Home • Search • Translate
From Wikipedia, the free encyclopedia


Lrednuas Senoroc

Lrednuas Senoroc ( talk + · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)

14 December 2015

Legitimate accounts
Suspected sockpuppet

Blocked editor has outed himself. He states at Wikipedia:Administrators'_noticeboard/IncidentArchive907#IP-jumping_editor_with_an_anti-Kurdish_bias that "I wrote articles on Banaz Mahmod..." He makes the very same claim for himself here in attempting to reverse the block on Hassan Rebell, citing this IP edit. Shawn in Montreal ( talk) 21:14, 14 December 2015 (UTC) reply

He's aware of the other user and yet referring to himself as "that user" at User_talk:Hassan_Rebell#Sockpuppet_investigation. And he's now accusing the blocking admin of having an anti-Turkish bias. It's all good. Shawn in Montreal ( talk) 21:30, 14 December 2015 (UTC) reply
Okay, he's as much as admitted on his talk page this is was a previous account. The problem, for me, was that he had never used {{unblock-un|user=your new username here|reason=your reason here}} as instructed. The accounts were not used simultaneously. However, because he was blocked for disruptive editing and because he's now edited under at least two usernames and a range of IPs, I wonder if these two accounts should not at least be tagged as duplicates? Shawn in Montreal ( talk) 21:40, 14 December 2015 (UTC) reply
The User:Heysem thing, though, would be a more bigger issue. He's been pledging every way till Sunday in that torrent of text at User talk:Hassan Rebell -- whose "Working draft (please do not edit section)" section ebbs and flows daily -- that he'll respect Wikipedia's rules, he wasn't trying to deceive anyone, etc. This would be deception and block evasion. @ PanchoS: has raised this on that talk page, stating that he doesn't feel the case is strong enough to ask for a Checkuser. Indeed, it's only a single edit and the IPs that have been editing the page previously are UK-based, whereas all of Lrednuas Senoroc‎/Hassan Rebell's IPs were Swiss based, such as the two below. Shawn in Montreal ( talk) 15:18, 17 December 2015 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • Although Hassan Rebell is currently blocked, I would like to see an SPI open to discover additional socks and possibly an IP-range block if possible. This appears to be a ongoing campaign targeting a minority ethnic group that is not likely to stop anytime soon. —Мандичка YO 😜 22:08, 14 December 2015 (UTC) reply
Indeed, he's explicitly admitted using both User:81.62.246.169 and User:81.62.24.156, to name but two. Shawn in Montreal ( talk) 22:13, 14 December 2015 (UTC) reply

Clerk, CheckUser, and/or patrolling admin comments

Let's just take a moment here. 1) there's no point pinging Hassan Rebell, he's blocked. 2) The connection between him and Lrednuas Senoroc/Lrednuas Senoroc Temp are that they are admittedly the same editor, that's not in doubt, now. If I'd understood the complex situation with this guy basically coopting someone else's ID and flipping the two backward-spelt names to basically confuse the f*ck out of everyone, creating a POV pushing mess, forced to change his username but then creating more trouble under a bunch of Swiss IPs then coming back as this Hassan Rebell, I wouldn't have started an SPI in the first place 3) The only outstanding question is whether Heysem is the blocked editor and the only "evidence" of that is a single edit of pro-Turkish POV blanking, that's all. 4) I don't know if a Checkuser is merited on that basis and I probably would not have asked for one, based just on a single edit in a hotly contested area. That's really all I can add. You may just want to shut this down. I don't know if Hassan Rebell is going to be unblocked anytime soon or ever. If he is, I've not doubt that he'll be back at ANI in short order, because he's basically here to attack a particular Kurdish editor and use Wikipedia as his own personal front in the Turk/Kurdish conflict. thank you, Shawn in Montreal ( talk) 01:58, 26 December 2015 (UTC) reply
@ Shawn in Montreal: Can you provide a diff that shows "that they are admittedly the same editor"? Vanjagenije (talk) 13:45, 26 December 2015 (UTC) reply
Oh god there's been so many. Hassan Rebell has modified his talk page so much I can't find one for you. But it's the previous account he mentions in "reasons to unblock" and as I've stated, he never used Hassan Rebell and this Lrednuas Senoroc/Lrednuas Senoroc Temp simultaneously. I think the blocking admin was as confused as me about the whole mess, but even if he was not editing using multiple accounts at the same time, there's been battlefield behaviour. I can't find you a diff where he admits to being Lrednuas Senoroc -- but not Senoroc Lrednuas, that's another editor entirely. If you really want to, you could ask Hassan Rebell that on his talk page, he's still free to edit there. He'd answer you, expressing again his outrage over being blocked. As the one who created this SPI, I can assure you it's a non-issue. Unless someone wants to run a checkuser on Heysem, this should be closed. Shawn in Montreal ( talk) 17:41, 26 December 2015 (UTC) reply

09 January 2017 (originally 30 December 2016)

Suspected sockpuppets

Per WP:DUCK. The ip ranges belong to notorious disruptive editor Lrednuas Senoroc. The last year, the user was reported on ANI by user Hegvald and his sock accounts were banned from editing. In an another ANI report, an another user highligted the problematic edits of the same ip-hopper on FGM and Kurdish women. See this. The same editor was also warned and reverted by Doug Weller. See this and talk pages of related articles. However, he continue the same disruptive edits through ip-jumping (in order not to be noticed), clear source falsifications, meatpuppeting/ canvassing (e.g. pinging other Turkish nationalist editors to "win" the discussions or to achieve intended consensus), cherry pickings, ip-sockings/proxy sockings and ongoing campaign targeting a minority ethnic group. His geolocation was Switzerland but since 25 June 2016, he has been editing from Germany 1 2.

All of their contributions focused on almost all Kurdish-related topics (specificially Kurdish women, FGM, Women in X country, Christians in Kurdish dominated areas, Kurdish mythology, history, culture, demography, revolts, human rights, diaspora Turks and Kurds, Kurdification, honor killing, Kurdish refugees, etc.)

Evidences regarding “habitual behaviors” of (old)Swiss and (current)German ip socks and sock accounts:

  • Targeting the same ethnic group with the same agenda
  • IP-jumping in order not to be noticed
  • Blaming other editors for “personal attack” when those editors notice his disruptive edits: 1, 2, 3
  • Copying the same (or partly modified) content from one article to another: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11...
  • Moving certain offensive contents/sections (which were added by him) upward to take more attentions of readers: 1, 2, 3, 4...
  • Detailed and sensational style of writing to affect readers : 1, 2, 3...
  • Often violating WP:COPYVIO and WP:RS-most of his edits were deleted by JzG and Diannaa: 1, 2, 3, 4, 5, 6, 7... (However he restores them.)
  • Disruptive editings through WP:CHERRY, WP:SNEAKY, WP:FICTREF and source falsifications. The last example was mentioned here. To see the previous “Swiss” ips’ violations, please check the related articles’ talk pages, revision histories and/or related ANI reports. 
  • Being familiar with Wikipedia terminology, procedure, templates etc. : 1, 2, 3, 4, 5,
  • Disruptive tagging-unnecesary merging  and/or deleting the articles, probably because he does not like their “content”: 1, 2, 3, 4, 5, 6. For more diffs, see the contribs of his sock account Hassan Rebell
  • Canvassing and meatpuppetry: 1, 2, 3...
  • Impersonating veteran editors by choosing similar usernames : 1, 2, 3, 4
  • Using proxies and ipv6s, when his physical ips are disclosed or become “notorious: 1, 2, 3, 4
  • Stalking contribs of particular editors and often edit-warring with them (eg. Ferakp and Vekoler)
  • Restoring his previous socks’ edits: 1, 2

Compare Swiss ipv4s of Lrednuas Senoroc and the German ipv4s on Kurdish women: 1, 2, 3 and 1, 2; on Honor killing: 1, 2, 3, 4, 5 and 1; on Human rights in post-invasion Iraq, Syria etc.: 1, 2 and 2, 3, 4, 5; on Kurdification: 1, 2, 3, 4. He also used ipv6s (from Germany). See: 1, 2 and compare them with 1, 2 Regarding Kurdish population in Turkey, see 1, 2.

On the other hand, just like his older socks, the German ips are active on Christianity in Kurdish-dominated area-related articles (wishing to emphasize Kurdish "savagism" against Christians and de-emphasizing Ottoman role in Assyrian and Armenian genocides through putting emphasis on attacks of Kurdish tribes), on the articles of Kurdish and Turkish diaspora (trying to prove that most of "immigrant" Turks are actually Kurds and associating them with honor killings, crime, etc). Totally the same agenda with confirmed ip socks of the same editor.

Besides, there is an obvious sockpuppetry through proxies. Compare this addition by ip 87.189.xx and this by an ip from the US.

An another proxy sock of Lrednuas Senoroc, 81.253.60.172, have complained about an editor  whose contribs are often stalked by the same sockmaster 1 The previous Swiss and current German ips of the sockmaster also edited "History of Kurds" and related articles before-seems those topics are within his are of interest too: 1, 2. Further, the ip from “France” weirdly complained about additional issues which are clearly off-topic  but the pet topics of the sockmaster Lrednuas Senoroc.  Namely women rights, Christianity, anti-Turkism, etc. Interestingly, Hassan Rebell/ Lrednuas Senoroc  also accused an another editor, who was also stalked by him, as being : “anti-Turkish”, “anti-women”, “anti-Iranian” etc., last year. It’s exactly, almost word by word,  the same accusations with the “French” ip’s. Plus, the “French” ip accused the editor as “nationalist”, “meatpuppet” as ip sock of the same sockmaster did while he was arguing with user:Doug Weller on his talk page and provided exactly the same link/diff to prove his "righteousness": 1, 2. Again, clear WP:DUCK case through abusing various proxies. 

In a nutshell, clear WP:DUCK case with WP:NOTHERE, WP:DISRUPT, WP:SOCK through using various ipv4s, ipv6s, proxies and accounts. A range block for his current German ip ranges(87.189.xx/88.128.xx/81.92.xx) and ipv6s would be useful to prevent wikipedia further disruption by the same ip-jumping editor. It is a serious problem, since he also targeted "indefinite protected" articles too. See: this request on user Beeblebrox's talk page. Also, mind that this guy intentionally switches his ip in order not to be noticed. See his last edits: 1 and 2. Ip sock 87.189.xx made his last edit on 20.01 and just a few minutes later ip 88.128.xx edited an another article. Also see: this and this. Again, ip sock 87.189.xx made his last edit at 19.51 and after a few minutes ago, ip 88.128.xx copied the same content an another article. 46.221.216.243 ( talk) 00:08, 30 December 2016 (UTC) reply

@ Materialscientist:, @ Doug Weller:, @ Favonian:, @ DoRD: please take a look at this case. The user might be a "paid editor", since most of his edits requires a large amounts of time and even the most active users do not spend such a time on the internet/wikipedia. Plus, his "knowledge" regarding Wikipedia terminology is also makes my doubts possible. 46.221.173.105 ( talk) 05:54, 30 December 2016 (UTC) reply

I have added two socks to the list. The “new”  account Nilgravity was created after his ip ranges were revealed on this SPI case.  The account’s suspicious acts are:

  • Adding the same/similar content with previous ip socks in Kurdish or Christianity-related articles: 1, 2. For the similar/same additions of ip socks, please see the revision history of Christianity in Iraq, Persecution of Christians, Iraqi-Assyrians, etc.
  • Moving the preferred section/content (that was added by him) upward probably to take more attention of the readers : 1, 2, 3, 4

I have added Kinetsubuffalo to the list too. I know the account is stale but it should be tagged as “suspected sock” at least per WP:DUCK.

  • The file regarding FGM in Iraq was uploaded by user:Kinetsubuffalo on 17 April 2016 on Commons and  just a few hours later, the same map added an article by notorious “Swiss” ip (those Swiss ips are confirmed ip socks of Lrednuas Senoroc, he admitted it. See previous case). See: this.
  • The same user created new pages, namely “Rape in Kurdistan”, “FGM in Kurdistan”, etc. and redirected them to certain articles articles which were edited by the previous Swiss ip socks of Lrednuas Senoroc before.
  • Additionally, the account’s user name is very similar to user user:Kintetsubuffalo.  Please note that, his previous sock account’s user name (Lrednuas Senoroc) is also very similar to veteran editor user:Srednuas Lenoroc’s. I think that vandal “intentionally” chooses those nicknames in order to confuse other editors. Please see previous case. 46.221.181.223 ( talk) 08:35, 21 January 2017 (UTC) reply
  • Note: I'm just re-filing this (I am not 46.221) to fix a previous misfiled report. No comment one way or another, I have not actually read the above beyond half-awake skimming for any obvious problems. Ian.thomson ( talk) 02:16, 9 January 2017 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I've just been pinged about this. One of the above mentioned IP's ( 87.189.128.42) edited Genocide exactly like described and was reverted by User:Doug Weller for attacking Kurds. Same edits were added back later by these IPs, please check them too:

-- 92slim ( talk) 11:09, 11 January 2017 (UTC) reply

Argentina? It seems that an another case of proxy socking by the same editor or an off-wiki organization? No idea but I have noticed many proxies abusing by the same disruptive editor (Romania, the US, the UK...) I'll add them when have a time. 46.221.213.142 ( talk) 11:21, 11 January 2017 (UTC) reply
Yes, either that or Argentinian proxies are popular. I am not sure. -- 92slim ( talk) 12:07, 11 January 2017 (UTC) reply

Despite he has been continuing his disruptive edits for at least 1-2 years, it is hard to notice all of the disruption, since he is an ip-jumping editor.  Also it is hard to check all the sources in order to see if he falsified the sources. Nevertheless, I have noticed so many falsifications by this vandal and his proxies. For example, see: 1, 2, 3, 4. The sources are about ISIS’s human right abuses but it “changed” by a proxy (most probably belong to the same editor) and when an another editor reverted it, the ipv4 of Lrednuas Senoroc/Heysem/Hassan Rebell restored it. It reminds me this and this. And here, the sources are actually about "total" number of Kurds living in Germany but the user showed it as the number of "Turkish Kurds" to push his agenda I have mentioned above. Moreover, he made an another source falsification here. (The sources are about Iraq and have nothing to do with Syria. Those are the current disruptive edits by ip socks of Lrednuas Senoroc. God knows, how many falsifications, cherry pickings, etc. were done by the same editor!

Plus, most probably, Ultimate Destiny ( talk · contribs) is master of all the socks. Many of the editor's additions were copied by the ip socks. Also, it seems that they interested in the similar topics. The IPS that I have mentioned above and previous confirmed Swiss ip socks of Lrednuas Senoroc seem professional as user Hegvald mentioned on his ANI report regarding the same user. Thus, it makes this old user more suspicious. However, i did not add him the list, since the account is very stale. But, i think it may be tagged as "suspected sock". 46.221.213.148 ( talk) 11:03, 18 January 2017 (UTC) reply

It has been almost 1 months now. It would be good, if checkusers or admins block that long-term vandal. 'Cause it seems that he is back with various proxies 1 involved in suspicious taggings regarding "certain" informations. An ipv6 from Germany (like the sockmaster) also made suspicious edits on an another article. 2.Stalking, suspicious edits and geolocation: all resembling me the same sockmaster again. It would be an appropriate action, if admins/checkusers pay attention to those suspicious anon editors too. 46.221.171.152 ( talk) 13:10, 5 February 2017 (UTC) reply

@ Vanjagenije:, I'm strictly against it. There are strong evidences that banned Kinetsubuffalo is sock of Lrednuas Senoroc/ Hassan Rebell. Stardust al is also most probably sock of the same editor-editing the same articles (mostly unpopular on WP but pet topics of the sockmaster) with same sytle, with the same agenda- So, I request a hard block for him, instead of "soft block". 46.221.180.211 ( talk) 04:10, 18 February 2017 (UTC) reply

"And there is no evidences the user used different IPS to make it as if there were several people." No, I am not agree with that too. He has been using several proxies, as I shown above. 46.221.180.211 ( talk) 04:26, 18 February 2017 (UTC) reply

@ Vanjagenije:, user:Kinetsubuffalo was blocked for impersonating user:Kintetsubuffalo, not for socking. As for IPS, it seems the sockmaster abandoned them about 1,5 months ago. He has been using various proxies now. Plus, it seems to me that, impersonating other editors is the "tactic" of this sockmaster: When his disruptive/suspicious accounts are noticed, they are first blocked for impersonating other editors, before blocked for socking or disruptive editing. And thereby, they become "soft-blocked", instead of "hard-blocked" For example, exactly the same problem has occured in this case too (Kinetsubuffalo). Plus, he uses this situation as an excuse. 46.221.161.190 ( talk) 11:16, 18 February 2017 (UTC) reply

@ Vanjagenije:, OK, I will not insist on not to close this case, I do not want to wait another month to get the feedback. But I just have a question: Couldn't you simply block Kinetsubuffalo and proxy socks 81.253* , 80.153* per WP:DUCK please? I know the first one was already blocked but the block reason could be change, i think. And, again, I request a hard-block for him, since he abused multiple accounts, proxies and involved in disruptive edits. Thanks. 46.221.204.47 ( talk) 09:57, 19 February 2017 (UTC) reply

We don't block IPs that did not edit in the last several days. That is because dynamic IPs might be resigned to different person in the meantime. None of those IPs edited in the last 7 days, and there are just 4 edits this whole month. Kinetsubuffalo is already blocked, and there is no point in blocking already blocked account. The purpose of WP:SPI is to stop ongoing disruption, not to play detectives. If the account is blocked, there is no ongoing disruption. Vanjagenije (talk) 22:20, 22 February 2017 (UTC) reply

Clerk, CheckUser, and/or patrolling admin comments

I've blocked User:Kinetsubuffalo as an impersonation of User:Kintetsubuffalo. RickinBaltimore ( talk) 20:24, 9 February 2017 (UTC) reply
I read all this and I think there is nothing here for the SPI team. It looks like all those IPs belong to the same person, probably Lrednuas Senoroc. But, I'm not sure it constitutes socking. Lrednuas Senoroc is just "soft blocked" which means he is allowed to edit. And there is no evidence the user used different IPs to make it as if there were several people. If there is vandalism or disruptive editing, the ranges may need to be blocked, but that's not the job for SPI. Regarding those registered account, one is also soft blocked now, and I don't see any strong evidence against other two. I'm closing this. If disruption needs attention, it may be addressed throu other channels (like WP:ANI). Vanjagenije (talk) 23:42, 17 February 2017 (UTC) reply
But, there is not much we can do here. Kinetsubuffalo is already blocked and Hassan Rebell has not edited in years. I can only make this case  Clerk endorsed and ask Ckecusers whether it is possible to block those IP ranges for some time? The MediaWiki:Gadget-contribsrange.js gadget does not allow me to see contributions from /20 and /24 ranges. Vanjagenije (talk) 09:58, 18 February 2017 (UTC) reply
(I'm guessing that you're referring to the collapsed ranges listed above.) Nobody has used the /20 since January 2. There shouldn't be any problem seeing contribs from /28 or /24 ranges with the the tool, and the /23 can be broken into two /24s ( 88.128.80.0/24 and 88.128.81.0/24) for range contribs purposes. If I'm to do any further checks, I'll want a concise summary of the case. ​— DoRD ( talk)​ 14:40, 22 February 2017 (UTC) reply
Thanks, I should have thought about that. There are only 4 edits from the /23 range in this month, and none in the last several days. The /28 range has no edits since December. Kinetsubuffalo is already blocked, and evidence against other two accounts is too weak. I'm (re-)closing this. Vanjagenije (talk) 22:20, 22 February 2017 (UTC) reply

16 February 2017

Suspected sockpuppets

The name alone makes it obvious that this is the same person. Sir Sputnik ( talk) 15:02, 16 February 2017 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

@ Sir Sputnik:, it was discussed here and as @ Blackmane: and @ Cordless Larry: mentioned, Lrednuas Senoroc was just impersonating user user:Srednuas Lenoroc. "Impersonating veteran editors" is one of the habitual behavior of this vandal. Please read the SPI case above. His another sock account Kinetsubuffalo was also blocked by the admin for impersonating Kintetsubuffalo. However, i don't think that user:Srednaus Lenoroc is related to this SPI case, IF it is the new account of user:Srednuas Lenoroc. 46.221.167.95 ( talk) 20:27, 16 February 2017 (UTC) reply

Yep, there is no doubt that Srednuas Lenoroc ( talk · contribs · deleted contribs · logs · filter log · block user · block log) and Srednaus Lenoroc ( talk · contribs · deleted contribs · logs · filter log · block user · block log) are the same person but I doubt that they are related to this SPI. Nthep ( talk) 17:26, 16 February 2017 (UTC) reply

Oh, no. Another conspiracy? We have two SL's and the latest one is trying to pass himself off. Unfortunately, there is no attempt to pass off anyone as any other person here at WP. There is this thing called a computer, They function very conveniently especially when you set it up so that you do not have to supply the usual log in information. Unfortunately, when the programmed computer no longer functions and you are unable to log back in you have to carry on and work with the system. Voila, I put in the user name I previously used and WP accepted it. Is that a conspiracy? They have medications for that syndrome and I prefer to leave conspiracies to others. Or is my editing someone a threat to the endurance of WP? Growing up, in the neighbourhood there was a fellow that as long as he could direct how everyone played everything in his mind was okay--well, really perfect. Unfortunately, for him he became what we had yet to learn what it was called--annoying. Use your time for your own entertainment but leave me out. I am not here poisoning the towns water well. Srednaus Lenoroc ( talk) 19:50, 16 February 2017 (UTC) reply

Please see my comments above, Srednaus Lenoroc. I suggested that you created a new account, not that you were trying to pass yourself off as someone else. However, you did not "put in the user name I previously used" - there's a slight spelling difference, which is why the new account could be created. As long as you don't use both accounts, I don't see a problem though. Cordless Larry ( talk) 19:55, 16 February 2017 (UTC) reply
@ Cordless Larry:, actually I do see a problem, if Sradnuas Lenoroc is not the new account of Srednuas Lenoroc. A new, separate user with very similar user name, the same (minor) editing style, and even the same edit summaries e.g. "sp", "style", etc. Weird. It has nothing to do with being "conspirational". 46.221.164.49 ( talk) 21:05, 16 February 2017 (UTC) reply
If "Srednaus" is a new account of "Srednuas" because of a forgotten password or something, that should be flagged on both of their user pages. Wouldn't it save some confusion to rename this SPI (even just to a placeholder), if it was started as a result of impersonation of an unrelated third party? -- McGeddon ( talk) 20:11, 16 February 2017 (UTC) reply

If that will qual your conspiratorial stance then by all means do what it is that you said should be done and just leave me be. Is that possible or do we have a situation that if I do not play according to how your preferred perceived way then I cannot play? I just noticed that someone names Sir Sputnik somehow comes up when I click on the colored buttons. It is rather funny that although he is a declared anti-monarchist he does use a term of ennobleism. I think you must have me confused with others that you have encountered because I do not recognize any other name that has been brought up. There is no conspiracy to be uncovered--well at least not with me. Now if you are insinuating trump into this situation then we very well may have something since he like Nixon is very much a bully and look at what happened to him. Do not go looking for trouble where it does not exits. The East Germans clearly should have learned that while under the Soviet sphere. I have plenty on my hands just understanding weltenshuaang, Toynbee and bots. Anonymity has its benefits. I hope it does not blow out into a full conspiratorial level as in the movie Capsule. — Preceding unsigned comment added by Srednaus Lenoroc ( talk • contribs) 20:22, 16 February 2017 (UTC) reply

Srednaus Lenoroc, please do not accuse other editors of being conspiratorial when all they are doing is trying to demonstrate that you are innocent of the sockpuppetry accusations that have been made against you. Cordless Larry ( talk) 20:34, 16 February 2017 (UTC) reply

Oh, here is where you wtote tht. Well, there does seem to be a tendency of reacting to things as if someone butcher has just left the cooler door open and the house pets have just discovered. But I guess that can just be another sign that someone has invested so much of their personality into WP. Srednaus Lenoroc ( talk) 21:11, 16 February 2017 (UTC) reply

Sigh...@ Srednaus Lenoroc:, "please" answer this simple question: Are you Srednuas Senoroc and this is your new account, or are you a "new" separate editor whose user name, editing style and even edit summaries very similar to user Srednuas Lenoroc? 46.221.164.49 ( talk) 21:19, 16 February 2017 (UTC) reply

Actually, I don't think that these two really extraordinary names can be a coincidence in any way, especially looking at the simply switched first letters. If you read Srednuas Lenoroc from the right to the left, you get "Coronel Saunders". The other two most likely only impersonate him and don't sound similiar just because of a coincidence.-- Ermanarich ( talk) 22:21, 16 February 2017 (UTC) reply

Yeah, what a coincidence... Even their edit patterns, styles and edit summaries are identical. I agree with you, it's simply an impersonation case, nothing more. And probably the same sockmaster. 46.221.164.49 ( talk) 23:09, 16 February 2017 (UTC) reply

.--Ermanarich you are correct about not thinking. Yes there is a coincidence that these two extraordinary names exist. I established mine and then the other person decided to vex you by starting chatter on the other. WE ARE NOT THE SAME PERSON DESPITE YOUR PARANOIA. Every time there is the subject of the other user being a sock puppet there comes along some new idito at WP saying that it is not by coincidence blah blah blah. Well, the latter is. STOP. Leave me out of this. Srednaus Lenoroc ( talk) 22:53, 16 February 2017 (UTC) reply

I edit conflicted with Srednaus Lenoroc. I was going to say that the rather uppity syntax between the two is too similar for one to be an impersonator of the other. But the most that EC'd with mine plus the editing style puts to rest my doubts that they are the same person. Srednuas Lenoroc stopped editing last July and it would not be unreasonable to presume that they've lost their password to their original account and created a new one. The editing style is also quite similar between the two. Very large numbers of gnomish spelling and grammatical corrections with no specific area of interest. I'd be inclined to leave this as a case of a new account created because of a forgotten password and ask that the two accounts be linked in some way. The impostor account that was blocked back in 2015 focused more or less exclusively on Kurd related topics. Also, @ Srednaus Lenoroc:, for fuck's sake untwist your panties. Given that there was previous a case where someone impersonated you, editors here are trying to determine that this is not happening again. People are trying to help you, not get you blocked. So get your head out of your arse and appreciate the effort that some will go to to ensure those who are not familiar with the detective side of WP are unduly affected. Blackmane ( talk) 23:09, 16 February 2017 (UTC) reply

@ Blackmane:, Srednaus Lenoroc did not admit that he is Srednuas Lenoroc. On the contrary, he claims that it is just a "coincidence" and blaming others as being "conspirational". That is the reason why we think that it is an impersonation case. 46.221.164.49 ( talk) 23:19, 16 February 2017 (UTC) reply

I think that they perhaps misunderstood and are denying that they are Lrednuas Senoroc. Certainly, their combative attitude towards people who try to help them is reminiscent of Srednuas Lenoroc and rather unique. Cordless Larry ( talk) 23:22, 16 February 2017 (UTC) reply
@ Cordless Larry:, i don't think so. My question was so simple. I asked him/her whether he/she is Srednuas Lenoroc or a separate user. And as I said above, I do not think that user Srednaus Lenoroc is related to this SPI case, IF it is a new account of user Srednuas Lenoroc. However, he STILL didn't admit that he is Srednuas Lenoroc, despite he knows that it will help him. The reason is simple: Because he is not Srednuas Lenoroc, but a seperate editor impersonating him. 46.221.164.49 ( talk) 23:31, 16 February 2017 (UTC) reply
@ 46.221.164.49: Unless we've got a very good impersonator, this looks to be quite a WP:DUCK case. I don't really see that a CU would be necessary here, but would not be opposed to one being run. Blackmane ( talk) 00:05, 17 February 2017 (UTC) reply

46.221.164.49 Einstein. Send me a message to my email then you can find out who is playing stupid. Srednaus Lenoroc ( talk) 00:07, 17 February 2017 (UTC) reply

Sigh...Will you answer the damn question? If not, then do not waste my and other editors' time anymore. 46.221.164.49 ( talk) 00:23, 17 February 2017 (UTC) reply

Lets simplify; Srednaus Lenoroc are you Srednuas Lenoroc, or not. Yes or no. That is all that is being asked of you. Mr rnddude ( talk) 08:00, 17 February 2017 (UTC) reply

@ Mr rnddude:, he said that it is a coincidence. In other words, he asserted that he is not Srednuas Lenoroc, but a seperate editor. 46.221.172.216 ( talk) 08:10, 17 February 2017 (UTC) reply

That has already been explained and was met with another accusation of being a sock puppet. How idiotic must this situation get when upon accusation upon accusation is levied to discount that explanation. How stupid do you think I am to believe that after a witch hunt this situation is going to change when the sharks have smelled blood and have nothing better than yo throw more mud into the fan. It would seem that there are a few people in WP that need to undertake a lesson on perspective in their proceedings. Now I suppose you all will be upset with that being said and then sanction based on that. Give yourself a break and just go away. For being people of such intellect you seem to be reacting in such a childish manner. It reminds me of school arguments where the person with the presumed highest following levies an accusation and all of a sudden everyone comes forward with stories about how to support that view instead of truly understanding the situation. Just leave me alone. or cannot all you understand that? Srednaus Lenoroc ( talk) 08:36, 17 February 2017 (UTC) reply

I'll give you a second opportunity to answer the question. I don't care about all of the back and forth above. It would serve you to answer the question. All I care about is a two or three byte simple answer; yes or no. Don't give me an explanation, don't tell me about all the peripheral junk of no consequence, don't waste your time writing a long form response, just save yourself the time and please answer the question. For accessibility, my question is; Are you Srednuas Lenoroc, or not. I don't care about anything else, I don't care about the SPI or the AN/I case or anything else. Just that; one word. Mr rnddude ( talk) 10:13, 17 February 2017 (UTC) reply
@ Cyphoidbomb:, @ Vanjagenije:, user Srednaus Lenoroc was already blocked now. Lrednuas Senoroc is just a seperate vandal and ip-socker impersonating other editors and has nothing to do with Srednuas Lenoroc. As for Srednaus Lenoroc, I agree with Cyphoidbomb, he is a disruptive editor trolling on WP. 46.221.194.163 ( talk) 17:12, 17 February 2017 (UTC) reply
This was the most spectacular waste of volunteer time. All they had to do was 1. acknowledge that our presumption they had forgotten their password was correct and 2. that this was a new account 3. link the two accounts and that would have been that. Instead all we got was waffle, waffle and more waffle. Blackmane ( talk) 06:16, 18 February 2017 (UTC) reply

Clerk, CheckUser, and/or patrolling admin comments

  •  Clerk assistance requested: - I haven't gone through all of the accounts, but Lrednuas Senoroc was created 28 November 2015, whereas Srednuas Lenoroc was created 3 May 2015, so of the two, Srednuas Lenoroc is the earlier account. Probably not surprising, since Srednuas Lenoroc is Coronel Saunders backward and the other accounts seem derivative, like Coronel Suanders (Srednaus Lenoroc) and Corones Saunderl (Lrednuas Senoroc). Some sort of play on Colonel Sanders? Based on talk page discussions here, and some of the other missives the user has written, I don't get the sense that they are here to be constructive. Many of their responses just come off as pseudo-psychoanalytical trolling. Further, based on many of the edits that came out of the Srednaus Lenoroc account, I got the impression that they were using some form of unapproved bot, an impression that WikiDan61 also had. For me, the close proximity of edits with one another along with a string of blank edit requests here made it seem very likely. Why would the user initiate three edit requests without any content, and then consciously save each one to the talk pgae? WikiDan queried Srednaus about the mechanical editing, but Srednaus denied it, then danced around the matter using circuitous language. Frankly, I have strong concerns about the user's ability to communicate effectively here, as well as their competence. For instance, they've initiated discussions on user pages numerous times. [1] [2] [3], then there are edits like this, where he refers to a football team as the Venezuela national team, instead of Venezuelan. And if it's true that they are not using a bot, the three blank edit summaries are weird decisions for a competent good-faith editor to make. Anyhow, I'm not certain they're here to be constructive, so the multiple accounts are very likely a violation of our sockpuppetry policy. I'll defer to another admin on this though. Cyphoidbomb ( talk) 16:17, 17 February 2017 (UTC) reply
@ Cyphoidbomb: What do you need clerk's assistance for? Vanjagenije (talk) 17:07, 17 February 2017 (UTC) reply
@ Vanjagenije: Shouldn't this be filed under Srednuas Lenoroc since that user was indeffed today for abusing multiple accounts and since that's the older account? I'm a little confused, since some people are saying that this most recent flare-up is a disruptive user impersonating Srednuas Lenoroc. If that's the case, then I could see why we wouldn't file this under the older account, but I'd be more comfortable all-around if a CU looked at this and figured out what was going on. I'm not sure why the other editors here are convinced it's just an impostor, but if that's the case, an innocent user may have been indeffed. If you think the clerk assistance is not required, so be it. Anyhow, I don't have much time to deal with this. IRL obligations. Cyphoidbomb ( talk) 20:31, 17 February 2017 (UTC) reply
  • Srednuas Lenoroc was a wikignome who joined in early 2015 and stopped editing in 2016;
  • Lrednuas Senoroc was a sockmaster deliberately mimicking the username in late 2015;
  • Srednaus Lenoroc claims to be the original wikignome creating a new account last week after being unable to recover the first account's password.
Both the first and third accounts have been doing exactly the same kind of typo gnoming and well-meaning-but-ungrammatical search-and-replace copyediting across dozens of articles at a time. The second just edited a handful of Turkish articles and AfDs.
I'm not sure why the first editor has been flagged as being blocked for "abusing multiple accounts" - the blocking editor seemed happy to take it as a procedural block over a forgotten password at User_talk:Srednaus_Lenoroc#Blocked. The third of these users was indef blocked earlier today for being bizarrely recalcitrant when asked to confirm whether they were also the first user (this was downgraded to a 48h block after we got an answer of "yes") - but this doesn't seem like it means anything sinister, as both the first and third users have been bizarrely recalcitrant in pretty much all their interactions with other editors since 2015. -- McGeddon ( talk) 21:50, 17 February 2017 (UTC) reply
Thanks, McGeddon. I'm closing this with no action. Vanjagenije (talk) 23:02, 17 February 2017 (UTC) reply

09 March 2017

Suspected sockpuppets

The account was created in 2008. There was only one minor contrib within 9 years. On 24 February 2017, the account, abrubtly, began to edit Banaz Mahmod (the sockmaster's pet topic) and edited the "External links" section, as ip socks of the sockmaster frequently did on various articles 1 2 3 4 5 6 7 8 9. The article is not popular on WP and is rarely edited by other users. However, it's a pet topic of Hassan Rebell/Lrednuas Senoroc and was created by his confirmed Swiss ip sock 1. The sockmaster probably preferred to use this sleeper sock, since his IPS are exposed on the SPI. Regarding IPS, see 1 2 3 4. More detailed information was provided relating to the ip socks on 09 January case. Please compare this account with current ip socks from Germany as well as other ips and suspected socks that were mentioned on 09 January 2017 case. 46.221.167.58 ( talk) 15:12, 9 March 2017 (UTC) reply

Add-on: Hassan Rebell/Lrednuas Senoroc registered in 2015, however, as the admin said on the ANI, his familiarity with Wikipedia terminology, WP:TLAs, etc. makes it plain that he is not actually a new user. Thus, it makes Antonyfrb-registered in 2008- more suspicious. 46.221.177.91 ( talk) 17:32, 10 March 2017 (UTC) reply

Update: The ipv6 from Germany(again) edited the same (unpopular) article 1 and seems that the same ip range with previous ipv6 socks of Hassan Rebell/Lrednuas Senoroc 2 3. 46.221.220.128 ( talk) 00:06, 14 March 2017 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims. "Antonyfrb has done nothing to suggest familiarity with Wikipedia". I was talking about the familiarity of Hassan Rebell/Lrednuas Senoroc and his "plenty of" ips. All those suggest that he is not a new editor-other editors also agree with that. Thus, this "old" account registered in 2008 might have been his sleeper due to the suspicions i mentioned above. Though i still think that Antonyfrb is likely a sleeper sock, i admit that i couldnt provide enough evidence, since he has only a few edits. So there isn't anything i can add. 46.221.197.194 ( talk) 14:03, 14 March 2017 (UTC) reply

Clerk, CheckUser, and/or patrolling admin comments

  •  Clerk note: a long-idle user adding an external link is compared to IPs previously linked to the case adding different external links to different articles: that's practically nothing to go on at all. The IPs are  Stale, and Antonyfrb has done nothing to suggest familiarity with Wikipedia, quite the opposite actually. Closing with no action. Ivanvector ( Talk/ Edits) 13:36, 14 March 2017 (UTC) reply

10 May 2017

Suspected sockpuppets

  • The account was created after the sockmaster's various ip socks were exposed on the SPI case [4] and all of his edits are exclusively about the same ethnic minority like Lrednuas Senoroc/Hassan Rebell's edits.
  • In his first edit, he highlighted the nomadicity of Kurds in his edit summary [5] and interestingly, only a few days later, ip sock of Lrednuas Senoroc/Hassan Rebell also underlined the same issue on RSN [6]. (for more info, see 09 January case)
  • Like Lrednuas Senoroc/Hassan Rebell [65] [66] [67] [68], the suspected sock also uses the small "-" as a link between sentences [69]
  • Regarding ip sock 91.61.203.181; the same ISP, the same geolocation, the same articles/targets, the same manner, the same agenda with Lrednuas Senoroc.

Info regarding Lrednuas Senoroc/Hassan Rebell/Heysem/Kintetsuboffalo's ip socks based on previous cases:

  • Geolocation: "Mainly" North Rhine Westphalia, Germany (also previously Switzerland)
  • ISP: Unitymedia(probably home isp), Deutsche Telecom

So, it seems that the anon is technically and behaviorally belongs the same sockpuppeteer. More info regarding the ip sock was provided here [70].

  • Regarding likely proxy sock 76.169.240.143; Both the suspected sock account and the likely proxy sock ip were re-activated after a long time (months after their last edits) within the same time period: [71] [72]. 
  • The ip’s targeted articles, manner and agenda is identical with the sockmaster’s.  E.g. editing the articles that are mostly on Kurdish-Turkish conflict, involved in disruptive editing and inserting the word “Kurdish terrorism” [73] [74] like LS [75] [76]. The article Kurdish terrorism was created by the sockmaster Lrednuas Senoroc as mentioned on the AfD page and was deleted last year. See the comments of the sockmaster on the AfD [77]. So, the ip's edits shows parallelity with the edits of the sockmaster.
  • Plus, it was proved with plenty of diffs that the sockmaster used various ips/proxies from different geolocations , e.g. from France, the UK, etc. [78] [79] [80] [81] [82]. For more detailed information, see the 9 January 2017 case.  So, taking into account all of these, the ip seems highly suspicious and likely belongs to the same sockmaster.
  • I am adding this report down to the report regarding likely proxy sock 76.169.240.143, since the provided info is also related to this case. An another “new” user, Supreme Dragon, created a category called “Terrorist symbolism” on commons and despite there are other groups’ flags in the same category (please note that, Lrednuas Senoroc  added a few attacks by Turkish security forces  to the article ”Kurdish terrorism”, for creating a “fake balance”), the user, weirdly,  filled the category with the symbols of Kurdish militant organisations, even added the same flag 3 times to the same category.  Moreover, official KRG flag was also added to the category of “terrorist symbolism” [83]. The same user continued the same problematic edits in an another article through a clear source falsification [84]. Also, in commons, after he created the template:Terrorist symbolism, he first added Kurdistan Workers' Party to the template, before adding any other terror groups [85] As I mentioned above, the sockmaster Lrednuas Senoroc  tried to associate Kurds with terrorism many times in the past and this suspected sock’s edits and “tricks” (e.g. “fake balance” and source falsification) are resembling the same sockmaster. By the way, it seems that the suspected sock is interested in Soviet-communism related articles [86] [87] [88] [89] like suspected sock Heysem as PanchoS explained here [90]. Furthermore, despite the account was registered only a few months ago, the user is very familiar with the wikipedia terminology, like Lrednuas Senoroc [91] [92] [93]. Therefore, because of the reasons I mentioned above, the user seems very suspicious and should be checked.
  • Regarding likely proxy sock 69.175.34.159; Dubious deletions on Kave [94]. The article is within the category of “Kurdish mythology” [95] which is one of the main targets of the sockmaster(see previous cases). Plus, the ip is from a Hosting Provider, i.e. a confirmed proxy, making the anon even more questionable. 

I added a new suspected sock, Elmira91, to the list for obvious reasons:

  • A newly created SPA, Elmira91, is engaged in the same forms of disruptive editing on Kurd-related articles. Elmira91 abrubtly began to edit with blanking the articles that are exclusively about Kurdish-populated regions by redirecting them irrevelant articles [120] [121] [122] and removed their links from the other articles [123]. The SPA’s editing pattern, manner, purpose/agenda are resembling the same sockmaster and should be checked.

For the avoidance of doubt, please compare the suspected socks with each others and please don't forget to consider the sockmaster's physical location that i have mentioned above. 176.126.68.77 ( talk) 09:50, 19 May 2017 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Based on the diffs here [124] and suspicions of user:PanchoS here [125], can we tag user:Heysem as suspected sock of Lrednuas Senoroc? Please note that, the sockmaster did not reject the accusations regarding block evading sock Heysem while he strictly rejected the accusations regarding the ip 86.165.11.32. 176.126.68.77 ( talk) 14:44, 18 May 2017 (UTC) reply

@ Doug Weller:, please note that, the sockmaster used various ips that were from different locations before. For example; this ip is from France, this one is from Germany and this is the comment of the sockmaster Lrednuas Senoroc/Hassan Rebell. Those 3 (the 2 ips and the account) obviously belong to the same person but from different geolocations. For more detailed info regarding ips, see the 09 January 2017 case. What i am trying to say is that, maybe those 2 accounts are not technically connected but this info alone doesn't prove so much thing. Maybe other checkusers wanna check/review this case too: @ Materialscientist:@ DoRD:@ DeltaQuad: 103.200.5.137 ( talk) 14:14, 31 May 2017 (UTC) reply

@ Doug Weller:I think your comment here is a bit irrelevant with what I asked you on your talk page [126]. I asked you whether geolocations of those suspected accounts match with main geolocation of the ip socks of LS, i.e. Germany.  And  I still wonder.

As for the comment by @ Vanjagenije:, it was just a superficial assessment ignoring WP:SCRUTINY which is also WP:SOCKPUPPETRY.  Regarding this, I’ll come with relevant diffs and more detailed information about the impersonator/sockmaster to illustrate this long-term vandalism and sockpuppetry (mostly through avoiding scrutiny). Because I realised that I did not provide enough diffs to demonstrate it.  176.126.71.112 ( talk) 17:34, 9 June 2017 (UTC)  reply

Clerk, CheckUser, and/or patrolling admin comments

CU does not connect the three accounts. However, Elmira91 is confirmed as identical to two newer editors, Zana.ardalan1 ( talk · contribs) and Kohnelahijan9it ( talk · contribs) and all 3 will be  Blocked and tagged in a minute. Doug Weller talk 13:02, 31 May 2017 (UTC) reply

I'll try to revisit this later in the week. Doug Weller talk 19:12, 6 June 2017 (UTC) reply
I've looked at the January case now, and can only repeat what User:Vanjagenije said: "I read all this and I think there is nothing here for the SPI team. It looks like all those IPs belong to the same person, probably Lrednuas Senoroc. But, I'm not sure it constitutes socking. Lrednuas Senoroc is just "soft blocked" which means he is allowed to edit. And there is no evidence the user used different IPs to make it as if there were several people. If there is vandalism or disruptive editing, the ranges may need to be blocked, but that's not the job for SPI. Regarding those registered account, one is also soft blocked now, and I don't see any strong evidence against other two. I'm closing this. If disruption needs attention, it may be addressed throu other channels (like WP:ANI). Vanjagenije (talk) 11:42 pm, 17 February 2017, Friday (3 months, 21 days ago) (UTC+0)" Sorry about that. And one edit isn't really enough to tag an account as a sock without CU confirmation, which we don't have. Doug Weller talk 16:02, 9 June 2017 (UTC) reply
I'm sorry to say that I can't find anything that would make me feel I can identify any of these accounts with the sockmaster, and certainly the geolocation information suggests otherwise. Time to close this. Doug Weller talk 14:49, 17 June 2017 (UTC) reply

 Clerk note: it appears that Doug Weller ( talk · contribs) intended to close this on 17 June (see directly above) but did not change the status. I have done that now. No comment on the case. Ivanvector ( Talk/ Edits) 12:42, 27 June 2017 (UTC) reply

14 September 2017

Suspected sockpuppets

Yahya3009: The user does not seem a newbie and his edits (their targets, agenda, cherry pickings, etc.) seem quite similar to the long term abuser's. Some of the edits by the ip socks [127] [128] [129] [130] and edit the by the suspected sock account [131]. For more diffs, see this case, especially edits by ip sock 87.189.xx. Plus, in order to avoid behavioral investigation, the long term abuser creates temporary SPAs like this one. See for example banned Kinetsubuffalo.

195.89.58.9 The same geolocation [Germany & Switzerland] with the ip socks of Lrednuas Senoroc and restores his edits [132] [133]

As I mentioned on previous case, it is a WP:SCRUTINY case, a form of sockpuppetry. The sockmaster’s account Hassan Rebell was banned per WP:NOTHERE by JzG.  An another admin lifted his block as “a chance to prove that he did in fact understand the issues that led to the block and would not repest them.”  As the problem has been continuing for years [mostly through ip socking & ip-hopping], I think the suspected socks of the long-term vandal should be blocked as per WP:SCRUTINY, if they technically overlap with the location of the sockmaster [Germany & Switzerland] or evidently abuse web servers.

P:S: His impersonator sock account Kinetsubuffalo mentioned here should be tagged as “suspected sock of Lrednuas Senoroc”, at least. Please note that, Lrednuas Senoroc was also banned for impersonating an another editor. He had said that it was a coincidence. However, after the block, he created an another impersonator sock account, Kinetsubuffalo. It was obviously not a “coincidence” but a tactic/sock trick. 24.184.255.182 ( talk) 23:25, 14 September 2017 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

Retrieved from " https://en.wikipedia.org/?title=Wikipedia:Sockpuppet_investigations/Lrednuas_Senoroc/Archive&oldid=1079619709"

Top Of Page

Home • Search • Translate

© CSE