Wikipedia:Sockpuppet investigations/Lrednuas Senoroc

Lrednuas Senoroc

Lrednuas Senoroc (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Populated account categories: suspected

For archived investigations, see Wikipedia:Sockpuppet investigations/Lrednuas Senoroc/Archive.

 Clerk note: the user operating the accounts in this case is known for impersonating established users. It has been previously determined that the accounts Srednuas Lenoroc (talk · contribs) and Srednaus Lenoroc (talk · contribs) are not sockpuppets of this case.

10 May 2017

– This SPI case is open.

Suspected sockpuppets

• TheodorLewin (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Elmira91 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Supreme Dragon (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• 91.61.203.181 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 76.169.240.143 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 69.175.34.159 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 87.156.251.65 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

• The account was created after the sockmaster's various ip socks were exposed on the SPI case [1] and all of his edits are exclusively about the same ethnic minority like Lrednuas Senoroc/Hassan Rebell's edits.

• In his first edit, he highlighted the nomadicity of Kurds in his edit summary[2] and interestingly, only a few days later, ip sock of Lrednuas Senoroc/Hassan Rebell also underlined the same issue on RSN[3]. (for more info, see 09 January case)

• Hassan Rebell/Lrednuas Senoroc devoted his most of time for black propaganda on Kurdish-Assyrian issues[4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20][21][22][23][24][25][26][27][28][29][30][31][32] and new user TheodorLewin's edits on Dawronoye show a strong parallelity with the edits of the sockpuppeteer[33][34][35]

• The suspected sock does not sign when comment on the talk pages[36] like Lrednuas Senoroc/Hassan Rebell and his ip socks[37][38][39][40][41][42][43][44][45][46][47][48][49][50][51][52][53][54][55][56][57][58][59][60][61]

• Like Lrednuas Senoroc/Hassan Rebell[62][63][64][65], the suspected sock also uses the small "-" as a link between sentences[66]

• Regarding ip sock 91.61.203.181; the same ISP, the same geolocation, the same articles/targets, the same manner, the same agenda with Lrednuas Senoroc.

Info regarding Lrednuas Senoroc/Hassan Rebell/Heysem/Kintetsuboffalo's ip socks based on previous cases:

• Geolocation: "Mainly" North Rhine Westphalia, Germany (also previously Switzerland)
• ISP: Unitymedia(probably home isp), Deutsche Telecom

So, it seems that the anon is technically and behaviorally belongs the same sockpuppeteer. More info regarding the ip sock was provided here [67].

• Regarding likely proxy sock 76.169.240.143; Both the suspected sock account and the likely proxy sock ip were re-activated after a long time (months after their last edits) within the same time period: [68][69]. 
• The ip’s targeted articles, manner and agenda is identical with the sockmaster’s.  E.g. editing the articles that are mostly on Kurdish-Turkish conflict, involved in disruptive editing and inserting the word “Kurdish terrorism”[70][71] like LS[72][73]. The article Kurdish terrorism was created by the sockmaster Lrednuas Senoroc as mentioned on the AfD page and was deleted last year. See the comments of the sockmaster on the AfD[74]. So, the ip's edits shows parallelity with the edits of the sockmaster.
• Plus, it was proved with plenty of diffs that the sockmaster used various ips/proxies from different geolocations , e.g. from France, the UK, etc. [75][76][77][78] [79]. For more detailed information, see the 9 January 2017 case.  So, taking into account all of these, the ip seems highly suspicious and likely belongs to the same sockmaster.

• I am adding this report down to the report regarding likely proxy sock 76.169.240.143, since the provided info is also related to this case. An another “new” user, Supreme Dragon, created a category called “Terrorist symbolism” on commons and despite there are other groups’ flags in the same category (please note that, Lrednuas Senoroc  added a few attacks by Turkish security forces  to the article ”Kurdish terrorism”, for creating a “fake balance”), the user, weirdly,  filled the category with the symbols of Kurdish militant organisations, even added the same flag 3 times to the same category.  Moreover, official KRG flag was also added to the category of “terrorist symbolism”[80]. The same user continued the same problematic edits in an another article through a clear source falsification[81]. Also, in commons, after he created the template:Terrorist symbolism, he first added Kurdistan Workers' Party to the template, before adding any other terror groups[82] As I mentioned above, the sockmaster Lrednuas Senoroc  tried to associate Kurds with terrorism many times in the past and this suspected sock’s edits and “tricks” (e.g. “fake balance” and source falsification) are resembling the same sockmaster. By the way, it seems that the suspected sock is interested in Soviet-communism related articles[83][84][85][86] like suspected sock Heysem as PanchoS explained here[87]. Furthermore, despite the account was registered only a few months ago, the user is very familiar with the wikipedia terminology, like Lrednuas Senoroc[88][89][90]. Therefore, because of the reasons I mentioned above, the user seems very suspicious and should be checked.

• Regarding likely proxy sock 69.175.34.159; Dubious deletions on Kave[91]. The article is within the category of “Kurdish mythology”[92] which is one of the main targets of the sockmaster(see previous cases). Plus, the ip is from a Hosting Provider, i.e. a confirmed proxy, making the anon even more questionable. 

I added a new suspected sock, Elmira91, to the list for obvious reasons:

• Previosly, Lrednuas Senoroc/Hassan Rebell (with his plenty of ipv4s and ipv6s) attempted to remove countless articles that are exclusively about the same ethnic group by blanking their content and redirecting them[93][94], by removing their links from the other articles[95][96], by (disruptively) tagging[97][98][99][100] and mass nominating on AfD[101][102][103][104][105][106][107][108][109][110][111][112][113][114][115][116]

• A newly created SPA, Elmira91, is engaged in the same forms of disruptive editing on Kurd-related articles. Elmira91 abrubtly began to edit with blanking the articles that are exclusively about Kurdish-populated regions by redirecting them irrevelant articles[117][118][119] and removed their links from the other articles[120]. The SPA’s editing pattern, manner, purpose/agenda are resembling the same sockmaster and should be checked.

For the avoidance of doubt, please compare the suspected socks with each others and please don't forget to consider the sockmaster's physical location that i have mentioned above. 176.126.68.77 (talk) 09:50, 19 May 2017 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Based on the diffs here [121] and suspicions of user:PanchoS here [122], can we tag user:Heysem as suspected sock of Lrednuas Senoroc? Please note that, the sockmaster did not reject the accusations regarding block evading sock Heysem while he strictly rejected the accusations regarding the ip 86.165.11.32. 176.126.68.77 (talk) 14:44, 18 May 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

CU does not connect the three accounts. However, Elmira91 is confirmed as identical to two newer editors, Zana.ardalan1 (talk · contribs) and Kohnelahijan9it (talk · contribs) and all 3 will be  Blocked and tagged in a minute. Doug Weller talk 13:02, 31 May 2017 (UTC)

---