Misplaced Pages

Latest revision as of 09:26, 15 January 2025

Icewhiz

Icewhiz (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Populated account categories: confirmed · suspected

For archived investigations, see Misplaced Pages:Sockpuppet investigations/Icewhiz/Archive.

29 December 2024

– An SPI clerk has relisted this case for a checkuser to make another check.

Suspected sockpuppets

• Terrainman (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Evidence relies on comparing User:Terrainman with User:ABHammad and their likely sockmasters User:Icewhiz and User:Dajudem.

Timeline:

User:Terrainman was created on 13 November, just five days after the SPI case against ABHammad was opened on 8 November. Simultaneously, starting 8 November, ABHammad’s contributions drop to records low of 28 edits over a month.

Timecard:

Like ABHammad, Terrainman does not seem to get any sleep, or has a very random sleep schedule, with edits spread throughout the day.

Compare that with the control group of myself for example, where I am clearly absent and asleep between 12 and 8 am UTC. Or with other users who participated in the last Icewhiz SPI: like nableezy who seems to be asleep between 8 am and 1 pm UTC; or Sean.hoyland between 7 pm and 1 am UTC; TarnishedPath 2 pm and 11 pm UTC; Levivich between 7 am and 1 pm UTC; etc. You get the point.

Claiming politicization:

Terrainman’s very first edits are made on ARBPIA-related topic area articles, on the talk page of List of genocides, where they accuse editors of being politicized and infiltrating WP; common ABHammad tactics and talking points. .

Also, as was interestingly noted and characterized as quacking by TarnishedPath in the last SPI, the two blocked socks of ABHammad and “HaOfa” appealed while claiming the move was politicized.

Editor Interaction tool:

Editor Interaction tool reveals they are editing the same exact topics within the topic area: Israel, Golan Heights, Talk:List of Genocides, and Talk:Israel.

Username:

Username of Terrainman (Terrain, man) rings a bell with User:Dajudem’s other sock: User:Stellarkid (Stellar, kid).

Nationality:

An Icewhiz signature, Terrainman seems to continue the habit of pretending to be different nationalities and people, now a Chinese-speaking femboy. Reminder how Icewhiz socks pretended to be: Greek (User:EliasAntonakos), Lebanese (User:EnfantDeLaVille), and Indian (User:Proud Indian Arnab).

Edit summaries

Like ABHammad and Dajudem and Icewhiz socks, they are still extensively using the “adding info” edit summary in their contributions: total of 59 matches for “added info”. Examples:

Negation of adjectives

As demonstrated in the previous SPI, the same odd way of negating adjectives continues, the most peculiar of which is the use of “unneeded”: Unnecessary, unnecessary, unneeded, undoing.

Aggression:

Like ABHammad, Terrainman is always on the offensive and makes very aggressive and provocative comments and accusations, such as this one falsely accusing me on vandalism on my talk page. .

Important note: I had expected that any new socks would try to act as different as possible to other previous socks, but surprisingly this is not the case. Is it a deliberate move to prove a point somehow or mislead SPI by having another co-sock doing these distinctive behaviors? Or that they just don’t care and can easily create new accounts? Makeandtoss (talk) 11:45, 29 December 2024 (UTC)

Extended evidence

SPI Defense: Like ABHammad, Terrainman, who somehow made their way to the SPI case, responded by relying more on attacking the filer, rather than defending themselves.

Shared behaviors and similar comments:

1- SPI defenses:

• ABHammad: "I feel like I am being targeted by editors for providing more evidence relevant to Arbcom's upcoming case."
• Terrainman: "I do think I am being targeted by makeandtoss due to the message I left on their talk page."

2- Alleged "infiltration" of WP

• ABHammad: "...showing how our community has been distorted and infiltrated."
• Terrainman: "...the answer might be political fervor infiltrating Misplaced Pages"

3- Focusing on User:DMH223344

• ABHammad: "DMH223344, who has previously been warned for actual edit warring and violating 1RR, today received only a one-week ban from editing on Zionism."
• Terrainman: "Just checking, are you aware this user User talk:DMH223344, is currently making many edits to the Zionism page?"

4- Extensive use of brackets in comments

• ABHammad: (I'll let other people point the inaccuracies but as far as I can tell it seems correct); (again, related to the Jewish connection to Israel); (or any violations from UnspokenPassion at all); (we haven't reached consensus); (which include a significant number of Hamas militants but the Hamas-run Health Ministry prefers not to differentiate militants from civilians)
• Terrainman: (so essentially it is uncited and is original research) (Leaving out the Syria-Israel element) (it also ignores the Golan heights element of the war); (a page I have not edited or commented on since the first day of my account creation)

5- Asking admins to monitor alleged topic ban violations

• ABHammad: "Just checking, are you aware this user User talk:DMH223344, is currently making many edits to the Zionism page?"
• Terrainman: "I want to make sure someone is monitoring Nishidani's violations of the topic ban you placed."

6- Leaving warnings on editors' talk pages

• ABHammad on Selfstudier's, Levivich
• Terrainman on mine only, so far. Makeandtoss (talk) 10:17, 31 December 2024 (UTC)

7- Promoting a populist narrative of “new” editors being wronged by experienced ones

• ABHammad: “…putting harsh sanctions on new editors but ignoring the clearly disruptive behavior of experienced editors…”
• Terrainman: “…I dared to stand up to NPOV by an experienced editor..” Makeandtoss (talk) 12:15, 1 January 2025 (UTC)

8- Forgetting WP:CHOICE

• האופה (HaOfa) (blocked along with ABHammad as Icewhiz/Dajudem sock): “I’ve been here for a year and have written hundreds of articles. I've invested days and nights into Misplaced Pages.” (total user edits 1900)
• Terrainman: “I have put a lot of work into[REDACTED] since joining a few weeks ago” (total user edits 1100)

9- Accusing editors and WP of ideological bias

• HaOfa: “…lobbying by editors who want the content here to fit their ideology”
• ABHammad: “Editors who don't align with the ideology on Misplaced Pages...”
• Terrainman: “..after I saw what I believed to be ideological bias..”

Attacking checkusers

• Not sure if this is the first occurrence, but Terrainman has taken it to the Administrator’s noticeboard attacking checkusers if they block them as “rogue” admins. Makeandtoss (talk) 17:53, 1 January 2025 (UTC)

Interesting, in that case, it appears to be an attempt at misleading SPI, because the behavioral evidence is quite damning and almost identical to the previous case. But sure, a second and third closer looks at the technical evidence by Icewhizologists would still be very important. Makeandtoss (talk) 12:40, 29 December 2024 (UTC)

What? I have no idea what you are talking about to be frank. I have not been aggressive. 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 21:02, 29 December 2024 (UTC)

" Chinese-speaking" What gave you the idea from my talk page that I am chinese speaking!? 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 21:03, 29 December 2024 (UTC)

This whole SPI response reads like ABHammad and this group of socks to me, this response in particular. For someone who writes their username in Chinese in their signature (地形人 = "terrain man" according to Google translate) to then ask "what gave you the idea from my talk page that I was Chinese speaking!?", complete with faux-outrage ("!?") and sealioning obtuseness (as if we can't all see the signature with Chinese characters in it). It's trolling in my view, and it's an identifiable habit of this sockfarm. Levivich (talk) 17:24, 31 December 2024 (UTC)

I am not trolling, I honestly forgot at the time that I even had chinese characters in my name. It is stylization, and ofcourse you do not need to speak Chinese to use google translate. It was not faux outrage. 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 19:30, 31 December 2024 (UTC)

I will also point out, because it is extremely relevant. That @Levivich is another user who nearly 100% of their edits pertain to Israel. This is a Misplaced Pages:Witch hunt and I am honestly shocked by it. I have put so much work into editing[REDACTED] and to face this just becasue I stood up to NPOV is an injustice in of itself. 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 19:32, 31 December 2024 (UTC)

I see this "blatant bullshitting" as another tell-tale sign of this sock farm. The account made four comments on this page and signed each one--including directly above the "chinese speaking!?" one. The suggestion that they didn't notice or forgot that they had Chinese characters in their signature is so stupid it can't possibly be made in good faith.

And it's just like what OdNawhali said about answering for PeleYoetz. This discussion between ABHammad and PeleYoetz reads to me a lot like Terrain Man's comments here. Right down to the feigning of confusion, attempts to show unfamiliarity with Misplaced Pages by misnaming "sockpuppet" (eg PeleYoetz's "puppet socks" and Terrain Man's "sock users"), and allegations of a conspiracy against them (TM "witch hunt", PY "haunted").

It's true I've been pretty much an IP SPA since the war started, and in that year or so, I've read so much of this from so many different accounts that now it just jumps out at me, it's the same writing style, same tactics, over and over and over again. And I say that as someone who was falsely accused of sockpuppetry by a number of editors when I first started editing here. But I never had problems using the word "sockpuppet." I've come to believe with this sockfarm--which I guess has been going for almost 20 years now!--forget the technical evidence, its the behavioral evidence that's damning. I hope this sockfarm at least makes it interesting in the future and switches up the on-wiki style. It's already boring and I've only been doing this for 1 out of those 20 years. Levivich (talk) 20:44, 31 December 2024 (UTC)

Do you know what percentage of my edits pertain to that topic? I have literally only made a handful of edits/reverts on the Israel topic area, and no edits at all to articles relating to the current war; I am not even watching the Israel-Hamas article! 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 20:46, 31 December 2024 (UTC)

You act so confident about being right, why don't you consider for a moment that you might be wrong. I have alot of work into Misplaced Pages since joining, I am deeply passionate about editing, I dared to stand up to NPOV by an experienced editor, and this is the result. 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 20:48, 31 December 2024 (UTC)

So I am using sockpuppets because I leave warnings, care about NPOV, and... use brackets? Ok 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 10:34, 31 December 2024 (UTC)

@Barkeep49: You are right about ABHammad potentially being a different individual from Icewhiz/Galamore, who is most likely a Dajudem sock. On the other hand, as we know from the topic area and the ABHammad SPI case, there is extensive coordination between these socks. And for that matter, WP does not distinguist between sockpuppetry and meatpuppetry. A possible solution would be to have ABHammad as a confirmed sock of Dajudem, and a suspected sock of Icewhiz/Galamore.

That aside, could you or any other checkuser kindly elaborate to us what kind of sophisticated obfuscation techniques are being used by these closely related families of socks, as understanding this will help immensely in the organization and presentation of evidence? Are they multiple individuals handing over their log in credentials to one another to mislead time-wise and style-wise? Or is it one individual just using proxy and VPN methods and device and software changing tactics? Or is it somehow a combination of both? Makeandtoss (talk) 19:15, 2 January 2025 (UTC)

@Barkeep49: That is fair. Judging from the past Icewhiz SPIs however it becomes apparent that it is the behavioral evidence that has been detrimental, with technical evidence often inconclusive. As time passes they will become better at obfuscating the behavioral evidence, so access to at least some of the technical conclusions -not necessarily the hard evidence themselves- is important. Can I be emailed about this as a possible solution? Makeandtoss (talk) 20:19, 2 January 2025 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Hello, I'm not sure what is going on here. Obviously I am a bit alarmed about this. I do not have any 'sockusers'. I encourage check users to verify this. I am happy to stay away from editing contentious topics if that is what is necessary. --𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 20:58, 29 December 2024 (UTC)

I will also point out that I left a message on Makeandtoss' talk page regarding what I suspected to be ideolgically motivated subtle vandalism by them, I don't know if this is 'revenge' from them or good intentions. But I look forward to check users verifying my innocence. Again, I am more than happy to stay away from contentious topics including the Israel wiki project, which, admitedly, is what inspired me to create an account after I saw what I believed to be ideological bias on the list of genocides page (a page I have not edited or commented on since the first day of my account creation). 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 21:00, 29 December 2024 (UTC)

I will also add that almost 100% of makeandtoss' edits are on articles relating to Israel, and there are a very large number which suggest this user is not ascribing to NPOV. I left a message on their talk page mentioning this and quoting several edits which I believe amount to subtle vandalism, and I strongly believe that this accusation is 'revenge' for that message. 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 22:30, 29 December 2024 (UTC)

Do you know what WP:ASPERSIONS are? If you have a complaint about another editor, then make that complaint in the appropriate forum. Selfstudier (talk) 10:42, 31 December 2024 (UTC)

I understand, I shouldn't have gone as far to bring up their editing history, however it pertains to the message I had left on their talk page, which I believe is the reason why this accusation of sockpuppeting is being brought forth by them; I believe that to be relevant to the investigation, but perhaps I am wrong. 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 10:50, 31 December 2024 (UTC)

@Makeandtoss: what did you mean in your edit summary on this investigation: "this should be closed by self-admission already"? — Preceding unsigned comment added by Terrainman (talk • contribs)

Please tell me if there is anything at all I can do to verify my innocence. I do think I am being targeted by makeandtoss due to the message I left on their talk page. 𝙏𝙚𝙧𝙧𝙖𝙞𝙣𝙢𝙖𝙣地形人 (talk) 21:04, 29 December 2024 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

• Terrainman edited as an IP for a while before creating their account. They have another account with zero edits (not a violation of policy in itself). Technically, they really don't look like ABHammad, Galamore, or other past Icewhiz accounts, and there are no obvious signs of CU obfuscation shenanigans. But I'm not an Icewhizologist, so second opinions are welcome. Spicy (talk) 12:21, 29 December 2024 (UTC)

  I continue to be uneasy about linking ABHammad to Icewhiz/Galamore. That said I do find reasonable behavioral evidence here linking Terrainman to ABHammad. I did a limited amount of actual CU'ing, but from what I see @Spicy: I feel like there's nothing there to suggest it's not ABHammad. What are your thoughts on the behavioral side of things (ignoring any Icewhizology and just thinking about ABHammad/Terrainman)? Barkeep49 (talk) 18:51, 2 January 2025 (UTC)

  I suppose one could say re. the technical evidence that there's nothing there to suggest it's not ABHammad, but I don't think there's anything that particularly suggests that it is either, i.e.  Inconclusive,  Behavioural evidence needs evaluation. I haven't examined the behaviour beyond verifying that it's credible enough to justify a check. That I will leave to others. Spicy (talk) 19:02, 2 January 2025 (UTC)

  @Makeandtoss we are generally reluctant to share too much about what behaviors we're focused on in the hopes that it will make it harder for the sock to change up in a new way that becomes harder to detect. Barkeep49 (talk) 20:11, 2 January 2025 (UTC)

  We've been blocking Icewhiz largely on certain not disclosed, and shifting, behaviors more than technical evidence for quite some time now. Sometimes the behavioral pattern is shown through the technical evidence, other times not. I understand how frustrating this is to people who aren't CUs. Barkeep49 (talk) 20:31, 2 January 2025 (UTC)

02 January 2025

– A user has requested CheckUser. An SPI clerk will shortly look at the case and endorse or decline the request.

Suspected sockpuppets

• Rajoub570 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Evidence relies on comparing User:Rajoub570 with User:Icewhiz socks (mainly EnfantDeLaVille, but also EliasAntonakos) as well as possible connections with other sockmaster User:Tombah.

Creation dates:

• User:האופה (“HaOfa”) 24 October 2023 האופה
• Rajoub570 25 December 2023
• User:Galamore 25 December 2023
• User:Minden500 25 January 2024
• User:O.maximov 8 February 2024
• User:Owenglyndur 22 February 2024
• User:EnfantDeLaVille 24 March 2024
• User:UnspokenPassion 28 March 2024
• User:PeleYoetz 9 May 2024
• User:OdNahlawi 20 June 2024
• User:EliasAntonakos 24 June 2024

Timecards:

• Almost identical timecards for Rajoub570 with EnfantDeLaVille, OdNahlawi, EliasAntonakos, with most edits 6 am to 6 pm UTC, and the fewest daily edits on Saturday.
• Interesting complementarity between the aforementioned users and Galamore, in which all of them are editing 4 am and 8 pm UTC, but Galamore has most edits concentrated 4 am – 7 am UTC.
• Timecard comparison between Rajoub570 and Tombah.

Editor interaction tool

• Comparing Rajoub570 with EliasAntonakos shows odd focus on some specific Palestinian villages and the Arab migrations to the Levant article, and comparing Rajoub570 with EnfantDeLaVille shows odd focus on random Lebanese village of Rmaish.

Pretending to be different nationalities

• EnfantDeLaVille supposedly Lebanese
• Proud Indian Arnab supposedly Indian
• EliasAntonakos supposedly Greek
• Rajoub570 supposedly Palestinian

Second language choices

As usual, most edits on English WP, with very few edits on a second language:

• Galamore and PeleYoetz editing on Hebrew WP
• O.maximov editing on Russian WP
• EnfantDeLaVille editing on French WP
• Rajoub570 editing on Arabic WP

Use of Arab family names

• OdNahlawi, ex: Abdul Karim al-Nahlawi, Syrian military officer
• ABHammad, ex: Salameh Hammad, Jordanian police minister
• Rajoub570, ex: Jibril Rajoub, Palestinian security official

Stonewalling

An Icewhiz sock signature, Rajoub570 has engaged in stonewalling:

• Rajoub570
• EnfantDeLaVille
• Galamore
• PeleYoetz

Hyperfocus on Arab and Jewish demographic history

• Side note: Another sockmaster User:Tombah created the Origins of the Palestinians article on 9 July 2023
• Rajoub570 created articles of Liyathnah and Bedul in early 2024 that promote the controversial theory that these Arab tribes are of Jewish origin
• Rajoub570 starts editing the Origins of the Palestinians article starting 5 February 2024
• EliasAntonakos creates article of Muslim migrations to Ottoman Palestine on 30 June 2024, which has been recently deleted as a misrepresentation of sources
• Rajoub570 sneakily inserts a link of the then recently-EliasAntonakos-created Muslim migrations to Ottoman Palestine into the Origins of the Palestinians article on 21 July 2024
• Rajoub 570 creates the Arab migrations to the Levant article on 18 September 2024
• EliasAntonakos at Arab migrations of Levant made several reverts in favor of versions created by Rajoub 570, starting 29 September 2024: and

User pages

And now for the most incriminating piece of evidence: first version of Rajoub570’s userpage has the exact same structure and content to that of EnfantDeLaVille, with five user boxes in horizontal order and five categories, all identical identifications.

• EnfantDeLaVille’s user boxes: from Lebanon (nationality), a Maronite (religion), geography (interest), hiphop music (interest), French (citizenship)
• Rajoub570’s user boxes: from Palestine (nationality), Muslim (religion), Middle Ages (interest), Ottoman Empire (interest), Islamic Architecture (interest)
• EnfantDeLaVille’s categories: Lebanese Wikipedians, Maronite Wikipedians, and the rest interests
• Rajoub570’s categories: Palestinian Wikipedians, Muslim Wikipedians, and the rest interests. Makeandtoss (talk) 14:06, 2 January 2025 (UTC)

Further evidence on demographic history

@Barkeep49: Of course, that doesn't make sense, but that's not what the behavioral evidence I presented above points to, so it a closer look will show, as Nableezy mentioned, that it is anti-Palestinian content being propagated, characteristic of an Icewhiz sock.

This anti-Palestinian and anti-Arab content is denying the indigenous nature of Palestinians by over-amplifying their connection to the Arabian peninsula, and by controversially claiming that some Arab tribes are originally Jewish. Propagation of this material has been done in tandem with other Icewhiz sock, as demonstrated above and as I will further expand on below.

An admin just now restored the deleted Muslim migrations to Ottoman Palestine article to my talk page: User:Makeandtoss/Muslim migrations to Ottoman Palestine, and it shows exactly the same pattern that I have described above: Rajoub570 intervening there a single time to add content from a Hebrew-language paper on how Palestinians trace their ancestry from the Hauran region, i.e. outside of Palestine.

You're also right about the evidence about Arab family names and second language choices being unconvincing, but that is when they are taken alone. When the full picture is seen collectively, the behavioral evidence clearly points out to an Icewhiz sock. Makeandtoss (talk) 19:26, 2 January 2025 (UTC)

Connections to sockmaster Tombah

@Barkeep49: Thanks for the pushback, I genuinely appreciate it, this shows that SPIs are always taken seriously, and that false positives are very rare. As an Arabic speaker myself, I have now taken a closer look at their Arabic WP contributions, which showed me some further interesting but worrying results:

1- Dura, Hebron:

• Rajoub570's Arabic WP userpage states that the user is a Palestinian from the village of Dura, Hebron.
• This seems to be in line with the aforementioned choice of name by Rajoub570, since the Rajoub family is indeed from Dura, Hebron; and the user knows this themselves as they edited this piece of information there.
• Tellingly, however, their user page says اسمي رجوب aka my name is Rajoub, which is clearly a red flag as Rajoub is a last name not a first name; no Palestinian nor Arab identifies themselves using their family's name this way. Nor would they call their families "clans".
• Several of Rajoub570's edits on Arabic WP relate to adding pictures of Iranian mosques, which is an odd interest for a Palestinian from the West Bank.

2- Connections to Tombah:

• As @Nableezy: mentioned, they had filed a case against Rajoub570 as a suspected sock of Tombah last year, which was unsuccessful.
• Worth noting that the Dura, Hebron article in English WP was edited 32 times by Rajoub570 and 12 times by sockmaster Tombah.
• Tombah has 153 edits on Arabic WP, of which 12 were edits to the Dura, Hebron article.
• Way too many article matches between Tombah and Rajoub570 of oddly specific articles

3- Knowledge of Arabic:

• These related families of socks seem to have at least one individual remotely capable of some Arabic with the aid of google translate, namely Icewhiz sock OdNahlawi who has 106 edits on Arabic WP.
• Rajoub570 maintains a strict use of an overly neat modern standard Arabic, which is unusual in a setting like a user page or talking to other users.

@Rosguill: And you are right, making a few token edits on Arabic WP to avoid suspicion is a trivial sacrifice. However, I am afraid that Arabic WP could also be subject to this kind of systemic manipulation, through different clusters of users.

I have so much more to say, but this will be a story for another venue. Makeandtoss (talk) 21:40, 2 January 2025 (UTC)

Further evidence linking with EnfantDeLaVille

• Rajoub570: "As a Palestinian, whose life is affected daily by the conflict, with my criticisms of Israel, I find this behavior problematic for Misplaced Pages." Rajoub570 made this comment as part of an ANI report complaining that a user, among a number of things, called Israel a rogue state.
• EnfantDeLaVille: "The events in Lebanon in recent months catch me at a sensitive time, and the suffering of my people from the situation in my homeland is unbearable." EnfantDeLaVille made this comment as part of an AE report filed against them for a number of things, among them, giving Israeli premier Netanyahu's statements undue weight in an article's lede. Makeandtoss (talk) 09:44, 3 January 2025 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
@Barkeep49 I dont think Rajoub's editing can reasonably be described as "pro-Palestinian content". I previously raised this editor as a potential sock of Tombah before and was told unrelated however. Have no comment on any connection to Icewhiz, would surprise me, but I personally remain convinced of my earlier view on what prior account they may have had. But the part on "making pro-Palestinian content" is in my view completely wrong. The editing behavior of a person saying they are Palestinian but editing mostly with a position that can best be summarized as "Palestinians arent real, they're just Arab immigrants" and primarily citing material from Hebrew journals published by a university in an Israeli settlement is not what I would call "pro-Palestinian content". nableezy - 19:11, 2 January 2025 (UTC)

• FWIW, for me, from a statistical distance perspective, the closest match to Rajoub570 is Owenglyndur, significantly closer than other actors. This might be reflected in some of the page intersections at multiple pages with low revision counts and unique actor counts (see table below).

Owenglyndur has been categorized as a Galamore sock/possible Icewhiz sock. I have no idea whether that is correct, but I would not rule out a connection to the Category:Misplaced Pages sockpuppets of ElLuzDelSur group as both Rajoub570 and Owenglyndur are statistically close to that set of actors. Sean.hoyland (talk) 03:01, 3 January 2025 (UTC)

• Here are some claims by Rajoub570. Here is a claim by EnfantDeLaVille,"The events in Lebanon in recent months catch me at a sensitive time, and the suffering of my people from the situation in my homeland is unbearable.". Misplaced Pages requires us to assume good faith, but in the PIA topic area, the probability of encountering those special individuals who are only capable of seeing utility in dishonesty and the cynical exploitation of suffering for camouflage is non-zero. Sean.hoyland (talk) 04:50, 3 January 2025 (UTC)
• I'm useless as a sock-catcher, so I won't comment on matches. I'll just note that Rajoub570 does not make pro-Palestinian edits. Actually much of their effort has gone into presenting "evidence" that Palestinians are recent immigrants, descendants of Jews, etc.. For example, here Rajoub570 reported an anecdote about an Arab telling Israeli soldiers he was descended from Jews, with the edit summary "this is another piece of the folklore of my people and land and has important historical and modern consequences". Zero 05:42, 3 January 2025 (UTC)
• I agree that for whatever it's worth, this doesn't seem like a pro-Palestinian user, the edits to ar are probably to "throw off the scent." Andre🚐 02:12, 6 January 2025 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

• I think we've lost the plot if we're now suggesting Icewhiz is making pro-Palestinian content. I also find behavior like that listed under "Use of Arab family names" and "Second language choices" unconvincing. Barkeep49 (talk) 18:56, 2 January 2025 (UTC)

  I would describe this edit on arwiki from January as making pro-Palestinian content. Barkeep49 (talk) 20:18, 2 January 2025 (UTC)

  If the sockmaster's goal is to influence coverage English Misplaced Pages, making a few token edits on Arabic Misplaced Pages, a project that both receives much less traffic and whose pro-Palestinian bonafides are displayed as a banner on every page, seems like a pretty trivial sacrifice. It would be one thing if they had extensive participation in discussions expressing a consistent viewpoint, but a quick writeup of essentially-neutral article text doesn't seem like conclusive evidence of anything in particular. I'd be curious if editors fluent in Arabic could identify whether the edits reflect a particular regional dialect or other distinctive pattern. _signed, Rosguill 20:53, 2 January 2025 (UTC)

  And just as a note: while this reply came only a few minutes after my comment above, I'd actually invested a fair amount of time into looking into the behavioral evidence all listed here before making either comment. Barkeep49 (talk) 20:32, 2 January 2025 (UTC)

7 January 2025

– This SPI case is closed and will be archived shortly by an SPI clerk or checkuser.

Suspected sockpuppets

• Icewhiz (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Eostrix (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• BilledMammal (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• BePrepared1907 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Free1Soul (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• ABHammad (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• UnspokenPassion (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Boksi (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Clerical

Free1Soul was blocked as one of this set but not labelled.

I found it looking for accounts that look like BilledMammal and Icewhiz.

Sorry if this is not formatted correctly. I tried to copy others' sections. I've been compiling this off wiki. I can't see a size limit anywhere on here. If I have missed one please ping me from this page and I will come back and trim this. I.M.B. (talk) 12:51, 7 January 2025 (UTC)

What I noticed

I have been trying to improve some of the pages started by Icewhiz puppets, and I saw those accounts deleting cited content on multiple other pages, alongside that I also saw the mass rollback by BilledMammal. It is difficult to quantify or compare "deletes a lot", but I also found more specific similarities in what they add.

Reporting

On 21 March 2022 BilledMammal was first raised in the Icewhiz sock archive. At the time it looked unlikely, but since then there was an attempted mass removal of content using rollback (the thing I noticed) and a very large number of edits during the year before BilledMammal went quiet.

BePrepared1907 also deletes a lot of sourced content with similar themes, there are a lot of shared pages between the 3 but I haven't looked at any of these in depth yet. There is a swarm of accounts with a few dozen edits around BePrepared1907.

I should probably disclose BePrepared1907 has been reverting a lot of my edits recently, so I might be biased.

Masters

BePrepared1907 could belong to a different set, but personality seems like BilledMammal's.

BilledMammal looks vividly like the original Icewhiz account.

Comparing things I noticed in BilledMammal history to most active Icewhiz accounts, the one in the middle Eostrix changes tactics, then a year or so ago BilledMammal became a monolingual English speaking version of Icewhiz. BilledMammal works only in English, I don't think I've ever seen an account with that many edits and zero on any other language

ARBPIA_activity_statistics_complete

BilledMammal has created a user space page cataloguing sockpuppets (and other things)

Some people have mentioned irregularities in these, relating to:

• Onlineone22
• MurrayGreshler
• Kentucky Rain24
• Izzy Borden
• Red Slapper
• O.maximov
• UnspokenPassion

Interaction with those

• Icewhiz (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Eostrix (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• BilledMammal (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• BePrepared1907 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Onlineone22 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• MurrayGreshler (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Kentucky Rain24 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Izzy Borden (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Red Slapper (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• O.maximov (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• UnspokenPassion (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

"deletes a lot"

They look similar, but what's normal?

BilledMammal's top two most edited pages show more removals than additions

BilledMammal

• Most edited page Israel–Hamas war, about half of their top edits remove content (top edits)
• Second-most edited page List of military engagements during the Israel–Hamas war, more than half of their top edits remove content. (top edits)

Icewhiz - Has a similar examples in their top few most edited pages

• Jan Grabowski - top edits
• Antisemitism in the British Labour Party - top edits

On others Icewhiz is removing a lot, but probably not an abnormally large amount? history to most act/en.wikipedia.org/Icewhiz/1 top pages

Update "deletes a lot"

Recent edits by BePrepared1907 (past few days) are predominately deletions.

• BePrepared1907 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Kentucky Rain24: One of their top pages Ofer Prison was mostly removals

I.M.B. (talk) 20:00, 8 January 2025 (UTC)

Timeline

6 August 2012

• Icewhiz account created on Hebrew Misplaced Pages

30 January 2017

• Icewhiz account created on English Misplaced Pages
• early edit history
• Icewhiz active February 2017 to September 2019

29 March 2019 Icewhiz gets a contentious topic notice for Israel–Palestine

BilledMammal xtools

• Created 24 April 2019
• A few edits per month
• zero from 20 September 2019 to 4 December 2019

1 October 2019 - Icewhiz blocked

BilledMammal early edit history

• 14 edits in December 2019
• vanishes on 6 December 2019

Eostrix on English Misplaced Pages xtools

• 15 October 2019 to 20 October 2021 user contributions

18 May 2021 BilledMammal reappears and makes an edit request

3 July 2021 - Saturday approx 4:00am UTC

• BilledMammal updated to extended confirmed user.

20 October 2021 - Eostrix gets blocked

24 October 2021 - Contentious topic notices appear on BilledMammal's talk page for both the Arab–Israeli conflict and the Holocaust, 12 hours apart. Both topics that the Icewhiz and socks were clashing with people over. BilledMammal responded to the earliest suspicions by making an arbitration complaint about “Insinuation of sockpuppetry”

20 March 2022

• BilledMammal first raised in the Icewhiz sock archive.
• Ruled out without a check.

1 October 2023

• BilledMammal started messaging people on their talk pages about 1RR violations, Icewhiz also made an unusually large number of complaints about this” (see last section).

Edits on the same pages

The Holocaust and the Arab Israeli conflict are sufficiently interconnected (e.g. The Holocaust and the Nakba) that they are not a suspicious combination, but BilledMammal suddenly attracted attention in both topics 3 days after the most active Icewhiz sock was blocked.

BilledMammal and Icewhiz also mention some very specific matching points years apart.

UNRWA

• both IW and BM were accusing UNWRA of connections to Hamas

List of genocides

• Icewhiz raises Polish operation of the NKVD as a new topic
• BilledMammal raises “Polish Operation of the NKVD” specifically, while making a point of claiming to not know much about it, “while I have, regretfully, no knowledge of the Aardakh, and minimal knowledge about the classification of Polish Operation of the NKVD as a genocide”. in this edit

WikiProject_Deletion_sorting/Companies

BilledMammal made their 14th edit on 20 September 2019 nominating something for deletion, with terminology that doesn't seem to fit someone newly autoconfirmed?

BilledMammal also added it to wikiproject deletion sorting at Misplaced Pages: WikiProject Deletion sorting/Companies

Icewhiz was active in that project → 82 edits from 28 November 2017 to 29 August 2019 (82 edits by Icewhiz on Deletion sorting/Companies)

While BilledMammal was dormant → Eostrix nominated 3 pages in 2021 and one in June 2020 (4 edits by Eostrix on Deletion sorting/Companies)

Shared pages are mostly in administration

BM and IW have both made hundreds of edits on some admin pages.

BM and IW Ranked 12th and 15th on top editors on Misplaced Pages:Arbitration/Requests/Enforcement - page history

Interaction with others

I decided against providing most examples I saw from Arbitration/Requests/Enforcement. Some look similar, but I didn't feel right including the complaints against other people as examples. They also leave some similar messages on user talk pages. That feels wrong to share here without permission, but asking permission makes an even more awkward situation. If there was a way to make a pooled anonymous word frequency analysis for the namespace "user talk" that might be informative? I tried one thing I noticed, but systematic would be better. Like a word cloud?

Edit summaries that contain “1RR” I attempted something quantitative.

A frequent topic for BilledMammal was the 1RR – I searched the edit summaries of BilledMammal and the Icewhiz socks for edits relating to this.

The original Icewhiz made an abnormally high number of 1RR complaints. Other Icewhiz socks have made occasional complaints, sometimes lodging very detailed complaints to arbitration / requests / enforcement.

I can't find any other editors on Misplaced Pages who use this rule as much as Icewhiz and BilledMammal, I checked a few other people in the same threads, most had under 100. For the only editor I found with more mentions of “1RR” than BilledMammal, their edits mentioning “1RR” were over a period of more than ten years, whereas BilledMammal's were mostly within a window of 10 months.

The amount of detail on arbitration enforcement reports by 11Fox11 and Free1Soul resembles complaints made by BilledMammal

BilledMammal = Over 270 edits contain “1RR”

• mostly from 1 October 2023 to 12 August 2024
• then 6 were on 8 November 2024
• BilledMammal edit search for “1RR”

Icewhiz = Over 160 edits contain “1RR”

• from 11 June 2017 to 15 September 2019
• Icewhiz edit search for “1RR”

I tried to fill the gap by searching the arbitrations archives for 1RR, that might be how I found Free1Soul or they could have come to my attention as a "deletes a lot" account. I found a few extras, a few of those were already labelled Icewhiz socks, but the gap is mostly full of Eosterix making thousands of sock complaints.

Free1Soul = 4 edits contain “1RR” From 15 to 16 October 2021

• 16 October 2021
• Free1Soul lodges an extremely detailed 1RR complaint

11Fox11

• 4 edits contain “1RR” All on on 30 September 2021
• On 30 September 2021–11Fox11 lodged and then retracted a very detailed 1RR complaint.

ABHammad = I found only one but it's unusually threatening, “Please self-revert, or be reported to AE”. 10 August 2024

Kentucky Rain24 = just one showed up in a search, but it revealed a previous edit that made a new section with “1RR” in the heading, but not the edit summary.

Gaps in 1RR complaints

I checked all the confirmed Icewhiz accounts but not all the suspected.

Gaps (not counting when the Icewhiz are being accused or defending someone)

• 8 November to present
• 12 August 2024 to 8 November 2024
• 16 October 2021 to 1 October 2023
• 15 September 2019 to 30 September 2021

When looking for possible undiscovered socks I found “Free1Soul” who is blocked as an Icewhiz sockpuppet but not labelled or in the categories.

There could be undiscovered socks in this gap, but I've not found any that look likely, and most of the gap is filled by Eostrix making thousands of edits about socks. Eostrix has 3284 edits that contain “sock” from 31 December 2019 to 04 October 2021

Collaboration on Arbitration Enforcement Requests

These sets all seem to be overlapping?

7 November 2024 - BilledMammal lodged and enforcement request and ABHammad adds follow-up — Preceding unsigned comment added by Industrial Metal Brain (talk • contribs)

Editor interaction

BePrepared1907 and BilledMammal - I think I've seen them do very convoluted things, they follow content to new pages if things get split or merged, one puppet works on the old page and one on the new. I couldn't keep track of it, but I think that's what I saw.

2024_Southport_stabbing interaction - UnspokenPassion then BilledMammal takes over.

Cooperation on misleading referencing

Again, declaring bias because a lot of this relates to my own edits being reverted, but I think I can see a general strategy used by these accounts.

Others might be able to find other puppets doing the same thing.

There are multiple puppet-like accounts, including BePrepared1907, protecting UnspokenPassion's repeated use of the same few pro-Israel sources in the same article. UnspokenPassion, and possibly others cited the same Israeli academic over 40 times on one page. They also cited the same paper from Haifa University over 20 times on one page.

As far as I can tell the things they cite are legitimate sources, but they do favour Israel are not notable enough to cite that many times.

Unspoken passion hid this by making the citations refer to a specific page. It looked like many sources were cited, but the majority were page references for a tiny number of actual sources in the bibliography.

When I have tried to flag things as "one source section" or "additional sources needed" the puppets removed it as "tag bombing" after someone restored them, a different suspected puppet removed it.

They also removed attempts to add attributions.

3rd suspected puppet

Boksi

• Boksi (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• BilledMammal (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• UnspokenPassion (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Boksi (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• BePrepared1907 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Boksi showing BePrepared1907 and BilledMammal traits and helping UnspokenPassion

• Speedy delete nomination of 2023–2024_Gaza_Strip_preterm_births
• time line Borski deletion nominating and BilledMammal rollback (note against different users but same page)
• Removing massacres, edit summary: "rm POV intro since both sides faced massacres and terror", replaced a list of massacres with: "During the 1948 Palestine war, massacres and acts of terror were conducted by and against both sides".
• Removing "undue weight" notice for Mogadham 2003.
• Removing attribution for Moghadham 2003.

Additional info from IOHANNVSVERVS: I have concerns of Boksi engaging in pro-Israel POV pushing generally, and here is Boksi restoring a reverted edit of BePrepared https://en.wikipedia.org/search/?title=Palestinian_suicide_attacks&diff=prev&oldid=1268421917, https://en.wikipedia.org/search/?title=Palestinian_suicide_attacks&diff=prev&oldid=1268141377. IOHANNVSVERVS (talk) 19:47, 9 January 2025 (UTC) Also see https://en.wikipedia.org/Talk:2024_Neot_HaKikar_shooting#Restoring_sock_edits. IOHANNVSVERVS (talk) 19:49, 9 January 2025 (UTC)

Edit segregation

They segregate topics, the disposable puppets focus on the topics BilledMammal avoids. The simplest is BilledMammal works on mainly new pages about things that happened after Icewhiz and Eostrix were blocked.

BilledMammal avoids making any edits to specific pages, despite other edits showing intense interest in the page or topic. e.g. Talk:2018–2019 Gaza border protests: both BilledMammal and Icewhiz edited the talk page dozens of times, but only Icewhiz ever edited the page. Talk page timeline

Editor interaction analysis limitations

We really need a control column in the editor interaction analysis. It needs the option to add all pages in a topic to the list. That will mean you can distinguish bad actors from good faith editors with shared interests.

Alternatively, if we could include all pages by every editor instead of only those with overlap.

Currently a system of disposable socks who are careful to never edit the same pages is invisible. Whereas if you have "all pages in topic" as an additional column you'll be able to catch systems working together.

If a collection of accounts cover a whole topic without ever editing the same pages, that's suspicious. The active master of that set is likely to be an unusually rule-abiding editor who has edited all those pages.

I.M.B. (talk) 01:23, 9 January 2025 (UTC)

Hypotheses and suggestion

From what I've seen I suspect that Icewhiz uses two types of puppets. But one of those would be better described as master. They have a main account that looks like an experienced editor and simultaneously a collection of disposable accounts that create new articles.

The ban revert policy probably exacerbates the second problem, because creating multiple articles with one account means they ALL get deleted when the account gets caught.

If you change to needing the AfD process to delete a whole page, then instead of making a greater number of accounts they will write better articles. They could also write more subtly biased articles, but if the AfD process flags them as sock created then other editors can check for deceptive referencing and verify sources.

They could also keep creating sock armies to avoid facing that scrutiny, but the effort needed to bring them all up to 500 edits will be a bit less worth it, particularly the higher level of effort needed to do that without being obvious.

This group are also clearly very active in the AfD process, people will find ways around any system, but it at least will put less direct pressure on creating very large numbers of disposable article creation accounts.

And if people selectively use the AfD system to remove things for political reasons, it at least won't be invisible. Whereas quick delete is designed to make things disappear untraceably. Having things disappear invisibly in a contentious topic seems very counter productive towards trying to find and stop people who are editing in a manipulative way.

I.M.B. (talk) 19:01, 8 January 2025 (UTC)

Comments by other users

I've been drafting another batch SPI, and BePrepared1907 was part of that batch (disclosure: this account was brought to my attention here), so here is some additional behavioral evidence related to that account:

Israel the old "various causes" / "numerous factors" edit war--note this is over a period of 3 months: ABHammad, HaOfa, O.maximov, PeleYoetz, Galamore, BePrepared1907

Axis of Resistance: EnfantDeLaVille, Galamore, HaOfa, PeleYoetz, BePrepared1907

Druze in Israel: HaOfa, BePrepared1907

1948 Arab–Israeli War: HaOfa, BePrepared1907

Palestinian suicide attacks - an article created by sock User:UnspokenPassion: HaOfa "drive by tagging", BePrepared1907 "Drive-by tagging"

International Criminal Court arrest warrants for Israeli leaders: ABHammad, BePrepared1907

Mișu King of the Kebab is an article started in 2022 by BePrepared1907 that has had less than 20 revisions since, one of them by PeleYoetz (article history)

I know מתיאל ("Matiel") was determined "unlikely" above at #08 November 2024, but nevertheless:

• Ariel Sharon: Matiel "not convicted as such", BePrepared1907 "not convicted as such" (see also: AHJ sock BanyanClimber)
• International reactions to the Israel–Hamas war: Matiel, BePrepared1907 (not the same edit but similar content)

I've also had some concerns about BilledMammal=Icewhiz, but hadn't raised them on-wiki because I was worried I was just being paranoid and lacked any real "smoking gun." Since the connection is "Possible", however, I will post some behavioral evidence about that suspected connection in the next 24hrs. I'll try to post the batch SPI in the next 48 hopefully by this weekend; the other accounts in that batch may shed some light on BePrepared (or even BM). Levivich (talk) 19:05, 7 January 2025 (UTC) Updated. Levivich (talk) 02:31, 9 January 2025 (UTC)

Some additional items about BePrepared (xtools) I forgot to include above:

• Account created Dec 2014 but doesn't start editing until June 2015
• Makes less than 100 edits between June 2015 and Nov 2023
• In Nov-Dec 2023, makes 400+ edits, in a clear rush to XC
• Gets XC on Dec 3, 2023, after which their editing drops to almost zero (about 25 edits between Dec 3 2023 and August 2024)
• July and early August are when I filed the ABHammad (Jul 22-31), O.maximov (Aug 4-16), HaOfa (Aug 11-17), and PeleYoetz (Aug 11-24) AEs; BePrepared returns to activity on Aug 13--two days after the HaOfa and PeleYoetz AEs were filed--and subsequently, he repeats the edits of these editors (diff'd above)
• In 859 edits, "Adding" appears in the edit summaries 222 times
• I don't remember who, but I think I remember that scouting was one of the topics of interest of some of these known socks; see BePrepared's user page and contribs re: scouting
• Timecard shows editing mostly in the 12-14:00 UTC 2-hour-window; looks the same or similar as many other socks, e.g.

The rush-to-XC, followed by dormancy, and a return to activity after other socks in the group "get in trouble," is a pattern we've seen throughout this group. Levivich (talk) 19:59, 7 January 2025 (UTC)

I disagree with BK's comment about "major process work". Icewhiz is the user who taught me how to make the NFooty AfDs table, and you can see his coaching of me at that sandbox page's talk page. It was the similarity -- both in choice of target (WP:NSPORTS) and methodology -- between my collaboration on NFooty with Icewhiz and my collaboration with BM on Lugstubs that initially raised my suspicions. Levivich (talk) 20:06, 7 January 2025 (UTC)

@Levivich I don't know where I am supposed to respond to comments, move this if needed. In one of the threads above someone raises the possibility of multiple people. It looks quite plausible that this is an actual different person following the same playbook. The timecards are different, IW is only waking hours in a Middle Eastern work week, Sunday to Thursday, BilledMammal is active at a lot of times IW never was. Possibly the person who was running the account actually moved (which will make checkuser very difficult) or possibly they deliberately did things first things at weird times to look different. I left out some of the more speculative parts of what I had accumulated off Wiki, but the first thing BilledMammal does is make a draft article about Melbourne at a time that makes sense for that time zone. They also seem a bit vague about where they are pretending to be from, Australia or New Zealand. They also do a lot of automated edits that obscure the human edits, if there is any way to remove automated edits from what is in the timecard that might help. I.M.B. (talk) 03:52, 8 January 2025 (UTC)

If you are compiling a report, look for pages you would expect them to be most active on but that they have never edited, one I noticed was the main page about the Hostage crisis during the Israel– Hamas war. They sound extremely passionate about that topic on a few other pages and talk pages, but they have never edited the main page about it. This is not normal? I.M.B. (talk) 19:01, 8 January 2025 (UTC)

@Levivich. If you are doing that can I suggest one to include: Dclemens1971.

I'm not sure what the rule is on where to mention things. I am not accusing that one as such, but it looks worth checking. It really looks like them from the profile page, then I put it in an editor interaction table and all those deletion sorting pages showed up, including one about sport. I.M.B. (talk) 08:27, 9 January 2025 (UTC)

@Industrial Metal Brain: Why did you mention Dclemens1971? Please clarify this. —Alalch E. 01:46, 10 January 2025 (UTC)

@Alalch E. @Industrial Metal Brain I have no idea what this is about (Icewhiz?), but ANYONE who nominates a lot of AfDs, as I do in my capacity as a New Page Reviewer, will show up in editor interaction charts for the deletion sorting pages, because any time you nominate an article using XfD, it automatically edits the nomination onto those sorting pages. And I nominate AfDs across all categories. So of course I overlap with any other editor who was active at AfD, as I apparently do with Icewhiz -- but that's just a function of how deletion discussions are created. At SPI you need to provide diffs, not just interaction tables. If you are looking for overlap at SPI, overlap on the deletion sorting pages is the very last thing to look for. Dclemens1971 (talk) 03:35, 10 January 2025 (UTC)

On IW/BM:

• To state the obvious: a billed mammal is not a duck
• To also state the obvious: both share the same POV on IP issues
• As I mentioned above, both spent a great deal of time on reforming NSPORTS SNGs
• It's hard to "prove" this, but the style and volume of argumentation by BM at, e.g. WP:NSPORTS2022 and WP:LUGSTUBS strikes me as similar to IW, e.g. at Misplaced Pages:Articles for deletion/Clarice Phelps and Misplaced Pages:Articles for deletion/Clarice Phelps (2nd nomination)
• Both used the foot-in-the-door approach of trying to find small agreeable compromises to advance NSPORTS reform, e.g IW at Misplaced Pages talk:Notability (sports)/Archive 31#Proposal - NFOOTY#2 - raising the bar (proposing to raise the NFOOTY bar for youth players only), BM at WP:LUGSTUBS (proposing to batch-delete only the most-obvious 1k out of 90k)
• Both were top filers at AE, among the top 20 AE editors
• Use of tables in an effort to prove conduct violations, e.g. User:Icewhiz/hounding, User:BilledMammal/ARBPIA discussion statistics
• A lot of people use a hyphen as a dash, but both IW and BM use hyphens-as-dash a lot (not to get pedantic but also hypens-as-semicolons and other punctuation; basically, using hyphens to separate thoughts), e.g.:
  • In edit summaries: IW , BM (ctrl+f " - " on their contrib pages to find more examples)
  • In comments: IW , BM
• There's the old no-space-before-the-signature thing of IW's , I don't know whether 22 instances of that by BM is a lot or just the normal occurrence of a typo

To be clear, I never thought the above, alone, was enough to justify an SPI report. "Vibes" ain't enough, but that's basically what I got: BM reminds of IW when it comes to I/P, NSPORTS, AE, argumentation style and effort, the use of data and tables (particularly to frame), the hyphen thing... in my view, it becomes a "too many coincidences" thing. Levivich (talk) 02:29, 9 January 2025 (UTC)

Never dealt with Icewhiz so I don't have much to provide here, but I will note a few important things:

1- Icewhiz socks were not necessarily the same person; sure they collaborated and defended each other and likely occasionally gave each other their log-in credentials, but they were probably different people.

2- Icewhiz, from my understanding, was incredibly adept at deception; so much so that one of their socks nearly ran for adminship.

3- What struck me most from dealing with BilledMammal is that they rarely meaningfully contributed to edit articles by adding content, with their focus more on talk pages and AE filings.

Admittedly, I initially did not entertain the idea when this SPI case was first filed. But reading through the case, namely the possible technical connection as well as the interesting oddly specific behavioral coincidences, I am pretty much prepared to be surprised. Makeandtoss (talk) 07:56, 9 January 2025 (UTC)

Fixed formatting. Ian P. Tetriss (talk) 01:10, 8 January 2025 (UTC)

•  Closing without action Barkeep49 (talk) 21:21, 13 January 2025 (UTC)

  Wait was I deleted or no? Frankly whoever organized this seemed to not be good at organizing the page for making our cases.

  In any case I don't know what else I need to add as "proof." I'm an American, if that helps. MagyarNavy1918 (talk) 12:51, 14 January 2025 (UTC)

  @MagyarNavy1918, this page is a mess. There are two sections titled ‘comments by other users.’ The one you edited first is located further down. Michael Boutboul (talk) 15:26, 14 January 2025 (UTC)

  Thanks! MagyarNavy1918 (talk) 15:53, 14 January 2025 (UTC)

@User:CaptainEek, can I request you compare BilledMammal and BePrepared1907 to each other? They seem similar in personality. It might show a technical connection that BilledMammal and Icewhiz don't. I.M.B. (talk) 00:40, 9 January 2025 (UTC)

@CaptainEek Also, what does "ArbCom" stand for? And what is the difference you have seen between the users?

I saw some very similar Arbitration and Enforcement reports filed by BilledMammal and the socks, if that is what you mean? But I felt uncomfortable sharing a reports about other people as examples. I.M.B. (talk) 08:01, 9 January 2025 (UTC)

@Industrial Metal Brain WP:ARBCOM is the Arbitration Committee, of which I am one of the sitting members. ArbCom sometimes gets private information, which we can't share. CaptainEek ⚓ 08:08, 9 January 2025 (UTC)

@CaptainEek I would like to add Borski to the list, vs BM and BP, edit links in a moment. I.M.B. (talk) 18:48, 9 January 2025 (UTC)

#3rd suspected puppet above. Sorry this is not very organized. I.M.B. (talk) 19:02, 9 January 2025 (UTC)

Boksi* IOHANNVSVERVS (talk) 19:50, 9 January 2025 (UTC)

@CaptainEek @Barkeep49 @Levivich

Borski is a duck? #3rd suspected puppet? I.M.B. (talk) 19:24, 9 January 2025 (UTC)

Or from what Levivich said below, checking Icewhiz vs BePrepared1907 would be warranted. I.M.B. (talk) 01:23, 9 January 2025 (UTC)

Personality and tone seem similar for BilledMammal and BePrepared1907. I have looked more closely at the recent editors, there's not much direct interaction with the originals so I've mostly looked at numbers for those. I haven't seen much of Icewhiz or Eostrix personalities. But I would expect someone to build better skills with organizing people over time. I.M.B. (talk) 02:26, 9 January 2025 (UTC)

Free1Soul is still blocked but unlabelled. Is there someone I need to ask about that? I am not even sure if they were guilty, just the incongruity seems wrong. I.M.B. (talk) 07:55, 9 January 2025 (UTC)

• No comment on the other two suspected accounts as socks of Icewhiz, but I'd be lying if I said I wasn't a tad concerned that the BilledMammal filing is retaliatory, considering IMB, the filer, is themselves currently under SPI investigation as a possible sock of Irtapil, whom BilledMammal orginally reported for socking (which led to Irtapil's block). The Kip 00:41, 10 January 2025 (UTC)

  And IMB has now been sock-blocked after admitting to being Irtapil. Adding in the fact that Dclemens, who he also found “suspicious,” had also filed an SPI against a past Irtapil sock, I’m about fully convinced that this report with respect to BilledMammal and Dclemens specifically was retaliatory in nature. The Kip 15:14, 10 January 2025 (UTC)

  If you assume it was retaliatory in nature for the sake of argument what useful conclusions could be drawn from that? I think it is none. And I doubt that the assumption would be valid anyway. A simpler explanation is probably that irtapil believes what they said. I don't agree with many of their conclusions, about BilledMammal for example, but I do agree that other accounts named could be socks. The topic area has plenty of socks active every day. I don't think an answer to the question "was it retaliatory?" tells me anything useful. Socks see socks of the opposite valence. The first 2 cases against IMB were filed by socks. They were not processed. The case was picked up by an editor in good standing. I don't know whether the editor prepared it them self or whether they received assistance from another party. I don't think it matters because it is unknowable. I think what matters is that only non-socks should have their reports processed, just like I think only non-socks should have their content retained. Editors in good standing can re-use and re-file evidence from this case in a new case. And I hope ArbCom reads Irtapil's statements on their report and thinks about ways to try to reduce sockpuppetry, or let's say, increase honesty in the topic area, that don't just rely on an unwinnable whack-a-mole approach. There are certainly other experienced editors evading bans in the topic area that could speak openly about it. Maybe we could learn something useful. Sean.hoyland (talk) 16:17, 10 January 2025 (UTC)

  I.M.B. is now a confirmed sock of Irtapil by self-admission. So yeah, it was probably retaliatory, and probably frivolous. Andre🚐 19:37, 10 January 2025 (UTC)

  Since intent is unverifiable and whether a suspected sock is a sock has no dependency on the intent of the filer, I think opinions on the matter have no utility. Sean.hoyland (talk) 04:35, 13 January 2025 (UTC)

  Oh and to answer your question Sean, no I didn't have any assistance in the filing, I prepared it myself. I had already suspected I.M.B. and I did see the cases that were filed by presumably-Yaniv/AHJ socks, but they didn't have any evidence so there wasn't anything I used from those. Andre🚐 21:16, 10 January 2025 (UTC)

  I wasn't asking, but thanks for the reply. I would be okay with a world where we could outsource some ban evasion detection to experienced ban evading actors, as long as the evidence they prepared and presented was high quality and went into a designated sandbox where it could be evaluated by editors in good standing, and maybe picked up, rather than injected straight into the normal SPI system. Sean.hoyland (talk) 04:35, 13 January 2025 (UTC)

Just a passing comment as someone who has been a target of major harassment from Ice - I've had some brief interactions with BilledMammal and never thought there was any similarity between that account and Ice. That said, for what it is worth, I have also entertained the idea that Icewhiz is more than one person (i.e. that it/they is a shared account run by a some group). Food for thought. --_{Piotr Konieczny aka Prokonsul Piotrus| reply here} 02:32, 12 January 2025 (UTC)

• I've interacted with BM on a number of occasions (but never knowingly with IW as far as I can recall). I have no experience as a CU and probably wouldn't be much good at it, so I'm not going to act as if I know better than people here. That said it seems pretty unlikely that BM could be a sock set up simply to garner a high edit-count and then transition to the IP field to cause chaos there. This is based primarily on the amount of work they had to do in cases like WP:LUGSTUBS being way beyond the amount that you would need to build up an edit-count, and indeed being the kind of work that serves to turn people against you rather than build up social capital. I found BM's shift from sports bios to IP an odd thing to do, but possibly explicable by the way that their efforts in that field had struck a wall after WP:LUGSTUBS2. FOARP (talk) 09:13, 14 January 2025 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

• I'd say the CU to BilledMammal is  Possible, but some ArbCom knowledge plus my general knowledge of BilledMammal makes me think it's not super likely. CaptainEek ⚓ 18:25, 7 January 2025 (UTC)
• I have not done a CU, because I find this behavioral evidence completely unconvincing even without ArbCom's knowledge based on my deep knowledge of BM compared to IW. For instance, BM's ability to do major process work of the kind he has done around fundraising and SNGs is behaviorally incredibly different than IW - even with a goodhand like Eostrix. This is categorically a different kind of analysis than my skpeticism than the report above about Rajoub570, where I had skepticism but take seriously the pushback. No comment on BePrepared1907 as there really isn't evidence there (and this is acknowledged as such). Barkeep49 (talk) 19:40, 7 January 2025 (UTC)

  I look forward to seeing the fuller information and additional filing as I am inclined from the evidence presented so far to run a check on BePrepared. Waiting until then for sake of efficiency as much as anything. As for the further BilledMammal evidence, I remain unconvinced. It wasn't the topic areas that was unconvincing to me as much as the way BM went about seeing change compared to how IW would go about seeking change. I will spend some time doing some analysis of each of their contributions at RSN - a forum I know both have lots of edits on and where if I recall correctly BM did some RfC work - to see if I need to re-examine that. Is it possible BM was the return of some other editor? Sure but that is very different than saying he's Icewhiz (especially because at first glance some of IW's behavioral "tells" from 2022 don't seem to be true of BM). Barkeep49 (talk) 20:26, 7 January 2025 (UTC)

•  On hold to give Levivich another day or so. I anticipate what he has will be a seperate filing, but keeping this "evidence" here until then seems productive. If that doesn't happen in a day or so and/or if this isn't useful for that I will then close this one down. Barkeep49 (talk) 15:42, 10 January 2025 (UTC)

11 January 2025

– This SPI case is closed and will be archived shortly by an SPI clerk or checkuser.

Suspected sockpuppets

• Hsilvers (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Sethy017 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Ank2408 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Anon123987 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• SECschol (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Pyramids09 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Mk8mlyb (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Benjy613 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• MrBismark1871 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Boutboul (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• IntrepidContributor (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• BePrepared1907 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Shoogiboogi (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• MagyarNavy1918 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• DancingOwl (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Vegan416 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Here is the combined EIA for everyone. The common thread for most of these accounts are people showing up on or around Nov 30, when ARBPIA5 opened, and making the same edits/talk page comments as the known socks in these groups (e.g., "colonization," etc.).

Throwaway accounts These may be socks, or may just be people responding to off-wiki canvassing efforts, but they turned up in the searches and "fit the profile" so I'm including them, despite the lack of edits. Contribs are linked below:

• Sethy07: 2 edits, 1 of which is an edit request about "colonization" at the Zionism article--that old chestnut. The edit was made on Nov 29, the day before ARBPIA5 opened (its opening date was announced head of time, and several of the socks in this group showed up to that article on or about the opening date). The second edit was to change engvar at Concerns and controversies at the 2024 Summer Olympics, a fairly obscure sub-article that has also been edited by User:Minden500, a sock in this group, as well as CU-blocked accounts User:0lida0 and User:FanOfSunYang (I don't know anything about those two accounts and whether they are related).
• Anon123987: 7 edits, the first 5 are to an article about a kosher certification agency. 6th edit was to Talk:Zionism as settler colonialism to complain about "colonization" (that old chestnut!), and the edit by Anon read as virtually the same as an edit by Sethy017 (lack of capitalization, punctuation, etc.)
• Ank2408: 1 edit, on Nov 30 (day PIA5 opened), to Talk:Zionism, to agree with User:SECschol (mentioned below); later User:Boutboul (mentioned below in the new users section) also posted to agree in that thread
• SECschol: 9 edits, all about "colonization" and related, from November
• Hsilvers: 1 edit on Dec 3, making an edit request to change "the sentence" at the Zionism article ("...as few Palestinian Arabs as possible"), which has been the subject of most of the recent off-wiki commentary. This edit request has been made a million times by throwaway accounts.

If these aren't socks, they're SPAs violating ARBECR.

Older accounts

Pyramids09

Palestinians: HaOfa, ABHammad, Owenglyndur, ABHammad, ABHammad again, Owenglyndur, ABHammad, Pyramids09, Pyramids09 again, Shoogiboogi (listed below)

• AFAICT, only this group of socks has tried to remove "indigenous" or "native" recently (page history). You can see at Talk:Palestinians#Indigineity and Talk:Palestinians/Archive 27#Indigeneous, it's pretty much just this sockfarm arguing against "indigenous"/"native". And, of course, Pyramids09 (self-reverted, re-posted).

List of genocides: HaOfa, ABHammad, Pyramids09

Talk:List of genocides: HaOfa, O.maximov, ABHammad, Galamore, IntrepidContributor (mentioned below), Pyramids09

Gaza genocide: ABHammad ("accused"), Pyramids09, Pyramids09, Pyramids09, Pyramids09

• The EIA for this page for the whole group: pretty much every edit, by any of the editors, is about downplaying or attempting to rebut the genocide accusation.

I think Pyramids09 (xtools) may be a compromised account like User:Icebear244 and User:916crdshn. Pyramids' account was created in 2021, and they edited in 2021-2022 without, as far as I can tell, making any or many edits related to ARBPIA. Their activity drops in June 2022. Less than 90 edits in 2023. 2 edits in Jan-Feb 2024, and 3 edits in June 2024.

Then, in October 2024, they become an ARBPIA SPA, and pick up with the same long-term edit wars as the blocked group, diff'd above. One of their first edits in October is to complain about Nableezy's pro-terrorism userbox: Misplaced Pages:Administrators' noticeboard/Archive366#User:Nableezy has a (Personal attack removed) userbox (the diff's were oversighted). This is an well-worn give-away. On the same day, they changed their user page: before, after, now--it's like a different person.

They have a very similar timecard pattern that follows the consecutive-editing theory:

• User:Galamore edits 5-7
• User:Sakakami edits 8-10
• User:O.maximov edits 11-13
• User:UnspokenPassion edits 13-14
• Pyramids09 edits mostly 17-19
• (see also User:Geshem Bracha , User:Hippeus , User:Mvqr )

MrBismark1871, Benjy613, Mk8mlyb

Zionism: About the "Zionists wanted..." sentence (RFC about this just closed):

• Aug 27 O.maximov and a lot of geese
• Sep 16 MrBismark1871
• Nov 27 Benjy613, Benjy again
• Dec 5 Mk8mlyb
• Dec 5 (2) MrBismark again
• Dec 6 Mk8mlyb again, and again
• Dec 15 Pyramids09, Pyramids again

Here is the full Zionism article EIA.

MrBismark1871 (xtools)

• Account created and first edit Oct 2021
• 130 edits Oct 2021 is highest-activity month; edits sporadically, with <30 edits/mo until Oct 2023; 63 edits in Nov 2023 and hits XC, then drops back down to <6 edits/mo from Nov 2023 until Dec 2024
• All edits seem to be about eastern Europe, nothing ARBPIA or even Middle East-related (AFAICT) until end of 2024, when they make the two Zionism reverts in Sep and Dec, plus there have been Syria-related edits recently

Benjy613 (xtools)

• Account created and first edit Feb 2006
• 1500 edits in 2006 (including ARBPIA edits), less than 100 since then; 0 edits in 2022 and 2023; 5 edits in 2024, which are the two Zionism reverts, and User talk:Benjy613#Introduction to contentious topics

Mk8mlyb (xtools)

• Account created Nov 2016, first edit Jun 2017, XC in 2020
• 14 edits in 2022 and 2023, about 20 edits in 2024 until Dec
• AFAICT none of the edits relate to ARBPIA up to that point, it's all sports and AP2
• 130 edits in December 2024, starting with the above edits to Zionism, which seem to be the only ARBPIA edits this editor has ever made, and lead to a TBAN from ARBPIA at AE: Misplaced Pages:Arbitration/Requests/Enforcement/Archive345#Mk8mlyb
• Dismissing mainstream RS like Rashid Khalidi: Special:Diff/1261551828

It's not unusual for editors who haven't edited in a long time to read something in the media and then log into their old account and make an edit. But three of them (four if you count Pyramids), each of whom appear to have only one edit to make in ARBPIA, and it happens to be the same as the others (plus a known sock)? Response to media also doesn't explain how MrBismark and Mk8mlyb knew to come back on Dec 5 when Mk8mlyb made that same revert. These may not be sockpuppets, but they're at least meatpuppets, canvassed, or otherwise coordinating with each other.

Boutboul

Boutboul (xtools)

• Account created and first edit in 2006
• Has that mostly-two-hour-window time card pattern (2000-2100)
• ~350 edits 2006-2012; 4 edits 2013-2016; 0 edits 2017-2024
• 5 edits in May 2024, and then requests XC (it was denied)
• 0 edits until November 2024, then begins editing more heavily starting November 11 -- that would be right after the November batch of Icewhiz/Galamore SPIs (see above)
• Hits XC on 11/11 and then stops editing for a couple of weeks
• On Nov 24, posts on Talk:Zionism arguing to remove "colonization" and change "Palestine" to "Land of Israel" -- see Talk:Zionism/Archive 31#Proposal to Revise the Lead of the Zionism Article
• On Nov 30, posts an LLM-generated talk page post with hallucinated source quotations (this, alone, merits an indef); the post was hatted and XC was revoked
• Posts an ARC (that was declined) (note the proposed parties)
• As a reminder, Nov 30 is the day that ARBPIA5 opened
• See the DancingOwl section below for info about attempts to regain XC