Misplaced Pages

:Sockpuppet investigations/Icewhiz: Difference between revisions - Misplaced Pages

Article snapshot taken from[REDACTED] with creative commons attribution-sharealike license. Give it a read and then ask your questions in the chat. We can research this topic together.
< Misplaced Pages:Sockpuppet investigations Browse history interactively← Previous editContent deleted Content addedVisualWikitext
Revision as of 23:08, 8 November 2024 editSelfstudier (talk | contribs)Extended confirmed users, Page movers41,282 edits →Comments by other users 3: ReplyTag: Reply← Previous edit Latest revision as of 09:26, 15 January 2025 edit undoMagyarNavy1918 (talk | contribs)Extended confirmed users547 edits →Clerk, CheckUser, and/or patrolling admin comments 4: ReplyTags: Mobile edit Mobile web edit Reply 
(246 intermediate revisions by 42 users not shown)
Line 1: Line 1:
{{SPIarchive notice|Icewhiz}} {{SPIarchive notice|Icewhiz}}


===09 October 2024=== ===29 December 2024===
{{SPI case status|close}} {{SPI case status|relist}}
====Suspected sockpuppets==== ====Suspected sockpuppets====
{{sock list|1=Galamore|tools_link=yes}}<!-- Add more accounts or IPs to this template as needed --> {{sock list|1=Terrainman|tools_link=yes}}<!-- Add more accounts or IPs to this template as needed -->


Evidence relies on comparing ] with ] and their likely sockmasters ] and ].
There are behavioral similarities between Galamore and the ]/] accounts I reported at ] (pinging blocking admin {{u|HJ Mitchell}}). There are also similarities between Galamore and other confirmed/suspected socks, so I'm not sure who the master is (if anyone). Per {{u|RoySmith}}'s advice ], I'm filing it under this case to stick with one case file and not sweating the details of which file.


'''Timeline''':
I had this timecard theory:
* Galamore edits 5-7
* ] edits 8-10
* ] edits 11-13
* ] edits 13-14
* (see also ] , ] , ] )
Sakakami had been on my radar because the account was created Aug 8, just a few days after I filed ], and Sakakami made ~500 edits almost exclusively to category namespace in a handful of days in Aug and Sep, hit XC 9/9 7:29 , and their ] was at ]. But Sakakami was recently confirmed to ], see ]. I don't know if Dolyn is related here but I've decided to file Galamore under this case page instead of that one.


] was created on 13 November, just five days after the SPI case against ABHammad was opened on 8 November.
Galamore was previously mentioned at ] and ]
Simultaneously, starting 8 November, ABHammad’s contributions


'''Timecard''':
Same similarities as in the prior O.maximov/UnspokenPassion filing: repeating each other's edits, similar talking points, and "drive-by" habit (only making one edit to article/talk page, to support another sock)
* ]: ], ]
* ]
** ]: "This isn't a clear-cut case of a colonial power committing genocide against a indigenous population. We're looking at two groups, both with historical ties to the land, both claiming indigenity. Jews have always seen themselves, and were seen by their neighbors all around the world, as being from this area."
** ] (Galamore's only edit to this article/talk page): "the Palestinians are not widely described as indigenous except for several opinionated articles ... Given that they should not be described as indigenous (maybe just part of them, so if we consider them all indigenous, Jews are no less indigenous, as this is where the Jews first appeared in history ..."
** ]: "The Israeli-Palestinian conflict is generally understood as a struggle between two ethnic groups, both laying claim to being indigenous."
* ]
** ]: "does not reflect a consensus from reliable sources ... requires a stronger consensus among scholars"
** ] (only edit to article/talk page): "this framing is rejected by most scholars on the topic"
* ]
** ]: "better aligns with the terminology used by leading reliable sources and avoids issues with ambiguity and neutrality"
** ] (only edit to article/talk page): "better serves in protecting Misplaced Pages's neutrality"
* ]: ], ]
* ]: ], ]
* ]: ], ]
* {{pagelinks|Jordanian option}} - See article history: UnspokenPassion expanded this redirect into an article, Galamore picked up after UnspokenPassion was blocked ], ]


, does not seem to get any sleep, or has a very random sleep schedule, with edits spread throughout the day.
Aside from similarities between Galamore and O.maximov/UnspokenPassion, there are also similarities between these three accounts and two other accounts, OdNahlawi and PeleYoetz, that have been reported at another currently-pending SPI, ]:
* ], removing "colonization": ], ], ], ]
Compare that with the control group of for example, where I am clearly absent and asleep between 12 and 8 am UTC. Or with other users who participated in the last Icewhiz SPI: like who seems to be asleep between 8 am and 1 pm UTC; or between 7 pm and 1 am UTC; 2 pm and 11 pm UTC; between 7 am and 1 pm UTC; etc. You get the point.
* ], "no consensus": ], ], ]
* ]
** ] downplaying illegality of occupations (in 2021), ], ]
** ] ("various causes"), ] ("various reasons"), ] ("numerous factors")
** ], ]
* ] - created by UnspokenPassion
** ]: "suicide bombings deliberately targeting civilians"
** ]: "Suicide bombings ... that target civilians"
** ] (only edit to article/talk page): "The term terrorism is entirely appropriate ... suicide bombings that primarily target civilians"
** ]: "the term 'terrorism' can be used when it is common in literature ... suicide bombings targeting civilians are widely recognized as acts of terrorism"
** ]: "the term 'terrorism' is entirely appropriate"
** ] (for completeness)
* ]: ], ] - only edits by G or PY to article or talk page (I also saw here {{u|ManOnTheMoon92}}: ])
* ]: ], ] - only edits for both
* ]: ], ] - only edits for both
* ]: both arrive at the same time to an article they've never edited before, to jump on the same side of the same dispute:
** ]: "it does not seem to reflect the prevailing view"
** ]: "Having found a few sources that share the same sentiment and hold the same minority view does not make this perhaps verifiable claim something widely agreed upon in relevant scholarship."
** ]: "Please prove this is the majority view"
** ]: "see WP:ONUS - not all verifiable information must be included"
** ]: "No, the burden is on those seeking to include disputed content, even if they have found several sources that seem to support their own point of view. Most sources do not use this term."
** ]: "They say nothing about IDF facilitating the massacre, that's false."
** ]: "The bottom line is that portraying the Sabra and Shatila massacre as "Israel facilitated the massacre" is a POV rather than an established fact. The sources provide a broader and more nuanced explanation. All agree that the Phalangist militias committed the massacre, while the exact role of the IDF is highly contested. Views range from (opinionated) accusations of facilitation, such as those presented by Makeandtoss, to more measured assessments that highlight Israel's failure to prevent the massacre rather than direct involvement or facilitation."
** ]: "Even if that's what's the word facilitating means I think it is pretty clear that not all sources are on board with that. The more neutral ones say there is a debate about Israel's part of responsibility. What most agree on is that the IDF failed to intervene stop the violence, but using the word 'facilitated' based on just some of the sources is POV."
* ]: ], ], ]
* ]: ], ]
* ]: ] moves to "Attempted assassination of Hassan Nasrallah", ] "A more relevant move would be to attempted assassination of Hassan Nasrallah"
* ]: G jumps in and answers for PY: ], ]


'''Claiming politicization''':
Edit summary similarities:
* Many vague, canned edit summaries like "added info" or "adding info and sources"
** : e.g. "Added more information and citation"
** : e.g. "Added much information with sources and links" , "Added sources, links and much information"
** : "added information and citation"
** : "naming sources and adding info" , "Added general info with sources" , "I added more info"
** : "add more info" , "added update info" , "added info"
** : "Adding an update" , "Adding a source"
* "detail"
** ]: "dropping figures, no need to get this level of detail here" (how many Palestinians and Lebanese have been killed)
** ]: "number of bombs not really important at this level of detail" (how many bombs dropped by Israel)
** But: ]: "Reverting recent edit that removed important, factual details on Palestinian political violence"
** ]: "list of places too detailed for this article" (places occupied by Israel)
** But: ]: "I changed the introduction to add more important detail on the neighborhood" (the important detail is "renowned for its eclectic architectural styles, and often regarded as one of the most beautiful neighborhoods in the city")
* "historical truth"/"historical facts"
** ] ("deny the plain fact ... denial of historical truth ... I will be adding this factual information shortly.")
** ] ("Reverting, these edits removed important historical facts")


Terrainman’s are made on ARBPIA-related topic area articles, on the talk page of ], where they accuse editors of being politicized and infiltrating WP; common ABHammad tactics and talking points. .
And of course, all the accounts share the same Israeli nationalist POV. Throw a dart at the EIA for all of them and you're likely to hit a pro-Israeli edit. ] (]) 23:09, 9 October 2024 (UTC)


Also, as was interestingly noted and characterized as quacking by TarnishedPath in the last SPI, the two blocked socks of ABHammad and “HaOfa” appealed while .
:Per Izno's comment on the OdNahlawi SPI, here are diffs/links from that page that wasn't on this page (because it doesn't involve Galamore, but does involve OdNahlawi, PeleYoetz, and another, Uppagus):

:* ] (]), relevant portion quoted in Wikitext: {{tq2|... <nowiki>"] the changes and introduced ] errors in the article" doesn’t seem like you’re addressing me to explain my edits or calling for any action.</nowiki> ...}} To make this edit, OdNahlawi had to type the word "PeleYoetz" (or enough of it to trigger autofill), and then type the words "me" and "my" -- simply being on the wrong page doesn't explain how one types out another's username and then refers to it as "me" and "my". This is the single most compelling piece of behavioral evidence IMO. (Even if the quoted portion were copied-and-pasted in whole or in part instead of typed out, the text "User:PeleYoetz|PeleYoetz" would be the first portion that was highlighted.)
'''Editor Interaction tool''':
:* All three edited almost-daily to get to XC. Once they hit XC, both the frequency and number of edits declines:

:** Uppagus edits almost daily until 5/7 (); hits XC 5/7 ; stops daily editing 5/7, switches to a few days a week, then a few days a month ()
they are editing the same exact topics within the topic area: Israel, Golan Heights, Talk:List of Genocides, and Talk:Israel.
:** PeleYoetz same: edits almost daily until 6/18 ; XC 6/17 ; stops daily editing 6/18

:** OdNahlawi same: edits almost daily until 8/8 ; XC 8/8 ; stops daily editing 8/8
'''Username:'''
:* All three make liberal use of vague stock edit summaries, e.g. "Added information", "Adding information", "Added info" (see the contribs lists linked above for examples).

:* Similar and somewhat distinctive timecards: , ,
Username of Terrainman (Terrain, man) rings a bell with ]’s other sock: ] (Stellar, kid).
:* PeleYoetz and OdNahlawi have edited hewiki, though Uppagus has not: , ,

:* Uppagus created Jan 28; PeleYoetz May 9; OdNahlawi June 18 -- basically the same time periods as many of the already-blocked socks in this topic area, although I understand that socks are created all the time
'''Nationality:'''
:*Overlaps for OdNahlawi/PeleYoetz/Uppagus:

:** ]:
An Icewhiz signature, Terrainman seems to continue the habit of pretending to be different nationalities and people, now a . Reminder how Icewhiz socks pretended to be: Greek (]), Lebanese (]), and Indian (]).
:*** ]: {{tqq|more balanced ... should be described as part of the article on Masada ... more relevant context and all the relevant views}} - AFAICT, OdNahlawi has made no edits to the article, 1 edit to the talk page, and the 1 AFD vote

:*** ]: {{tqq|should be included under the main topic ... alongside the main scholarly opinions and with stronger sourcing ... lack balance}}
'''Edit summaries'''
:*** ]: {{tqq|completely out of context ... belongs in the main article ... uses questionable phrasing and sources ... out of context}}

:*** See also ] EIA for the three accounts
Like ABHammad and Dajudem and Icewhiz socks, they are still extensively using the “adding info” edit summary in their contributions: total of 59 matches for “added info”. Examples:
:** ]

:*** ]; ]; ]
'''Negation of adjectives'''
:*** ] ; ]

:** ]
As demonstrated in the previous SPI, the same odd way of negating adjectives continues, the most peculiar of which is the use of “unneeded”: , , , .
:*** ] - PeleYoetz never edited this article or talk page before or since (Uppagus has).

:*** ]
'''Aggression''':
:* EIA for all three: . All three accounts' edits reflect a noticeable Israeli nationalist POV -- I think anyone reviewing these edits who clicks on any random edit will find that the edit in some way or form makes Israel look better or makes its enemies look worse. This is how I'd characterize pretty much ever edit in this report.

:One final note: however this shakes out, whatever the CU team ultimately decides, I would appreciate feedback about the behavioral evidence, both content and format. I have other SPIs I am contemplating filing (other suspected socks) but I don't want to waste your time reading things that aren't helpful any more than I want to waste my time writing it. So, please help me help you by telling me what is useful and what is not useful in these reports I've filed. Thank you! ] (]) 18:27, 16 October 2024 (UTC)
Like ABHammad, Terrainman is always on the offensive and makes very aggressive and provocative comments and accusations, such as this one falsely accusing me on vandalism on my talk page. .

'''Important note''':
I had expected that any new socks would try to act as different as possible to other previous socks, but surprisingly this is not the case. Is it a deliberate move to prove a point somehow or mislead SPI by having another co-sock doing these distinctive behaviors? Or that they just don’t care and can easily create new accounts? ] (]) 11:45, 29 December 2024 (UTC)

'''Extended evidence'''

'''SPI Defense''':
, Terrainman, who somehow made their way to the SPI case, responded by relying more on , rather than defending themselves.

'''Shared behaviors and similar comments''':

1- SPI defenses:
* ABHammad:
* Terrainman:

2- Alleged "infiltration" of WP
* ABHammad:
* Terrainman:

3- Focusing on ]
* ABHammad:
*Terrainman:

4- Extensive use of brackets in comments
* ABHammad: ; ; ; ;
* Terrainman: ;

5- Asking admins to monitor alleged topic ban violations
* ABHammad:
*Terrainman:

6- Leaving warnings on editors' talk pages
* ABHammad on ,
* Terrainman on only, so far. ] (]) 10:17, 31 December 2024 (UTC)

7- Promoting a populist narrative of “new” editors being wronged by experienced ones
* ABHammad:
* Terrainman: ] (]) 12:15, 1 January 2025 (UTC)

8- Forgetting ]
* ] (blocked along with ABHammad as Icewhiz/Dajudem sock): (total user edits 1900)
* Terrainman: (total user edits 1100)

9- Accusing editors and WP of ideological bias
* HaOfa:
* ABHammad:
* Terrainman:

'''Attacking checkusers'''
* Not sure if this is the first occurrence, but Terrainman has to the Administrator’s noticeboard attacking checkusers if they block them as “rogue” admins. ] (]) 17:53, 1 January 2025 (UTC)


:Interesting, in that case, it appears to be an attempt at misleading SPI, because the behavioral evidence is quite damning and almost identical to the previous case. But sure, a second and third closer looks at the technical evidence by Icewhizologists would still be very important. ] (]) 12:40, 29 December 2024 (UTC)
::What? I have no idea what you are talking about to be frank. I have not been aggressive. ] (]) 21:02, 29 December 2024 (UTC)
:" Chinese-speaking" What gave you the idea from my talk page that I am chinese speaking!? ] (]) 21:03, 29 December 2024 (UTC)
::This whole SPI response reads like ABHammad and this group of socks to me, this response in particular. For someone who writes their username in Chinese in their signature (地形人 = "terrain man" according to Google translate) to then ask "what gave you the idea from my talk page that I was Chinese speaking!?", complete with faux-outrage ("!?") and sealioning obtuseness (as if we can't all see the signature with Chinese characters in it). It's trolling in my view, and it's an identifiable habit of this sockfarm. ] (]) 17:24, 31 December 2024 (UTC)
:::I am not trolling, I honestly forgot at the time that I even had chinese characters in my name. It is stylization, and ofcourse you do not need to speak Chinese to use google translate. It was not faux outrage. ] (]) 19:30, 31 December 2024 (UTC)
:::'''I will also point out, because it is extremely relevant. That @] is another user who nearly 100% of their edits pertain to Israel'''. This is a ] and I am honestly shocked by it. I have put so much work into editing[REDACTED] and to face this just becasue I stood up to NPOV is an injustice in of itself. ] (]) 19:32, 31 December 2024 (UTC)
::::I see this "blatant bullshitting" as another tell-tale sign of this sock farm. The account made four comments on this page and signed each one--including ''directly'' above the "chinese speaking!?" one. The suggestion that they didn't notice or forgot that they had Chinese characters in their signature is so stupid it can't possibly be made in good faith.
::::And it's just like what ] about answering for PeleYoetz. ] reads to me a lot like Terrain Man's comments here. Right down to the feigning of confusion, attempts to show unfamiliarity with Misplaced Pages by misnaming "sockpuppet" (eg PeleYoetz's "puppet socks" and Terrain Man's "sock users"), and allegations of a conspiracy against them (TM "witch hunt", PY "haunted").
::::It's true I've been pretty much an IP SPA since the war started, and in that year or so, I've read so much of this from so many different accounts that now it just jumps out at me, it's the same writing style, same tactics, over and over and over again. And I say that as someone who was falsely accused of sockpuppetry by a number of editors when I first started editing here. But I never had problems using the word "sockpuppet." I've come to believe with this sockfarm--which I guess has been going for almost 20 years now!--forget the technical evidence, its the behavioral evidence that's damning. I hope this sockfarm at least makes it interesting in the future and switches up the on-wiki style. It's already boring and I've only been doing this for 1 out of those 20 years. ] (]) 20:44, 31 December 2024 (UTC)
:::::Do you know what percentage of my edits pertain to that topic? I have literally only made a handful of edits/reverts on the Israel topic area, and no edits at all to articles relating to the current war; I am not even watching the Israel-Hamas article! ] (]) 20:46, 31 December 2024 (UTC)
:::::You act so confident about being right, why don't you consider for a moment that you might be wrong. I have alot of work into Misplaced Pages since joining, I am deeply passionate about editing, I dared to stand up to NPOV by an experienced editor, and this is the result. ] (]) 20:48, 31 December 2024 (UTC)
:So I am using sockpuppets because I leave warnings, care about NPOV, and... use brackets? Ok ] (]) 10:34, 31 December 2024 (UTC)
:{{ping|Barkeep49}} You are right about ABHammad potentially being a different individual from Icewhiz/Galamore, who is most likely a Dajudem sock. On the other hand, as we know from the topic area and the ABHammad SPI case, there is extensive coordination between these socks. And for that matter, WP between sockpuppetry and meatpuppetry. A possible solution would be to have ABHammad as a confirmed sock of Dajudem, and a suspected sock of Icewhiz/Galamore.
:That aside, could you or any other checkuser kindly elaborate to us what kind of sophisticated obfuscation techniques are being used by these closely related families of socks, as understanding this will help immensely in the organization and presentation of evidence? Are they multiple individuals handing over their log in credentials to one another to mislead time-wise and style-wise? Or is it one individual just using proxy and VPN methods and device and software changing tactics? Or is it somehow a combination of both? ] (]) 19:15, 2 January 2025 (UTC)
::{{ping|Barkeep49}} That is fair. Judging from the past Icewhiz SPIs however it becomes apparent that it is the behavioral evidence that has been detrimental, with technical evidence often inconclusive. As time passes they will become better at obfuscating the behavioral evidence, so access to at least some of the technical conclusions -not necessarily the hard evidence themselves- is important. Can I be emailed about this as a possible solution? ] (]) 20:19, 2 January 2025 (UTC)


====<big>Comments by other users</big>==== ====<big>Comments by other users</big>====
:<small>''Accused parties may also comment/discuss in this section below. See ].''</small> :<small>''Accused parties may also comment/discuss in this section below. See ].''</small>
Hello, I'm not sure what is going on here. Obviously I am a bit alarmed about this. I do not have any 'sockusers'. I encourage check users to verify this. I am happy to stay away from editing contentious topics if that is what is necessary. --] (]) 20:58, 29 December 2024 (UTC)
:I am honestly baffled that PeleYoetz and OdNahlawi arent confirmed by self-admission already. ] should be put as the definition of ] here. Even if the CU showed one of them was editing from the moon, that is a user accidentally outing themselves as running multiple accounts. I think the evidence above ties those two together with Galamare, and I can try to scrounge up some evidence for what I think is another account (not sure if it's the same unnamed one Izno references obviously) before this is closed, but those two being the same editor is a slam dunk, and I am baffled as to how that is in question. ''']''' - 17:45, 17 October 2024 (UTC)


:I will also point out that I left a message on Makeandtoss' talk page regarding what I suspected to be ideolgically motivated subtle vandalism by them, I don't know if this is 'revenge' from them or good intentions. But I look forward to check users verifying my innocence. Again, I am more than happy to stay away from contentious topics including the Israel wiki project, which, admitedly, is what inspired me to create an account after I saw what I believed to be ideological bias on the list of genocides page (a page I have not edited or commented on since the first day of my account creation). ] (]) 21:00, 29 December 2024 (UTC)
:Besides the very different time signatures, level of English, topics of interest, and languages (for example, OdNahlawi seems to speak Arabic) between the editors listed here, I want to point out something important to CheckUsers here. The two editors here asking for CU—namely Levivich and Nableezy—are now included in the list of parties in ]. If it passes, arbcom will start a full case to check their conduct, alongside that of other editors, in the PIA topic area. Note that the concerns discussed on that page, as escalating admins labelled them, include "edit warring, battleground mentality, and POV pushing." As I mention in my comment ], I believe that, alongside issues such as the endorsement of sources affiliated with terrorist organizations, and the promotion of skewed content, there's a major issue of aggressive conduct by the so-called 'ARBPIA regulars' towards new editors with opposing viewpoints based on unsubstantiated evidence. In fact, arbcom became involved in this issue in the very beginning following an AE complaint Levivich opened against PeleYoetz, claiming tag-teaming, which admins later closed and escalated to the committee, saying that the conduct in question also applies to the side of those filing the AE too (which was then followed by some editors saying will be solved only through sanctions on the 'regulars' too.).
::<s>I will also add that almost 100% of makeandtoss' edits are on articles relating to Israel, and there are a very large number which suggest this user is not ascribing to NPOV.</s> I left a message on their talk page mentioning this and quoting several edits which I believe amount to subtle vandalism, and I strongly believe that this accusation is 'revenge' for that message. ] (]) 22:30, 29 December 2024 (UTC)
: Is it just coincidence that after a ], and then a just a few days ago (closed as unrelated), now Levivich is making another CU request involving the same editors? The choice of words in the above request, with the main point of similarity comes down to what Levivich describes as the editors' "pro-Israeli views" (but in fact are shared by much of the Western World), while the editor says things such as "," and "," may show more clearly what really is going on here. ] (]) 19:45, 17 October 2024 (UTC)
:::Do you know what ] are? If you have a complaint about another editor, then make that complaint in the appropriate forum. ] (]) 10:42, 31 December 2024 (UTC)
::Bonkers that this level of misdirection for a page that is solely focused on if one user is the sockpuppet of a banned user is allowed. ''']''' - 21:44, 17 October 2024 (UTC)
::::I understand, I shouldn't have gone as far to bring up their editing history, however it pertains to the message I had left on their talk page, which I believe is the reason why this accusation of sockpuppeting is being brought forth by them; I believe that to be relevant to the investigation, but perhaps I am wrong. ] (]) 10:50, 31 December 2024 (UTC)
::Your lawyerly approach to these things reminds me of someone, let me think... ] (]) 22:31, 17 October 2024 (UTC)
:::Fox something, someone help me out here, could be totally wrong of course. ] (]) 22:43, 17 October 2024 (UTC)


{{ping|makeandtoss}} what did you mean in your edit summary on this investigation: "this should be closed by self-admission already"? <!-- Template:Unsigned --><small class="autosigned">—&nbsp;Preceding ] comment added by ] (] • ]) </small>
:I've written this before about users suspected of being sock puppets (then it was people accused of being socks of Tombah, but it applies to Icewhiz too):
# We can't just continue claiming that all those who don't align with the anti-Israel view common here, as being by the same person and file CU checks on them based on very limited evidence if any. there are 10 million Israelis, who may be interested in similar topic and work in similar timeframes.
# Take a look at these user edits in other languages as well. In my case, I was also accused of being Tombah, but after checks they have found out that I was not related to them. This is becoming too common and for no reason.] (]) 20:12, 17 October 2024 (UTC)
:::There's a high cost associated with having an over-sensitive approach to ban evasion and a high cost trying to deal with it, including mistakes and collateral damage.
:::* In terms of cost, Irtapil, an account used by someone with a pronounced pro-Palestinian bias has made 12865 edits using 5 accounts that have been identified so far. Evidently, we are very bad at identifying ban evasion. Notably, no one leapt to their defense when SPIs were filed.
:::* Identifying accounts that are employing deception should have nothing to do with the conflict, it should just be about identifying people willing to use deception, because their presence is corrosive. Their presence makes all of the tools, and the rules used to control/limit behavior in the topic area worthless because the effectiveness of sanctions becomes dependent on a person's willingness to employ deception via disposable accounts.
:::* Sanctions are only effective on honest editors. No one should have to deal with dishonest people here. I would rather they were given a subset of the topic area where they can edit and not get reported because they are never going to stop ignoring rules they don't think apply to them. ] (]) 12:10, 18 October 2024 (UTC)
::Frankly, @], I find it suspicious that you characterize my report as "very limited evidence," considering there are maybe 50 diffs or something? And similar with your characterization of "similar topic" when it's actually ''the same articles'', not just similar topics, and "similar timeframes" when the evidence actually shows that it's ''not'' similar timeframes, but consecutive timeframes. I'm not really sure how you can look at this evidence and ''not'' think that it's worthy of an SPI filing. Similar to your comments in the previous one, even though that one came back confirmed. You don't have to be persuaded by the evidence, but acting as if there isn't evidence on this page, is odd. ] (]) 17:22, 18 October 2024 (UTC)
:Previously @] said the OdNahlawi and PeleYoetz were unrelated, below @] says there is "weird data" that connects those two and Galamore and it is consistent with potentially being Icewhiz. This has languished here for a couple of weeks now, can we get some clarity as to if this is being investigated further? ''']''' - 15:48, 30 October 2024 (UTC)
::Nope. The last time I went near this, I got beaten up because somebody didn't like my findings. I've got better things to do with my time. ] ] 15:55, 30 October 2024 (UTC)
:::I certainly did not beat you up, and now we have conflicting findings between you and Izno. I dont think Levivich was beating you up either, but Im sorry you felt attacked. I hope youll reconsider your withdrawal from this case, but could any other checkuser review this and the findings on the CU wiki? ''']''' - 16:01, 30 October 2024 (UTC)
::::As the other CU mentioned by Izno below I don't know if they're conflicting findings necessarily or rather differences in how similar findings are presented. I'll see what I can do about diving into the technical evidence but don't think I"m going to have time to go through the massive behavioral evidence {{u|Levivich}} compiled above. ] (]) 16:11, 30 October 2024 (UTC)
:Izno I'm not faulting Roy either, that was not my intent at all, based on the history I assume that most Icewhiz sock's technical data would generally look inconsistent. Though I said "is consistent with potentially" not "is consistent", which I think is closer to "not inconsistent" than "is consistent". ''']''' - 18:09, 30 October 2024 (UTC)


Please tell me if there is anything at all I can do to verify my innocence. I do think I am being targeted by makeandtoss due to the message I left on their talk page. ] (]) 21:04, 29 December 2024 (UTC)
:Interestingly, one of the most prominent behaviors I have seen from and was their occasional avoidance of engaging in the talk page despite repeated pings and talk page messages; this is a behavior also by EnfantDeLaVille. Editor interaction tool shows some interesting results. ] (]) 12:13, 1 November 2024 (UTC)
::@], I wouldn't necessarily draw anything out of the result of that interaction result unless you also provide diffs showing close phrasing in their edits. Not saying you aren't on to something, but something more would be needed. '']''<sup>]</sup> 12:20, 1 November 2024 (UTC)
:::Although we can see clear signs of trying to avoid suspicion by changing writing styles and behaviors, a phenomena that will likely continue to grow especially after this SPI, but sure, you are right, this is just an initial observation that other editors can also build on. I will see what I can do. ] (]) 12:28, 1 November 2024 (UTC)
::::Here are some other observations for now. I don't have the tools to do a quick review of the edit summaries, so tagging {{ping|Levivich}} and {{ping|Sean.hoyland}} who might.
::::'''Creation dates''':
::::* Galamore 25 December 2023
::::* O.maximov 8 February 2024
::::* EnfantDeLaVille 24 March 2024
::::* UnspokenPassion 28 March 2024
::::'''Language choices''':
::::*Galamore editing on Hebrew WP
::::*O.maximov editing on Russian WP
::::*EnfantDeLaVille editing on French WP
::::'''Timezone''':
::::All four users never edit between 22 and 4 UTC.
::::'''Identifications'''
::::* One of the banned suspected socks of Icewhiz is ], resembling the proud Lebanese tag on EnfantDeLaVille's userpage.
::::'''Odd interest in banks''':
::::* O.maximov most edited articles are Israeli banks
::::* EnfantDeLaVille odd two uploads to WP were logos of Lebanese banks; in one of which they seem to have used the unusual Arabic word of مصرف instead of بنك to describe the bank.
::::] (]) 12:52, 1 November 2024 (UTC)
:::::{{u|Makeandtoss}}, I don't think I have anything of much value to add here. What I can say is that according to my unreliable no-time-work-on-because-i-have-young-dog software, out of a test dataset of 339 accounts, EnfantDeLaVille is a closest match to Icewhiz sock Uppagus. But it places Uppagus closest to OliveTree39 rather than a sock classified as an Icewhiz sock. And while it has been consistent with SPI results in many cases, it placed PeleYoetz closest to Bukrafil (a Gilabrand sock) and Gilabrand, which is inconsistent with classification as an Icewhiz sock. So, make of that what you will. ] (]) 15:36, 3 November 2024 (UTC)
:::::Unfortunately, I also don't know anythingabout this editor, but if it helps, the ] I use is ; there's also a template, {{t|EIA}} that generates a custom link. ] (]) 18:34, 3 November 2024 (UTC)
::::::{{ping|Izno}} {{ping|Barkeep49}} I can go on to do an editing behavioral analysis if this is not adequate for a check yet. ] (]) 10:07, 4 November 2024 (UTC)
:::::::@] can you please make a separate filing with whoever it is you think needs a new check, with specifics for that/those accounts? Either as part of this SPI or a new one. ] (]) 16:27, 4 November 2024 (UTC)
::::::::I have done so as suggested. ] (]) 14:32, 5 November 2024 (UTC)


====<big>Clerk, CheckUser, and/or patrolling admin comments</big>==== ====<big>Clerk, CheckUser, and/or patrolling admin comments</big>====
*Terrainman edited as an IP for a while before creating their account. They have another account with zero edits (not a violation of policy in itself). Technically, they really don't look like ABHammad, Galamore, or other past Icewhiz accounts, and there are no obvious signs of CU obfuscation shenanigans. But I'm not an Icewhizologist, so second opinions are welcome. ] (]) 12:21, 29 December 2024 (UTC)
* I looked at some of this when ] was open. There was some weird data that I and another CU looked at that connects the 3 identified between these two pages (OdNahlawi, PeleYoetz, and Galamore) as well as a fourth account that is yet unnamed. exists for CUs to review, and feel free to add to it if you want. The data was not inconsistent with the thesis that this is specifically Icewhiz, and that user crossed my mind given their historical skill at evasion and some knowledge of their previous behavior. I didn't do a deep dive on behavior. ] (]) 18:12, 16 October 2024 (UTC)
*:I continue to be uneasy about linking ABHammad to Icewhiz/Galamore. That said I do find reasonable behavioral evidence here linking Terrainman to ABHammad. I did a limited amount of actual CU'ing, but from what I see {{re|Spicy}} I feel like there's nothing there to suggest it's not ABHammad. What are your thoughts on the behavioral side of things (ignoring any Icewhizology and just thinking about ABHammad/Terrainman)? ] (]) 18:51, 2 January 2025 (UTC)
*:The relation here isn't one you'd normally be looking for while checking accounts, so Roy missing it is not a big deal to me. Something something CU is not magical faerie pixie dust. As for consistency with Icewhiz, I did not say that it was consistent, I said it was not inconsistent. Two nots in English do not imply a positive statement. ;) There was CU data that did make me think "huh, this looks a bit like the last time I had to think about Icewhiz" though, if these accounts are connected. ] (]) 18:05, 30 October 2024 (UTC)
*::I suppose one could say re. the technical evidence that {{tq|there's nothing there to suggest it's not ABHammad}}, but I don't think there's anything that particularly suggests that it ''is'' either, i.e. {{inconclusive}}, {{behav}}. I haven't examined the behaviour beyond verifying that it's credible enough to justify a check. That I will leave to others. ] (]) 19:02, 2 January 2025 (UTC)
*After discussing new results with Izno, I feel that {{sock list|Galamore|Minden500|PeleYoetz|OdNahlawi}} can be technically linked to each other. I also think there is an ] of this socking between PeleYoetz and OdNahlawi. I think it is {{possilikely}} that these socks are all Icewhiz but that connection doesn't need to be proven given the technical evidence linking them to each other and abuse of the socking policy. ] (]) 20:50, 30 October 2024 (UTC)
*::@] we are generally reluctant to share too much about what behaviors we're focused on in the hopes that it will make it harder for the sock to change up in a new way that becomes harder to detect. ] (]) 20:11, 2 January 2025 (UTC)
* I'm adding {{checkuser|Uppagus}} to the blocked accounts list for the same connection as the others. ] (]) 21:08, 30 October 2024 (UTC)
*:::We've been blocking Icewhiz largely on certain not disclosed, and shifting, behaviors more than technical evidence for quite some time now. Sometimes the behavioral pattern is shown through the technical evidence, other times not. I understand how frustrating this is to people who aren't CUs. ] (]) 20:31, 2 January 2025 (UTC)
* I'm requesting locks for the 5 identified here given similarity of these accounts to prior accounts after a review. And closing this discussion since the noodling about this specific batch seems to have tapered. ] (]) 16:41, 4 November 2024 (UTC)

----<!--- All comments go ABOVE this line, please. --> ----<!--- All comments go ABOVE this line, please. -->


===05 November 2024=== ===02 January 2025===
{{SPI case status|CUrequest}}
====Suspected sockpuppets====
{{sock list|1=Rajoub570|tools_link=yes}}<!-- Add more accounts or IPs to this template as needed -->

Evidence relies on comparing ] with ] socks (mainly EnfantDeLaVille, but also EliasAntonakos) as well as possible connections with other sockmaster ].

'''Creation dates:'''

* ] (“HaOfa”) 24 October 2023
* {{tq|Rajoub570}} <span style="color:red">25 December 2023</span>
* ] <span style="color:red">25 December 2023</span>
* ] 25 January 2024
* ] 8 February 2024
* ] 22 February 2024
* ] 24 March 2024
* ] 28 March 2024
* ] 9 May 2024
* ] 20 June 2024
* ] 24 June 2024

'''Timecards:'''

* Almost identical timecards for with , , , with most edits 6 am to 6 pm UTC, and the fewest daily edits on Saturday.
* Interesting complementarity between the aforementioned users and , in which all of them are editing 4 am and 8 pm UTC, but Galamore has most edits concentrated 4 am – 7 am UTC.
* Timecard comparison between and .

'''Editor interaction tool'''

* Comparing Rajoub570 with EliasAntonakos shows odd focus on some specific Palestinian villages and the ] article, and comparing Rajoub570 with EnfantDeLaVille shows odd focus on random Lebanese village of ].

'''Pretending to be different nationalities'''

* EnfantDeLaVille supposedly Lebanese
* Proud Indian Arnab supposedly Indian
* EliasAntonakos supposedly Greek
* Rajoub570 supposedly Palestinian

'''Second language choices'''

As usual, most edits on English WP, with very few edits on a second language:
* Galamore and PeleYoetz editing on Hebrew WP
* O.maximov editing on Russian WP
* EnfantDeLaVille editing on French WP
* Rajoub570 editing on Arabic WP

'''Use of Arab family names'''

* OdNahlawi, ex: ], Syrian military officer
* ABHammad, ex: ], Jordanian police minister
* Rajoub570, ex: ], Palestinian security official

'''Stonewalling'''

An Icewhiz sock signature, Rajoub570 has engaged in stonewalling:
* Rajoub570
* EnfantDeLaVille
* Galamore
* PeleYoetz

'''Hyperfocus on Arab and Jewish demographic history '''

* Side note: Another sockmaster ] created the ] article on 9 July 2023
* Rajoub570 created articles of ] and ] in early 2024 that promote the theory that these Arab tribes are of Jewish origin
* Rajoub570 starts editing the ] article starting 5 February 2024
* EliasAntonakos article of ] on 30 June 2024, which has been as of sources
* Rajoub570 sneakily inserts a link of the then recently-EliasAntonakos-created ] into the ] article on 21 July 2024
* Rajoub 570 creates the ] article on 18 September 2024
* EliasAntonakos at ] made several reverts in favor of versions created by Rajoub 570, starting 29 September 2024: and

'''User pages'''

And now for the most incriminating piece of evidence: of Rajoub570’s userpage has the exact same structure and content to that of , with five user boxes in horizontal order and five categories, all identical identifications.
* EnfantDeLaVille’s user boxes: from Lebanon (nationality), a Maronite (religion), geography (interest), hiphop music (interest), French (citizenship)
* Rajoub570’s user boxes: from Palestine (nationality), Muslim (religion), Middle Ages (interest), Ottoman Empire (interest), Islamic Architecture (interest)
* EnfantDeLaVille’s categories: Lebanese Wikipedians, Maronite Wikipedians, and the rest interests
* Rajoub570’s categories: Palestinian Wikipedians, Muslim Wikipedians, and the rest interests. ] (]) 14:06, 2 January 2025 (UTC)

'''Further evidence on demographic history'''

{{ping|Barkeep49}} Of course, that doesn't make sense, but that's not what the behavioral evidence I presented above points to, so it a closer look will show, as Nableezy mentioned, that it is anti-Palestinian content being propagated, characteristic of an Icewhiz sock.

This anti-Palestinian and anti-Arab content is denying the indigenous nature of Palestinians by over-amplifying their connection to the Arabian peninsula, and by controversially claiming that some Arab tribes are originally Jewish. Propagation of this material has been done in tandem with other Icewhiz sock, as demonstrated above and as I will further expand on below.

An admin just now restored the deleted ] article to my talk page: ], and it shows exactly the same pattern that I have described above: Rajoub570 intervening there a single time to add content from a Hebrew-language paper on how Palestinians trace their ancestry from the Hauran region, i.e. outside of Palestine.

You're also right about the evidence about Arab family names and second language choices being unconvincing, but that is when they are taken alone. When the full picture is seen collectively, the behavioral evidence clearly points out to an Icewhiz sock. ] (]) 19:26, 2 January 2025 (UTC)

'''Connections to sockmaster Tombah'''

{{ping|Barkeep49}} Thanks for the pushback, I genuinely appreciate it, this shows that SPIs are always taken seriously, and that false positives are very rare. As an Arabic speaker myself, I have now taken a closer look at their Arabic WP contributions, which showed me some further interesting but worrying results:

1- Dura, Hebron:
* states that the user is a Palestinian from the village of ].
*This seems to be in line with the aforementioned choice of name by Rajoub570, since the Rajoub family is indeed from Dura, Hebron; and the user knows this themselves as they there.
* Tellingly, however, their user page says اسمي رجوب aka my name is Rajoub, which is clearly a red flag as Rajoub is a last name not a first name; no Palestinian nor Arab identifies themselves using their family's name this way. Nor would they call their families "clans".
* Several of Rajoub570's edits on Arabic WP relate to adding pictures of Iranian mosques, which is an odd interest for a Palestinian from the West Bank.
2- Connections to Tombah:
* As {{ping|nableezy}} mentioned, they had a case against Rajoub570 as a suspected sock of Tombah last year, which was unsuccessful.
* Worth noting that the Dura, Hebron article in English WP was edited by Rajoub570 and 12 times by sockmaster Tombah.
* Tombah has , of which were edits to the Dura, Hebron article.
* Way too many article matches between Tombah and Rajoub570 of oddly specific articles
3- Knowledge of Arabic:
* These related families of socks seem to have at least one individual remotely capable of some Arabic with the aid of google translate, namely Icewhiz sock OdNahlawi who has on Arabic WP.
* Rajoub570 maintains a strict use of an overly neat modern standard Arabic, which is unusual in a setting like a or to other users.

{{ping|Rosguill}} And you are right, making a few token edits on Arabic WP to avoid suspicion is a trivial sacrifice. However, I am afraid that Arabic WP could also be subject to this kind of systemic manipulation, through different clusters of users.

I have so much more to say, but this will be a story for another venue. ] (]) 21:40, 2 January 2025 (UTC)

'''Further evidence linking with EnfantDeLaVille'''
* Rajoub570: Rajoub570 made this comment as part of an ANI report complaining that a user, among a number of things, called Israel a rogue state.
* EnfantDeLaVille: EnfantDeLaVille made this comment as part of an AE report filed against them for a number of things, among them, giving Israeli premier Netanyahu's statements undue weight in an article's lede. ] (]) 09:44, 3 January 2025 (UTC)

====<big>Comments by other users</big>====
:<small>''Accused parties may also comment/discuss in this section below. See ].''</small><br>@] I dont think Rajoub's editing can reasonably be described as "pro-Palestinian content". I ] this editor as a potential sock of Tombah before and was told unrelated however. Have no comment on any connection to Icewhiz, would surprise me, but I personally remain convinced of my earlier view on what prior account they may have had. But the part on "making pro-Palestinian content" is in my view completely wrong. The editing behavior of a person saying they are Palestinian but editing mostly with a position that can best be summarized as "Palestinians arent real, they're just Arab immigrants" and primarily citing material from Hebrew journals published by a university in an Israeli settlement is not what I would call "pro-Palestinian content". ''']''' - 19:11, 2 January 2025 (UTC)

*FWIW, for me, from a statistical distance perspective, the closest match to Rajoub570 is Owenglyndur, significantly closer than other actors. This might be reflected in some of the page intersections at multiple pages with low revision counts and unique actor counts (see table below).
{{cot}}
{| class="wikitable sortable"
!rev_page!!page_title!!page_namespace!!namespace_desc!!Rajoub570 editcount!!Owenglyndur editcount!!page_rev_count!!page_actor_count
|-
|23267||Palestinians||0||(Main/Article)||3||2||8981||2215
|-
|28333||Samaria||0||(Main/Article)||2||2||1604||756
|-
|82886||Tiberias||0||(Main/Article)||1||1||1711||698
|-
|323332||Nahariya||0||(Main/Article)||1||1||561||281
|-
|1519509||Tel Arad||0||(Main/Article)||1||25||341||151
|-
|5379955||Ma'ale Levona||0||(Main/Article)||1||1||141||76
|-
|8736327||Suba, Jerusalem||0||(Main/Article)||2||2||283||91
|-
|9608366||Aboud||0||(Main/Article)||1||1||337||113
|-
|13269758||Sebastia, Nablus||0||(Main/Article)||2||1||389||140
|-
|13956939||Teqoa||0||(Main/Article)||1||3||378||111
|-
|14565789||Beit Ummar||0||(Main/Article)||11||1||237||96
|-
|14895600||Awarta||0||(Main/Article)||3||1||217||80
|-
|15306482||Beitunia||0||(Main/Article)||3||3||198||75
|-
|16703154||Qarawat Bani Hassan||0||(Main/Article)||5||7||224||58
|-
|18101397||Beit Ur al-Fauqa||0||(Main/Article)||12||2||200||62
|-
|24018856||Khirbat Umm Burj||0||(Main/Article)||1||36||168||52
|-
|34824719||Jalud||0||(Main/Article)||2||1||91||38
|-
|72892562||Khirbet Kurkush||0||(Main/Article)||1||7||56||12
|-
|76917222||Khirbet Ghuraba||0||(Main/Article)||14||2||20||6
|}
{{cob}}
:Owenglyndur has been categorized as a Galamore sock/possible Icewhiz sock. I have no idea whether that is correct, but I would not rule out a connection to the ] group as both Rajoub570 and Owenglyndur are statistically close to that set of actors. ] (]) 03:01, 3 January 2025 (UTC)
*Here are by Rajoub570. Here is a claim by EnfantDeLaVille,. Misplaced Pages requires us to assume good faith, but in the PIA topic area, the probability of encountering those special individuals who are only capable of seeing utility in dishonesty and the cynical exploitation of suffering for camouflage is non-zero. ] (]) 04:50, 3 January 2025 (UTC)
* I'm useless as a sock-catcher, so I won't comment on matches. I'll just note that Rajoub570 does not make pro-Palestinian edits. Actually much of their effort has gone into presenting "evidence" that Palestinians are recent immigrants, descendants of Jews, etc.. For example, Rajoub570 reported an anecdote about an Arab telling Israeli soldiers he was descended from Jews, with the edit summary "this is another piece of the folklore of my people and land and has important historical and modern consequences". ]<sup><small>]</small></sup> 05:42, 3 January 2025 (UTC)
* I agree that for whatever it's worth, this doesn't seem like a pro-Palestinian user, the edits to ar are probably to "throw off the scent." ''']'''<span style="border:2px solid #073642;background:rgb(255,156,0);background:linear-gradient(90deg, rgba(255,156,0,1) 0%, rgba(147,0,255,1) 45%, rgba(4,123,134,1) 87%);">]</span> 02:12, 6 January 2025 (UTC)

====<big>Clerk, CheckUser, and/or patrolling admin comments</big>====
*I think we've lost the plot if we're now suggesting Icewhiz is making pro-Palestinian content. I also find behavior like that listed under "Use of Arab family names" and "Second language choices" unconvincing. ] (]) 18:56, 2 January 2025 (UTC)
*:I would describe this on arwiki from January as making pro-Palestinian content. ] (]) 20:18, 2 January 2025 (UTC)
*::If the sockmaster's goal is to influence coverage English Misplaced Pages, making a few token edits on Arabic Misplaced Pages, a project that both receives much less traffic and whose pro-Palestinian bonafides are displayed as a banner on every page, seems like a pretty trivial sacrifice. It would be one thing if they had extensive participation in discussions expressing a consistent viewpoint, but a quick writeup of essentially-neutral article text doesn't seem like conclusive evidence of anything in particular. I'd be curious if editors fluent in Arabic could identify whether the edits reflect a particular regional dialect or other distinctive pattern. <sub>signed, </sub>] <sup>]</sup> 20:53, 2 January 2025 (UTC)
*:And just as a note: while this reply came only a few minutes after my comment above, I'd actually invested a fair amount of time into looking into the behavioral evidence all listed here before making either comment. ] (]) 20:32, 2 January 2025 (UTC)

----<!--- All comments go ABOVE this line, please. -->

=== 7 January 2025 ===
{{SPI case status|close}} {{SPI case status|close}}

====Suspected sockpuppets==== ====Suspected sockpuppets====
{{sock list|Icewhiz|Eostrix|BilledMammal|BePrepared1907|Free1Soul|ABHammad|UnspokenPassion|Boksi|tools_link=yes}}
{{sock list|1=EnfantDeLaVille|tools_link=yes}}<!-- Add more accounts or IPs to this template as needed -->


'''Clerical'''
Evidence relies on comparing EnfantDeLaVille with socks PeleYoetz, Galamore, O.maximov, and UnspokenPassion of the sockmaster Icewhiz:


'''Free1Soul''' was blocked as one of this set but not labelled.
*'''Common behaviors''':
:1- Occasional avoidance of engaging in the talk page despite repeated pings and talk page messages: , and .
:2- Overlapping interests in the , namely Hezbollah, Israel and the conflict area.
:3- Overwhelming and very specific start of edit summaries with the word "Add" (Add/Adding/Added): UnspokenPassion 268 times,, O.maximov 41 times, EnfantDeLaVille 99 times, Galamore 67 times if my calculations are correct.


I found it looking for accounts that look like BilledMammal and Icewhiz.
*'''Registration dates''':
:1- Galamore 25 December 2023
:2- O.maximov 8 February 2024
:3- EnfantDeLaVille 24 March 2024
:4- UnspokenPassion 28 March 2024
:5- PeleYoetz 9 May 2024


*'''Second language choices''':
:1-Galamore and PeleYoetz editing on Hebrew WP
:2-O.maximov editing on Russian WP
:3-EnfantDeLaVille editing on French WP


Sorry if this is not formatted correctly. I tried to copy others' sections. I've been compiling this off wiki. I can't see a size limit anywhere on here. If I have missed one please ping me from this page and I will come back and trim this. ] (]) 12:51, 7 January 2025 (UTC)
*'''Timezone''':

:- All five users never edit between 22 and 4 UTC.
'''What I noticed'''

I have been trying to improve some of the pages started by Icewhiz puppets, and I saw those accounts deleting cited content on multiple other pages, alongside that I also saw the mass rollback by BilledMammal. It is difficult to quantify or compare "deletes a lot", but I also found more specific similarities in what they add.

'''<big>Reporting</big>'''

On 21 March 2022 '''BilledMammal''' was first raised in the Icewhiz sock archive. At the time it looked unlikely, but since then there was an attempted mass removal of content using rollback (the thing I noticed) and a very large number of edits during the year before BilledMammal went quiet.

'''BePrepared1907''' also deletes a lot of sourced content with similar themes, there are between the 3 but I haven't looked at any of these in depth yet. There is a swarm of accounts with a few dozen edits around BePrepared1907.

I should probably disclose BePrepared1907 has been reverting a lot of my edits recently, so I might be biased.

'''<big>Masters</big>'''

'''BePrepared1907''' could belong to a different set, but personality seems like BilledMammal's.

'''BilledMammal''' looks vividly like the original Icewhiz account.

Comparing things I noticed in BilledMammal history to most active Icewhiz accounts, the one in the middle Eostrix changes tactics, then a year or so ago BilledMammal became a monolingual English speaking version of Icewhiz. BilledMammal works only in English, I don't think I've ever seen an account with that many edits and

'''ARBPIA_activity_statistics_complete'''

BilledMammal has created

Some people have mentioned irregularities in these, relating to:
* Onlineone22
* MurrayGreshler
* Kentucky Rain24
* Izzy Borden
* Red Slapper
* O.maximov
* UnspokenPassion

'''Interaction with those'''

{{sock list|tools_link=yes|Icewhiz|Eostrix|BilledMammal|BePrepared1907|Onlineone22|MurrayGreshler|Kentucky Rain24|Izzy Borden|Red Slapper|O.maximov|UnspokenPassion}}

'''<big>"deletes a lot"</big>'''

They look similar, but what's normal?

BilledMammal's top two most edited pages show more removals than additions

'''BilledMammal'''
* Most edited page ], about half of their top edits remove content
* Second-most edited page ], more than half of their top edits remove content.

'''Icewhiz''' - Has a similar examples in their top few most edited pages
* ] -
* ] -
On others Icewhiz is removing a lot, but probably not an abnormally large amount?

'''Update "deletes a lot"'''

Recent edits by '''BePrepared1907''' (past few days) are predominately deletions. {{socklist|BePrepared1907}}

'''Kentucky Rain24:'''
One of their top pages ] was

] (]) 20:00, 8 January 2025 (UTC)

'''<big>Timeline</big>'''

6 August 2012
* Icewhiz account created on Hebrew Misplaced Pages

30 January 2017
* Icewhiz account created on English Misplaced Pages
*
* Icewhiz active

29 March 2019 Icewhiz gets a contentious topic notice for Israel–Palestine

BilledMammal
* Created 24 April 2019
* A few edits per month
* zero from 20 September 2019 to 4 December 2019

1 October 2019 - Icewhiz blocked

BilledMammal
* 14 edits in December 2019
* vanishes on 6 December 2019

Eostrix on English Misplaced Pages
* 15 October 2019 to 20 October 2021

18 May 2021 and

3 July 2021 - Saturday approx 4:00am UTC
* BilledMammal updated to extended confirmed user.

20 October 2021 - Eostrix gets blocked
24 October 2021 - for both the Arab–Israeli conflict and the Holocaust, 12 hours apart. Both topics that the Icewhiz and socks were clashing with people over. BilledMammal responded to the earliest suspicions by making an arbitration complaint about “Insinuation of sockpuppetry”
20 March 2022
* BilledMammal first raised in the Icewhiz sock archive.
* Ruled out without a check.

1 October 2023
* BilledMammal started messaging people on their talk pages about 1RR violations, Icewhiz also made an unusually large number of complaints about this” (see last section).

'''<big>Edits on the same pages</big>'''

The Holocaust and the Arab Israeli conflict are sufficiently interconnected (e.g. ]) that they are not a suspicious combination, but BilledMammal suddenly attracted attention in both topics 3 days after the most active Icewhiz sock was blocked.

BilledMammal and Icewhiz also mention some very specific matching points years apart.

]
* both IW and BM were
]
* Icewhiz raises ] as a
* BilledMammal raises “]” specifically, while making a point of claiming to not know much about it, “while I have, regretfully, no knowledge of the ], and minimal knowledge about the classification of ] as a genocide”.

'''WikiProject_Deletion_sorting/Companies'''

BilledMammal made their 14th edit on 20 September 2019 nominating something for deletion, with terminology that doesn't seem to fit someone newly autoconfirmed?

BilledMammal also added it to wikiproject deletion sorting at ]

Icewhiz was active in that project → 82 edits from 28 November 2017 to 29 August 2019

While BilledMammal was dormant → Eostrix nominated 3 pages in 2021 and one in June 2020

'''<big>Shared pages are mostly in administration</big>'''

BM and IW have both made hundreds of edits on some admin pages.

BM and IW Ranked 12th and 15th on top editors on ] -

'''<big>Interaction with others</big>'''

I decided against providing most examples I saw from Arbitration/Requests/Enforcement. Some look similar, but I didn't feel right including the complaints against other people as examples. They also leave some similar messages on user talk pages. That feels wrong to share here without permission, but asking permission makes an even more awkward situation. If there was a way to make a pooled anonymous word frequency analysis for the namespace "user talk" that might be informative? I tried one thing I noticed, but systematic would be better. Like a word cloud?

'''Edit summaries that contain “1RR”'''
{{anchor|1RR}}
I attempted something quantitative.

A frequent topic for BilledMammal was the '''1RR''' – I searched the edit summaries of BilledMammal and the Icewhiz socks for edits relating to this.

The original Icewhiz made an abnormally high number of 1RR complaints. Other Icewhiz socks have made occasional complaints, sometimes lodging very detailed complaints to arbitration / requests / enforcement.

I can't find any other editors on Misplaced Pages who use this rule as much as Icewhiz and BilledMammal, I checked a few other people in the same threads, most had under 100. For the only editor I found with more mentions of “1RR” than BilledMammal, their edits mentioning “1RR” were over a period of more than ten years, whereas BilledMammal's were mostly within a window of 10 months.

The amount of detail on arbitration enforcement reports by '''11Fox11''' and '''Free1Soul''' resembles complaints made by BilledMammal
'''BilledMammal''' = Over 270 edits contain “1RR”
* mostly from 1 October 2023 to 12 August 2024
* then 6 were on 8 November 2024
*

'''Icewhiz''' = Over 160 edits contain “1RR”
* from 11 June 2017 to 15 September 2019
*

I tried to fill the gap by searching the arbitrations archives for 1RR, that might be how I found Free1Soul or they could have come to my attention as a "deletes a lot" account. I found a few extras, a few of those were already labelled Icewhiz socks, but the gap is mostly full of Eosterix making thousands of sock complaints.

Free1Soul = 4 edits contain “1RR”
* 16 October 2021
* Free1Soul

11Fox11
* 4 edits contain “1RR”
* On 30 September 2021–11Fox11 a very detailed 1RR complaint.

ABHammad = I found only one but it's unusually threatening, “Please self-revert, or be reported to AE”.

Kentucky Rain24 = showed up in a search, but it revealed that made a new section with “1RR” in the heading, but not the edit summary.

'''Gaps in 1RR complaints'''

I checked all the confirmed Icewhiz accounts but not all the suspected.

Gaps (not counting when the Icewhiz are being accused or defending someone)
* 8 November to present
* 12 August 2024 to 8 November 2024
* 16 October 2021 to 1 October 2023
* 15 September 2019 to 30 September 2021

When looking for possible undiscovered socks I found “Free1Soul” who is blocked as an Icewhiz sockpuppet but not labelled or in the categories.

There could be undiscovered socks in this gap, but I've not found any that look likely, and most of the gap is filled by Eostrix making thousands of edits about socks. Eostrix has 3284 edits that contain “sock”

'''Collaboration on Arbitration Enforcement Requests'''

These sets all seem to be overlapping?

7 November 2024 - BilledMammal lodged and enforcement request and
<!-- Template:Unsigned --><small class="autosigned">—&nbsp;Preceding ] comment added by ] (] • ]) </small>

'''<big>Editor interaction</big>'''

'''BePrepared1907''' and '''BilledMammal''' - I think I've seen them do very convoluted things, they follow content to new pages if things get split or merged, one puppet works on the old page and one on the new. I couldn't keep track of it, but I think that's what I saw.

- '''UnspokenPassion''' then '''BilledMammal''' takes over.

'''<big>Cooperation on misleading referencing</big>'''

Again, declaring bias because a lot of this relates to my own edits being reverted, but I think I can see a general strategy used by these accounts.

Others might be able to find other puppets doing the same thing.

There are multiple puppet-like accounts, including BePrepared1907, protecting UnspokenPassion's repeated use of the same few pro-Israel sources in the same article. UnspokenPassion, and possibly others cited the same Israeli academic over 40 times on one page. They also cited the same paper from Haifa University over 20 times on one page.

As far as I can tell the things they cite are legitimate sources, but they do favour Israel are not notable enough to cite that many times.

Unspoken passion hid this by making the citations refer to a specific page. It looked like many sources were cited, but the majority were page references for a tiny number of actual sources in the bibliography.

When I have tried to flag things as "one source section" or "additional sources needed" the puppets removed it as "tag bombing" after someone restored them, a different suspected puppet removed it.

They also removed attempts to add attributions.

'''<big>3rd suspected puppet</big>'''

'''Boksi'''

{{Sock list| master= Icewhiz | Boksi | BilledMammal | UnspokenPassion | Boksi | BePrepared1907 |tools_link=yes}}

'''Boksi''' showing '''BePrepared1907''' and '''BilledMammal''' traits and helping '''UnspokenPassion'''
* Speedy delete of ]
* Borski deletion nominating and BilledMammal rollback (note against different users but same page)
* , edit summary: "rm POV intro since both sides faced massacres and terror", replaced a list of massacres with: "During the ], massacres and acts of terror were conducted by and against both sides".
* "undue weight" notice for Mogadham 2003.
* attribution for Moghadham 2003.

Additional info from IOHANNVSVERVS: I have concerns of Boksi engaging in pro-Israel POV pushing generally, and here is Boksi restoring a reverted edit of BePrepared https://en.wikipedia.org/search/?title=Palestinian_suicide_attacks&diff=prev&oldid=1268421917, https://en.wikipedia.org/search/?title=Palestinian_suicide_attacks&diff=prev&oldid=1268141377. ] (]) 19:47, 9 January 2025 (UTC) Also see https://en.wikipedia.org/Talk:2024_Neot_HaKikar_shooting#Restoring_sock_edits. ] (]) 19:49, 9 January 2025 (UTC)

'''<big>Edit segregation</big>'''

They '''segregate topics''', the disposable puppets focus on the topics '''BilledMammal''' avoids. The simplest is '''BilledMammal''' works on mainly new pages about things that happened after '''Icewhiz''' and '''Eostrix''' were blocked.

'''BilledMammal''' avoids making any edits to specific pages, despite other edits showing intense interest in the page or topic. e.g. ]: both BilledMammal and Icewhiz edited the talk page dozens of times, but only Icewhiz ever edited the page.

'''<big>Editor interaction analysis limitations</big>'''

We really need a control column in the editor interaction analysis. It needs the option to add all pages in a topic to the list. That will mean you can distinguish bad actors from good faith editors with shared interests.

Alternatively, if we could include all pages by every editor instead of only those with overlap.

Currently a system of disposable socks who are careful to never edit the same pages is invisible. Whereas if you have "all pages in topic" as an additional column you'll be able to catch systems working together.

If a collection of accounts cover a whole topic without ever editing the same pages, that's suspicious. The active master of that set is likely to be an unusually rule-abiding editor who has edited all those pages.

] (]) 01:23, 9 January 2025 (UTC)

'''<big>Hypotheses and suggestion</big>'''

From what I've seen I suspect that Icewhiz uses two types of puppets. But one of those would be better described as master. They have a main account that looks like an experienced editor and simultaneously a collection of disposable accounts that create new articles.

The ban revert policy probably exacerbates the second problem, because creating multiple articles with one account means they ALL get deleted when the account gets caught.

If you change to needing the AfD process to delete a whole page, then instead of making a greater number of accounts they will write better articles. They could also write more subtly biased articles, but if the AfD process flags them as sock created then other editors can check for deceptive referencing and verify sources.

They could also keep creating sock armies to avoid facing that scrutiny, but the effort needed to bring them all up to 500 edits will be a bit less worth it, particularly the higher level of effort needed to do that without being obvious.

This group are also clearly very active in the AfD process, people will find ways around any system, but it at least will put less direct pressure on creating very large numbers of disposable article creation accounts.

And if people selectively use the AfD system to remove things for political reasons, it at least won't be invisible. Whereas quick delete is designed to make things disappear untraceably. Having things disappear invisibly in a contentious topic seems very counter productive towards trying to find and stop people who are editing in a manipulative way.

] (]) 19:01, 8 January 2025 (UTC)



*'''Self-identification'''
:- One of the banned suspected socks of Icewhiz is ], resembling the proud Lebanese tag on EnfantDeLaVille's userpage.


*'''Odd interest in banks''':
:1- O.maximov most edited articles are Israeli banks
:2- EnfantDeLaVille odd two uploads to WP were logos of Lebanese banks; in one of which they seem to have used the unusual Arabic word of مصرف instead of بنك to describe the bank. ] (]) 14:32, 5 November 2024 (UTC)
::There are way too many accounts which are claiming that they are Arab with very similar characteristics so I will build another case soon. ] (]) 15:19, 5 November 2024 (UTC)


====<big>Comments by other users</big>==== ====<big>Comments by other users</big>====
:<small>''Accused parties may also comment/discuss in this section below. See ].''</small>
So, when they said "{{tq|The events in Lebanon in recent months catch me at a sensitive time, and the suffering of my people from the situation in my homeland is unbearable.}}" ] they were lying. That's nice. ] (]) 15:14, 5 November 2024 (UTC)


I've been drafting another batch SPI, and BePrepared1907 was part of that batch (disclosure: this account was brought to my attention ]), so here is some additional behavioral evidence related to that account:
For interest, out of the 658 accounts that registered this year and have qualified for extendedconfirmed privileges, a much lower number than I expected, 91 of them have been blocked for ban evasion/sockpuppetry. ] (]) 16:08, 5 November 2024 (UTC)

] the old "various causes" / "numerous factors" edit war--note this is over a period of 3 months: ], ], ], ], ], ]

]: ], ], ], ], ]

]: ], ]

]: ], ]

] - an article created by sock ]: ], ]

]: ], ]

] is an article started in 2022 by BePrepared1907 that has had less than 20 revisions since, one of them by PeleYoetz ()

I know מתיאל ("Matiel") was determined "unlikely" above at ], but nevertheless:
* ]: ], ] (see also: ])
* ]: ], ] (not the same edit but similar content)

I've also had some concerns about BilledMammal=Icewhiz, but hadn't raised them on-wiki because I was worried I was just being paranoid and lacked any real "smoking gun." Since the connection is "Possible", however, I will post some behavioral evidence about that suspected connection in the next 24hrs. I'll try to post the batch SPI <del>in the next 48</del> <ins>hopefully by this weekend</ins>; the other accounts in that batch may shed some light on BePrepared (or even BM). ] (]) 19:05, 7 January 2025 (UTC) <ins>Updated. ] (]) 02:31, 9 January 2025 (UTC)</ins>

:Some additional items about BePrepared () I forgot to include above:
:* Account created Dec 2014 but doesn't start editing until June 2015
:* Makes less than 100 edits between June 2015 and Nov 2023
:* In Nov-Dec 2023, makes 400+ edits, in a clear rush to XC
:* Gets XC on Dec 3, 2023, after which their editing drops to almost zero (about 25 edits between Dec 3 2023 and August 2024)
:* July and early August are when I filed the ] (Jul 22-31), ] (Aug 4-16), ] (Aug 11-17), and ] (Aug 11-24) AEs; BePrepared returns to activity on Aug 13--two days after the HaOfa and PeleYoetz AEs were filed--and subsequently, he repeats the edits of these editors (diff'd above)
:* In , "Adding" appears in the edit summaries 222 times
:* I don't remember who, but I think I remember that scouting was one of the topics of interest of some of these known socks; see BePrepared's user page and contribs re: scouting
:* shows editing mostly in the 12-14:00 UTC 2-hour-window; looks the same or similar as many other socks, e.g.
:The rush-to-XC, followed by dormancy, and a return to activity after other socks in the group "get in trouble," is a pattern we've seen throughout this group. ] (]) 19:59, 7 January 2025 (UTC)
:I disagree with BK's comment about "major process work". Icewhiz is the user who taught me how to make ], and you can see his coaching of me at ]. It was the similarity -- both in choice of target (]) and methodology -- between my collaboration on NFooty with Icewhiz and my collaboration with BM on Lugstubs that initially raised my suspicions. ] (]) 20:06, 7 January 2025 (UTC)
::@] I don't know where I am supposed to respond to comments, move this if needed. In one of the threads above someone raises the possibility of multiple people. It looks quite plausible that this is an actual different person following the same playbook. The timecards are different, IW is only waking hours in a Middle Eastern work week, Sunday to Thursday, BilledMammal is active at a lot of times IW never was. Possibly the person who was running the account actually moved (which will make checkuser very difficult) or possibly they deliberately did things first things at weird times to look different. I left out some of the more speculative parts of what I had accumulated off Wiki, but the first thing BilledMammal does is make a draft article about Melbourne at a time that makes sense for that time zone. They also seem a bit vague about where they are pretending to be from, Australia or New Zealand. They also do a lot of automated edits that obscure the human edits, if there is any way to remove automated edits from what is in the timecard that might help. ] (]) 03:52, 8 January 2025 (UTC)
:: If you are compiling a report, look for pages you would expect them to be most active on but that they have never edited, one I noticed was the main page about the Hostage crisis during the Israel– Hamas war. They sound extremely passionate about that topic on a few other pages and talk pages, but they have never edited the main page about it. This is not normal? ] (]) 19:01, 8 January 2025 (UTC)
:::@]. If you are doing that can I suggest one to include: Dclemens1971.
:::I'm not sure what the rule is on where to mention things. I am not accusing that one as such, but it looks worth checking. It really looks like them from the profile page, then I put it in an editor interaction table and all those deletion sorting pages showed up, including one about sport. ] (]) 08:27, 9 January 2025 (UTC)
::::@]: Why did you mention {{u|Dclemens1971}}? Please clarify this. —] 01:46, 10 January 2025 (UTC)
:::::@] @] I have no idea what this is about (Icewhiz?), but ANYONE who nominates a lot of AfDs, as I do in my capacity as a New Page Reviewer, will show up in editor interaction charts for the deletion sorting pages, because any time you nominate an article using XfD, it automatically edits the nomination onto those sorting pages. And I nominate AfDs across all categories. So of course I overlap with any other editor who was active at AfD, -- but that's just a function of how deletion discussions are created. At SPI you need to provide diffs, not just interaction tables. If you are looking for overlap at SPI, overlap on the deletion sorting pages is the very last thing to look for. ] (]) 03:35, 10 January 2025 (UTC)
::On IW/BM:
::* To state the obvious: a billed mammal is not a ]
::* To also state the obvious: both share the same POV on IP issues
::* As I mentioned above, both spent a great deal of time on reforming NSPORTS SNGs
::* It's hard to "prove" this, but the style and volume of argumentation by BM at, e.g. ] and ] strikes me as similar to IW, e.g. at ] and ]
::* Both used the foot-in-the-door approach of trying to find small agreeable compromises to advance NSPORTS reform, e.g IW at ] (proposing to raise the NFOOTY bar for youth players only), BM at ] (proposing to batch-delete only the most-obvious 1k out of 90k)
::* Both were top filers at AE, among the top 20 AE editors
::* Use of tables in an effort to prove conduct violations, e.g. ], ]
::* A lot of people use a hyphen as a dash, but both IW and BM use hyphens-as-dash a lot (not to get pedantic but also hypens-as-semicolons and other punctuation; basically, using hyphens to separate thoughts), e.g.:
::** In edit summaries: IW , BM (ctrl+f " - " on their contrib pages to find more examples)
::** In comments: IW , BM
::* There's the old no-space-before-the-signature thing of IW's , I don't know whether of that by BM is a lot or just the normal occurrence of a typo
::To be clear, I never thought the above, alone, was enough to justify an SPI report. "Vibes" ain't enough, but that's basically what I got: BM reminds of IW when it comes to I/P, NSPORTS, AE, argumentation style and effort, the use of data and tables (particularly to frame), the hyphen thing... in my view, it becomes a "too many coincidences" thing. ] (]) 02:29, 9 January 2025 (UTC)

:Never dealt with Icewhiz so I don't have much to provide here, but I will note a few important things:
:1- Icewhiz socks were not necessarily the same person; sure they collaborated and defended each other and likely occasionally gave each other their log-in credentials, but they were probably different people.
:2- Icewhiz, from my understanding, was incredibly adept at deception; so much so that one of their socks nearly ran for adminship.
:3- What struck me most from dealing with BilledMammal is that they rarely meaningfully contributed to edit articles by adding content, with their focus more on talk pages and AE filings.
:Admittedly, I initially did not entertain the idea when this SPI case was first filed. But reading through the case, namely the possible technical connection as well as the interesting oddly specific behavioral coincidences, I am pretty much prepared to be surprised. ] (]) 07:56, 9 January 2025 (UTC)

Fixed formatting. ] (]) 01:10, 8 January 2025 (UTC)
*{{Closing without action}} ] (]) 21:21, 13 January 2025 (UTC)
*:Wait was I deleted or no? Frankly whoever organized this seemed to not be good at organizing the page for making our cases.
*:In any case I don't know what else I need to add as "proof." I'm an American, if that helps. ] (]) 12:51, 14 January 2025 (UTC)
*::@], this page is a mess. There are two sections titled ‘comments by other users.’ The one you edited first is located further down. ] (]) 15:26, 14 January 2025 (UTC)
*:::Thanks! ] (]) 15:53, 14 January 2025 (UTC)

@], can I request you compare '''BilledMammal''' and '''BePrepared1907''' to each other? They seem similar in personality. It might show a technical connection that BilledMammal and Icewhiz don't. ] (]) 00:40, 9 January 2025 (UTC)

: @] Also, what does "ArbCom" stand for? And what is the difference you have seen between the users?
: I saw some very similar Arbitration and Enforcement reports filed by BilledMammal and the socks, if that is what you mean? But I felt uncomfortable sharing a reports about other people as examples. ] (]) 08:01, 9 January 2025 (UTC)
::@] ] is the Arbitration Committee, of which I am one of the sitting members. ArbCom sometimes gets private information, which we can't share. ] <sup>]</sup>] 08:08, 9 January 2025 (UTC)
:::@] I would like to add Borski to the list, vs BM and BP, edit links in a moment. ] (]) 18:48, 9 January 2025 (UTC)
::::] above. Sorry this is not very organized. ] (]) 19:02, 9 January 2025 (UTC)
::::Boksi* ] (]) 19:50, 9 January 2025 (UTC)
:@] @] @]
:Borski is a duck? ]? ] (]) 19:24, 9 January 2025 (UTC)

Or from what ] said below, checking Icewhiz vs '''BePrepared1907''' would be warranted. ] (]) 01:23, 9 January 2025 (UTC)

Personality and tone seem similar for '''BilledMammal''' and '''BePrepared1907'''. I have looked more closely at the recent editors, there's not much direct interaction with the originals so I've mostly looked at numbers for those. I haven't seen much of Icewhiz or Eostrix personalities. But I would expect someone to build better skills with organizing people over time. ] (]) 02:26, 9 January 2025 (UTC)

'''Free1Soul''' is still blocked but unlabelled. Is there someone I need to ask about that? I am not even sure if they were guilty, just the incongruity seems wrong. ] (]) 07:55, 9 January 2025 (UTC)
* No comment on the other two suspected accounts as socks of Icewhiz, but I'd be lying if I said I wasn't a tad concerned that the BilledMammal filing is retaliatory, considering IMB, the filer, is ] as a possible sock of ], whom ] (which led to Irtapil's block). ] ] <span style="color:#C8102E;"><small><sup>(])</sup></small></span> 00:41, 10 January 2025 (UTC)
*:And IMB has now been sock-blocked after admitting to being Irtapil. Adding in the fact that Dclemens, who he also found “suspicious,” had also filed an SPI against a past Irtapil sock, I’m about fully convinced that this report with respect to BilledMammal and Dclemens specifically was ] in nature. ] ] <span style="color:#C8102E;"><small><sup>(])</sup></small></span> 15:14, 10 January 2025 (UTC)
*::If you assume it was retaliatory in nature for the sake of argument what useful conclusions could be drawn from that? I think it is none. And I doubt that the assumption would be valid anyway. A simpler explanation is probably that irtapil believes what they said. I don't agree with many of their conclusions, about BilledMammal for example, but I do agree that other accounts named could be socks. The topic area has plenty of socks active every day. I don't think an answer to the question "was it retaliatory?" tells me anything useful. Socks see socks of the opposite valence. The first 2 cases against IMB were filed by socks. They were not processed. The case was picked up by an editor in good standing. I don't know whether the editor prepared it them self or whether they received assistance from another party. I don't think it matters because it is unknowable. I think what matters is that only non-socks should have their reports processed, just like I think only non-socks should have their content retained. Editors in good standing can re-use and re-file evidence from this case in a new case. And I hope ArbCom reads Irtapil's statements on ] and thinks about ways to try to reduce sockpuppetry, or let's say, increase honesty in the topic area, that don't just rely on an unwinnable whack-a-mole approach. There are certainly other experienced editors evading bans in the topic area that could speak openly about it. Maybe we could learn something useful. ] (]) 16:17, 10 January 2025 (UTC)
*:::I.M.B. is now a confirmed sock of Irtapil by self-admission. So yeah, it was probably retaliatory, and probably frivolous. ''']'''<span style="border:2px solid #073642;background:rgb(255,156,0);background:linear-gradient(90deg, rgba(255,156,0,1) 0%, rgba(147,0,255,1) 45%, rgba(4,123,134,1) 87%);">]</span> 19:37, 10 January 2025 (UTC)
*::::Since intent is unverifiable and whether a suspected sock is a sock has no dependency on the intent of the filer, I think opinions on the matter have no utility. ] (]) 04:35, 13 January 2025 (UTC)
*:::Oh and to answer your question Sean, no I didn't have any assistance in the filing, I prepared it myself. I had already suspected I.M.B. and I did see the cases that were filed by presumably-Yaniv/AHJ socks, but they didn't have any evidence so there wasn't anything I used from those. ''']'''<span style="border:2px solid #073642;background:rgb(255,156,0);background:linear-gradient(90deg, rgba(255,156,0,1) 0%, rgba(147,0,255,1) 45%, rgba(4,123,134,1) 87%);">]</span> 21:16, 10 January 2025 (UTC)
*::::I wasn't asking, but thanks for the reply. I would be okay with a world where we could outsource some ban evasion detection to experienced ban evading actors, as long as the evidence they prepared and presented was high quality and went into a designated sandbox where it could be evaluated by editors in good standing, and maybe picked up, rather than injected straight into the normal SPI system. ] (]) 04:35, 13 January 2025 (UTC)

Just a passing comment as someone who has been a target of major harassment from Ice - I've had some brief interactions with BilledMammal and never thought there was any similarity between that account and Ice. That said, for what it is worth, I have also entertained the idea that Icewhiz is more than one person (i.e. that it/they is a shared account run by a some group). Food for thought. --<sub style="border:1px solid #228B22;padding:1px;">]&#124;]</sub> 02:32, 12 January 2025 (UTC)

*I've interacted with BM on a number of occasions (but never knowingly with IW as far as I can recall). I have no experience as a CU and probably wouldn't be much good at it, so I'm not going to act as if I know better than people here. That said it seems pretty unlikely that BM could be a sock set up simply to garner a high edit-count and then transition to the IP field to cause chaos there. This is based primarily on the amount of work they had to do in cases like ] being way beyond the amount that you would need to build up an edit-count, and indeed being the kind of work that serves to turn people against you rather than build up social capital. I found BM's shift from sports bios to IP an odd thing to do, but possibly explicable by the way that their efforts in that field had struck a wall after ]. ] (]) 09:13, 14 January 2025 (UTC)

====<big>Clerk, CheckUser, and/or patrolling admin comments</big>==== ====<big>Clerk, CheckUser, and/or patrolling admin comments</big>====
*I'd say the CU to BilledMammal is {{possible}}, but some ArbCom knowledge plus my general knowledge of BilledMammal makes me think it's not super likely. ] <sup>]</sup>] 18:25, 7 January 2025 (UTC)
* Similar characteristics to the most recent groups. Blocked, locks requested. ] (]) 14:48, 5 November 2024 (UTC)
*I have not done a CU, because I find this behavioral evidence completely unconvincing even without ArbCom's knowledge based on my deep knowledge of BM compared to IW. For instance, BM's ability to do major process work of the kind he has done around fundraising and SNGs is behaviorally incredibly different than IW - even with a goodhand like Eostrix. This is categorically a different kind of analysis than my skpeticism than the report above about Rajoub570, where I had skepticism but take seriously the pushback. No comment on BePrepared1907 as there really isn't evidence there (and this is acknowledged as such). ] (]) 19:40, 7 January 2025 (UTC)
*:I look forward to seeing the fuller information and additional filing as I am inclined from the evidence presented so far to run a check on BePrepared. Waiting until then for sake of efficiency as much as anything. As for the further BilledMammal evidence, I remain unconvinced. It wasn't the topic areas that was unconvincing to me as much as the way BM went about seeing change compared to how IW would go about seeking change. I will spend some time doing some analysis of each of their contributions at RSN - a forum I know both have lots of edits on and where if I recall correctly BM did some RfC work - to see if I need to re-examine that. Is it possible BM was the return of some other editor? Sure but that is very different than saying he's Icewhiz (especially because at first glance some of IW's behavioral "tells" from 2022 don't seem to be true of BM). ] (]) 20:26, 7 January 2025 (UTC)
*{{onhold}} to give {{u|Levivich}} another day or so. I anticipate what he has will be a seperate filing, but keeping this "evidence" here until then seems productive. If that doesn't happen in a day or so and/or if this isn't useful for that I will then close this one down. ] (]) 15:42, 10 January 2025 (UTC)

----<!--- All comments go ABOVE this line, please. --> ----<!--- All comments go ABOVE this line, please. -->


===08 November 2024=== ===11 January 2025===
{{SPI case status|checked}} {{SPI case status|close}}
====Suspected sockpuppets==== ====Suspected sockpuppets====
{{sock list|1=ABHammad|tools_link=yes}}<!-- Add more accounts or IPs to this template as needed --> {{sock list|1=Hsilvers|2=Sethy017|3=Ank2408|4=Anon123987|5=SECschol|6=Pyramids09|7=Mk8mlyb|8=Benjy613|9=MrBismark1871|10=Boutboul|11=IntrepidContributor|12=BePrepared1907|13=Shoogiboogi|14=MagyarNavy1918|15=DancingOwl|16=Vegan416|tools_link=yes}}<!-- Add more accounts or IPs to this template as needed -->


Here is . The common thread for most of these accounts are people showing up on or around Nov 30, when ARBPIA5 opened, and making the same edits/talk page comments as the known socks in these groups (e.g., "colonization," etc.).
Evidence is based on comparing ABHammad with sockmaster Icewhiz.


'''Timeline:''' '''Throwaway accounts'''
These may be socks, or may just be people responding to off-wiki canvassing efforts, but they turned up in the searches and "fit the profile" so I'm including them, despite the lack of edits. Contribs are linked below:
* : 2 edits, 1 of which is an edit request about "colonization" at the ] article--that old chestnut. The edit was made on Nov 29, the day before ARBPIA5 opened (its opening date was announced head of time, and several of the socks in this group showed up to that article on or about the opening date). The second edit was to change engvar at ], a fairly obscure sub-article that has also been edited by ], a sock in this group, as well as CU-blocked accounts ] and ] (I don't know anything about those two accounts and whether they are related).
* : 7 edits, the first 5 are to an article about a kosher certification agency. 6th edit was to ] to complain about "colonization" (that old chestnut!), and ] read as virtually the same as ] (lack of capitalization, punctuation, etc.)
* : 1 edit, on Nov 30 (day PIA5 opened), to ], to agree with ] (mentioned below); later ] (mentioned below in the new users section) also posted to agree in ]
* : 9 edits, all about "colonization" and related, from November
* : 1 edit on Dec 3, making an edit request to change "the sentence" at the Zionism article ("...as few Palestinian Arabs as possible"), which has been the subject of most of the recent off-wiki commentary. This edit request has been made a million times by throwaway accounts.
If these aren't socks, they're SPAs violating ARBECR.


'''Older accounts'''
Icewhiz has a large number of suspected socks who were banned for either being them or working with them, example from the 14 August 2022 batch: , , , . This is only a month before ABHammad created their account on 20 September 2022.


'''Rushing to defend:''' '''Pyramids09'''


]: ], ], ], ], ], ], ], ], ], ] (listed below)
ABHammad in the past couple of weeks has rushed to the defence of four of Icewhiz’s recently banned sockpuppets ], ], ], and ].
* AFAICT, only this group of socks has tried to remove "indigenous" or "native" recently (). You can see at ] and ], it's pretty much just this sockfarm arguing against "indigenous"/"native". And, of course, ] (], ]).


]: ], ], ]
Also, whenever an SPI case was opened against Icewhiz socks, ABHammad also rushed to their defence, in which they that these were different users; ultimately all SPIs ended up in a positive confirmation of sockpuppetry.


]: ], ], ], ], ] (mentioned below), ]
'''Interaction tool:'''


]: ] ("accused"), ], ], ], ]
Tool reveals several interlaps in articles, with minimum time between edits at least 1 minute long; added User:Owenglyndur to the list.
*: pretty much every edit, by any of the editors, is about downplaying or attempting to rebut the genocide accusation.


I think Pyramids09 () may be a compromised account like ] and ]. Pyramids' account was created in 2021, and they edited in 2021-2022 without, as far as I can tell, making any or many edits related to ARBPIA. Their activity drops in June 2022. Less than 90 edits in 2023. 2 edits in Jan-Feb 2024, and 3 edits in June 2024.
'''Odd contributions to commons:'''


Then, in October 2024, they become an ARBPIA SPA, and pick up with the same long-term edit wars as the blocked group, diff'd above. One of their first edits in October is to complain about {{u|Nableezy}}'s pro-terrorism userbox: ] (the diff's were oversighted). This is an well-worn give-away. On the same day, they changed their user page: ], ], ]--it's like a different person.
ABHammad’s sole odd contribution to Wikicommons is an upload of an Emirate mall’s logo,, similar to EnfantDeLaVille’s odd only upload of a Lebanese bank’s logo.


They have a very similar timecard pattern that follows the consecutive-editing theory:
'''Usernames:'''
* ] edits 5-7
* ] edits 8-10
* ] edits 11-13
* ] edits 13-14
* Pyramids09 edits mostly 17-19
* (see also ] , ] , ] )


'''MrBismark1871, Benjy613, Mk8mlyb'''
Most importantly, ABHammad and OdNahlawi are similarly structured and both Arab family names, such as ] and ].


]: About the "Zionists wanted..." sentence (]):
'''Connection with other sockmaster Dajudem:'''
*] O.maximov and a lot of geese
*] MrBismark1871
*] Benjy613, ]
*] Mk8mlyb
*] MrBismark again
*] Mk8mlyb again, ]
*] Pyramids09, ]


Here is the full .
In addition, there seems additional similarties with another sockmaster ], who has and :


MrBismark1871 ()
1- Very similar username structure to banned sockpuppets ] and ].
* Account created and first edit Oct 2021
* 130 edits Oct 2021 is highest-activity month; edits sporadically, with <30 edits/mo until Oct 2023; 63 edits in Nov 2023 and hits XC, then drops back down to <6 edits/mo from Nov 2023 until Dec 2024
* All edits seem to be about eastern Europe, nothing ARBPIA or even Middle East-related (AFAICT) until end of 2024, when they make the two Zionism reverts in Sep and Dec, plus there have been Syria-related edits recently


Benjy613 ()
2- Very similar timecards as most common edits occur 2-5 am UTC, and fewer after 12 pm: , , , .
* Account created and first edit Feb 2006
* 1500 edits in 2006 (including ARBPIA edits), less than 100 since then; 0 edits in 2022 and 2023; 5 edits in 2024, which are the two Zionism reverts, and ]


Mk8mlyb ()
3- Hyperfixations on similar topics:
* Account created Nov 2016, first edit Jun 2017, XC in 2020
(A) Golan Heights: Denial of the fact that the territory is occupied by Israel from Syria on the article’s talk page: , , , .
* 14 edits in 2022 and 2023, about 20 edits in 2024 until Dec
(B) 1948 Palestinian expulsion and flight: Calling the topic “controversial” and attacking the sources and historians critical of Israel as being “politicized”: ABHammad: , , . ]: , , .
* AFAICT none of the edits relate to ARBPIA up to that point, it's all sports and AP2
* 130 edits in December 2024, starting with the above edits to Zionism, which seem to be the only ARBPIA edits this editor has ever made, and lead to a TBAN from ARBPIA at AE: ]
* Dismissing mainstream RS like ]: ]


It's not unusual for editors who haven't edited in a long time to read something in the media and then log into their old account and make an edit. But three of them (four if you count Pyramids), each of whom appear to have only one edit to make in ARBPIA, and it happens to be the same as the others (plus a known sock)? Response to media also doesn't explain how MrBismark and Mk8mlyb knew to come back on Dec 5 when Mk8mlyb made that same revert. These may not be sockpuppets, but they're at least meatpuppets, canvassed, or otherwise coordinating with each other.
4- between ABHammad, Snakeswithfeet, and ]. ] (]) 12:40, 8 November 2024 (UTC)

'''Boutboul'''

Boutboul ()
* Account created and first edit in 2006
* Has that mostly-two-hour-window time card pattern (2000-2100)
* ~350 edits 2006-2012; 4 edits 2013-2016; 0 edits 2017-2024
* 5 edits in May 2024, and then ] (it was denied)
* 0 edits until November 2024, then begins editing more heavily starting November 11 -- that would be right after the November batch of Icewhiz/Galamore SPIs (see above)
* Hits XC on 11/11 and then stops editing for a couple of weeks
* On Nov 24, posts on Talk:Zionism arguing to remove "colonization" and change "Palestine" to "Land of Israel" -- see ]
* On Nov 30, posts ] (this, alone, merits an indef); and XC was revoked
* ] (that was declined) (note the proposed parties)
* As a reminder, Nov 30 is the day that ARBPIA5 opened
* See the DancingOwl section below for info about attempts to regain XC

'''IntrepidContributor'''

:
* Account created and first edit Jul 2022
* From 2022: ] "I haven't even used my old account in years."
* 855 edits in 2022; 29 edits in 2023; 0 edits from August 2023 until July 2024; 1 edit in July 2024
* It seems to be all Russia/Ukraine up to this point, no ARBPIA

On August 16, ]. On August 17 and 19, 2024, IC returns to activity and makes a series of votes in RFCs and RMs, some in Russia/Ukraine, but also at: ], ], ], ], ], ], ], and said, about the Gaza genocide move review, "]" In almost all of those, IC is voting the same way as HaOfa, UnspokenPassion, etc.

No edits between August 19 and Sep 7. On Sep 7, a couple of weeks after the Gaza genocide RM was endorsed at MR, an editor posted an RM to move it back to its original title. I reverted that RM. IntrepidContributor ] exactly one hour later. Spends Sep 7-11 editing around the Gaza genocide article.

I filed ] where I suggested IC was a sock of either ]/] based on timecard similarities, or Icewhiz. BK checked against Wierzba and determined them to be unrelated. BK didn't check against the IW group, and said I could file an SPI to request a check against that group. I never did because IC stopped editing in September; but now they're back in the last few days (apparently not ARBPIA-related), and since they've turned up in the EIA with Pyramids and others, I figured I'd include them here. Big-picture, it's the same pattern of editing outside of ARBPIA, then a long period of inactivity, and then returning to editing almost as an SPA to pick up where previous socks in this group left off in edit wars. I could believe one or two, but in this report, I've listed 5 in this report so far, who didn't return to editing when the war started, but rather returned in the summer/fall of 2024. It could be in response to media attention, it could be sleeper socks, it could be compromised accounts. The reason I don't think it's media attention is because these accounts are showing up at exactly the right time, at exactly the right place, and making edits that others had made weeks or months prior. I don't believe in that many coincidences, this seems like a surgical, targetted effort.

'''New accounts'''

BePrepared1907: see ] above

Shoogiboogi ()
* Account created/first edit March 2024, activity tapers down in the summer (11 edits in August, 2 in September, 0 in October); returns 11/14 (see ] and ] SPIs), XC 12/3
*]: ], ], ], ], ], ]
*]: ], ], ]
*]: ], ]
*]: ] (removing "thousands of Palestinians had been killed and Israel has been accused of genocide"), ] (removing same)
*]: ], ], ]
*]: ], ]
*]: ], ] (not the same but similar content)
*]: ], ]

MagyarNavy1918 ()
* Account created/first edit May 2024, edits steadily since then
* A bunch of ARBECR violations (Zionism-related edits, though never the actual ] article or talk page, until Nov 30) that seemed to have gone unnoticed (see contribs)
* On that magical day, Nov 30, makes their first post at ], ], and includes the false but common talking point that "The citations are mostly from Palestine studies authors" (this is not true, unless you call people like Benny Morris a "Palestine studies author").
* Still not XC at that point; hits XC on Dec 10
* Also posts ] "Guys...The Irgun Weren't Labor Zionists". Strange because the article ] doesn't say, and never said, that ] were Labor Zionists, the article always said "Irgun, the military arm of the revisionist Zionists." (In the Labor Zionism section of ], Irgun is compared with Labor Zionists.)
* Reposts that same message on ]
* Normally the above wouldn't be enough for me to include this account, but also a bunch of edits to the same obscure articles in common as various other accounts, e.g. Magyar and Kentucky Rain24 and ] at ]; Magyar and Shoogiboogi at ]; Magyar and Galamore at ]; Magyar and BePrepared1907 at ]; Magyar and Mk8mlyb at ]; there are other socks in the page histories of these pages, I haven't gone to the trouble of mapping them all out. As far as I can tell, it's about whether certain groups/people/whatever are "right" or "left" or "centrist".

'''DancingOwl, Vegan416, Kentucky Rain24'''

This section maybe should be filed under NoCal (based on the categorization of ]).
* DancingOwl (): Created Feb 2024; 6 edits until July, then a month of 46 edits, then 0 edits in August and September, comes back in October and has been editing regularly since; hits XC November 2
* Vegan416 (): created 2016, 15 edits 2016-2022, 20 edits in 2023, started editing regularly Feb 2024; hits XC March 2024
* Both in the same time zone (though slightly different from Kentucky Rain)

It's hard to "prove" the connection between these three because this isn't based on tag-team edit warring (there is fairly limited overlap, and I haven't looked through it: ), but rather on talk page bludgeoning, and the sense, from reading their extensive posts, that they are the same person.

All three are top editors to ] (), and this is unique because, I'm a top editor of that talk page, and it took me over a year to get on the leaderboard (as it were). KR, Vegan, and DO got there in under a month. Everyone else took months or years to gather enough posts to make the leaderboard.

Substantively, it's like one person: Here are KR's posts , they got blocked at the Nishidani AE. Next, Vegan picks up right where KR left off , same argument topic, same argument style. Vegan got TBANed (for attacking me) at AE. DancingOwl waited a couple of months, but basically picked up where Vegan left off : again, same arguments about "colonization" etc., same ] argument style, same fast-and-loose relationship with sources.

In addition, some overlaps with DancingOwl:
* DancingOwl and Kentucky Rain24: ]: ] edit request, ]
* DancingOwl and BePrepared1907: ]: ], ]
* Both DancingOwl and Boutbol had ECR revoked; Boutbol has made multiple requests for EC, see:
** ]
** ]
** ] - Boutboul currently pending request
** ]
** ]
** ] - Boutboul at DancingOwl's talk page
* Boutboul & DancingOwl: ], ]

I'm not sure how anyone can evaluate that without reading everything KR, Vegan, and DancingOwl wrote, which would take a long time. Maybe CUs have some language comparison tools they can use or something.

Thanks for reading all this. ] (]) 19:56, 11 January 2025 (UTC)

:I am here accused of being a sockpuppet of an editor I've never heard of based on completely random points that are entirely coincidental and unfounded. The accusation has no baring on reality and this level of obsessive scrutiny is unhealthy and sad. ] (]) 20:42, 14 January 2025 (UTC)
::Actually, you have been declared “inconclusive”, see on the bottom of this page. It means no problem. ] (]) 21:50, 14 January 2025 (UTC)


====<big>Comments by other users</big>==== ====<big>Comments by other users</big>====
:<small>''Accused parties may also comment/discuss in this section below. See ].''</small> :<small>''Accused parties may also comment/discuss in this section below. See ].''</small>
Think it’s Dajudem but don’t know how that will be proven with how old those confirmed socks are. ''']''' - 12:55, 8 November 2024 (UTC)
:Although there are some pretty interesting overlaps here. ] are now two blocked socks along with ABHammad. At ] it is ABHammad alongside 5 Icewhiz socks (OdNahlawi, Galamore, UnspokenPassion, PeleYoetz, O.maximov) and one other user opposed to the move. At ] it is ABHammad alongside three now blocked Icewhiz socks (EnfantDeLaVille, Galamore, and PeleYoetz). At ] it was ABHammad alongside OdNahlawi and Galamore until a few other users joined in a couple of days later. Over and over again it is ABHammad alongside almost by themselves a collection of IW socks. ''']''' - 19:53, 8 November 2024 (UTC)
:@] Galamore is blocked as an Icewhiz sock. ''']''' - 20:13, 8 November 2024 (UTC)
::I realize that, but the connection was very brief, and I'd like a second opinion from another CU before taking action on it. – ] 20:14, 8 November 2024 (UTC)
:::{{ping|bradv}} And Dajudem? ] (]) 20:27, 8 November 2024 (UTC)
::::Are there any recent accounts? From what I can see, the last confirmed Dajudem sock was blocked 14 years ago. CU wouldn't be helpful in this case. – ] 20:37, 8 November 2024 (UTC)
:::::Doesn't appear so; maybe a sock was later misidentified as a sockmaster, which could explain the gap. But either way, the behavioral evidence is also very interesting. ] (]) 20:40, 8 November 2024 (UTC)
::Owenglyndur isnt blocked as a sock but rather for copyvios, but adding that name shows some additional curiosities. ABHammad alongside two Icewhiz socks at ] (PeleYoetz, and Galamore), and alongside Owenglyndur at ] ''']''' - 21:14, 8 November 2024 (UTC)
:::Looking at other connections with IW socks, ] had ABHammad's first and only ever edit to that talk page to agree with Minden500. Just repeated behavior, showing up for the first time to agree with a now blocked IW sock, often in discussions with a limited number of editors, and often when ABHammad and the IW socks are the only ones arguing a point. ''']''' - 22:10, 8 November 2024 (UTC)


'''Accused parties comment'''
I read this and I ask myself how is this still allowed here. {{ping|Barkeep49}}, surely you see the '''weaponization of SPI''' happening here. We have an editor who has already received their ], yet continues to spread bad-faith allegations (here), engage in edit warring , and selectively remove content . I feel like I am being targeted by editors for providing more evidence relevant to Arbcom's upcoming case. In my case I was quick to be given a 0RR sanction. For how long are we gonna keep this policy of ignoring the continuing battleground behavior from the 'unsanctionable' club? When will Misplaced Pages finally wake up? ] (]) 22:11, 8 November 2024 (UTC)
* I find it rather ironic that {{User|Levivich}} accused me of {{tq|fast-and-loose relationship with sources}} after I was the one who posted ], demonstrating that many quotes have been truncated or presented out of context in a way that grossly misrepresents the actual claims made by the sources.

:Unfortunately, instead of addressing my criticism on its merits, {{User|Levivich}} chose to initiate this bad-faith ad hominem attack accusing me of being a ], with the only "evidence" provided to support this ridiculous accusation being the fact of living in the same time-zone as another editor {{tq|(though slightly different from Kentucky Rain}}, by their own admission), and raising multiple substantial objections to their edits (which, in my case, was what led to my becoming one of the top editors on ] page rather quickly).

:I'm ready to do whatever is required to verify my identity and I hope that {{User|Levivich}} will face appropriate sanctions for making those unfounded false accusations.

: ] (]) 09:49, 12 January 2025 (UTC)

::I will just point out to the similarity of this response with previous SPI "defenses," namely: somehow making their way to the SPI case, attacking the filer, and asking to "verify" their identity. For example, Terrainman's comment on 21:04, 29 December 2024 (UTC): "Please tell me if there is anything at all I can do to verify my innocence..."" ] (]) 10:00, 12 January 2025 (UTC)
:::I will just point out that taking the most natural response you'd expect to see from a person falsely accused of being a sockpuppet by an editor whose contribution they recently criticized and trying to frame it as another "evidence" is a textbook example of acting in bad faith. ] (]) 12:33, 12 January 2025 (UTC)

* First, I wish to thank {{User|Levivich}} for associating me with distinguished editors like {{User|DancingOwl}}. However, I have nothing to do with them. I have no idea how to defend myself against such accusations:
:- My signature is my real name; I have nothing to hide
:- A large part of my contributions are in science and technology
:- I live in France,
:- What else?
:] (]) 10:43, 12 January 2025 (UTC)
::@] - Your time and expertise are invaluable, and I sincerely thank you for them. However, I am quite surprised, to say the least, by the nature of your statement, 'That's not a great success rate when it comes to SPI': proving that editors were falsely accused should indeed be considered a success! That said, I fully agree with you on another point: as {{User|DancingOwl}} highlighted, these accusations are not only the result of strong ideological bias but also stem from the accuser's inability to respond to the arguments presented by {{User|DancingOwl}}.
::I acknowledge having made editing mistakes, and I regret them. However, these errors occurred within the context of discussions on the talk page and not directly in the main article. I believe they do not warrant such a high level of suspicion.--] (]) 11:17, 14 January 2025 (UTC)
:::Thanks for giving me the chance to clarify my remarks. You're right that saying that there isn't evidence that someone is socking after they're accused is a success. But checkuser is a fairly invasive tool and I can learn information about a person that otherwise would (rightly) stay private. So my expectation is that we are predominantly invading the privacy of people who are socking. ] (]) 15:22, 14 January 2025 (UTC)

* I would just like to say that I am not a sockpuppet or a meatpuppet, and I have no idea who the people I have been listed with are, and I am in no way, shape, or form working with them. I am willing to cooperate in any way needed to verify my identity. That's all I have to say, thank you very much. ] (]) 19:51, 12 January 2025 (UTC)

*Hello, I am writing to address the concerns raised regarding my account, BePrepared1907. I want to clarify that I am a real person and not a sockpuppet. I am more than willing to provide any necessary information to confirm my identity and assure you of my genuine participation in the Misplaced Pages community.
:I appreciate the need to maintain the integrity of Misplaced Pages and I understand the reasons behind these investigations. However, I feel it is important to highlight that my editing activity and interests stem from my personal commitment to providing valuable contributions and fostering accurate, well-researched content on the platform.
:If there are specific concerns or questions about my editing patterns or behavior, I am open to discussing them and providing any clarification needed. I genuinely want to continue contributing positively to the Misplaced Pages community.
:Thank you for your understanding and attention to this matter.
:Best regards, ] (]) 13:54, 12 January 2025 (UTC)
*I am not a sockpuppet. I didn't even know what that meant until I was accused of being a sockpuppet for some account. I'm not sure what I am supposed to show as proof of not being a sock puppet. If someone could tell me what I am supposed to do, that would actually be amazing. ] (]) 22:45, 12 January 2025 (UTC)
:I guess the evidence I would use would be to look at my edit log. I have edited many articles relating to Israel-Palestine, that is true, but I have also edited or commented on many articles relating to Hungarian, American, and Irish politics as well, as well as making certain edits to the Christian nationalism article, as I have a degree of knowledge on these topics. Those last three do not seem to be consistent with the accounts which are being edited by Icewhiz. Furthermore, I do actively engage in discussions with members of the Misplaced Pages community for my article edits. As someone how is supposedly only focusing on Israel-Palestine, why did I make edits to and add to the talk page of the ]? I have a decent bit of knowledge about religious nationalism, be it ] in countries such as the ] and ], ] and ] in ], ] in ], the ], historically in ] and both in ] and the ] ], ] in ], or where a lot of these identities merge into one, especially in ]. ] (]) 22:55, 12 January 2025 (UTC)
:If you want more evidence, or if this is insufficient, please let me know. Trying to make my case here honestly feels kafkaesque. ] (]) 22:56, 12 January 2025 (UTC)
::What trouble are you having? I'm not sure what seems to uncertain. All of this is just very kafkaesque to me. ] (]) 12:54, 14 January 2025 (UTC)
:::{{re|MagyarNavy1918}}, checkuser reveals certain information about the device and browswer you are using and reveals IP information about where the internet traffic is coming from. I was hoping with the context clue of offering that there was something unusual (because of our privacy policies - the ] specificially - I can't say more) you would be able to go "Oh I think I know what he's talking about it's..." and fill in that blank. ] (]) 15:26, 14 January 2025 (UTC)
::::I'm still bot sure what you are referring too. Are you saying that my IP address does or does not prove I am a sock puppet?
::::In any case, I was unaware about the edits made by other editors in any case. I have also made edits on unrelated pages such as the talk page on the ]. I don't remember if I made any edits to that page.
::::The reason why I made the post on the ] page was due to the liberal use of the term "Zionist militias" in relation to the 1936-39 conflict. During that conflict, there was a stark difference between the policy of the ] and the ], but it seemed as though that difference was being downplayed for the sake of smearing the whole of the Zionist movement. This isn't surprising for an editorial base which changed the definition of "]" to being a form of Jewish ethnonationalism, even though pages on ], ], ], ], and Herzl's ] which would challenge this assumption.
::::As for my comments on the Zionist page about "Palestine scholars," that was my mistake: there are also misquotes of historians and Zionist scholars such as Benny Morris. I've just found Misplaced Pages's editorial stance to be far from non-partisan since the beginning of the ], and its frankly made me upset. I know people who lost family members on October 7th, but none of y'all care about dead Israelis to be honest. In none of my edits have I sought to argue that Israel has acted in accordance with international law, nor that the war should continue. If you don't believe me, check my comment on the talk page of the ] article. It's just that the Misplaced Pages editors have become so ] and that there is no effective moderation of any of these pages. This isn't the first time Misplaced Pages has had this problem either. ] was taken over by bunch of ] a few years ago, and they effectively erased all references to Croatian war crimes for years on Croation Misplaced Pages AND on English Misplaced Pages for a few months.
::::To me, when I say this is Kafkaesque, I'm also saying that this feels like a purge of Misplaced Pages moderators who hold inconvenient views for the Misplaced Pages moderation team. The idea that Hamas can commit war crimes AND so can Israel is just too much. But no one on this site needs to correct to explain Israel's war crimes; that ] quite long. However, with a moderation team seeking to delete ] as a Misplaced Pages page AND has an Israeli war crimes page longer than the ] page (Israel has, in fact, not committed as many war crimes as the country responsible for the ] and the ]), one has to question your neutrality. ] (]) 16:23, 14 January 2025 (UTC)
*I deny these allegations of being a sockpuppet wholeheartedly. First of all, my lack of editing between 2022-2024 was because of a lack of interest in editing. However, once I saw the misleading information rampant in ARBPIA, I decided to resume editing. Secondly, Nableezy had been on my radar for a while. I had always meant to report him, and just remembered on that specific day. Thirdly, I changed my userpage in order to make it look better and cleaner. Fourthly (is that a word), 17:00-19:00 UTC correspond to 7:00-9:00 AM my time, which is my preferred time to edit. Fifthly, my efforts on the Palestinian page was not in collaboration with any other accounts. I only edited it because it was wrong. This entire investigation seems less like a genuine effort to crack down on sockpuppets and more a effort to silence opposing voices. This entire discussion is completely disingenuous, and is making me doubt the prior investigations into Icewhiz sockpuppets. Thank you. ] (]) 10:37, 13 January 2025 (UTC)

'''Further evidence about Shoogiboogi'''

Evidence is based on comparing users Shoogiboogi with Icewhiz socks.

'''Account creation dates'''
* האופה (“HaOfa”) 24 October 2023
* Galamore 25 December 2023
* Minden500 25 January 2024
* O.maximov 8 February 2024
* Owenglyndur 22 February 2024
* {{tq|Shoogiboogi}} 16 March 2024
* EnfantDeLaVille 24 March 2024
* UnspokenPassion 28 March 2024
* PeleYoetz 9 May 2024
* OdNahlawi 20 June 2024
* EliasAntonakos 24 June 2024

'''Timecards:'''
* Timecards for aligns with , , , in which most edits are between their range of 6 am – 8 pm UTC (Shoogiboogi most between 2 pm and 8 pm UTC).

'''Hyperfocus on Francesca Albanese'''

Icewhiz socks have made UN rapporteur on Palestine a target, having extensively inserted and/or highlighted several US and Israeli government criticisms of the official:
* Minden500 3 July 2024
* O.maximov 27 July 2024
* “HaOfa” 1 November 2024
* {{tq|Shoogiboogi}} 31 December 2024

'''Copyright violations'''
* {{tq|Shoogiboogi}} was warned on 22 May 2024 for inserting copyrighted content
* Owenglyndur was blocked on 13 December 2024 for copyright violations


'''Editor interaction tool'''
:] {{tq|This issue doesn't compare to fifteen years of the topic's 'regulars' engaging in edit wars, intimidating new editors, and relying on extremist sources, some linked to authoritarian regimes or terrorist organizations, all leading to a large-scale bias, making fringe ideas seem mainstream, and massively distorting our content on multiple topics}}
* Tool also shows six odd article matches for {{tq|Shoogiboogi}} and O.maximov: ], ], ], ], ] and ].
:How is it that you apparently have a 15 year memory of the topic area? I've been on Misplaced Pages round that long and I can't remember stuff that far back. In fact it has struck me ever since we ran across each other how very familiar with Misplaced Pages and its processes you seem to be. You must be an excellent researcher. ] (]) 23:08, 8 November 2024 (UTC)
] (]) 10:06, 12 January 2025 (UTC)


====<big>Clerk, CheckUser, and/or patrolling admin comments</big>==== ====<big>Clerk, CheckUser, and/or patrolling admin comments</big>====
*There's an IP, ] that's gone around exhorting most of the editors named in this report to respond here. I feel like this is a somewhat unusual area between ] violation and canvassing on one hand, and the general principle of allowing for defendants to make a statement on another (although in my experience following SPI threads, defendants' comments rarely make a positive difference in their cases). With all that in mind, I'm not sure if any action or notice needs to be taken with respect to this IP, primarily thinking about future instances of the same, as the cat is essentially out of the bag for the moment. <sub>signed, </sub>] <sup>]</sup> 16:47, 12 January 2025 (UTC)
* It looks like this will need to be done on behaviour. The geography doesn't match other Icewhiz socks, although there appears to be extensive proxy use. I did, however, find two brief overlaps with other users, namely {{noping|Galamore}} and {{noping|Owenglyndur}}. A second opinion on the technical aspects would be helpful, along with more evaluation of the behavioural evidence. – ] 20:11, 8 November 2024 (UTC)
* I find the technical evidence connecting ABHammad to Galamore and Owenglyndur to be at best inconclusive but more likely to indicate they're unrelated. If there's socking it will need to be proven behaviorally. ] (]) 20:59, 8 November 2024 (UTC) *:Ultimately the pages are public. But I think there it is the right decision that unlike almost any other conduct forum there is not an expectation to notify people. ] (]) 17:10, 12 January 2025 (UTC)
*::For whatever reason, halfway through they switched to a much more threatening tone ]. I don't think it's helpful or particularly accurate to say {{tq|Your silence may be used against you}}--if anything, the opposite is likely more true. <sub>signed, </sub>] <sup>]</sup> 20:01, 12 January 2025 (UTC)
*:::If it were something more than a throw away I'd have blocked it. ] (]) 01:50, 13 January 2025 (UTC)
*I hope to be able to substantively begin looking into this in the next 24 hours. Of course no objections if another CU beats me to it. ] (]) 01:51, 13 January 2025 (UTC)
*:Alright. I have just spent 45 minutes beginning to work through this case; I have so far checked 4 of the accounts listed here. I'd hoped to have something one way or another to report, but I don't yet. I have justification to run checks on at least 1 other reported editor and depending on those reults might have to go further down a rabbit hole. However, I'm out of time for the moment so I'm having to pause here and do little expect report that I've spent time. ] (]) 20:22, 13 January 2025 (UTC)
*Alright here are my outcomes:
*:*I have blocked Shoogiboogi as {{likely}} to Galamore. Still working through other elements of the case. ] (]) 21:18, 13 January 2025 (UTC)
*:*Sethy017 is {{Unrelated}} to any of the socks linked in the report, including Icewhiz or Galamore. I do not find sufficient grounds to check any of the others listed under "throwaway". They can be made AWARE of contentious topics and otherwise handled under ECR. If disruption continues it can be addressed (including by coming back here when they have more edits). ] (]) 22:55, 13 January 2025 (UTC)
*:*I have Pyramids09 and IntrepidContributor as {{Inconclusive}}. ] (]) 22:55, 13 January 2025 (UTC)
*:*I see Boutboul and Benjy613 as {{Unlikely}}. ] (]) 22:55, 13 January 2025 (UTC)
*:*MrBismark1871 is {{Unrelated}} ] (]) 22:55, 13 January 2025 (UTC)
*:*There's one strange thing with MagyarNavy1918 from a technical evidence side on January 12 (yesterday) that I'm having trouble explaining. Magyar I know you're reading this and if you know what I'm talking about and would like to explain here or privately via ] I'm happy to hear it. Otherwise I'm going to be looking for a 2nd opinion. This very loosely ties into BePrepared1907. ] (]) 22:55, 13 January 2025 (UTC)
*:*:I should have really pinged @]. ] (]) 02:51, 14 January 2025 (UTC)
*:*::In further reviewing the evidence with MagyarNavy1918, it's not quite as strange as I had first thought and so we'll land at an {{Inconclusive}}. ] (]) 20:34, 14 January 2025 (UTC)
*:*:::Okay! If you have any questions you want to clear up, just let me know! Thanks! ] (]) 09:26, 15 January 2025 (UTC)
*:*:It is certainly {{Possible}} that BePrepared1907 is a sock. The technical evidence offers some weak clues and the behavior evidence is a little stronger. But not strong enough for me to block. I would have no compunction if a different CU were to reach a different decision and would revisit this if there were to be other behavioral evidence put forward. ] (]) 20:34, 14 January 2025 (UTC)
*:*There is something unconnected to any of IW/Galamore/etc with Mk8mlyb that will get resolved outside of this SPI. ] (]) 22:55, 13 January 2025 (UTC)
*:*:The things with Mk8mlyb has been resolved. I have Mk8mlyb as a weak {{Unlikely}} to socks in this topic. ] (]) 20:34, 14 January 2025 (UTC)
*:*I have not evaluated DancingOwl, Vegan416, Kentucky Rain24 as that is its own grouping that can be done independently of the rest of these results. ] (]) 22:55, 13 January 2025 (UTC)
*:As can be made clear from the above, I did a lot of checking here. This was really a bunch of SPI reports rolled up into a single date. I also thought carefully about each check and if asked could explain the policy basis for each one. So for both those reasons all the checking can be justified. And yet I can't help but take stock of the work as a whole and wonder. I know that Levivich spent a lot of time writing this report and the quality of that work meant there for me to justify checks, but there wasn't so much that I could justify blocking on behavior alone. And even if all of the unresolved pieces end up as blocks, at most we'd have caught 3 socks tied to PIA LTAs and 1 other sock by accident. That's not a great success rate when it comes to SPI and I think it's more likely our final totals will be less than that. I want to do some deep thinking - and would encourage those who frequent this topic area and find socks - on what it all means and to make sure that not we're spooked to the point where "edits with a certain POV" is what is what is making us think someone is a sock. ] (]) 23:51, 13 January 2025 (UTC)
*Clerical note: I have just removed a number of formatting elements (mostly headers, and a misplaced divider line) from this filing, as well as the previous one. SPI tooling tends to be sensitive to the existence (and placement) of those elements (and they inflate the size of the archive ToCs, which already have a tendency to become too big for comfort), so it is generally best to just stick to the default format and use either nested bulleted lists or bolding if additional structure is needed. --] (]) 14:21, 14 January 2025 (UTC)
*I think everything that needs doing has been done (with ] open about some of the editors initially reported here). ] (]) 20:37, 14 January 2025 (UTC)
----<!--- All comments go ABOVE this line, please. --> ----<!--- All comments go ABOVE this line, please. -->

Latest revision as of 09:26, 15 January 2025

Icewhiz

Icewhiz (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Populated account categories: confirmed · suspected

For archived investigations, see Misplaced Pages:Sockpuppet investigations/Icewhiz/Archive.

29 December 2024

– An SPI clerk has relisted this case for a checkuser to make another check.

Suspected sockpuppets

Evidence relies on comparing User:Terrainman with User:ABHammad and their likely sockmasters User:Icewhiz and User:Dajudem.

Timeline:

User:Terrainman was created on 13 November, just five days after the SPI case against ABHammad was opened on 8 November. Simultaneously, starting 8 November, ABHammad’s contributions drop to records low of 28 edits over a month.

Timecard:

Like ABHammad, Terrainman does not seem to get any sleep, or has a very random sleep schedule, with edits spread throughout the day.

Compare that with the control group of myself for example, where I am clearly absent and asleep between 12 and 8 am UTC. Or with other users who participated in the last Icewhiz SPI: like nableezy who seems to be asleep between 8 am and 1 pm UTC; or Sean.hoyland between 7 pm and 1 am UTC; TarnishedPath 2 pm and 11 pm UTC; Levivich between 7 am and 1 pm UTC; etc. You get the point.

Claiming politicization:

Terrainman’s very first edits are made on ARBPIA-related topic area articles, on the talk page of List of genocides, where they accuse editors of being politicized and infiltrating WP; common ABHammad tactics and talking points. .

Also, as was interestingly noted and characterized as quacking by TarnishedPath in the last SPI, the two blocked socks of ABHammad and “HaOfa” appealed while claiming the move was politicized.

Editor Interaction tool:

Editor Interaction tool reveals they are editing the same exact topics within the topic area: Israel, Golan Heights, Talk:List of Genocides, and Talk:Israel.

Username:

Username of Terrainman (Terrain, man) rings a bell with User:Dajudem’s other sock: User:Stellarkid (Stellar, kid).

Nationality:

An Icewhiz signature, Terrainman seems to continue the habit of pretending to be different nationalities and people, now a Chinese-speaking femboy. Reminder how Icewhiz socks pretended to be: Greek (User:EliasAntonakos), Lebanese (User:EnfantDeLaVille), and Indian (User:Proud Indian Arnab).

Edit summaries

Like ABHammad and Dajudem and Icewhiz socks, they are still extensively using the “adding info” edit summary in their contributions: total of 59 matches for “added info”. Examples:

Negation of adjectives

As demonstrated in the previous SPI, the same odd way of negating adjectives continues, the most peculiar of which is the use of “unneeded”: Unnecessary, unnecessary, unneeded, undoing.

Aggression:

Like ABHammad, Terrainman is always on the offensive and makes very aggressive and provocative comments and accusations, such as this one falsely accusing me on vandalism on my talk page. .

Important note: I had expected that any new socks would try to act as different as possible to other previous socks, but surprisingly this is not the case. Is it a deliberate move to prove a point somehow or mislead SPI by having another co-sock doing these distinctive behaviors? Or that they just don’t care and can easily create new accounts? Makeandtoss (talk) 11:45, 29 December 2024 (UTC)

Extended evidence

SPI Defense: Like ABHammad, Terrainman, who somehow made their way to the SPI case, responded by relying more on attacking the filer, rather than defending themselves.

Shared behaviors and similar comments:

1- SPI defenses:

2- Alleged "infiltration" of WP

3- Focusing on User:DMH223344

4- Extensive use of brackets in comments

5- Asking admins to monitor alleged topic ban violations

6- Leaving warnings on editors' talk pages

7- Promoting a populist narrative of “new” editors being wronged by experienced ones

8- Forgetting WP:CHOICE

9- Accusing editors and WP of ideological bias

Attacking checkusers


Interesting, in that case, it appears to be an attempt at misleading SPI, because the behavioral evidence is quite damning and almost identical to the previous case. But sure, a second and third closer looks at the technical evidence by Icewhizologists would still be very important. Makeandtoss (talk) 12:40, 29 December 2024 (UTC)
What? I have no idea what you are talking about to be frank. I have not been aggressive. 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 21:02, 29 December 2024 (UTC)
" Chinese-speaking" What gave you the idea from my talk page that I am chinese speaking!? 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 21:03, 29 December 2024 (UTC)
This whole SPI response reads like ABHammad and this group of socks to me, this response in particular. For someone who writes their username in Chinese in their signature (地形人 = "terrain man" according to Google translate) to then ask "what gave you the idea from my talk page that I was Chinese speaking!?", complete with faux-outrage ("!?") and sealioning obtuseness (as if we can't all see the signature with Chinese characters in it). It's trolling in my view, and it's an identifiable habit of this sockfarm. Levivich (talk) 17:24, 31 December 2024 (UTC)
I am not trolling, I honestly forgot at the time that I even had chinese characters in my name. It is stylization, and ofcourse you do not need to speak Chinese to use google translate. It was not faux outrage. 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 19:30, 31 December 2024 (UTC)
I will also point out, because it is extremely relevant. That @Levivich is another user who nearly 100% of their edits pertain to Israel. This is a Misplaced Pages:Witch hunt and I am honestly shocked by it. I have put so much work into editing[REDACTED] and to face this just becasue I stood up to NPOV is an injustice in of itself. 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 19:32, 31 December 2024 (UTC)
I see this "blatant bullshitting" as another tell-tale sign of this sock farm. The account made four comments on this page and signed each one--including directly above the "chinese speaking!?" one. The suggestion that they didn't notice or forgot that they had Chinese characters in their signature is so stupid it can't possibly be made in good faith.
And it's just like what OdNawhali said about answering for PeleYoetz. This discussion between ABHammad and PeleYoetz reads to me a lot like Terrain Man's comments here. Right down to the feigning of confusion, attempts to show unfamiliarity with Misplaced Pages by misnaming "sockpuppet" (eg PeleYoetz's "puppet socks" and Terrain Man's "sock users"), and allegations of a conspiracy against them (TM "witch hunt", PY "haunted").
It's true I've been pretty much an IP SPA since the war started, and in that year or so, I've read so much of this from so many different accounts that now it just jumps out at me, it's the same writing style, same tactics, over and over and over again. And I say that as someone who was falsely accused of sockpuppetry by a number of editors when I first started editing here. But I never had problems using the word "sockpuppet." I've come to believe with this sockfarm--which I guess has been going for almost 20 years now!--forget the technical evidence, its the behavioral evidence that's damning. I hope this sockfarm at least makes it interesting in the future and switches up the on-wiki style. It's already boring and I've only been doing this for 1 out of those 20 years. Levivich (talk) 20:44, 31 December 2024 (UTC)
Do you know what percentage of my edits pertain to that topic? I have literally only made a handful of edits/reverts on the Israel topic area, and no edits at all to articles relating to the current war; I am not even watching the Israel-Hamas article! 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 20:46, 31 December 2024 (UTC)
You act so confident about being right, why don't you consider for a moment that you might be wrong. I have alot of work into Misplaced Pages since joining, I am deeply passionate about editing, I dared to stand up to NPOV by an experienced editor, and this is the result. 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 20:48, 31 December 2024 (UTC)
So I am using sockpuppets because I leave warnings, care about NPOV, and... use brackets? Ok 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 10:34, 31 December 2024 (UTC)
@Barkeep49: You are right about ABHammad potentially being a different individual from Icewhiz/Galamore, who is most likely a Dajudem sock. On the other hand, as we know from the topic area and the ABHammad SPI case, there is extensive coordination between these socks. And for that matter, WP does not distinguist between sockpuppetry and meatpuppetry. A possible solution would be to have ABHammad as a confirmed sock of Dajudem, and a suspected sock of Icewhiz/Galamore.
That aside, could you or any other checkuser kindly elaborate to us what kind of sophisticated obfuscation techniques are being used by these closely related families of socks, as understanding this will help immensely in the organization and presentation of evidence? Are they multiple individuals handing over their log in credentials to one another to mislead time-wise and style-wise? Or is it one individual just using proxy and VPN methods and device and software changing tactics? Or is it somehow a combination of both? Makeandtoss (talk) 19:15, 2 January 2025 (UTC)
@Barkeep49: That is fair. Judging from the past Icewhiz SPIs however it becomes apparent that it is the behavioral evidence that has been detrimental, with technical evidence often inconclusive. As time passes they will become better at obfuscating the behavioral evidence, so access to at least some of the technical conclusions -not necessarily the hard evidence themselves- is important. Can I be emailed about this as a possible solution? Makeandtoss (talk) 20:19, 2 January 2025 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Hello, I'm not sure what is going on here. Obviously I am a bit alarmed about this. I do not have any 'sockusers'. I encourage check users to verify this. I am happy to stay away from editing contentious topics if that is what is necessary. --𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 20:58, 29 December 2024 (UTC)

I will also point out that I left a message on Makeandtoss' talk page regarding what I suspected to be ideolgically motivated subtle vandalism by them, I don't know if this is 'revenge' from them or good intentions. But I look forward to check users verifying my innocence. Again, I am more than happy to stay away from contentious topics including the Israel wiki project, which, admitedly, is what inspired me to create an account after I saw what I believed to be ideological bias on the list of genocides page (a page I have not edited or commented on since the first day of my account creation). 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 21:00, 29 December 2024 (UTC)
I will also add that almost 100% of makeandtoss' edits are on articles relating to Israel, and there are a very large number which suggest this user is not ascribing to NPOV. I left a message on their talk page mentioning this and quoting several edits which I believe amount to subtle vandalism, and I strongly believe that this accusation is 'revenge' for that message. 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 22:30, 29 December 2024 (UTC)
Do you know what WP:ASPERSIONS are? If you have a complaint about another editor, then make that complaint in the appropriate forum. Selfstudier (talk) 10:42, 31 December 2024 (UTC)
I understand, I shouldn't have gone as far to bring up their editing history, however it pertains to the message I had left on their talk page, which I believe is the reason why this accusation of sockpuppeting is being brought forth by them; I believe that to be relevant to the investigation, but perhaps I am wrong. 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 10:50, 31 December 2024 (UTC)

@Makeandtoss: what did you mean in your edit summary on this investigation: "this should be closed by self-admission already"? — Preceding unsigned comment added by Terrainman (talk • contribs)

Please tell me if there is anything at all I can do to verify my innocence. I do think I am being targeted by makeandtoss due to the message I left on their talk page. 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 21:04, 29 December 2024 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

  • Terrainman edited as an IP for a while before creating their account. They have another account with zero edits (not a violation of policy in itself). Technically, they really don't look like ABHammad, Galamore, or other past Icewhiz accounts, and there are no obvious signs of CU obfuscation shenanigans. But I'm not an Icewhizologist, so second opinions are welcome. Spicy (talk) 12:21, 29 December 2024 (UTC)
    I continue to be uneasy about linking ABHammad to Icewhiz/Galamore. That said I do find reasonable behavioral evidence here linking Terrainman to ABHammad. I did a limited amount of actual CU'ing, but from what I see @Spicy: I feel like there's nothing there to suggest it's not ABHammad. What are your thoughts on the behavioral side of things (ignoring any Icewhizology and just thinking about ABHammad/Terrainman)? Barkeep49 (talk) 18:51, 2 January 2025 (UTC)
    I suppose one could say re. the technical evidence that there's nothing there to suggest it's not ABHammad, but I don't think there's anything that particularly suggests that it is either, i.e.  Inconclusive,  Behavioural evidence needs evaluation. I haven't examined the behaviour beyond verifying that it's credible enough to justify a check. That I will leave to others. Spicy (talk) 19:02, 2 January 2025 (UTC)
    @Makeandtoss we are generally reluctant to share too much about what behaviors we're focused on in the hopes that it will make it harder for the sock to change up in a new way that becomes harder to detect. Barkeep49 (talk) 20:11, 2 January 2025 (UTC)
    We've been blocking Icewhiz largely on certain not disclosed, and shifting, behaviors more than technical evidence for quite some time now. Sometimes the behavioral pattern is shown through the technical evidence, other times not. I understand how frustrating this is to people who aren't CUs. Barkeep49 (talk) 20:31, 2 January 2025 (UTC)

02 January 2025

– A user has requested CheckUser. An SPI clerk will shortly look at the case and endorse or decline the request.

Suspected sockpuppets

Evidence relies on comparing User:Rajoub570 with User:Icewhiz socks (mainly EnfantDeLaVille, but also EliasAntonakos) as well as possible connections with other sockmaster User:Tombah.

Creation dates:

Timecards:

  • Almost identical timecards for Rajoub570 with EnfantDeLaVille, OdNahlawi, EliasAntonakos, with most edits 6 am to 6 pm UTC, and the fewest daily edits on Saturday.
  • Interesting complementarity between the aforementioned users and Galamore, in which all of them are editing 4 am and 8 pm UTC, but Galamore has most edits concentrated 4 am – 7 am UTC.
  • Timecard comparison between Rajoub570 and Tombah.

Editor interaction tool

  • Comparing Rajoub570 with EliasAntonakos shows odd focus on some specific Palestinian villages and the Arab migrations to the Levant article, and comparing Rajoub570 with EnfantDeLaVille shows odd focus on random Lebanese village of Rmaish.

Pretending to be different nationalities

  • EnfantDeLaVille supposedly Lebanese
  • Proud Indian Arnab supposedly Indian
  • EliasAntonakos supposedly Greek
  • Rajoub570 supposedly Palestinian

Second language choices

As usual, most edits on English WP, with very few edits on a second language:

  • Galamore and PeleYoetz editing on Hebrew WP
  • O.maximov editing on Russian WP
  • EnfantDeLaVille editing on French WP
  • Rajoub570 editing on Arabic WP

Use of Arab family names

Stonewalling

An Icewhiz sock signature, Rajoub570 has engaged in stonewalling:

  • Rajoub570
  • EnfantDeLaVille
  • Galamore
  • PeleYoetz

Hyperfocus on Arab and Jewish demographic history

User pages

And now for the most incriminating piece of evidence: first version of Rajoub570’s userpage has the exact same structure and content to that of EnfantDeLaVille, with five user boxes in horizontal order and five categories, all identical identifications.

  • EnfantDeLaVille’s user boxes: from Lebanon (nationality), a Maronite (religion), geography (interest), hiphop music (interest), French (citizenship)
  • Rajoub570’s user boxes: from Palestine (nationality), Muslim (religion), Middle Ages (interest), Ottoman Empire (interest), Islamic Architecture (interest)
  • EnfantDeLaVille’s categories: Lebanese Wikipedians, Maronite Wikipedians, and the rest interests
  • Rajoub570’s categories: Palestinian Wikipedians, Muslim Wikipedians, and the rest interests. Makeandtoss (talk) 14:06, 2 January 2025 (UTC)

Further evidence on demographic history

@Barkeep49: Of course, that doesn't make sense, but that's not what the behavioral evidence I presented above points to, so it a closer look will show, as Nableezy mentioned, that it is anti-Palestinian content being propagated, characteristic of an Icewhiz sock.

This anti-Palestinian and anti-Arab content is denying the indigenous nature of Palestinians by over-amplifying their connection to the Arabian peninsula, and by controversially claiming that some Arab tribes are originally Jewish. Propagation of this material has been done in tandem with other Icewhiz sock, as demonstrated above and as I will further expand on below.

An admin just now restored the deleted Muslim migrations to Ottoman Palestine article to my talk page: User:Makeandtoss/Muslim migrations to Ottoman Palestine, and it shows exactly the same pattern that I have described above: Rajoub570 intervening there a single time to add content from a Hebrew-language paper on how Palestinians trace their ancestry from the Hauran region, i.e. outside of Palestine.

You're also right about the evidence about Arab family names and second language choices being unconvincing, but that is when they are taken alone. When the full picture is seen collectively, the behavioral evidence clearly points out to an Icewhiz sock. Makeandtoss (talk) 19:26, 2 January 2025 (UTC)

Connections to sockmaster Tombah

@Barkeep49: Thanks for the pushback, I genuinely appreciate it, this shows that SPIs are always taken seriously, and that false positives are very rare. As an Arabic speaker myself, I have now taken a closer look at their Arabic WP contributions, which showed me some further interesting but worrying results:

1- Dura, Hebron:

  • Rajoub570's Arabic WP userpage states that the user is a Palestinian from the village of Dura, Hebron.
  • This seems to be in line with the aforementioned choice of name by Rajoub570, since the Rajoub family is indeed from Dura, Hebron; and the user knows this themselves as they edited this piece of information there.
  • Tellingly, however, their user page says اسمي رجوب aka my name is Rajoub, which is clearly a red flag as Rajoub is a last name not a first name; no Palestinian nor Arab identifies themselves using their family's name this way. Nor would they call their families "clans".
  • Several of Rajoub570's edits on Arabic WP relate to adding pictures of Iranian mosques, which is an odd interest for a Palestinian from the West Bank.

2- Connections to Tombah:

  • As @Nableezy: mentioned, they had filed a case against Rajoub570 as a suspected sock of Tombah last year, which was unsuccessful.
  • Worth noting that the Dura, Hebron article in English WP was edited 32 times by Rajoub570 and 12 times by sockmaster Tombah.
  • Tombah has 153 edits on Arabic WP, of which 12 were edits to the Dura, Hebron article.
  • Way too many article matches between Tombah and Rajoub570 of oddly specific articles

3- Knowledge of Arabic:

  • These related families of socks seem to have at least one individual remotely capable of some Arabic with the aid of google translate, namely Icewhiz sock OdNahlawi who has 106 edits on Arabic WP.
  • Rajoub570 maintains a strict use of an overly neat modern standard Arabic, which is unusual in a setting like a user page or talking to other users.

@Rosguill: And you are right, making a few token edits on Arabic WP to avoid suspicion is a trivial sacrifice. However, I am afraid that Arabic WP could also be subject to this kind of systemic manipulation, through different clusters of users.

I have so much more to say, but this will be a story for another venue. Makeandtoss (talk) 21:40, 2 January 2025 (UTC)

Further evidence linking with EnfantDeLaVille

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
@Barkeep49 I dont think Rajoub's editing can reasonably be described as "pro-Palestinian content". I previously raised this editor as a potential sock of Tombah before and was told unrelated however. Have no comment on any connection to Icewhiz, would surprise me, but I personally remain convinced of my earlier view on what prior account they may have had. But the part on "making pro-Palestinian content" is in my view completely wrong. The editing behavior of a person saying they are Palestinian but editing mostly with a position that can best be summarized as "Palestinians arent real, they're just Arab immigrants" and primarily citing material from Hebrew journals published by a university in an Israeli settlement is not what I would call "pro-Palestinian content". nableezy - 19:11, 2 January 2025 (UTC)
  • FWIW, for me, from a statistical distance perspective, the closest match to Rajoub570 is Owenglyndur, significantly closer than other actors. This might be reflected in some of the page intersections at multiple pages with low revision counts and unique actor counts (see table below).
Extended content
rev_page page_title page_namespace namespace_desc Rajoub570 editcount Owenglyndur editcount page_rev_count page_actor_count
23267 Palestinians 0 (Main/Article) 3 2 8981 2215
28333 Samaria 0 (Main/Article) 2 2 1604 756
82886 Tiberias 0 (Main/Article) 1 1 1711 698
323332 Nahariya 0 (Main/Article) 1 1 561 281
1519509 Tel Arad 0 (Main/Article) 1 25 341 151
5379955 Ma'ale Levona 0 (Main/Article) 1 1 141 76
8736327 Suba, Jerusalem 0 (Main/Article) 2 2 283 91
9608366 Aboud 0 (Main/Article) 1 1 337 113
13269758 Sebastia, Nablus 0 (Main/Article) 2 1 389 140
13956939 Teqoa 0 (Main/Article) 1 3 378 111
14565789 Beit Ummar 0 (Main/Article) 11 1 237 96
14895600 Awarta 0 (Main/Article) 3 1 217 80
15306482 Beitunia 0 (Main/Article) 3 3 198 75
16703154 Qarawat Bani Hassan 0 (Main/Article) 5 7 224 58
18101397 Beit Ur al-Fauqa 0 (Main/Article) 12 2 200 62
24018856 Khirbat Umm Burj 0 (Main/Article) 1 36 168 52
34824719 Jalud 0 (Main/Article) 2 1 91 38
72892562 Khirbet Kurkush 0 (Main/Article) 1 7 56 12
76917222 Khirbet Ghuraba 0 (Main/Article) 14 2 20 6
Owenglyndur has been categorized as a Galamore sock/possible Icewhiz sock. I have no idea whether that is correct, but I would not rule out a connection to the Category:Misplaced Pages sockpuppets of ElLuzDelSur group as both Rajoub570 and Owenglyndur are statistically close to that set of actors. Sean.hoyland (talk) 03:01, 3 January 2025 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

  • I think we've lost the plot if we're now suggesting Icewhiz is making pro-Palestinian content. I also find behavior like that listed under "Use of Arab family names" and "Second language choices" unconvincing. Barkeep49 (talk) 18:56, 2 January 2025 (UTC)
    I would describe this edit on arwiki from January as making pro-Palestinian content. Barkeep49 (talk) 20:18, 2 January 2025 (UTC)
    If the sockmaster's goal is to influence coverage English Misplaced Pages, making a few token edits on Arabic Misplaced Pages, a project that both receives much less traffic and whose pro-Palestinian bonafides are displayed as a banner on every page, seems like a pretty trivial sacrifice. It would be one thing if they had extensive participation in discussions expressing a consistent viewpoint, but a quick writeup of essentially-neutral article text doesn't seem like conclusive evidence of anything in particular. I'd be curious if editors fluent in Arabic could identify whether the edits reflect a particular regional dialect or other distinctive pattern. signed, Rosguill 20:53, 2 January 2025 (UTC)
    And just as a note: while this reply came only a few minutes after my comment above, I'd actually invested a fair amount of time into looking into the behavioral evidence all listed here before making either comment. Barkeep49 (talk) 20:32, 2 January 2025 (UTC)

7 January 2025

– This SPI case is closed and will be archived shortly by an SPI clerk or checkuser.

Suspected sockpuppets

Clerical

Free1Soul was blocked as one of this set but not labelled.

I found it looking for accounts that look like BilledMammal and Icewhiz.


Sorry if this is not formatted correctly. I tried to copy others' sections. I've been compiling this off wiki. I can't see a size limit anywhere on here. If I have missed one please ping me from this page and I will come back and trim this. I.M.B. (talk) 12:51, 7 January 2025 (UTC)

What I noticed

I have been trying to improve some of the pages started by Icewhiz puppets, and I saw those accounts deleting cited content on multiple other pages, alongside that I also saw the mass rollback by BilledMammal. It is difficult to quantify or compare "deletes a lot", but I also found more specific similarities in what they add.

Reporting

On 21 March 2022 BilledMammal was first raised in the Icewhiz sock archive. At the time it looked unlikely, but since then there was an attempted mass removal of content using rollback (the thing I noticed) and a very large number of edits during the year before BilledMammal went quiet.

BePrepared1907 also deletes a lot of sourced content with similar themes, there are a lot of shared pages between the 3 but I haven't looked at any of these in depth yet. There is a swarm of accounts with a few dozen edits around BePrepared1907.

I should probably disclose BePrepared1907 has been reverting a lot of my edits recently, so I might be biased.

Masters

BePrepared1907 could belong to a different set, but personality seems like BilledMammal's.

BilledMammal looks vividly like the original Icewhiz account.

Comparing things I noticed in BilledMammal history to most active Icewhiz accounts, the one in the middle Eostrix changes tactics, then a year or so ago BilledMammal became a monolingual English speaking version of Icewhiz. BilledMammal works only in English, I don't think I've ever seen an account with that many edits and zero on any other language

ARBPIA_activity_statistics_complete

BilledMammal has created a user space page cataloguing sockpuppets (and other things)

Some people have mentioned irregularities in these, relating to:

  • Onlineone22
  • MurrayGreshler
  • Kentucky Rain24
  • Izzy Borden
  • Red Slapper
  • O.maximov
  • UnspokenPassion

Interaction with those

"deletes a lot"

They look similar, but what's normal?

BilledMammal's top two most edited pages show more removals than additions

BilledMammal

Icewhiz - Has a similar examples in their top few most edited pages

On others Icewhiz is removing a lot, but probably not an abnormally large amount? history to most act/en.wikipedia.org/Icewhiz/1 top pages

Update "deletes a lot"

Recent edits by BePrepared1907 (past few days) are predominately deletions.

Kentucky Rain24: One of their top pages Ofer Prison was mostly removals

I.M.B. (talk) 20:00, 8 January 2025 (UTC)

Timeline

6 August 2012

  • Icewhiz account created on Hebrew Misplaced Pages

30 January 2017

29 March 2019 Icewhiz gets a contentious topic notice for Israel–Palestine

BilledMammal xtools

  • Created 24 April 2019
  • A few edits per month
  • zero from 20 September 2019 to 4 December 2019

1 October 2019 - Icewhiz blocked

BilledMammal early edit history

  • 14 edits in December 2019
  • vanishes on 6 December 2019

Eostrix on English Misplaced Pages xtools

18 May 2021 BilledMammal reappears and makes an edit request

3 July 2021 - Saturday approx 4:00am UTC

  • BilledMammal updated to extended confirmed user.

20 October 2021 - Eostrix gets blocked

24 October 2021 - Contentious topic notices appear on BilledMammal's talk page for both the Arab–Israeli conflict and the Holocaust, 12 hours apart. Both topics that the Icewhiz and socks were clashing with people over. BilledMammal responded to the earliest suspicions by making an arbitration complaint about “Insinuation of sockpuppetry”

20 March 2022

  • BilledMammal first raised in the Icewhiz sock archive.
  • Ruled out without a check.

1 October 2023

  • BilledMammal started messaging people on their talk pages about 1RR violations, Icewhiz also made an unusually large number of complaints about this” (see last section).

Edits on the same pages

The Holocaust and the Arab Israeli conflict are sufficiently interconnected (e.g. The Holocaust and the Nakba) that they are not a suspicious combination, but BilledMammal suddenly attracted attention in both topics 3 days after the most active Icewhiz sock was blocked.

BilledMammal and Icewhiz also mention some very specific matching points years apart.

UNRWA

List of genocides

WikiProject_Deletion_sorting/Companies

BilledMammal made their 14th edit on 20 September 2019 nominating something for deletion, with terminology that doesn't seem to fit someone newly autoconfirmed?

BilledMammal also added it to wikiproject deletion sorting at Misplaced Pages: WikiProject Deletion sorting/Companies

Icewhiz was active in that project → 82 edits from 28 November 2017 to 29 August 2019 (82 edits by Icewhiz on Deletion sorting/Companies)

While BilledMammal was dormant → Eostrix nominated 3 pages in 2021 and one in June 2020 (4 edits by Eostrix on Deletion sorting/Companies)

Shared pages are mostly in administration

BM and IW have both made hundreds of edits on some admin pages.

BM and IW Ranked 12th and 15th on top editors on Misplaced Pages:Arbitration/Requests/Enforcement - page history

Interaction with others

I decided against providing most examples I saw from Arbitration/Requests/Enforcement. Some look similar, but I didn't feel right including the complaints against other people as examples. They also leave some similar messages on user talk pages. That feels wrong to share here without permission, but asking permission makes an even more awkward situation. If there was a way to make a pooled anonymous word frequency analysis for the namespace "user talk" that might be informative? I tried one thing I noticed, but systematic would be better. Like a word cloud?

Edit summaries that contain “1RR” I attempted something quantitative.

A frequent topic for BilledMammal was the 1RR – I searched the edit summaries of BilledMammal and the Icewhiz socks for edits relating to this.

The original Icewhiz made an abnormally high number of 1RR complaints. Other Icewhiz socks have made occasional complaints, sometimes lodging very detailed complaints to arbitration / requests / enforcement.

I can't find any other editors on Misplaced Pages who use this rule as much as Icewhiz and BilledMammal, I checked a few other people in the same threads, most had under 100. For the only editor I found with more mentions of “1RR” than BilledMammal, their edits mentioning “1RR” were over a period of more than ten years, whereas BilledMammal's were mostly within a window of 10 months.

The amount of detail on arbitration enforcement reports by 11Fox11 and Free1Soul resembles complaints made by BilledMammal

BilledMammal = Over 270 edits contain “1RR”

Icewhiz = Over 160 edits contain “1RR”

I tried to fill the gap by searching the arbitrations archives for 1RR, that might be how I found Free1Soul or they could have come to my attention as a "deletes a lot" account. I found a few extras, a few of those were already labelled Icewhiz socks, but the gap is mostly full of Eosterix making thousands of sock complaints.

Free1Soul = 4 edits contain “1RR” From 15 to 16 October 2021

11Fox11

ABHammad = I found only one but it's unusually threatening, “Please self-revert, or be reported to AE”. 10 August 2024

Kentucky Rain24 = just one showed up in a search, but it revealed a previous edit that made a new section with “1RR” in the heading, but not the edit summary.

Gaps in 1RR complaints

I checked all the confirmed Icewhiz accounts but not all the suspected.

Gaps (not counting when the Icewhiz are being accused or defending someone)

  • 8 November to present
  • 12 August 2024 to 8 November 2024
  • 16 October 2021 to 1 October 2023
  • 15 September 2019 to 30 September 2021

When looking for possible undiscovered socks I found “Free1Soul” who is blocked as an Icewhiz sockpuppet but not labelled or in the categories.

There could be undiscovered socks in this gap, but I've not found any that look likely, and most of the gap is filled by Eostrix making thousands of edits about socks. Eostrix has 3284 edits that contain “sock” from 31 December 2019 to 04 October 2021

Collaboration on Arbitration Enforcement Requests

These sets all seem to be overlapping?

7 November 2024 - BilledMammal lodged and enforcement request and ABHammad adds follow-up — Preceding unsigned comment added by Industrial Metal Brain (talk • contribs)

Editor interaction

BePrepared1907 and BilledMammal - I think I've seen them do very convoluted things, they follow content to new pages if things get split or merged, one puppet works on the old page and one on the new. I couldn't keep track of it, but I think that's what I saw.

2024_Southport_stabbing interaction - UnspokenPassion then BilledMammal takes over.

Cooperation on misleading referencing

Again, declaring bias because a lot of this relates to my own edits being reverted, but I think I can see a general strategy used by these accounts.

Others might be able to find other puppets doing the same thing.

There are multiple puppet-like accounts, including BePrepared1907, protecting UnspokenPassion's repeated use of the same few pro-Israel sources in the same article. UnspokenPassion, and possibly others cited the same Israeli academic over 40 times on one page. They also cited the same paper from Haifa University over 20 times on one page.

As far as I can tell the things they cite are legitimate sources, but they do favour Israel are not notable enough to cite that many times.

Unspoken passion hid this by making the citations refer to a specific page. It looked like many sources were cited, but the majority were page references for a tiny number of actual sources in the bibliography.

When I have tried to flag things as "one source section" or "additional sources needed" the puppets removed it as "tag bombing" after someone restored them, a different suspected puppet removed it.

They also removed attempts to add attributions.

3rd suspected puppet

Boksi

Boksi showing BePrepared1907 and BilledMammal traits and helping UnspokenPassion

Additional info from IOHANNVSVERVS: I have concerns of Boksi engaging in pro-Israel POV pushing generally, and here is Boksi restoring a reverted edit of BePrepared https://en.wikipedia.org/search/?title=Palestinian_suicide_attacks&diff=prev&oldid=1268421917, https://en.wikipedia.org/search/?title=Palestinian_suicide_attacks&diff=prev&oldid=1268141377. IOHANNVSVERVS (talk) 19:47, 9 January 2025 (UTC) Also see https://en.wikipedia.org/Talk:2024_Neot_HaKikar_shooting#Restoring_sock_edits. IOHANNVSVERVS (talk) 19:49, 9 January 2025 (UTC)

Edit segregation

They segregate topics, the disposable puppets focus on the topics BilledMammal avoids. The simplest is BilledMammal works on mainly new pages about things that happened after Icewhiz and Eostrix were blocked.

BilledMammal avoids making any edits to specific pages, despite other edits showing intense interest in the page or topic. e.g. Talk:2018–2019 Gaza border protests: both BilledMammal and Icewhiz edited the talk page dozens of times, but only Icewhiz ever edited the page. Talk page timeline

Editor interaction analysis limitations

We really need a control column in the editor interaction analysis. It needs the option to add all pages in a topic to the list. That will mean you can distinguish bad actors from good faith editors with shared interests.

Alternatively, if we could include all pages by every editor instead of only those with overlap.

Currently a system of disposable socks who are careful to never edit the same pages is invisible. Whereas if you have "all pages in topic" as an additional column you'll be able to catch systems working together.

If a collection of accounts cover a whole topic without ever editing the same pages, that's suspicious. The active master of that set is likely to be an unusually rule-abiding editor who has edited all those pages.

I.M.B. (talk) 01:23, 9 January 2025 (UTC)

Hypotheses and suggestion

From what I've seen I suspect that Icewhiz uses two types of puppets. But one of those would be better described as master. They have a main account that looks like an experienced editor and simultaneously a collection of disposable accounts that create new articles.

The ban revert policy probably exacerbates the second problem, because creating multiple articles with one account means they ALL get deleted when the account gets caught.

If you change to needing the AfD process to delete a whole page, then instead of making a greater number of accounts they will write better articles. They could also write more subtly biased articles, but if the AfD process flags them as sock created then other editors can check for deceptive referencing and verify sources.

They could also keep creating sock armies to avoid facing that scrutiny, but the effort needed to bring them all up to 500 edits will be a bit less worth it, particularly the higher level of effort needed to do that without being obvious.

This group are also clearly very active in the AfD process, people will find ways around any system, but it at least will put less direct pressure on creating very large numbers of disposable article creation accounts.

And if people selectively use the AfD system to remove things for political reasons, it at least won't be invisible. Whereas quick delete is designed to make things disappear untraceably. Having things disappear invisibly in a contentious topic seems very counter productive towards trying to find and stop people who are editing in a manipulative way.

I.M.B. (talk) 19:01, 8 January 2025 (UTC)



Comments by other users

I've been drafting another batch SPI, and BePrepared1907 was part of that batch (disclosure: this account was brought to my attention here), so here is some additional behavioral evidence related to that account:

Israel the old "various causes" / "numerous factors" edit war--note this is over a period of 3 months: ABHammad, HaOfa, O.maximov, PeleYoetz, Galamore, BePrepared1907

Axis of Resistance: EnfantDeLaVille, Galamore, HaOfa, PeleYoetz, BePrepared1907

Druze in Israel: HaOfa, BePrepared1907

1948 Arab–Israeli War: HaOfa, BePrepared1907

Palestinian suicide attacks - an article created by sock User:UnspokenPassion: HaOfa "drive by tagging", BePrepared1907 "Drive-by tagging"

International Criminal Court arrest warrants for Israeli leaders: ABHammad, BePrepared1907

Mișu King of the Kebab is an article started in 2022 by BePrepared1907 that has had less than 20 revisions since, one of them by PeleYoetz (article history)

I know מתיאל ("Matiel") was determined "unlikely" above at #08 November 2024, but nevertheless:

I've also had some concerns about BilledMammal=Icewhiz, but hadn't raised them on-wiki because I was worried I was just being paranoid and lacked any real "smoking gun." Since the connection is "Possible", however, I will post some behavioral evidence about that suspected connection in the next 24hrs. I'll try to post the batch SPI in the next 48 hopefully by this weekend; the other accounts in that batch may shed some light on BePrepared (or even BM). Levivich (talk) 19:05, 7 January 2025 (UTC) Updated. Levivich (talk) 02:31, 9 January 2025 (UTC)

Some additional items about BePrepared (xtools) I forgot to include above:
  • Account created Dec 2014 but doesn't start editing until June 2015
  • Makes less than 100 edits between June 2015 and Nov 2023
  • In Nov-Dec 2023, makes 400+ edits, in a clear rush to XC
  • Gets XC on Dec 3, 2023, after which their editing drops to almost zero (about 25 edits between Dec 3 2023 and August 2024)
  • July and early August are when I filed the ABHammad (Jul 22-31), O.maximov (Aug 4-16), HaOfa (Aug 11-17), and PeleYoetz (Aug 11-24) AEs; BePrepared returns to activity on Aug 13--two days after the HaOfa and PeleYoetz AEs were filed--and subsequently, he repeats the edits of these editors (diff'd above)
  • In 859 edits, "Adding" appears in the edit summaries 222 times
  • I don't remember who, but I think I remember that scouting was one of the topics of interest of some of these known socks; see BePrepared's user page and contribs re: scouting
  • Timecard shows editing mostly in the 12-14:00 UTC 2-hour-window; looks the same or similar as many other socks, e.g.
The rush-to-XC, followed by dormancy, and a return to activity after other socks in the group "get in trouble," is a pattern we've seen throughout this group. Levivich (talk) 19:59, 7 January 2025 (UTC)
I disagree with BK's comment about "major process work". Icewhiz is the user who taught me how to make the NFooty AfDs table, and you can see his coaching of me at that sandbox page's talk page. It was the similarity -- both in choice of target (WP:NSPORTS) and methodology -- between my collaboration on NFooty with Icewhiz and my collaboration with BM on Lugstubs that initially raised my suspicions. Levivich (talk) 20:06, 7 January 2025 (UTC)
@Levivich I don't know where I am supposed to respond to comments, move this if needed. In one of the threads above someone raises the possibility of multiple people. It looks quite plausible that this is an actual different person following the same playbook. The timecards are different, IW is only waking hours in a Middle Eastern work week, Sunday to Thursday, BilledMammal is active at a lot of times IW never was. Possibly the person who was running the account actually moved (which will make checkuser very difficult) or possibly they deliberately did things first things at weird times to look different. I left out some of the more speculative parts of what I had accumulated off Wiki, but the first thing BilledMammal does is make a draft article about Melbourne at a time that makes sense for that time zone. They also seem a bit vague about where they are pretending to be from, Australia or New Zealand. They also do a lot of automated edits that obscure the human edits, if there is any way to remove automated edits from what is in the timecard that might help. I.M.B. (talk) 03:52, 8 January 2025 (UTC)
If you are compiling a report, look for pages you would expect them to be most active on but that they have never edited, one I noticed was the main page about the Hostage crisis during the Israel– Hamas war. They sound extremely passionate about that topic on a few other pages and talk pages, but they have never edited the main page about it. This is not normal? I.M.B. (talk) 19:01, 8 January 2025 (UTC)
@Levivich. If you are doing that can I suggest one to include: Dclemens1971.
I'm not sure what the rule is on where to mention things. I am not accusing that one as such, but it looks worth checking. It really looks like them from the profile page, then I put it in an editor interaction table and all those deletion sorting pages showed up, including one about sport. I.M.B. (talk) 08:27, 9 January 2025 (UTC)
@Industrial Metal Brain: Why did you mention Dclemens1971? Please clarify this. —Alalch E. 01:46, 10 January 2025 (UTC)
@Alalch E. @Industrial Metal Brain I have no idea what this is about (Icewhiz?), but ANYONE who nominates a lot of AfDs, as I do in my capacity as a New Page Reviewer, will show up in editor interaction charts for the deletion sorting pages, because any time you nominate an article using XfD, it automatically edits the nomination onto those sorting pages. And I nominate AfDs across all categories. So of course I overlap with any other editor who was active at AfD, as I apparently do with Icewhiz -- but that's just a function of how deletion discussions are created. At SPI you need to provide diffs, not just interaction tables. If you are looking for overlap at SPI, overlap on the deletion sorting pages is the very last thing to look for. Dclemens1971 (talk) 03:35, 10 January 2025 (UTC)
On IW/BM:
To be clear, I never thought the above, alone, was enough to justify an SPI report. "Vibes" ain't enough, but that's basically what I got: BM reminds of IW when it comes to I/P, NSPORTS, AE, argumentation style and effort, the use of data and tables (particularly to frame), the hyphen thing... in my view, it becomes a "too many coincidences" thing. Levivich (talk) 02:29, 9 January 2025 (UTC)
Never dealt with Icewhiz so I don't have much to provide here, but I will note a few important things:
1- Icewhiz socks were not necessarily the same person; sure they collaborated and defended each other and likely occasionally gave each other their log-in credentials, but they were probably different people.
2- Icewhiz, from my understanding, was incredibly adept at deception; so much so that one of their socks nearly ran for adminship.
3- What struck me most from dealing with BilledMammal is that they rarely meaningfully contributed to edit articles by adding content, with their focus more on talk pages and AE filings.
Admittedly, I initially did not entertain the idea when this SPI case was first filed. But reading through the case, namely the possible technical connection as well as the interesting oddly specific behavioral coincidences, I am pretty much prepared to be surprised. Makeandtoss (talk) 07:56, 9 January 2025 (UTC)

Fixed formatting. Ian P. Tetriss (talk) 01:10, 8 January 2025 (UTC)

@User:CaptainEek, can I request you compare BilledMammal and BePrepared1907 to each other? They seem similar in personality. It might show a technical connection that BilledMammal and Icewhiz don't. I.M.B. (talk) 00:40, 9 January 2025 (UTC)

@CaptainEek Also, what does "ArbCom" stand for? And what is the difference you have seen between the users?
I saw some very similar Arbitration and Enforcement reports filed by BilledMammal and the socks, if that is what you mean? But I felt uncomfortable sharing a reports about other people as examples. I.M.B. (talk) 08:01, 9 January 2025 (UTC)
@Industrial Metal Brain WP:ARBCOM is the Arbitration Committee, of which I am one of the sitting members. ArbCom sometimes gets private information, which we can't share. CaptainEek ⚓ 08:08, 9 January 2025 (UTC)
@CaptainEek I would like to add Borski to the list, vs BM and BP, edit links in a moment. I.M.B. (talk) 18:48, 9 January 2025 (UTC)
#3rd suspected puppet above. Sorry this is not very organized. I.M.B. (talk) 19:02, 9 January 2025 (UTC)
Boksi* IOHANNVSVERVS (talk) 19:50, 9 January 2025 (UTC)
@CaptainEek @Barkeep49 @Levivich
Borski is a duck? #3rd suspected puppet? I.M.B. (talk) 19:24, 9 January 2025 (UTC)

Or from what Levivich said below, checking Icewhiz vs BePrepared1907 would be warranted. I.M.B. (talk) 01:23, 9 January 2025 (UTC)

Personality and tone seem similar for BilledMammal and BePrepared1907. I have looked more closely at the recent editors, there's not much direct interaction with the originals so I've mostly looked at numbers for those. I haven't seen much of Icewhiz or Eostrix personalities. But I would expect someone to build better skills with organizing people over time. I.M.B. (talk) 02:26, 9 January 2025 (UTC)

Free1Soul is still blocked but unlabelled. Is there someone I need to ask about that? I am not even sure if they were guilty, just the incongruity seems wrong. I.M.B. (talk) 07:55, 9 January 2025 (UTC)

  • No comment on the other two suspected accounts as socks of Icewhiz, but I'd be lying if I said I wasn't a tad concerned that the BilledMammal filing is retaliatory, considering IMB, the filer, is themselves currently under SPI investigation as a possible sock of Irtapil, whom BilledMammal orginally reported for socking (which led to Irtapil's block). The Kip 00:41, 10 January 2025 (UTC)
    And IMB has now been sock-blocked after admitting to being Irtapil. Adding in the fact that Dclemens, who he also found “suspicious,” had also filed an SPI against a past Irtapil sock, I’m about fully convinced that this report with respect to BilledMammal and Dclemens specifically was retaliatory in nature. The Kip 15:14, 10 January 2025 (UTC)
    If you assume it was retaliatory in nature for the sake of argument what useful conclusions could be drawn from that? I think it is none. And I doubt that the assumption would be valid anyway. A simpler explanation is probably that irtapil believes what they said. I don't agree with many of their conclusions, about BilledMammal for example, but I do agree that other accounts named could be socks. The topic area has plenty of socks active every day. I don't think an answer to the question "was it retaliatory?" tells me anything useful. Socks see socks of the opposite valence. The first 2 cases against IMB were filed by socks. They were not processed. The case was picked up by an editor in good standing. I don't know whether the editor prepared it them self or whether they received assistance from another party. I don't think it matters because it is unknowable. I think what matters is that only non-socks should have their reports processed, just like I think only non-socks should have their content retained. Editors in good standing can re-use and re-file evidence from this case in a new case. And I hope ArbCom reads Irtapil's statements on their report and thinks about ways to try to reduce sockpuppetry, or let's say, increase honesty in the topic area, that don't just rely on an unwinnable whack-a-mole approach. There are certainly other experienced editors evading bans in the topic area that could speak openly about it. Maybe we could learn something useful. Sean.hoyland (talk) 16:17, 10 January 2025 (UTC)
    I.M.B. is now a confirmed sock of Irtapil by self-admission. So yeah, it was probably retaliatory, and probably frivolous. Andre🚐 19:37, 10 January 2025 (UTC)
    Since intent is unverifiable and whether a suspected sock is a sock has no dependency on the intent of the filer, I think opinions on the matter have no utility. Sean.hoyland (talk) 04:35, 13 January 2025 (UTC)
    Oh and to answer your question Sean, no I didn't have any assistance in the filing, I prepared it myself. I had already suspected I.M.B. and I did see the cases that were filed by presumably-Yaniv/AHJ socks, but they didn't have any evidence so there wasn't anything I used from those. Andre🚐 21:16, 10 January 2025 (UTC)
    I wasn't asking, but thanks for the reply. I would be okay with a world where we could outsource some ban evasion detection to experienced ban evading actors, as long as the evidence they prepared and presented was high quality and went into a designated sandbox where it could be evaluated by editors in good standing, and maybe picked up, rather than injected straight into the normal SPI system. Sean.hoyland (talk) 04:35, 13 January 2025 (UTC)

Just a passing comment as someone who has been a target of major harassment from Ice - I've had some brief interactions with BilledMammal and never thought there was any similarity between that account and Ice. That said, for what it is worth, I have also entertained the idea that Icewhiz is more than one person (i.e. that it/they is a shared account run by a some group). Food for thought. --Piotr Konieczny aka Prokonsul Piotrus| reply here 02:32, 12 January 2025 (UTC)

  • I've interacted with BM on a number of occasions (but never knowingly with IW as far as I can recall). I have no experience as a CU and probably wouldn't be much good at it, so I'm not going to act as if I know better than people here. That said it seems pretty unlikely that BM could be a sock set up simply to garner a high edit-count and then transition to the IP field to cause chaos there. This is based primarily on the amount of work they had to do in cases like WP:LUGSTUBS being way beyond the amount that you would need to build up an edit-count, and indeed being the kind of work that serves to turn people against you rather than build up social capital. I found BM's shift from sports bios to IP an odd thing to do, but possibly explicable by the way that their efforts in that field had struck a wall after WP:LUGSTUBS2. FOARP (talk) 09:13, 14 January 2025 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

  • I'd say the CU to BilledMammal is  Possible, but some ArbCom knowledge plus my general knowledge of BilledMammal makes me think it's not super likely. CaptainEek ⚓ 18:25, 7 January 2025 (UTC)
  • I have not done a CU, because I find this behavioral evidence completely unconvincing even without ArbCom's knowledge based on my deep knowledge of BM compared to IW. For instance, BM's ability to do major process work of the kind he has done around fundraising and SNGs is behaviorally incredibly different than IW - even with a goodhand like Eostrix. This is categorically a different kind of analysis than my skpeticism than the report above about Rajoub570, where I had skepticism but take seriously the pushback. No comment on BePrepared1907 as there really isn't evidence there (and this is acknowledged as such). Barkeep49 (talk) 19:40, 7 January 2025 (UTC)
    I look forward to seeing the fuller information and additional filing as I am inclined from the evidence presented so far to run a check on BePrepared. Waiting until then for sake of efficiency as much as anything. As for the further BilledMammal evidence, I remain unconvinced. It wasn't the topic areas that was unconvincing to me as much as the way BM went about seeing change compared to how IW would go about seeking change. I will spend some time doing some analysis of each of their contributions at RSN - a forum I know both have lots of edits on and where if I recall correctly BM did some RfC work - to see if I need to re-examine that. Is it possible BM was the return of some other editor? Sure but that is very different than saying he's Icewhiz (especially because at first glance some of IW's behavioral "tells" from 2022 don't seem to be true of BM). Barkeep49 (talk) 20:26, 7 January 2025 (UTC)
  •  On hold to give Levivich another day or so. I anticipate what he has will be a seperate filing, but keeping this "evidence" here until then seems productive. If that doesn't happen in a day or so and/or if this isn't useful for that I will then close this one down. Barkeep49 (talk) 15:42, 10 January 2025 (UTC)

11 January 2025

– This SPI case is closed and will be archived shortly by an SPI clerk or checkuser.

Suspected sockpuppets

Here is the combined EIA for everyone. The common thread for most of these accounts are people showing up on or around Nov 30, when ARBPIA5 opened, and making the same edits/talk page comments as the known socks in these groups (e.g., "colonization," etc.).

Throwaway accounts These may be socks, or may just be people responding to off-wiki canvassing efforts, but they turned up in the searches and "fit the profile" so I'm including them, despite the lack of edits. Contribs are linked below:

  • Sethy07: 2 edits, 1 of which is an edit request about "colonization" at the Zionism article--that old chestnut. The edit was made on Nov 29, the day before ARBPIA5 opened (its opening date was announced head of time, and several of the socks in this group showed up to that article on or about the opening date). The second edit was to change engvar at Concerns and controversies at the 2024 Summer Olympics, a fairly obscure sub-article that has also been edited by User:Minden500, a sock in this group, as well as CU-blocked accounts User:0lida0 and User:FanOfSunYang (I don't know anything about those two accounts and whether they are related).
  • Anon123987: 7 edits, the first 5 are to an article about a kosher certification agency. 6th edit was to Talk:Zionism as settler colonialism to complain about "colonization" (that old chestnut!), and the edit by Anon read as virtually the same as an edit by Sethy017 (lack of capitalization, punctuation, etc.)
  • Ank2408: 1 edit, on Nov 30 (day PIA5 opened), to Talk:Zionism, to agree with User:SECschol (mentioned below); later User:Boutboul (mentioned below in the new users section) also posted to agree in that thread
  • SECschol: 9 edits, all about "colonization" and related, from November
  • Hsilvers: 1 edit on Dec 3, making an edit request to change "the sentence" at the Zionism article ("...as few Palestinian Arabs as possible"), which has been the subject of most of the recent off-wiki commentary. This edit request has been made a million times by throwaway accounts.

If these aren't socks, they're SPAs violating ARBECR.

Older accounts

Pyramids09

Palestinians: HaOfa, ABHammad, Owenglyndur, ABHammad, ABHammad again, Owenglyndur, ABHammad, Pyramids09, Pyramids09 again, Shoogiboogi (listed below)

List of genocides: HaOfa, ABHammad, Pyramids09

Talk:List of genocides: HaOfa, O.maximov, ABHammad, Galamore, IntrepidContributor (mentioned below), Pyramids09

Gaza genocide: ABHammad ("accused"), Pyramids09, Pyramids09, Pyramids09, Pyramids09

I think Pyramids09 (xtools) may be a compromised account like User:Icebear244 and User:916crdshn. Pyramids' account was created in 2021, and they edited in 2021-2022 without, as far as I can tell, making any or many edits related to ARBPIA. Their activity drops in June 2022. Less than 90 edits in 2023. 2 edits in Jan-Feb 2024, and 3 edits in June 2024.

Then, in October 2024, they become an ARBPIA SPA, and pick up with the same long-term edit wars as the blocked group, diff'd above. One of their first edits in October is to complain about Nableezy's pro-terrorism userbox: Misplaced Pages:Administrators' noticeboard/Archive366#User:Nableezy has a (Personal attack removed) userbox (the diff's were oversighted). This is an well-worn give-away. On the same day, they changed their user page: before, after, now--it's like a different person.

They have a very similar timecard pattern that follows the consecutive-editing theory:

MrBismark1871, Benjy613, Mk8mlyb

Zionism: About the "Zionists wanted..." sentence (RFC about this just closed):

Here is the full Zionism article EIA.

MrBismark1871 (xtools)

  • Account created and first edit Oct 2021
  • 130 edits Oct 2021 is highest-activity month; edits sporadically, with <30 edits/mo until Oct 2023; 63 edits in Nov 2023 and hits XC, then drops back down to <6 edits/mo from Nov 2023 until Dec 2024
  • All edits seem to be about eastern Europe, nothing ARBPIA or even Middle East-related (AFAICT) until end of 2024, when they make the two Zionism reverts in Sep and Dec, plus there have been Syria-related edits recently

Benjy613 (xtools)

Mk8mlyb (xtools)

It's not unusual for editors who haven't edited in a long time to read something in the media and then log into their old account and make an edit. But three of them (four if you count Pyramids), each of whom appear to have only one edit to make in ARBPIA, and it happens to be the same as the others (plus a known sock)? Response to media also doesn't explain how MrBismark and Mk8mlyb knew to come back on Dec 5 when Mk8mlyb made that same revert. These may not be sockpuppets, but they're at least meatpuppets, canvassed, or otherwise coordinating with each other.

Boutboul

Boutboul (xtools)

  • Account created and first edit in 2006
  • Has that mostly-two-hour-window time card pattern (2000-2100)
  • ~350 edits 2006-2012; 4 edits 2013-2016; 0 edits 2017-2024
  • 5 edits in May 2024, and then requests XC (it was denied)
  • 0 edits until November 2024, then begins editing more heavily starting November 11 -- that would be right after the November batch of Icewhiz/Galamore SPIs (see above)
  • Hits XC on 11/11 and then stops editing for a couple of weeks
  • On Nov 24, posts on Talk:Zionism arguing to remove "colonization" and change "Palestine" to "Land of Israel" -- see Talk:Zionism/Archive 31#Proposal to Revise the Lead of the Zionism Article
  • On Nov 30, posts an LLM-generated talk page post with hallucinated source quotations (this, alone, merits an indef); the post was hatted and XC was revoked
  • Posts an ARC (that was declined) (note the proposed parties)
  • As a reminder, Nov 30 is the day that ARBPIA5 opened
  • See the DancingOwl section below for info about attempts to regain XC

IntrepidContributor

xtools:

  • Account created and first edit Jul 2022
  • From 2022: User talk:IntrepidContributor#What is your old account? "I haven't even used my old account in years."
  • 855 edits in 2022; 29 edits in 2023; 0 edits from August 2023 until July 2024; 1 edit in July 2024
  • It seems to be all Russia/Ukraine up to this point, no ARBPIA

On August 16, O.maximov AE closed with a warning. On August 17 and 19, 2024, IC returns to activity and makes a series of votes in RFCs and RMs, some in Russia/Ukraine, but also at: Gaza genocide move review, List of genocides, Gaza genocide RFC, Palestinian genocide accusation, Calls for the destruction of Israel, Israel-Hamas war, Al Jazeera RFC, and said, about the Gaza genocide move review, "I sense a new move request coming up." In almost all of those, IC is voting the same way as HaOfa, UnspokenPassion, etc.

No edits between August 19 and Sep 7. On Sep 7, a couple of weeks after the Gaza genocide RM was endorsed at MR, an editor posted an RM to move it back to its original title. I reverted that RM. IntrepidContributor reverted me exactly one hour later. Spends Sep 7-11 editing around the Gaza genocide article.

I filed an AE against IC where I suggested IC was a sock of either User:Wierzba/User:IsraPara2 based on timecard similarities, or Icewhiz. BK checked against Wierzba and determined them to be unrelated. BK didn't check against the IW group, and said I could file an SPI to request a check against that group. I never did because IC stopped editing in September; but now they're back in the last few days (apparently not ARBPIA-related), and since they've turned up in the EIA with Pyramids and others, I figured I'd include them here. Big-picture, it's the same pattern of editing outside of ARBPIA, then a long period of inactivity, and then returning to editing almost as an SPA to pick up where previous socks in this group left off in edit wars. I could believe one or two, but in this report, I've listed 5 in this report so far, who didn't return to editing when the war started, but rather returned in the summer/fall of 2024. It could be in response to media attention, it could be sleeper socks, it could be compromised accounts. The reason I don't think it's media attention is because these accounts are showing up at exactly the right time, at exactly the right place, and making edits that others had made weeks or months prior. I don't believe in that many coincidences, this seems like a surgical, targetted effort.

New accounts

BePrepared1907: see #7 January 2025 above

Shoogiboogi ()

MagyarNavy1918 (xtools)

  • Account created/first edit May 2024, edits steadily since then
  • A bunch of ARBECR violations (Zionism-related edits, though never the actual Zionism article or talk page, until Nov 30) that seemed to have gone unnoticed (see contribs)
  • On that magical day, Nov 30, makes their first post at Talk:Zionism, about the sentence, and includes the false but common talking point that "The citations are mostly from Palestine studies authors" (this is not true, unless you call people like Benny Morris a "Palestine studies author").
  • Still not XC at that point; hits XC on Dec 10
  • Also posts this strange thread "Guys...The Irgun Weren't Labor Zionists". Strange because the article Zionism doesn't say, and never said, that Irgun were Labor Zionists, the article always said "Irgun, the military arm of the revisionist Zionists." (In the Labor Zionism section of the Zionism article as of Nov 30, Irgun is compared with Labor Zionists.)
  • Reposts that same message on Jan 5
  • Normally the above wouldn't be enough for me to include this account, but also a bunch of edits to the same obscure articles in common as various other accounts, e.g. Magyar and Kentucky Rain24 and User:MWQs at Noam (political party); Magyar and Shoogiboogi at History of the Jews in Africa; Magyar and Galamore at Hatzohar; Magyar and BePrepared1907 at Golus nationalism; Magyar and Mk8mlyb at Rockefeller Republican; there are other socks in the page histories of these pages, I haven't gone to the trouble of mapping them all out. As far as I can tell, it's about whether certain groups/people/whatever are "right" or "left" or "centrist".

DancingOwl, Vegan416, Kentucky Rain24

This section maybe should be filed under NoCal (based on the categorization of User:Kentucky Rain24).

  • DancingOwl (xtools): Created Feb 2024; 6 edits until July, then a month of 46 edits, then 0 edits in August and September, comes back in October and has been editing regularly since; hits XC November 2
  • Vegan416 (xtools): created 2016, 15 edits 2016-2022, 20 edits in 2023, started editing regularly Feb 2024; hits XC March 2024
  • Both in the same time zone (though slightly different from Kentucky Rain)

It's hard to "prove" the connection between these three because this isn't based on tag-team edit warring (there is fairly limited overlap, and I haven't looked through it: EIA for those three), but rather on talk page bludgeoning, and the sense, from reading their extensive posts, that they are the same person.

All three are top editors to Talk:Zionism (page xtools), and this is unique because, I'm a top editor of that talk page, and it took me over a year to get on the leaderboard (as it were). KR, Vegan, and DO got there in under a month. Everyone else took months or years to gather enough posts to make the leaderboard.

Substantively, it's like one person: Here are KR's posts , they got blocked at the Nishidani AE. Next, Vegan picks up right where KR left off , same argument topic, same argument style. Vegan got TBANed (for attacking me) at AE. DancingOwl waited a couple of months, but basically picked up where Vegan left off : again, same arguments about "colonization" etc., same gish gallop argument style, same fast-and-loose relationship with sources.

In addition, some overlaps with DancingOwl:

I'm not sure how anyone can evaluate that without reading everything KR, Vegan, and DancingOwl wrote, which would take a long time. Maybe CUs have some language comparison tools they can use or something.

Thanks for reading all this. Levivich (talk) 19:56, 11 January 2025 (UTC)

I am here accused of being a sockpuppet of an editor I've never heard of based on completely random points that are entirely coincidental and unfounded. The accusation has no baring on reality and this level of obsessive scrutiny is unhealthy and sad. IntrepidContributor (talk) 20:42, 14 January 2025 (UTC)
Actually, you have been declared “inconclusive”, see on the bottom of this page. It means no problem. Michael Boutboul (talk) 21:50, 14 January 2025 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Accused parties comment

Unfortunately, instead of addressing my criticism on its merits, Levivich (talk · contribs) chose to initiate this bad-faith ad hominem attack accusing me of being a WP:SOCKPUPPET, with the only "evidence" provided to support this ridiculous accusation being the fact of living in the same time-zone as another editor (though slightly different from Kentucky Rain, by their own admission), and raising multiple substantial objections to their edits (which, in my case, was what led to my becoming one of the top editors on Talk:Zionism page rather quickly).
I'm ready to do whatever is required to verify my identity and I hope that Levivich (talk · contribs) will face appropriate sanctions for making those unfounded false accusations.
DancingOwl (talk) 09:49, 12 January 2025 (UTC)
I will just point out to the similarity of this response with previous SPI "defenses," namely: somehow making their way to the SPI case, attacking the filer, and asking to "verify" their identity. For example, Terrainman's comment on 21:04, 29 December 2024 (UTC): "Please tell me if there is anything at all I can do to verify my innocence..."" Makeandtoss (talk) 10:00, 12 January 2025 (UTC)
I will just point out that taking the most natural response you'd expect to see from a person falsely accused of being a sockpuppet by an editor whose contribution they recently criticized and trying to frame it as another "evidence" is a textbook example of acting in bad faith. DancingOwl (talk) 12:33, 12 January 2025 (UTC)
  • First, I wish to thank Levivich (talk · contribs) for associating me with distinguished editors like DancingOwl (talk · contribs). However, I have nothing to do with them. I have no idea how to defend myself against such accusations:
- My signature is my real name; I have nothing to hide
- A large part of my contributions are in science and technology
- I live in France,
- What else?
Michael Boutboul (talk) 10:43, 12 January 2025 (UTC)
@Barkeep49 - Your time and expertise are invaluable, and I sincerely thank you for them. However, I am quite surprised, to say the least, by the nature of your statement, 'That's not a great success rate when it comes to SPI': proving that editors were falsely accused should indeed be considered a success! That said, I fully agree with you on another point: as DancingOwl (talk · contribs) highlighted, these accusations are not only the result of strong ideological bias but also stem from the accuser's inability to respond to the arguments presented by DancingOwl (talk · contribs).
I acknowledge having made editing mistakes, and I regret them. However, these errors occurred within the context of discussions on the talk page and not directly in the main article. I believe they do not warrant such a high level of suspicion.--Michael Boutboul (talk) 11:17, 14 January 2025 (UTC)
Thanks for giving me the chance to clarify my remarks. You're right that saying that there isn't evidence that someone is socking after they're accused is a success. But checkuser is a fairly invasive tool and I can learn information about a person that otherwise would (rightly) stay private. So my expectation is that we are predominantly invading the privacy of people who are socking. Barkeep49 (talk) 15:22, 14 January 2025 (UTC)
  • I would just like to say that I am not a sockpuppet or a meatpuppet, and I have no idea who the people I have been listed with are, and I am in no way, shape, or form working with them. I am willing to cooperate in any way needed to verify my identity. That's all I have to say, thank you very much. Mk8mlyb (talk) 19:51, 12 January 2025 (UTC)
  • Hello, I am writing to address the concerns raised regarding my account, BePrepared1907. I want to clarify that I am a real person and not a sockpuppet. I am more than willing to provide any necessary information to confirm my identity and assure you of my genuine participation in the Misplaced Pages community.
I appreciate the need to maintain the integrity of Misplaced Pages and I understand the reasons behind these investigations. However, I feel it is important to highlight that my editing activity and interests stem from my personal commitment to providing valuable contributions and fostering accurate, well-researched content on the platform.
If there are specific concerns or questions about my editing patterns or behavior, I am open to discussing them and providing any clarification needed. I genuinely want to continue contributing positively to the Misplaced Pages community.
Thank you for your understanding and attention to this matter.
Best regards, BePrepared1907 (talk) 13:54, 12 January 2025 (UTC)
  • I am not a sockpuppet. I didn't even know what that meant until I was accused of being a sockpuppet for some account. I'm not sure what I am supposed to show as proof of not being a sock puppet. If someone could tell me what I am supposed to do, that would actually be amazing. MagyarNavy1918 (talk) 22:45, 12 January 2025 (UTC)
I guess the evidence I would use would be to look at my edit log. I have edited many articles relating to Israel-Palestine, that is true, but I have also edited or commented on many articles relating to Hungarian, American, and Irish politics as well, as well as making certain edits to the Christian nationalism article, as I have a degree of knowledge on these topics. Those last three do not seem to be consistent with the accounts which are being edited by Icewhiz. Furthermore, I do actively engage in discussions with members of the Misplaced Pages community for my article edits. As someone how is supposedly only focusing on Israel-Palestine, why did I make edits to and add to the talk page of the Know Nothings? I have a decent bit of knowledge about religious nationalism, be it Islamic nationalism in countries such as the Islamic Republic of Iran and Hamas in Gaza, Jewish messianic nationalism and Kahanism in Israel, Christian nationalism in Hungary, the United States, historically in Francoist Spain and both in Protestant Ulster and the Catholic Church in Ireland Republic of Ireland, Hindu ultranationalism in India, or where a lot of these identities merge into one, especially in Lebanon. MagyarNavy1918 (talk) 22:55, 12 January 2025 (UTC)
If you want more evidence, or if this is insufficient, please let me know. Trying to make my case here honestly feels kafkaesque. MagyarNavy1918 (talk) 22:56, 12 January 2025 (UTC)
What trouble are you having? I'm not sure what seems to uncertain. All of this is just very kafkaesque to me. MagyarNavy1918 (talk) 12:54, 14 January 2025 (UTC)
@MagyarNavy1918:, checkuser reveals certain information about the device and browswer you are using and reveals IP information about where the internet traffic is coming from. I was hoping with the context clue of offering that there was something unusual (because of our privacy policies - the ANPDP specificially - I can't say more) you would be able to go "Oh I think I know what he's talking about it's..." and fill in that blank. Barkeep49 (talk) 15:26, 14 January 2025 (UTC)
I'm still bot sure what you are referring too. Are you saying that my IP address does or does not prove I am a sock puppet?
In any case, I was unaware about the edits made by other editors in any case. I have also made edits on unrelated pages such as the talk page on the Know Nothings. I don't remember if I made any edits to that page.
The reason why I made the post on the Zionism page was due to the liberal use of the term "Zionist militias" in relation to the 1936-39 conflict. During that conflict, there was a stark difference between the policy of the Revisionist Zionists and the Labor Zionists, but it seemed as though that difference was being downplayed for the sake of smearing the whole of the Zionist movement. This isn't surprising for an editorial base which changed the definition of "Zionism" to being a form of Jewish ethnonationalism, even though pages on Ahad Ha'am, Brit Shalom, Martin Buber, Ihud, and Herzl's Altneuland which would challenge this assumption.
As for my comments on the Zionist page about "Palestine scholars," that was my mistake: there are also misquotes of historians and Zionist scholars such as Benny Morris. I've just found Misplaced Pages's editorial stance to be far from non-partisan since the beginning of the war, and its frankly made me upset. I know people who lost family members on October 7th, but none of y'all care about dead Israelis to be honest. In none of my edits have I sought to argue that Israel has acted in accordance with international law, nor that the war should continue. If you don't believe me, check my comment on the talk page of the Jewish supremacy article. It's just that the Misplaced Pages editors have become so radicalized and that there is no effective moderation of any of these pages. This isn't the first time Misplaced Pages has had this problem either. Croatian Misplaced Pages was taken over by bunch of far-right Croatians a few years ago, and they effectively erased all references to Croatian war crimes for years on Croation Misplaced Pages AND on English Misplaced Pages for a few months.
To me, when I say this is Kafkaesque, I'm also saying that this feels like a purge of Misplaced Pages moderators who hold inconvenient views for the Misplaced Pages moderation team. The idea that Hamas can commit war crimes AND so can Israel is just too much. But no one on this site needs to correct to explain Israel's war crimes; that Misplaced Pages page quite long. However, with a moderation team seeking to delete Palestinian suicide bombings as a Misplaced Pages page AND has an Israeli war crimes page longer than the Soviet war crimes page (Israel has, in fact, not committed as many war crimes as the country responsible for the Katyn Forest massacre and the Soviet-Afghan War), one has to question your neutrality. MagyarNavy1918 (talk) 16:23, 14 January 2025 (UTC)
  • I deny these allegations of being a sockpuppet wholeheartedly. First of all, my lack of editing between 2022-2024 was because of a lack of interest in editing. However, once I saw the misleading information rampant in ARBPIA, I decided to resume editing. Secondly, Nableezy had been on my radar for a while. I had always meant to report him, and just remembered on that specific day. Thirdly, I changed my userpage in order to make it look better and cleaner. Fourthly (is that a word), 17:00-19:00 UTC correspond to 7:00-9:00 AM my time, which is my preferred time to edit. Fifthly, my efforts on the Palestinian page was not in collaboration with any other accounts. I only edited it because it was wrong. This entire investigation seems less like a genuine effort to crack down on sockpuppets and more a effort to silence opposing voices. This entire discussion is completely disingenuous, and is making me doubt the prior investigations into Icewhiz sockpuppets. Thank you. Pyramids09 (talk) 10:37, 13 January 2025 (UTC)

Further evidence about Shoogiboogi

Evidence is based on comparing users Shoogiboogi with Icewhiz socks.

Account creation dates

  • האופה (“HaOfa”) 24 October 2023
  • Galamore 25 December 2023
  • Minden500 25 January 2024
  • O.maximov 8 February 2024
  • Owenglyndur 22 February 2024
  • Shoogiboogi 16 March 2024
  • EnfantDeLaVille 24 March 2024
  • UnspokenPassion 28 March 2024
  • PeleYoetz 9 May 2024
  • OdNahlawi 20 June 2024
  • EliasAntonakos 24 June 2024

Timecards:

  • Timecards for Shoogiboogi#timecard Shoogiboogi aligns with , , , in which most edits are between their range of 6 am – 8 pm UTC (Shoogiboogi most between 2 pm and 8 pm UTC).

Hyperfocus on Francesca Albanese

Icewhiz socks have made UN rapporteur on Palestine a target, having extensively inserted and/or highlighted several US and Israeli government criticisms of the official:

  • Minden500 3 July 2024
  • O.maximov 27 July 2024
  • “HaOfa” 1 November 2024
  • Shoogiboogi 31 December 2024

Copyright violations

  • Shoogiboogi was warned on 22 May 2024 for inserting copyrighted content
  • Owenglyndur was blocked on 13 December 2024 for copyright violations

Editor interaction tool

Makeandtoss (talk) 10:06, 12 January 2025 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

  • There's an IP, Special:Contributions/5.47.169.16 that's gone around exhorting most of the editors named in this report to respond here. I feel like this is a somewhat unusual area between WP:PIA violation and canvassing on one hand, and the general principle of allowing for defendants to make a statement on another (although in my experience following SPI threads, defendants' comments rarely make a positive difference in their cases). With all that in mind, I'm not sure if any action or notice needs to be taken with respect to this IP, primarily thinking about future instances of the same, as the cat is essentially out of the bag for the moment. signed, Rosguill 16:47, 12 January 2025 (UTC)
    Ultimately the pages are public. But I think there it is the right decision that unlike almost any other conduct forum there is not an expectation to notify people. Barkeep49 (talk) 17:10, 12 January 2025 (UTC)
    For whatever reason, halfway through they switched to a much more threatening tone Special:Diff/1268971984. I don't think it's helpful or particularly accurate to say Your silence may be used against you--if anything, the opposite is likely more true. signed, Rosguill 20:01, 12 January 2025 (UTC)
    If it were something more than a throw away I'd have blocked it. Barkeep49 (talk) 01:50, 13 January 2025 (UTC)
  • I hope to be able to substantively begin looking into this in the next 24 hours. Of course no objections if another CU beats me to it. Barkeep49 (talk) 01:51, 13 January 2025 (UTC)
    Alright. I have just spent 45 minutes beginning to work through this case; I have so far checked 4 of the accounts listed here. I'd hoped to have something one way or another to report, but I don't yet. I have justification to run checks on at least 1 other reported editor and depending on those reults might have to go further down a rabbit hole. However, I'm out of time for the moment so I'm having to pause here and do little expect report that I've spent time. Barkeep49 (talk) 20:22, 13 January 2025 (UTC)
  • Alright here are my outcomes:
    As can be made clear from the above, I did a lot of checking here. This was really a bunch of SPI reports rolled up into a single date. I also thought carefully about each check and if asked could explain the policy basis for each one. So for both those reasons all the checking can be justified. And yet I can't help but take stock of the work as a whole and wonder. I know that Levivich spent a lot of time writing this report and the quality of that work meant there for me to justify checks, but there wasn't so much that I could justify blocking on behavior alone. And even if all of the unresolved pieces end up as blocks, at most we'd have caught 3 socks tied to PIA LTAs and 1 other sock by accident. That's not a great success rate when it comes to SPI and I think it's more likely our final totals will be less than that. I want to do some deep thinking - and would encourage those who frequent this topic area and find socks - on what it all means and to make sure that not we're spooked to the point where "edits with a certain POV" is what is what is making us think someone is a sock. Barkeep49 (talk) 23:51, 13 January 2025 (UTC)
  • Clerical note: I have just removed a number of formatting elements (mostly headers, and a misplaced divider line) from this filing, as well as the previous one. SPI tooling tends to be sensitive to the existence (and placement) of those elements (and they inflate the size of the archive ToCs, which already have a tendency to become too big for comfort), so it is generally best to just stick to the default format and use either nested bulleted lists or bolding if additional structure is needed. --Blablubbs (talk) 14:21, 14 January 2025 (UTC)
  • I think everything that needs doing has been done (with Misplaced Pages:Sockpuppet investigations/NoCal100 open about some of the editors initially reported here). Barkeep49 (talk) 20:37, 14 January 2025 (UTC)
Categories:
Misplaced Pages:Sockpuppet investigations/Icewhiz: Difference between revisions Add topic