Wikipedia:Sockpuppet investigations/767-249ER/Archive

Report date February 25 2009, 00:02 (UTC)

 * Suspected sockpuppets
 * Suspected sockpuppets (added MArch 10th)
 * Suspected sockpuppets (added MArch 10th)
 * Suspected sockpuppets (added MArch 10th)
 * Suspected sockpuppets (added MArch 10th)
 * Suspected sockpuppets (added MArch 10th)


 * Evidence submitted by: J Bar (talk) 00:02, 25 February 2009 (UTC)
 * Admission of vandalism as sock puppet Loy Wong and previous vandalism as Udom N. Tantiprasongchai and Udom N from IP address 114.76.210.127
 * Vandalism on my talk page
 * Vandalism on other articles and talk pages
 * Vandalism as Poorarticleremovalist includes adding nonsense and deleting articles  and obscenities on talk pages
 * Investigation into Loy Wong found a connection to 114.76.210.127 and Poorarticleremovalist and therefore links to vandalism


 * Vandalism on my talk page by User:114.77.199.50
 * Defiant reverts by User:114.76.210.127 on


 * Comments by accused parties    See Defending yourself against claims.

Vandalism continues using IP and other sockpuppets listed. J Bar (talk) 04:06, 25 February 2009 (UTC)
 * Comments by other users

Requested by J Bar (talk) 00:02, 25 February 2009 (UTC)
 * CheckUser requests


 * Please provide a applicable code letter. Thanks, Tiptoety  talk 01:21, 25 February 2009 (UTC)

Please provide evidence of socking, in the form of Diffs. Without more evidence, the Checkuser request will be declined, and the case delisted. Mayalld (talk) 09:38, 25 February 2009 (UTC) I removed Udom N, as the account is not registered. The ip's comment (114.76.210.127) you mention above may have meant Udom N. Tantiprasongchai.  Syn  ergy 00:38, 26 February 2009 (UTC)
 * Clerk, patrolling admin and checkuser comments
 * , moved case from Sockpuppet investigations/ 767-249ER to Sockpuppet investigations/767-249ER and changed names to remove the unnecessary space. Foxy Loxy  Pounce! 22:24, 25 February 2009 (UTC)
 * That account is too old to check. In any case, I would have wanted diffs of the accused accounts actually fitting the pattern, so we don't go blocking or checusering innocent people just because a vandal wanted us to. Dominic·t 07:25, 26 February 2009 (UTC)

no diffs provided, and none of the accounts appear to be active at present. Mayalld (talk) 08:36, 11 March 2009 (UTC) Mayalld (talk) 08:36, 11 March 2009 (UTC)
 * Commented out the RFCU template per Dominic's comment above. Tiptoety  talk 18:33, 2 March 2009 (UTC)
 * Conclusions

Report date March 24 2009, 19:17 (UTC)

 * Suspected sockpuppets




 * Evidence submitted by Bali ultimate (talk)

These four are all clearly the same user, here for some trolling/abusive purpose. James Tucton and Geoff Keen are already blocked. This came to light because new account apparently had some vendetta againts User:Marek69 per this and this spurious SPI case he opened with about his fifth edit on wikipedia. Marek1961 has a clean block log but currently claims (or an IP on his page at any rate claims) to be caught up in some weird range block. At any rate, User:Gerald1971 was created earlier today and went on to issue "block" messages to Marek and a number of other users asking for information about their IP addresses (none of these users appear to have any blocks). It appears this is tied in to some other user who was recently either blocked for one month or banned. It seems likely that the disruption is not going to end with the simple blocking of Gerald1971, so a CU seems appropriate to see what other associated accounts may be involved. I added the last IP on the list above because it appears related per this edit. That userpage was one of the latest to receive a "warning" from the newest sock.Bali ultimate (talk) 19:17, 24 March 2009 (UTC)


 * Mayalid - Would you reconsider? If I understand i used the wrong code letter. I've used "F" since it's not clear to me what other one best fits (i misread some info on the instructions page which said something to the effect of "use A for new cases." If you're not going to reconsider, tell me here. Would seem needlessly bureacratic to simply refile because i got the code letter wrong.Bali ultimate (talk) 19:35, 24 March 2009 (UTC)
 * Apparently, User:767-249ER may be the master account.Bali ultimate (talk) 23:40, 25 March 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users
 * I've changed the code letter to the more appropriate F. I assume Bali meant "E", which doesn't apply either since there's no community ban or block in place. If I am wrong in doing so please inform or revert me. -Jeremy (v^_^v Cardmaker) 19:39, 24 March 2009 (UTC)
 * Added another account blocked for the same reason as Gerald. -Jeremy (v^_^v Cardmaker) 20:05, 24 March 2009 (UTC)
 * I have added another account that has been used to leave sexually harassing messages on user talk pages where the user name appears to be a female's real name. This account's user signature pointed to Marek69's user page and user talk page. KuyaBriBri Talk 21:04, 25 March 2009 (UTC)


 * Added another account that was harassing Marek69. Is already blocked, added for completeness. // roux   21:04, 25 March 2009 (UTC)
 * Added IP 93.97.167.197 who was signing as Marek69. (Thats me - I'm can't edit with my account at the moment) --Marek69 using IP 91.135.6.121 (talk) 16:18, 26 March 2009 (UTC)
 * I've indef blocked psychanalist and Morek69, who are clearly the same editor and clearly socks from an earlier account, and were blatant vandals to boot. Fram (talk) 20:38, 26 March 2009 (UTC)
 * Added Klaudia2008, who posted yet another baseless complaint at Marek69's SPI subpage. -Jeremy (v^_^v Cardmaker) 23:48, 26 March 2009 (UTC)
 * Also added Naksloanebali, imitating the comments from Morek69 and Psychanalist (plus the username, not Morek related but also named after involved editors). Fram (talk) 13:20, 27 March 2009 (UTC)
 * Added 92.26.242.240; Marek69 listed him at the AN/I thread as an impersonator. -Jeremy (v^_^v Cardmaker) 19:14, 27 March 2009 (UTC)
 * And added another user. Could we have the check done asap?  We're getting two or three socks a day now, and I think we're gonna need a range to kill. -Jeremy (v^_^v Cardmaker) 20:12, 27 March 2009 (UTC)

Requested by Bali ultimate (talk) 19:17, 24 March 2009 (UTC), amended by Jeremy (v^_^v Cardmaker) 19:39, 24 March 2009 (UTC)
 * CheckUser requests

alleged master is not under Arbcom sanction. Mayalld (talk) 19:25, 24 March 2009 (UTC) apparent malicious SPI reports from this farm. Mayalld (talk) 14:20, 25 March 2009 (UTC) for further investigation Mayalld (talk) 14:17, 25 March 2009 (UTC)
 * Evidence: Administrators' noticeboard/Incidents
 * Clerk, patrolling admin and checkuser comments
 * I'm thinking that he was confusing block with ban (happens alot, and is accurate so long as no one unblocks). ips are obviously different (one in Australia and the other in the UK). Anyway, to me it looks like a heap of mess, probably coincidences. Accounts are blocked already, and then there is the issue of the threat but unless it starts up again, I'd say no further action is really nessasary. So unless there is something I've overlooked, I'll motion to close.  Syn  ergy 19:42, 24 March 2009 (UTC)
 * After this was reopened, I added AngelFace1966. They tried to create another case for Marek69.  Syn  ergy 16:06, 25 March 2009 (UTC)
 * on 2 ISPs, the rest is on some very large british ISPs we can't block without a lot of collateral. Can an other CU double check please? -- lucasbfr  talk 22:48, 27 March 2009 (UTC)


 * anything more on this one? Mayalld (talk) 13:38, 6 April 2009 (UTC)
 * Conclusions

There appear to be three separate sets of possibly unrelated sockpuppets in ranges listed above:

✅ Technical and behavioral evidence indicates that the following accounts are related and are likely sock/meatpupets of : ✅ Technical and behavioral evidence indicates that the following accounts are related and likely sock/meatpupets of :

The above two sets geolocate to different continents. I am uncertain why was tagged as a sockpuppet of.

✅ Technical and behavioral evidence indicates that the following accounts are related and probably unrelated to the two groups above:

-- Avi (talk) 14:29, 7 April 2009 (UTC)


 * Moving 767-249ER confirmed to his case and autoarchiving, fixing all tags on socks, and master accounts, then archiving this one.  Syn  ergy 14:54, 7 April 2009 (UTC)
 * This is a duplicate case to show what lead to a confirmation on other accounts.  Syn  ergy 15:04, 7 April 2009 (UTC)
 * ✅ Syn  ergy 15:12, 7 April 2009 (UTC)