Wikipedia:Sockpuppet investigations/Junior5a is not nice/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

All of these users are creating the same attack pages in a short duration of time. Let's find the IP address and block it. CLCStudent (talk) 15:06, 13 September 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I've reported the user's to WP:OS to have the pages rev-del'd if possible. This is a severe case of WP:OUTING RickinBaltimore (talk) 15:13, 13 September 2016 (UTC)
 * Just to update I just received email from the OS team advising all the request I sent have been oversighted RickinBaltimore (talk) 15:46, 13 September 2016 (UTC)
 * Not to pile on the list of users below, but you might want to add to this list as well. RickinBaltimore (talk) 20:00, 13 September 2016 (UTC)
 * User:CYyCo appears to be the latest one. Sro23 (talk) 20:06, 13 September 2016 (UTC)
 * too. 20:17, 13 September 2016 (UTC)
 * continuing claiming to be on "randomit proxy v2.25" RickinBaltimore (talk) 20:29, 13 September 2016 (UTC)
 * And they will not stop. By the way if this is not helpful, please let me know. RickinBaltimore (talk) 20:38, 13 September 2016 (UTC)
 * The latest sock, User:What sock is just claimed to be Evlekis, but I'm not sure what to believe. Sro23 (talk) 20:51, 13 September 2016 (UTC)
 * Must be watching this page because the latest one also mentioned Royer2356. Sro23 (talk) 20:58, 13 September 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * I'm fairly sure this is . GABgab 15:26, 13 September 2016 (UTC)
 * - To investigate whether an IP-block is feasible. I would also appreciate if an admin could merge this into the Evlekis case - the pages created may now be oversighted, but I remember seeing them mention Evlekis. GABgab 15:30, 13 September 2016 (UTC)
 * The reason I've put this on hold is because it's more complicated than it appears. The accounts listed above do not match Evlekis technically, although I can readily understand the behavioral connection. OTOH, there are accounts attacking Junior5a who are ✅ to Evlekis, e.g., and, the latter I just blocked a moment ago, the former already blocked before I checked. For the moment I don't want this case merged until I do some more work, which may take a while. Unfortunately, though, it looks unlikely that I can do any IP or range blocks that will do any good as there's too many ranges involved. A lot of hopping and a lot of use of proxy servers by the non-technical-match-Evlekis socks.--Bbb23 (talk) 15:50, 13 September 2016 (UTC)
 * One way you can help is to dredge up as many of the blocked socks you can that you think are related and add them to the list of sock puppets at the top. My guess is they will fall into two groups technically - hopefully not more - and maybe we can sort it out. Thanks.--Bbb23 (talk) 16:17, 13 September 2016 (UTC)
 * According to, who was referring to some heavy vandalism of the reference desks that necessitated protection, "There's been a few socks around today, apparently User:Evlekis one of them, and possibly the most likely." In that case, the refdesk vandals are:




 * But I'd appreciate if Zzuuzz they could confirm that they did, indeed, mean this. GABgab 19:02, 13 September 2016 (UTC)
 * For the Evlekis connection I refer the honourable admins to the deleted edits of . There may also be a connection in the suppressed edits - both 'groups' have suppressed edits, though I can no longer be sure. I was mainly going by my feel for the timing of the attacks. I'd recommend a look through my blocking logs if you haven't already. I note also that 'Royer2356' ( was also active (whoever that really is). -- zzuuzz (talk) 19:17, 13 September 2016 (UTC)
 * Added even more suspects from the blocklog:




 * Thank you for clarifying, Zzuuzz. GABgab 19:33, 13 September 2016 (UTC)
 * Add this one as probably somewhere in between: . -- zzuuzz (talk) 19:39, 13 September 2016 (UTC)
 * To go with the mention of Royer2356, the timing of these two accounts looks more than suspicious: and . -- zzuuzz (talk) 20:48, 13 September 2016 (UTC)

Thanks for the list. However, I don't know when I'll get to this. I'm not even sure it's worth my time. First, admins are doing a great job blocking these accounts fairly quickly. Second, as I said above, based on my earlier check of several accounts, there's nothing I can do to prevent these accounts from editing in advance. I don't know about edit filters, but nothing in the way of IP blocking. That leaves just the craving to know which accounts belong to which master, and that's mostly academic as long as the socks are being blocked.--Bbb23 (talk) 21:01, 13 September 2016 (UTC)
 * If you feel like banging your head repeatedly into a brick wall then I suggest you run a check. As the account were popping up I was blocking and mass deleting the article creations and then checking the accounts. Other than blocking a few open proxies it was a useless endeavour as there is no pattern to the data. We're well past WP:DENY. I wouldn't even bother continuing to list the accounts here as it's just egging them on and the abusive usernames are repeated.-- Jezebel's Ponyo bons mots 21:19, 13 September 2016 (UTC)
 * Closing based on Ponyo's comments. Brick walls aren't my thing. Bbb23 (talk) 21:23, 13 September 2016 (UTC)