Jump to content

Wikipedia:Sockpuppet investigations/Yourname/Archive

Add links
Page semi-protected
From Wikipedia, the free encyclopedia


Yourname

Report date April 29 2009, 00:39 (UTC)
Suspected sockpuppets


Evidence submitted by StarM

Obsession with adding the "stool" image and other shit related images here, here, here, here, etc. He's been trolling DGG, Chillum, I'm Spartacus and I, among others, after various actions which led to him being blocked, finally indef. Playing whack-a-mole at the moment. StarM 00:39, 29 April 2009 (UTC)[reply]

Synergy, thanks for re-opening. Maybe these are all proxies, Nakon has certainly blocked some as such, in which case this is moot. Don't wory in SPI much so I may have gone wrong but I thought this was the right path for a person blatantly using multiple accounts/IPs StarM 02:06, 29 April 2009 (UTC)[reply]

Comments by accused parties    See Defending yourself against claims.


Comments by other users

Not sure what whosis is telling us, different ISP's in different countries:

  • 69.197.156.202 Kansas City, Missouri
  • 78.53.41.53 Berlin
  • 89.105.196.76 Netherlands
  • 81.17.254.70 Ireland
  • 38.108.178.115

Cheers, Dlohcierekim 00:48, 29 April 2009 (UTC)[reply]

CheckUser requests
Checkuser request – code letter: B (Ongoing serious pattern vandalism )
Current status – Declined, the reason can be found below.    Requested by StarM 00:39, 29 April 2009 (UTC)[reply]


Clerk, patrolling admin and checkuser comments
  •  Clerk declined All blocked for various reasons, some include block evasion, others are proxy. Synergy 00:51, 29 April 2009 (UTC)[reply]
  •  Clerk declined I've taken another look at this as requested by Synergy, and it appears to me that we are looking at proxies here, and that there is nothing useful that CU will tell us.
Conclusions

 Completed Everything that can be done on this one has been done. Mayalld (talk) 12:59, 29 April 2009 (UTC)[reply]

This case has been marked as closed. It has been archived automatically.

Mayalld (talk) 12:59, 29 April 2009 (UTC)[reply]


Yourname

Report date April 29 2009, 21:24 (UTC)
Suspected sockpuppets
Evidence submitted by Abce2 (talk)

Obsession with images of poo and similar things. Abce2 (talk) 21:24, 29 April 2009 (UTC)[reply]


Comments by accused parties    See Defending yourself against claims.


Comments by other users
It's Wikipedia:Sockpuppet investigations/Yourname/Archive, which has been closed. They're all proxies and nothing that can be done. Sad but apparently that's the answer StarM 00:49, 30 April 2009 (UTC)[reply]
CheckUser requests
Checkuser request – code letter: B (Ongoing serious pattern vandalism )
Current status – Declined, the reason can be found below.    Requested by Abce2 (talk) 21:24, 29 April 2009 (UTC)[reply]
 Clerk declined Per Toon below. PeterSymonds (talk) 22:49, 29 April 2009 (UTC)[reply]
Clerk, patrolling admin and checkuser comments

information Administrator note WP:QUACK - the IP's first edit was to User talk:DGG#Wikipedia:Sockpuppet investigations/Yourname, to insert a picture of faeces. No need for CU, I've switched the template to indicate the correlation - this should be at Wikipedia:Sockpuppet investigations/Yourname really. IP is blocked for 3 hours already, worth keeping an eye on if he comes back. – Toon(talk) 22:46, 29 April 2009 (UTC)[reply]

Conclusions
This case has been marked as closed. It has been archived automatically.
 Clerk note: Blocks already applied; nothing left to see here, folks. — Jake Wartenberg 02:59, 30 April 2009 (UTC)[reply]


Yourname

Report date May 4 2009, 08:31 (UTC)
Suspected sockpuppets


Evidence submitted by Abce2
Abce2 08:31, 4 May 2009 (UTC)


Comments by accused parties    See Defending yourself against claims.


Comments by other users

Wikipedia:Sockpuppet investigations/Yourname he's proxy hopping. Nothing anyone can do. StarM 12:11, 4 May 2009 (UTC)[reply]

CheckUser requests
Checkuser request – code letter: A (Arbcom ban/sanction evasion )
Current status – Declined, the reason can be found below.    Requested by Abce2 08:31, 4 May 2009 (UTC)
Proxy hardblocked for a year, for what it's worth, but CU would tell us nothing we don't already know. Sorry. PeterSymonds (talk) 12:17, 4 May 2009 (UTC)[reply]
Clerk, patrolling admin and checkuser comments


Conclusions
This case has been marked as closed. It has been archived automatically.

Proxy-hopping, per Star Mississipi and verified by nmap. Hardblocked for a year per m:NOP but it won't stop him. PeterSymonds (talk) 12:17, 4 May 2009 (UTC)[reply]

08 September 2011
Suspected sockpuppets



Sockmaster is unknown, actually. This is apparently a sockpuppet of someone. See discussion at User talk:DoDo Bird Brain.

The editor has retired in a huff after being warned multiple times to stop abusing CSD tags. As discussed on the talk page, this is clearly not a new user account, indicating that this account may be a "good hand" sock for someone, or possibly an attempt to evade a block.

This report is not a fishing expedition, but I know of no other way to identify the sockmaster — assuming checkuser can be used for such a purpose. If not, please disregard this report. ~Amatulić (talk) 12:25, 8 September 2011 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
I kinda figured that. The concern was whether the sockmaster had retired. Anyway, thanks. ~Amatulić (talk) 23:30, 8 September 2011 (UTC)[reply]
12 November 2011
Suspected sockpuppets

User has personally attacked other users and makes unconstructive edits to articles such as Katrina Johnson identical to the sock master before the master account was blocked (([1], [2], [3], [4]). The user was blocked for a week on November 4, but I feel that a check user is necessary to check if these accounts are the same person. Darth Sjones23 (talk - contributions) 04:29, 12 November 2011 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

no Declined. Sorry, but CUs don't publicly link IPs to accounts. Elockid (Talk) 04:36, 12 November 2011 (UTC)[reply]


14 November 2011
Suspected sockpuppets


Same disruptive edits, same personal attacks. Darth Sjones23 (talk - contributions) 04:56, 14 November 2011 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
14 November 2011
Suspected sockpuppets

Reported to http://en.wikipedia.org/wiki/Wikipedia:ANI#Yourname.2C_again. 1966batfan (talk) 23:12, 14 November 2011 (UTC)[reply]

Personal attacks on User:Sjones2, the alt. account of Sjones23. 1966batfan (talk) 23:54, 14 November 2011 (UTC)[reply]

Same as the previous socks. Personal attacks on User:Sjones2. 1966batfan (talk) 00:01, 15 November 2011 (UTC)[reply]

Same pattern as previous socks. 1966batfan (talk) 00:27, 15 November 2011 (UTC)[reply]

Another trademark of Yourname socks: a suicide thought. 1966batfan (talk) 00:54, 15 November 2011 (UTC)[reply]

Same as last IP. Also made personal attack on my talk page. 1966batfan (talk) 01:41, 15 November 2011 (UTC)[reply]

Rangeblocks are definitely needed here.--1966batfan (talk) 01:59, 15 November 2011 (UTC)[reply]

These IPs are coming from several different places. I did Geolocate on them and found that out. This must be some sort of botnet or something.--1966batfan (talk) 02:02, 15 November 2011 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

no Declined – There is nothing more that CheckUser can do here than what is currently being done. Rangeblocks are clearly not possible here. –MuZemike 03:22, 15 November 2011 (UTC)[reply]

15 November 2011
Suspected sockpuppets


One of a few IP addresses that vandalized my talk page in the same fashion as previous Yourname IPs, causing it to be protected. 1966batfan (talk) 20:27, 15 November 2011 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments
29 November 2011
Suspected sockpuppets


These are obvious socks; however, since this user has been using open proxies (such as 178.209.46.143), we should have some one check which IPs these accounts used and whether or not each of these IPs is an open proxy. עוד מישהו Od Mishehu 07:56, 29 November 2011 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

They attacked my talk page, causing it to be protected for almost a month.--1966batfan (talk) 20:26, 29 November 2011 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

 IP blocked. Nothing much else of interest. Elockid (Talk) 02:39, 30 November 2011 (UTC)[reply]

01 December 2011
Suspected sockpuppets

It is rather unlikely, though I'm submitting this SPI anyway because of the attack-ish username. Yourname has often targeted Sjones23; it seems very unlikely that the choice of this username, Kdjones23, was a coincidence. additionally, they triggered filter 445 (intended to block edits with suicide-like phrases, which are often used by Yourname) when they tried to create Childhood phobias, which includes a brief bit related to that. The article seems to show a level of competence I don't see in Yourname, though a CU might be able to clear it up. HurricaneFan25 18:48, 1 December 2011 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

no Declined – Given that Yourname almost exclusively edits from proxies or a botnet, CU won't tell us anything here. You need to go on behavior, and it looks like Kdjones23 is not him based on the likely false positive on the edit filter. –MuZemike 15:10, 2 December 2011 (UTC)[reply]

02 December 2011
Suspected sockpuppets

Look at the edits. They have Yourname trademarks 1966batfan (talk) 23:17, 2 December 2011 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

You don't need CU to check for open proxies. –MuZemike 23:18, 2 December 2011 (UTC)[reply]

30 March 2016

Suspected sockpuppets

Going to add more IPs and users momentarily. Just lost a bunch of work so going to file this now and add evidence after. EvergreenFir (talk) Please {{re}} 03:14, 30 March 2016 (UTC)[reply]

Resurrecting an ancient SPI here based on comments by Zzuuzz on Talk:Defecation. Yourname's primary fixation from the beginning was feces and trying to insert images of them (see here as well as examples of edits: [5], [6], (warning, nsfw)). There's been an effort to get a video of defecation put on the article defecation since 2009. I became aware of the effort in August 2015 when there was some edit warring over it. See Wikipedia:Sockpuppet_investigations/Yourname/Archive#Report_date_April_29_2009.2C_00:39_.28UTC.29 and Talk:Defecation/Archive_1#Defecation_Video for more on that.

These past couple weeks there's been renew activity regarding the defecation article as well as edits on Wikipedia:Sandbox. The first IP listed in the report seems to be the most active of the bunch, but all the IPs seem related (geolocating to Maryland). The IP editors and other user(s) reported generally have the following in common:

  • Geolocation to Maryland
  • Attempts to add images of feces or other shocking images (e.g., [7], [8], [9])
  • Harassment of users, especially DanielRigal
  • Blanking of own IP user talk pages as well as other users' talk pages, sometimes to replace content with an image (e.g., old IP, old IP, new IP, new IP, newer IP)
  • Campaigning/GAMING discussion to get video or image on Defecation (e.g., [10]
  • Editing on Sandbox to add shocking images or content (e.g., [11])

I understand that this SPI might be too old, in which case I'd ask it be moved to the user account listed as a sock. Also, there are many many IP editors and providing diffs for all of them is hours of work. A quick view of their edit histories should show the pattern quickly enough though. I will attempt to order them from "most active" to least. EvergreenFir (talk) Please {{re}} 03:34, 30 March 2016 (UTC)[reply]

Pinging Paul Erik who just blocked the first IP listed. EvergreenFir (talk) Please {{re}} 03:36, 30 March 2016 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I am certainly convinced that 71.166.33.65 and 173.13.205.205, and the 70.192.* addresses are this same user. The others also seem likely, though they're somewhat older. I could probably find an actual claim from the 70.192.* addresses to be this user if anyone's that interested. However the behavioural analysis makes this somewhat unnecessary. -- zzuuzz (talk) 08:12, 30 March 2016 (UTC)[reply]

@Zzuuzz: Curious, did one of the IPs publicly state they were Yourname? Or am I misunderstanding you. (Not necessarily to find, but would be interesting to know). FWIW, I filed this SPI mostly so we have something to point to when disruption occurs. Users are likely unfamiliar with this, like I was until your comment, and it would help when filing AIV reports or just shutting down disruption in general. EvergreenFir (talk) Please {{re}} 17:21, 30 March 2016 (UTC)[reply]
70.192.203.102 and 70.192.210.2 did recently, though it's admin-only. There has recently been a spate of abuse from this range, all the same user, and rather obviously it is indeed this user. You'll have seen Wikipedia:Administrators'_noticeboard/IncidentArchive917#Wikipedia:Sandbox and Wikipedia:Administrators'_noticeboard/IncidentArchive917#Abuse_Filter_For_WP:Sandbox - same user. -- zzuuzz (talk) 17:32, 30 March 2016 (UTC)[reply]
Thank you! EvergreenFir (talk) Please {{re}} 18:29, 30 March 2016 (UTC)[reply]

Adding Skyxox109 and 109.7.228.225 and 188.191.30.45. What an odd perseveration this user has. EvergreenFir (talk) Please {{re}} 21:56, 31 March 2016 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

Putting on my admin hat, I think it's fairly conclusive that the 70.192.* addresses are Yourname. There is currently a short-term block on 70.192/16.[12] Previous range blocks have been applied to 70.192.192/18[13] and 70.208.128/19[14]

173.13.205.205 and 71.166.33.65 are also the same user - the IPs have probably been static for several months and can probably both expect a longer block.

The IPv6 address is making identical edits from the same network, although some time ago. 2600:1003:b000::/36 is currently blocked, and has been blocked repeatedly.[15]

96.244.249.58 looks like some kind of proxy to me, though it's also Verizon and geolocates to the right area. I think we can safely conclude it's the same user.

98.117.33.218 and 71.246.89.7 are somewhat stale, but it looks like the same user. I don't think we can reach any conclusion about Iamafatlard - the account is blocked.

Pinging a couple of users for FYI. 123. Bar lengthening the aforementioned blocks, this can be closed. -- zzuuzz (talk) 14:57, 31 March 2016 (UTC)[reply]

08 April 2016

Suspected sockpuppets

Obscene images at WP:Sandbox. Special:Contributions/109.7.228.225 has an admission of sockpuppetry. — Andy W. (talk · contrib) 22:54, 8 April 2016 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

  •  Clerk declined @Andy M. Wang: I'm declining the CU request (I haven't read the rest of this); CheckUser generally doesn't publically link IP addresses to usernames (unless there's something I'm missing here). Thanks, Kevin (aka L235 · t · c) 04:36, 10 April 2016 (UTC)[reply]
  • Most of these IPs are this same user (66.167.141.20 is not). It's likely some proxy service is being used, in addition to the IP ranges mentioned in the previous report (undocumented here). Most of these proxies are not long term, but those that are are tending to experience longer blocks. This can be closed. -- zzuuzz (talk) 23:59, 10 April 2016 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=Wikipedia:Sockpuppet_investigations/Yourname/Archive&oldid=1142565975"