Wikipedia:Sockpuppet investigations/Dude on riding dudes/Archive

16 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Dude on riding dudes impersonated a CheckUser, signing as DoRD here. It should be noted that the user "made a false claim he was an admin on his short-lived user page," according to Gilliam here. Gilliam suspects that the user may be a sock of a vandal they blocked (see the block log for reference). JustBerry (talk) 02:41, 16 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * . Only one account. Just a personal suspicion. There are only two ways something like this would work. The first is that someone recognizes the account and then identifies the target master along with evidence. That isn't the case here. The second is to run a CU, and that's not going to happen. . Closing.--Bbb23 (talk) 04:24, 16 September 2015 (UTC)

18 September 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Dude on riding dudes impersonated a CheckUser, signing as DoRD here. It should be noted that the user "made a false claim he was an admin on his short-lived user page," according to Gilliam here. Gilliam suspects that the user may be a sock of a vandal they blocked (see the block log for reference).

This was the evidence in the previous SPI case that was made about the user; however, Bbb23 had declined the continuation of the investigation due to insufficient reason for suspicion/evidence. This time, it seems as though the same user made two additional accounts Cheetolover69, which has not been banned, and Mu23m1k3, which has been banned. Using these two accounts, the users made similar CheckUser impersonations on my talk page here and here respectively approximately two hours from each other. If there seems to be insufficient evidence to link the master sock to sock1 and sock2, at least sock1 and sock2 have a more reasonable reason for suspicion due to the time difference between the diffs. It should also be noted that the same user may have left the templates on my talk page after seeing my conversation on Gilliam's talk page, which was regarding reporting the SPI case. This may have easily instigated more rebellious behavior from the sock to come over to my talk page and place these templates. Not to mention, it may be the case that we're not taking into account the other account(s) that may have been created to put similar templates on other user talk pages. If you feel as though this is a newer trend of sorts, it might be beneficial to have a master SPI case of some sorts where similar reports can be compared and serve as a reason for suspecting that they are all socks, however such a proposal would work under the SPI construct. Of course, my suggestion is simply something for you to consider and keep in the back of your mind if it may be doable and useful, but the current situation at hand appears to give me significant suspicion for believing they are socks. --JustBerry (talk) 02:33, 18 September 2015 (UTC) JustBerry (talk) 02:33, 18 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

It might be helpful to note the signatures of the socks in the diffs to identify who the socks may have a grudge on, check that person's talk page, and see if there are any similar templates lingering around. Wish that CheckUser views comments and initial case to find additional socks potentially related to this case, would this be the case if you've closed the SPI case? --JustBerry (talk) 03:09, 18 September 2015 (UTC)

This is what I'm getting on the edit interaction utility:. Seems like the potential socks might be making new socks for each additional case. --JustBerry (talk) 03:11, 18 September 2015 (UTC)

Also, it could be helpful to check recent changes with a diff filter for that template and see what illegitimate accounts show up. Do you happen to know a tool that can do this? I'll look around and see if I have can find a tool for that when I get a chance. --JustBerry (talk) 03:14, 18 September 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
now closing--5 albert square (talk) 02:59, 18 September 2015 (UTC)

20 September 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Found another suspected sock of the master that added a block template to my user page for vandalizing while also impersonating an administrator's name, which ironically happens to be Gilliam again here. Please review archived cases of the master, as Gilliam was one of the initial targets of this sock master. I think a trend is being noticed now, Bbb23. JustBerry (talk) 15:51, 20 September 2015 (UTC)


 * Just looked at the user's other contributions, seems like two other users were targeted as well. See contribs. --JustBerry (talk) 15:53, 20 September 2015 (UTC)
 * It should be noted that the sock has already been blocked. However, it looks like an IP block and block of all accounts on the IP would be more complete to catch any lingering accounts. Would a minor regional block be needed perhaps? --JustBerry (talk) 16:11, 20 September 2015 (UTC)
 * Added Aspertardation as per discussion here with zzuuzz. See contribs, e.g. this diff for block template impersonation. --JustBerry (talk) 16:19, 20 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Latest puppet blocked. Nothing more to do here. Closing. Bbb23 (talk) 16:14, 20 September 2015 (UTC)

23 September 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Continued vandalism to 's talk page with admin/CU templates, i.e. warnings, blocks, etc. MikeV has mentioned to me that it would be best to continue to report socks, so that patterns are eventually noticed. Hence, similar reports will be made here. See this and this for and 's 'vandalistic' contributions respectively. linked via the category "Suspected Wikipedia sockpuppets of Manxruller" to other two socks. Linking sub-master sock to suspected master sock through similar privileged template-adding behavior. As with prior cases of the suspected master sock, any preventative action, i.e. IP-block, etc. would be appreciated. JustBerry (talk) 22:53, 23 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * is ✅ to Pope Francis X. is ✅ to Manxruller. C.Frred has already been addressed by other CUs. Mike V • Talk 23:04, 23 September 2015 (UTC)

01 October 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Add to the list per this. See previous case for same rationale - very similar behavior on same page(s). Reported per MikeV's suggestion (see archive of previous case). JustBerry (talk) 23:24, 1 October 2015 (UTC)

Look at user's contribs for other admin template examples. Appears to be a clear sock.

Pinging blocking admin for observing additional socks or comments. --JustBerry (talk) 23:40, 1 October 2015 (UTC)
 * I merely acted on this one account on its own. Although it almost certainly was a sock of someone, I did not seem like one of the sock-drawers with which I am familiar, and I did not look more deeply. DMacks (talk) 03:54, 2 October 2015 (UTC)

Have you noticed any additional activity on your talk page? --JustBerry (talk) 23:41, 1 October 2015 (UTC)
 * No, once blocked, returning vandals usually seem to know to avoid the blocking administrators.– Gilliam (talk) 23:45, 1 October 2015 (UTC)
 * If you look in the archives, it appears that your talk page and my talk page have both been targeted twice now by socks from this SPI case. That's why I had asked; thanks for the update. --JustBerry (talk) 23:49, 1 October 2015 (UTC)
 * Thanks for keeping me up to date.– Gilliam (talk) 23:53, 1 October 2015 (UTC)

Up just popped: who User:Elockid blocked for behavior. Obvious sock is obvious, blocked obviously: "banned" tagging of admins' pages, creation of List of non-LGBT Wikipedia admins and similarly-named pages. DMacks (talk) 03:59, 2 October 2015 (UTC)

Older blocked socks not already listed in archive: Same behavior at User talk:Bongwarrior/Unprotected. DMacks (talk) 04:22, 2 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * "Dude on riding dudes" is certainly punny (and stealthy at that). I wonder if this sockfarm is connected to an older sockmaster that's encountered DoRD..... Zeke Essiestudy (talk) 06:29, 2 October 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. Closing. Bbb23 (talk) 23:31, 1 October 2015 (UTC)
 * At least some of them are not yet tagged. Will do it later today unless someone else beats me to it. DMacks (talk) 04:22, 2 October 2015 (UTC)


 * No need to tag, no shrines for vandals and all that. Courcelles (talk) 17:24, 2 October 2015 (UTC)