Wikipedia:Sockpuppet investigations/Middayexpress

Middayexpress

Middayexpress (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Populated account categories: confirmed · suspected

For archived investigations, see Wikipedia:Sockpuppet investigations/Middayexpress/Archive.

30 April 2018

– A checkuser has completed a check on relevant users in this case, and it is now awaiting administration and close.

Suspected sockpuppets

• Geneticanthro (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

User was created April 18 at 15:50. Goes on to edit for a half hour (16:01 - 16:37). Then is dormant until April 26.

Previous sock Troyoleg began editing for the day on April 18 shortly after Geneticanthro stopped. Troyoleg was blocked was blocked on April 24. Two days later, Geneticanthro resumes editing. Note that Soupforone had edited on all pages Geneticanthro has. See https://tools.wmflabs.org/sigma/editorinteract.py?users=Soupforone&users=&users=Geneticanthro&startdate=&enddate=&ns=&server=enwiki

Tirgil34 was my initial suspect as the sock master given their focus on genetics (and past socks having also edited on the same pages as Geneticanthro). But the African focus led me to Midwayexpress. Is it possible they are the same sock master? EvergreenFir (talk) 23:36, 30 April 2018 (UTC)

CU request removed per Kzl55's suggestion. EvergreenFir (talk) 18:49, 1 May 2018 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

@EvergreenFir: I am not sure if a checkuser will be useful for this SPI. Soupforone (confirmed sock of Middayexpress) insisted on the use of checkuser in the last SPI, this suggests they have means of evading a checkuser since they were later confirmed to be a sock through behavioural evidence. Moreover, they seem to be running multiple socks atm, so I suggest you remove your request for a checkuser and let the case be judged through behavioural evidence instead. Regards--Kzl55 (talk) 16:26, 1 May 2018 (UTC)

@EvergreenFir: It's definitely him. He has the same urge to link East Africans to Arabs.Wadaad (talk) 10:32, 2 May 2018 (UTC)

• Copying over additional behaviour evidence from the other open SPI [1]:

• Geneticanthro account was created on 18 April, shortly after discussion regarding confirmed sock Troyoleg took place [2].

• Geneticanthro exhibits the same interest in Horn of Africa projects particularly Somali and Ethiopian articles [3], [4], [5]. This is inline with Middayexpress/Soupforone behaviour as both have Somalis as one of their top edited articles [6], [7].

• Geneticanthro exhibits the same idiosyncratic editing style of making a major edit quickly followed by a minor (+1) edit: [8], [9], [10]. This habit is seen in the edits of both Middayexpress and Soupforone [11], [12].

• Geneticanthro has a similar time card as Soupforone (who generally posted twice a day, between 2:00-6:00 UTC and between 14:00-18:00 UTC [13]). Geneticanthro conforms to the second editing slot [14]. Please note that this is also inline with confirmed sock Troyoleg's time card [15] --Kzl55 (talk) 15:26, 2 May 2018 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

See report below.--Bbb23 (talk) 18:45, 4 May 2018 (UTC)

---

01 May 2018

– A checkuser has completed a check on relevant users in this case, and it is now awaiting administration and close.

Suspected sockpuppets

• Odriejh (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Egezal (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Reporting multiple new suspected accounts operated by Middayexpress/Soupforone per note on Middayexpress' Wikipedia:Editing restrictions entry.

Behavioural evidence:

• Accounts creation dates: Both Odriejh and Egezal accounts (as well as Geneticanthro which has a separate SPI [16]) were created within days of one another (22, 25 and 18 April respectively). It is important to note that the accounts were created around confirmed sock Troyoleg's SPI which started on 19th of April [17] (blocked on 24 April).

• Same interest in Horn of Africa projects particularly Somali and Ethiopian articles as Middayexpress/Soupforone:

• Particular interest in the Somalis article, which is a top edited article of Soupfornone (confirmed sock) [18], Troyoleg (confirmed sock) [19] and Middayexpress [20]. Examples of this include:

• Odriejh [21], [22], [23] (it was their second ever edit).
• Egezal [24] (restoring a previous edit by suspected sock Odriejh).
• Geneticanthro [25], [26], [27].

• Same interest in articles related to Afro-Asiatic languages by one of the reported accounts. This is an area frequented by all confirmed socks thus far (Troyoleg [28], [29], [30], [31], Soupforone [32], [33], [34], Middayexpress [35], [36]... there are many more examples):

• Odriejh [37], [38], [39], [40]... there are many other examples.

• All accounts exhibit the same idiosyncratic editing style of making a major edit quickly followed by a minor (+1) edit:

• Odriejh [41], [42], [43]... and so on.
• Egezal [44], [45], [46]... and so on.
• Geneticanthro [47], [48], [49]... and so on.

This habit is seen in the edits of Middayexpress [50] as well as confirmed socks Soupforone [51] and Troyoleg [52].

• The new accounts have a similar time card as Soupforone (who generally edited twice a day, between 2:00-6:00 UTC and between 14:00-18:00 UTC [53]). They all conform to the second editing slot: Odriejh [54], Egezal [55], Geneticanthro [56]. Please note that this is also inline with confirmed sock Troyoleg's time card [57].

• Same restoration of Nuruddin Farah file to the Somalis article:

• Troyoleg (confirmed sock) [58]. Odriejh [59]. Egezal [60]. Kzl55 (talk) 16:18, 1 May 2018 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

• The following accounts are very  Likely to each other and to Troyoleg (talk · contribs · count):
  • Geneticanthro (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Odriejh (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Egezal (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Blocked without tags.--Bbb23 (talk) 18:44, 4 May 2018 (UTC)

---

12 May 2018

– A checkuser has completed a check on relevant users in this case, and it is now awaiting administration and close.

Suspected sockpuppets

• Rogundra90 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Wahure (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Qevoja (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Kobe19782 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Arboleh (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Reporting multiple new suspected accounts operated by Middayexpress/Soupforone per note on Middayexpress' Wikipedia:Editing restrictions entry.

There has been an influx of sock accounts following the blocking of Soupforone as a sock of Middayexpress (e.g. Troyoleg, Geneticanthro, Odriejh, Egezal). And it seems since these sock accounts were blocked, more sock accounts were created/activated, all of whom seem to share similar editing styles/areas of interest/time card with Soupforone/Middayexpress.

All of these accounts have these commonalities:

• New accounts or accounts that made their first edits recently following the block of Soupforone.
• Clearly not new users of Wikipedia.
• Same interest in Somali/Ethiopian articles as Middayexpress/Soupforone, including specific articles of interest to Middayexpress/Soupforone.
• Sticking very closely to Soupforone's established time card.

Behavioural evidence for Rogundra90:

• Rogundra90 account was created on 19 April, almost exactly 24 hours after (now blocked) sock Geneticanthro account was created [61], [62]. The account was created only a few hours after SPI was filed against (now blocked) sock Troyoleg ([63], [64]).
• Clearly not a new account per their editing history [65].
• Same interest in Somali articles as Middayexpress and confirmed sock Soupforone:

• Particular interest in the Somalis article, their top edited article [66]. This is an article of interest of Middayexpress, and appears on their top edited articles list [67], as well as on that of confirmed sock Soupforone [68], confirmed sock Troyoleg [69], confirmed sock Odriejh [70], confirmed sock Geneticanthro [71] and others.
• Repeated restoration of file originally uploaded and added to artcicle by Middayexpress [72], [73]: [74], [75], [76].

• Confirmed sock Soupforone has a time card showing two editing slots per day, generally between 2:00-6:00 UTC and between 14:00-18:00 UTC [77], so far it seems all blocked socks conform to the second editing slot: Troyoleg's [78], Odriejh [79], Egezal [80], Geneticanthro [81]. Rogundra90's time card shows a similar pattern [82]

• Similar behaviour regarding Commons files: Soupforone has a history of unsuccessful Commons speedy deletion requests on grounds of copyright violation for images they want removed from articles. One example is their copyvio speedy deletion request of this file [83], followed by removal of file from article [84]. Similarly, Rogundra90's very first edit on Commons was a copyvio speedy deletion request for author Nadifa Mohamed's file [85], this was followed a couple of hours later by the removal of the same file from Somalis by confirmed sock Troyoleg [86] (same file was also removed by other confirmed socks [87], [88]).

• Socks of Middayexpress have shown particular interest in uploading portraits of Somali politician to Commons. Middayexpress [89] (just one of many examples), Soupforone [90], Troyoleg [91]. Again, Rogundra90 is no different here [92], [93] and [94].

Behavioural evidence for Wahure:

• Wahure account created 3 May [95], 2 days after SPI was filed against previous (now blocked) socks Odriejh and Egezal [96]. The same day (3 May) saw the creation of account Qevoja (also reported in this SPI, please see below).
• Time card [97] conforms to second editing slot of Soupforone (between 14:00-18:00 UTC), similar to other socks as discussed above.
• Addition of images to Somalis originally uploaded by Middayexpress to the Somalis article [98], [99].
• Knowledge of and editing of obscure articles such as Wemberma, previously edited by confirmed sock Egezal [100]. This is an obscure article with less than an edit a day since creation. Excluding the creator of the article, there are only edits by sock Egezal and Wahure. Wahure's limited activity includes editing Bahir Dar Airport [101] (11 total edits) and Bitama [102] (8 total edits), the top editor of both articles is Middayexpress [103], [104].

Behavioural evidence for Qevoja:

• Account created 3 May [105], 2 days after SPI was filed against previous (now blocked) socks Odriejh and Egezal (as per above). Account was created only a couple of hours before the Wahure account ([106], [107]).
• Time card [108] inline with both editing slots of Soupforone (2:00-6:00 UTC and between 14:00-18:00 UTC) [109].
• Repeated restoration of Haji Bashir file [110], [111], [112], originally added by Middayexpress [113], (this is similar behaviour to Rogundra90 as discussed above).
• Similar attempt to hide socking activity by a public display of disagreement between two socks. This was previously done with Troyoleg and Odriejh (two confirmed socks) [114], here Qevoja is reverting confirmed sock Geneticanthro [115].

Behavioural evidence for Kobe19782:

• Account created 4 May [116], one day after accounts Qevoja and Wahure were created (on 3 May) and on the same day previous socks Geneticanthro, Odriejh, Egezal were blocked. It was probably created in anticipation of the block.
• Time card [117] inline with Soupforone's first editing slot (2:00-6:00 UTC [118]).
• Same interest in Somalis and Amharas [119] (both articles have both Soupforone and Middayexpress as top editors [120], [121].
• Same insertion of population estimate 20-21 million in the Somalis article as Soupforone, months apart [122], [123].

Behaviour evidence for Arboleh:

This account seems to have been a sleeper (account created 21 May 2017) that was activated recently (first edit 7 April 2018).

• First ever edit on 7 April [124], a few days after sock account Troyoleg was created (3 April).
• Time card inline with sock Soupforone. Unlike some of the recently blocked socks whose activity happened during Soupforone's second editing slot (14:00-18:00 UTC), Arboleh account's time card follows both Soupforone's editing slots (2:00-6:00 UTC and between 14:00-18:00 UTC) [125], [126].
• They have edited only three articles: Horn of Africa, Cushitic languages and Land of Punt, all three articles have either Soupforone or Middayexpress (or both) on their top editors list [127], [128], [129].

• On Horn of Africa for instance, Arboleh made a number of edits to the history section on the 7 April [130], this was followed by edits to the same history section by confirmed sock Troyoleg later that same day [131]. Kzl55 (talk) 14:15, 12 May 2018 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I have no idea how this system works, and I apologize for that, but I am wondering if this is the appropriate place to suggest that somebody keeps an eye on user 185.84.181.121 as a possible sockpuppet? Middayexpress persistently edited East African archaeology pages to include reference to the "African Great Lakes region", and this unidentified user has reverted edits of mine which deleted that phrase from the Luxmanda article. Thanks, and again I apologize if this is not the right place to note my concerns (or if I should do so at all). Ninafundisha (talk) 18:55, 14 May 2018 (UTC)

Bbb23, can you check this latest report, or does Ninafundisha need to file a new case via WP:SPI? Cordless Larry (talk) 19:41, 14 May 2018 (UTC)

Ninafundisha, please see Bbb23's reply below. You'll need to file a new case by going to WP:SPI, opening the "How to open an investigation" box, entering "Middayexpress" into the text field, pressing submit and then completing the pro-forma report that appears with the details of the IP's edits. Let me know if you need help. Cordless Larry (talk) 22:03, 14 May 2018 (UTC)

Great, thanks so much. I think I'll sit on it for now, but if I continue to have problems on the East Africa pages I'll open a new investigation for sure. Ninafundisha (talk) 03:10, 15 May 2018 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

• The following accounts, all using different proxies just like the last batch, are  Confirmed to each other and to Troyoleg (talk · contribs · count):
  • Rogundra90
  • Wahure
  • Qevoja
• Kobe19782 and Arboleh are  Unrelated.
• Blocked the confirmed accounts without tags.--Bbb23 (talk) 14:53, 12 May 2018 (UTC)
• @Cordless Larry: If Ninafundisha wants the IP's edits evaluated, they should reopen this SPI so a new report is created. I can't check the IP because it is against policy.--Bbb23 (talk) 21:54, 14 May 2018 (UTC)

---

18 May 2018

– This SPI case is closed and will be archived shortly by an SPI clerk or checkuser.

Suspected sockpuppets

• Cherue (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• 185.84.181.121 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

I have previously been involved in long discussions with Middayexpress about several rather obscure East African archaeology pages, including Savanna Pastoral Neolithic - see our talk page discussion here: https://en.wikipedia.org/wiki/Talk:Savanna_Pastoral_Neolithic. I have tried to update these pages with new archaeological information, and I have tried to remove information that can no longer be supported with current archaeological evidence. Full disclosure: I found Middayexpress extremely belligerent and unreasonably committed to very outdated notions about linguistic affiliations, genetic histories, terminology, and so forth. I have at times lost my patience and I am sorry for that. I have recently started editing East African archaeology pages again, and immediately after editing pages such as Luxmanda (which was created by Soupforone, a Middayexpress sockpuppet), Elmenteitan, and Savanna Pastoral Neolithic a user with the IP 185.84.181.121 began changing my edits back to better suit Middayexpress's vision of East African archaeology - he/she uses the term Great Lakes region see [132], for example, but no archaeologists that I know recognize and use this terminology. I posted a note here [133] raising my concerns. The next day, I believe, that user had stopped posting and Cherue appeared.

I do not believe that Cherue could be a new user of Wikipedia, given his/her editing proficiency and tendency to immediate make the same sorts of edits, on the same pages, as Middayexpress used to. Middayexpress also had the habit of making long edits followed by very short edits (presumably to hide those long edits from other user's watchlist pages?), which was noted in previous sockpuppet investigations. Cherue also seems extremely concerned with both genetic evidence and with linguistic evidence [134] (at the expense of archaeological evidence, in my opinion), which is exactly Middayexpress's pattern of editing as well.

My biggest frustration stems from the fact that Cherue's new edits seem intended (although I cannot prove this, and I apologize if I misread this situation) to minimize the contribution of Africans when thinking about ancient peoples found archaeologically in East Africa. For example, new genetic data from the site of Luxmanda shows that ~38% of an ancient individual's DNA is related to ancient Levantine populations, but ~66% is related to ancient hunter/gatherers from Ethiopia. Cherue repeatedly edits the first sentence in the Ancient DNA analysis section of the Luxmanda page to imply that the individual is either entirely or mostly from the Near East. Here is one example: [135]. I find this really distressing - African archaeology has a long history of denying African populations their history and contributions to the archaeological record, and so I feel obliged to fight this battle. Here is an example of Soupforone defending the problematic Hamitic hypothesis: [136]. Similar concerns about Middayexpress and Soupforone were voiced by Cordless Larry here in previous investigations of Middayexpress sockpuppetry [137]; see (here). Ninafundisha (talk) 21:12, 18 May 2018 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

•  Confirmed to Troyoleg. Blocked without tags and closing (the IP edits are too old).--Bbb23 (talk) 22:48, 18 May 2018 (UTC)

---

24 May 2018

– This SPI case is open.

Suspected sockpuppets

• Vukharttara (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

• [138] - creates an account three days after Troyoleg is blocked.
• Edits Addis Ababa [139], a page where he is the second-highest editor, if the socks Middayexpress, Troyoleg, and Soupforone are combined [140].
• [141] Replaces images, similar to Troyoleg [142]
• [143] Reinstates an edit war started by Soupforone [144]
• [145] Similar POV in that Horn Africans aren't black.
• [146] Similar editing style of following a major edit with a minor edit [147]
• [148] Proceeds to diversify his topic area moments after I voiced my suspicions [149]. Thylacoop5 (talk) 06:18, 24 May 2018 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

---