Wikipedia:Sockpuppet investigations/AzUrArInG/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Confession on Oshwah's TP: I'm sorry about TheAmazingHacker5555 and Sciencedude505, I just wanted to have fun making mean edits, but due to blocking the accounts I can't edit with my actual account called AzUrArInG from my Ipad mini and my Windows 7, I just wanted to do it for fun so I make them have a similar way to get blocked with swearing issues and more similar with old year edits as a joke, now I need it fixed so I can edit with my Ipad and windows 7 so I can use my normal account so I can edit good things with it, so now you know that Sciencedude505 and TheAmazingHacker5555 is me in disguise The amazinghacker5555 is not registered, so I think he misspelled the username L3X1 (distant write)  02:01, 28 April 2017 (UTC)
 * Update I have tried: TheAmazingHacker5555, …55555, …555, …55, …5, TheAmazingHacker, AmazingHacker55555, …5555, …555, …55, …5, no the and no numbers. All are unregistered. L3X1 (distant write)  17:05, 28 April 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Quack quack. 78.40.158.52 (talk) 06:42, 28 April 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * The editor has admitted to using sockpuppets for vandalism and trolling with the deliberate intention of being disruptive and getting blocked. I have blocked the master account indefinitely. It can, of course, be unblocked if the editor can persuade an administrator that similar vandalism and trolling will not be repeated. Sciencedude505 has already been blocked by Oshwah. The account TheAmazingHacker5555 does not exist, but the mention of that name by the sockmaster suggests that there may be another account with a name similar to that, presumably with that name containing an error, so perhaps a CheckUser can look for it. The editor who uses the pseudonym "JamesBWatson" (talk) 09:02, 28 April 2017 (UTC)
 * ✅ + . Tagged and closing.--Bbb23 (talk) 18:06, 28 April 2017 (UTC)

Suspected sockpuppets

 * Impersonators


 * AzUrArInG socks below


 * User compare report Auto-generated every hour.
 * Editor interaction utility

(This is a partial rewrite after my power went out and I only had some of it saved. :/ )

See this ANI thread. Also see User talk:AmyWeatherspoon63 (doppelganger) where they state "I will create more hoax articles and drafts about fictional amusement parks and attractions. My 2 accounts I created: my doppelganger and MothraFanGirl1763 is just the beginning. Enjoy your time here as I take a hiatus until March 15, 2018. Because when I come back, I'm gonna create more fictional and made-up amusement parks and attractions articles as well as drafts."

I backtracked the IPs that this person has used centered around their article subject interests and they all geolocate to the exact same place. In this article history, ScienceGuy101, a sock of AzUrArInG will revert his own IP which is in one of the same ranges of interest. A comparison of interests and edits are spot on but the easiest way to see they are the same is the message at User talk:KaijuFan557 which states their intention to keep socking much like the above. Notice also in a seperate occasion, AzUrArInG tags his own IP which was also in the same /64 range of interest.

He edits articles on reptiles, dogs and other animals as well as the obvious target articles. Example crossover of subjects showing same editor behind the IP editing Underworld and animals as seen in the first two lines. Sometimes they only edit animal articles so it might not always appear obvious when looking through his ranges. A study of the range contribs is required here to understand subject focus and the contribs are greater than 95% all him:


 * (Current IPv6 range)
 * (Previous IPv6 range)



The 68.208.127.8 address seems to be shared with an LTA or alternatively AzUrArInG is an account belonging to the LTA and he is impersonating that person who uses the name elsewhere. The LTA is made clear here and here also.

Based on this edit to an Italian monster movie in the midst of that IP's editing spurt and the sharing of common IP ranges and locale, I'm going to say that AzUrArInG is quite possibly Brunodam.

The first four socks above are not stale and may be checked against the master also. — Berean Hunter   (talk)  15:41, 29 September 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

, given the CU results below, It appears that the accounts listed below are all sockpuppets of another LTA master, Incorrigible Troll. They have all been CU-linked to a couple of "UCLA" accounts, which are known socks of Incorrigible Troll (see his SPI archives). Also look at the "Global Account Details" of each sock; they are all Globally Locked as accounts of Incorrigible Troll, as you can see here. It appears to be a large-scale impersonation and vandalism campaign. As such, I think that you should move this case to the SPI for Incorrigible Troll after it has closed, in order to prevent other users from being confused later on. LightandDark2000 (talk) 23:42, 6 October 2017 (UTC)
 * I'd like to mention that Incorrigible Troll also seems to be from a state in the eastern US (as evidenced in one of the blocked ranges he used in a recent case I filed at his SPI), but there were 2 suspect IPs with similar behavioral edits that located to the other side of the globe. That being said, those 2 IPs haven't been CU-linked, so it's possible that they were a different vandal or another sockmaster editing while logged out. AzUrArInG and Incorrigible Troll's IPs seem to geolocate to different US states, but I could be wrong and Incorrigible Troll could have access to more IPs (such as VPNs or Proxies). I would also like to say that a number of IPs and sock accounts you listed above aren't Incorrigible Troll socks (probably socks of AzUrArInG), but the vast majority of the accounts named are Incorrigible Troll accounts, as indicated in the CU results below. LightandDark2000 (talk) 23:48, 6 October 2017 (UTC)

Okay, is User:UnderArmourKid did Hurricane Irma an UnderArmourKid sock, or is it an Incorrigible Troll sock? I would also like a sleeper check done on this account as well, as I'm sick of these sockmasters running around and screwing up those articles. LightandDark2000 (talk) 00:02, 7 October 2017 (UTC)

I filed a separate report at Incorrigible Troll's SPI, using a truncated copy of this report for future reference.  Light and Dark2000  (talk) 01:54, 18 October 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  15:51, 29 September 2017 (UTC)
 * to confirm the first four accounts to the master and also to compare to Brunodam to see if this is him. Please locate alt accounts/sleepers of either along the way., I would also appreciate your input here as you probably know BD better than anyone.



— Berean Hunter   (talk)  12:55, 1 October 2017 (UTC) — Berean Hunter   (talk)  13:02, 1 October 2017 (UTC)
 * Additional socks created since this case was filed.
 * , did I get all of the ones that you referred to at ANI (thank you for reporting there btw).?

Looks like it Legacypac (talk) 07:50, 4 October 2017 (UTC) — Berean Hunter   (talk)  15:24, 5 October 2017 (UTC)
 * Please see my comment in the other case where I state that I think the accounts in this section belong to an impersonator.


 * Following accounts are ✅ to each other:
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)
 * They are to AzUrArInG (AzUrArInG seems to be from a different state in the US, but I'd take that technical info with a grain of salt). . Callanecc (talk • contribs • logs) 02:42, 6 October 2017 (UTC)

— Berean Hunter   (talk)  10:59, 11 October 2017 (UTC)
 * I've placed labels to separate the impersonator accounts from the accounts and IPs that are still likely AzUrArInG. Since much of the info there is correct to this named master, I suggest closing this case and archiving without moving. The CU data may be broke out for a separate filing.
 * ✅, closing. GABgab 02:41, 19 October 2017 (UTC)