These three have in common the phrase "Seems to be not notable and without any reliable sources" (Bigneerman
[1], Dark Juliorik
[2][3][4], 不和の林檎
[5]) which had
never been used before until this week. They all follow the standard Expertwikiguy playbook of making numerous small edits with the VisualEditor and casting a large number of low-quality AfD !votes. Requesting CU to confirm and to look for others.
Extraordinary Writ (
talk)
21:40, 25 September 2022 (UTC)reply
Comment I've taken a look at these, but would appreciate it if another CU with experience of residential proxies would be willing to take a look. These accounts are all editing out of a lot of very different IP ranges. Each account uses ranges that geolocate to a particular country; some of the IP addresses they are using show as belonging to the same set of residential proxies, and they all look similar to one another in other ways.
GirthSummit (blether)18:06, 26 September 2022 (UTC)reply
The three possible users are all, without a doubt, using a VPN. They bounce all around the world geolocation-wise, and nearly all of the ranges I looked into came back positive for VPN use in reports. The user agents are mostly of the same device family, but different browsers. No IP address ranges overlapped or directly connected any of the users. The inconclusive user used one range in one geo-location, where none of the IPs used had VPN use reported. Unfortunately, that's all the information that I can give. Resetting status back to 'completed', as Behavioural evidence needs evaluation.
~Oshwah~(talk)(contribs)21:28, 2 October 2022 (UTC)reply
Some findings and requested actions:
Bigneeerman, Dark Juliorik, 不和の林檎, and Assirian cat voted keep on the
Maropost, which has been a repeated UPE target (including
Bennet43 sockfarm in a previous creation). This overlap alone is quite suspicious.
All of them do simple gnoming and AFD copypasta votes. This is a frequent behavior in a few sockfarms, including
SpareSeiko,
Sanketio31, and
Expertwikiguy.
These accounts have occasionally copypasted the same votes in different AFDs. Some also did rapid-fire AFD noms with copypasta rationales. Here's a summary table:
Based on the way edits interleaved on 2022-09-25, I think it is likely that Assirian cat and Bigneeerman are not the same person.
Based on AFD activity (table above) and CU results with respect VPNs, I think it is likely that Bigneeerman, Dark Juliorik, and 不和の林檎 are the same person.
While YouVeNeverSeenBetter looks quite similar to the others, I'm not so sure about what to make of it.
All reported accounts deviate from the expected timecard for Expertwikiguy
[33]. This is far from excluding a relation to Expertwikiguy, but in the absence of further evidence, I think we should not assume the reported accounts are Expertwikiguy.
Awaiting administrative action Based on the above analysis, I moved the case to Bigneeerman. I recommend indefing Bigneeerman, Dark Juliorik, and 不和の林檎 (supected to Bigneeerman). No action for YouVeNeverSeenBetter and Assirian cat, without prejudice of any admin willing to act on their behavior beyond a specific relation to Bigneeerman or Expertwikiguy (e.g. AFD coordination or UPE).
MarioGom (
talk)
17:41, 9 October 2022 (UTC)reply
24.138.27.215 has 11 edits on Oct 19 and no other edits since 2008. 9 of those edits are to AfDs started by Mambo Rumbo. They are all on a similar topic and, of course, this could be someone trying to seem like Mambo Rumbo. I think a CU is needed to sort this out, but I don't know the SPI rules as well as I should... A quick look showed no similar instances of this in the past.
Hobit (
talk)
19:53, 23 October 2022 (UTC)reply