Wikipedia:Requests for checkuser/Case/200.215.40.3

''The following discussion is preserved as an archive of a Request for checkuser. Please do not modify it .''

200.215.40.3 (2nd)
// All of the listed users in the first case (bottom)
 * [Global Contribs]
 * [Global Contribs]

Recent IPs/Aliases revealed on enwiki (after September 5/08)

 * - disruptively made reverts on Nov. 5/08; obvious sock
 *  - disruptively made reverts (again) on Nov. 7/08; obvious sock
 * - disruptively made reverts (again) on Nov. 6/08; obvious sock
 * - disruptively made reverts on Nov. 5/08; obvious sock
 *  - disruptively made reverts (again) on Nov. 7/08; obvious sock
 * - disruptively made reverts (again) on Nov. 6/08; obvious sock
 *  - disruptively made reverts (again) on Nov. 7/08; obvious sock
 * - disruptively made reverts (again) on Nov. 6/08; obvious sock
 *  - disruptively made reverts (again) on Nov. 7/08; obvious sock
 * - disruptively made reverts (again) on Nov. 6/08; obvious sock
 *  - disruptively made reverts (again) on Nov. 7/08; obvious sock
 * - disruptively made reverts (again) on Nov. 6/08; obvious sock
 * - disruptively made reverts (again) on Nov. 6/08; obvious sock


 * Code letter: C


 * Supporting evidence: The IPs have the exact same editing patterns, they are all under the same ISP (LACNIC) and that has been confirmed by WHOIS. On Template:Holy Roman Emperors, the user was undeniably edit warring by use of more sock puppets, this being after the case was handled several times by more than one admin. Obviously, at this point, the user is aware that abuse of sockpuppet accounts are prohibited under certain uses (as seen on this string of edits by each contributer). These include using them to evade blocks, bans, and user accountability—and especially to make personal attacks or reverts, or vandalism. The most noticeable err against that would be the simple fact that he has evaded blocks 3 times before the first checkuser request, this would be the fifth if you include it as a seperate evasion from the one made by User:Troy is a parasite.


 * Also, there were countless edits in other projects, as you can see in the case below. So, in regards to the cross-wiki sock puppetry, as explained here, the user was actually blocked once in Italian Wikipedia and was noticeably disruptive in a few of the main articles in which this person edited. Considering how widespread this is, I would highly suggest that cases should be opened in the major problem areas like Portugese wiki, Latin wiki and Italian wiki. Lastly, if there is any information that should be carefully given, feel free to send me an email. I will usually respond swiftly to any queries. I assumed that the issues would have at least temporarily subsided on this wiki for a few months longer, but unfortunately, that hasn't been the case. I am thus more open to any suggestions in regards to what further steps should be taken and how this issue can be avoided in the future. ~ Troy (talk) 04:16, 25 September 2008 (UTC)

In progress. Requires crosswiki checks. ++Lar: t/c 12:19, 28 September 2008 (UTC)
 * OK, so just making sure that it's ptwiki, lawiki (la, not lt) and itwiki that need to be looked at, respectively. In any case, I would expect some kind of result from those projects, first and foremost. ~ Troy (talk) 00:14, 4 October 2008 (UTC)
 * Still working this, it will take a block of time to get to the bottom of this. Sorry for the delay. ++Lar: t/c 21:52, 7 October 2008 (UTC)
 * No worries, you can take your time. I'm not in a rush right now because I know that the IP socks responsible for this mess will turn up again sooner or later, so, steady as she goes. ~ Troy (talk) 01:37, 8 October 2008 (UTC)
 * Minor update: WHOIS query for User:189.73.71.46 matches identically with the other IP addresses. I have thus added that IP to the list for the sake of tracking purposes—these IP ranges are a little more dynamic than I would like. I'm sure to find more, of course. ~ Troy (talk) 00:08, 11 October 2008 (UTC)

I'll be helping with the en.wiki part of this while Lar concentrates on the cross wiki checks. — Rlevse  •  Talk  • 02:28, 14 October 2008 (UTC) . Anthøny   ✉  22:00, 14 October 2008 (UTC)
 * Annotating with a graphic, to make the status here easily noticeable:

I'm still working the crosswiki stuff but it's a hard slog. The request is so nebulous that it's hard to come to grips what to look for. I'm about ready to chalk this up as unresolvable. ++Lar: t/c 16:14, 2 November 2008 (UTC)
 * I had a feeling that might be the case. If so; you might as well do that. I'm ready to spot the guy's edits if I can in the future, but if it's that hard to checkuser, it won't be much easier to present. Quite unfortunate for those ranges to be so dynamic, but at least I have somewhat of an idea of what to expect :P ~ Troy (talk) 00:46, 5 November 2008 (UTC)
 * Argh ...I just checked the contribs on this wiki now; he was using 189.31.82.149 just a few days ago. Certainly the same guy if you look at 189.31.82.148. Still, it's not my within my decision if you want to discontinue the cross-wiki checks; I've already said pretty much what I knew. ~ Troy (talk) 00:53, 5 November 2008 (UTC)


 * Note: the user has been actively disruptive for days now, and it doesn't seem that s/he was competent enough to get the idea. I would've thought that s/he would've given up by now, but that only means that it's getting out of hand at this point. The user is abusively & intentionally changing his IP address on a daily basis now. Yesterday, it was 189.31.111.17, and again, he turned up today as 201.2.236.54. I'm absolutely open to suggestions, but in the mean time, this certainly needs to be looked at closely. ~ Troy (talk) 00:50, 7 November 2008 (UTC)

✅ same guy as before. As these are rather dynamic, I did three range blocks. That's about all we can do here, try to isolate ranges small enough to block. I close this now and reopen if it is warranted later.  — Rlevse • Talk  • 01:59, 9 November 2008 (UTC)
 * As long as I can avoid the issue here, that will serve its purpose. Of course, if I spot something unusual, I'll have to report it, but that's it otherwise. ~ Troy (talk) 01:35, 10 November 2008 (UTC)

200.215.40.3
X denotes users with no contributions on enwiki (see "Global Contribs" if listed)
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs] X
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs] X
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global User Contribs] X
 * X
 * X
 * X
 * X
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs] X
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs]
 * [Global Contribs] X
 * [Global Contribs]
 * [Global Contribs]


 * Code letter: C


 * Supporting evidence: I have filed two lengthy reports regarding the issue. It all started in November of last year, when 200.215.40.3 kept playing around with my edits and went Wiki-stalking with my contributions. Eventually, 200.215.40.3 was blocked for a period of two days on December 24. What I didn't notice was that the user was very active on several projects. In fact, by the time he started disrupting enwiki, he had already made a lot of edits on ptwiki, itwiki and lawiki (see Global Contribs of 200.215.40.3). The user lives in Brazil (I know this for a fact as there are more Portuguese edits than Spanish; also see WHOIS) and, thus, edits in Portugese and English for the most part. After the block expired, Pontiff and Holy Father were two of many articles that were still negatively affected. In Portugese Wikipedia, Sua Santidade ("His Holiness") was negatively affected. The user was involved in changing all of the links/names (ie: opposite of "dab" linking), which was considered to be actually quite minor at the time. However, the user was evidently denying requests (the first one was made by Andrew c) to kindly discuss the issue as they were used solely for that purpose. The problem became obvious to me by the time he/she had only reverted a few times and had wrote almost as many negative edit summaries.


 * The first report that I filed, Suspected sock puppets/200.215.40.3, brought attention regarding this issue. What that report didn't cover was the handful of accounts that were created as spares in order to evade the blocks. Afterwards, a few days ago, I filed the second report, Suspected sock puppets/Benkenobi is a retardate, which concluded with indefinite blocks for all of the checkusered accounts and ended also with the idea of further action regarding cross-wiki vandalism (I'll deal with that mostly on Meta). Like the edits on enwiki, ptwiki and the other projects were, again, negatively affected by this user (ie: the Sua Santidade article), a lot of which were edited by the user either for either needlessly changing the names (against naming conventions), or deletion of content or POV changes on Coptic Orthodox-related articles (definitely against me specifically). In regards to those edits, I strongly feel that it is against the Wikimedia Foundation's Policy on Discrimination.


 * User:Auson was indefinitely blocked for harassment of users and manipulating sock accounts (see the Block log). According to Auson's User log, Auson did indeed try to evade a block by creating the account of "User:Benkenobi is a retardate" (12:47, 19 July 2008), who was indefinitely blocked. This is the first piece of evidence which proves that this user intentionally harrassed or bothered users other than myself, User:Benkenobi18 in particular. Also, according to the log of Catholicus, the account of ProSadomino was created by the same user. Also, while the edits are quite similar, some of the usernames are quite obvious as well. Auson —> Log|Username (Benkenobi is a retardate|Ausonia) // Catholicus —> Log|Username (ProSaDomino|Italicus).


 * Some of these accounts, of which I wasn't aware about until recently, were unused because of the convenience of using them as spares in case of blocking the user. Malleus Haereticorum was the two only "recently noticed" accounts that were used here, and it was solely meant for moving pages. He/she was warned not to do so by other users, but it looks as though it hardly even mattered. ProSaDomino, also recently revealed, made similar edits as the ones from the start (ie: this edit to His Eminence, affected by the user on more than one project). Moreover, after that last report, I have added 10 more IP addresses here than the other two reports combined, thus, the seriousness of this issue has risen steadily over the weeks. The only IP that I am not fully sure of is 189.29.202.107 (listed at the bottom), who made two edits on ptwiki as of the day this request was filed.


 * Lastly, since there have been many IP edits that were made to different projects, there is still the potential of further global edits made by any of these accounts. Habsburgo, Catholicus, Ausonia and Italicus have all been registered on another language. Thus, I would highly suggest as many indefinite "global" blocks as possible to prevent creation/globalization of the same accounts so that further cross-wiki issues with this user can be more easily avoided. ~ Troy (talk) 17:57, 29 August 2008 (UTC)
 * Note: for more information regarding the cross-wiki vandalism, see the report that was filled out here. Also, if anyone is interested, I may send a Wikipedia email in accordance with Wikipedia's privacy policy. I do have some important information regarding how to track IP vandalism/sock puppetry in general, so I am prepared to give you that information if you are willing to know. Thank you. ~ Troy (talk) 21:51, 29 August 2008 (UTC)

''The above discussion is preserved as an archive of the Request for checkuser. Please do not modify it. Subsequent requests related to this user should be made above, in a new section.''
 * ✅ the named accounts with edits on this wiki are the same person, and he has edited a lot while logged out from these or similar IPs. You'll have to ask a local checkuser or steward to deal with the situation on other wikis. Thatcher 00:29, 9 September 2008 (UTC)
 * Ok, so it appears all the named accounts have already been blocked, and I have only blocked one of the IP's listed above seeing as it is the only one that has edited within the past month and until I see recent disruption from the other listed IP's I am going to leave them unblocked. So, if they start up again contact me and I. Tiptoety  talk 00:49, 9 September 2008 (UTC)
 * Per CheckUser request. Tiptoety  talk 04:41, 23 September 2008 (UTC)