Wikipedia:Sockpuppet investigations/Gumerperu/Archive

03 November 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Contributors with very similar names Gumerperu/Gumersindoperu who contributed mainly only to one article and push with multiple names and multiple votes to keep this article. I highly recommend to look on this request history, with contributions like this one, in which 46.253.39.254 modifies Gumerperu's comment, and also signs with another name. Xtv - (my talk) - (que dius que què?) 13:21, 3 November 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
The two named accounts are ✅ matches to each other. No comment on the IP. TN X Man 13:36, 3 November 2011 (UTC)
 * Gumerperu blocked 1 week, Gumersindoperu indef. Alexandria   (talk)  13:38, 3 November 2011 (UTC)

09 November 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Two new editors whose first edits immediately after registration include comments to the AfD discussion for Jaume Cañellas Galindo. Behavioral evidence such as the style of comment, including but not limited to use of the statement "references [are] verified" as was done by previous suspected and confirmed sockpuppets, also suggests block evasion. Kinu t/c 07:26, 9 November 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * obvious SPAs registered purely for the sake of commenting in AfD/Jaume Cañellas Galindo. Spmdcp's style of simply providing a list of references is similiar to Gumerperu's comment, while Dianaruttman1's comment is similiar to Rosamdcp's. Possible we're seeing large scale meatpuppetry here. Endorsing to check for a link and to get an IP block (preferably at least for the duration of the AfD), if possible, please. Best, SpitfireTally-ho! 00:34, 10 November 2011 (UTC)

is (editing behind a proxy). What I can tell you is that Dianaruttman1's UA doesn't match Gumerperu or Spmdcp. appears to be ❌ to Gumerperu. Looks like meatpuppetry is going on. Elockid  ( Talk ) 00:43, 10 November 2011 (UTC)

13 November 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

In WP:Articles for deletion/Jaume Cañellas Galindo, after Sharonperez2000 made an unintelligible edit, 5 minutes later Gumerperu (apparently forgetting who he was logged in as) tried to clean it up. Gumerperu has been blocked once already (WP:Sockpuppet_investigations/Gumerperu/Archive) for socking on this same AfD, though indications are that he's smartened up and started using proxies. EEng (talk) 11:55, 13 November 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * A few things here push me over the AGF line. Lets kill another (probably) proxy. -- DQ  (t)   (e)  15:21, 14 November 2011 (UTC)
 * Sharonperez2000 is a straight match: technical evidence ✅ that the same person operates that account and Gumerperu. AGK  [&bull; ] 14:47, 15 November 2011 (UTC)
 * Sharonperez2000 is blocked, so we're done. —  Hello Annyong  (say whaaat?!) 03:13, 17 November 2011 (UTC)

20 December 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Another SPA pushing to keep the article Jaume Cañellas Galindo and providing personal information about the subject, as the previous sockpuppets did. Xtv - (my talk) - (que dius que què?) 11:32, 20 December 2011 (UTC)
 * Some new users (SPA) and an IP are behaiving the same way, so I reopen the case. --Xtv - (my talk) - (que dius que què?) 10:26, 26 December 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I was about to make the same nomination. Smells the same as all the others in this long series of socks.
 * EEng (talk) 14:21, 20 December 2011 (UTC)


 * At this point, as much as I'd like the satisfaction of exposing more sockpuppets, the fact is that the puppetry is limited to this one AfD, and it's so manifest there that no checkuser is needed -- and as people seem to forget, checkuser is meant to be something of a last resort, for cases that can't be otherwise decided. In any event it's pretty likely it's a combination of socks and meats (I never thought I'd see the day I'd be tossing these blase terms about like that!) so checkuser wouldn't be a fix-all anyway. As things stand I think only two things are needed:
 * Make sure the closing admin on the AfD isn't confused by seeing one of the persistent reverts of the discussion that the puppets have been making -- note the requisite 7 days will have elapsed in about 24 hours.
 * Some of the puppets, in an attempt to mask their SPA-ishness, made a number of phony edits to various articles, with not-good consequences (e.g. ). I take someone has some magic wand that can mass undo this kind of activity?
 * EEng (talk) 19:59, 26 December 2011 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * This one looks relatively obvious to me, enough so to pass the DUCK test. to see if an IP block is possible.  Steven   Zhang  Join the DR army! 20:26, 20 December 2011 (UTC)

Although one technical indicator suggests they could be related, I'm going to mark this one ❌ at this point. If we get more activity and evidence, we can re-check. Frank &#124;  talk  16:00, 21 December 2011 (UTC)
 * Quack. -- DQ  (t)   (e)  14:28, 24 December 2011 (UTC)
 * - These newly listed accounts (everyone under Misterfister) are fairly suspicious, so I'll endorse. —  Hello Annyong  (say whaaat?!) 17:08, 26 December 2011 (UTC)

The following are ✅ as each other:



The following are ✅ as each other:



The above two groups are as each other, but there are inconsistencies that knock this out of "confirmed" territory.

Misterfister1337 seems ❌ on technical evidence.

Given some inconsistencies in the CU results, there is a small window of possibility that they could be multiple people working together. However, the editing patterns in the groups of accounts above seem to tell a different story. --MuZemike 17:44, 26 December 2011 (UTC)
 * The first group was already all blocked. I blocked and tagged the latter three accounts in the second set as socks of Dianaruttman1, and blocked that account for a week. —  Hello Annyong  (say whaaat?!) 08:04, 27 December 2011 (UTC)


 * I'm not an admin or anything, but since my note in the "other users' comments" section seems to have been overlooked, I'm repeating it here: can someone with appropriate tools rollback the many unconstructive changes made by these socks (other than their comments to the AfD, which should stand as a sort of memorial). EEng (talk) 14:15, 27 December 2011 (UTC)

13 February 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Same behaviour as the multiple sockpuppets. Xtv - (my talk) - (que dius que què?) 16:30, 13 February 2012 (UTC)
 * Since it's already the 4th or 5th time that this user creates sockpuppets, could it be possible to block ip's? --Xtv - (my talk) - (que dius que què?) 17:13, 13 February 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Regarding the checkuser's comment about User:Dianaruttman1 below: personally, I see no reason to leave one of the socks unblocked. At this point, there has been significant bad faith on the part of the sockmaster to justify a block on sight of any of his socks. To leave one of the socks unblocked simply because he may have abandoned it seems illogical, considering it would be blocked the next time it is used anyway. -- Kinu  t/c 19:30, 13 February 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
✅ that the following are the same:
 * (Please note this account has not edited since the last SPI, which resulted in a week-long block. I don't believe they should be blocked again unless they resume editing.) TN X Man  16:40, 13 February 2012 (UTC)
 * All accounts blocked indefinitely. -- Kinu  t/c 19:35, 13 February 2012 (UTC)
 * (Please note this account has not edited since the last SPI, which resulted in a week-long block. I don't believe they should be blocked again unless they resume editing.) TN X Man  16:40, 13 February 2012 (UTC)
 * All accounts blocked indefinitely. -- Kinu  t/c 19:35, 13 February 2012 (UTC)
 * All accounts blocked indefinitely. -- Kinu  t/c 19:35, 13 February 2012 (UTC)

19 February 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

It seems a slightly bit more elaborated SPA, but the pattern is similar as in the previous (multiple) sockppuppets. Could it be possible to block the IP or an IP range? It's the 6th investigation and I think more than 10 accounts have been blocked already... Xtv - (my talk) - (que dius que què?) 15:39, 19 February 2012 (UTC)
 * To me, this looks much like this, this, this or this: overlinking. But well, I might be wrong...--Xtv - (my talk) - (que dius que què?) 23:13, 19 February 2012 (UTC)
 * A handful of links to contribs pages is insufficient. We need specific diffs, edit summaries, a list of similar topics, whatever - something to definitively show enough of a connection before we make a judgment. —  Hello Annyong  (say whaaat?!) 23:46, 19 February 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - This case is woefully lacking in any sort of evidence, so I'm putting it on hold until we get something more concrete. —  Hello Annyong  (say whaaat?!) 16:18, 19 February 2012 (UTC)
 * It seems possible, but not obviously ducky. I see behavior similar to the previous sockpuppets, i.e., a penchant for overlinking, "signing" their own talk page after throwing seemingly arbitrary userboxes on their user page, and just happening to stumble upon a discussion about this article. A CU might be justifiable. -- Kinu  t/c 20:08, 19 February 2012 (UTC)
 * There needs to be considerable hard evidence before a clerk will endorse this case, and definitely before a CU gets run. —  Hello Annyong  (say whaaat?!) 22:17, 19 February 2012 (UTC)
 * If nothing else, User:Angelaquency is a ducksock of the newly-created User:Jorgelopest, and I've blocked both indefinitely based on that analysis. Whether we can tie them to the original sockmaster that is the subject of this report might be moot at this point. -- Kinu, you forgot to sign!  02:18, 23 February 2012 (UTC)
 * (non-admin comment) Thanks, Kinu, for the quick action (even if you did go to Yale). Please keep an eye on the AfD  as it will certainly come under attack just as the first two   did. EEng (talk) 02:36, 23 February 2012 (UTC)


 * I'm fine with those blocks. So closing. —  Hello Annyong  (say whaaat?!) 04:59, 23 February 2012 (UTC)

27 February 2012

 * Suspected sockpuppets




 * ''[added by...EEng (talk) 12:46, 27 February 2012 (UTC)]


 * User compare report Auto-generated every hour.

Same behaviour as in previous sockpuppets. See this. Could it be possible to block IP ranges? Xtv - (my talk) - (que dius que què?) 09:42, 27 February 2012 (UTC)


 * For busy clerks and CUs and so on: the behavior we've seen, over and over, is creation of an account, random overlinking of a dozen articles, then a sudden "discovery" of either the article Jaume Cañellas Galindo or its AfD (e.g., this being the 3rd Afd -- the 1st collapsing under the weight of socks, and the second concluding Delete). This pattern is easily seen via the Contribs of most of the above, although recently they seem to have abandoned bothering with the overlinking, instead just going straight for the AfD.
 * In all honestly I don't think Juantana is a sock, but actually a canvassed meatpuppet -- the editing patterns and linguistic oddities don't match.
 * EEng (talk) 12:46, 27 February 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * Just to clarify, Xtv, checkuser will likely remain silent on the two IPs (or give a severely guarded opinion) because to say they're linked with the named accounts is to reveal the location of those editors, and that's a no-no.
 * In addition to the plea for blocks on the two listed IPs, plus those that the puppets are operating from, does someone have tools to easily roll back all the minor damage these socks have done to miscellaneous articles? Their habit has been to create a phony trail of legitimatizing edits by adding absurd overlinking to random articles.  I started to undo that stuff by some of the socks that appeared during previous AfDs, but it's just too had with normal user techniques.
 * EEng (talk) 12:09, 27 February 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Unfortunately, there are no clear connections between the accounts. I would say they are all different people, but I have hunch there was some sort of off-wiki coordination. TN X Man 15:36, 27 February 2012 (UTC)
 * Two of the socks are blocked, but I don't know what to do about the rest. And given how this case has sat untouched for awhile, I assume the other clerks don't know either. Closing with no further action taken. —  Hello Annyong  (say whaaat?!) 02:10, 1 March 2012 (UTC)