Wikipedia:Sockpuppet investigations/Leandrorezendecarvalho033/Archive

07 April 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same modus operandi as blocked editors 177.134.73.40 and 177.97.73.64. Now also using Leandrorezendecarvalho033.



Fyunck(click) (talk) 05:05, 7 April 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Moved case to named account. Dennis Brown - 2¢  © Join WER 12:59, 7 April 2013 (UTC)
 * Blocked for WP:DE as well. Closing. Dennis Brown - 2¢  © Join WER 13:02, 7 April 2013 (UTC)

11 April 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Fyunck(click) (talk) 23:25, 11 April 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked one week via WP:DUCK. Closing Dennis Brown - 2¢  © Join WER 23:35, 11 April 2013 (UTC)

14 April 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

I've already blocked this account for 24 hours because their entire set of edits consisted of censoring references to full country names when listing birthplaces in former Yugoslavia. There exists an outstanding consensus across en: that we have the least amount of stupid edit-warring over those trivialities when we're most precise, so we either mention the republic names or say the current country name after mentioning .yu. Undoing this en masse can easily be argued to be a gross violation of e.g. WP:ARBMAC. They've also been changing trivial internal references (flagicon) from Serbia and Montenegro to FR Yugoslavia, which is bizarre because that could actually be a move towards precision in some cases (but isn't, for example, in this edit they used the term "FR Yugoslavia" to refer to a 2004 event, when the country was already formally renamed).

The IP addresses are all Brazilian ADSL, so could it be a proxy, and in turn block evasion? It would be exceedingly strange for an actual Brazilian person to be so interested in pushing one particular POV with regard to former Yugoslavia. Joy &#91;shallot&#93; (talk) 08:02, 14 April 2013 (UTC)

I see now that two other IPs from the same ISP were blocked, from another huge range according to WHOIS: Even a soft block for so many IPs seems just too likely to cause collateral damage. --Joy &#91;shallot&#93; (talk) 09:01, 14 April 2013 (UTC)

Another day, another slew of reverts from a new IP. :( Dennis, do you need me to tag for CU or? --Joy &#91;shallot&#93; (talk) 14:25, 15 April 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I agree that doing two /16 rangeblocks is likely to cause more collateral damage than I'm comfortable with at this time. Not sure if mass amounts of semi-protection is the answer either.  We probably need a CU to weigh in. Looking at the most obvious ports, I don't find any evidence of it being an open proxy.  Dennis Brown - 2¢  © Join WER 11:27, 14 April 2013 (UTC)

17 April 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

he's back again today doing the same old things Fyunck(click) (talk) 18:51, 17 April 2013 (UTC)

daily routine with this sockpuppet. Fyunck(click) (talk) 05:54, 18 April 2013 (UTC)

daily routine with this guy Fyunck(click) (talk) 17:59, 18 April 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Looking at these IPs, I see telecom IPs, which means they constantly change. Blocking them here isn't going to help.  Perhaps a list of article to semi-protect would be better at WP:RFPP.  Otherwise, we will keep getting these every day, or every few hours, with no end in sight. Dennis Brown - 2¢  © Join WER 18:57, 18 April 2013 (UTC)

19 April 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

daily routine... this guy is certainly persistent. Fyunck(click) (talk) 15:50, 19 April 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

20 April 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

does this daily. ,. Main sockpuppeteer is probably User:Leandro da silva pereira santos Fyunck(click) (talk) 23:29, 20 April 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
. Leandro da silva pereira santos hasn't edited since September 2012, so any edits from this account are stale. By policy, CheckUser cannot be used to link IP addresses to an account. So, nothing for CU to do here. — Rich wales (no relation to Jimbo) 23:54, 20 April 2013 (UTC)

Also, as mentioned already, these IP addresses all appear to be dynamic assignments from an ISP, and it's not going to be feasible to do a range block. Unless we have evidence of at least one more recent account (i.e., at least two accounts, not IPs, with recent edits), I don't think there is anything either CU or SPI can do here. A better approach would probably be to semi-protect the affected article(s). — Rich wales (no relation to Jimbo) 23:54, 20 April 2013 (UTC)

I have blocked the obvious sock by username above. I am declining everything else at this time - protection would be more feasible. --Rschen7754 03:00, 21 April 2013 (UTC)

27 April 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * Fails the duck test (unneeded links, just see the name). Tb hotch .™ Grammatically incorrect? Correct it!  See terms and conditions.  18:09, 27 April 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I agree that doing two /16 rangeblocks is likely to cause more collateral damage than I'm comfortable with at this time. Not sure if mass amounts of semi-protection is the answer either.  We probably need a CU to weigh in. Looking at the most obvious ports, I don't find any evidence of it being an open proxy.  Dennis Brown - 2¢  © Join WER 11:27, 14 April 2013 (UTC)
 * I put in a targeted rangeblock on the two /16 ranges at Special:AbuseFilter/551. -- King of &hearts;   &diams;   &clubs;  &spades; 19:27, 27 April 2013 (UTC)
 * Closing then, nothing else can be done here. :/ Amalthea  20:08, 27 April 2013 (UTC)