Wikipedia:Sockpuppet investigations/Clarify29/Archive

15 March 2011

 * Suspected sockpuppets


 * already blocked (added by AussieLegend)
 * already blocked (added by AussieLegend)
 * already blocked (added by AussieLegend)
 * only 2 edits, not yet blocked (added by AussieLegend)
 * sleeper account, no edits, not yet blocked (added by AussieLegend)
 * already blocked
 * (Clarify29, who is already blocked, was created between Clarify27 and Clarify 25)
 * already blocked
 * now blocked


 * User compare report Auto-generated every hour.

''Please list evidence below this line. Remember to sign at the end of your section with 4 tilde characters " ~ "''

Initially I intended this case to be for Clarify255, but then I noticed Sock on Clarify27's talk page indicating such account as a suspected sock of Clarify29, and so I am creating this discussion as such. Here we have three similar usernames, of which Clarify27 and Clarify29 have been indefinitely blocked within three minutes of each other on March 11. Clairify255 and Clarify27 have a similar editing pattern in that the user adds unnecessary links on the article "The Penguins of Madagascar: Operation: DVD Premiere," as evidenced here and beginning here with four successive edits thereafter. Sgt. R.K. Blue (talk) 02:39, 15 March 2011 (UTC)
 * After creating this report, I also discovered User:Clarify25, also indefinitely blocked. I've added it to the above. --Sgt. R.K. Blue (talk) 02:52, 15 March 2011 (UTC)

I have no doubt at all that these accounts belong to a long-term vandal that I reported to ANI back in December 2010.

In early December various IPs from the 108.32.0.0/12 and 108.17.96.0/20 pools, both of which are allocated to Verizon, began sneakily vandalising various articles. Typical traits include, but are not limited to:
 * changing random words(e.g "blond" to "light Eru brown")
 * gratuitously adding wikilinks to random words
 * randomly changing individual words and wikilinking them
 * indiscriminately changing some links (eg "running gag" to "running gag" )
 * changing female names to "Chanel" or variations, such as "Chantelle". This was a common trait in the early vandalism but it has also been seen in later edits.

The vandal has also periodically identified herself as "Gabby", which has also been reflected in accounts that have been registered, such as User:729gabby. Edits adding "Gabby" to articles have also been seen.

On 18 December I raised the issue at ANI. The discussion is now archived at Administrators' noticeboard/IncidentArchive658. The outcome of that discussion was that any instances of vandalism by the IPs was to be reverted, the IP given a level 4 or 4im vandalism warning and then be reported to KrakatoaKatie, who graciously offered to handle all reports. Unfortunately, KrakatoaKatie contracted a serious bout of the flue back in January and hasn't returned since 22 January, so I've been reporting all instances to WP:AIV.

A WP:ABUSE report was raised on 5 January at Abuse response/108.32.x.x

On 9 January the IP registered its first known account, User:729gabby (technically this report should probably be moved to reflect this as Clarify29 is technically a sock of 729gabby.) A number of accounts have been added since then and, for record purposes, I've added these in chronological order to the list above. Of all the accounts created to date, only Bad523, Bad729 and Clarify255 have not been blocked. Bad523 has only made two edits, but adding "Chanel" to an article that has previously (and since) been vandalised by the vandal makes it obvious that it is a sock. Bad729 has never edited. It was created by Bad523 and appears to be a sleeper.

On 26 January 108.17.96.0/20 was range blocked for three months. Unfortunately, there had been constructive editing from addresses in the 100 108.32.0.0/12 pool, so only 108.32.0.0/20 was range blocked on 31 January. All of the socks have been created since then, most in March. To date, the vandal has made 576 edits and shows no signs of slowing down.

Further information may be found at User:AussieLegend/Project 04. --AussieLegend (talk) 05:42, 15 March 2011 (UTC)


 * Clarify255 has now been indef blocked. Only Bad523 and Bad729 remain, but I expect that will change in the next few hours. --AussieLegend (talk) 10:48, 15 March 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
All of these accounts are ✅ matches:
 * TN X Man 14:29, 15 March 2011 (UTC)
 * All socks blocked and tagged. Ready for closing. — G FOLEY   F OUR  — 22:55, 15 March 2011 (UTC)
 * TN X Man 14:29, 15 March 2011 (UTC)
 * All socks blocked and tagged. Ready for closing. — G FOLEY   F OUR  — 22:55, 15 March 2011 (UTC)
 * TN X Man 14:29, 15 March 2011 (UTC)
 * All socks blocked and tagged. Ready for closing. — G FOLEY   F OUR  — 22:55, 15 March 2011 (UTC)
 * TN X Man 14:29, 15 March 2011 (UTC)
 * All socks blocked and tagged. Ready for closing. — G FOLEY   F OUR  — 22:55, 15 March 2011 (UTC)
 * TN X Man 14:29, 15 March 2011 (UTC)
 * All socks blocked and tagged. Ready for closing. — G FOLEY   F OUR  — 22:55, 15 March 2011 (UTC)
 * TN X Man 14:29, 15 March 2011 (UTC)
 * All socks blocked and tagged. Ready for closing. — G FOLEY   F OUR  — 22:55, 15 March 2011 (UTC)
 * All socks blocked and tagged. Ready for closing. — G FOLEY   F OUR  — 22:55, 15 March 2011 (UTC)

17 March 2011

 * Suspected sockpuppets


 * - blocked
 * (added by AussieLegend, blocked by Materialscientist)


 * User compare report Auto-generated every hour.

''Please list evidence below this line. Remember to sign at the end of your section with 4 tilde characters " ~ "''

I opened a case on March 15 against this puppetmaster which has now been archived. Today I'm here again because there is yet another account with a similarly sounding name and edit pattern that is a likely sock. As in the previous case, this new account is linking common and random terms on the The Penguins of Madagascar: Operation: DVD Premiere article, beginning in this dif and continuing in the 10 next revisions.

Once I'm done making this report, I will be requesting semi-protection of the article.

I admit that I am quite new to making reports on problematic users – my cases against this puppetmaster are my first ever – but I don't think I'm out of line to suggest that it may be time for a rangeblock against this user, who has repetitively disrupted and bypassed administrative action by creating multiple accounts. Refer to archived case for more details about this particular vandal's behavior, which were added by another Wikipedian who has long been after the "Verizon Vandal." Sgt. R.K. Blue (talk) 03:37, 17 March 2011 (UTC)


 * This is the third bout of vandalism just today (Australian time). Plarify233 and 108.32.105.144 have already been blocked by Materialscientist, who has been doing an absolutely brilliant job of blocking the vandal, usually within minutes of being reported at WP:AIV. As I stated in the archived SPI report, the vandal uses two address ranges, 108.32.0.0/12 and 108.17.96.0/20. The latter is already rangeblocked but there have been some constructive edits in the 108.32.0.0/12 meaning the whole range couldn't be blocked. However, it was possible to block 108.32.0.0/17. Unfortunately this still leaves a number of addresses available to the vandal. To date there has been an ANI discussion and two SPI cases raised. I raised a AussieLegend (talk) 04:18, 17 March 2011 (UTC)


 * I've reported Plarify7029 at AIV and Materialscientist has once again leapt in at lightning speed and blocked her. --AussieLegend (talk) 04:41, 17 March 2011 (UTC)


 * Since AussieLegend (above) and Materialscientist (below) have commented in support of exploring rangeblock options, I've changed the status of this case to now request CheckUser. --Sgt. R.K. Blue (talk) 05:00, 17 March 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

This user might seems harmless (adding useless wikilinks all over the place) but they are not, as they mix it up with vandalism like, and do it at a rate of dozens of edits/day. In other words, this is a serious long-term abuse, and we do need a CU advise on a wide, long-term rangeblock here, no matter the collateral damage. Materialscientist (talk) 04:44, 17 March 2011 (UTC)

All users blocked and tagged, marking as closed. -- Addi hockey  10  e-mail 13:49, 17 March 2011 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
The following are ✅ matches:
 * Short rangeblock implemented. This is a big range and I would rather not block it for any longer than is necessary. TN X Man  13:23, 17 March 2011 (UTC)
 * Short rangeblock implemented. This is a big range and I would rather not block it for any longer than is necessary. TN X Man  13:23, 17 March 2011 (UTC)
 * Short rangeblock implemented. This is a big range and I would rather not block it for any longer than is necessary. TN <b style="color:midnightblue; font-size:larger;">X</b> Man  13:23, 17 March 2011 (UTC)
 * Short rangeblock implemented. This is a big range and I would rather not block it for any longer than is necessary. TN <b style="color:midnightblue; font-size:larger;">X</b> Man  13:23, 17 March 2011 (UTC)
 * Short rangeblock implemented. This is a big range and I would rather not block it for any longer than is necessary. TN <b style="color:midnightblue; font-size:larger;">X</b> Man  13:23, 17 March 2011 (UTC)

07 November 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Obvious sock of The Verizon vandal, whose edits are usually reverted by the edit filter. There are numerous items of evidence, using "729" in the user name, identifying herself as "Gabby", adding massive amounts of overlinking to articles, and copying articles to her talk page where she then adds massive ammounts of overlinking, in preparation to copy that to an article in the future, are all typical. 108.17.99.244, who edited User talk:729esavioli today, is an address in the range 108.17.96.0/20, which is used by The Verizon vandal TM. Checkuser has been requested for the purpose of identifying sleeper accounts, which is always a problem with this user. AussieLegend (talk) 01:17, 7 November 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * This one seems pretty straightforward, as above. I've blocked the account based on a request at AIV.  Kuru   (talk)  01:50, 7 November 2011 (UTC)
 * . The master is stale, but we can see if there are any sleepers connected with this new account. I'll also point out that the autoblock has engaged for that IP. —  Hello Annyong  (say whaaat?!) 03:47, 7 November 2011 (UTC)


 * The following are ✅ socks of one another:


 * Being that the master is, there is no way for me to confirm if they are related.
 * Also, no comment with regards to the IP, though I will say they are editing on a rather populated range so I am going to hold off on a rangeblock for the time being. Tiptoety  talk 03:53, 7 November 2011 (UTC)

19 December 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Fairly obvious socks of Clarify29 a/k/a the Verizon vandal. I've blocked them all, but listing here to get a check for sleepers/underlying IPs. NawlinWiki (talk) 21:38, 19 December 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
(assuming Nawlin meant to add a CUrequest to the case status, based on his comment). Endorsed for a sleeper check. All the accounts are clearly related per their account names and the fact that they were all recently created. In addition clear focus from those that have edited on TV/disney articles, e.g. and. I have checked the ListUsers, and all accounts prefixed with 729 which were created this year are already blocked (with the exception of 7292011abc, but they're clearly not related), but a sleeper check would nonetheless be appreciated in case the naming pattern has been changed (as it regularly is, see /Archive) or there are any other loose sleepers lying around (master is, but no need for comparison checks due to duckish nature). Many thanks, SpitfireTally-ho! 01:06, 20 December 2011 (UTC)

I blocked one range, but others have to remain open, I'm afraid, due to possible collateral damage. I also cleaned up and did quite a few deletions on many of the socks' WP:FAKEARTICLEs or otherwise fan-fiction or other BS on the user pages. –MuZemike 01:36, 20 December 2011 (UTC)

closing. Thanks for the check + adminwork, Mike. SpitfireTally-ho! 01:40, 20 December 2011 (UTC)