Wikipedia:Sockpuppet investigations/Jermboy27

Jermboy27

Jermboy27 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Populated account categories: confirmed · suspected

For archived investigations, see Wikipedia:Sockpuppet investigations/Jermboy27/Archive.

A long-term abuse case exists at Wikipedia:Long-term abuse/Jermboy27.

07 July 2023

– A checkuser has completed a check on relevant users in this case, and it is now awaiting administration and close.

Suspected sockpuppets

• Goadinaloafofbread (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Same exclusive focus on signs--e.g., Road signs in Chile (Marioman26, RonaldMcmanners, Goadinaloafofbread); Draft:Comparison of Asian road signs (Jermboy27altsmustdie, Jquann1998, Goadinaloafofbread); etc. And, of course, confirmed on Commons--check requested here for sleepers/assist G5. Эlcobbola _talk 19:19, 7 July 2023 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

@Bbb23: who has helped block previous socks. Эlcobbola _talk 19:20, 7 July 2023 (UTC)

@Courcelles:: FWIW, Jermboy27 nearly always uses a proxy, and it is not uncommon to see other bad-actors in the ranges (they are, after all, there for the same reason.) If you're not familiar with it, bullseye.toolforge.org is an excellent tool for IP information, including whether it's a known proxy. Эlcobbola _talk 21:51, 7 July 2023 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

•  Confirmed but you knew that already. The only previously unblocked/locked account I see is NGC 5139 GDPR 53 (talk⁺ · contribs · deleted contribs · tag · block user · block log · CheckUser). Courcelles (talk) 19:25, 7 July 2023 (UTC)

• @Courcelles: I'm confused. Isn't NGC 5139 GDPR 53 a sock of another master?--Bbb23 (talk) 20:01, 7 July 2023 (UTC)

  @Bbb23, They match perfectly to accounts tagged as this master as well as one tagged to Join Instagram at Under 13 (talk⁺ · contribs · deleted contribs · tag · block user · block log · CheckUser) Courcelles (talk) 20:05, 7 July 2023 (UTC)

  There also the previously blocked, but untagged 74-year-old juvenile criminal (talk⁺ · contribs · deleted contribs · tag · block user · block log · CheckUser) that should likely be included in the lock request. Courcelles (talk) 20:08, 7 July 2023 (UTC)

  @Courcelles: See Category:Wikipedia sockpuppets of CD -32 9396SSE + the history of HD 224693 going back years. These are all Jermboy??--Bbb23 (talk) 20:11, 7 July 2023 (UTC)

  @Bbb23, Let’s see if I can explain. Goadinaloafofbread matches self admitted Jermboy sock Creamatedinstants and the tagged RonaldMcmanners. They also directly match the NGC sock I named above, the 74 year old criminal account, 15-year-old girl from Norway and a bunch of other tagged Jermboy socks. Now, working the NGC sock alone, it matches SCR 1845-6357. SCR is tagged on its talk page as User:Join Instagram at Under 13, which has its own Category:Suspected Wikipedia sockpuppets of Join Instagram at Under 13 as well as being tagged itself as a sock of CD -32 9396SSE. It’s a mess, but technically, they’re the same in current socks. Courcelles (talk) 20:24, 7 July 2023 (UTC)

  @Courcelles: Sorry to be so insistent, but is there any behavioral connection between the NGC socks and Jermboy? I've looked back at the archives and can't find anything. Plus, there have been a ton of checks in this case - why did you make the connection now? Is it possible that other CUs have also noticed it but ruled it out behaviorally? Sorry again, but I can't wrap my head around it. I of course can't see the technical details, so I don't know whether the exact same IPs are being used or ranges of the same IPs or just geolocations; nor can I see how distinctive the UAs are.--Bbb23 (talk) 20:33, 7 July 2023 (UTC)

  @Bbb23 I’m an idiot. They overlap on the exact same IP and very close/version progressive UAs… but more digging indicates that IP is a likely proxy. So you can just ignore everything I said and assume they are indeed two separate sockpuppeteers. Courcelles (talk) 20:39, 7 July 2023 (UTC)

  @Courcelles: Doesn't sound like you're an idiot if you had to dig to figure out the IP was a proxy. Obvious proxies are easy, but I've always found it hard to identify less obvious ones. Anyway, I've always been told (sometimes not to my liking) that behavior is the touchstone of confirming accounts and that technical data cannot trump behavior. In some instances, that's false (in my view), but not in this one (at least for me). Thanks for digging.--Bbb23 (talk) 20:52, 7 July 2023 (UTC)

---