Misplaced Pages

:Sockpuppet investigations/Icewhiz - Misplaced Pages

Article snapshot taken from Wikipedia with creative commons attribution-sharealike license. Give it a read and then ask your questions in the chat. We can research this topic together.
< Misplaced Pages:Sockpuppet investigations

This is an old revision of this page, as edited by ABHammad (talk | contribs) at 22:12, 8 November 2024 (→Comments by other users). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Revision as of 22:12, 8 November 2024 by ABHammad (talk | contribs) (→Comments by other users)(diff) ← Previous revision | Latest revision (diff) | Newer revision → (diff)

Icewhiz

Icewhiz (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Populated account categories: confirmed · suspected

For archived investigations, see Misplaced Pages:Sockpuppet investigations/Icewhiz/Archive.

09 October 2024

– This SPI case is closed and will be archived shortly by an SPI clerk or checkuser.

Suspected sockpuppets

There are behavioral similarities between Galamore and the User:O.maximov/User:UnspokenPassion accounts I reported at Misplaced Pages:Sockpuppet investigations/Icewhiz/Archive#27 August 2024 (pinging blocking admin HJ Mitchell). There are also similarities between Galamore and other confirmed/suspected socks, so I'm not sure who the master is (if anyone). Per RoySmith's advice here, I'm filing it under this case to stick with one case file and not sweating the details of which file.

I had this timecard theory:

Sakakami had been on my radar because the account was created Aug 8, just a few days after I filed an AE report against O.maximov, and Sakakami made ~500 edits almost exclusively to category namespace in a handful of days in Aug and Sep, hit XC 9/9 7:29 , and their very next edit at 7:43 was at State of Palestine. But Sakakami was recently confirmed to User:Dolyn, see Misplaced Pages:Sockpuppet investigations/Dolyn/Archive#07 October 2024. I don't know if Dolyn is related here but I've decided to file Galamore under this case page instead of that one.

Galamore was previously mentioned at Misplaced Pages:Sockpuppet investigations/Bennet43/Archive#17 January 2024 and Misplaced Pages:Sockpuppet investigations/ElLuzDelSur/Archive#26 April 2024

Same similarities as in the prior O.maximov/UnspokenPassion filing: repeating each other's edits, similar talking points, and "drive-by" habit (only making one edit to article/talk page, to support another sock)

Aside from similarities between Galamore and O.maximov/UnspokenPassion, there are also similarities between these three accounts and two other accounts, OdNahlawi and PeleYoetz, that have been reported at another currently-pending SPI, Misplaced Pages:Sockpuppet investigations/OdNahlawi:

Edit summary similarities:

  • Many vague, canned edit summaries like "added info" or "adding info and sources"
  • "detail"
    • Galamore: "dropping figures, no need to get this level of detail here" (how many Palestinians and Lebanese have been killed)
    • Galamore: "number of bombs not really important at this level of detail" (how many bombs dropped by Israel)
    • But: Galamore: "Reverting recent edit that removed important, factual details on Palestinian political violence"
    • PeleYoetz: "list of places too detailed for this article" (places occupied by Israel)
    • But: PeleYoetz: "I changed the introduction to add more important detail on the neighborhood" (the important detail is "renowned for its eclectic architectural styles, and often regarded as one of the most beautiful neighborhoods in the city")
  • "historical truth"/"historical facts"
    • O.maximov ("deny the plain fact ... denial of historical truth ... I will be adding this factual information shortly.")
    • Galamore ("Reverting, these edits removed important historical facts")

And of course, all the accounts share the same Israeli nationalist POV. Throw a dart at the EIA for all of them and you're likely to hit a pro-Israeli edit. Levivich (talk) 23:09, 9 October 2024 (UTC)

Per Izno's comment on the OdNahlawi SPI, here are diffs/links from that page that wasn't on this page (because it doesn't involve Galamore, but does involve OdNahlawi, PeleYoetz, and another, Uppagus):
  • Edit by OdNahlawi (reverted), relevant portion quoted in Wikitext:

    ... "] the changes and introduced ] errors in the article" doesn’t seem like you’re addressing me to explain my edits or calling for any action. ...

    To make this edit, OdNahlawi had to type the word "PeleYoetz" (or enough of it to trigger autofill), and then type the words "me" and "my" -- simply being on the wrong page doesn't explain how one types out another's username and then refers to it as "me" and "my". This is the single most compelling piece of behavioral evidence IMO. (Even if the quoted portion were copied-and-pasted in whole or in part instead of typed out, the text "User:PeleYoetz|PeleYoetz" would be the first portion that was highlighted.)
  • All three edited almost-daily to get to XC. Once they hit XC, both the frequency and number of edits declines:
    • Uppagus edits almost daily until 5/7 (1st 500 contribs); hits XC 5/7 ; stops daily editing 5/7, switches to a few days a week, then a few days a month (post-XC contribs)
    • PeleYoetz same: edits almost daily until 6/18 ; XC 6/17 ; stops daily editing 6/18
    • OdNahlawi same: edits almost daily until 8/8 ; XC 8/8 ; stops daily editing 8/8
  • All three make liberal use of vague stock edit summaries, e.g. "Added information", "Adding information", "Added info" (see the contribs lists linked above for examples).
  • Similar and somewhat distinctive timecards: Uppagus's timecard, PeleYoetz's timecard, OdNahlawi's timecard
  • PeleYoetz and OdNahlawi have edited hewiki, though Uppagus has not: Uppagus's xtools, PeleYoetz's xtools, OdNahlawi's xtools
  • Uppagus created Jan 28; PeleYoetz May 9; OdNahlawi June 18 -- basically the same time periods as many of the already-blocked socks in this topic area, although I understand that socks are created all the time
  • Overlaps for OdNahlawi/PeleYoetz/Uppagus:
  • EIA for all three: . All three accounts' edits reflect a noticeable Israeli nationalist POV -- I think anyone reviewing these edits who clicks on any random edit will find that the edit in some way or form makes Israel look better or makes its enemies look worse. This is how I'd characterize pretty much ever edit in this report.
One final note: however this shakes out, whatever the CU team ultimately decides, I would appreciate feedback about the behavioral evidence, both content and format. I have other SPIs I am contemplating filing (other suspected socks) but I don't want to waste your time reading things that aren't helpful any more than I want to waste my time writing it. So, please help me help you by telling me what is useful and what is not useful in these reports I've filed. Thank you! Levivich (talk) 18:27, 16 October 2024 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
I am honestly baffled that PeleYoetz and OdNahlawi arent confirmed by self-admission already. This should be put as the definition of own goal here. Even if the CU showed one of them was editing from the moon, that is a user accidentally outing themselves as running multiple accounts. I think the evidence above ties those two together with Galamare, and I can try to scrounge up some evidence for what I think is another account (not sure if it's the same unnamed one Izno references obviously) before this is closed, but those two being the same editor is a slam dunk, and I am baffled as to how that is in question. nableezy - 17:45, 17 October 2024 (UTC)
Besides the very different time signatures, level of English, topics of interest, and languages (for example, OdNahlawi seems to speak Arabic) between the editors listed here, I want to point out something important to CheckUsers here. The two editors here asking for CU—namely Levivich and Nableezy—are now included in the list of parties in this ARBCOM motion. If it passes, arbcom will start a full case to check their conduct, alongside that of other editors, in the PIA topic area. Note that the concerns discussed on that page, as escalating admins labelled them, include "edit warring, battleground mentality, and POV pushing." As I mention in my comment here, I believe that, alongside issues such as the endorsement of sources affiliated with terrorist organizations, and the promotion of skewed content, there's a major issue of aggressive conduct by the so-called 'ARBPIA regulars' towards new editors with opposing viewpoints based on unsubstantiated evidence. In fact, arbcom became involved in this issue in the very beginning following an AE complaint Levivich opened against PeleYoetz, claiming tag-teaming, which admins later closed and escalated to the committee, saying that the conduct in question also applies to the side of those filing the AE too (which was then followed by some editors saying will be solved only through sanctions on the 'regulars' too.).
Is it just coincidence that after a failed AE on PeleYoetz, and then a failed CU on PeleYoetz and OdNahlawi just a few days ago (closed as unrelated), now Levivich is making another CU request involving the same editors? The choice of words in the above request, with the main point of similarity comes down to what Levivich describes as the editors' "pro-Israeli views" (but in fact are shared by much of the Western World), while the editor says things such as "we are witnessing the last grasps of Zionism," and "Zionism is fundamentally irrational: as soon as you lay it out and look at it, you realize it makes absolutely no sense whatsoever," may show more clearly what really is going on here. ABHammad (talk) 19:45, 17 October 2024 (UTC)
Bonkers that this level of misdirection for a page that is solely focused on if one user is the sockpuppet of a banned user is allowed. nableezy - 21:44, 17 October 2024 (UTC)
Your lawyerly approach to these things reminds me of someone, let me think... Selfstudier (talk) 22:31, 17 October 2024 (UTC)
Fox something, someone help me out here, could be totally wrong of course. Selfstudier (talk) 22:43, 17 October 2024 (UTC)
I've written this before about users suspected of being sock puppets (then it was people accused of being socks of Tombah, but it applies to Icewhiz too):
  1. We can't just continue claiming that all those who don't align with the anti-Israel view common here, as being by the same person and file CU checks on them based on very limited evidence if any. there are 10 million Israelis, who may be interested in similar topic and work in similar timeframes.
  2. Take a look at these user edits in other languages as well. In my case, I was also accused of being Tombah, but after checks they have found out that I was not related to them. This is becoming too common and for no reason.Eladkarmel (talk) 20:12, 17 October 2024 (UTC)
There's a high cost associated with having an over-sensitive approach to ban evasion and a high cost trying to deal with it, including mistakes and collateral damage.
  • In terms of cost, Irtapil, an account used by someone with a pronounced pro-Palestinian bias has made 12865 edits using 5 accounts that have been identified so far. Evidently, we are very bad at identifying ban evasion. Notably, no one leapt to their defense when SPIs were filed.
  • Identifying accounts that are employing deception should have nothing to do with the conflict, it should just be about identifying people willing to use deception, because their presence is corrosive. Their presence makes all of the tools, and the rules used to control/limit behavior in the topic area worthless because the effectiveness of sanctions becomes dependent on a person's willingness to employ deception via disposable accounts.
  • Sanctions are only effective on honest editors. No one should have to deal with dishonest people here. I would rather they were given a subset of the topic area where they can edit and not get reported because they are never going to stop ignoring rules they don't think apply to them. Sean.hoyland (talk) 12:10, 18 October 2024 (UTC)
Frankly, @Eladkarmel, I find it suspicious that you characterize my report as "very limited evidence," considering there are maybe 50 diffs or something? And similar with your characterization of "similar topic" when it's actually the same articles, not just similar topics, and "similar timeframes" when the evidence actually shows that it's not similar timeframes, but consecutive timeframes. I'm not really sure how you can look at this evidence and not think that it's worthy of an SPI filing. Similar to your comments in the previous one, even though that one came back confirmed. You don't have to be persuaded by the evidence, but acting as if there isn't evidence on this page, is odd. Levivich (talk) 17:22, 18 October 2024 (UTC)
Previously @RoySmith said the OdNahlawi and PeleYoetz were unrelated, below @Izno says there is "weird data" that connects those two and Galamore and it is consistent with potentially being Icewhiz. This has languished here for a couple of weeks now, can we get some clarity as to if this is being investigated further? nableezy - 15:48, 30 October 2024 (UTC)
Nope. The last time I went near this, I got beaten up because somebody didn't like my findings. I've got better things to do with my time. RoySmith (talk) 15:55, 30 October 2024 (UTC)
I certainly did not beat you up, and now we have conflicting findings between you and Izno. I dont think Levivich was beating you up either, but Im sorry you felt attacked. I hope youll reconsider your withdrawal from this case, but could any other checkuser review this and the findings on the CU wiki? nableezy - 16:01, 30 October 2024 (UTC)
As the other CU mentioned by Izno below I don't know if they're conflicting findings necessarily or rather differences in how similar findings are presented. I'll see what I can do about diving into the technical evidence but don't think I"m going to have time to go through the massive behavioral evidence Levivich compiled above. Barkeep49 (talk) 16:11, 30 October 2024 (UTC)
Izno I'm not faulting Roy either, that was not my intent at all, based on the history I assume that most Icewhiz sock's technical data would generally look inconsistent. Though I said "is consistent with potentially" not "is consistent", which I think is closer to "not inconsistent" than "is consistent". nableezy - 18:09, 30 October 2024 (UTC)
Interestingly, one of the most prominent behaviors I have seen from PeleYoetz and Galamore was their occasional avoidance of engaging in the talk page despite repeated pings and talk page messages; this is a behavior also shared by EnfantDeLaVille. Editor interaction tool shows some interesting results. Makeandtoss (talk) 12:13, 1 November 2024 (UTC)
@Makeandtoss, I wouldn't necessarily draw anything out of the result of that interaction result unless you also provide diffs showing close phrasing in their edits. Not saying you aren't on to something, but something more would be needed. TarnishedPath 12:20, 1 November 2024 (UTC)
Although we can see clear signs of trying to avoid suspicion by changing writing styles and behaviors, a phenomena that will likely continue to grow especially after this SPI, but sure, you are right, this is just an initial observation that other editors can also build on. I will see what I can do. Makeandtoss (talk) 12:28, 1 November 2024 (UTC)
Here are some other observations for now. I don't have the tools to do a quick review of the edit summaries, so tagging @Levivich: and @Sean.hoyland: who might.
Creation dates:
  • Galamore 25 December 2023
  • O.maximov 8 February 2024
  • EnfantDeLaVille 24 March 2024
  • UnspokenPassion 28 March 2024
Language choices:
  • Galamore editing on Hebrew WP
  • O.maximov editing on Russian WP
  • EnfantDeLaVille editing on French WP
Timezone:
All four users never edit between 22 and 4 UTC.
Identifications
  • One of the banned suspected socks of Icewhiz is User:Proud Indian Arnab, resembling the proud Lebanese tag on EnfantDeLaVille's userpage.
Odd interest in banks:
  • O.maximov most edited articles are Israeli banks
  • EnfantDeLaVille odd two uploads to WP were logos of Lebanese banks; in one of which they seem to have used the unusual Arabic word of مصرف instead of بنك to describe the bank.
Makeandtoss (talk) 12:52, 1 November 2024 (UTC)
Makeandtoss, I don't think I have anything of much value to add here. What I can say is that according to my unreliable no-time-work-on-because-i-have-young-dog software, out of a test dataset of 339 accounts, EnfantDeLaVille is a closest match to Icewhiz sock Uppagus. But it places Uppagus closest to OliveTree39 rather than a sock classified as an Icewhiz sock. And while it has been consistent with SPI results in many cases, it placed PeleYoetz closest to Bukrafil (a Gilabrand sock) and Gilabrand, which is inconsistent with classification as an Icewhiz sock. So, make of that what you will. Sean.hoyland (talk) 15:36, 3 November 2024 (UTC)
Unfortunately, I also don't know anythingabout this editor, but if it helps, the WP:Editor Interaction Analyzer I use is the Sigma one; there's also a template, {{EIA}} that generates a custom link. Levivich (talk) 18:34, 3 November 2024 (UTC)
@Izno: @Barkeep49: I can go on to do an editing behavioral analysis if this is not adequate for a check yet. Makeandtoss (talk) 10:07, 4 November 2024 (UTC)
@Makeandtoss can you please make a separate filing with whoever it is you think needs a new check, with specifics for that/those accounts? Either as part of this SPI or a new one. Izno (talk) 16:27, 4 November 2024 (UTC)
I have done so as suggested. Makeandtoss (talk) 14:32, 5 November 2024 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

05 November 2024

– This SPI case is closed and will be archived shortly by an SPI clerk or checkuser.

Suspected sockpuppets

Evidence relies on comparing EnfantDeLaVille with socks PeleYoetz, Galamore, O.maximov, and UnspokenPassion of the sockmaster Icewhiz:

  • Common behaviors:
1- Occasional avoidance of engaging in the talk page despite repeated pings and talk page messages: PeleYoetz, Galamore and EnfantDeLaVille.
2- Overlapping interests in the analysis tool , namely Hezbollah, Israel and the conflict area.
3- Overwhelming and very specific start of edit summaries with the word "Add" (Add/Adding/Added): UnspokenPassion 268 times,, O.maximov 41 times, EnfantDeLaVille 99 times, Galamore 67 times if my calculations are correct.
  • Registration dates:
1- Galamore 25 December 2023
2- O.maximov 8 February 2024
3- EnfantDeLaVille 24 March 2024
4- UnspokenPassion 28 March 2024
5- PeleYoetz 9 May 2024
  • Second language choices:
1-Galamore and PeleYoetz editing on Hebrew WP
2-O.maximov editing on Russian WP
3-EnfantDeLaVille editing on French WP
  • Timezone:
- All five users never edit between 22 and 4 UTC.
  • Self-identification
- One of the banned suspected socks of Icewhiz is User:Proud Indian Arnab, resembling the proud Lebanese tag on EnfantDeLaVille's userpage.
  • Odd interest in banks:
1- O.maximov most edited articles are Israeli banks
2- EnfantDeLaVille odd two uploads to WP were logos of Lebanese banks; in one of which they seem to have used the unusual Arabic word of مصرف instead of بنك to describe the bank. Makeandtoss (talk) 14:32, 5 November 2024 (UTC)
There are way too many accounts which are claiming that they are Arab with very similar characteristics so I will build another case soon. Makeandtoss (talk) 15:19, 5 November 2024 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

So, when they said "The events in Lebanon in recent months catch me at a sensitive time, and the suffering of my people from the situation in my homeland is unbearable." here at AE they were lying. That's nice. Sean.hoyland (talk) 15:14, 5 November 2024 (UTC)

For interest, out of the 658 accounts that registered this year and have qualified for extendedconfirmed privileges, a much lower number than I expected, 91 of them have been blocked for ban evasion/sockpuppetry. Sean.hoyland (talk) 16:08, 5 November 2024 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

08 November 2024

– A checkuser has completed a check on relevant users in this case, and it is now awaiting administration and close.

Suspected sockpuppets

Evidence is based on comparing ABHammad with sockmaster Icewhiz.

Timeline:

Icewhiz has a large number of suspected socks who were banned for either being them or working with them, example from the 14 August 2022 batch: DoraExp, Molave Quinta, SCNBAH, Smoking Ethel. This is only a month before ABHammad created their account on 20 September 2022.

Rushing to defend:

ABHammad in the past couple of weeks has rushed to the defence of four of Icewhiz’s recently banned sockpuppets User:OdNahlawi, User:EnfantDeLaVille, User:PeleYoetz, and User:O.maximov.

Also, whenever an SPI case was opened against Icewhiz socks, ABHammad also rushed to their defence, in which they argued confidently that these were different users; ultimately all SPIs ended up in a positive confirmation of sockpuppetry.

Interaction tool:

Tool reveals several interlaps in articles, with minimum time between edits at least 1 minute long; added User:Owenglyndur to the list.

Odd contributions to commons:

ABHammad’s sole odd contribution to Wikicommons is an upload of an Emirate mall’s logo,, similar to EnfantDeLaVille’s odd only upload of a Lebanese bank’s logo.

Usernames:

Most importantly, ABHammad and OdNahlawi are similarly structured and both Arab family names, such as Salameh Hammad and Abd al-Karim al-Nahlawi.

Connection with other sockmaster Dajudem:

In addition, there seems additional similarties with another sockmaster User:Dajudem, who has nine confirmed sockpuppets and two suspected ones:

1- Very similar username structure to banned sockpuppets User:CJStevens and User:FLWalker.

2- Very similar timecards as most common edits occur 2-5 am UTC, and fewer after 12 pm: Snakeswithfeet, ABHammad, Tundrabuggy, Dadujem.

3- Hyperfixations on similar topics: (A) Golan Heights: Denial of the fact that the territory is occupied by Israel from Syria on the article’s talk page: Golan heights is not occupied, Golan heights is ours, Improvisealot123, ABHammad. (B) 1948 Palestinian expulsion and flight: Calling the topic “controversial” and attacking the sources and historians critical of Israel as being “politicized”: ABHammad: 1, 2, 3. User:Snakeswithfeet: 1, 2, 3.

4-Multiple interlapping article interests between ABHammad, Snakeswithfeet, and User:Tundrabuggy. Makeandtoss (talk) 12:40, 8 November 2024 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Think it’s Dajudem but don’t know how that will be proven with how old those confirmed socks are. nableezy - 12:55, 8 November 2024 (UTC)

Although there are some pretty interesting overlaps here. Talk:Samir Kuntar#Large scale revert are now two blocked socks along with ABHammad. At Talk:Palestinian suicide attacks#Requested move 21 August 2024 it is ABHammad alongside 5 Icewhiz socks (OdNahlawi, Galamore, UnspokenPassion, PeleYoetz, O.maximov) and one other user opposed to the move. At Talk:1982 Lebanon War#Lede it is ABHammad alongside three now blocked Icewhiz socks (EnfantDeLaVille, Galamore, and PeleYoetz). At Talk:Israeli apartheid#Tags it was ABHammad alongside OdNahlawi and Galamore until a few other users joined in a couple of days later. Over and over again it is ABHammad alongside almost by themselves a collection of IW socks. nableezy - 19:53, 8 November 2024 (UTC)
@Bradv Galamore is blocked as an Icewhiz sock. nableezy - 20:13, 8 November 2024 (UTC)
I realize that, but the connection was very brief, and I'd like a second opinion from another CU before taking action on it. – bradv 20:14, 8 November 2024 (UTC)
@Bradv: And Dajudem? Makeandtoss (talk) 20:27, 8 November 2024 (UTC)
Are there any recent accounts? From what I can see, the last confirmed Dajudem sock was blocked 14 years ago. CU wouldn't be helpful in this case. – bradv 20:37, 8 November 2024 (UTC)
Doesn't appear so; maybe a sock was later misidentified as a sockmaster, which could explain the gap. But either way, the behavioral evidence is also very interesting. Makeandtoss (talk) 20:40, 8 November 2024 (UTC)
Owenglyndur isnt blocked as a sock but rather for copyvios, but adding that name shows some additional curiosities. ABHammad alongside two Icewhiz socks at Talk:Golan Heights#Revert (PeleYoetz, and Galamore), and alongside Owenglyndur at Talk:Golan Heights/Archive 16#Scope? nableezy - 21:14, 8 November 2024 (UTC)
Looking at other connections with IW socks, Talk:Antisemitism in the United Kingdom#New bus line had ABHammad's first and only ever edit to that talk page to agree with Minden500. Just repeated behavior, showing up for the first time to agree with a now blocked IW sock, often in discussions with a limited number of editors, and often when ABHammad and the IW socks are the only ones arguing a point. nableezy - 22:10, 8 November 2024 (UTC)

I read this and I ask myself how is this still allowed here. @Barkeep49:, surely you see the weaponization of SPI happening here. We have an editor who has already received their 'final warning' "for behavior that falls below the required level required when editing in contentious topics", yet continues to spread bad-faith allegations (here), engage in edit warring , and selectively remove content . I feel like I am being targeted by editors for providing more evidence relevant to Arbcom's upcoming case. In my case I was quick to be given a 0RR sanction. For how long are we gonna keep this policy of ignoring the continuing battleground behavior from the 'unsanctionable' club? When will Misplaced Pages finally wake up? ABHammad (talk) 22:11, 8 November 2024 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

  • It looks like this will need to be done on behaviour. The geography doesn't match other Icewhiz socks, although there appears to be extensive proxy use. I did, however, find two brief overlaps with other users, namely Galamore and Owenglyndur. A second opinion on the technical aspects would be helpful, along with more evaluation of the behavioural evidence. – bradv 20:11, 8 November 2024 (UTC)
  • I find the technical evidence connecting ABHammad to Galamore and Owenglyndur to be at best inconclusive but more likely to indicate they're unrelated. If there's socking it will need to be proven behaviorally. Barkeep49 (talk) 20:59, 8 November 2024 (UTC)
Categories: