Wikipedia:Sockpuppet investigations/Harronn/Archive

01 November 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Harronn and F.leviadin were already blocked by User:Parsecboy for abusing multiple accounts, due to their singular purpose in edits such as this and this. The IP addresses appear to be the same user (.49, .69, .144). Ian.thomson (talk) 20:20, 1 November 2014 (UTC)
 * Added Dr.hezkia after seeing this. Different page, but same edit. Ian.thomson (talk) 20:58, 1 November 2014 (UTC)
 * Same edit, same page. Dr.hezkia's gotta be another sock.  Ian.thomson (talk) 21:05, 1 November 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Reopened with permission from MusikAnimal.

Reasons I reopened:


 * 1) While the data is fresh, I think the unconfirmed socks should be confirmed (or refuted).
 * 2) It would be valuable to look for the real puppetmaster, as the nominal puppetmaster has only made a few edits. There are "Likely undetected or "sleeper" socks".
 * 3) I just expanded the investigation to include Oncenawhile for this edit - removal of same Iranian Jew population information and same source by another editor - though I continue to AGF, we've only got a nominal puppetmaster and this is a lead that could be followed up on, and I checked with MusikAnimal first.
 * 4) Part of the reason the IPs haven't edited more recently is that they had been blocked by a rangeblock put in at my request.  (This is a response to the initial close.)  Update: rangeblock (expired)
 * 5) It says anyone can request a technical/CheckUser check, and to me, the extant conclusion that there are multiple socks indicates "Evasion of community-based bans or blocks"; if the CU not performed anyway due to the backlog, so be it.
 * 6) To urge all readers (including the accused) who have concerns about the content the socks are vandalizing to read this; we're not arbitrarily censoring these users; we are open to whatever is supported by policy - verifiable, etc.--Elvey(t•c) 19:25, 3 November 2014 (UTC)
 * I'd need to see a bit more evidence. The socks so far have usually been using a cite template for a bare URL, while Oncenawhile used a fuller but manually formatted citation. Ian.thomson (talk) 19:44, 3 November 2014 (UTC)
 * I hear you, but I notice that like the socks so far, Oncenawhile was with that edit using text (including citations) already written by others, so any difference in citation format is a result of that, rather than significant. In any case, that still leaves 4 unassailed reasons: 1,2,4, and 5, for running a CheckUser, and 'backlog' as the only one for not running one at all.  WP:NOTFISHING says, it is not fishing to check an account where the alleged sock master is unknown, but there is reasonable suspicion of sock puppetry, and a suspected sock-puppet's operator is sometimes unknown until a CheckUser investigation is concluded.  I trust the tool will be used by those with the power to use it only as warranted, and that's all I'll say about that.--Elvey(t•c) 21:38, 3 November 2014 (UTC)

I've added a link to the log of the rangeblock; too bad the User compare report doesn't find such blocks (yet).--Elvey(t•c) 21:38, 3 November 2014 (UTC)
 * Thanks for the CU! It's not magic pixie dust; the puppetmaster must be going through some pretty extreme measures to avoid detection.  Appreciate the work. --Elvey(t•c) 09:11, 7 November 2014 (UTC)
 * User:Ponyo, I've updated the tags on the confirmed socks user pages, so now is empty.  If Oncenawhile can be tagged as a possible sock with  /the weak correlation is enough for such a tag, please say so.  I've cautiously assumed not.--Elvey(t•c) 20:28, 7 November 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Dr.hezkia blocked, all accounts tagged. Not going to block the IPs as they have not edited in quite a while, but with Persian Jews now semi-protected we should have little to worry about. Closing &mdash;  MusikAnimal talk 05:06, 3 November 2014 (UTC) you assume correct. I wouldn't place a tag on an account without more evidence of a connection.-- Jezebel's Ponyo bons mots 20:32, 7 November 2014 (UTC)
 * and are ✅ to . You will need much stronger behavioural evidence if you wish to tie these accounts to  as the technical data shows only a weak/ correlation between the accounts.-- Jezebel's Ponyo bons mots  21:36, 6 November 2014 (UTC)
 * What has been said above in this section agrees entirely with the conclusion I reached on the basis of behavioural evidence. The evidence against Oncenawhile is far too weak to consider taking any action, but the other accounts are clearly sockpuppets. None of the IP addresses has edited recently, so there is no point taking any action unless they start up again. The editor who uses the pseudonym "JamesBWatson" (talk) 14:00, 11 November 2014 (UTC)