts, a few admin accounts (for sanity checks). It mostly focuses on accounts with activity in the PIA topic area but there are quite a lot of accounts that don't edit in the topic area too (again for sanity checks).

Caveats

  • This is a work in progress out of curiosity, an idea that I thought wouldn't work that maybe/might work to provide pointers or likelihoods to help shrink the search space for sockmasters.
  • I have a near zero credence in the results right now because I don't have enough data on resolution or reliability.
  • As it has grown, I no longer fully understand what it is doing internally to match accounts e.g. the FourPi to Irtapil sock matches.

Sean.hoyland (talk) 04:15, 4 September 2024 (UTC)[reply]

I should add, as there is no limit to my pedantry, that one of the legend titles is a bit misleading. For the one that says cosine similarity I actually use 1 - cosine similarity so that increasing vector resemblance tends towards zero rather than one. Sean.hoyland (talk) 06:04, 4 September 2024 (UTC)[reply]

Just wanted to make a quick comment about these 2 accounts being blocked. It seems highly likely that there are several other undetected Icewhiz socks operating in the PIA topic area. If you look at the timeline for the subset of accounts that have been identified and blocked, two things are notable.

  • For any given time period, they operate many accounts in parallel. I assume this is common knowledge.
  • Many accounts probably remain undetected. Imagine drawing a straight line connecting the account registration dates on the timeline plot. There is a very obvious change of slope for the section between 2021 to present. The slope is much shallower. There are at least 2 explanations, 1. Icewhiz is creating fewer socks or 2. many accounts have not been detected (obviously detection would increase the slope). Option 1 seems highly unlikely. Sean.hoyland (talk) 07:03, 6 September 2024 (UTC)[reply]

Comment by Eladkarmel

edit

As I wrote in the discussion about Tombah, it doesn't seem logical to me that any editor who does not align with the anti-Israel views, is accused immediately and blocked almost without discussion and almost without evidence. I myself was wrongly accused of being a sock puppet by some editors here but it was later proven this was wrong. I almost completely left English Wikipedia because it is very difficult to be an Israeli who is identified as Israeli here. Please, rethink the blocks, and assume good faith. Eladkarmel (talk) 16:09, 3 September 2024 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

edit
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Icewhiz/Archive&oldid=1244750121"