Wikipedia:Requests for checkuser/Case/Littleteddy

''The following discussion is preserved as an archive of a Request for checkuser. Please do not modify it .''

Littleteddy



 * Code letter: C, G
 * Supporting evidence:, ,
 * Code letter: C, G
 * Supporting evidence:, ,
 * Code letter: C, G
 * Supporting evidence:, ,
 * Code letter: C, G
 * Supporting evidence:, ,
 * Code letter: C, G
 * Supporting evidence:, ,
 * Code letter: C, G
 * Supporting evidence:, ,
 * Supporting evidence:, ,

Noting that I still don't believe LT was ever involved, so this is more a check against the other accounts such as User:Cg9806 and User:Goodbo - this spate of vandalism over the last two days is entirely consistent with some of the other accounts, including shall we say some favourite themes of the young editors in question. Note that the "Timeshift" nick is an attempt to impersonate User:Timeshift9, a regular at the Australian Politics wikiproject - another consistent theme is attacking editors who bust them. Orderinchaos 13:19, 27 March 2008 (UTC)
 * Note also the case at IP check initiated by Lucasbfr, which mentions the following accounts. One is clearly a CG sockpuppet, but I won't give away how I know on here.




 * Orderinchaos 13:37, 27 March 2008 (UTC)


 * ✅ These accounts are all indistinguishable, except that he has started to use open proxies as well. No matter how many people might make up the "Wikimafia",  and  were created 3 and 5 minutes after Littleteddy's last edit on the same IP, and both Littleteddy and I'm On Speed posted unblock requests on their talk pages when they were autoblocked after Goodbo was blocked.  Grantkeys could be someone different as the edits are from the school and from a proxy, but at this point there is no real way to distinguish the members of the Wikimafia from each other and no reason to try. Thatcher 13:55, 27 March 2008 (UTC)
 * seems suspicious, after this note he left on Littleteddy's talk page. Nwwaew (Talk Page) (Contribs) (E-mail me) 20:27, 27 March 2008 (UTC)
 * ❌. Thatcher 00:27, 28 March 2008 (UTC)
 * I can personally vouch for Twenty Years, as can anyone at the August Perth Wikimeetup. Orderinchaos 08:02, 28 March 2008 (UTC)

Littleteddy


While checking IPs of vandal accounts, I discovered that Littleteddy is ✅ as the puppetmaster of the following accounts:


 * through
 * through
 * through
 * through
 * through
 * through
 * through
 * through
 * through
 * through
 * through
 * through
 * through
 * through
 * through

In addition he is the puppetmaster of these accounts:


 * 9 other nicknames
 * 9 other nicknames
 * 9 other nicknames
 * 9 other nicknames
 * 9 other nicknames
 * 9 other nicknames
 * 9 other nicknames
 * 9 other nicknames
 * 9 other nicknames
 * 9 other nicknames
 * 9 other nicknames
 * 9 other nicknames
 * 9 other nicknames

Thatcher 02:20, 20 March 2008 (UTC)
 * Hi, I can't see the connection here - my IP according to whatismyipaddress.com is 203.189.4.98. I use a shared computer to edit... maybe that is it? I have frequently neglected to log out in the past and I found that my account was twice used for vandalism. I'll also copy this to AN/I. Littleteddy... keep me in a good mood 03:18, 20 March 2008 (UTC)


 * Comment See Administrators%27_noticeboard/Incidents where a consensus of ❌ or seems to be emerging. &mdash;Moondyne click! 05:45, 20 March 2008 (UTC)  Sorry, that was premature, but mainly I was trying to point out that the other discussion was going on. &mdash;Moondyne click! 22:59, 20 March 2008 (UTC)
 * The conversation doesn't seem over yet. -- lucasbfr  talk 13:58, 20 March 2008 (UTC)
 * I don't see why, as it seems to be a simple unrelated to me. Littleteddy... keep me in a good mood 14:03, 20 March 2008 (UTC)
 * Taking my admin hat off here, the account names above do not correlate from a common-sense point of view to the person I've come to know from a distance offline. In general he writes with proper English, has a particular way about him etc and the above just looks like stereotypical teenage vandalism. (Per WP:BEANS I won't outline what other features Littleteddy consistently exhibits, but good faith admins/checkusers are more than welcome to ask privately.) Question to checkusers - is there clear cases of sockpuppetry between 7am and 3pm UTC (which corresponds to afternoon our time, after everyone's gone home from school), or are they limited to Perth daytime hours (roughly 11pm to 7am UTC)? Orderinchaos 15:59, 20 March 2008 (UTC)


 * There is additional information on my talk page. The edits are made within the same time frame as Littleteddy's normal editing, which seems to be 5pm-11pm Perth time. Gnangarra on my talk page says he attends a residential school.  The accounts I marked as "confirmed" edit from the same ISPs as Littleteddy, usually on the same day.  The "likely" edits are on IP addresses in the same ranges with other identifying characteristics.  I don't know how the school IT dept is configured; whether there really are shared IPs, whether students have internet in the rooms or only libraries and such, etc.  The technical evidence can not rule out the possibility that these are friends and fellow students playing silly buggers, neither can it rule out the possibility that this is the work of a single individual, or even a hybrid explanation.  For example, at one point Littleteddy makes an ordinary edit, and 4 minutes later someone from the same IP and user agent makes a logged-out edit containing an offensive remark toward an admin.  Without a time-traveling reverse web cam, there is no way for me to know who made that edit, but those kinds of synchronicities show up many times. Thatcher 16:14, 20 March 2008 (UTC)
 * Have had offline confirmation (not from the user concerned, but from another person associated with the school) that there are several real names of Year 9 and 10 (14-15yo) students at the same school in and with the above. (Darryl Hair, meanwhile, is a controversial cricket umpire who made news a year or two ago.) Orderinchaos 19:42, 20 March 2008 (UTC)


 * (Cross-posted from AN/I) This is somewhat technical, and I can not share the specifics, obviously.  However, I attempted to analyze Littleteddy's IP use with whois and traceroute.  The IP he gives above, 203.189.4.98, is true, and is registered to Crox Development, and there are shenanigans on it, and it is certainly plausible that it is a shared IP at his school.  Littleteddy has used over a dozen other IP addresses registered to a different ISP that I will call "Kangaroo." Some of these IPs only have Littleteddy's edits but some of them also have shenanigans.  There are also a large number of vandal-only accounts that also use "Kangaroo" IPs and traceroute puts them on the same network branch with the same first-upstream-server as IPs used by Littleteddy.  I can not be positive that Littleteddy's school does not have internet service from two different providers, but it seems unlikely.  I can not be positive that the "Kangaroo" IPs are not shared, but it seems unlikely.  It seems more likely that "Kangaroo" ISP edits come from Littleteddy's home. That's about the most I could ever say technically.  Make of it what you will. Thatcher 16:21, 21 March 2008 (UTC)

''The above discussion is preserved as an archive of the Request for checkuser. Please do not modify it. Subsequent requests related to this user should be made above, in a new section.''