I found more. P9 - BestofSR, cryptonikus, Deftonikus, Djentriser and TeseracT. Busted as socks on NODE.
All present on the NEM stakeholder list, haven't collected any tokens yet.
This looks pretty extensive. It's a good chance that all the socks on NODEs' list are probably on the NEM list. Seems like some had collected tokens (and presumably sold). The others can still be refunded.
Perhaps should clarify first how NODE declared them to be socks. They never had a public or transparent taint analysis as far as I know. In a lot of circumstances, I see them just grouping inactives based on similar names.
For instance, P5 consists of two guys. Bytemother and ivanluiso. No chain transactions to put them together. They registered weeks apart. Only thing I see in common are messages in Spainish and both are named Ivan (meh I guess that's a probable link but still).