Wikipedia:Sockpuppet investigations/KO.2/Archive

22 June 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

The Blanking and MFD tag removal thread at Wikipedia:Administrators' noticeboard/Incidents provides details. In that discussion, Jsjsjs1111 notes user has at least 17 sockpuppets on zhwiki. Four of User:KO.2's pages are now at MFD, and at least two are mirrors for his other pages, so he knows how to duplicate content in effort to keep it from getting deleted. In the ANI thread, Blackmane brought up a good point about User:KO.2 playing whack-a-mole with subpages. Knowing all the user ids will help editors locate any recreation of a WP:G4 user page that was deleted per an MfD deletion discussion. Uzma Gamal (talk) 12:52, 22 June 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * - The Bushranger One ping only 17:02, 22 June 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Requesting CU to check for sleepers Dennis Brown - 2&cent;    &copy;  21:28, 22 June 2012 (UTC)
 * ✅, with a  sock.  &mdash; Coren (talk) 22:22, 24 June 2012 (UTC)
 * Blocked master for a month, sock indef, and didn't block Мэн-1 as I couldn't see any abuse, even if a little overlap. Dennis Brown - 2&cent;    &copy;  22:53, 24 June 2012 (UTC)

02 September 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

I became suspicious because of an AfD in which several IPs, who had very little to no editing experience, began to pop up in support of keeping an article that User:KO.2 created (AfD here). Upon opening this SPI case, it came to my attention that he's been an established sockpuppeter before. Here is my evidence that the IPs are puppets and that their !votes should be stricken entirely from the AfD, and that all accounts should be blocked:
 * 100.2.41.66 had 11 total edits to its name prior to participating in the aforementioned AfD. Several of those pertained to NBA articles . Out of the blue he decides to participate in the NBA-related AfD as a "keep" vote. Prior to his August 26, 2014 AfD participation, he hadn't edited since August 10 (i.e. prior to the AfD).
 * One day after 100.2.41.66 voted keep, User:KO.2 officially decided to participate and vote keep as well . The timing and similarity of poorly-thought out objections are very similar (100.2.41.66's rationale was "NBA Playoffs and NBA Finals, they're different." and User:KO.2's was "In the NBA, the players make 60 points in a game, or make 50 points in a playoffs game, or make 40 points in a final game, they're not easy." The brevity and syntax of these arguments is similar IMO.)
 * On August 30, just three days after User:KO.2 joins the discussion, 74.72.5.181 makes his first-ever edit, a test edit in the AfD . But then, just 13 minutes later, 74.72.10.132 fixes that test edit and votes keep . Also interesting about 74.72.10.132 is that he had only ever made 3 total edits to Wikipedia prior to participating, 2 of which pertained to NBA articles within the past month.
 * 74.72.10.132's keep rationale exhibits a very poor grasp of the English language ("I cannot understand how about persist to do anything about the deletion? If List of National Basketball Association players with 40 or more points in a final game has be delete, List of National Basketball Association players with 40 or more points in a final game and List of National Basketball Association players with most points in a game must have be delete too. If PPG in a final game is not independent, the PPG in a playoff game and the PPG in a regular season game are not independent too, both. If not，it just is the double standard!") and User:KO.2's own self-created user page says he's from Japan.
 * User:KO.2 has been a confirmed sockpuppeter before. Additionally, he's had a number of MfD's and AfD's about things he created, a number of them pertaining to NBA topics. He's removed MfD templates before and now he seems to be vote-stacking using sock IP addresses. I believe there may be lurkers out there besides the IPs and sockmaster being nominated here and therefore request a CheckUser to block all involved. If found to be guilty as I suspect he will, I need to adjust the ongoing AfD accordingly so let the closing administrator know. Jrcla2 (talk) 14:23, 2 September 2014 (UTC) Jrcla2

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * All three IP addresses are located in either Corona, New York or Flushing, New York, in a tight geographic grouping. Looks like either a dynamic IP address, or a combination of home and work addresses -- unless, of course, you believe that three random users from the same small geographic area all coincidentally found the same AfD discussion and decided to comment.  Dirtlawyer1 (talk) 14:44, 2 September 2014 (UTC)
 * The AFD that prompted this SPI report has now been closed.—Bagumba (talk) 19:55, 10 September 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  18:34, 13 September 2014 (UTC)
 * Given that IP 100.2.41.66 continues to be used to support 's edits, it's obvious that KO.2 is logging out to edit contrary to WP:SOCK. I've blocked the account for three months as escalation of the previous one month block for socking. If KO.2 continues to make logged-out edits to evade their block, please open another SPI for review.--Jezebel's Ponyo bons mots 20:59, 12 September 2014 (UTC)
 * I've hardblocked that IP for 3 months as he resumed editing and evading his block an hour ago.

02 July 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

IP address of a blocked user. A lot of subtle but disruptive edits in NBA-related articles. Identical/supporting edits promoting the "Fieldsanity" hoax, basically copy-pasting content from Jeremy Lin (a.k.a. Linsanity). Mosmof (talk) 14:33, 2 July 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * was only blocked today, and this IP hasn't been used in two weeks. Unless he starts using the IP to evade the block, there's really no action needed at this time. Please re-report should the IP become active.-- Jezebel's Ponyo bons mots 17:58, 2 July 2015 (UTC)

16 July 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Procedural report before blocking as WP:DUCK. Much like before at earlier SPI, Мэн-1 has Fieldsanity hoaxes based off of Linsanity with additions of Fieldsanity into


 * 100.2.41.66:
 * Мэн-1:

There is also similiarity with text copied from Jeremy Lin into
 * 100.2.41.66:
 * 96.246.234.251:

96.246.234.251 is linked to Мэн-1 by having the wherewithal to find and edit
 * —Bagumba (talk) 07:31, 16 July 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' Mosmof (talk) 07:36, 16 July 2015 (UTC)
 * Besides the "Fieldsanity" vandalism, there's also similar/same vandalism in UEFA Euro 2012 and UEFA Euro 2008: and . Like many of the KO.2 socks, the user is pushing the Aleksei Meng/Aleksei Mendeleevskiy/Alexey Mendeleevskiy by actually creating an "Aleksei Meng" article on user page: . Finally, I believe the following users are linked as well:
 * Also note that the user page you noted has the initials ATM, and ATM has been edited before to link to Aleksei Mendeleevskiy, an alleged basketball player. Sometimes these hoaxes redirect the page to Derrick Rose, a famous Chicago basketball player. Othertimes, the hoax is about an alleged basketball player on the Chicago Bulls, the as Rose's in real life.—Bagumba (talk) 08:25, 16 July 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Indef blocked and tagged Мэн-1. IP 96.246.234.251 was already blocked for socking a few days back. Based on prolific socking across multiple wikis described in June 2012 report, requesting CU. Of note, Мэн-1 was listed as a   with no action taken back then.—Bagumba (talk) 07:41, 16 July 2015 (UTC)
 * The following accounts are ✅:
 * (blocked by another checkuser - for the record)
 * The following accounts are :
 * Blocking and tagging when needed. Closing.--Bbb23 (talk) 08:47, 16 July 2015 (UTC)
 * The following accounts are :
 * Blocking and tagging when needed. Closing.--Bbb23 (talk) 08:47, 16 July 2015 (UTC)
 * The following accounts are :
 * Blocking and tagging when needed. Closing.--Bbb23 (talk) 08:47, 16 July 2015 (UTC)
 * Blocking and tagging when needed. Closing.--Bbb23 (talk) 08:47, 16 July 2015 (UTC)
 * Blocking and tagging when needed. Closing.--Bbb23 (talk) 08:47, 16 July 2015 (UTC)
 * Blocking and tagging when needed. Closing.--Bbb23 (talk) 08:47, 16 July 2015 (UTC)

24 February 2016

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Procedural report of WP:DUCK. IP was blocked by on 3 July 2015 for evasion of KO.2. Recently, this Time Warner Cable IP from Brooklyn, New York, has continued the Aleksei Mendeleevskiy hoax. —Bagumba (talk) 09:29, 24 February 2016 (UTC)

Also adding 67.243.179.81, another Time Warner Cable IP from New York that was blocked for evasion in the past that is continuing hoax.—Bagumba (talk) 09:52, 24 February 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Blocked IP for 6 months. Mark for close.—Bagumba (talk) 09:29, 24 February 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

I have blocked the accounts as obvious WP:DUCKs in the last few days. However here are the creation dates of each account:


 * Estabilisher: 10 October 2015
 * NBA8925: 24 June 2016
 * JWB & JIM: 10:40, 27 June 2016
 * All Rise 8925: 27 June 2016

Since KO.2 has been a serial sock since 2012, and given that Establisher went undetected since 2015 and three other new socks have recently been created, requesting a CU to check for sleepers. —Bagumba (talk) 08:23, 15 July 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ✅ and highly to the master:
 * Blocked the unblocked accounts and tagged or retagged all. The last two accounts, the latter of which is globally locked, warrant some comments.  They are obviously the same person based on their interest in Trump hoaxes, but that's, I believe, a little outside of this master's usual behavior.  I've established at least one tenuous connection to the accounts, though, and that's a Russian edit summary by Trump Campaign 1988 2000 2016. See blocked sock .  Do you know of any other connections?--Bbb23 (talk) 14:08, 15 July 2016 (UTC)
 * Yes, they sometimes use Russian in their edit text too. Otherwise, I've got nothing additional to add.—Bagumba (talk) 16:36, 15 July 2016 (UTC)
 * Blocked the unblocked accounts and tagged or retagged all. The last two accounts, the latter of which is globally locked, warrant some comments.  They are obviously the same person based on their interest in Trump hoaxes, but that's, I believe, a little outside of this master's usual behavior.  I've established at least one tenuous connection to the accounts, though, and that's a Russian edit summary by Trump Campaign 1988 2000 2016. See blocked sock .  Do you know of any other connections?--Bbb23 (talk) 14:08, 15 July 2016 (UTC)
 * Yes, they sometimes use Russian in their edit text too. Otherwise, I've got nothing additional to add.—Bagumba (talk) 16:36, 15 July 2016 (UTC)
 * Blocked the unblocked accounts and tagged or retagged all. The last two accounts, the latter of which is globally locked, warrant some comments.  They are obviously the same person based on their interest in Trump hoaxes, but that's, I believe, a little outside of this master's usual behavior.  I've established at least one tenuous connection to the accounts, though, and that's a Russian edit summary by Trump Campaign 1988 2000 2016. See blocked sock .  Do you know of any other connections?--Bbb23 (talk) 14:08, 15 July 2016 (UTC)
 * Yes, they sometimes use Russian in their edit text too. Otherwise, I've got nothing additional to add.—Bagumba (talk) 16:36, 15 July 2016 (UTC)
 * Blocked the unblocked accounts and tagged or retagged all. The last two accounts, the latter of which is globally locked, warrant some comments.  They are obviously the same person based on their interest in Trump hoaxes, but that's, I believe, a little outside of this master's usual behavior.  I've established at least one tenuous connection to the accounts, though, and that's a Russian edit summary by Trump Campaign 1988 2000 2016. See blocked sock .  Do you know of any other connections?--Bbb23 (talk) 14:08, 15 July 2016 (UTC)
 * Yes, they sometimes use Russian in their edit text too. Otherwise, I've got nothing additional to add.—Bagumba (talk) 16:36, 15 July 2016 (UTC)
 * Blocked the unblocked accounts and tagged or retagged all. The last two accounts, the latter of which is globally locked, warrant some comments.  They are obviously the same person based on their interest in Trump hoaxes, but that's, I believe, a little outside of this master's usual behavior.  I've established at least one tenuous connection to the accounts, though, and that's a Russian edit summary by Trump Campaign 1988 2000 2016. See blocked sock .  Do you know of any other connections?--Bbb23 (talk) 14:08, 15 July 2016 (UTC)
 * Yes, they sometimes use Russian in their edit text too. Otherwise, I've got nothing additional to add.—Bagumba (talk) 16:36, 15 July 2016 (UTC)
 * Yes, they sometimes use Russian in their edit text too. Otherwise, I've got nothing additional to add.—Bagumba (talk) 16:36, 15 July 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Their only edits have been to tag themselves as a sockpuppet. That was easy. Sro23 (talk) 17:08, 19 July 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Symbol confirmed.svgWP:DUCK, [[Image:Artículo bueno-blue.svg|16px]]blocked, Symbol opinion vote.svgtagged; Symbol no support vote.svgd. ☺ ·  Salvidrim!   ·  &#9993;  17:15, 19 July 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Report of obvious duck with typical hoax. Check at whois.domaintools.com shows IP to be from Target Corporation, a retail chain in the US headquartered in Minnesota. As KO.2 has been identified as being based in New York in the past, they are likely using from a Target location based in NY. This is a one-time edit so far, but worth noting the anomaly with the IP location for possible future reference. —Bagumba (talk) 09:19, 21 July 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Unless there is further activity on this IP, the case can be closed.—Bagumba (talk) 09:21, 21 July 2016 (UTC)
 * IP not active. Case closed.  Vanjagenije  (talk)  14:21, 22 July 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Procedural report of another WP:DUCK from a Time Warner Cable IP from New York.—Bagumba (talk) 16:18, 12 April 2017 (UTC) —Bagumba (talk) 16:18, 12 April 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Sock has been blocked.—Bagumba (talk) 16:18, 12 April 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Procedural report before blocking IP. Besides the usual "Aleksei Mendeleevskiy" hoax, they also change China to Manchuria like a previous sock did. This latest IP is using Verizon ISP and is located in New Jersey, whereas past ones were in New York. —Bagumba (talk) 10:20, 7 November 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
IP blocked.—Bagumba (talk) 10:20, 7 November 2017 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Procedural report of already blocked WP:DUCK to note they also make incorrect edits regarding Joe Alexander as seen here and by past IP blocked in 2015 with this edit. —Bagumba (talk) 11:26, 31 January 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
IP already blocked. Mark for close.—Bagumba (talk) 11:26, 31 January 2019 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same Joe Alexander–Carmelo Anthony hoax as previous IP sock. IP is now from Massachusetts. —Bagumba (talk) 12:07, 7 March 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
IP blocked.—Bagumba (talk) 12:07, 7 March 2019 (UTC)