Wikipedia:Sockpuppet investigations/Escapeeyes/Archive

Report date June 3 2009, 16:05 (UTC)

 * Suspected sockpuppets

Several accounts are involved in a dispute on Ronald Ryan article and talk page, all in disagreement with User:Purrum, and almost all of their edits are to the article or its talk page. Many of their comments on the talk page contain personal attacks, and Escapeeyes and BeyondReasonableDoubt have accused Purrum of vandalism with almost identical edit summaries in edits to the article (which is now protected because of the dispute). Other edits by these two accounts, and also by Cameron1940, Julieannwells, and 60.224.64.166 often use similar edit summaries. Cameron1940, Ghost of Hodson and Julieannwells have also used brackets around their signatures, although not consistently, and they have not used them on any other edits. Another account, User:PurrumShotHodson, appears to have been created only to attack Purrum (and has now been blocked for a username violation). — Snigbrook 16:05, 3 June 2009 (UTC)
 * Evidence submitted by Snigbrook


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

All the accounts share similar contributions and have made efforts to revert the edits of Purrum. I've blocked the socks indef. and tagged them as well. I blocked the IP and the master account for a week. Icestorm815 •  Talk  18:28, 3 June 2009 (UTC)
 * Clerk, patrolling admin and checkuser comments
 * I see the reason this report was created. There is a pattern of activity on that case. I've generated a report which can be found at http://toolserver.org/~eagle/spi/1244045772.html . I don't have the time at the moment to go through this case and make any determinations, so if someone else would do so that would be great. ——  nix eagle email me 16:18, 3 June 2009 (UTC)
 * Conclusions

Evidence submitted by Jayron32
Escapeeyes is currently on an indefinite block for general disruption and tendentious editing, mostly at Ronald Ryan. Today, Bloodknows showed up and edited Ronald Ryan, showing a surprising level of knowledge of Wikipedia editing for a newbie editor. This one seems rather "ducky" given the similarity between this edit from Escapeeyes (page down to the interview with Father Brosnan) and the sole edit by Bloodknows. Bloodknows will be blocked per WP:DUCK. Requesting second opinion to see if I am right on this. Also requesting checkuser to root out any other sleeper socks. -- Jayron  32  07:12, 11 December 2009 (UTC)

Comments by accused parties
See Defending yourself against claims.

CheckUser requests
Requested by Jayron  32  07:12, 11 December 2009 (UTC)

Clerk, patrolling admin and checkuser comments

 * ✅, . No other accounts found. Dominic·t 07:21, 11 December 2009 (UTC)

Conclusions

 * Already blocked. I tagged. Tiptoety  talk 07:22, 11 December 2009 (UTC)

Evidence submitted by Jayron32

 * User:Monopolees has showed up editing the article Ronald Ryan, formerly the stomping grounds of the now indef blocked user User:Escapeeyes. Escapeeyes has used socks in the past to dodge their block.  Asking for checkuser to confirm if this is him (its always possible that someone else with a similar POV has just showed up).  Also, to check for sleepers.  -- Jayron  32  02:19, 20 March 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
Requested by Jayron  32  02:19, 20 March 2010 (UTC)

–MuZemike 02:22, 20 March 2010 (UTC)

Monopolees blocked and tagged. –MuZemike 02:22, 20 March 2010 (UTC)


 * I got nothing. Hers fold  (t/a/c) 04:49, 20 March 2010 (UTC)

Evidence submitted by GenericBob
Escapeeyes and 8 other socks have previously been banned for sockpuppetry on Ronald Ryan (the last man to be executed in Australia - some believe he was innocent, Escapeeyes among them). Socks had a grudge against User:Purrum - see e.g. and User:PurrumShotHodson.

Article semi-ed for a year on April 23 due to ongoing sock abuse, and the last identified sock account was banned around this time. As soon as the sock accounts vanished, anon IPs started to push the same agenda on the Talk page - almost all the anon edits there since April 23 appear to come from one person using a redirecting service to conceal their IP. Some reasons for suspicion:


 * Previously-established history of sock abuse on this article.
 * Traceroute is interesting: given that few people outside Australia are likely to know or care who Ronald Ryan was, I'd expect at least 80% of legit editors to be Australian. Of the ten IPs I've listed above: one is in Slovakia ("ip-anywhere.net", one Japan, one Netherlands, and the rest are dot-coms/dot-nets, mostly in USA. None of them resolve to an Australian address. Most of them appear to be hosting sites; it's what I'd expect to see if somebody was deliberately redirecting to avoid identification.
 * Quirks of writing/editing style, e.g.:
 * Extra capitals: Man Necked On No Evidence, Australian News Video on Ryan, Article is Flawed - not in all edits, but enough to look like more than a coincidence
 * Fondness for using bold a lot - you just have to skim through the current talk page from here to get the strong impression that many of the anon edits are coming from the same person.
 * A couple of other quirks that I won't list here for now (don't want to give them too many pointers on how to cover their tracks, but looking through the anon edits may suggest a few).

I'm not sure whether this is the place to report this; they are no longer using sockpuppet accounts, but this is clearly an attempt to get around sockpuppet bans. Given that they know how to use a redirecting service, I don't know if there's a solution other than extending semi-protection to the talk page.

Comments by accused parties
See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments
I think the best option here is semi-protection of the talk page. There's no way to effectively rangeblock those accounts, especially if they're proxies. TN X Man 11:49, 14 July 2010 (UTC)
 * Semi-protected by . T. Canens (talk) 08:58, 15 July 2010 (UTC)

Evidence submitted by GenericBob
Long history of sock abuse on Ronald Ryan and Talk:Ronald Ryan by Escapeeyes - see previous sockpuppet investigations for details. Editor also had a grudge against User:Purrum. After repeated account blocks, culprit shifted to anonymous IP editing via some sort of rerouting service (again, see previous history). Since it's not possible to block all their IPs, article was semi-ed and talk page was temporarily semi-ed. Now that semi on the talk page has expired, the same guy is back: compare and  to previous edits by this culprit.

Previous history indicates that this guy will go on and on making a nuisance of himself as long as he can edit Talk:Ronald Ryan, so once again semi-protection is probably the only remedy. GenericBob (talk) 06:40, 17 August 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
IP already blocked by User:Zzuuzz as an open proxy. –MuZemike 23:27, 18 August 2010 (UTC)

07 January 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every six hours.

''Please list evidence below this line. Remember to sign at the end of your section with 4 tilde characters " ~ "'' Escapeeyes had a long-running history of disruptive editing and sock abuse on Ronald Ryan (last man to be hanged in Australia), which included a long-standing grudge against Purrum. After no less than eight sockpuppet accounts were blocked, he switched to using an IP anonymising service/open proxies; article is under long-term semi-protection and talk page was also semi'ed for a while. As can be seen in the investigation archive, every time he was banned he'd disappear for a little while and then reappear under a new sock account (or several), claiming to be unconnected with the previous editors who just happened to have the same agenda and posting style - this guy had a serious fixation on Ronald Ryan and was very persistent in trying to get around bans.

Dmol recently raised concerns that Bepopalula was engaged in sockpuppetry, noting that he'd been making similar edits to 93.185.104.30 (since blocked as an open proxy) - compare e.g. with. Bepopalula requested that administrators look at the allegations against him, and since his edit patterns look awfully familiar, this seemed like an appropriate forum.

Edit histories have several suspicious points:


 * First edit by Bepopalula appeared two weeks after the last investigation/ban on another of Escapeeyes' IP socks.
 * As with previous socks, Bepopalula seems to have an extreme dislike of Purrum in particular - compare e.g. with.
 * As with previous socks, every single edit by Bepopalula has been concerned solely with Ronald Ryan - popular articles include HM Prison Pentridge where Ryan was hanged, Wrongful execution, Miscarriage of justice, Capital punishment in Australia, and accusations against Purrum re. his edits regarding Ryan.
 * These edits go over the exact same ground as previous socks. It's not just that both Bepopalula and Escapeeyes believe Ryan was innocent and didn't get a fair trial; it's that they keep making the same points in the same fashion. Compare e.g. with  or, both from previously-identified socks of EE. As an example, all three make a big deal about the point that Ryan's rifle was never forensically examined - even though it's not clear what light this could have shed on the case. (The bullet was never found, so nothing to match against, and Ryan was on the run with the rifle for 19 days, more than enough time to have cleaned it had it been fired.)
 * Curiously, despite this fixation with Ryan, Bepopalula has made no edits to Ronald Ryan itself or its talk page from that account. This would be very peculiar for a new editor who had an interest in the subject; OTOH, it would make a lot of sense for a sockmaster who'd realised that he was too well-known at that page and wanted to avoid getting banned again. (It would not be the first time Escapeeyes has been a little too clever in trying to cover his tracks - see the IP masking incident in his sock investigation archive.) — Preceding unsigned comment added by GenericBob (talk • contribs) 14:26, January 7, 2011

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Based on behavioral evidence, I've blocked Bepopalula as a sock. And that IP has been blocked as an open proxy. —  Hello Annyong  (say whaaat?!) 13:43, 10 January 2011 (UTC)

31 August 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

(Undid revision 678608310 by Purrum (talk) STOP IT PURRUM !!!!!!!!!!!!!!!!!!) (undo)) WIKI EDITORS PLEASE NOTE --- User Purrum persistently deletes newspaper citations solely because he does not agree with the info.

Using same argument, no forensics = no evidence. The bullet was never recovered so no forensics was possible. Ignores evidence of the four eyewitnesses that saw the incident. Purrum (talk) 10:28, 31 August 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - In order to facilitate and expedite your request, please provide diffs to support your case. Please give two or more diffs meeting the following format:
 * 1) At least one diff is from the sockmaster (or an account already blocked as a confirmed sockpuppet of the sockmaster), showing the behaviour characteristic of the sockmaster.
 * 2) At least one diff per suspected sockpuppet, showing the suspected sockpuppet emulating the behaviour of the sockmaster given in the first diff.
 * 3) In situations where it is not immediately obvious from the diffs what the characteristic behaviour is, a short explanation must be provided. Around one sentence is enough for this.  Vanjagenije   (talk)  12:31, 2 September 2015 (UTC)
 * Admin action needed - I need an admin to history-merge this into Sockpuppet investigations/Escapeeyes.  Vanjagenije  (talk)  14:26, 7 September 2015 (UTC)
 * ✅. Callanecc (talk • contribs • logs) 01:56, 13 September 2015 (UTC)
 * Case filler shows no intention to provide diffs. IP not active anymore. Closing the case.  Vanjagenije  (talk)  09:25, 13 September 2015 (UTC)