Wikipedia:Sockpuppet investigations/I Love Bridges/Archive

Summary
The user(s) create hoax bridge articles and edit through existing ones.

21 March 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

All these are involved in the creation of hoax bridge articles, and meddling with existing ones. There was a wave of them in February, involving I Love Bridges1 and the first eight IPs on the list, all from the range 166.216.130.* geolocating to Wichita. I Love Bridges 2 surfaced on 19 Mar and spent most of his edits adding spurious db tags to existing article Lordville-Equinunk Bridge, where he was followed by the next four IPs, the 32.137.*.* group, also geolocating to Wichita. The last two IPs, 64.222.150.* have also been involved, but geolocate differently, to Greenville, NH. JohnCD (talk) 22:44, 21 March 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
The registered accounts are obvious WP:DUCKs and are already blocked. The IPs are reported for the record, but I am not sure what to do about them, if anything. The 166.216.130.* group is small enough for a rangeblock, and two of them have made dubious bridge edits since the mid-February episode. JohnCD (talk) 22:56, 21 March 2015 (UTC)
 * JohnCD has done some great sleuthing on this issue. However, as can be seen by the block log of the master, when I blocked him I put in a comment that I thought there was another similar account. And it wouldn't have been I Love Bridges1 because I had no involvement with the account. I would have either blocked the account (not necessarily for sock puppetry but for hoaxing), left a warning on the account's Talk page, or at least deleted one or more of the articles. For the life of me, I can't remember who it is. A CU would help only if the account contributed in the last three months.--Bbb23 (talk) 23:27, 21 March 2015 (UTC)

. Given the history, I'm endorsing a CU for sleepers. As for the IPs, I looked at all the contribution histories. The most recent edit by any IP in the 166 series is March 11. Many are much older. Also, given the nature of these IPs, many have made edits to non-bridge-related pages. Thus, I'm not happy with a range block. Almost all of the 32 and 64 series IPs edited on the same day, March 20, 2015. Assuming that's a one-time occurrence, I'd leave those alone, too. Obviously, if there's more disruption in the future, we may need to revisit this issue. For the moment, I'm more interested in ruling out any other named accounts.--Bbb23 (talk) 14:39, 22 March 2015 (UTC)
 * . ​—DoRD (talk)​ 16:38, 23 March 2015 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Seems to be a WP:DUCK, given the userpage similarity to the last sock and this edit in particular. I also have concerns about. I think it's strange a new account would repeat this edit made by a probable sock, but that's the only connection I could find. Sro23 (talk) 22:09, 12 March 2017 (UTC)
 * If it's any help the previous sockpuppet went on a similar rant to the one below here. Sro23 (talk) 23:06, 12 March 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' Okay, seriously? This is just not okay. I was in the channel when "I Love Bridges" joined the channel. Huon then set mode +q on their hostmask, and I wondered why. I did some poking around myself, and I made the post on AN after I found some interesting things.

The userpage claim is blatantly false. The userboxes between my user page and the sock puppet user page are totally different. The only box that is in common is user wikipedia1. The post on AN should not say anything, either. I don't understand why attempting to discuss a blocked user automatically makes me suspected of being the blocked user. That is outright unacceptable and should not be allowed.

This is my first Wikipedia account. I have never edited under any previous username. I've made some small typo corrections under various IP addresses in the past, but they were so long ago that I don't remember the exact IP's (and in fact, I no longer have access to them).

I'm really tempted to close this myself as the evidence is horribly insufficient, but I know that I am not allowed to do that. Sunsets are Pretty (talk) 22:32, 12 March 2017 (UTC)
 * I do not grant permission for a CheckUser to search my account. I will provide my current IP address privately if requested, but I must initiate this action. Again, do not search my account. If I find out that my account has been searched, I will take action as necessary. Sunsets are Pretty (talk) 22:35, 12 March 2017 (UTC)
 * I'd start with a post on ANI and a talk page message to the CU in question. I may also email the CU in question. If a resolution is not reached/attempts to reach resolution are ignored, I'd probably take it to ArbCom mainly because it is CU related. Sunsets are Pretty (talk) 22:40, 12 March 2017 (UTC)
 * I would suggest reading the Privacy policy, specifically Privacy policy. --AntiCompositeNumber (Leave a message) 22:48, 12 March 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
could you clarify what you mean by taking action as necessary.Amortias (T)(C) 22:38, 12 March 2017 (UTC)
 * Please read CheckUser as this explains that CU can run checks if they choose to for investigation into claims of sockpuppetry. Amortias (T)(C) 22:45, 12 March 2017 (UTC)

, no comments on the behavioral evidence. Regarding your point on granting permission to perform a CU, I'd echo the advice that AntiComposite gave above to read the Privacy policy, which you agree to when you edit this site. GorillaWarfare (talk) 22:52, 12 March 2017 (UTC)
 * I had a look as well and I found that, similar to the previous sock, they're using an anonymizing web hosting range to edit, so that's blocked now. The behavioral evidence is strong enough to convince me that this is ILB, so I've blocked the account. ​—DoRD (talk)​ 01:59, 13 March 2017 (UTC)
 * And now they have edited from their home range, so this is ✅. -- Amanda  (aka DQ) 03:46, 13 March 2017 (UTC)


 * Closing. GABgab 21:50, 13 March 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

These sockpuppets will always 1. have the same userpages (examples:  ) and 2. complain about the (same?) webhost block that impairs their editing experience in one way or another. I don't buy that this user is new here. Sro23 (talk) 00:27, 12 May 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. --Neil N  talk to me 00:36, 12 May 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

The user is obsessed with editing the Fremont Bridge specifically the Fremont Bridge (Portland) article, and particularly with disrupting it in a way that fits the I Love Bridges master. Fits with the May 12 investigation, same userpage - specifically the member of English Wikipedia, would like to be an admin, and would like to be a bureaucrat userboxen. Please note Long-term_abuse/I_Love_Bridges. menaechmi (talk) 00:07, 22 August 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Please compare to . Sro23 (talk) 00:23, 22 August 2017 (UTC)
 * All things considered, there's enough evidence to conclude that the User:KatelynARG is not quite as innocent as they claim to be. I've indefinitely blocked the account. --Deskana (talk) 22:07, 22 August 2017 (UTC)
 * Off the top of my head, I don't know who they are, but good call on the indef. Ahh, scratch that. I didn't realize that they were abusing a proxy-like service when I looked at them earlier. ​—DoRD (talk)​ 22:24, 22 August 2017 (UTC)
 * A tag should not be necessary per WP:DENY. Closing the case. Sro23 (talk) 23:46, 22 August 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Per this, Comfycozybeds is Pillowfluffyhead's new account. The IP is clearly still being used by the same person for vandalism. . Pinging Sro23 (talk) 23:34, 16 September 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Woah woah whoa! Let's hit the pause button here. First of all, I did not "take my computer to a computer shop because someone else was using it". You're right that doing such is just dumb. What happened was that my hard drive was compromised by malicious software, which in turn compromised my computer, which in turn compromised several online accounts that I had logged into on the computer, including Wikipedia. I took the computer to the shop in order to have the infected hard drive replaced.


 * Also, the IP vandalism didn't come from me. I honestly don't know where it came from, but it likely came from someone else in the same housing complex as me, as all the houses share two or three IP addresses.


 * If you want to block my account for vandalism in addition, go right ahead. You'll end up at WP:ANI pretty quickly if you do though, so think twice. I have not done anything wrong and do not appreciate being put in this position. Comfycozybeds (talk) 01:18, 17 September 2017 (UTC)


 * User:Comfycozybeds had make the request for global lock on his compromised account by a vandal at Meta:SRG and now the account has been locked. Don't know what is going on for your computer that you did not take to a computer shop because someone else was using it, its possibly have a theft at behind.  S A 1 3 B r o  (talk) 21:19, 22 September 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * I'm convinced that the 'compromise' was actually a lame WP:BRO excuse. No one takes their computer to a computer shop because someone else has been using  it. I've  blocked the IP for a week. We'll see if that affects the master and their puppet. Kudpung กุดผึ้ง (talk) 00:54, 17 September 2017 (UTC)


 * I have just blocked Comfycozybeds for 24 hours for violating 3RR in an unrelated case. The WP:QUACKing is making my ears hurt, so he's lucky he's got 24 hours and not indef; however I will leave the reviewing admin (he's raised an unblock request) to deal with that. Ritchie333 (talk) (cont)  19:27, 24 September 2017 (UTC)




 * See block log for 249.202. See also block log for 248.201 blocked by.


 * 24.91.248.201 trolls the RfAs for both and.


 * Noting the edit warring test admin tool request page by Comfycozybeds and his current IP, 24.91.248.60 which seems to proxy for an LTA as seen here. See also these contribs. Perhaps could fill us in so that we can compare the current master  to the LTA.


 * Simple wiki edits messing with . The IP has deleted edits there that I can't see. With cross-wiki abuse, we may need to request account locks and rangeblocks from the stewards at meta after the checkuser is complete.


 * The proper master here is and their SPI case archive may be seen here. Their edits here make it clear. Special:Contributions/24.91.248.209 makes it clear also.

— Berean Hunter   (talk)  05:08, 25 September 2017 (UTC)
 * to confirm socks and route out any remaining accounts. Comfy's withdraw of an unblock request after it was suggested that a CU take a look sends up a red flag. This may also be worth some anon rangeblocking due to the levels of disruption so if the checkuser agrees, please implement.
 * Every editor whose first actions are to create their user and talk pages is a sock. I have yet to be proved wrong. Ritchie333 (talk) (cont)  06:02, 25 September 2017 (UTC)

— Berean Hunter   (talk)  14:51, 25 September 2017 (UTC)
 * Pillowfluffyhead and Comfycozybeds look exactly like ILB. The other three accounts are some other LTA. . ​—DoRD (talk)​ 11:55, 25 September 2017 (UTC)
 * Moved casename to correct master, tagged socks and note global lock at meta. Leaving open for review.
 * Both accounts have been global locked, case can be closing.  S A 1 3 B r o  (talk) 17:48, 25 September 2017 (UTC)


 * Closing. GABgab 22:38, 26 September 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

blanking the LTA page and replacing with db-hoax. -★- PlyrStar93. → Message me. ← 15:14, 1 October 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ and blocked. Closing. Katietalk 15:30, 1 October 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Blanked LTA and admitted to be a meat 64.134.189.83 (talk) 14:54, 6 October 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked -- There'sNoTime (to explain) 14:56, 6 October 2017 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Request CU to verify suspicion. I believe the case is non-stale given that I see one of their IP's has been blocked recently (within 3 months). -★- PlyrStar93  → Message me. ← 01:32, 6 December 2018 (UTC)
 * Uploading a bunch of bridge images at commons: See commons contributions. Creating a bunch of pages of bridges here: Middle Thorofare Bridge, Stone Harbor Bridge, Great Channel Bridge and so on.
 * Their user page mentions that they study at Presentation of Mary Academy which turns out the page had been vandalized by IP from I Love Bridge's region and ISP, i.e. 66.31.81.200. Just see the 24.91.248.0/23 IP's from this SPI archive. The account also made an edit at Presentation of Mary Academy.
 * Some messing around at mediawikiwiki: see history of this page, previous IP was making an edit with summary mentioning Xauroflaux (which should be an old sock of I Love Bridges) and Matthew Wong (PMA) rvv'ed it: 1, 2. I have no opinion about the Cogent IP except that it's also blocked here, but maybe Matthew Wong (PMA) has some connection with the IP or the accounts that IP mentioned.
 * Some other connection not convenient to discuss here.

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I just want to clarify that Xauroflaux sock account holding the Bureaucrats tool which having the check user right on Referata test wiki, he could be possible to play with the abuse and get the experience of avoiding scrutiny on here. SA<b style="color:gold"> 1</b><b style="color:green">3</b><b style="color:blue"> B</b><b style="color:indigo">r</b><b style="color:violet">o</b> (talk) 05:24, 6 December 2018 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Sock already blocked by . Case closed. Courcelles (talk) 14:57, 6 December 2018 (UTC)