Wikipedia:Sockpuppet investigations/Coat of Many Colours/Archive

24 October 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Behavioral evidence is clear enough, as far as I'm concerned; I'll ask to contribute some technical details about technical details. In short, Coat was blocked for three months on 15 October, after disrupting various processes including FP, and for harassing Crisco and. Well, that's sort of my reading: the close by of an ANI thread cited battleground mentality and disruption, here. Note also that Euryalus doubted that Coat was a new account. Well, here we are, with a new editor, whose account was begun on 15 October, and whose first edits pertain to the sex industry in Indonesia--nothing special until you see that Coat started accusing Crisco, an editor who lives in Indonesia, of attempting to redeem the reputation of a supposed pedophile via the FP process. Note that Marinka then jumps right into the FP process, which was Coat's favorite area as well, but I will let Crisco speak, if necessary, to the comparisons between the two editors, and I'll let him collect some diffs as well, for your viewing pleasure. One more thing: I would like CU run. It may not provide conclusive evidence; Coat already indicated traveling. They used some IPs as well; I do not have those details at my disposal right now, but I think one IP's edit is linked on Coat's talk page. Drmies (talk) 00:42, 24 October 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Another one: User:64.9.157.141 all but identifies themselves at ; they also edited at. Seriously, they've gone from a three-month block to indef, what next? IP blocks? Adam Cuerden (talk) 09:26, 27 October 2014 (UTC)
 * Blocked for a while. Will wait and see if a static IP. -- Euryalus (talk) 09:40, 27 October 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
. Marisa's primary focuses are pedophilia in Indonesia (Crisco is from Indonesia) and WP:FPC (she is commenting/voting on a lot of candidates). She's obviously not a new editor. After being blocked, Coat said they (she?) would not be returning. On that same day, Marinka started an account. Coat was not blocked on October 15 (Drmies's error) but on October 5. However, she made contributions post-block through October 15 (last edit: ).--Bbb23 (talk) 01:39, 24 October 2014 (UTC)
 * is a sock of .-- Jezebel's Ponyo bons mots  22:15, 24 October 2014 (UTC)
 * Thank you . I have blocked Marinka van Dam indefinitely. I will leave it to you, or to, or to , to decide what to do with the block on Coat. Thanks, Drmies (talk) 23:26, 24 October 2014 (UTC)
 * Thank you. — Crisco 1492 (talk) 23:31, 24 October 2014 (UTC)
 * I've added three more months to Coat's block, meaning the entire block from the date of the original block is 6 months. If there's more socking, the block of the master will become indefinite.--Bbb23 (talk) 23:34, 24 October 2014 (UTC)
 * Beat me to it, thanks . Apologies to for the delay in posting the SPi. -- Euryalus (talk) 02:10, 25 October 2014 (UTC)
 * No apology necessary, Euryalus; these cases are difficult and we all have day jobs. I appreciate your help. Drmies (talk) 02:16, 25 October 2014 (UTC)
 * ,, --please see the totally duck-like contributions of User:A Sextet Short of PG(2,57). This is turning into quite a sock farm. Drmies (talk) 13:31, 26 October 2014 (UTC)
 * Just before Drmies came back here, I responded to a comment from on my talk page here. Although the requested diffs would be nice, I'm endorsing a CU as I think there's enough for it even without the diffs and because it should be fairly simple.--Bbb23 (talk) 13:36, 26 October 2014 (UTC)
 * Agreed. I have stepped away from the keyboard (nearly 1am here) but a review of contributions, writing style, editing interests and of course sudden re-emergence, are enough to point very strongly at this being another sock, even without CU. -- Euryalus (talk) 13:42, 26 October 2014 (UTC)
 * Diffs at Bbb23's talk page. — Crisco 1492 (talk) 13:53, 26 October 2014 (UTC)

Based on the outstanding diffs left by Crisco, I've indeffed and tagged Sextet based on duck. I'll leave the endorse, and the CU may either run the CU for confirmation or, if they prefer, decline it. I should note that Marinka, in their last post on their talk page post-block, threatened to continue socking with a work account here.--Bbb23 (talk) 14:26, 26 October 2014 (UTC)
 * Right on--thanks everyone. Allow me to ping one more time, just so I know that they know that I know that they know, you know? Drmies (talk) 15:34, 26 October 2014 (UTC)
 * Oh,, I know. Coat of Many Colours has a fondness for attempting to obfuscate their location, and with so few edits there isn't much to go on here. The behavioural evidence is there and if nothing else the CU allows us to stick a cork in some dodgy IPs. -- Jezebel's Ponyo bons mots 16:34, 26 October 2014 (UTC)
 * And apparently obfuscating = changing their location every few minutes... — Crisco 1492 (talk) 16:40, 26 October 2014 (UTC)
 * At the risk of pinging you to death, does this mean we're done and I should close this report again?--Bbb23 (talk) 16:42, 26 October 2014 (UTC)
 * You can ping me anytime . I don't think there's anything more to do here, so ok to close.-- Jezebel's Ponyo bons mots 17:04, 26 October 2014 (UTC)


 * Thanks to 's reminder on my talk page of my earlier comment here, I've indeffed and tagged the master based on the new socking. It's comforting to know that someone reads what I write.--Bbb23 (talk) 19:24, 26 October 2014 (UTC)


 * Perhaps its not time to close yet: 2 edits, one to a museum on August 6 (a time when COMC was supposed to be "travelling") and one to FPC just today, after the most recent sock was blocked. — Crisco 1492 (talk) 02:57, 27 October 2014 (UTC)
 * The timing is obviously suspicious, but it's hard to block on two edits that aren't an absolute slam dunk. I don't suppose requesting a CU will do any good?--Bbb23 (talk) 04:46, 27 October 2014 (UTC)
 * Indeed. If timing were less suspicious I wouldn't mention it, but... — Crisco 1492 (talk) 11:02, 27 October 2014 (UTC)


 * , geolocation is off (which, due to CoMC's talk of travel and use of webhost/proxies, means little), but the UA is an exact match to Marinka van Dam's from the same time period. -- Jezebel's Ponyo bons mots 16:12, 27 October 2014 (UTC)
 * That helps enormously, thanks. I've indeffed and tagged the new puppet. I've also adjusted the tags on a few of the puppets to make the tagging consistent with the CU findings. Everything is now "suspected"; before some were confirmed, and some were not, and my read of Ponyo's findings is that nothing is actually "confirmed", particularly to the master. It may be a technicality, but it seems important to me. As soon as I finish this comment, I will close the case for the 99th time. If will take a short break, we might be able to archive this before he finds another. He would then have to start a new case. :-) --Bbb23 (talk) 23:45, 27 October 2014 (UTC)
 * I would if they'd stop coming looking for me. — Crisco 1492 (talk) 23:48, 27 October 2014 (UTC)
 * You're correct - the IP template should have read "suspected" and is likely pointless in any case. That's my fault for editing late at night. -- Euryalus (talk) 00:20, 28 October 2014 (UTC)
 * I know what that's like. Except in very unusual circumstances, we don't usually tag IPs at all. The block itself should be self-explanatory and sufficient for the future.--Bbb23 (talk) 05:06, 28 October 2014 (UTC)

14 January 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User name indicates a familiarity with both WP:DUCK (regarding sockpuppetry) and technical matters (404 error reference); Coat has formerly shown an interest in such technical matters. Also of note is a focus on WP:FPC. — Crisco 1492 (talk) 20:51, 14 January 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Yeah, DUCK and 404, that's pretty funny, but it's not very conclusive evidence. The exclusive focus on FP, that's quite another thing--plus the account's disappearance is real timely. I'd still like to see CU, though... Drmies (talk) 14:58, 2 February 2015 (UTC)
 * CU is due to the extensive proxy use by CoMC. At this point there are essentially two options 1) are they DUCKy enough to block outright? or 2) wait until they eventually out themselves behaviourally or they become disruptive enough to block regardless of the possible connection. Looks like this was just a burner account that's been abandoned though. -- Jezebel's Ponyo bons mots  22:10, 5 February 2015 (UTC)

22 July 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

It pains me to be back here again. I believe C1cada is yet another sock of Coat; I have no doubt that CU will reveal the same proxy use. Coat had a track record of following Hafspajen around, and that's what C1cada is doing as well, with 152 edits to Houses at Auvers, an article Hafspajen started and edited extensively. In general, the interest in Van Gogh is typical for Coat and their socks. The overlap between Coat and C1cada has, of course, Van Gogh but, more significantly for those who know Coat, Revenge porn, an old favorite. Note also their edits on Paul Gauguin--Coat always had an interest in, shall we say, underage human sexuality, and it's evident here as well: here is a reference they added to that issue, and the edit beforehand has them editwarring with over using a website as a reliable source (see their condescending comments at Talk:Paul Gauguin). There's some other behavioral evidence as well, which I will not share here, though I'll gladly post it in Marinka van Dam's thread on Wikipediocracy, haha. Other editors have noticed the similarities as well, and I'd like to know if has anything to add. Drmies (talk) 02:30, 22 July 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * This CU was triggered by an off-wiki request. The master and all socks are . However, made a finding in October 2014 that the master used proxies to hide his location. Based on that comment, I checked C1cada and found that he too used proxies. I then checked Ponyo's log from 2014 and, bless Ponyo for her organizational skills, found that the ranges used by the master and those used by C1cada were either identical or belonged to the same company. Even my knowledge of the master's behavior in comparison with C1cada's behavior made it very likely that the account was a sock. However, I asked, who is more familiar with the master's behavior, to reopen the SPI and provide behavioral evidence, which he has done. Purely technically, I think it's  that C1cada is a sock of CoMC. When coupled with the behavioral evidence, it seems all but certain. I've blocked C1cada and tagged the account as ✅. That's a bit of a stretch, but of the possibilities the template permits, that seemed the most accurate. Closing.--Bbb23 (talk) 22:04, 22 July 2015 (UTC)

03 August 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Account comes out of the blue to follow Hafspajen editing an article on a 17th-century painting. No doubt in my mind, and I've already blocked. I'd like and  to look at the technical evidence--thanks. Drmies (talk) 14:06, 3 August 2015 (UTC) Drmies (talk) 14:06, 3 August 2015 (UTC)
 * IP editor making personal attacks against Hafspajen here, and pretty much blatantly admit that he's a sock here. Started editing by stalking Hafspajen. At a painting article, naturally. Blocked. — Chris Woodrich (talk) 08:15, 5 August 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * and are technically ❌. I've put this case on hold in case  wishes to add her nickel to my two cents.--Bbb23 (talk) 00:19, 4 August 2015 (UTC)
 * In comparison with previous socks, the technical data is not a match. That being said, this is a sockmaster who generally goes out of their way to switch up their "game" every once in a while to evade detection on a technical basis. It's their odious behaviour that always outs them.-- Jezebel's Ponyo bons mots 17:09, 5 August 2015 (UTC)
 * There's no reason why WinstonJunior should be unblocked based on the lack of technical evidence. Thus, the only decision is whether to tag the account as a suspected puppet. Personally, I don't think it's necessary, particularly because we have a record here regardless of the tag. However, I'll defer the decision to and . If either wants to tag, fine. Once tagged, please close the SPI. If neither wants to tag, I'd appreciate it if one of you would close the SPI. Thanks.--Bbb23 (talk) 17:29, 5 August 2015 (UTC)
 * Up to you, Ponyo and Bbb. I don't much care. Drmies (talk) 17:32, 5 August 2015 (UTC)
 * Looks like we're done, no tagging. Closing. Bbb23 (talk) 14:08, 6 August 2015 (UTC)

11 August 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

We are convinced that this is yet another sock of Coat, who likes to pride themselves on speaking in the plural and having lots of legitimate accounts. This account is a longtime sleeper which became active a few days after the last Coat sock got blocked and, guess what, got involved with FP nominations, arguing against Hafspajen. We blocked it as a duck, given the obvious quacking. Drmies (talk) 22:47, 11 August 2015 (UTC)
 * Second behavior issues. There's also a stalking of the user Stephan in the past, similar to Coat. — Chris Woodrich (talk) 00:03, 12 August 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked, and now tagged as a suspect. Closing the case.  Vanjagenije  (talk)  16:20, 12 August 2015 (UTC)
 * The technical evidence also dovetails with the behavioural similarities.-- Jezebel's Ponyo bons mots 21:25, 12 August 2015 (UTC)

17 September 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Obvious sock(s) of Coat, with FBF (meaning "vaginal play" or something like that, hinting at sexual desire spilling over into online activity) having been renamed JaniB. If you put your admin glasses on you can compare [User:Coat of Many Colours/sandbox 4]] with User:JaniB/sandbox--and next up you can look at P v S and Cornwall County Council, started by Coat sock C1cada. JaniB, like C1cada, has a fondness for editing Suicide of Amanda Todd. Finally, we have 1d6507f9, who restored comments made by IP socks on Talk:September Morn, a longtime favorite of Sock's to comment on, and who intersects with JaniB in a left-hand/right-hand kind of way in Peer review/Metock case/archive1. I'm not blocking them yet because I'm at my quota for blocks this morning, but I am very interested in CU--,, is there anything there? Drmies (talk) 16:07, 17 September 2015 (UTC)
 * Update: I'm blocking 1d6507f9 as well. Drmies (talk) 16:18, 17 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * and are.
 * is . Closing.--Bbb23 (talk) 20:02, 17 September 2015 (UTC)

16 October 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

has been topic banned and eventually indefinitely blocked for sockpuppetry as per this SPI thread: Sockpuppet_investigations/Coat_of_Many_Colours/Archive.

He has long wanted to edit at Perinçek v. Switzerland and even after he has been blocked, he has said specifically that: "I shall certainly want to edit there if the judgment goes the way I expect it shall." In fact, right after he got topic-banned he asked the sanction imposing admin: "Does that include Perinçek v. Switzerland where I had planned a significant edit once the judgment is in?".

Well, the judgement happened recently, on October 15, and ten minutes after C1cada made this edit at his own TP, edits from an IP address started pouring in at Perinçek v. Switzerland. The edit-summaries and personal attacks are strikingly similar to the master C1cada. Examples:


 * Same edit-summaries:
 * C1cada:
 * 109.153.80.157:


 * Accusations of my English not being good (which begs the question, how would a random IP know my level of my English?):
 * C1cada:
 * 31.51.20.183:

Note: employs the word 'semi-literate': and


 * Same baseless accusations of OWNERSHIP:
 * C1cada:
 * 109.153.80.157:


 * Same baseless accusations of WIKILAWYERING:
 * C1cada:
 * 109.153.80.157:
 * 31.51.20.183: Étienne Dolet (talk) 20:48, 16 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I've blocked the IPs for 1 week and semi-protected the page for 3 months. Mike V • Talk 21:24, 16 October 2015 (UTC)

20 December 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * KIC 8462852 was blocked by on December 4 as a suspected sock of CoMC.
 * and are ✅ and  to other blocked puppets. Closing.--Bbb23 (talk) 16:43, 20 December 2015 (UTC)

21 January 2016

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Account made from 86.147.21.40, a Coat IP, used to follow someone around in an article. Marked as CU block. Already blocked: this is pro forma. Drmies (talk) 06:00, 21 January 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Tagged. Closing the case.  Vanjagenije  (talk)  10:05, 21 January 2016 (UTC)

28 March 2016

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same kind of edits, same kind of interests: Flemish and Dutch artists, women's topics. CU can confirm and perhaps uncover more. Drmies (talk) 15:48, 28 March 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
These three accounts are ✅ to each other:
 * The past socks are too stale to definitively link them together via technical data. However, looking at the contributions I do see a behavioral similarity. I've blocked all three accounts. Mike V • Talk 16:33, 28 March 2016 (UTC)
 * The past socks are too stale to definitively link them together via technical data. However, looking at the contributions I do see a behavioral similarity. I've blocked all three accounts. Mike V • Talk 16:33, 28 March 2016 (UTC)
 * The past socks are too stale to definitively link them together via technical data. However, looking at the contributions I do see a behavioral similarity. I've blocked all three accounts. Mike V • Talk 16:33, 28 March 2016 (UTC)
 * The past socks are too stale to definitively link them together via technical data. However, looking at the contributions I do see a behavioral similarity. I've blocked all three accounts. <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 16:33, 28 March 2016 (UTC)