Wikipedia:Sockpuppet investigations/Joe Circus/Archive

10 November 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Since Joe Circus was blocked on November 6th, a number of new users have appeared with a slightly different but remarkably similar posting style. Every one of these users has signed their posts (with the exception of a probable typo from California Mom), and have written full edit summaries. This seems unlikely for new and inexperienced users. Each user has edited Talk:Circumcision as their first (or almost first) edit; however some of these users (Joe Circus, California Mom, and Aussie1947) created a user page as their first edit. Jakew (talk) 20:50, 10 November 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
California Mom is a bordering on  match to Joe Circus - same ISP and geographic area. Comparing Aussie1947 and EditTalk to them would be, as they appear to be editing from proxies of some description in different continents, however from my perspective I would still be willing to say it's they themselves are related to each other. No comment on the IP. Whatever's going on here, I don't think it can be reconciled with the policy on using multiple accounts. WilliamH (talk) 21:33, 10 November 2011 (UTC)

There is some geographic similarity between Off-wiki-gal and Joe Circus, but other than that, they are technically ❌. But remember. WilliamH (talk) 22:03, 10 November 2011 (UTC)
 * After revisiting the technical data, I've blocked California Mom indefinitely as a very sock of Joe Circus. I've also indefinitely blocked Aussie1947 and EditTalk - spurious proxy related stuff aside, there is a definite association between them which I won't go into here. As I said before, there is some geographic proximity with Off-wiki-gal and Joe Circus, but because of where Off-wiki-gal is editing from, examining a connection with CheckUser is . Meatpuppetry could be a reasonable explanation (not least if the name is anything to go by). WilliamH (talk) 19:03, 11 November 2011 (UTC)
 * Everyone's blocked. —  Hello Annyong  (say whaaat?!) 13:40, 12 November 2011 (UTC)

13 November 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Last week I blocked Joe Circus for inappropriate behavior at Talk:Circumcision and his own Talk: page. Since then Joe has been socking using various accounts and IP proxies, which have now been blocked. Yesterday and today my user and talk pages were vandalized by this new account and IP, and the edit summary makes it clear it's about the same issue. Jayjg (talk) 17:32, 13 November 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

A new sockpuppet has just appeared: (This one is obvious, compare with this edit.) Jakew (talk) 17:00, 14 November 2011 (UTC) (edited 09:32, 15 November 2011 (UTC))

Clerk, CheckUser, and/or patrolling admin comments

 * The IP has already been blocked, and I've indefinitely blocked the account. Nothing else to report. No comment on any association. WilliamH (talk) 17:58, 13 November 2011 (UTC)
 * You can't talk about any association at all? If Joe Circus is repeatedly socking here, then we should at least consider a longer block for him. —  Hello Annyong  (say whaaat?!) 18:15, 13 November 2011 (UTC)
 * Sorry, I meant no comment on any association between the IP and account here. As for this account and Joe Circus, we are talking different continents, but given the previous smattering of accounts using international proxies and the behaviour, it quacks loudly. WilliamH (talk) 18:25, 13 November 2011 (UTC)
 * Alright, cool. I've reset Joe Circus' block to two weeks. —  Hello Annyong  (say whaaat?!) 20:14, 13 November 2011 (UTC)

has now vandalized my Talk: page in the same way. It might make sense to do a CU to find other socks. Can this one be added to the case and blocked? Jayjg (talk) 05:16, 14 November 2011 (UTC)
 * Another suspected sock has popped up (see Jakew's addition). Alexandria   (talk)  17:42, 14 November 2011 (UTC)


 * actually, both IPs are open proxies/misconfigured servers. The first IP, 46.19.140.174, is part of a tiny range (46.19.140.168/29) owned by privatelayer.com. The second is a misconfigured server or open proxy. No other accounts on either of these, from what I can see - A l is o n  ❤ 01:35, 15 November 2011 (UTC)


 * I think it is that  is . Another CU may want to confirm/reject. -- Avi (talk) 04:46, 15 November 2011 (UTC)


 * The two accounts are ✅ as each other but are (on technical evidence) as to any relation to Joe Circus (behaviors will be needed to determine socking). However, the two accounts were using an open proxy, which I hardblocked. –MuZemike 17:00, 17 November 2011 (UTC)


 * Were done here. -- DQ  (t)   (e)  09:49, 18 November 2011 (UTC)

20 November 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Quack quack, another account with some weird obsession with some sort of Gilgal conspiracy. Ian.thomson (talk) 14:28, 20 November 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Nothing to report via CheckUser, but an obvious duck indeed, blocked. For the same reason, also blocked . WilliamH (talk) 18:00, 20 November 2011 (UTC)
 * Socks were already blocked, but I tagged them. I've also indefinitely blocked the sockmaster for repeatedly socking. —  Hello Annyong  (say whaaat?!) 18:21, 20 November 2011 (UTC)

03 March 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Behavioral. Joe Circus has dozens and dozens of socks, and makes extensive use of proxies, therefore his IPs geolocate to dozens of countries. Existing known socks generally have a pattern of getting created, making a few nondescript edits over the next few days or weeks, sleeping for a while, jumping into the conversation at Talk:Circumcision, and then not getting used again. These accounts follow that general pattern, have made edits to Talk:Circumcision in the past year or so, have a low total edit count (59 or less) and a low total number of unique pages edited, most of them 1 to 3 pages. Requesting a check for sleepers as well, but I know that because open proxies are used this is hard to do. 20:04, 3 March 2013 (UTC)


 * Thanks for your patience and investigative skills, I believe this is my first SPI request and I'm still learning what's expected from a filing. Appreciate it.    04:34, 4 March 2013 (UTC)


 * Give me a day to make a closer review and I'll see if I can come up with a short list of strong candidates. Am I correct in assuming that if proxies were being used, I would have seen action happen?    13:35, 4 March 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I find it unlikely that a single sockmaster controls puppets using unlisted, non-public proxies on different continents. More likely, random intactivists register on WP to push their point of view, find it hard to achieve instant results, then drop out, but soon another one of their number steps up to the plate and the cycle repeats. If one had the time to trawl through their many web forums, I am sure one would find many calls to right the grievous wrong that is WP's article on circumcision.89.204.137.49 (talk) 11:44, 6 March 2013 (UTC)


 * I think this is a good observation and is in line with the observed editing behavior and technical detail at that page. My thanks to DQ and Someguy for investigating; I don't have any further requests here or evidence to bring at this time.  Cheers...   13:51, 6 March 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - I need diffs. I'm not sorting through a crap ton of users whom are mostly stale to make your case for you because they edit the same talkpage and don't have more than x edits. -- DQ   (ʞlɐʇ)  23:49, 3 March 2013 (UTC)
 * - Just making a tidier list here - these are the suspected socks who are not stale:


 * Someguy1221 (talk) 01:05, 4 March 2013 (UTC)
 * I am of the opinion there is enough evidence here to warrant a checkuser. I have to run, however, and will submit my evidence later tonight. Someguy1221 (talk) 01:14, 4 March 2013 (UTC)
 * - Looking at just the first six of the above seven accounts I have listed, we have six editors whose only and immediate interest upon registering was to edit the Circumcision talk page. There are also some unusual actions for alleged newbies, such as requesting confirmation as one's first edit, or making a bunch of userspace edits and waiting to get autoconfirmed before actually doing anything. Behavioral similarities between some sets of accounts I see are: registering an account just ot make a single edit request ; and making a hard return before signing: . This is a controversial topic and I'm sure many newbies are naturally drawn to the controversy, or directed to that talk page by offsite canvassing, but I believe there is enough evidence to suggest that someone is socking on that talk page. Someguy1221 (talk) 04:23, 4 March 2013 (UTC)
 * I ran Thermoelectric and Acoyoa Chaemetay as they looked the most suspicious to me for being previous users. They are ❌ (polar opposites in location on the globe). Since edit requests and RfPs for confirmed are not rare among newer users, and inconsistencies with the way users write on these talkpages, and bearing in mind the result I just gave, I am of the opinion that there is to run a check on the rest of the users since this is also known as a hot topic area. Thank you for your work so far in looking through the contributions, it's appreciated. --  DQ   (ʞlɐʇ)  10:45, 4 March 2013 (UTC)
 * Aside from the three I thought were behaviorally similar (Tobias and the two you mentioned), I didn't find any striking behavioral similarities. I still think there's something strange going on at that talk page, but I guess it's not sockpuppetry. Someguy1221 (talk) 11:12, 4 March 2013 (UTC)
 * If proxies are being used, that simply means that technical evidence will be unhelpful. Action may still be taken in the case of strong behavioral evidence. Someguy1221 (talk) 19:53, 4 March 2013 (UTC)
 * I went back and checked two additional users after finding enough to count things as highly suspicious, and cross compared. Of the four users I have checked, all are ❌ and there is no indication of proxy use. -- DQ   (ʞlɐʇ)  03:33, 5 March 2013 (UTC)
 * Closing per Zad68. -- DQ   (ʞlɐʇ)  17:10, 9 March 2013 (UTC)

09 July 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Joe Circus has a long history of "cleverly"-named socks used to complain about the Circumcision article, see Category:Wikipedia_sockpuppets_of_Joe_Circus  17:29, 9 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked, closing. King of &hearts;   &diams;   &clubs;  &spades; 03:17, 10 July 2013 (UTC)
 * edited this archive, then was blocked by me as a self-admitted sock. Dennis Brown &#124; 2¢ &#124;  WER  16:45, 11 July 2013 (UTC)