Wikipedia:Sockpuppet investigations/Coat of Many Colours/Archive

Coat of Many Colours

Coat of Many Colours (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

24 October 2014

Suspected sockpuppets

• Marinka van Dam (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• A Sextet Short of PG(2,57) (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Anthony McDiarmid (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• User compare report Auto-generated every hour.
• Editor interaction utility

Behavioral evidence is clear enough, as far as I'm concerned; I'll ask Crisco 1492 to contribute some technical details about technical details.

In short, Coat was blocked for three months on 15 October, after disrupting various processes including FP, and for harassing Crisco and Hafspajen. Well, that's sort of my reading: the close by Euryalus of an ANI thread cited battleground mentality and disruption, here. Note also that Euryalus doubted that Coat was a new account.

Well, here we are, with a new editor, whose account was begun on 15 October, and whose first edits pertain to the sex industry in Indonesia--nothing special until you see that Coat started accusing Crisco, an editor who lives in Indonesia, of attempting to redeem the reputation of a supposed pedophile via the FP process. Note that Marinka then jumps right into the FP process, which was Coat's favorite area as well, but I will let Crisco speak, if necessary, to the comparisons between the two editors, and I'll let him collect some diffs as well, for your viewing pleasure.

One more thing: I would like CU run. It may not provide conclusive evidence; Coat already indicated traveling. They used some IPs as well; I do not have those details at my disposal right now, but I think one IP's edit is linked on Coat's talk page. Drmies (talk) 00:42, 24 October 2014 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Another one: User:64.9.157.141 all but identifies themselves at [1]; they also edited at [2]. Seriously, they've gone from a three-month block to indef, what next? IP blocks? Adam Cuerden ^(talk) 09:26, 27 October 2014 (UTC)

Blocked for a while. Will wait and see if a static IP. -- Euryalus (talk) 09:40, 27 October 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 Clerk endorsed. Marisa's primary focuses are pedophilia in Indonesia (Crisco is from Indonesia) and WP:FPC (she is commenting/voting on a lot of candidates). She's obviously not a new editor. After being blocked, Coat said they (she?) would not be returning. On that same day, Marinka started an account. Coat was not blocked on October 15 (Drmies's error) but on October 5. However, she made contributions post-block through October 15 (last edit: [3]).--Bbb23 (talk) 01:39, 24 October 2014 (UTC)

• Marinka van Dam (talk · contribs) is  Likely a sock of Coat of Many Colours.--Jezebel's Ponyo^{bons mots} 22:15, 24 October 2014 (UTC)
  • Thank you Ponyo. I have blocked Marinka van Dam indefinitely. I will leave it to you, or to Bbb23, or to Euryalus, to decide what to do with the block on Coat. Thanks, Drmies (talk) 23:26, 24 October 2014 (UTC)
    • Thank you. — Crisco 1492 (talk) 23:31, 24 October 2014 (UTC)
      • I've added three more months to Coat's block, meaning the entire block from the date of the original block is 6 months. If there's more socking, the block of the master will become indefinite.--Bbb23 (talk) 23:34, 24 October 2014 (UTC)
        • Beat me to it, thanks Bbb23. Apologies to Drmies for the delay in posting the SPi. -- Euryalus (talk) 02:10, 25 October 2014 (UTC)
          • No apology necessary, Euryalus; these cases are difficult and we all have day jobs. I appreciate your help. Drmies (talk) 02:16, 25 October 2014 (UTC)
• Euryalus, Bbb23, Ponyo--please see the totally duck-like contributions of User:A Sextet Short of PG(2,57). This is turning into quite a sock farm. Drmies (talk) 13:31, 26 October 2014 (UTC)

• Just before Drmies came back here, I responded to a comment from Crisco 1492 on my talk page here. Although the requested diffs would be nice, I'm endorsing a CU as I think there's enough for it even without the diffs and because it should be fairly simple.--Bbb23 (talk) 13:36, 26 October 2014 (UTC)
  • Agreed. I have stepped away from the keyboard (nearly 1am here) but a review of contributions, writing style, editing interests and of course sudden re-emergence, are enough to point very strongly at this being another sock, even without CU. -- Euryalus (talk) 13:42, 26 October 2014 (UTC)
    • Diffs at Bbb23's talk page. — Crisco 1492 (talk) 13:53, 26 October 2014 (UTC)

 Clerk note: Based on the outstanding diffs left by Crisco, I've indeffed and tagged Sextet based on duck. I'll leave the endorse, and the CU may either run the CU for confirmation or, if they prefer, decline it. I should note that Marinka, in their last post on their talk page post-block, threatened to continue socking with a work account here.--Bbb23 (talk) 14:26, 26 October 2014 (UTC)

• Right on--thanks everyone. Allow me to ping Ponyo one more time, just so I know that they know that I know that they know, you know? Drmies (talk) 15:34, 26 October 2014 (UTC)

Oh, Drmies, I know. Coat of Many Colours has a fondness for attempting to obfuscate their location, and with so few edits there isn't much to go on here. The behavioural evidence is there and if nothing else the CU allows us to stick a cork in some dodgy IPs. --Jezebel's Ponyo^{bons mots} 16:34, 26 October 2014 (UTC)

• And apparently obfuscating = changing their location every few minutes... — Crisco 1492 (talk) 16:40, 26 October 2014 (UTC)

(edit conflict) @Ponyo: At the risk of pinging you to death (), does this mean we're done and I should close this report again?--Bbb23 (talk) 16:42, 26 October 2014 (UTC)

You can ping me anytime Bbb23. I don't think there's anything more to do here, so ok to close.--Jezebel's Ponyo^{bons mots} 17:04, 26 October 2014 (UTC)

• Thanks to Hafspajen's reminder on my talk page of my earlier comment here, I've indeffed and tagged the master based on the new socking. It's comforting to know that someone reads what I write.--Bbb23 (talk) 19:24, 26 October 2014 (UTC)

• Perhaps its not time to close yet: 2 edits, one to a museum on August 6 (a time when COMC was supposed to be "travelling") and one to FPC just today, after the most recent sock was blocked. — Crisco 1492 (talk) 02:57, 27 October 2014 (UTC)

• The timing is obviously suspicious, but it's hard to block on two edits that aren't an absolute slam dunk. @Ponyo: I don't suppose requesting a CU will do any good?--Bbb23 (talk) 04:46, 27 October 2014 (UTC)

• Indeed. If timing were less suspicious I wouldn't mention it, but... — Crisco 1492 (talk) 11:02, 27 October 2014 (UTC)

• @Bbb23:, geolocation is off (which, due to CoMC's talk of travel and use of webhost/proxies, means little), but the UA is an exact match to Marinka van Dam's from the same time period. --Jezebel's Ponyo^{bons mots} 16:12, 27 October 2014 (UTC)

• That helps enormously, thanks. I've indeffed and tagged the new puppet. I've also adjusted the tags on a few of the puppets to make the tagging consistent with the CU findings. Everything is now "suspected"; before some were confirmed, and some were not, and my read of Ponyo's findings is that nothing is actually "confirmed", particularly to the master. It may be a technicality, but it seems important to me. As soon as I finish this comment, I will close the case for the 99th time. If Crisco 1492 will take a short break, we might be able to archive this before he finds another. He would then have to start a new case. :-) --Bbb23 (talk) 23:45, 27 October 2014 (UTC)

• I would if they'd stop coming looking for me. — Crisco 1492 (talk) 23:48, 27 October 2014 (UTC)
  • You're correct - the IP template should have read "suspected" and is likely pointless in any case. That's my fault for editing late at night. -- Euryalus (talk) 00:20, 28 October 2014 (UTC)
    • I know what that's like. Except in very unusual circumstances, we don't usually tag IPs at all. The block itself should be self-explanatory and sufficient for the future.--Bbb23 (talk) 05:06, 28 October 2014 (UTC)

---

14 January 2015

Suspected sockpuppets

• DUCK404 a (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• User compare report Auto-generated every hour.
• Editor interaction utility

User name indicates a familiarity with both WP:DUCK (regarding sockpuppetry) and technical matters (404 error reference); Coat has formerly shown an interest in such technical matters. Also of note is a focus on WP:FPC.  — Crisco 1492 (talk) 20:51, 14 January 2015 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

• Yeah, DUCK and 404, that's pretty funny, but it's not very conclusive evidence. The exclusive focus on FP, that's quite another thing--plus the account's disappearance is real timely. I'd still like to see CU, though... Drmies (talk) 14:58, 2 February 2015 (UTC)
• @Drmies: CU is  Inconclusive due to the extensive proxy use by CoMC. At this point there are essentially two options 1) are they DUCKy enough to block outright? or 2) wait until they eventually out themselves behaviourally or they become disruptive enough to block regardless of the possible connection. Looks like this was just a burner account that's been abandoned though. --Jezebel's Ponyo^{bons mots} 22:10, 5 February 2015 (UTC)

---

22 July 2015

Suspected sockpuppets

• C1cada (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• User compare report Auto-generated every hour.
• Editor interaction utility

It pains me to be back here again. I believe C1cada is yet another sock of Coat; I have no doubt that CU will reveal the same proxy use.

Coat had a track record of following Hafspajen around, and that's what C1cada is doing as well, with 152 edits to Houses at Auvers, an article Hafspajen started and edited extensively. In general, the interest in Van Gogh is typical for Coat and their socks. The overlap between Coat and C1cada has, of course, Van Gogh but, more significantly for those who know Coat, Revenge porn, an old favorite. Note also their edits on Paul Gauguin--Coat always had an interest in, shall we say, underage human sexuality, and it's evident here as well: here is a reference they added to that issue, and the edit beforehand has them editwarring with Modernist over using a website as a reliable source (see their condescending comments at Talk:Paul Gauguin#Blog).

There's some other behavioral evidence as well, which I will not share here, though I'll gladly post it in Marinka van Dam's thread on Wikipediocracy, haha. Other editors have noticed the similarities as well, and I'd like to know if Xanthomelanoussprog has anything to add. Drmies (talk) 02:30, 22 July 2015 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

• This CU was triggered by an off-wiki request. The master and all socks are  Stale. However, Ponyo made a finding in October 2014 that the master used proxies to hide his location. Based on that comment, I checked C1cada and found that he too used proxies. I then checked Ponyo's log from 2014 and, bless Ponyo for her organizational skills, found that the ranges used by the master and those used by C1cada were either identical or belonged to the same company. Even my knowledge of the master's behavior in comparison with C1cada's behavior made it very likely that the account was a sock. However, I asked Drmies, who is more familiar with the master's behavior, to reopen the SPI and provide behavioral evidence, which he has done. Purely technically, I think it's  Likely that C1cada is a sock of CoMC. When coupled with the behavioral evidence, it seems all but certain. I've blocked C1cada and tagged the account as  Confirmed. That's a bit of a stretch, but of the possibilities the template permits, that seemed the most accurate. Closing.--Bbb23 (talk) 22:04, 22 July 2015 (UTC)

---

03 August 2015

Suspected sockpuppets

• WinstonJunior (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• User compare report Auto-generated every hour.
• Editor interaction utility

Account comes out of the blue to follow Hafspajen editing an article on a 17th-century painting. No doubt in my mind, and I've already blocked. I'd like Ponyo and Bbb23 to look at the technical evidence--thanks. Drmies (talk) 14:06, 3 August 2015 (UTC) Drmies (talk) 14:06, 3 August 2015 (UTC)

• IP editor making personal attacks against Hafspajen here, and pretty much blatantly admit that he's a sock here. Started editing by stalking Hafspajen. At a painting article, naturally. Blocked. — Chris Woodrich (talk) 08:15, 5 August 2015 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

• WinstonJunior (talk · contribs · count) and C1cada (talk · contribs · count) are technically  Unrelated. I've put this case on hold in case Ponyo wishes to add her nickel to my two cents.--Bbb23 (talk) 00:19, 4 August 2015 (UTC)
• In comparison with previous socks, the technical data is not a match. That being said, this is a sockmaster who generally goes out of their way to switch up their "game" every once in a while to evade detection on a technical basis. It's their odious behaviour that always outs them.--Jezebel's Ponyo^{bons mots} 17:09, 5 August 2015 (UTC)
• There's no reason why WinstonJunior should be unblocked based on the lack of technical evidence. Thus, the only decision is whether to tag the account as a suspected puppet. Personally, I don't think it's necessary, particularly because we have a record here regardless of the tag. However, I'll defer the decision to Drmies and Crisco 1492. If either wants to tag, fine. Once tagged, please close the SPI. If neither wants to tag, I'd appreciate it if one of you would close the SPI. Thanks.--Bbb23 (talk) 17:29, 5 August 2015 (UTC)
• Up to you, Ponyo and Bbb. I don't much care. Drmies (talk) 17:32, 5 August 2015 (UTC)
• Looks like we're done, no tagging. Closing. Bbb23 (talk) 14:08, 6 August 2015 (UTC)

---

11 August 2015

Suspected sockpuppets

• Ayesha23 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• User compare report Auto-generated every hour.
• Editor interaction utility

We are convinced that this is yet another sock of Coat, who likes to pride themselves on speaking in the plural and having lots of legitimate accounts. This account is a longtime sleeper which became active a few days after the last Coat sock got blocked and, guess what, got involved with FP nominations, arguing against Hafspajen. We blocked it as a duck, given the obvious quacking. Drmies (talk) 22:47, 11 August 2015 (UTC)

• Second behavior issues. There's also a stalking of the user Stephan in the past, similar to Coat. — Chris Woodrich (talk) 00:03, 12 August 2015 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

• Already blocked, and now tagged as a suspect. Closing the case. Vanjagenije (talk) 16:20, 12 August 2015 (UTC)
• The technical evidence also dovetails with the behavioural similarities.--Jezebel's Ponyo^{bons mots} 21:25, 12 August 2015 (UTC)

---