Wikipedia:Sockpuppet investigations/Coat of Many Colours/Archive

Coat of Many Colours

Coat of Many Colours (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

24 October 2014

Suspected sockpuppets

Marinka van Dam (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
A Sextet Short of PG(2,57) (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Anthony McDiarmid (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

User compare report Auto-generated every hour.
Editor interaction utility

Behavioral evidence is clear enough, as far as I'm concerned; I'll ask Crisco 1492 to contribute some technical details about technical details.

In short, Coat was blocked for three months on 15 October, after disrupting various processes including FP, and for harassing Crisco and Hafspajen. Well, that's sort of my reading: the close by Euryalus of an ANI thread cited battleground mentality and disruption, here. Note also that Euryalus doubted that Coat was a new account.

Well, here we are, with a new editor, whose account was begun on 15 October, and whose first edits pertain to the sex industry in Indonesia--nothing special until you see that Coat started accusing Crisco, an editor who lives in Indonesia, of attempting to redeem the reputation of a supposed pedophile via the FP process. Note that Marinka then jumps right into the FP process, which was Coat's favorite area as well, but I will let Crisco speak, if necessary, to the comparisons between the two editors, and I'll let him collect some diffs as well, for your viewing pleasure.

One more thing: I would like CU run. It may not provide conclusive evidence; Coat already indicated traveling. They used some IPs as well; I do not have those details at my disposal right now, but I think one IP's edit is linked on Coat's talk page. Drmies (talk) 00:42, 24 October 2014 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Another one: User:64.9.157.141 all but identifies themselves at [1]; they also edited at [2]. Seriously, they've gone from a three-month block to indef, what next? IP blocks? Adam Cuerden ^(talk) 09:26, 27 October 2014 (UTC)[reply]

Blocked for a while. Will wait and see if a static IP. -- Euryalus (talk) 09:40, 27 October 2014 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

Clerk endorsed. Marisa's primary focuses are pedophilia in Indonesia (Crisco is from Indonesia) and WP:FPC (she is commenting/voting on a lot of candidates). She's obviously not a new editor. After being blocked, Coat said they (she?) would not be returning. On that same day, Marinka started an account. Coat was not blocked on October 15 (Drmies's error) but on October 5. However, she made contributions post-block through October 15 (last edit: [3]).--Bbb23 (talk) 01:39, 24 October 2014 (UTC)[reply]

Marinka van Dam (talk · contribs) is Likely a sock of Coat of Many Colours.--Jezebel's Ponyo^{bons mots} 22:15, 24 October 2014 (UTC)[reply]
- Thank you Ponyo. I have blocked Marinka van Dam indefinitely. I will leave it to you, or to Bbb23, or to Euryalus, to decide what to do with the block on Coat. Thanks, Drmies (talk) 23:26, 24 October 2014 (UTC)[reply]
  - Thank you. — Crisco 1492 (talk) 23:31, 24 October 2014 (UTC)[reply]
    - I've added three more months to Coat's block, meaning the entire block from the date of the original block is 6 months. If there's more socking, the block of the master will become indefinite.--Bbb23 (talk) 23:34, 24 October 2014 (UTC)[reply]
      - Beat me to it, thanks Bbb23. Apologies to Drmies for the delay in posting the SPi. -- Euryalus (talk) 02:10, 25 October 2014 (UTC)[reply]
        No apology necessary, Euryalus; these cases are difficult and we all have day jobs. I appreciate your help. Drmies (talk) 02:16, 25 October 2014 (UTC)[reply]
Euryalus, Bbb23, Ponyo--please see the totally duck-like contributions of User:A Sextet Short of PG(2,57). This is turning into quite a sock farm. Drmies (talk) 13:31, 26 October 2014 (UTC)[reply]

Just before Drmies came back here, I responded to a comment from Crisco 1492 on my talk page here. Although the requested diffs would be nice, I'm endorsing a CU as I think there's enough for it even without the diffs and because it should be fairly simple.--Bbb23 (talk) 13:36, 26 October 2014 (UTC)[reply]
- Agreed. I have stepped away from the keyboard (nearly 1am here) but a review of contributions, writing style, editing interests and of course sudden re-emergence, are enough to point very strongly at this being another sock, even without CU. -- Euryalus (talk) 13:42, 26 October 2014 (UTC)[reply]
  - Diffs at Bbb23's talk page. — Crisco 1492 (talk) 13:53, 26 October 2014 (UTC)[reply]

Clerk note: Based on the outstanding diffs left by Crisco, I've indeffed and tagged Sextet based on duck. I'll leave the endorse, and the CU may either run the CU for confirmation or, if they prefer, decline it. I should note that Marinka, in their last post on their talk page post-block, threatened to continue socking with a work account here.--Bbb23 (talk) 14:26, 26 October 2014 (UTC)[reply]

Right on--thanks everyone. Allow me to ping Ponyo one more time, just so I know that they know that I know that they know, you know? Drmies (talk) 15:34, 26 October 2014 (UTC)[reply]

Oh, Drmies, I know. Coat of Many Colours has a fondness for attempting to obfuscate their location, and with so few edits there isn't much to go on here. The behavioural evidence is there and if nothing else the CU allows us to stick a cork in some dodgy IPs. --Jezebel's Ponyo^{bons mots} 16:34, 26 October 2014 (UTC)[reply]

And apparently obfuscating = changing their location every few minutes... — Crisco 1492 (talk) 16:40, 26 October 2014 (UTC)[reply]

(edit conflict) @Ponyo: At the risk of pinging you to death (

), does this mean we're done and I should close this report again?--Bbb23 (talk) 16:42, 26 October 2014 (UTC)[reply]

You can ping me anytime Bbb23. I don't think there's anything more to do here, so ok to close.--Jezebel's Ponyo^{bons mots} 17:04, 26 October 2014 (UTC)[reply]

Thanks to Hafspajen's reminder on my talk page of my earlier comment here, I've indeffed and tagged the master based on the new socking. It's comforting to know that someone reads what I write.--Bbb23 (talk) 19:24, 26 October 2014 (UTC)[reply]

Perhaps its not time to close yet: 2 edits, one to a museum on August 6 (a time when COMC was supposed to be "travelling") and one to FPC just today, after the most recent sock was blocked. — Crisco 1492 (talk) 02:57, 27 October 2014 (UTC)[reply]

The timing is obviously suspicious, but it's hard to block on two edits that aren't an absolute slam dunk. @Ponyo: I don't suppose requesting a CU will do any good?--Bbb23 (talk) 04:46, 27 October 2014 (UTC)[reply]

Indeed. If timing were less suspicious I wouldn't mention it, but... — Crisco 1492 (talk) 11:02, 27 October 2014 (UTC)[reply]

@Bbb23:, geolocation is off (which, due to CoMC's talk of travel and use of webhost/proxies, means little), but the UA is an exact match to Marinka van Dam's from the same time period. --Jezebel's Ponyo^{bons mots} 16:12, 27 October 2014 (UTC)[reply]

That helps enormously, thanks. I've indeffed and tagged the new puppet. I've also adjusted the tags on a few of the puppets to make the tagging consistent with the CU findings. Everything is now "suspected"; before some were confirmed, and some were not, and my read of Ponyo's findings is that nothing is actually "confirmed", particularly to the master. It may be a technicality, but it seems important to me. As soon as I finish this comment, I will close the case for the 99th time. If Crisco 1492 will take a short break, we might be able to archive this before he finds another. He would then have to start a new case. :-) --Bbb23 (talk) 23:45, 27 October 2014 (UTC)[reply]

I would if they'd stop coming looking for me. — Crisco 1492 (talk) 23:48, 27 October 2014 (UTC)[reply]
- You're correct - the IP template should have read "suspected" and is likely pointless in any case. That's my fault for editing late at night. -- Euryalus (talk) 00:20, 28 October 2014 (UTC)[reply]
  - I know what that's like. Except in very unusual circumstances, we don't usually tag IPs at all. The block itself should be self-explanatory and sufficient for the future.--Bbb23 (talk) 05:06, 28 October 2014 (UTC)[reply]

14 January 2015

Suspected sockpuppets

DUCK404 a (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

User compare report Auto-generated every hour.
Editor interaction utility

User name indicates a familiarity with both WP:DUCK (regarding sockpuppetry) and technical matters (404 error reference); Coat has formerly shown an interest in such technical matters. Also of note is a focus on WP:FPC. — Crisco 1492 (talk) 20:51, 14 January 2015 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

Yeah, DUCK and 404, that's pretty funny, but it's not very conclusive evidence. The exclusive focus on FP, that's quite another thing--plus the account's disappearance is real timely. I'd still like to see CU, though... Drmies (talk) 14:58, 2 February 2015 (UTC)[reply]
@Drmies: CU is Inconclusive due to the extensive proxy use by CoMC. At this point there are essentially two options 1) are they DUCKy enough to block outright? or 2) wait until they eventually out themselves behaviourally or they become disruptive enough to block regardless of the possible connection. Looks like this was just a burner account that's been abandoned though. --Jezebel's Ponyo^{bons mots} 22:10, 5 February 2015 (UTC)[reply]