Wikipedia:Sockpuppet investigations/Kambliyil/Archive

Add links
Source: Wikipedia, the free encyclopedia.


Kambliyil

Kambliyil (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

15 July 2021

Suspected sockpuppets

Kambliyil was identified as a CU confirmed sockpuppeteer last month during the course of a separate investigation (see: Wikipedia:Sockpuppet_investigations/Alandyept/Archive) where two parties were involved in a dispute, and both parties were confirmed to be abusing multiple accounts to gain the upper hand during that dispute.

In hindsight, reviewing the combined edits from the Kambliyil group of accounts, and those from the 150.129.101.0/24 subnet, it is clear that this issue of socking was not an isolated incident.

Kambliyil has demonstrated an extensive history of abusing multiple accounts in order to edit war and game WP:3RR, to the point of baiting the parties they are in a dispute with, and impose a sense of ownership over a wide range of articles by using multiple accounts to ensure their preferred revision is presented. Examples: [1] [2] [3] [4] [5]

They do not show an interest in editing in a collaborative manner, and are now editing while logged out and creating new accounts in order to evade their current indefinite block. [6] [7] [8]

The user accounts listed above have since been blocked as CU-confirmed or obvious WP:DUCK accounts. Due to ongoing block evasion, I respectfully request a check for additional sleepers.

Thank you for your time and please don't hesitate to contact me if there are any additional questions or concerns. Regards, Yamaguchi先生 (talk) 18:40, 15 July 2021 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  •  Clerk endorsed – sleeper check seems like a good idea. Please also check if there are other blockable ranges, this ISP seems to have sensible IP assignment patterns. Blablubbs (talk) 19:20, 15 July 2021 (UTC)[reply]
  •  Confirmed.
Also found and  Confirmed:
Akkinenis (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Bagging and tagging all accounts. No other sleepers exist that I could find. no No comment with respect to IP address(es). This SPI can be closed... ~Oshwah~(talk) (contribs) 19:45, 15 July 2021 (UTC)[reply]
Thank you both Blablubbs and Oshwah. Another editor has expressed concerns that User:Boschanot is also an involved sock pushing the same agenda. The Interaction Analyser does show considerable overlap, and this may warrant further examination if not confirmed by technnical evidence. Regards, Yamaguchi先生 (talk) 19:59, 15 July 2021 (UTC)[reply]
Please excuse me adding a comment here after this was archived. Boschanot is  Unlikely based on technical evidence. They are all but certainly a different person (all the technical evidence points to this being a different person) but of course, WP:MEAT may possibly apply. --Yamla (talk) 10:54, 18 July 2021 (UTC)[reply]

22 September 2021

Suspected sockpuppets

Kambliyil was recently blocked for an extensive history of sockpuppetry, with speculation that there was more than we were seeing. I think I've found a bit of that. Here are the users whose userpages Kambliyil created. In all cases, there is no record of any of them asking Kambliyil to do so. There are two not listed here: Satya prakasham (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), already confirmed; and Alandyept (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), already ruled unlikely.

Some more notes on individualized suspicion:

  • As you may notice, both of the Messrs. Arjun M. M. have essentially the same name, just with the second and third names reversed. Both somehow got past 1,000 edits this way; I can only assume people seeing both usernames didn't realize they weren't the same account.
  • Three pages were created with the content I am a Malayali and a follower of Communism. Of those three:

More generally, all of these accounts are heavily involved in the topic area of Indian politics, specifically Kerala politics, often with a focus on the far left.

I suspect we're on the tip of an iceberg here, one that may see a few cases merged. More notes on that shortly. Requesting CU for all of these to sort out this madness. I can't rule out the chance that Kambliyil was creating userpages for editors they liked, or whom they knew personally off-wiki, and given that one of the users they did this for is Alandyept, the userpage creations on their own aren't enough. -- Tamzin[cetacean needed] (she/they) 09:00, 22 September 2021 (UTC)[reply]

Adding Shaheed Hemukalani, who edited Draft:All India Bank Officers' Association with the two Arjuns, and who stopped editing a few days after Arjun Muraleedharan Madathiparambil. -- Tamzin[cetacean needed] (she/they) 09:09, 22 September 2021 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

This case is being reviewed by Tamzin as part of her training as a clerk. Please allow her to process the entire case without interference. You may pose any questions or concerns either on her talk page or on this page.

-- Tamzin[cetacean needed] (she/they) 09:07, 22 September 2021 (UTC)[reply]
  • For what its worth, my observation was that Alandyept and Kambliyil were in an editorial dispute and that both resorted to abusively using multiple accounts to gain the upper hand. In the case of Kambliyil, this was not an isolated incident. They showed an extensive history of deceptively using their accounts to revert to their preferred version, provide an illusion of consensus, gaslighting editors they were in a dispute with, et cetera. Kambliyil has access to at least two different internet providers with large IP ranges, presumably one is a home network connection and the other is mobile. In any case I do not believe Alandyept and Kambliyil share a relationship outside of their on-wiki dispute. With respect to Boschanot and all the other accounts listed in this recent report, would defer to a CU administrator for their review and feedback. Regards, Yamaguchi先生 (talk) 18:44, 22 September 2021 (UTC)[reply]
In addition to having a technical match, Anobob also too the step of moving Akmil Hashim Kapat's user page to a new user name which does not exist! I have moved the page back and blocked Anobob (talk · contribs) indef.
In terms of the real subject of this SPI, Kambliyil (talk · contribs), Yamaguchi's main evidence is that the above set of user pages were all created by the same guy. This is not quite the same as noticing misbehavior by the individual accounts listed. There could still be something here even though I was not able to find it. I looked in detail only at the first two in the list, but saw nothing wrong with their edits and found them to be technically Red X Unrelated to Kambliyil. Any other checkuser is welcome to continue screening the above listed accounts to see if they can find something. EdJohnston (talk) 02:29, 25 September 2021 (UTC)[reply]
  • I selected these accounts as they were not stale. Any other accounts should be behaviourally reviewed.
    • Kambliyil appears to have recently used webhosts/proxies (this is solely based on open ports and Shodan's classification, as said IPs are not online currently). The organisation the IPs are registered to does not appear to offer hosting/co-location.
      • No other accounts appear on these ranges.
    • Arjun Madathiparambil Muraleedharan appears technically Red X Unrelated to the master, and other checked accounts.
      • Other accounts visible on these ranges.
    • Sreein Sreedhar appears technically Red X Unrelated to the master, and other checked accounts.
      • Other accounts visible on these ranges.
    • Mehboob Nambrath appears technically Red X Unrelated to the master, and other checked accounts.
      • Other accounts visible on these ranges.
    • Jabirkdh11 is definitely technically Red X Unrelated to the master, and other checked accounts.
      • Other accounts visible on these ranges.
    • Boschanot appears technically Red X Unrelated to the master, and other checked accounts.
      • Other accounts visible on these ranges.
    • I concur with the previous findings for Anobob, and note the marked differences i/r/t the above.
  • Unfortunately the results here are not helpful. If Kambliyil was using a webhost/proxy, then we could potentially assume some sort of evasion is at play, if you believe this master would attempt to evade?
  • (TL;DR)  In summary, my checks have not yielded any useful information ~TNT (she/her • talk) 20:44, 9 October 2021 (UTC)[reply]
  • Thanks, Sam. This is... all very perplexing. I'm going to leave this open for now while I take a look at the two Arjuns. -- Tamzin[cetacean needed] (she/they) 20:58, 9 October 2021 (UTC)[reply]
    @Tamzin I took a look at this (just the publicly-available data). My inclination would be to assume that the two Arjuns are indeed the same person. However, given the name similarity, it's hard to make a convincing argument for deception. So I'd be tempted to close this with no action, or maybe uw-agf-sock, or a more polite hand-written note to make sure they're aware of our policies and ask them to resolve any questions by putting an explanatory note on one or both of the user pages. -- RoySmith (talk) 18:26, 30 October 2021 (UTC)[reply]
    @RoySmith: Yeah, sorry I've left this open for so long. I've just wanted to take a closer look to figure out whether any sort of warning is needed. But, looking at the dates here, gosh, didn't realize I'd let it get to three weeks. I'll sort this in the next day or two. -- Tamzin[cetacean needed] (she/they) 04:39, 31 October 2021 (UTC)[reply]
  • Okay, I've given Arjun an AGF half-warning/half-query, and think that's all there is to do there. It seems likely to me that there is some sort of off-wiki coördination going on regarding the topic area of leftist politics in Kerala, but I can't say for sure that it's bad faith coördination, so I don't think there's anything else to be done here, but I do think it's worth keeping in mind for the future. Anyways, sorry again for the mess and the delays.
    This leaves us with the question of merging. @Yamaguchi先生: I've taken a long look at the two sets of sox' contribs, and see lots of similarities, more than enough to endorse a check on had one not already been run. I'm not seeing, though, the sort of smoking gun I'd need to call this proven and thus merge, especially in the face of a "technically unrelated". Is there something in particular that makes you certain they're the same? -- Tamzin[cetacean needed] (she/they) 02:43, 5 November 2021 (UTC)[reply]
    @Tamzin if you're looking at the two Arjuns, you should also look at Wikipedia:Sockpuppet investigations/Arjun Muraleedharan Madathiparambil, which I see I was involved in, and had totally forgotten about the last time I chimed in on this case. -- RoySmith (talk) 03:15, 5 November 2021 (UTC)[reply]
    @RoySmith: Welp, wish I'd noticed that before I warned them, but oh well, two AGF warnings can't hurt. Does make me wonder, should {{checkuser}} link to an SPI if there is one? Something like {{#ifexist:Wikipedia:Sockpuppet investigations/{{{1}}}|· '''[[Wikipedia:Sockpuppet investigations/{{{1}}}|SPI]]'''}}, right at the front before "talk". -- Tamzin[cetacean needed] (she/they) 04:28, 5 November 2021 (UTC)[reply]
    Yeah, it would be there was some easily visible notice of other cases of interest. A case titled for the account is certainly one, but also other cases where the account was mentioned would be cool too. My template-fu is rather weak, so I have no idea how feasible it would be to implement that. -- RoySmith (talk) 14:41, 5 November 2021 (UTC)[reply]
    I'll reply on your talk so I don't delay archival. -- Tamzin[cetacean needed] (she/they) 16:20, 5 November 2021 (UTC)[reply]
  • As far as I can tell, Tamzin and me are each waiting for the other one to close this. OK, I'll jump. -- RoySmith (talk) 19:45, 6 November 2021 (UTC)[reply]
    @RoySmith: I was actually waiting on Yamaguchi for the merge question, but it seems they've been offline a few days, so I think fine to close, yeah. Can always make the case to me directly; no rule that a merge can only happen with an active case pending. -- Tamzin[cetacean needed] (she/they) 05:40, 8 November 2021 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Kambliyil/Archive&oldid=1237239176"