Wikipedia:Sockpuppet investigations/James Tucton/Archive

HASH(0x3a1b288)

Report date March 24 2009, 19:17 (UTC)

 * Suspected sockpuppets




 * Evidence submitted by Bali ultimate (talk)

These four are all clearly the same user, here for some trolling/abusive purpose. James Tucton and Geoff Keen are already blocked. This came to light because new account apparently had some vendetta againts User:Marek69 per this and this spurious SPI case he opened with about his fifth edit on wikipedia. Marek1961 has a clean block log but currently claims (or an IP on his page at any rate claims) to be caught up in some weird range block. At any rate, User:Gerald1971 was created earlier today and went on to issue "block" messages to Marek and a number of other users asking for information about their IP addresses (none of these users appear to have any blocks). It appears this is tied in to some other user who was recently either blocked for one month or banned. It seems likely that the disruption is not going to end with the simple blocking of Gerald1971, so a CU seems appropriate to see what other associated accounts may be involved. I added the last IP on the list above because it appears related per this edit. That userpage was one of the latest to receive a "warning" from the newest sock.Bali ultimate (talk) 19:17, 24 March 2009 (UTC)


 * Mayalid - Would you reconsider? If I understand i used the wrong code letter. I've used "F" since it's not clear to me what other one best fits (i misread some info on the instructions page which said something to the effect of "use A for new cases." If you're not going to reconsider, tell me here. Would seem needlessly bureacratic to simply refile because i got the code letter wrong.Bali ultimate (talk) 19:35, 24 March 2009 (UTC)
 * Apparently, User:767-249ER may be the master account.Bali ultimate (talk) 23:40, 25 March 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users
 * I've changed the code letter to the more appropriate F. I assume Bali meant "E", which doesn't apply either since there's no community ban or block in place. If I am wrong in doing so please inform or revert me. -Jeremy (v^_^v Cardmaker) 19:39, 24 March 2009 (UTC)
 * Added another account blocked for the same reason as Gerald. -Jeremy (v^_^v Cardmaker) 20:05, 24 March 2009 (UTC)
 * I have added another account that has been used to leave sexually harassing messages on user talk pages where the user name appears to be a female's real name. This account's user signature pointed to Marek69's user page and user talk page. KuyaBriBri Talk 21:04, 25 March 2009 (UTC)


 * Added another account that was harassing Marek69. Is already blocked, added for completeness. // roux   21:04, 25 March 2009 (UTC)
 * Added IP 93.97.167.197 who was signing as Marek69. (Thats me - I'm can't edit with my account at the moment) --Marek69 using IP 91.135.6.121 (talk) 16:18, 26 March 2009 (UTC)
 * I've indef blocked psychanalist and Morek69, who are clearly the same editor and clearly socks from an earlier account, and were blatant vandals to boot. Fram (talk) 20:38, 26 March 2009 (UTC)
 * Added Klaudia2008, who posted yet another baseless complaint at Marek69's SPI subpage. -Jeremy (v^_^v Cardmaker) 23:48, 26 March 2009 (UTC)
 * Also added Naksloanebali, imitating the comments from Morek69 and Psychanalist (plus the username, not Morek related but also named after involved editors). Fram (talk) 13:20, 27 March 2009 (UTC)
 * Added 92.26.242.240; Marek69 listed him at the AN/I thread as an impersonator. -Jeremy (v^_^v Cardmaker) 19:14, 27 March 2009 (UTC)
 * And added another user. Could we have the check done asap?  We're getting two or three socks a day now, and I think we're gonna need a range to kill. -Jeremy (v^_^v Cardmaker) 20:12, 27 March 2009 (UTC)

Requested by Bali ultimate (talk) 19:17, 24 March 2009 (UTC), amended by Jeremy (v^_^v Cardmaker) 19:39, 24 March 2009 (UTC)
 * CheckUser requests

alleged master is not under Arbcom sanction. Mayalld (talk) 19:25, 24 March 2009 (UTC) apparent malicious SPI reports from this farm. Mayalld (talk) 14:20, 25 March 2009 (UTC) for further investigation Mayalld (talk) 14:17, 25 March 2009 (UTC)
 * Evidence: Administrators' noticeboard/Incidents
 * Clerk, patrolling admin and checkuser comments
 * I'm thinking that he was confusing block with ban (happens alot, and is accurate so long as no one unblocks). ips are obviously different (one in Australia and the other in the UK). Anyway, to me it looks like a heap of mess, probably coincidences. Accounts are blocked already, and then there is the issue of the threat but unless it starts up again, I'd say no further action is really nessasary. So unless there is something I've overlooked, I'll motion to close.  Syn  ergy 19:42, 24 March 2009 (UTC)
 * After this was reopened, I added AngelFace1966. They tried to create another case for Marek69.  Syn  ergy 16:06, 25 March 2009 (UTC)
 * on 2 ISPs, the rest is on some very large british ISPs we can't block without a lot of collateral. Can an other CU double check please? -- lucasbfr  talk 22:48, 27 March 2009 (UTC)


 * anything more on this one? Mayalld (talk) 13:38, 6 April 2009 (UTC)
 * Conclusions

There appear to be three separate sets of possibly unrelated sockpuppets in ranges listed above:

✅ Technical and behavioral evidence indicates that the following accounts are related and are likely sock/meatpupets of : ✅ Technical and behavioral evidence indicates that the following accounts are related and likely sock/meatpupets of :

The above two sets geolocate to different continents. I am uncertain why was tagged as a sockpuppet of.

✅ Technical and behavioral evidence indicates that the following accounts are related and probably unrelated to the two groups above:

-- Avi (talk) 14:29, 7 April 2009 (UTC)


 * Moving 767-249ER confirmed to his case and autoarchiving, fixing all tags on socks, and master accounts, then archiving this one.  Syn  ergy 14:54, 7 April 2009 (UTC)

Report date July 10 2009, 17:49 (UTC)

 * Suspected sockpuppets

another sockpuppet, making baseless claims accusing Marek69 of sockpuppetry. Wuh Wuz Dat 17:49, 10 July 2009 (UTC)
 * Evidence submitted by <font color="#21421E" face="Papyrus">Wuh <font color="#CC7722" face="Papyrus">Wuz <font color="#AA0022" face="Papyrus">Dat


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users
 * Blocked him indefinitely on behavior. I'm familiar with the case: one of the MOs is accusing Marek69 of sockpuppetry via SPI; he demanded Marek69's SPI page be unprotected. I support the request; where there's one JT sock there tends to be a few more fermenting. -<font color="32CD32">Jeremy <font color="4682B4">(v^_^v Tear him for his bad verses!) 01:13, 11 July 2009 (UTC)

Requested by <font color="#21421E" face="Papyrus">Wuh <font color="#CC7722" face="Papyrus">Wuz <font color="#AA0022" face="Papyrus">Dat 17:49, 10 July 2009 (UTC)
 * CheckUser requests
 * - Per Jéské Couriano comments above. Tiptoety  talk 04:22, 11 July 2009 (UTC)


 * Clerk, patrolling admin and checkuser comments


 * Most recent activity I'm seeing from confirmed socks is stale; anything more recent to compare against? – Luna Santin  (talk) 04:27, 12 July 2009 (UTC)
 * A quick look at the log doesn't bring much (same country). Marking this case as completed (no obvious sleepers). -- Luk  talk 05:26, 13 July 2009 (UTC)

-- Avi (talk) 05:27, 13 July 2009 (UTC)
 * Conclusions