Wikipedia:Sockpuppet investigations/Djtechno95/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Identical complex reverts coupled with similar reasoning explaining just one part of the revert. ,, ,  Looking at both accounts they seem to make identical edits on the same range of pop culture articles and have received similar warnings on those edits. Gleeanon409 (talk) 21:38, 10 October 2019 (UTC)

I suspect you didn't generate the SPI correctly. You listed the sockmaster under suspected sockpuppets (which I've removed), along with an IP. But, you mention "both accounts". Was there another account you intended to list? -- RoySmith (talk) 03:54, 18 October 2019 (UTC) This is another one likely the same person but only one edit on this exact ip. Gleeanon409 (talk) 06:32, 18 October 2019 (UTC)
 * Based on the history of Baby You Can't Drive My Car, I'd guess that they meant "both accounts" to mean the registered account and the IP. ST47 (talk) 04:13, 18 October 2019 (UTC)
 * Yes, sorry. There is another IP, but it’s only made one edit so I didn’t include it. Gleeanon409 (talk) 04:37, 18 October 2019 (UTC)
 * Looking at the interaction report, it's clear these are the same person; they've got common editing history going back 8 years. However, socking implies intent to decieve, which isn't clear.  They could have just innocently forgotten or not bothered to log in.  I'm going to WP:AGF, drop a Template:Uw-login warning on dj's talk page, and close this for now.  If they ignore the warning and continue to edit anonymously, that would be good evidence of socking, and you should open another SPI case at that time.  -- RoySmith (talk) 14:15, 18 October 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

As evidenced from the last SPI case, 144.178.8.74 is Djtechno95’s Main IP when not signed in, there is likely some others, if I run across them I’ll add them.

From the last case they were warned to not do it again.

A quick look at both talk pages User talk:144.178.8.74 shows others have had identified this fact, and documented numerous editing problems over time which continue to late last year.

I notice since the SPI warning last year they seem to separate which account is used for which articles instead of a lot of overlap. But this shows there is still crossover. Gleeanon409 (talk) 22:29, 4 January 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Clearly socking. I'll issue some blocks once I figure out the right plan for the IP. -- RoySmith (talk) 23:49, 4 January 2020 (UTC)
 * Checkuser note: The IP is ❌ to the account.  Risker (talk) 00:19, 5 January 2020 (UTC)
 * thanks for that, but what I was really asking was if there were any issues with blocking the IP due to other activity that I can't see. I'm going to assume the answer to that is, "no", and block 144.178.8.74 (got the copy-paste right that time!) for 6 months.  Plus ifdef Djtechno95.  -- RoySmith (talk) 01:03, 5 January 2020 (UTC)
 * That would be a bad call, Roy. The two are not related.  When I start comparing their edits, they're clearly not the same people. There's no indication that Djtechno95 is socking technically speaking, and there's no indication that the IP is socking, either.  I don't understand the basis for blocking either the IP or the account. Risker (talk) 01:09, 5 January 2020 (UTC)
 * I'm looking at the interaction timeline between the two. There's a long history of the same articles being edited by Djtechno95 and 144.178.8.74, going back years, covering many different articles.  How does this not add up to socking?  -- RoySmith (talk) 01:20, 5 January 2020 (UTC)
 * The interaction tool is just that, a tool; it's not diagnostic of socking. Many of those edits are months if not years apart, and many made closer together are likely to be related to events that occurred in relation to the subject.  The quality and nature of the edits is different, the account and the IP are not making the same edits or edit-warring to keep the same information in. Their behaviour does not come across as socking. It comes across as two different people who have similar interests, which is pretty common.  Risker (talk) 01:29, 5 January 2020 (UTC)
 * I still think they are the same as they both made identical complex edits on the same article, I believe within a week. Gleeanon409 (talk) 01:37, 5 January 2020 (UTC)
 * And others have noted it as well. Gleeanon409 (talk) 01:40, 5 January 2020 (UTC)
 * Consider edit pairs such as this by Djtechno95 and this by the IP two days later. Exact same change, almost identical edit comments. More generally, looking over the pages edited in common, they share the same taste in music, TV shows, even an interest in Apple computers. And, their interests in particular topics come and go in sync. For example, around 2019-06-15, both of them seemed fascinated with List of Atomic Mass & Def Leppard members. 2018-11-04 was The X Factor (British series 15) day for both of them. For a few days around 2019-07-22 they were both interested in Gump Roast. From what I can see, there's no way these are not the same person. -- RoySmith (talk) 01:56, 5 January 2020 (UTC)


 * 2604:2000:1481:81D9:6034:64A3:1CA3:B691 just started up where the others stopped. Gleeanon409 (talk) 03:27, 5 January 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Jchau1995 emailed me, asking me to stop Gleeanon409 from protecting the article Baby You Can't Drive My Car. This article had never been edited by Jchau1995, but instead by 81.107.194.51, which made me think Jchau1995 was not making a good-faith request – that Jchau1995 was already involved and worried about being caught again. Last year, the article was one of the hot buttons of the Djtechno95/144.178.8.74 disruption. Djtechno95 was blocked on 5 January and a few hours later, Jchau1995 was registered, which is very suspicious. The interaction tool for Jchau1995 and 81.107.194.51 has the same pattern as the previous one for Djtechno95 and 144.178.8.74. The tool shows that an edit by one may soon be followed by an edit from the other one. The two pairs of users and IPs are tied together by similar edits, for instance the emphasis on failure at the Novelist MC article: "commercial failure" vs "commercial failure" vs "commercial failure" vs "failing to chart". Checkuser requested to make certain. Binksternet (talk) 14:00, 24 October 2020 (UTC)


 * After CU declined, we need a confirmation by way of behavioral analysis. Binksternet (talk) 22:02, 27 October 2020 (UTC)


 * More behavioral evidence
 * The diurnal activity pattern of the following four users shares the same period of inactivity, from 0200 to 0800 UTC, consistent with the London locations of the IPs.
 * https://xtools.wmflabs.org/ec/en.wikipedia/Djtechno95
 * https://xtools.wmflabs.org/ec/en.wikipedia/144.178.8.74
 * https://xtools.wmflabs.org/ec/en.wikipedia/Jchau1995
 * https://xtools.wmflabs.org/ec/en.wikipedia/81.107.194.51
 * Speaking of London, the range Special:Contributions/2A00:23C4:6F84:7100:0:0:0:0/64 appears to be another place where Djtechno95 evades his block. Many edits in the range share the same style and focus as Djtechno95, but this addition to the Novelist MC biography demonstrates the familiar emphasis on failure which is characteristic of Djtechno95 and Jchau1995.
 * There are many times when one user's edits will be followed by another user's edits at the same article. For instance, at Whole Lotta History, 81.107.194.51 fiddled with the piped links of concerts, after which Jchau1995 came in and fiddled with concert piped links and more. Djtechno95 split out a paragraph of background information at The Promise (Girls Aloud song) after which Jchau1995 expanded the new paragraph. Same interest in the same part of the article, separated by six years.
 * This interaction tool shows that two registered users and two IP users have remarkable intersections of interest. Djtechno95 and Jchau1995 are surprisingly joined by their activities at The X Factor (British series 15), The Sims 4, The X Factor: Celebrity, The X Factor (British series 13), The X Factor (British series 11), Hysteria (Def Leppard album), Fatboy (EastEnders), The Promise (Girls Aloud song), Shania Twain, and The X Factor (British TV series). This is a fingerprint here, pulling topics from computer games, UK TV, American country music, British hard rock and girls pop music – a uniquely personal pattern of interest. Djtechno95 and Jchau1995 have the same fingerprint. Binksternet (talk) 05:49, 28 October 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Archive is stale, and we do not make connections to IPs. -- Amanda  (aka DQ) 19:50, 27 October 2020 (UTC)
 * On hold pending a response from Jchau1995. Callanecc (talk • contribs • logs) 03:59, 4 January 2021 (UTC)
 * , You placed this on hold, but it's obvious at this point that we're not going to get any response. Any objection if I go ahead with this?   The bottom line is it's clear to me that Jchau1995 is the same person as Djtechno95.  To start, the huge overlap in articles edited.  More than that, they both edited the unusual pair of MacBook Pro and Windows 98.  And did I mention that Jchau1995's account was created 9 hours after Djtechno95 was blocked? -- RoySmith (talk) 01:02, 24 February 2021 (UTC)
 * Callanecc - Any reason why this is still on hold? Can we proceed with the SPI process here?  ~Oshwah~  (talk) (contribs)   01:53, 26 February 2021 (UTC)
 * No response from Jchau1995 or Callanecc in several months, so I'm just going to block and tag, as the evidence is convincing enough. Closing. Sro23 (talk) 17:57, 13 March 2021 (UTC)