Wikipedia:Sockpuppet investigations/Velebit/Archive

Velebit

Velebit (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Prior SSP or RFCU cases may exist for this user:

• Suspected sock puppets/Velebit
• Suspected sock puppets/Velebit2

• Requests for checkuser/Case/Velebit

25 January 2012

Suspected sockpuppets

• 71.178.115.169 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 71.163.229.6 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 71.191.19.40 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 71.163.236.199 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.

I've observed a pattern of edits from these users and IP addresses, basically the bulk of their contributions match the same topic areas - fascism, Nazism, Italian irredentism, etc. They push their POV and have a lack of understanding of the verifiability policies, too. They engage in revert wars and also seem to have a propensity of censoring talk pages. As far as I can tell, they've abused pretty much all other editors they came in contact with - I now skimmed their contributions in the user talk namespace and they're all fraught with incivility.

There are now too many of them for me to just discard the IP address changes as a result of a standard ISP IP randomization policy. They keep making the same kinds of edits (reverts) and these IP address changes split the edit history so their now long-term disruption becomes less obvious.

Obviously I could be wrong about all this, but by now it's wasted enough of my time for me to request this kind of an investigation.

The general usage timestamps seem to match:

• the named account was active from March 2011 to May 2011, when they "resigned"
• 71.178.115.169 was active in April 2011
• 71.163.229.6 was active in May 2011 (except for one vandal edit in April whose revert pattern links them to 71.178.115.169)
• 71.191.19.40 was active from October 2011 to late December 2011
• 71.163.236.199 became active in late December 2011

There are some obvious clues such as this edit:

• http://en.wikipedia.org/enwiki/w/index.php?title=User:Luciano_di_Martino&diff=prev&oldid=430341548

Or this indicative response:

• http://en.wikipedia.org/enwiki/w/index.php?title=Talk:Giorgio_da_Sebenico&diff=462794047&oldid=462739154

Either way, whatever their IP address, from the content I've seen, there is little doubt in my mind that this is indeed the same person. Joy [shallot] (talk) 14:30, 25 January 2012 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

There is no evidence of sock puppetry, try dispute resolution. A request for comment may be the most suitable option as the main problem identified is civility and not avoidance of scrutiny. Peter E. James (talk) 02:26, 26 January 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

I'm not sure what action you would like us to take here. The account appears to have been abandoned. The first two IPs have not been used in some time. The other IPs don't appear to overlap in editing dates. So, while this may in fact be the same person, they simply appear to be editing while logged out, which is permitted. TNXMan 15:48, 25 January 2012 (UTC)

I believe they fail the following points of the policy:

• Editors who use unlinked alternative accounts, or who edit as an IP separate from their account, should carefully avoid any crossover on articles or topics
• Contributing to the same page or discussion with multiple accounts: Editors may not use more than one account to contribute to the same page or discussion in a way to suggest that they are multiple people.
• Avoiding scrutiny: Using alternative accounts that are not fully and openly disclosed to split your editing history means that other editors cannot detect patterns in your contributions.
• Editing logged out in order to mislead: Editing under multiple IP addresses may be treated the same as editing under multiple accounts where it is done deceptively or otherwise violates the above principles.

Note the above edit where one of the IPs explicitly replied negatively to my request to identify themselves as LdM, yet it's pretty clear they're the same. If that's not improper concealment, I don't know what is... --Joy [shallot] (talk) 20:08, 25 January 2012 (UTC)

• Although I suspect all IPs and the user are run by the same person, the IPs are all in the same range and are probably just dynamic IPs. Editing has not occurred simultaneously on any of them in the last six months, and the account has clearly been abandoned. Although there were probably warnable policy violations going on, at this point in time there is very little to be done on the matter. NativeForeigner ^Talk 03:23, 26 January 2012 (UTC)

---

29 January 2012

Suspected sockpuppets

• 71.178.106.120 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.

Well, just as my previous complaint was archived as obsolete and fruitless (not complaining, just saying :), in the period between 2012-01-25 and 2012-01-28, this user has conveniently changed their IP address again to help prove my point:

• Special:Contributions/71.163.236.199 ends with a flurry of blanking reverts of their talk page despite several warnings against talk page censorship listed there: User talk:71.163.236.199#Talk_page_censorship. Over there I noticed how they previously wanted to censor talk page contributions of banned/indef-blocked users. Their reverts have edit summaries where they invoke "talk page rules" - wrongly, but still. This all indicates to me we're dealing with a repeat offender who is acquainted with the workings of Wikipedia.
• Their new IP is 71.178.106.120, as evidenced by http://en.wikipedia.org/enwiki/w/index.php?title=Giorgio_da_Sebenico&diff=prev&oldid=473691463 where they repeat http://en.wikipedia.org/enwiki/w/index.php?title=Giorgio_da_Sebenico&diff=473438139&oldid=473419657

This means that the former address, 71.163.236.199, was used between 2011-12-23 and 2012-01-27, which is 35 days. The address before that one was used between 2011-10-12 and 2011-12-18, which is 67 days. Sure, this can all be the result of an accidental change by their ISP, or their modem can just so happen to lose power every time they feel like further fragmenting their contribution history. -- Joy [shallot] (talk) 12:02, 29 January 2012 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• query: >"this user has conveniently changed their IP address again to help prove my point"

Perhaps, but isn't this arguing a lack of evidence is evidence? Like the editor who argued a complete change of style indicated a sock was gaming the system? You may be right, but just sayin'… --Unicorn Tapestry ^{say} 05:18, 31 January 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

•  Clerk note: I have a feeling this editor's ISP hands out dynamic IPs. Per the findings in the previous case I'm closing with no action taken. — HelloAnnyong ^{(say whaaat?!)} 02:52, 1 February 2012 (UTC)

---

05 February 2012

Suspected sockpuppets

• Eleven Nine (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• User compare report Auto-generated every hour.

I filed Wikipedia:Arbitration/Requests/Enforcement#Luciano di Martino, where I noted:

• [...] User:Eleven Nine, which I believe to be yet another sockpuppet of the same person, added their POV back into the article claiming they were just copying it from the Simple Wikipedia - as if that is somehow a legitimate rationale for abuse. Yet, this is simply transparent - http://simple.wikipedia.org/enwiki/w/index.php?title=Giorgio_Orsini&action=history clearly lists all the same IPs used for the same abuse on the English Wikipedia.

Now that the username Eleven Nine responded to my accusation, they didn't really deny the sockpuppetry, it was more of a generic rant against Wikipedia, and one that also talked about someone called John Harnad. This gave me the second clue:

• history of John Harnad and Talk:John Harnad has a bunch of edit-warring and ranting in the same style from 71.163.236.199, another one of the IP sock puppets I already reported here.

It seems to me we have enough circumstantial evidence here for me to legitimately request that someone check the logs if there these are in fact the same person. IOW has this "Eleven Nine" edited from the same IPs as "Luciano di Martino" &co.? I'm pasting the complete list from the archive again:

• 71.178.115.169
• 71.163.229.6
• 71.191.19.40
• 71.163.236.199
• 71.178.106.120

I also mentioned User:Davide41 as suspicious in my AE request, but there the correlation in contributions isn't immediately clear (at least I haven't researched it enough to be more sure). If you have some extra time and believe my hunch, maybe that should be checked, too; but I'll certainly understand if this is deemed too invasive a search at this point. --Joy [shallot] (talk) 22:48, 5 February 2012 (UTC) Joy [shallot] (talk) 22:48, 5 February 2012 (UTC)

I'm not sure of your definition of 'stale' - the account Eleven Nine was active since 11 July 2011, which overlaps with most if not all of the anonymous activity periods. --Joy [shallot] (talk) 09:01, 6 February 2012 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

•  Clerk declined - Luciano is stale, and there's no other non-stale accounts to connect to. This will have to be determined by behavior. — HelloAnnyong ^{(say whaaat?!)} 03:06, 6 February 2012 (UTC)
•  Administrator note I'm convinced. Both blocked and tagged. T. Canens (talk) 04:39, 6 February 2012 (UTC)

---

06 February 2012

Suspected sockpuppets

• Don Luca Brazzi (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• User compare report Auto-generated every hour.

This doesn't really matter these days because both accounts are already indefinitely blocked, but I wanted to mention:

• Giorgio da Sebenico: Revision as of 00:30, 31 October 2008 Don Luca Brazzi (→Name: Unreliable surces removed)
• Giorgio da Sebenico: Revision as of 01:00, 7 May 2011 Luciano di Martino (→Name: Unreliable sources removed)

The pattern of all other contributions seems to generally fit, too - fascism, Italy, Croatia, etc. If I'm right, this seems to point to a pattern of sockpuppet behavior spanning well over three years. -- Joy [shallot] (talk) 20:08, 6 February 2012 (UTC)

When I read up more about this user, I saw him implicated in User:Velebit's shenanigans, but never confirmed. I read some of the older history of the latter and their writing style doesn't seem to be overly similar, though it looks like the same ISP/region was used. Does anyone see any more concrete clues? If not, I guess this can be summarily closed. --Joy [shallot] (talk) 22:20, 6 February 2012 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

• So closing. — HelloAnnyong ^{(say whaaat?!)} 04:47, 7 February 2012 (UTC)

---