User talk:Berean Hunter

⋙–Berean–Hunter—► ((⊕))

@This user can be reached by email.

SPI (as usual)

Looking back at Wikipedia:Sockpuppet investigations/GoguryeoHistorian, I strongly suspect there might be an older master. However, since I haven't extensively dealt with ethno-nationalist sockmasters, I was curious if you might have an idea. Thanks, GAB^gab 16:40, 21 October 2017 (UTC)

• Satoshi Kondo (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki) is  Technically indistinguishable to GoguryeoHistorian

 Technically indistinguishable to WorldCreaterFighter are:

• Verakhu (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• OrenburgNative (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• MasterChai (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• PeopleTaking11 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• WayneMacleod1 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• DrKoraKora (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)

 Likely to WCF:

• Lynch Kevin de León (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)

GoguryeoHistorian  Confirmed to WorldCreaterFighter who shares many of the same target articles and on the same IPs that geolocate to the same place and are not proxies. GAB, you may want to broaden that rangeblock. Look through full range to identify other addresses not blocked. Akocsg's case should be merged with these. Also, I believe that some thought should go into Kumasojin 熊襲 that may be related and I'm fairly sure that NonoHIDE98 = WorldCreaterFighter.
 — Berean Hunter (talk) 19:08, 21 October 2017 (UTC)

Thank you so much... this may get messy. I've indeffed and tagged Satoshi Kondo, GoguryeoHistorian, Verakhu et al., and tagged Lynch Kevin de León. TheKumasojin 熊襲 IP looks to be in a different location, but not that far away, geographically speaking. However, NonoHIDE98 is clearly related. GAB^gab 19:22, 21 October 2017 (UTC)

GAB, the CU tool indicates that Lynch Kevin de León (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki) is "(Globally Locked)" but I'm not finding this at meta and I also looked within the edit view in case this was listed as hidden prior to locking. I can't find it and it doesn't show up here in the contribs view the way that it normally would. DoRD can you point to where this was locked? This may tie in other accounts.
 — Berean Hunter (talk) 19:51, 21 October 2017 (UTC)

Note the lack of a global account for that account. That means that a steward did the global version of block/suppress, so even OSers can't see the details. CU can still see the local account, but if you want details about the lock, you'll need to find a steward or ask on the CU list. ​—DoRD (talk)​ 20:15, 21 October 2017 (UTC)

GAB, neither of those cases rings a bell with me (unless I'm missing something...?) ​—DoRD (talk)​ 20:20, 21 October 2017 (UTC)

Thank you DoRD, I have posted for the stewards here.
 — Berean Hunter (talk) 20:49, 21 October 2017 (UTC)

Oh, geez... and it looks like NonoHIDE98 is older than WCF. (Is it possible to just hist-merge SPI archives?) GAB^gab 18:20, 27 October 2017 (UTC)

Given how long he has been known as WCF, I would leave it under that name, GAB.
 — Berean Hunter (talk) 22:12, 27 October 2017 (UTC)

Yeah, that was my inclination, too - just wanted to double-check. GAB^gab 22:13, 27 October 2017 (UTC)

I'm going to go ahead and make these merges - how would I go about merging archives without it turning into a huge mess? Thanks, GAB^gab 17:41, 3 November 2017 (UTC)

You already appear to have merged GoguryeoHistorian into WCF and there is no archive for GoguryeoHistorian so that part looks finished, GAB. It looks like you could close the case, someone archive it, and then do a normal histmerge. Be sure to have everything copied for backup first, I like to copy paste all of the text into an editor to preserve it if all else fails. I have many open tabs during that process and it helps to have the histories of the main case pages open as well as their archives so that you can compare at the end of the process.
 — Berean Hunter (talk) 18:57, 3 November 2017 (UTC)

University College London Ban

Hello, Berean Hunter!

I'm a first-year history student at the University College London. To my dismay, I've recently discovered that the entire school's IP is blocked from editing Wiki.

As someone who has noticed repeated errors in information and lax writing on many pages relating to Ancient Rome and the Social War, it pains me that I cannot do my part to edit them.

My purpose in writing is two-fold. I'd like to this school-wide ban to be repealed and I'd like to inquire as to what presumably egregious offence was committed on the part of this school to warrant such a blanket punishment.

I look forward to your reply!

Best regards,

JoshLyman — Preceding unsigned comment added by JoshLyman (talk • contribs) 19:30, October 28, 2017 (UTC)

You'll be happy to know that now that you have an account, JoshLyman, that you will be able to edit from the University while logged in. That solves your problem and the same applies for anyone else at the University. The reason why it was blocked was to prevent long term abuse which had been happening for some time and the officials at the school are aware of the situation.

Welcome to Wikipedia.
 — Berean Hunter (talk) 20:12, 28 October 2017 (UTC)

• Don't they need to apply for an IP block exemption if they want to edit Wikipedia from the Uni network? Kudpung กุดผึ้ง (talk) 03:03, 31 October 2017 (UTC)

• Kudpung กุดผึ้ง, it is an anonblock. Remember that he was primarily editing as an IP. I don't remember him using an account on that range.
   — Berean Hunter (talk) 03:16, 31 October 2017 (UTC)

OK. Kudpung กุดผึ้ง (talk) 03:23, 31 October 2017 (UTC)

Sockpuppet JournalmanManila reappear

Hi @Berean Hunter:, remember JournalmanManila and his sockpuppets, I think s/he reappeared again as user:Skyrim9 and user:Reign05. While user:Pricedelink and user:Keroscene777 are possibly also another sockpuppets although I'm not quite sure. His insistence on Philippines inclusion on Hindu-Buddhist articles such as Ramayana and breaking WP:3RR (although he wait for 24 hours) here is kind of reminiscence of what JournalmaManila would do. Thank you in advance. Gunkarta  talk  10:01, 1 November 2017 (UTC)

Gunkarta, please file this in an SPI report. It is better to keep all of these details in the reports for future reference. Place make sure to supply some diffs as evidence. I've only got a few moments of time right now and others may get to it first.
 — Berean Hunter (talk) 22:48, 1 November 2017 (UTC)

I'm curious how you spot sockpuppets

An experienced editor seeking UPE sockpuppets

Is it mostly an automated process or what? Is there some explainer available? I'm intrigued by how you all managed to find close to a dozen sockpuppets in this investigation[1]. Snooganssnoogans (talk) 22:42, 1 November 2017 (UTC)

Will try to respond later if other talk page stalkers haven't covered it first.
 — Berean Hunter (talk) 22:50, 1 November 2017 (UTC)

Some experience with dowsing helps. Also once one sees many signs of PR in the same article or related articles, one has a good clue where to start looking. Sometimes technical evidence like editing from one or more proxies can indicate it, but usually it's the other way around -- content leads to the socks. Some of this is also covered in Wikipedia:Signs of sock puppetry. Precocious edits might be one of the strongest signs especially with somewhat experienced sockfarms engaged in UPE, but not yet experienced enough to cover their tracks well. They are under the gun for time (time=money for these operators) and take shortcuts in the process of establishing a plausible edit history for a sock. IMO a tiny minority of sockers have managed to pull off a "long game", but you do see several in the WP:LTA index. ☆ Bri (talk) 00:03, 2 November 2017 (UTC)

In addition to what Bri has said, the checkuser tool helped in this case. It doesn't in every case, though. I don't know if you have noticed, but the sockmaster in that case, logged into every single one of those accounts the day after I blocked them and blanked the notices one after another. That is good behavioral confirmation.

<Now, for the not-so-serious; in his best Blackadder voice>

• Well...I'll have you know that contrary to popular belief,  CheckUser really is magic pixie dust and only available in really small tins with a no money back guarantee and for a limited time and with limited availability, I'm afraid. It helps if you know where to steal find it. The Wiki Magick Foundation has generously supplied the inquisitors with a private stash so that the headsmen shall have job security.

• If dowsing doesn't work then perhaps dunking will. Our minions in the dungeon have been hard at work to possibly bring back a few oldies but goodies, however the tapes were leaked and the secret experiments have been exposed. Seen here for the first time, two such experiments that grew out of discussions from the Village Pump. Just look at those admins enjoying their work. I think that's Kudpung in the green shirt pulling the sock's rope...yes, I'm quite certain that's him. Ye Olde Sock of Baldrick...Exposed (occurs at 39:30 onward). Ooh, now that's fun....rewind. I can watch that over and over again....almost as good as the real thing. Of course, we still have the traditional ways of dealing with socks.

• I believe they were trying to have this ready for trials on this year's ArbCom candidates but now, with all the scandal, we'll have to come up with something else dastardly to throw at them. We shall have to consult with the angry villagers to see what ideas they may have. Their involvement has been known to bring great pleasure and joy...and perhaps they can tell us where all the bloody socks have gone.

</Sir Cotton Mather Blackadder>
 — Berean Hunter (talk) 00:21, 4 November 2017 (UTC)

Shivamevolution

Hey Berean Hunter,

This appears to be a sock from the Shivamevolution group, is editing other unprotected pages now (I semi'd some of the earlier targets), but with the same Hindi poetry focus, and the two articles have a history of paid COI editing too, and should likely go to AfD again (one was deleted at AfD and then DRV permitted re-creation with an option to AfD again). Likewise this ip too. Since the SPI is still awaiting a clerk after CU action, I'm not adding it there but bringing directly to you to see if you can do something. Sitush is away I think, if not, he may have something to say. Could you take a look please? cheers. —SpacemanSpiff 12:40, 3 November 2017 (UTC)

• N1197L is  Possible because they geolocate to the exact same area but have different UAs. SpacemanSpiff, you may want to get that into the report and then it may be decided based on behavior.
   — Berean Hunter (talk) 18:40, 3 November 2017 (UTC)

range block - expansion needed?

A few days ago you had done a range block on user:172.56.0.0/16. It appears the user is evading the block (see The Great Indoors (TV series) (edit | talk | history | protect | delete | links | watch | logs | views).

I've been doing individual blocks for block evasion; but I was wondering if you had notes that may help in expanding the range block, or identifying a secondary range. --- Barek (talk • contribs) - 00:29, 4 November 2017 (UTC)

• Barek,
• Editor 1

Affected Articles:

• Female
• AT&T Mobility
• Danitra Vance
• Kate McKinnon
• The Great Indoors (TV series)
• Slender Man stabbing
• Linda Perry
• Sara Gilbert

• All of the above done with a very distinct UA within the two ranges making these an exact match. Semi-protection as opposed to rangeblocks may be the way to go. Ranges are busy and took a while to consider. There are multiple known sockmasters including three different LTAs operating but not enough to justify anon rangeblocking based on what I see.

• Editor 2 that left a note on Ad Orientem's talk is
• 172.56.36.39 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser (log))
• 172.56.37.119 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser (log)) (on both days)

...and an exact UA match to 172.56.3.115 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser (log)) that edited Acquaintance rape. This is a perfect match to this banned user's UA used by Smooth alligator on Aug. 18. Note that this relates to this banned user but also I'll say that this user which is also banned is likely the same based on behavior. I'm not alone in making that conclusion as it is shared by some at the WMF office. This banned user no longer receives a reasonable expectation of privacy here due to abuse.

• Editors 1 and 2 are using different devices so any comparison there must be based on behavior. Both editors are found in both the 172.56.0.0/16 and the 172.58.0.0/16 ranges.

• Pinging Flyer22 Reborn who should be aware of the banned editor here.
   — Berean Hunter (talk) 12:24, 4 November 2017 (UTC)
• Hi Berean Hunter, could you do a check user on user:Regiis Rosis? This is a new account who suddenly showed up on my talk page to discuss issues involving monarchism. They seem to have a remarkably good grasp of wiki editing. And their user page seems to use language similar to my own. None of which by itself would disturb me. But as noted above I recently had to block some IPs of Smooth alligator, who was a sock of Sarsaparilla. Smooth had a strong interest in neoreactionary subjects and I think they saw me as a kindred spirit. It's entirely possible that I am just being paranoid and that maybe I am not the only monarchist on here. But my sock detector is flashing a warning signal. -Ad Orientem (talk) 18:38, 4 November 2017 (UTC)

• Ad Orientem, your sock detector is working well.  Confirmed as they are using a phone on the exact same ranges as Sarsaparilla socks.
   — Berean Hunter (talk) 19:09, 4 November 2017 (UTC)

For clarity, "they are using a phone on the exact same ranges as Sarsaparilla socks" should read "they are using a phone (different UA) on the exact same ISP and similar ranges that geolocate to the same region as Sarsaparilla socks." zzuuzz, would you please take a look for a second opinion? Cheers,
 — Berean Hunter (talk) 00:21, 5 November 2017 (UTC)

OK, if you like. I'd almost forgotten how much I dislike that T-Mobile range. First, I'm not familiar with either of these users. I'd probably have to do a lot of trawling to catch up on the second user here, however, at this point I'd agree with your latter statement. I'm not seeing the smoking gun. Apparently an email has been sent, which sounds intriguing. I'd also point to the UA and IP editing history, which seems quite consistent and would probably have drawn attention sometime. -- zzuuzz ^(talk) 06:57, 5 November 2017 (UTC)

• Ah. Sad but not surprising. On a side note I am wondering if the blocked user:PerfectlyIrrational that I ran across when tagging a template (Template:Southern nationalism sidebar) created by one of their socks (user:DrawingLol) for CSD might not also be Sarsaparilla? These accounts are already blocked but as they appear to have the same areas of interest perhaps they are all one in the same and should be reclassified as such. -Ad Orientem (talk) 19:30, 4 November 2017 (UTC)

• Hi. (@Barek:). Just a random comment about these ranges. They're huge ranges with lots of good faith editors on them, and also more than a few banned editors also on them (in addition to any mentioned so far). Any /16 block is going to hit a lot of collateral and templated reasons are really helpful. What I've found is that users will usually be assigned to two /23 ranges, one in 172.56 and one in 172.58. Then there are the IPv6 ranges, and typically one or two IPs in 208.54/17. The assignments often last a couple of weeks. -- zzuuzz ^(talk) 18:56, 4 November 2017 (UTC)

• Thanks for the ping, Berean Hunter, and for your work on these cases. Flyer22 Reborn (talk) 23:19, 4 November 2017 (UTC)

Wikipedia:Sockpuppet investigations/Mkd07/Archive

Back?[2] It certainly isn't a source we should be using.[3][4] Doug Weller talk 09:57, 4 November 2017 (UTC)

Doug Weller, that is a perfect duck based on behavior.

• The en.wiki links are:

• historyofmacedonia.wordpress.com (*|search current)
• macedoniantruth.org (*|search current)

...which shows use of one of them in Marsyas of Pella. Also see spam report 1 and spam report 2 for reference.
 — Berean Hunter (talk) 19:22, 4 November 2017 (UTC)

Thanks. So who should do the honors? I'm about to go watch tv with my wife and probably wouldn't be able to do it until tomorrow, although I may do some editing on my iPad while watching tv. Doug Weller talk 19:29, 4 November 2017 (UTC)

Blocking or filing the case? I can round back to this sometime today...football game starting and prepping a stew in the kitchen.
 — Berean Hunter (talk) 19:42, 4 November 2017 (UTC)

•  Done Case filed and sock blocked.
   — Berean Hunter (talk) 00:30, 5 November 2017 (UTC)
  • Thanks. Doug Weller talk 20:00, 5 November 2017 (UTC)

You've got mail

Hello, Berean Hunter. Please check your email; you've got mail!
It may take a few minutes from the time the email is sent for it to show up in your inbox. You can at any time by removing the {{You've got mail}} or {{ygm}} template. Ad Orientem (talk) 20:39, 4 November 2017 (UTC)

Will be emailing you about a sock matter

I will send you an email about this because, although I have identified the sock on Wikipedia in subtle ways, this is better discussed off Wikipedia due to the sock's cues I'm familiar with and due to "you can't accuse without evidence" drama. Flyer22 Reborn (talk) 20:38, 6 November 2017 (UTC)

If you didn't get the notification that I emailed you, I just did. Flyer22 Reborn (talk) 21:48, 6 November 2017 (UTC)

Update: As you can see on my talk page, I've asked others about this matter as well. Flyer22 Reborn (talk) 16:30, 7 November 2017 (UTC)

Minor detail regarding something you said technically…

FYI It is possible to be logged into Wikipedia on multiple accounts in the same web browser and certainly on the same OS. For instance I run this account on standard Safari 10.1.2, and have had at the same time my vaild alts Lord High Permanent Senior Undersectretary to L3X1 and Hypn0toad logged in 2 separate tags in a Private Window (Apple-equivalent on Chrome's Incognito, which works a bit differently). If I had the accounts and the motive I could run up to 5 accounts at the same time. And regarding what happened, even though I am disappointed, I want to say Thank You for doing what is right. Thanks, L3X1 (distænt write) 01:56, 7 November 2017 (UTC)

L3X1, help me out and link to whatever you are referring to please. I've stopped one big case to work on two others and been searching ranges for too long. :)
 — Berean Hunter (talk) 02:38, 7 November 2017 (UTC)

Dr Strauss's recent deceptions. Sorry about that. L3X1 (distænt write) 02:42, 7 November 2017 (UTC)

You're welcome. Concurrent editing with invalid alts would be much the same as logging in/logging out to avoid scrutiny. I do understand what you mean, though.
 — Berean Hunter (talk) 02:56, 7 November 2017 (UTC)

The Bugle: Issue CXXXIX, November 2017

Your Military History Newsletter Project news: From the editors; awards and honours; contest results Articles: Last month's new featured and A-class content Book review: Recent external reviews Op-ed: TomStar81 on late 1917 naval warfare Timeline: This month in World War I

The Bugle is published by the Military history WikiProject. To receive it on your talk page, please join the project or sign up here.
If you are a project member who does not want delivery, please remove your name from this page. Your editors, Ian Rose (talk) and Nick-D (talk) 13:29, 7 November 2017 (UTC)

Are you familiar...

@
 — Berean Hunter (talk) I was browsing through Wikipedia and looking through old user's records, and I came across "The Wolf Child". I saw that you and that user have had an incident in the past, and thought maybe you might hold light on the matter. On the user's talk page I described that I sometimes looked into user's history for entertaining conflicts, and came across one with her and maybe the user remembered it. I was responded to with a strange and extremely unfriendly response-

"I don't know you. I'm not interested in getting to know you. This nonsense of yours has nothing to do with building or maintaining an encyclopeadia. Find a cure a for boredom elsewhere. This should be our last interaction on this matter. Please stay off my talk page. Thank you and have a nice day."

Are a lot of people on the encyclopedia like this? Should I not be interacting with other users? Do you remember a past with this user? I was just appalled by the lack of assuming good faith and almost rudeness. (find the incident here- User talk:Citationhelper)

Citationhelper ^(talk) 02:11, 9 November 2017 (UTC)