Wikipedia:Sockpuppet investigations/Karunyan/Archive

18 May 2010

 * Suspected sockpuppets

All IPs already pretty much confirmed on behavioral and all being from the Tamil Nadu area of India, but feel an SPI is needed to really have hard evidence on these ranges for easier cataloging and ID by others. All exhibit the same behavior as Karunyan, namely his continued, disturbing wikihounding of myself, primarily through List of Blood+ characters, and the random addition of "vandal shrine" notices on various Long Term Abuse reports with each IP. As he has continued to evade his ban, also asking for check user to check for possible sleepers as it seems unlikely he is satisfied with just IP socking when he had at least one named sock. See Administrators' noticeboard/IncidentArchive604 for the original discussion which led to his indef block and to the revelation of his using socks. Already suspect range blocks aren't likely to be a possibility, but posing that question as well. -- AnmaFinotera  (talk · contribs) 05:47, 18 May 2010 (UTC)
 * Evidence submitted by -- AnmaFinotera  (talk · contribs)
 * Added two more that he self-proclaimed. One couldn't be more obvious. -- AnmaFinotera  (talk · contribs) 13:16, 18 May 2010 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by -- AnmaFinotera  (talk · contribs) 05:47, 18 May 2010 (UTC)
 * CheckUser requests

– It's darn clear that these IPs all are from the sockmaster. No CU necessary. –MuZemike 06:31, 19 May 2010 (UTC)
 * I don't think the range block worked. He vandalized this page right before you posted that (removing the one named sock that has been uncovered), and my user talk (again) afterward I was thinking of CU primarily to find any other named sleepers, or even actives. -- AnmaFinotera  (talk · contribs) 12:42, 19 May 2010 (UTC)

59.96.16.0/20 blocked 1 week. List of Blood+ characters also semi-protected for a while. –MuZemike 06:31, 19 May 2010 (UTC)
 * Clerk, patrolling admin and checkuser comments
 * blocked for one week. Tim Song (talk) 04:32, 20 May 2010 (UTC)

Suspected sockpuppets




Evidence submitted by AnmaFinotera
Three more spoof accounts doing the usual wikistalking and vandalizing of various articles I've edited, including branching into page move vandalism and vandalizing other various India oriented articles. Usual check to confirm they are him, check for sleepers, and see if the current IP range block from the last ANI can be extended/expanded. Some of those named above seem to have been created at the same time as that discussion, so possible sleepers were missed in the last CU, however some have also been made since then. -- AnmaFinotera  (talk · contribs) 23:15, 14 June 2010 (UTC)
 * Add one newer one, and two older ones which may possibly stale, but that seem to be along the same line of being spoof accounts. Some possibly are Bambifan rather than Karunyan based on dates, but either is possible. -- AnmaFinotera  (talk · contribs) 23:25, 14 June 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
Requested by -- AnmaFinotera  (talk · contribs) 13:27, 14 June 2010 (UTC)


 * - T. Canens (talk) 23:47, 14 June 2010 (UTC)

and are.

✅ =
 *  
 *  
 * 
 * 


 * is, but not impossible, as it is editing from a mobile range. J.delanoy gabs adds  05:45, 15 June 2010 (UTC)
 * Fun fun...wonder where the Zombie motif came from. Looks like the SIayer one isn't blocked though?-- AnmaFinotera  (talk · contribs) 05:59, 15 June 2010 (UTC)

Evidence submitted by TheFarix
Obvious socks of puppeteer making the same edits to Talk:Dragon Ball as a self-identified sock. CheckUser requested to find additional sleepers. —Farix (t &#124; c) 21:55, 26 June 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
Requested by —Farix (t &#124; c) 21:55, 26 June 2010 (UTC)
 * - We need a checkuser to tell who is who here. Note that was ❌ in the last check. T. Canens (talk) 23:13, 26 June 2010 (UTC)
 * This looks like a joe job to me. J'onn J'onzz made an edit, which was reversed as an edit by a sock of a banned user, but I decided it was a misidentification; and then someone else -- I think User:Karunyan -- decided to entertain himself on our dime. The checkuser mismatch between J'onn J'onzz and the others is profound; we're talking other side of the planet and no similarities at all. --jpgordon:==( o ) 04:23, 28 June 2010 (UTC)
 * Moved from Sockpuppet investigations/PWeeHurman, see there for the full history. T. Canens (talk) 04:27, 28 June 2010 (UTC)

Evidence submitted by Jeff G.
One more spoof account and one more IP Address. Please see 1; 2; and the signature in 3. Usual check to confirm they are him, check for sleepers, and see if the current IP range block from the last ANI can be extended/expanded. — Jeff G. ツ 23:17, 26 June 2010 (UTC)
 * Would love to know how that thing got around the filter....grrr....-- AnmaFinotera  (talk · contribs) 23:28, 26 June 2010 (UTC)
 * It appears to have been a sleeper from 05:04, 8 April 2010 (UTC).   — Jeff G. ツ 23:35, 26 June 2010 (UTC)
 * Yeah, I see that now...but two CUs have been done since then at it was missed? That is concerning :-( -- AnmaFinotera  (talk · contribs) 23:38, 26 June 2010 (UTC)

I added more members of Category:Suspected Wikipedia sockpuppets of Karunyan. — Jeff G. ツ 01:05, 27 June 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Comments by other users

 * agree for need for CU to find sleepers since this one has been around since April and got past the user name filter. Also, agree with need to possibly extend range block, since he fully intends to continue to evade his community ban -- AnmaFinotera  (talk · contribs) 23:34, 26 June 2010 (UTC)
 * Added per WP:DUCK. Already blocked. --  AnmaFinotera  (talk · contribs) 01:55, 28 June 2010 (UTC)


 * Added IloveCollectonian & ConductDisMember. WP:DUCK. Ilove per name and Conduct as the account that created Ilove Jarkeld (talk) 09:11, 28 June 2010 (UTC)
 * Added TheAlmightyCollectonian and ConductDissmember, also per Duck and his disruption at ANI. -- AnmaFinotera  (talk · contribs) 13:21, 28 June 2010 (UTC)
 * And add yet another, HolyFlameofCollectonian, while waiting for the CU....-- AnmaFinotera  (talk · contribs) 14:06, 29 June 2010 (UTC)

Clerk, patrolling admin and checkuser comments
Requested by  — Jeff G. ツ 23:17, 26 June 2010 (UTC)
 * both blocked per WP:DUCK, with the IP hard blocked. Per above, a sleeper check and a possible extension of a rangeblock would be nice. CU/clerk- if the IP block needs to be shortened, feel free to do so without further consultation with me. HJ Mitchell  &#124;  Penny for your thoughts?   00:03, 27 June 2010 (UTC)


 * for a sleeper check. T. Canens (talk) 02:50, 27 June 2010 (UTC)
 * His ranges (59.96.0.0/16 and 59.92.96.0/19) are already softblocked on June 5 for 3 months by yours truly. I've unblocked the IP since it last edited in April and I seriously doubt that the user is using that IP right now. In addition, it is part of one of the blocked ranges. T. Canens (talk) 02:56, 27 June 2010 (UTC)
 * I've blocked per WP:DUCK - the account seemed to be only interested in restoring Karunyan's edits. PhilKnight (talk) 12:19, 27 June 2010 (UTC)
 * Yep, that's another of his naming patterns. Not very creative is he... -- AnmaFinotera  (talk · contribs) 17:00, 27 June 2010 (UTC)

Summing up, I think - Tim Song has softblocked two of the IP ranges and the named accounts are already blocked. There doesn't appear to be much more to do, so I will mark for closing. TN X Man 01:16, 30 June 2010 (UTC)
 * ✅ that all the *Coll* accounts are on 59.92.*.*, except for IloveColl* which is . I'm afraid these are busy ranges, with lots of new accounts being created, so blocking the range has a lot of collateral damage.  If it is necessary to block, please be careful to ensure the blocked anons know how to create an account around the block. Based on the data,  is  related to the *Coll* accounts and, and I see an edit or two which support it. I'm not sure how  relates to all this, given that it has no edits.  Anyway, there has been no recent activity from 117.97.177.0/26. John Vandenberg (chat) 17:56, 29 June 2010 (UTC)

Suspected sockpuppets




Evidence submitted by AnmaFinotera
Yet another spoof name sock doing the same old stuff, different day and pages. Need usual checkuser for sleeper check and see if latest range can be blocked. -- AnmaFinotera  (talk · contribs) 14:20, 1 July 2010 (UTC)


 * Two more added from today. From behavior, seems most likely to be in this batch, though the second is also a grawpy sounding one. -- AnmaFinotera  (talk · contribs) 05:32, 2 July 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
Something is up here and expanding the rangeblock will help us greatly. Kevin Rutherford (talk) 00:36, 2 July 2010 (UTC)


 * This account was created before the rangeblock. John Vandenberg (chat) 02:28, 2 July 2010 (UTC)
 * Which brings to question of how did it escape the sweeper checks which have been done since then? ~confused~ -- AnmaFinotera  (talk · contribs) 05:10, 2 July 2010 (UTC)
 * Either I'm out of my minds or something is wrong here. The range was blocked on June 5; the account was created on July 1. T. Canens (talk) 15:56, 2 July 2010 (UTC)
 * Guessing from MuZemike's note below, he is now creating accounts on other wikis then using unified to bypass the blocks. -- AnmaFinotera  (talk · contribs) 17:07, 2 July 2010 (UTC)
 * More specifically, he's creating them on other wikis to avoid CU detection via the user creation log; i.e. CU wouldn't be able to catch "sleeper socks" the traditional way. These socks must make an edit here first in order for CU to pick up anything. –MuZemike 19:10, 2 July 2010 (UTC)
 * Oh fun. Guess he gets 2 points for sneakiness. So how would we request a global CheckUser? Is there anyway to deal with him on a wiki wide level instead of just EN to stop it? -- AnmaFinotera  (talk · contribs) 19:49, 2 July 2010 (UTC)

– we're going to eventually need a global CheckUser here. Karunyan creates these accounts on other wikis first and then unifies them and edits here. –MuZemike 05:34, 2 July 2010 (UTC)
 * Finding them via local CU is not efficient (see 24231, and I doubt that global CU is going to be any more efficient. The simplest approach is to block them when they appear.  btw, I was wrong about "Collectonian no jutsu" being created before the rangeblock; as you and others have pointed out, these accounts where created on other wikis to bypass our blocks.  Is there a bug about this? John Vandenberg (chat) 23:57, 2 July 2010 (UTC)
 * So that's it? We're powerless against someone who is obviously exploiting the software and is battering another user (and others) senselessly with socks? Ridiculous. I just hope hoards and hoards of other banned sockmasters don't follow suit. –MuZemike 02:23, 3 July 2010 (UTC)