Wikipedia:Sockpuppet investigations/By78/Archive

Report date September 18 2009, 01:00 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by Vedant

The user Beanpile has curiously supported By78's edits on several pages including the Arihant page and the Stock Market page. It is worth noting that By78 was encountering significant opposition from many users with regards to his often controversial edits. See beanpile's contributions page for more information  Vedant (talk) 00:54, 18 September 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users


 * Clerk, patrolling admin and checkuser comments

✅ these two users appear to be the same person. – Luna Santin  (talk) 17:30, 18 September 2009 (UTC)

Sock blocked indefintely, sockmaster blocked for 2 weeks on top of for disruption and edit-warring. MuZemike 17:37, 18 September 2009 (UTC)
 * Conclusions

Report date September 24 2009, 04:03 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by Vedant

Has resumed the pattern of disruptive edits for which he was banned. For more information see the user's contributions page. An IP trace reveals that the 70.62.185.149 IP is also from Ohio and the ISP is Road Runner High Speed (By78's original IP was 24.123.153.141 and that originated from Columbus, Ohio and the ISP was also Road Runner)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users


 * Clerk, patrolling admin and checkuser comments
 * ✅ as By78. Brandon (talk) 07:40, 24 September 2009 (UTC)


 * Conclusions

Evidence submitted by Vedant
Editing the same articles that By78 did and in many cases re-introduced the same controversial "evidence" he was blocked for.Vedant (talk) 17:41, 8 December 2009 (UTC)

Comments by accused parties
See Defending yourself against claims.

Conclusions
Sock indefinitely blocked and tagged, By78's blocked is now extended to indefinite. MuZemike 20:47, 8 December 2009 (UTC)

Evidence submitted by Vedant
Offender has used this IP address before to engage in disruption and trolling. A review of this IP's recent contributions will reveal he is engaging in disruption again. It is also worth noting that this user has already been blocked indefinitely for sockpuppet violation and ban evasion and should not be allowed to continue vandalizing the encyclopedia. Vedant (talk) 07:32, 29 January 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
Requested by Vedant (talk) 07:31, 29 January 2010 (UTC)

see below comment. SpitfireTally-ho! 15:44, 29 January 2010 (UTC)

no need for a check, the IP is clearly being used for block evasion, I recommend a block of around 3 months to let the point sink in. (see also Sockpuppet investigations/By78/Archive). Regards, SpitfireTally-ho! 15:44, 29 January 2010 (UTC)
 * has been blocked six months for evasion. Suggested that the IP request any unblock under his main account. EdJohnston (talk) 16:05, 29 January 2010 (UTC)

Evidence submitted by Vedant
The user has made edits to the following pages that EXACTLY mirror contributions made by his other banned accounts. In addition, a simple review of the user's IP should reveal that he is from the Columbus, OH area (the same area of By78 and his other sockpuppets).

List_of_fighter_aircraft High-speed_rail_in_India List_of_tallest_buildings_in_India

Vedant (talk) 02:13, 21 April 2010 (UTC)'

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
Requested by Vedant (talk) 02:13, 21 April 2010 (UTC)

identical area of interest to previous By78 socks, similar MO (i.e. extensive ES, etc) and editing times. Also noting that this is an older account that has only recently started to be used. Endorsing to check the link and run a sleeper check, please. Thanks, SpitfireTally-ho! 12:16, 21 April 2010 (UTC)

--Deskana (talk) 22:59, 21 April 2010 (UTC)
 * edits from an IP that is currently blocked anon-only for block evasion of user User:By78, so it seems reasonable to assume that Soupysoap = By78.
 * All users listed either edit from different states or different countries to the IP referenced above and each other.
 * ✅ that the following users are the same:
 * Soupysoap blocked. I left a brief note for Ao333 - despite being younger it is the much more active account - as I don't see any evidence of wrong-doing. ~ Amory ( u  •  t  •  c ) 15:56, 22 April 2010 (UTC)

22 February 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

''Please list evidence below this line. Remember to sign at the end of your section with 4 tilde characters " ~ "''

It's probably that the idiot has created a few more socks and it may be a good idea to run a CU on his account to check for other accounts. Vedant (talk) 05:18, 22 February 2011 (UTC)
 * Similar editing interests and policies such as articles related to India particularly High-speed rail in India and Poverty in India. Edits made by SoupySoap and other socks virtually mirror By78's contributions to these articles.
 * Also appears to have the same beliefs and prejudicial attitudes as By78 as evinced by edits and/or edit summaries like this, this and this

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. Note the same type of "censored" edits here and here.  Nakon  23:12, 23 February 2011 (UTC)

12 October 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.


 * Identical set of edits to pages such as Cryogenic_Rocket_Engine and India Tower from other sockpuppets as well as the main account
 * Geolocation of the IP address shows that it originates from the Columbus, OH area (the same location that By78 was editing from) 184.77.229.73 (talk) 08:20, 12 October 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * IP blocked 2 weeks. —  Hello Annyong  (say whaaat?!) 02:36, 13 October 2011 (UTC)

11 June 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same pattern of controversial edits on India-related topics including Indian Road Network, High-speed rail in India, Economy of India that closely mirror the contributions/positions of previously proven sockpuppets. Since the last block of 2 weeks didn't prevent the user from editing, perhaps a longer term block should be instituted (considering that the individual contributes from a static-IP). Vedant (talk) 03:35, 11 June 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked 1 year, closing. King of &hearts;   &diams;   &clubs;  &spades; 04:24, 11 June 2013 (UTC)

18 June 2013

 * Suspected sockpuppets



-
 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * Account DonitzLiebt was created on June 12, 2013 (the same day the anon made an edit to the article)
 * The Anon IP started making contributions ONE DAY after By78 was blocked for a year. It's likely he was able to evade the block by using an alternate IPv6 address that was not blocked.
 * http://www.traceroute6.net/ shows that the IP address does originate from some point in the United States on the AT&T network although exact geolocation is not possible at this time. I'd hardly be surprised if DonitzLiebt's account was created from the same IP (or from within the same range)
 * The Anon made an edit which mirrored By78's change to the article. Although this normally would not be suspicious, the time frame (one day after By78's block) and contribution log of the anon lends credence that this new IP started editing after By78's IPv4 address was blocked.


 * Vedant (talk) 04:34, 18 June 2013 (UTC)


 * I believe the reason the IP only started editing in 2013 was because he was previously editing from his IPv4 address. Being subject to a one year block, the offending user likely decided to edit from an alternate address (presumably a work computer or atlernate internet connection). Further, I think the partial revert by DonitzLiebt is part of a deliberate campaign of deception to distance the user from the anonymous IP. Although I cannot confirm, I suspect that a CU will reveal that DonitzLiebt was created from the same IP that is referenced in the case. I also think it is rather suspicious that DonitzLiebt was created the same day that the IPv6 address started editing (which is only 1 day after By78's IPv4 address was blocked). Vedant (talk) 07:32, 19 June 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Are you sure you have that correct? DonitzLiebt undid the IP's edits, and also the IP only started editing in 2013. King of &hearts;   &diams;   &clubs;  &spades; 03:07, 19 June 2013 (UTC)
 * IPv6 is AT&T vs. previous IPv4 being Time Warner, plus no other evidence to definitively link these accounts at this time. Closing without action. Dennis Brown &#124; 2¢ &#124; © &#124;  WER  18:52, 24 June 2013 (UTC)