Wikipedia:Sockpuppet investigations/Sonic2030/Archive

Sonic2030

Sonic2030 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

17 December 2012

Suspected sockpuppets

• 96.54.183.71 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

New-ish user Sonic2030 (who seems to have pretty good Wiki knowledge, considering his sign-up date) has made a substantial portion of his short career Special:Contributions/Sonic2030 about un-doing my edits. He seems particularly interested in edits that air LGBT grievances against The Salvation Army.

Today, after racking up 3 reverts, he was given a 3RR "Stop Sign" warning for his activities at that article.[1]

Almost immediately thereafter, previously unseen and unknown IP 96.54.183.71 arrives and begins to repeat some of the same edits that Sonic has been reverting. Belchfire-TALK 22:53, 17 December 2012 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

•  Clerk declined - No need for CU, fairly obvious. Blocked. (X! · talk)  · @007  ·  23:10, 17 December 2012 (UTC)

---

19 December 2012

Suspected sockpuppets

• HelferLad (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• 96.54.183.71 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

This is a continuation of a case from yesterday (Wikipedia:Sockpuppet_investigations/Sonic2030/Archive) wherein sockmaster Sonic2030 was blocked, and then had his block extended for his behavior afterward.

In the initial case, it appeared he had logged out in order to continue an edit war at The Salvation Army. Along the way, we learned that the IP originated from Canada.[2]

The newest sock returned immediately to Salvation Army within one minute of account creation and repeated the same edits as before, [3] then proceeded to display an interest in hockey [4]. (Yeah, I know... stereotypes are bad. But SHEESH!) It seems fairly obvious that "HelferLad" is also the IP, and it was also obvious that the IP was "Sonic2030". Thus, the commutative law says they are all the same person. Belchfire-TALK 00:28, 19 December 2012 (UTC) Belchfire-TALK 00:28, 19 December 2012 (UTC)

• Addendum In light of the new information brought forward by the CheckUser, I'm going to suggest/request that we take a look at the following IPs. These are US Federal Government IPs originating at the Department of Homeland Security. The IP-hopping user who edits from this range is especially obnoxious and has a long term pattern of stalking my edits and editing tendentiously:

• 216.81.94.68 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

See: [5][6][]

• 216.81.94.69 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

See: [7]

• 216.81.94.70 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

See: [8][9]

• 216.81.94.71 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 216.81.94.72 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

See: [10][11]

• 216.81.94.73 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

See: [12][13][14][15][16][17]

• 216.81.94.75 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 216.81.94.76 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 216.81.94.77 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

See: [18][19][20]

• 216.81.94.78 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 216.81.81.80 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

See: [21]

• 216.81.81.81 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 216.81.81.82 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 216.81.81.83 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

See: [22][23][24]

• 216.81.81.84 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 216.81.81.85 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

The pattern of behavior seen from this list of IPs fits well with the pattern seen from the list of socks below. If it's the same person, hopefully we can block the entire range and lodge a complaint with the government. Belchfire-TALK 01:26, 21 December 2012 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

• CheckUser requested - Self-endorsed by clerk for checkuser attention - I think there's enough to link the two registered accounts. CU would be helpful. Basalisk ^{inspect damage}⁄_berate 19:23, 20 December 2012 (UTC)
• I don't see behavoir alone being enough for a block, so I ran the check.  Inconclusive though there is some evidence leaning towards this being him, proxies are being used. Take that as you will, but he's now indef'd. -- DQ (ʞlɐʇ) 19:37, 20 December 2012 (UTC)
• Thanks for the check. Closing. Basalisk ^{inspect damage}⁄_berate 19:39, 20 December 2012 (UTC)
• I found some additional data,  Confirmed:

• UKrOGERS (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• JimEdgers (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• KillAgo (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• JoseGoGo (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Jeronme (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Several IPs belonging to webhosts, mostly blocked as open proxies already.

• {{onhold}} There could be someone else behind this bunch, so i'm holding off on closing this. -- DQ (ʞlɐʇ) 22:53, 20 December 2012 (UTC)

• So I actually have nothing more, I do note that one of these socks has a sock tag for Marlin1975. -- DQ (ʞlɐʇ) 02:51, 21 December 2012 (UTC)

•  Administrator note All accounts and IPs that can be blocked, have been blocked, this is only awaiting clerk tagging now. -- DQ (ʞlɐʇ) 03:24, 21 December 2012 (UTC)
• I've tagged the named accounts and one IP. There's nothing else to be done here. Closing. Basalisk ^{inspect damage}⁄_berate 11:12, 21 December 2012 (UTC)

---