Wikipedia:Sockpuppet investigations/Hypocaustic/Archive

24 December 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Both accounts share an identical pattern of obsessively removing the term "train station" from across Wikipedia such as this by Wedensambo and this by SnrRailways. SnrRailways is currently blocked for making a large number of near identical edits without permission for script assisted editing and while a discussion at WikiProject UK Railways on the issue is still in progress. While SnrRailways had stopped editing activity moved to the Wedensambo account with similar bot-like repetitive editing on Japan railway articles. Similar polite but unhelpful responses to queries from other editors have been seen from both accounts. I am requesting CheckUser because an editor this obsessive is unlikely to have stopped and other accounts or sleepers seem likely. Charles (talk) 14:21, 24 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I had a quick look, as I was concerned about the bulk editing, although evidence of discussion and consensus would mostly shut me up. There are many edits of this type from both accounts, both starting around October. I have not checked exhaustively (I'm hoping/assuming that that's someone's job!) but on quite a few samples I found that one account seemed to take over when the other left off; that is, they seem to overlock, interlock, not overlap. Having said that, I am not sure that this is evidence or just an observation, and of course even if they are socks they could be legitimate uses for all I know ... I'm largely inclined to shut up now and leave wiser heads to ponder it DBaK (talk) 16:13, 24 December 2012 (UTC)

With regret, I am adding User:Hypocaustic to this. The behaviour complained of here seems very similar, and there seem to be similarities in the times of editing. Please note though that I have not checked this thoroughly and I am certainly not accusing Hypocaustic of anything - it just seems that it might be sensible to look at those patterns too. DBaK (talk) 21:01, 24 December 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Looks fairly clear to me, but given the age of the accounts it's probably possible. I'm reviewing SnrRailway's block anyway, and CU could be helpful in determining what was going on with the bot edits. Hers fold  (t/a/c) 22:29, 24 December 2012 (UTC)
 * All listed accounts ✅; looks like the bot-like edits were done either using some form of Javascript or manually, as no account is showing a useragent indicative of any sort of editing program. No other accounts found, though. Hers fold  (t/a/c) 22:31, 24 December 2012 (UTC)
 * All blocked. ( X! ·  talk )  · @246  · 04:54, 26 December 2012 (UTC)

20 February 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same pattern of behavior as prior socks and, especially obsessively removing the phrase "train station" at a pace tha must be script aided, including changing redirects where there is no reason to. See edit history. Note that almost all of these edits were immediately undone, et the user returned today to repeat them, just as the prior socks have done before. Also note the near identical (and wholly factually a incorrect) essays at the SnrRailways user page and the current John Snow II user page. Clear case of a duck quacking to me. oknazevad (talk) 16:37, 20 February 2015 (UTC)

User:Garibaldi do Biscotti has been making the same changes and move of articles from train station to railway station. Secondarywaltz (talk) 23:18, 23 February 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * Having been involved in the previous investigation this does look very similar.Charles (talk) 23:24, 23 February 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Symbol declined.svg Declined Previous account is Time2wait.svg Stale. Callanecc (talk • contribs • logs) 09:27, 22 February 2015 (UTC)
 * Seams that this user is doing the same thing the block user was doing: using some kind of bot to change "train station" to "railway station" wherever found. He menages to make this change in three different articles within one minute. CU is not possible here, but behavioral evidence is very strong that this is sockpuppetry.  Vanjagenije  (talk)  23:06, 23 February 2015 (UTC)
 * - - Now when another possible sock is found, those two may be compared to each other. They are making series of identical edits. This is either a sockpuppetry or users using the same (unapproved) bot.  Vanjagenije   (talk)  23:22, 23 February 2015 (UTC)
 * All those users are using some kind of bot or script to change links from "train station" to "railway station".
 * Here, makes such edits:  (eight within less than a minute);
 * Here, makes identical edits:  (9 within less than a minute);
 * Here is : (He is slower, only manages to make two or three per minute. Still he made thousands of such edits.);
 * And, finally, here is : (The pace is simmilar as with John Snow II, two or three per minute.).
 * By the way, is the oldest confirmed account, so the page should be moved to his name in the title.  Vanjagenije   (talk)  00:53, 24 February 2015 (UTC)


 * ✅ that and  are the same. I have applied the appropriate blocks and an explanation provided on John Snow II's talk page. - Mailer Diablo 19:22, 24 February 2015 (UTC)
 * Two newly suspected users are confirmed to each other. Unfortunately, they may not be connected to because all his confirmed accounts are by now . Sock is tagged and indeffed, master is warned and blocked for a week. Closing the case.  Vanjagenije   (talk)  12:32, 25 February 2015 (UTC)
 * WP:DUCK? Especially since the most recently discovered socks do date back close to the blocking of prior socks. Notably, John Snow II was created on December 27, 2012, three days after Hypocaustic and SnrRailways were blocked on December 24, 2012. And John Snow II's very first edit was to his user page. That's a common tactic of a sockmaster making the new sock look like a more experienced editor, as it eliminates the redlink to the user page that newbies usually have. Behavioral evidence is incredibly strong here, even if the checkuser data is too stale to use. John Snow II should be indeffed as well. oknazevad (talk) 12:53, 25 February 2015 (UTC)


 * I agree with Oknazevad's assessment. The behavioral evidence here is quite strong. I've blocked and tagged John Snow II as a sock of Hypocaustic. Mike V • Talk 23:09, 7 March 2015 (UTC)

18 May 2016

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

. Again falsely claiming the "train station" is wrong, an incorrect assertion that was the perenial claim of Hypocaustic, and his subsequent socks, complete with the edit warring afterwards. Also, pointless changes in ENGVAR when there's no WP:TIES, as seen here, much as the prior accounts did. In other words, WP:DUCK. oknazevad (talk) 03:32, 18 May 2016 (UTC)
 * Addendum. The latest account dates to shortly after the prior ones were blocked, as was the case before. oknazevad (talk) 03:35, 18 May 2016 (UTC)


 * Probably should also mention the hack job on the lead at train station he did here, claiming "neutrality", despite the well established consensus about the title of the article. oknazevad (talk) 03:53, 18 May 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

In the dab page Station, the accused's recent edits concerning "train station" were persistently repeated after being reverted. I sought help at Talk:Train station, where the behavioral pattern was quickly recognized. After reviewing the archived SPI investigations, based on comparing previous behavior with edit history at Station, I support this request by. Lwarrenwiki (talk) 04:08, 18 May 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * This seems fairly clear to me. Blocking under ; the signature sign off edit summary, other common edit summaries, and a fixation on railway station links and wording. I'll let the clerks close up with the appropriate tags.  Mkdw talk 04:47, 28 May 2016 (UTC)