Wikipedia:Sockpuppet investigations/Grfr12345/Archive

04 June 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

The suspected sock, after making eight nonsense edits to their sandbox (so that, with the two edits that created their user page and user talk page, they hit 10 edits and thus autoconfirmed to bypass semi-protection), transcluded the suspected master's RfA onto the page, substed the appropriate template, and cast a support vote. This would seem to be a fairly obvious sock in order to provide an extra support vote, but the fact that the sock account was created some months ago gives me pause (as well as the evident familiarity with the RfA protocol in contrast to the transparency of the ruse); looking more in depth here might be worthwhile. Writ Keeper &#9863;&#9812; 19:59, 4 June 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I'm confused on what is going on here  Aneditor (talk tome) 20:54, 4 June 2014 (UTC)
 * Evidence would suggest that you and are one and the same. Do you have any explanation on why this would be the case?  Tiptoety  talk 21:40, 4 June 2014 (UTC)
 * I know in person and we do share some very similar interests, including trams. However we are not the same person. Aneditor (talk tome) 07:15, 5 June 2014 (UTC)

I'm inclined to think Freo's comment above is correct; I have had a little previous interaction with him and he seemed to have enough sense to avoid doing something like this (and, it's been quite long and they've commented on several RfAs, so I'd assume they'd know how it works). Ansh666 10:04, 5 June 2014 (UTC)


 * Maybe ZTE908 is another editor (either someone who knows Grfr12345 or an unrelated troll) who has noticed the attempts by Grfr12345 to gain admin and rollback rights, and decided to pose as a sockpuppet to get Grfr12345 blocked. The open proxy use could be to prevent an "unrelated" result. Impersonation such as this has been attempted before. Another possibility is that all three accounts are used by the same person, and the edit warring is to make them appear unrelated; this is also something sockpuppets have been known to do. Peter James (talk) 17:01, 5 June 2014 (UTC)
 * Finally the truth comes out through and . Aneditor (talk tome) 21:55, 5 June 2014 (UTC)
 * Although what the purpose of getting an unknown, <300 edit account with no obvious conflicts blocked would be is beyond my comprehension. Ansh666 01:27, 6 June 2014 (UTC)
 * This is indeed very interesting. On one hand, it's a bit difficult to believe that someone capable of socking on an open proxy would not understand that you need more than a couple hundred edits to pass RfA and that the socking would be easily detected, the way it was conducted (supporting the idea that ZTE908 is a joe job). On the other hand, I don't know why someone would want to target Grfr12345. -- King of &hearts;   &diams;   &clubs;  &spades; 03:38, 6 June 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * For starters, is edit via an open proxy (now blocked), meaning the connection between them and the master is . That said, the behavioral evidence speaks for itself.
 * Secondly, is technically  though they are editing from a mobile range. Additionally, both edit tram related articles: Grfr12345, Fremantle99. Both edited/participated in WikiSnap Challenge: Grfr12345, Fremantle99. Also, Fremantle99 offered to nominate Grfr12345 for adminship. The odd part is this article's history, which shows the two accounts edit warring with one another. Before any action is taken against Fremantle99, a more thorough review of editing behavior should be conducted. I'd also suggest contacting Fremantle99.  Tiptoety  talk 20:12, 4 June 2014 (UTC)
 * In other words... ;) ​—DoRD (talk)​ 21:50, 4 June 2014 (UTC)
 * I've run WikiChecker on both of them (Grfr12345 and Fremantle99), and here's what I found: The hours of day suggest that both users are Australian (no surprise there). Frequencies by day of the week are pretty different, and I cannot discern any obvious pattern in the number of edits over time. Given that both only have a few hundred edits, time-based analysis is mostly inconclusive. I also noticed the discrepancy in the namespace pie chart; as a result, my hunch is that they are different people. King of &hearts;   &diams;   &clubs;  &spades; 08:09, 5 June 2014 (UTC)
 * Closing with no action based on King of Hearts' evaluation. I'm archiving rather than deleting as there is evidence suggesting a link of some sort. Callanecc (talk • contribs • logs) 11:24, 12 June 2014 (UTC)