Wikipedia:Sockpuppet investigations/Atac2/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

The master account was committing vandalism with addition of false information to various articles by adding "Ron Merkle" to them, including the Scientology article. The Santana Smooth account has repeated the same addition in Scientology.

The master account repeatedly made this edit which is did not have the name in the source and is likely false information. The Julius Al Mohammed account has made a similar edit.

The Jamal Tyrones account added deliberate false information (SF and LA are in the same coast) to the article which mentions "Ron Merkle". This might be a legit Ron Merkle as it is information from years back in the article history.

Note: Only the Julius Al Mohammed account seems to have been created after user:Widr blocked Atac2, so it would not be surprising if there are other accounts. Whpq (talk) 18:00, 13 December 2021 (UTC)


 * It looks like some IP accounts, like User:2A00:23C7:84A7:4B01:4464:BD16:CF63:3C25, have picked up on the vandalism. Liz Read! Talk! 02:41, 14 December 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * -  Girth Summit  (blether)  18:46, 13 December 2021 (UTC)
 * Santana's Smooth and Julius Al Mohammed are both ✅ to Atac2. The other account doesn't appear to be related, technically at least.  Girth Summit  (blether)  18:54, 13 December 2021 (UTC)
 * Jamal hasn't edited in over a month, so a block would not be in compliance with WP:BP. I'll close this; please file another report if disruption persists. -- RoySmith (talk) 00:28, 17 December 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Previous socks were inserting the name "Ron Merkle" into various articles. Same behaviour including adding teh assertion of a gyrocopter record for coast-to-coast speed when the starting and ending cities are on the same coast. Plus the user name. Is Sockpuppet investigations/Molotov Cock related to this? Whpq (talk) 13:02, 7 January 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Yes, seems a duck. Compare , indirectly .  In the future please link diffs from both accounts, not just the suspected sock. Normally I wouldn't care whether this is a sock or just some related VAO, but with an eye to Drmies statement at Sockpuppet investigations/Molotov Cock/Archive, and noting the Merkle connection on usernames and edits like this,  to see if this ties back to a known LTA.  --  Tamzin  [ cetacean needed ] (she/they) 14:49, 7 January 2022 (UTC)
 * User:Tamzin, User:Whpq, I haven't found an "original" but a range that includes Ron Merkle IV and Molotov Cock coughs up a few other already blocked socks: ILoveMarvel223, Squid Games, RonMerklefeller Skank, Ron Merkle's Nephew, Quart Games, Ron Merkle III. They seem to use proxies that are all over the place to make these accounts, and there's little that I can do about it. Maybe a better CU can figure out whether there are ranges that can be hardblocked... Drmies (talk) 15:07, 7 January 2022 (UTC)
 * Just clarifying, I've set this to endorsed since I'd forgotten to do so originally and since Drmies' response seems to request further CU attention. --  Tamzin  [ cetacean needed ] (she/they) 15:41, 7 January 2022 (UTC)
 * Blocking Ron Merkle IV per off-wiki conversation with Tamzin. -- RoySmith (talk) 20:12, 7 January 2022 (UTC)
 * I have Ron Merkle IV == == . Could be Molotov, I similar ranges and UAs but never see them on the same IP. I wouldn't dare call myself "better" than Drmies, but I see a couple small rangeblocks that can be made (won't get everything, but it might slow them down a bit). GeneralNotability (talk) 17:39, 9 January 2022 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

These accounts were connected to previous socks through checkuser and technical evidence. I'm creating this SPI retro-actively for record-keeping and accountability purposes. The accounts are blocked and tagged, and this SPI report will be filed as 'closed'.  ~Oshwah~  (talk) (contribs)   00:21, 10 January 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * }
 * These accounts are already blocked and tagged, and this SPI is already closed. No further action is needed here (short of archiving, of course)...  ~Oshwah~  (talk) (contribs)   00:24, 10 January 2022 (UTC)
 * }
 * These accounts are already blocked and tagged, and this SPI is already closed. No further action is needed here (short of archiving, of course)...  ~Oshwah~  (talk) (contribs)   00:24, 10 January 2022 (UTC)
 * These accounts are already blocked and tagged, and this SPI is already closed. No further action is needed here (short of archiving, of course)...  ~Oshwah~  (talk) (contribs)   00:24, 10 January 2022 (UTC)
 * These accounts are already blocked and tagged, and this SPI is already closed. No further action is needed here (short of archiving, of course)...  ~Oshwah~  (talk) (contribs)   00:24, 10 January 2022 (UTC)
 * These accounts are already blocked and tagged, and this SPI is already closed. No further action is needed here (short of archiving, of course)...  ~Oshwah~  (talk) (contribs)   00:24, 10 January 2022 (UTC)
 * These accounts are already blocked and tagged, and this SPI is already closed. No further action is needed here (short of archiving, of course)...  ~Oshwah~  (talk) (contribs)   00:24, 10 January 2022 (UTC)
 * These accounts are already blocked and tagged, and this SPI is already closed. No further action is needed here (short of archiving, of course)...  ~Oshwah~  (talk) (contribs)   00:24, 10 January 2022 (UTC)
 * These accounts are already blocked and tagged, and this SPI is already closed. No further action is needed here (short of archiving, of course)...  ~Oshwah~  (talk) (contribs)   00:24, 10 January 2022 (UTC)
 * These accounts are already blocked and tagged, and this SPI is already closed. No further action is needed here (short of archiving, of course)...  ~Oshwah~  (talk) (contribs)   00:24, 10 January 2022 (UTC)
 * These accounts are already blocked and tagged, and this SPI is already closed. No further action is needed here (short of archiving, of course)...  ~Oshwah~  (talk) (contribs)   00:24, 10 January 2022 (UTC)


 * Does the last one need to be tagged? --  Tamzin  [ cetacean needed ] (she/they) 00:25, 10 January 2022 (UTC)
 * Tamzin - Good catch! Thank you - Yes, and ✅. :-)  ~Oshwah~  (talk) (contribs)   00:28, 10 January 2022 (UTC)

Suspected sockpuppets


While both accounts were already blocked today — the sock by and the presumed puppeteer by  — the sock turned out to be a month-old sleeper. Therefore, I would like to use this SPI to request a CheckUser to look for further sleepers. IceWelder &#91; &#9993; &#93; 21:26, 2 March 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - page-move vandalism like this indicates that this is probably someone with prior experience. Please check for other accounts. Thanks, Spicy (talk) 23:53, 2 March 2022 (UTC)
 * - -- RoySmith (talk) 00:26, 3 March 2022 (UTC)
 * All of these are ✅ to each other: -- RoySmith (talk) 00:40, 3 March 2022 (UTC)
 * Actually, the M* accounts are logged in CU, but failed creation due to filter 887 -- RoySmith (talk) 00:44, 3 March 2022 (UTC)
 * - Looks like this needs to be merged with Atac2. Could a clerk please sort out the merge then ping me and I'll get all the checkuser-block stuff done up right. -- RoySmith (talk) 00:47, 3 March 2022 (UTC)
 * ✅ (moved from Sockpuppet investigations/TheMerk205). GABgab 23:35, 11 March 2022 (UTC)
 * Blocking and tagging -- RoySmith (talk) 23:48, 11 March 2022 (UTC)

Suspected sockpuppets
"Ron Merkle" nonsense like multiple other socks:

Requesting CheckUser for sleeper check. Edits by these socks often go unnoticed, so I need to know whether there are currently unknown puppets. IceWelder &#91; &#9993; &#93; 16:03, 26 June 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Behaviourally, this looks like a match, so I am blocking and tagging as suspected. I've looked at the CU records, and I don't see any other accounts. I actually wonder whether this account was hijacked - this account was created in 2012, and made a single edit (which was vandalism). The CU data shows attempts to log into a bunch of old, abandoned accounts. This was the only success that I saw - perhaps the password was just 'password' or similar, and easily guessable, but once it had been accessed, the Ron Merkle nonsense started. Use strong passwords, folks. Girth Summit  (blether)  17:50, 26 June 2022 (UTC)

Suspected sockpuppets
"Ron Merkle" nonsense once again. The former account was already active in May, before I last requested a sleeper check, which apparently came up empty-handed. The user is active from an IP range as well (Special:Contributions/2001:14bb::/37) with IPs changing multiple times a day. Maybe a range block is in order. Can a user be prevented from logging in on a blocked range? IceWelder &#91; &#9993; &#93; 18:08, 16 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I am not Atac2. — Preceding unsigned comment added by The Lord Above (talk • contribs) 01:58, 17 July 2022 (UTC) Huh. General Kerr Melon (talk) 07:11, 18 July 2022 (UTC)
 * You unfortunately had to deal with several socks this night. What do you think about the few I listed above that have not yet been blocked, as well as the IP range? IceWelder  &#91; &#9993; &#93; 06:22, 18 July 2022 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
It's difficult to be specific, but these are all apparently related to each other. Going mostly by behaviour, Atac looks about right. I've blocked about 30 related accounts, using various levels of confirmation to other accounts. Most are compromised. Many are on proxies. -- zzuuzz (talk) 22:25, 18 July 2022 (UTC)

Suspected sockpuppets
"Merkle" vandalism including page moves, plus. --Blablubbs (talk) 21:53, 21 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. given the extensive history of sleepers.  --Blablubbs (talk) 21:53, 21 July 2022 (UTC)
 * - -- RoySmith (talk) 22:03, 21 July 2022 (UTC)
 * Ashpokeman is ✅ to several socks from 16 July 2022 and a few sock-blocked accounts that I don't see listed in the archive. The only sleeper I see is . -- RoySmith (talk) 22:23, 21 July 2022 (UTC)

Suspected sockpuppets
. Sleeper check requested like always. IceWelder &#91; &#9993; &#93; 07:19, 22 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Confirmed. Other compromised accounts: -- zzuuzz (talk) 07:58, 22 July 2022 (UTC)


 * FWIW, Jamieis8 is now the oldest account, but I don't know if there's any value in renaming the case. -- RoySmith (talk) 12:23, 22 July 2022 (UTC)
 * I don't think so. We've gotten a new oldest account since this one was discovered, and there will probably be more down the line (and I'm not a huge fan of having compromised accounts listed as masters anyway). --Blablubbs (talk) 05:45, 23 July 2022 (UTC)


 * I just blocked as VOA, but I suspect they are part of this group. I've requested CU. The account is very old, but their first edit was right after the last check.--Bbb23 (talk) 00:05, 23 July 2022 (UTC)
 * Yes, same party. These accounts have been compromised:

-- zzuuzz (talk) 00:49, 23 July 2022 (UTC)


 * . --Blablubbs (talk) 08:15, 23 July 2022 (UTC)

Suspected sockpuppets
. Already blocked but reported for tagging and CU. IceWelder &#91; &#9993; &#93; 08:18, 23 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

There is another account, AngelaMerkelFan. I saw it at WP:ANI. Quandane Dingle (talk) 08:58, 23 July 2022 (UTC)


 * Noting Quandane Dingle, renamed to  is check user blocked. Deepfriedokra (talk) 19:17, 23 July 2022 (UTC)
 * But not part of this sock farm.--Bbb23 (talk) 20:32, 23 July 2022 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Clearly related. - For another sleeper check given how active they've been recently. --Jack Frost (talk) 08:52, 23 July 2022 (UTC)
 * There is an active ANI thread and I've noted from that thread for posterity (thankyou ). Also noting Sockpuppet investigations/Molotov Cock appears to be the same user as this one.  As a courtesy. --Jack Frost (talk) 09:11, 23 July 2022 (UTC)
 * Salvio 09:25, 23 July 2022 (UTC)

Suspected sockpuppets
. Requesting sleeper check yet again. IceWelder &#91; &#9993; &#93; 18:26, 24 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Confirmed, near enough. . -- zzuuzz (talk) 18:40, 24 July 2022 (UTC)

Suspected sockpuppets
Account evidently compromised today. , . Requesting check for other compromises by the same master. (Guessing you might also find a lot of failed login attempts against some accounts.) --  Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 07:15, 29 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * . --  Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 07:15, 29 July 2022 (UTC)


 * Confirmed to Atac2, confirmed to be a likely compromise, . -- zzuuzz (talk) 07:32, 29 July 2022 (UTC)

Suspected sockpuppets
Another clear compromise. This one doesn't have the same obvious method of compromise as the last one. . . CU requested for sleepers again. -- Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 02:42, 30 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * -- Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 02:42, 30 July 2022 (UTC)
 * Checked this earlier. Nothing else to be done. -- Amanda (she/her)  08:18, 30 July 2022 (UTC)

Suspected sockpuppets
Already blocked; reporting for tagging and sleeper check. IceWelder &#91; &#9993; &#93; 08:43, 30 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * since we've already had a sleeper check in the past few hours. And I'm gonna decline to tag, seems like Atac likes the attention. Closing. --  Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 09:35, 30 July 2022 (UTC)

Suspected sockpuppets
More compromised accounts. IceWelder &#91; &#9993; &#93; 08:56, 31 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * . . for sleeper check, particuarly in light of Special:Redirect/logid/134593165.  --  Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 09:03, 31 July 2022 (UTC)
 * Compromised accounts locked and sleeper CUblocked by Amanda. Closing. --  Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 09:18, 31 July 2022 (UTC)

Suspected sockpuppets

 * ( originally filed under this user)

Both have exceedingly long usernames, both accounts first edits were to their user page adding dashes in 9 edits then blanking them (obvious attempt to game the system for autoconfirmed status) Lavalizard101 (talk) 11:38, 31 July 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * One more:
 * "Alone.." is the oldest. (lyrics) 0x Deadbeef 15:32, 31 July 2022 (UTC)
 * "Alone.." is the oldest. (lyrics) 0x Deadbeef 15:32, 31 July 2022 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - considering the obvious autoconfirmed gaming, a check for other accounts and/or an older master seems like a good idea. Thanks, Spicy (talk) 18:59, 31 July 2022 (UTC)
 * All three accounts are ✅ to . . Please merge this case to Sockpuppet investigations/Atac2. Thanks, Mz7 (talk) 19:14, 31 July 2022 (UTC)
 * Thanks. Merged, closing. Spicy (talk) 19:18, 31 July 2022 (UTC)

Suspected sockpuppets
'nother compromise. Already locked. CU for sleepers. -- Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 04:30, 1 August 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * -- Tamzin  [ cetacean needed ] (she&#124;they&#124;xe) 04:30, 1 August 2022 (UTC)
 * Doesn't look like anything more. -- Amanda (she/her)  09:21, 1 August 2022 (UTC)

Suspected sockpuppets
. Sleeper check requested as usual. IceWelder &#91; &#9993; &#93; 19:44, 13 August 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments
Confirmed, compromised. Several glocks requested. -- zzuuzz (talk) 21:57, 13 August 2022 (UTC)

Suspected sockpuppets
Duck. Sleeper check please. IceWelder &#91; &#9993; &#93; 21:08, 16 August 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments
Confirmed to this previous sock. . -- zzuuzz (talk) 21:19, 16 August 2022 (UTC)

Suspected sockpuppets
This user has just created 49 pages about a Ronald Merkle with the ever so slightest variations in the same. Seems likely that based on the Ronald Merkle spam they're this sockpuppeteer. Hey man im josh (talk) 16:29, 29 August 2022 (UTC)


 * For those who are as confused as I was, the "slightest variations" consist of things like using an upper case "I" in place of a lower case "l", which looks identical in some fonts. -- RoySmith (talk) 16:36, 29 August 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * The account is now indeffed. Tagging and closing. Bbb23 (talk) 16:37, 29 August 2022 (UTC)
 * We edit-conflicted, but ✅ to Atac2. And, wow, going back to 2009!  Probably worth a case rename. -- RoySmith (talk) 16:47, 29 August 2022 (UTC)
 * I strongly advise against renaming. They keep compromising old accounts (there's one in the archive that was created in 2001), so we might be moving and retagging quite frequently. It would also be fairly confusing if the original owners regain access to their accounts. --Blablubbs (talk) 16:52, 29 August 2022 (UTC)
 * Actually, you previously identified a lot of Atac2 socks as compromised accounts.  Maybe this is another of those?  I'm still a little hazy on how to spot compromises, but you seem to have it figured out. -- RoySmith (talk) 16:54, 29 August 2022 (UTC)
 * @Blablubbs, as is often the case, I see you were one step ahead of me :-) -- RoySmith (talk) 16:55, 29 August 2022 (UTC)
 * Definitely compromised, and I'll just mention that I/we blocked/glocked a bunch of Atac2/compromised accounts earlier today. I'll drop you an email later. But for now, if it's older than a few months and spouting merkle, assume it's compromised. -- zzuuzz (talk) 17:13, 29 August 2022 (UTC)

Suspected sockpuppets
Leonidlednev (talk) 03:00, 29 August 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * This is Sockpuppet investigations/Atac2, as mentioned in the block log for the 'master' account(!). No real point merging there I don't think. Recommend G6 in lieu of anything else. Closing. firefly  ( t · c ) 11:09, 29 August 2022 (UTC)
 * Moved to Atac2 and will G6 Sockpuppet investigations/Ron Merkle (signatures will provide sufficient attribution in this circumstance and there is no value in retaining that page otherwise). . Closing. --Jack Frost (talk) 07:48, 30 August 2022 (UTC)

Suspected sockpuppets
More insertion of 'Ron Merkle' into articles:,. Also, 'Return of the Merkle' suggests it's not this user's first rodeo. ◇  Helen   Degenerate  ◆ 18:27, 3 December 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Now blocked. Spicy (talk) 21:31, 3 December 2022 (UTC)

Suspected sockpuppets
. WP:DUCK ◇  Helen   Degenerate  ◆ 21:01, 21 December 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I wholeheartedly disagree with this rude accusation. Ach afri ke (talk) 21:08, 21 December 2022 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked, closing. Bbb23 (talk) 21:12, 21 December 2022 (UTC)

Suspected sockpuppets
IceWelder &#91; &#9993; &#93; 21:47, 21 December 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked, closing. Bbb23 (talk) 22:05, 21 December 2022 (UTC)

Suspected sockpuppets
,  IceWelder  &#91; &#9993; &#93; 21:48, 21 December 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked, closing. Bbb23 (talk) 22:06, 21 December 2022 (UTC)

Suspected sockpuppets
More Ron Merkle nonsense. I've already blocked the account but a check for sleepers may be in order. Whpq (talk) 13:50, 22 December 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments
Confirmed, along with the following, who currently need a glock: -- zzuuzz (talk) 11:31, 24 December 2022 (UTC)