Wikipedia:Sockpuppet investigations/Btw Santhosh/Archive
Btw Santhosh
- Btw Santhosh (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
30 July 2023
[edit]Suspected sockpuppets
[edit]- Btwsanthoshkumar (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Btw Santhosh Hacker (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Tools: Editor interaction utility · Interaction Timeline · SPI Tools
All users have the single purpose of promoting Santhosh Kumar / Btw Santhosh. Tol (talk | contribs) @ 07:00, 30 July 2023 (UTC)
Comments by other users
[edit]- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
[edit]- Master nuked, Global lock(s) requested for accounts mentioned + Btw Santhosh ETHICAL HACKER (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). DatGuyTalkContribs 10:52, 30 July 2023 (UTC)
14 January 2024
[edit]Suspected sockpuppets
[edit]- XPosBot (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- CONFLIXERS (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Tools: Editor interaction utility · Interaction Timeline · SPI Tools
Users from this farm have been creating articles on a hacker Santhosh Kumar / Draft:Santhosh Kumar. Once that got protected, they seem to have now switched to trying their luck with Draft:Hacktivist Vanguard (Indian Hacktivist) / Draft:Hacktivist Vanguard (Indian Hacktivist Group) (and possibly others), apparently a group set up by the said Kumar. The first (that I'm aware of) was XPosBot, but they got blocked because of their username, and CONFLIXERS picked up the baton; I'm sure they're the same user, as their user pages are very similar, and the newer account was set up only two days after the older got blocked. But more to the point, I'm saying I think they're both Btw Santhosh.
BTW, three years ago Scounder also created Santhosh Kumar, although that's so long ago that I don't think it's part of this campaign. It is apparently part of the Srinesh.saravanan farm. I'm just mentioning here in case there's any connection, which I think unlikely.
Requesting CU to confirm, as the Hacktivist topic is a degree removed from Kumar, and also for a scan of others waiting in the wings. -- DoubleGrazing (talk) 09:00, 14 January 2024 (UTC)
Comments by other users
[edit]- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
[edit]- Came across this from another angle. See below. DatGuyTalkContribs 15:22, 14 January 2024 (UTC)
14 January 2024
[edit]Suspected sockpuppets
[edit]- CONFLIXERS (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Whoslivesmatterss (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- XPosBot (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Amhjustuser (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Kurta ipasvc (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Pplkhhb (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- African LIVES Matter (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) (original case name)
- Tools: Editor interaction utility · Interaction Timeline · SPI Tools
Pro forma, all Confirmed to each other (Kurta ipasvc (talk · contribs) was created directly by CONFLIXERS through Special:CreateAccount). Whoslivesmatterss (talk · contribs) might be just Likely instead but I don't see the point in making the distinction. DatGuyTalkContribs 14:37, 14 January 2024 (UTC)
Comments by other users
[edit]- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
[edit]- Global lock(s) requested due to cross-wiki disruption. DatGuyTalkContribs 14:47, 14 January 2024 (UTC)
- Correction: This is behaviourally likely to be Btw Santhosh (talk · contribs). Moving there and adding Pplkhhb (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) who is Highly likely. DatGuyTalkContribs 15:18, 14 January 2024 (UTC)
19 January 2024
[edit]Suspected sockpuppets
[edit]- Santhosh Rajput (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- BOMBBITA (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Tools: Editor interaction utility · Interaction Timeline · SPI Tools
Very similar user pages. I warned User:Santhosh Rajput about the misleading user page here. User:BOMBBITA has used a dragon gif at the bottom of their user page [1], which I believe no one else uses other than me. Requesting CU based on the behavioral evidence, as I remember seeing a very similar user page a couple of times recently. Jeraxmoira🐉 (talk) 18:25, 19 January 2024 (UTC)
- User page is similar to what XPosBot had initially. [2] Jeraxmoira🐉 (talk) 18:28, 19 January 2024 (UTC)
Comments by other users
[edit]- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
[edit]- I'll call these Confirmed to the previous batch and proven to Btw Santhosh (talk · contribs):
- 0p0poijhgvbjm (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- BhenChup12 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- ButterSuiter (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- OHMEREJANU (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Santhosh Rajput (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- BOMBBITA (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
08 February 2024
[edit]Suspected sockpuppets
[edit]- Hafzal Murbani (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Tools: Editor interaction utility · Interaction Timeline · SPI Tools
New account, whose first two edits had to do with this Hacktivist Vanguard thing, which is has seen a lot of socking from different farms, but most recently (AFAIK) from the Btw Santhosh one, so thought I'd flag this up here just in case. -- DoubleGrazing (talk) 11:21, 8 February 2024 (UTC)
- Huh? I didn't check the CU box. Soz! -- DoubleGrazing (talk) 11:22, 8 February 2024 (UTC)
- PS: On a different point, this user has created Draft:Rahhat Shah Kazmi, which was previously created several times under different titles. I had a look but couldn't see any blocked accounts anywhere in the history, but obvs the histories of deleted drafts/articles are not visible to me. I guess it could be that this user is just a new hired gun and not a sock, at least not from this farm? -- DoubleGrazing (talk) 11:37, 8 February 2024 (UTC)
Comments by other users
[edit]- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
- The following are single-purpose accounts for publicising Hacktivist Vanguard, or in the case of ShingaChu a semi-single purpose account.
- ShingaChu (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Manoj12Kumar11 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Prithivi Goswami (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Tools: Editor interaction utility · Interaction Timeline · SPI Tools
They look to me like sockpupets or meatpuppets associated with Hafzal Murbani. They may or may not also be Btw Santhosh, but either way I think a CU to compare them with one another, and to look for possible sleepers, would be welcome. JBW (talk) 20:03, 11 February 2024 (UTC)
- Hafzal Murbani is now globally locked, having been locally blocked on Faeroese Wikipedia for abusing multiple accounts, and on Hausa Wikipedia for a reason which Google translates as "immigrants". (????) However, a CU would still be welcome, because of the other accounts. JBW (talk) 23:49, 11 February 2024 (UTC)
Clerk, CheckUser, and/or patrolling admin comments
[edit]- ShingaChu (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Hafzal Murbani (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Pritham Gupta (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- ThaiBan Naban (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Blocked and tagged, Global lock(s) requested. Other accounts are stale. Closing. Thanks, Spicy (talk) 17:13, 18 February 2024 (UTC)
11 February 2024
[edit]Suspected sockpuppets
[edit]- Pplkhhb (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: originally filed under this user)
- ShingaChu (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Hafzal Murbani (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Manoj12Kumar11 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Prithivi Goswami (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- MahmudHM1 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Tools: Editor interaction utility · Interaction Timeline · SPI Tools
Block evasion. New SPA ShingaChu created 10 February. 15 minutes after creation, first edit was to add 13 copies of "group" press release, posted to 13 different junk sites, to Draft:Hacktivist Vanguard: [3]. This is the same press release used heavily in deleted Hacktivist Vanguard and Hacktivist Vanguard (Hacktivist Group), and added this time to a parallel draft Draft:Hacktivist Vanguard, created in September before the master was blocked and the articles were deleted following strong consensus at AFD. Following day, first made a few precocious edits to Mir Sarwar, all marked as minor Then rewrote Draft:Hacktivist Vanguard in a single edit: [4], created a second nearly identical draft at Draft:Hacktivist Vanguard (Hacker Group), both using image uploaded by Hafzal Murbani.
- And a third stab, at Draft:Hacktivist Vanguard (Indian Hacker Group). Wikishovel (talk) 18:28, 11 February 2024 (UTC)
New SPA Hafzal Murbani, uploaded non-free logo File:Hacktivist Vanguard.jpg to Commons as "own work", with the same spammy description used in the original article and the two new drafts. This identical to the non-free logo uploaded to Commons three times by master, and deleted three times over licensing. Wikishovel (talk) 16:23, 11 February 2024 (UTC)
An anon editor also worked extensively on Draft:Hacktivist Vanguard on 6 Feb, adding "This section will be updated periodically to reflect the group's evolving history and its impact on the cybersecurity landscape.", with no AfC template, essentially settling for a permanently parked draft to promote a one-person, zero-notability "hacker group". Wikishovel (talk) 16:27, 11 February 2024 (UTC)
Adding two more socks, Manoj12Kumar11 and Prithivi Goswami, SPAs who created [5] and worked on [6][7] Draft:Hacktivist Vanguard respectively. Wikishovel (talk) 16:32, 11 February 2024 (UTC)
Just noticed that User:Hafzal Murbani was indeffed and globally locked for sockpuppetry at FOwiki by User:WikiBayer, and previously indeffed at HAwiki by User:Gwanki. Wikishovel (talk) 17:35, 11 February 2024 (UTC)
- This is Special:CentralAuth/Muhammad_Bilal_Muzzamil. He is blocked on Wikidata, Fowiki, SSWIKI, HAWiki, and ... .I habe added MahmudHM1 to the request please check.
other socks
- Ubukwe Ahiya (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Kaodcisd (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Jaiiy uuu (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Hazim Rozak Bump (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Geho Horashama (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Gayuobs Yeoo (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Gerehap Ritz Ywoo (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Mitra Valmeoo (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Gaisoebd Hdiwodb (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Giria Ywoo (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Arhan Gautam Shan (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Tiya Chandra 28288 (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Aakansha Drivedi Bharat 66 (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Mukul Suressh (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Music Violet (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Arjit Kumar Biswas 254 (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
- Garpiwosb7 (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser) and more--WikiBayer (talk) 17:56, 11 February 2024 (UTC)
Comments by other users
[edit]- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
[edit]- Merged case to Btw Santhosh. All non-stale accounts have been blocked and locked. Closing. Thanks, Spicy (talk) 15:28, 30 March 2024 (UTC)
22 March 2024
[edit]Suspected sockpuppets
[edit]- शास्त्री 911 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Tools: Editor interaction utility · Interaction Timeline · SPI Tools
We have a brand new SPA creating yet another version of Draft:Hacktivist Vanguard. I believe this topic has been attempted by at least Btw Santhosh's farm as well as Pplkhhb's, but I had to pick one so went with Btw S. DoubleGrazing (talk) 18:15, 22 March 2024 (UTC)
Comments by other users
[edit]- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
[edit]- Confirmed to राहुल शास्त्री, technically Possilikely (a mix between possible and likely) to previous accounts, but behaviour makes it clear enough. Blocked and tagged, Global lock(s) requested, closing. Thanks, Spicy (talk) 18:12, 29 March 2024 (UTC)
15 April 2024
[edit]Suspected sockpuppets
[edit]- Techrd2000cork (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Brosscreater (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Tools: Editor interaction utility · Interaction Timeline · SPI Tools
Block evasion: new SPA Techrd2000cork created 15 April. An hour later, recreated Draft:Hacktivist Vanguard at Draft:Team Hacktivist Vanguard. Wikishovel (talk) 16:10, 15 April 2024 (UTC)
New SPA Brosscreater, created 16 April. Games autoconfirm, then recreates Rachana Shah, G5'd a day earlier. Requesting checkuser. Wikishovel (talk) 15:42, 20 April 2024 (UTC)
Comments by other users
[edit]- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
[edit]Please see my comments at User talk:Bbb23#Rachana Shah.--Bbb23 (talk) 15:45, 20 April 2024 (UTC)
- Techrd2000cork is Confirmed to राहुल शास्त्री. Some proxy use noted.
- Brosscreator is technically Unlikely to this case. Their technical data is more consistent with WP:Sockpuppet investigations/Bikrookanpurgangster but it's not wholly distinctive so Behavioural evidence needs evaluation. Spicy (talk) 16:29, 20 April 2024 (UTC)
- Brosscreater (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) has been documented in the 13 May 2024 that was filed here and moved to Wikipedia:Sockpuppet investigations/Bikrookanpurgangster. Closing this as there is nothing left to do. Dreamy Jazz talk to me | my contributions 17:29, 18 May 2024 (UTC)
21 April 2024
[edit]Suspected sockpuppets
[edit]- राहिल खान (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: original case name)
- Brosscreater (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Tools: Editor interaction utility · Interaction Timeline · SPI Tools
Right after deletion that I nominated, its being created again so I just think this user is sock or employed by same person. HarryD (talk) 08:44, 21 April 2024 (UTC)
Comments by other users
[edit]- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
- Note to clerk: A CU check has already been completed on Wikipedia:Sockpuppet investigations/Btw Santhosh w.r.t User:Brosscreater. Jeraxmoira🐉 (talk) 09:35, 21 April 2024 (UTC)
Clerk, CheckUser, and/or patrolling admin comments
[edit]- Closing as duplicate. Sir Sputnik (talk) 15:16, 21 April 2024 (UTC)
02 May 2024
[edit]Suspected sockpuppets
[edit]- HacktivistWasHere (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Tools: Editor interaction utility · Interaction Timeline · SPI Tools
Obvious block evasion. New SPA HacktivistWasHere created 7 April. A minute after creation, first two edits were poorly sourced puffery about Hacktivist Vanguard at IIT Bombay: [8], [9]. Third edit just now was, as usual, to add Hacktivist Vanguard to List of hacker groups, with the usual rock-bottom blog sources: [10]. Checkuser might be a good idea at this point. Wikishovel (talk) 15:47, 2 May 2024 (UTC)
Comments by other users
[edit]- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments
[edit]- Blocked without tags, leaving open in case anyone wants to check for sleepers, or verify its not a different sock. ScottishFinnishRadish (talk) 15:51, 2 May 2024 (UTC)
- CU evidence is not clear. This account can stay without tags. Close. Dreamy Jazz talk to me | my contributions 17:30, 18 May 2024 (UTC)
30 June 2024
[edit]Suspected sockpuppets
[edit]- द्वारा (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Viksheetvg (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Tools: Editor interaction utility · Interaction Timeline · SPI Tools
Brand new SPA creates as their first edit the fully-fledged Draft:Cyber Crime Break, not just on en.wiki but others as well. This CCB is apparently the latest venture of Santhosh Kumar, which obviously gets my spidey sense a-tingle. As there's not much evidence to go by, I'm asking for CU to confirm, although I realise this hasn't been entirely successful on previous checks. DoubleGrazing (talk) 09:56, 30 June 2024 (UTC)
- They've now created new article The Blaze Times, another venture in the Santhosh Kumar empire. Just mentioning it here in case it helps create connections later on, and also because there's another new account involved in editing that, Viksheetvg, whom I'm adding to this case. -- DoubleGrazing (talk) 05:28, 4 July 2024 (UTC)
Comments by other users
[edit]- Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
द्वारा has also just recreated Hacktivist Vanguard: loud quacking. Wikishovel (talk) 11:26, 1 July 2024 (UTC)
- ...and Cyber Crime Break, after the draft was declined twice. Wikishovel (talk) 14:02, 1 July 2024 (UTC)
Adding anon sock, refbombing and removal of AFD tag from Ankit Kayal after level 4 warning to creator द्वारा: [11]. Wikishovel (talk) 12:51, 11 July 2024 (UTC)
Clerk, CheckUser, and/or patrolling admin comments
[edit]- I globally locked 4 users in a sleeper check, including the first user reported. Viksheetvg is declined per this. No comment with respect to IP address(es) -- Amanda (she/her) 06:08, 28 July 2024 (UTC)
- Nothing more to do here. Closing. Vanjagenije (talk) 22:43, 14 August 2024 (UTC)