Jump to content

Wikipedia:Sockpuppet investigations/Cianzera

Add links
From Wikipedia, the free encyclopedia
< Wikipedia:Sockpuppet investigations

This is an old revision of this page, as edited by Bogomolov.PL (talk | contribs) at 15:06, 12 February 2023 (→‎Comments by other users). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Cianzera

Cianzera (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Populated account categories: confirmed · suspected

10 February 2023

– A checkuser has completed a check on relevant users in this case, and it is now awaiting administration and close.

Suspected sockpuppets

Cianzera, who has been indef blocked on Russian Wikipedia, runs several socks. One of them, Lauriswift911, has just been blocked on enwiki for racial slurs and personal attacks. The other socks, as confirmed by Q-bit array, include Th3Shoudy, Foggy kub and Kozaryl. The first piece of evidence comes from the Russian Wikipedia, where all of these accounts have been blocked. The reason provided for all of these blocks is sock puppetry: Lauriswift911, Th3Shoudy, Foggy kub, and Kozaryl.

This issue was first raised on the English Wikipedia last month by Kazman322, who pointed out that Lauriswift911 admitted to using multiple accounts (or sharing an account?). He basically wrote "Foggy kub is my friend, and he just went to my account, do not be offended by your story, you lost and won, this article has the right to be." At the time Lemonaka replied by saying that his account had been compromised and that it had to be reported. It seems no action was taken.

The issue was brought up again on enwiki by Bogomolov.PL on February 3, 2023, although on an AfD discussion page. There Bogomolov.Pl wrote as follows:

User:Lauriswift911 is a sock-puppet of the User:Cianzera (checkuser test in Russian Wikipedia): blocked indefinitely in Russian Wikipedia (2 September 2022) with reason Wikipedia:Sockpuppetry [29] The English Wikipedia on the personal page of this account User:Lauriswift911 says that his nickname in social networks is @cianzera and his ideology is Nationalism. 23 January 2023 account Lauriswift911 attempted to create a duplicate account called Cianzera911 [30]. This account created the article Kyrgyz Confederation 20 January 2023.

He also wrote that this person has numerous other sock-puppets, including Foggy254, Torsva45, Teodor342 ftk, X-man super, Konstanta.A, Лис По, Xakasya911.

This issue was again discussed on the Administrator's Noticeboard last week. As DIYeditor has rightly pointed out, some of the articles created by Lauriswift911 are potentially hoaxes. After Bogomolov.PL commented by writing I guess we are dealing with a cross-wiki vandal who has created a whole "team" of sockpuppets. He works on the subject of Kyrgyzstan, primarily the history of Kyrgyzstan, the discussion was simply archived and no action was taken.

While discussing Lauriswift911's behavior on the Administrators' Noticeboard today on February 10, 2023, I was advised to file an FTI here. The discussion there also includes relevant information and comments, including by Q-bit array.

The second piece of evidence comes from the contributions of these accounts. Take Th3Shoudy and Lauriswift911, for instance. Both have edited the articles on the Kyrgyz Khanate (this article could potentially be a hoax, by the way), List of wars involving Kyrgyzstan, Yenisei Kyrgyz Khaganate, List of wars involving Tajikistan, 2022 Isfara missile attacks, and Kyrgyzstan. Or take the improbable 'coincidence' on Commons, also pointed out by Bogomolov.PL:

Outside of the English Wikipedia, the "kinship" of accounts may indicate that these accounts uploaded maps of the same type to Wikimedia Commons: 

Cianzera:File:Map of Kyrgyz Union.jpg; Kozaryl:

Last week's discussion on the Administrator's Noticeboard also has some useful comments, inducing by Ymblanter and Salvio giuliano. The latter reprimanded Bogomolov.PL for not filing an SPI, so here we go. I hope I got everything. One final thing: all these accounts contribute in broken English, so maybe that's also an indication of some shenanigans (although a rather tenuous one, I must say). بلاد ما وراء النهر (talk) 20:11, 10 February 2023 (UTC)[reply]

Regarding IP addresses, in Central Asia, including Kyrgyzstan, a majority of the population access the Internet using their phones. Even when using a computer, their use their phone as a mobile hotspot, as landline Internet connection is not common (many people simply can't afford it). I've noticed that when you use your phone as a mobile hotspot, your IP address changes a bit each time, but the initial figures remain more or less the same. That explains why when doing a user check IP ranges that geolocate to the same area can be observed. As for behavioral evidence, I'll share some initial thoughts. Both users first registered on the Russian Wikipedia: Th3Shoudy on 11 March 2022, Lauriswift911 on 6 April 2022. What are the odds of two people registering on the Russian Wikipedia within less than a month and then actively editing more or less the same articles on the English Wikipedia? Also, let's consider actual edits. This edit made by Lauriswift911 is remarkably similar to this one made by Th3Shoudy. And consider this: both users do this weird thing where they write [[Bars Bek|Bars-Kagan]] instead of just writing [[Bars Bek]] or [[Bars-Kagan]]: Lauriswift911 and Th3Shoudy. Again, what are the odds of that happening by pure chance? Finally, Th3Shoudy made an edit at 10:22, 10 February 2023; Lauriswift911 made his last edit before being blocked at 13:21, 10 February 2023; then Th3Shoudy frantically started editing enwiki at 13:36, 10 February 2023, meaning 15 minutes later. And so on. بلاد ما وراء النهر (talk) 00:13, 11 February 2023 (UTC)[reply]
Th3Shoudy has been rightly blocked. I believe a global ban as suggested by Rosguill below is not a bad idea. The guy seems to be currently trying to become a sysop on the Kyrgyz Wikipedia! Imagine what a self-proclaimed nationalist would do there if given admin rights! بلاد ما وراء النهر (talk) 00:46, 11 February 2023 (UTC)[reply]
The user is now back with his another account, namely Foggy kub. Rosguill and Salvio giuliano, now that it's clear that we're dealing with the same person with dozens of socks (see the additional evidence provided by other users below), do you think all of his accounts should now be blocked? The guy just can't seem to refrain from spreading unsourced, unverified and potentially false claims about the history of the Kyrgyz. بلاد ما وراء النهر (talk) 15:00, 12 February 2023 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

To begin with, you need to clarify. I'm Th3Shoudy, not affiliated with the above mentioned accounts in any way, I know user Lauriswift911 by sight, nothing more. The Q-bit array user showed complete incompetence by blocking me on the Russian Wikipedia without trial, in my defense I will ask you to compare my IP and IP Lauriswift911. About the article Kyrgyz Khanate, they already tried to remove it as a "mystification", but the article was protected as a result, you can check this by reading the archive of the nomination for deletion.[1] — Preceding unsigned comment added by Th3Shoudy (talk • contribs)

I was pinged here, but I believe nothing I can do here. I don't have any other evidence to submit. Regards. --Lemonaka (talk) 10:16, 11 February 2023 (UTC)[reply]


Hi. I can confirm to the evidence presented here. First I want to note how this check coincided with my one carried out today. I've had my suspicions about puppetry for a long time. But before that I didn't want to deal with it all. But, today, checking the edits of Lauriswift911 for February 9, I realized that I need to act.
The story starts with Cianzera911. The account had massive, to some extent marginal (in terms of vocabulary, history, and others) edits without indicating sources. I started a discussion with him about one of his edits. In this regard, the insults were sent to my email address indicated on my user page. As a result, he was banned on February 22, 2022 In connection with this, one of the participants contacted me about this blocking. One of the respondents was the TAUZULE account. Today I checked his edits, they are very similar to the others mentioned here.
After a while, a very active contribution began from the Lauriswift911 account. Moreover, the themes of edits and the style were the same as those of Cianzera911.
Since the Kyrgyz Wikipedia is not very active it is easy to detect.
Next, I want to list the signs I noticed.:
1) The accounts in question edit the same articles or create articles on the same topic.
This is the history of Kyrgyzstan, the clans and tribes of the Kyrgyz, the list of wars of the Kyrgyz, modern historical events, regions and countries.
Speaking of the Kyrgyz Wikipedia, they are all edited and edited via a mobile phone. Moreover, editing takes place in the mobile view mode (because if you make edits from a mobile phone in the computer view mode, then no record is made about editing from a mobile phone).
Also, from those accounts that aroused my suspicions, mass edits can be traced without specifying the source of information, new articles are created short (mostly only the definition of the concept), and images of flags and coats of arms are placed in a table, not in a template.
2) You can notice that one of the accounts is the main one (after blocking Cianzera911 in several projects, Lauriswift911 became the main one). Other minor ones. So I noticed that to upload files, it is used: Torsva45
For example, on February 9, an image of the flag or symbol of the Solto tribe (not the state or something else) is included in this article. This image was uploaded on February 9 from the account Torsva45. The same has been done with other articles about Kyrgyz tribes in recent days. In addition to this case, maps of the same style are also specially created for a number of articles.
Cianzera:File:Map of Kyrgyz Union.jpg; Kozaryl:; Torsva45:File:Belovodsk Autonomous Republic Map.jpg

--Bosogo (talk) 17:30, 11 February 2023 (UTC)[reply]

One of the maps shows this community: https://vk.com/ateo_kr
The author of this community is probably the author of the uploaded images. Read the comments. The proposal to create flags for 40 Kyrgyz tribes is also mentioned there. Bosogo (talk) 08:34, 12 February 2023 (UTC)[reply]
This community was created on April 6, 2021. The author of the map is Barys Sultanov, he himself indicates this in the posts: "I draw myself, the style, all the colors I came up with myself." It seems that this name was indicated by Lauriswift911 on his personal page in the English Wikipedia[2]. Thus, the maps in the style of Barys Sultanov prove that the author of all the maps is the same person, but with different accounts. Bogomolov.PL (talk) 10:32, 12 February 2023 (UTC)[reply]
It is enough to look at such a post in this community: [3] and was only one comment to this post: [4]. Not deleted. It is enough. Bogomolov.PL (talk) 15:06, 12 February 2023 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

This case is fairly complicated, so I'll be as clear as I can. All the accounts I am about to list appear to be editing from the same country; to be even more precise, they edit from IP ranges that geolocate to the same area, but I'm not sure how reliable geolocation is in the context of this country (as I am fairly unfamiliar with it) and some of the ranges appear to be proxies, while others do not appear to be. Furthermore, the UAs seem to be all over the place even in relation to the same user.
That said, the following accounts seem to be very  Likely operated by the same person:

The following accounts are  Confirmed to one another:

If we accept that the two groups are operated by the same person, then Surapbaeva (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) is also a sock of theirs.
Finally, we also have Th3Shoudy (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) who appears to be editing on the same IP ranges as Foggy kub and the others, but the technical similarities end there. All the rest is stale.
In the end,  Behavioural evidence needs evaluation. Salvio giuliano 21:21, 10 February 2023 (UTC)[reply]

Looking at the WMF editor interaction logs, I am very confident that Th3Shoudy and Lauriswift911 are either the same person or working together, and will block accordingly. There's a remarkably striking pattern on both ru.wiki and en.wiki. There's also enough different accounts, on multiple projects, that I think we should consider escalating this to a global lock (or at least notifying ky.wiki where Lauriswift11 is quite active. I haven't investigated any of the other accounts listed yet. signed, Rosguill talk 00:27, 11 February 2023 (UTC)[reply]


Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Cianzera&oldid=1138946541"