Wikipedia:Sockpuppet investigations/1.243.231.53/Archive

08 December 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Since the (apparently legitimate, content-wise) addition of Park Chung-Hee to 21 hours ago, the article's been vandalized about 50 times. Most vandalism consisted of removing Park from the list, though there was also various collateral or related vandalism. Clearly a politically motivated mass sock campaign, using various proxies and a few registered accounts. Disregarding one self-reverted removal, the first vandal was 193.6.145.5 (who I haven't submitted as sockmaster, seeing as 1.243.231.53 conducted most of the vandalism). I'm also not including a tangential edit war over the term Takagi Masao, which may or may not be the Japanese name for Park... maybe one of the various editors reverting related vandalism to the Park page know more about that; I'd include it, but I can't quite tell who the "bad guys" are in that case. Anyways, here's a whole lotta diffs:
 * 1.243.231.53 (presumed sockmaster)


 * 193.6.145.5
 * 118.194.241.10
 * 67.55.6.213
 * 210.118.3.115
 * 121.134.97.240
 * 218.145.133.41


 * P740407
 * 166.48.226.31
 * 2607:F8F0:C10:FFF:200:5EFE:CE57:B636
 * 113.59.161.245
 * 14.45.1.156
 * 112.214.178.176


 * 49.143.76.86
 * 175.115.61.61
 * 211.54.2.241
 * 14.33.156.239
 * Luzen89
 * 175.114.176.244


 * 49.143.76.86
 * 63.141.199.159
 * 222.233.160.183
 * 203.255.50.70
 * Todays-riot
 * 174.19.189.114

Unless I missed any, that brings it to 24 sockpuppets. If anyone can shed some light on the whole "Takagi Masao" thing, there might be some more to add. — Francophonie&#38;Androphilie (Je vous invite à me parler ) 09:13, 8 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Response to Dennis and Basalisk: My thinking was more that for so high-volume a coordinated attack to take place, a large amount of this must have been proxy-socking, seeing as there were 21 IPs and only 3 usernames. And that since we generally block proxy IPs on sight (at least, I think we do?), these would all be blockable on those grounds. If you'd like, I can go through this and weed out the ones that can't meet the duck test, since some of the edits were identical from one IP to the next. Or, if you think it's better to just drop it unless the socks flare up again, that's fine by me too - though might I suggest you at least block the usernames? Regardless, you guys are the admins here, so do as you please. — Francophonie&#38;Androphilie (Je vous invite à me parler ) 18:21, 8 December 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * A random sampling of of the IPs shows these are located all over the globe, so socking isn't likely. Meatpuppetry may be the problem here, and using semi-protection via WP:RFPP would be the right way to go.  I can envision someone on a blog somewhere rallying the troops.  Some of the edit times overlap as well.  A few might be, but there is too much noise to separate the wheat from the chaff here, thus protection is the key to dealing with the chaos.  Dennis Brown -  2&cent;    &copy;   Join WER 15:05, 8 December 2012 (UTC)
 * The article had already been semi-protected by the time this was filed. I don't think there's anything to be gained from whacking every single suspicious IP. The day we start doing that is the day 4chan raids finally break SPI. Basa lisk  inspect damage⁄berate 17:34, 8 December 2012 (UTC)
 * I will go ahead and test a few these for proxy, but it takes more than several minutes each to do it properly. Some of them are undoubtedly NOT proxies by virtue of the type of IP they are. Dennis Brown -  2&cent;    &copy;   Join WER 19:03, 8 December 2012 (UTC)


 * Tested all IPv4, some deeper than others. Found one Hyundai employee, one open proxy, one misconfigured router, a little pwnage, and not much else.  Actions taken as needed. Dennis Brown -  2&cent;    &copy;   Join WER 19:33, 8 December 2012 (UTC)