Wikipedia:Sockpuppet investigations/94.193.131.142/Archive

12 July 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Master IP has engaged in extensive disruptive editing and subtle vandalism on articles related to ships and shipping despite repeated warnings and blocks. Master IP is currently blocked and the sock IP has popped up on some of the same articles and is engaging in the exact same behavior.

Contrib log for Master IP Contrib log for sock IP

This IP user is causing a great deal of trouble and work for the members of the WP:SHIPS project. There are many hundreds of edits that we are having to go back and revert. See also this discussion on the project talk page. Ad Orientem (talk) 15:11, 12 July 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Both IPs blocked by . Closing.--Jezebel's Ponyo bons mots 18:36, 15 July 2014 (UTC)

07 October 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

IP 46.64.178.3 appears to be the latest incarnation of IP 94.193.131.142 who along with an earlier sock, 94.193.131.253, have been range blocked for extensive and often subtle vandalism to scores of articles on the SHIPS project. See this ANI discussion. IP 46.64.178.3 is engaging in nearly identical editing behavior on the same articles targeted by the previously blocked IPs. See 46.64.178.3's contrib log and compare it with the contrib logs of the two already blocked IP linked in the ANI discussion.
 * I have added 94.193.131.115 to the list of suspected socks based on identical vandalism. -Ad Orientem (talk) 13:22, 10 October 2014 (UTC)

CC: - Ad Orientem (talk) 19:58, 7 October 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Re-pinging Dennis Brown and report creator Ad Orientem due to merging this from a possibly-incorrectly titled SPI page. Steel1943  (talk) 13:42, 9 October 2014 (UTC)
 * Thanks for the ping. As far as I know this particular vandal uses IP addresses. The one I used as the title is the first one that was identified as a habitual vandal by editors on the SHIPS project. If IPs can't be used for an SPI title let me know and I will send this to AVI as soon as s/he strikes again. I posted a final warning yesterday, but history has shown that these warnings are ignored. I really just don't want to wait until this person creates as much havoc as they did the last time around. -Ad Orientem (talk) 14:11, 9 October 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * It does look like the same person, but these look like disposable addresses, making blocking useless. Going to WP:RFPP and asking for PC or semi-protection for these articles is likely going to be the only thing that is actually effective.  As far as a range block, I would leave that to a CU, who can better view the traffic on both of these ranges.  Considering the ISP, my first guess is that there would be too much collateral damage for a range block, but that is why someone more experienced needs to peak in. Dennis 2&cent; 16:17, 9 October 2014 (UTC)

Ping. Not sure what the outcome was. -Ad Orientem (talk) 20:11, 13 October 2014 (UTC)
 * I've blocked 94.193.130.0/23 for a week, as that shouldn't cause too much damage and that is the IP range that keeps coming back. I don't want to go longer without digging deeper.  The other IP is a /17, which I have the capability to block but that is a lot of hosts and I hesitate without doing more homework on that range.  Really, the purpose of this block is of course to prevent disruption, but also to see where he pops up next.  If you add to here, ping me.  I'm not very active, and not an SPI clerk, but since I was pinged here, I will follow up. Dennis 2&cent; 13:32, 10 October 2014 (UTC)
 * Thanks, I will CC you on any more activity related to this problem. -Ad Orientem (talk) 13:40, 10 October 2014 (UTC)
 * User:Ad Orientem, the outcome looks like DQ closed it from a lack of needing other stuff done. I blocked the one IP range for a week, if they come back using that same IP range, I can block it further (link me back to here, I'm old, I forget).  As for the other IP, they haven't edited since you filed this report.  I suspect it is the same user, but maybe he went to starbucks and edited from there, etc.  Not much else that can be done today.  If it continues, we can escalate the block duration, but I would have to look closer at how many good contribs come from that range first.  We'll cross that bridge then. Dennis 2&cent; 20:57, 13 October 2014 (UTC)