Wikipedia:Sockpuppet investigations/Andreas2009/Archive

Evidence submitted by Dr.K.
Started edit-warring a few days after Andreas2009 was indeffed by Sandstein and doing exactly the same type of reversions that Andreas2009 did. Same type of edits overall. WP:DUCK is invoked. Dr.K. λogosπraxis 18:23, 2 November 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
✅ TN X Man  18:41, 2 November 2010 (UTC)
 * Blocked/tagged Sh i r ik  ( Questions or Comments? ) 18:44, 2 November 2010 (UTC)

Evidence submitted by Seb az86556
SPA. edit summary Please respect Information and pictures I collected about Nicosia from the Municipality. Pictures in question uploaded by Andreas2009, also SPA, currently blocked, as is previous sock (Special:Contributions/Austria12).

Apply WP:DUCK. Choyoołʼįįhí:Seb az86556 > haneʼ 13:09, 13 November 2010 (UTC)

Auto-generated every six hours.
 * User compare report

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
✅ and  TN X Man  18:13, 13 November 2010 (UTC)
 * Tagged and blocked. —  Hello Annyong  (say whaaat?!) 18:30, 13 November 2010 (UTC)

11 December 2010

 * Suspected sockpuppets




 * User compare report Auto-generated every six hours.

Evidence submitted by Seb az86556
Shows the same obsession with restoring and sorting images on Nicosia, Belgrade, and others &mdash; as did and previous socks  and. Claims to know my reputation after a few edits. Now starts talking about some "Turkish investigation". Choyoołʼįįhí:Seb az86556 > haneʼ 10:33, 11 December 2010 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
✅. TN X Man  14:58, 11 December 2010 (UTC)
 * Blocked and tagged. —  Hello Annyong  (say whaaat?!) 15:14, 11 December 2010 (UTC)

11 December 2010

 * Suspected sockpuppets


 * User compare report Auto-generated every six hours.

''Please list evidence below this line. Remember to sign at the end of your section with 4 tilde characters " ~ "''

Hit Nicosia at about the same time as blocked sock User:AmericanFe. Clear case of WP:DUCK. Dr.K. λogosπraxis 16:13, 11 December 2010 (UTC)

Reply to closing admin: Thank you very much HelloAnnyong. I agree. Will do. Take care. Dr.K. λogosπraxis 22:40, 11 December 2010 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I'm closing this for now, as the IP hasn't been active in a few days, and if it's the same editor, the autoblock _should_ kick in. But if the IP becomes active again, let me know and we'll take care of it. —  Hello Annyong  (say whaaat?!) 22:12, 11 December 2010 (UTC)

08 January 2011

 * Suspected sockpuppets


 * User compare report Auto-generated every six hours.

''Please list evidence below this line. Remember to sign at the end of your section with 4 tilde characters " ~ "''

Same MO, articles and edits. WP:DUCK in its purest form. Dr.K. λogosπraxis 20:03, 8 January 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked and tagged per WP:DUCK. —  Hello Annyong  (say whaaat?!) 16:24, 9 January 2011 (UTC)

06 February 2011

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

''Please list evidence below this line. Remember to sign at the end of your section with 4 tilde characters " ~ "''

The usual. Same MO, articles, type of edits. Preoccupied with removing pictures of mosques from the Cyprus article. Fowl play suspected. Dr.K. λogosπraxis 22:41, 6 February 2011 (UTC)


 * The CU request is a good idea. Thank you HelloAnnyong. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis  01:09, 7 February 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked and tagged per WP:DUCK, but I'm adding a CU to check for sleepers. It's been awhile since we've seen anything from this user, so I wonder if there's anything out there. —  Hello Annyong  (say whaaat?!) 01:04, 7 February 2011 (UTC)
 * No sleepers. TN <b style="color:midnightblue; font-size:larger;">X</b> Man  03:59, 7 February 2011 (UTC)

19 February 2011

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

''Please list evidence below this line. Remember to sign at the end of your section with 4 tilde characters " ~ "''

The customary. Unyielding preoccupation with removing pictures of Mosques from the Cyprus article. Another WP:DUCK just entered the pond. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis 18:28, 19 February 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * IP blocked 1 month for evasion. —  Hello Annyong  (say whaaat?!) 20:31, 19 February 2011 (UTC)

10 June 2011

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

''Please list evidence below this line. Remember to sign at the end of your section with 4 tilde characters " ~ "''

These seem like new socks of Andreas 2009. IP 87.228.183.50 is similar to IP which was reported last year at  the Andreas 2009 SPI archive. The reported IP 87.228.183.50 has become recently active in Cyprus-related articles as well as vandalising Seric2's userpage. Giorgoos has followed a similar pattern of behaviour. WP:DUCK in effect. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis 07:01, 10 June 2011 (UTC) Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis 13:02, 10 June 2011 (UTC)
 * Thank you HelloAnnyong. I agree completely. Take care.
 * I just found IP 93.109.133.131 and added it to the report. Pattern very close to Andreas2009. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis 13:11, 10 June 2011 (UTC)
 * Thank you DQ, TNXMAN and HelloAnnyong. I also think we are done. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis 17:21, 11 June 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Based on the similarity of these three edits, I've blocked Giorgoos as a sock. (And if not, they're being disruptive anyway.) I had previously blocked the IP for evasion, but now it's blocked again for three months. —  Hello Annyong  (say whaaat?!) 12:34, 10 June 2011 (UTC)
 * Alright, this is now getting to be a pain. I'm endorsing for clarification with the two named accounts here. —  Hello Annyong  (say whaaat?!) 13:24, 10 June 2011 (UTC)
 * ✅ that and  are the same. They are using the same range I checked in December for this case, so that would seem to indicate a connection to previous accounts. Giorgoos is using a mobile IP in a different country.  TN <b style="color:midnightblue; font-size:larger;">X</b> Man  15:20, 10 June 2011 (UTC)
 * Well.. oops. I've changed Giorgoos' block to 3 days for edit warring. —  Hello Annyong  (say whaaat?!) 15:57, 10 June 2011 (UTC)
 * Seems like were already done here to me. -- DQ  (t)   (e)  02:01, 11 June 2011 (UTC)

19 June 2011

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

This account, according to their disruptive MO, belongs to the family of the Andreas2009 socks and more particularly they may well be connected to. WP:QUACK in effect. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis 16:02, 19 June 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Endorsing for some form of confirmation, though I think all the master's socks have gone stale. At the very least, we can see if this is Strovolos and also maybe . —  Hello Annyong  (say whaaat?!) 20:01, 19 June 2011 (UTC)

✅ as Andreas2009:



Underlying IP is now hardblocked. –MuZemike 10:14, 20 June 2011 (UTC)
 * All seems to be done here, archiving. Steven Zhang  <sup style="color:#FFCC00;">The clock is ticking....  11:24, 22 June 2011 (UTC)

04 September 2011

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

The usual. This editor has run afowl of WP:3RR many times in the usual article. His other contribs also suggest a correlation to the sockmaster. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis 14:10, 4 September 2011 (UTC) Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis  14:10, 4 September 2011 (UTC)


 * Excellent work Keegan. Thank you HelloAnnyong, Seb, KuduIO. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis 06:29, 5 September 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

We have a whole range of possible other sockpuppets; I'm throwing in as that one is the most suspicious. Choyoołʼįįhí:Seb az86556 > haneʼ 14:24, 4 September 2011 (UTC)
 * and are Cyberduck icon.png ducks.  is a Cyberduck icon.png likely  duck. Andreas2009 is . — <span style="font-family: Georgia, Garamond, serif;"> Kudu  ~I/O~ 15:11, 4 September 2011 (UTC)
 * Out of curiosity how did you determine that Andreas2009 is a stale IP without having the tools of a CU? Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis 15:35, 4 September 2011 (UTC)
 * He didn't; that was probably based on behavior. Blocks/tags shouldn't be issued based on Kudu's post. —  Hello Annyong  (say whaaat?!) 15:52, 4 September 2011 (UTC)
 * Thank you HelloAnnyong. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis 15:58, 4 September 2011 (UTC)
 * As discussed on my talk page, I knew Andreas2009 was stale because a user's contributions go stale after 3 months of data retention. — <span style="font-family: Georgia, Garamond, serif;"> Kudu ~I/O~ 22:58, 4 September 2011 (UTC)
 * I replied on your talk but it was your use of the tag that triggered my query. I also thought that sockmasters abandon their original accounts in favour of the newer sock accounts. So a sockmaster account going stale was to be expected. But for the purposes of an SPI the original sockmaster SPI and its archives are used for all the subsequent incidents. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis  23:11, 4 September 2011 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * . It's all likely, but CU can confirm it, as well as find any sleepers. —  Hello Annyong  (say whaaat?!) 15:52, 4 September 2011 (UTC)
 * ✅ socking.  is:
 * Underlying IP blocked. Keegan (talk) 05:55, 5 September 2011 (UTC)
 * I also found related blocks to and .  There is an edit summary for one of the accounts saying "we", so there is a good chance this is off-wiki, work related editing by different parties.  Technical evidence pretty much ties them to the same network/computer.  Keegan (talk) 06:00, 5 September 2011 (UTC)
 * Holy crap! even more socks than I counted... Choyoołʼįįhí:Seb az86556 > haneʼ 06:39, 5 September 2011 (UTC)
 * Underlying IP blocked. Keegan (talk) 05:55, 5 September 2011 (UTC)
 * I also found related blocks to and .  There is an edit summary for one of the accounts saying "we", so there is a good chance this is off-wiki, work related editing by different parties.  Technical evidence pretty much ties them to the same network/computer.  Keegan (talk) 06:00, 5 September 2011 (UTC)
 * Holy crap! even more socks than I counted... Choyoołʼįįhí:Seb az86556 > haneʼ 06:39, 5 September 2011 (UTC)
 * Underlying IP blocked. Keegan (talk) 05:55, 5 September 2011 (UTC)
 * I also found related blocks to and .  There is an edit summary for one of the accounts saying "we", so there is a good chance this is off-wiki, work related editing by different parties.  Technical evidence pretty much ties them to the same network/computer.  Keegan (talk) 06:00, 5 September 2011 (UTC)
 * Holy crap! even more socks than I counted... Choyoołʼįįhí:Seb az86556 > haneʼ 06:39, 5 September 2011 (UTC)
 * Underlying IP blocked. Keegan (talk) 05:55, 5 September 2011 (UTC)
 * I also found related blocks to and .  There is an edit summary for one of the accounts saying "we", so there is a good chance this is off-wiki, work related editing by different parties.  Technical evidence pretty much ties them to the same network/computer.  Keegan (talk) 06:00, 5 September 2011 (UTC)
 * Holy crap! even more socks than I counted... Choyoołʼįįhí:Seb az86556 > haneʼ 06:39, 5 September 2011 (UTC)


 * All accounts blocked and tagged and IP has already been blocked by Keegan. &mdash; Spaceman  Spiff  06:44, 5 September 2011 (UTC)

24 September 2011

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

I present the clear evidence provided by fowl play. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis 07:41, 24 September 2011 (UTC)


 * Thank you HelloAnnyong. Good catch regarding the Giorgis 2011 connection. For sure, this is not an easy case. But the preponderance of the existing evidence of editing behaviour has enough alarms going off to point toward fow(u)l play, at least IMO. I was hesitant to start this, given the existing dissimilarities. But what clinched it was this: diff. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis  14:27, 24 September 2011 (UTC)


 * And now we have this: diff2. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis 14:32, 24 September 2011 (UTC)


 * Another great outcome from the SPI department regarding the sleepers. I am surprised about Marcobadotti, but since the evidence is not there there is not much we can do. Excellent work. Thank you very much Mailer diablo, HelloAnnyong. Take care. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis 00:43, 25 September 2011 (UTC)


 * Thank you HelloAnnyong. Since the primary didn't pan out, next time we have to go through ANI or AIV. Dr.K. <sup style="position:relative">λogos<span style="position:relative;bottom:-2.0ex;left:-5.2ex;*left:-5.5ex">πraxis 16:47, 25 September 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Hmm.. I don't know. This is a really old account (dating back to 2006) that initially went inactive in August 2009. For it to suddenly come back and edit in such quantity is rather suspicious, so I'll endorse to look into this, I guess, as well as to find any sleepers since the last time we checked. —  Hello Annyong  (say whaaat?!) 13:48, 24 September 2011 (UTC)
 * Actually, an update. Marcobadotti's first edit back was to add two images that were uploaded to Commons by, who was blocked here as a sock of . It should still be possible to run a checkuser on both of those accounts to see if there's a connection. —  Hello Annyong  (say whaaat?!) 13:52, 24 September 2011 (UTC)
 * technically seems . - Mailer Diablo 00:36, 25 September 2011 (UTC)
 * But uncovered the following sleepers ✅ :
 * I've blocked all of them. - Mailer Diablo 00:11, 25 September 2011 (UTC)
 * Don't close this just yet; I've asked Diablo for clarification. —  Hello Annyong  (say whaaat?!) 02:37, 25 September 2011 (UTC)
 * Diablo told me that it's unlikely related to both, so.. I guess we can close for now. —  Hello Annyong  (say whaaat?!) 04:40, 25 September 2011 (UTC)
 * I've blocked all of them. - Mailer Diablo 00:11, 25 September 2011 (UTC)
 * Don't close this just yet; I've asked Diablo for clarification. —  Hello Annyong  (say whaaat?!) 02:37, 25 September 2011 (UTC)
 * Diablo told me that it's unlikely related to both, so.. I guess we can close for now. —  Hello Annyong  (say whaaat?!) 04:40, 25 September 2011 (UTC)
 * I've blocked all of them. - Mailer Diablo 00:11, 25 September 2011 (UTC)
 * Don't close this just yet; I've asked Diablo for clarification. —  Hello Annyong  (say whaaat?!) 02:37, 25 September 2011 (UTC)
 * Diablo told me that it's unlikely related to both, so.. I guess we can close for now. —  Hello Annyong  (say whaaat?!) 04:40, 25 September 2011 (UTC)