Wikipedia:Sockpuppet investigations/Leon103102/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

The user Leon103102 was permantley blocked for persistent editing without citing sources and trying to evade temporary blocks. The user mostly has added unsourced cargo destinations from Ted Stevens Anchorage International Airport, McClellan Airfield, and Cincinnati/Northern Kentucky International Airport to numerous US Air Force bases such as Yokota Air Base and Thule Air Base. Here is the same text added by different IP's on Ted Stevens Anchorage International Airport: Leon103102: 73.93.155.70: 146.74.94.66: 73.93.153.49: Looking at the edit history, it seems like all of the IP addresses are being used by same user and have been consistently adding back the same information without citing sources. Stinger20 (talk) 02:42, 7 August 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Master indeffed, one IP blocked, everything else is too old. Closing. GABgab 14:14, 10 August 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

User Leon103102 was blocked indefinitely previously for adding unsourced/uncited information or added sources that didn't back up his edits in the past, and has previously evaded his block on other IPs. The 2 IPs had edited at similar articles as the master account.

Examples: Ted Stevens Anchorage International Airport Leon103102, 73.93.155.113  & Oscoda–Wurtsmith Airport   (Confirmed as a sock & blocked)  73.93.154.130

Looking at the IPs' edit histories as well as the histories of the blocked accounts of both User:Leon103102 and User:Leonxu4198. It seems that the IP range of 73.93.155.* is being used by the same user and is continually adding the same information without sources (or with outdated sources). An IP range ban of the 73.93.155.* range could be suggested if it is him (it does seem to meet the WP:DUCK criteria). 124.170.134.170 (talk) 04:46, 24 November 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - We do not publicly connect IP addresses to accounts. ~ Rob 13 Talk 16:16, 26 November 2017 (UTC)
 * IP edits are too old. Closing. Bbb23 (talk) 19:13, 30 November 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

This IP has claimed not to be a sock in edit summaries, despite never being accused  Tornado chaser (talk) 23:57, 22 December 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I’m not a sock puppet of Leon103102 - 73.93.152.208 (talk) —Preceding undated comment added 03:48, 25 December 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * The IP is too old at this point, closing. GABgab 01:26, 27 December 2017 (UTC)
 * GABgab 04:44, 29 December 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Claims to be not a sockpuppet of said user however, the contributions of both the IP range of 107.77.213.0/22 and the separate IP of 12.28.167.226 in this report matches similar behaviour to the banned IP ranges of 73.93.152.0/22 & 199.80.250.128/29.

In addition to the persistent vandalism over at the Bagram Airfield page after it got Pending Changes Protected (as per: 1, 2, 3 & 4). Both IPs seems to match the similar behaviour to the behaviour of IPs 73.93.152.* & 199.80.250.* in Bagram Airfield's page history.

Another example is the IP & Master account's behaviour in Oscoda-Wurtsmith Airport's page history where constant disruptions such as adding unsourced content and/or one-off "charters" which seem to state in the Airport's Wikiproject that "one-off" services shouldn't be added, which itself fails WP:NOTE. This is despite previous attempts with others users to converse with him prior to his ban on his master account.

In addition to those examples, all the IPs mentioned seem to add the same unsourced content (or content that fails notability) over and over across similar pages in their edit histories,.

Both IPs seem to meet the WP:DUCK criteria. 1.132.104.100 (talk) 09:51, 5 January 2018 (UTC)


 * Seems like Leon103102 has a pattern of denying that he is a sock without being accused, see this edit from dec 28. Tornado chaser (talk) 12:38, 5 January 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * , . GABgab 15:41, 5 January 2018 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

The IP in questions have the same editing patterns as per 73.92.152.0 and 199.80.250.128/29. The persistent ongoing vandalism at Bagram Airfield as per the page history by removing references and protection templates despite the ongoing Pending Protection just meets the WP:DUCK criteria.

This edit is also the same of one of the recently banned IPs. 1.132.107.93 (talk) 21:17, 6 January 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Both blocked, closing. GABgab 22:19, 6 January 2018 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

This IP has continued editing articles about airports (like the past sockpuppets), apparently avoiding the block. Chris Troutman ( talk ) 07:26, 4 February 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked for a year. Closing. Favonian (talk) 11:21, 4 February 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Their editing history largely matches that of this sock and has been ongoing for a period of 6 months from this IP. --  Dane talk  16:43, 25 May 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * geolocates to Santa Clara County same as previous IPs and makes similar edits to the same airports. Likely the master's school, so blocked for a year. TonyBallioni (talk) 20:12, 25 May 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Well,. Same exact editing as the prior socks (railway stations, airlines and airline hubs). IP also geolocates to the same area. --  Dane talk  23:23, 28 May 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' I wasn't trying to evade my block all I was going to do was summit an edit request 73.15.97.106 (talk)

Clerk, CheckUser, and/or patrolling admin comments

 * for a month. Closing. TonyBallioni (talk) 23:19, 29 May 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same edits as previous socks. \\\Septrillion:- &#8237;  10 Eleventeen 04:38, 1 July 2018 (UTC)
 * Admitted connection here. \\\Septrillion:- &#8237;  10 Eleventeen 04:40, 1 July 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * leaving open for CheckUser. 5 albert square (talk) 05:00, 1 July 2018 (UTC)
 * User is blocked. Case is stale. Closing. Bbb23 (talk) 13:37, 1 July 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Editor interaction analyzer indicates overlap of the two accounts. UnitedandNorthwestFan focuses only on airline-related articles, which fits the criteria. Page was also recently vandalized by an IP that was blocked as a sock of Leon103102. The more recently added IPs display the same behavior as previous socks, focusing on travel-related articles. Particularly ones that other socks of Leon103102 has vandalized. Lupin VII (talk) 05:43, 19 September 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' I am not related to this user UnitedandNorthwestFan (talk) 16:43, 19 September 2019 (UTC)

At the very least, it appears UnitedandNorthwestFan has been editing while logged out (whether intentional or not) - from 24.6.13.13 (see United ps history). All the IPs above locate to roughly the same area. I've looked at behavioural evidence in the UserCompare report, as an example, this edit to China Railway was made by Leon in 2017, and the exact same edit was made by the IP 199.80 in 2018. Several other edits that were made by Leon have been subsequently made by the 199.80 IP.

I've looked only at the edits of UnitedNorthWestFan. Even though there isn't universal re-inserting of edits that were done by the other accounts listed (e.g. on some of the articles here, the IPs removed instances of "road switcher" where UNF added them in), there are edits that overlap (e.g. Boeing 747-200 removed by Leon and by UNF.

However, I found one more edit in the usercompare that I think cements this - 199.80.250.131 (very close to the previously used .133 by Leon) made this edit to remove JFK airport from a list, which was reverted, then removed again by UNF). I think this makes it clear that behaviourally UnitedandNorthWestFan is the same person as Leon103102. [[User:Steven Crossin| Steven] Crossin  Help resolve disputes! 18:23, 23 September 2019 (UTC)

Comment: Whatever the outcome of this case may end up to be, it's pretty clear that Special:Contributions/24.6.13.13 and User:UnitedandNorthwestFan is the same user as both had displayed similar behaviour/attacks such as here and here. Coastie43 (talk) 23:15, 24 September 2019 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
As Bbb23 notes, accounts are too stale for a CU. -- Amanda  (aka DQ) 20:37, 29 September 2019 (UTC) — Berean Hunter   (talk)  20:52, 2 October 2019 (UTC)
 * UnitedandNorthwestFan is ✅ to Leon103102. . I looked at the unblock request for who uses the same useragent but in a different location and not likely Leon103102.
 * On the same IP as UnitedandNorthwestFan and ✅:
 * (stale but the cu log places them on the same IP as well and the edits seem to match both NastyDoctor accounts)
 * (stale but the cu log places them on the same IP as well and the edits seem to match both NastyDoctor accounts)
 * (stale but the cu log places them on the same IP as well and the edits seem to match both NastyDoctor accounts)
 * Close per the above. The SandDoctor  Talk 15:26, 3 October 2019 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Both the contribution lists of the Worldwide Railfan and the UnitedandNorthwestFan account (where the UnitedandNorthwestFan account was banned for being a sockpuppet of Leon103102 per checkuser) share the same edits on the same airline and railway topics. In addition, there are some similar edits between 199.33.32.245 and the banned UnitedandNorthwestFan account where they revert back to similar edits such as this edit from UnitedandNorthwestFan and this edit from Worldwide Railfan.

The contribution lists between Worldwide railfan and UnitedandNorthwestFan also has both accounts reverting my earlier edits on the United p.s. despite showing clear signs of WP:DUCK.

I have also requested checkuser in case Leon103102 may have sleeper accounts. Coastie43 (talk) 05:56, 14 February 2020 (UTC)

Comment User:Worldwide Railfan is currently active and disruptive by editing and mass moving rail articles as per Worldwide Railfan/Leon103102's previous socks and continuing to be disruptive/edit war on the United p.s. article in the past few days. Coastie43 (talk) 22:53, 18 February 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
This case is. CU declined.--Bbb23 (talk) 15:53, 14 February 2020 (UTC)
 * Stale, no action in a few weeks, closing. ST47 (talk) 19:07, 1 March 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

This user is displaying the similar editing behavior of Leon103102, a noted sockpuppetier who was recently using the account "UnitedandNorthwestFan" as recently as September 2019. The United Airlines, Delta Air Lines, and American Airlines pages, as well as several airport pages, have been vandalized with original research. Coastie43 is another editor who can vouch for this claim, and to build this argument, I would ask the admins to reopen the old case files of Leon103102 and UnitedandNorthwestFan; a clear relation will form to support that these accounts are all controlled by the same user. Notable Diffs: https://en.wikipedia.org/w/index.php?title=American_Airlines&diff=cur&oldid=949695118 https://en.wikipedia.org/w/index.php?title=United_Airlines&diff=950427996&oldid=950427793 https://en.wikipedia.org/w/index.php?title=Heathrow_Airport&diff=950053900&oldid=950053806 Theoldkinderhook (talk) 07:21, 12 April 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Request a check against anything in the log for this master plus who was recently reported (in the archive), and a sleeper check. Thanks,  Callanecc (talk • contribs • logs) 04:14, 13 April 2020 (UTC)
 * - Cabayi (talk) 10:30, 13 April 2020 (UTC)
 * Aviation and Railway ✅, plus . I also see enough to connect back to the master. -- Amanda  (aka DQ) 10:50, 13 April 2020 (UTC)
 * Just confirming you meant Worldwide Railfan when you said Railway? Callanecc (talk • contribs • logs) 11:16, 13 April 2020 (UTC)
 * Correct, the one you mentioned. Sorry, it's obviously bed time. -- Amanda  (aka DQ) 11:21, 13 April 2020 (UTC)
 * Blocked and tagged. Closing. Callanecc (talk • contribs • logs) 11:23, 13 April 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same editing pattern on most of the same articles as Special:Contributions/AviationFan123. May have sleepers BilCat (talk) 02:05, 29 April 2020 (UTC) - BilCat (talk) 02:06, 29 April 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅. No sleepers immediately visible., closing. Mz7 (talk) 04:55, 29 April 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same editing pattern on most of the same articles as Special:Contributions/AviationFan123 and Special:Contributions/Civil and Military Aviation. BilCat (talk) 05:11, 26 May 2020 (UTC)

- BilCat (talk) 02:12, 27 May 2020 (UTC)


 * See also - BilCat (talk) 05:20, 27 May 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Comment: Seems like a clear case of quack quack. Contributions of the above mentioned account matches the past 2-3 socks almost entirely perfectly. Coastie43 (talk) 02:18, 27 May 2020 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * per behaviorial evidence. I've also blocked the following IP addresses for block evasion:
 * – blocked for 6 months
 * – blocked for 1 month

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Seems to be a sleeper account that made similar edits as per the previous socks and IPs in the archive. Also reverted a recent edit made by a prior sock (Link: this edit) which was made by Special:Contributions/199.33.32.245 and User:AviationGuy123 reverted them here and here. Checkuser requested as there may possibly be other sleepers. and Coastie43 (talk) 01:55, 16 June 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * Possibly using Special:Contributions/2601:640:10A:79FE:D1BC:8BF6:4C18:A6B5. The IP is editing some of the same articles as the socks. - BilCat (talk) 04:44, 19 June 2020 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Known for sleepers in the past. Probably worth a look for sleepers. There are non-stale accounts in the archives. The SandDoctor  Talk 04:29, 19 June 2020 (UTC)
 * ✅, blocked and tagged and placed at meta. Closing. Callanecc (talk • contribs • logs) 04:38, 19 June 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Likely another IP sock, see edit history and matches with other sock edits Ed6767  talk!  23:18, 26 June 2020 (UTC)

WHOIS results:
 * Match between 2601:640:107:7637:FCF2:5052:9CB8:71D1 and 2601:640:10C:15D3:293F:E933:C804:6155 - at least block evasion. Ed6767  talk!  23:28, 26 June 2020 (UTC)
 * Another match: 2601:640:108:A894:799B:51DC:AD30:8AB2 Ed6767  talk!  23:31, 26 June 2020 (UTC)
 * Looks like many IP socks, all from COMCAST6NET Ed6767  talk!  23:35, 26 June 2020 (UTC)
 * All talk pages tagged with WHOIS headers Ed6767  talk!  23:38, 26 June 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked two of the /64s involved here, one was already blocked. The comcast IPv6 range involved here is huge, so a complete rangeblock isn't possible (and even if it were, it would cause a ton of collateral damage). GeneralNotability (talk) 15:50, 29 June 2020 (UTC)
 * Actually not as huge as I thought (I was looking at the wrong line on the WHOIS), but still pretty big: Special:Contributions/2601:640:100::/40. Sure looks like there are other people editing from those ranges, so unacceptable collateral damage. GeneralNotability (talk) 15:52, 29 June 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Editing the same aviation and rail articles per the previous socks in the archive, also User:Union Pacific 4014 had previously been in edit wars on the rail articles on the use of the road switcher term as per his previous socks. Checkuser requested as Leon has a history of operating sleeper accounts. Coastie43 (talk) 12:29, 2 July 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' I am not related to this user Union Pacific 4014 (talk) 12:40, 2 July 2020 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Both ✅. They've also spent most of the time since the "I am not related" comment trying and failing to create new accounts. Ivanvector (Talk/Edits) 18:35, 2 July 2020 (UTC)

Suspected sockpuppets

 * ( original case name)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Timing of when editing started, which is after user Union Pacific 4014 was blocked and the editing pattern. Appears to be a continuation of Sockpuppet_investigations/Leon103102 Graywalls (talk) 20:13, 3 August 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Comment - I suggest moving this case to Sockpuppet_investigations/Leon103102 as that is clearly the sockmaster account. Coastie43 (talk) 23:37, 3 August 2020 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Mz7 (talk) 21:22, 3 August 2020 (UTC)
 * ✅ plus . ; I will request locks on meta. Please merge this case into Sockpuppet investigations/Leon103102. Thanks, Mz7 (talk) 21:27, 3 August 2020 (UTC)
 * case merged per request. Dreamy Jazz talk to me &#124; my contributions 09:00, 5 August 2020 (UTC)
 * All blocked and tagged by Mz7. All accounts globally locked. Nothing left to do. Close. Dreamy Jazz talk to me &#124; my contributions 09:05, 5 August 2020 (UTC)

Suspected sockpuppets
Has a similar interest to the past socks and IPs in the archives, and has been known to edit war on various airliner pages such as here, here and here. In addition, a past IP range from Palo Alto School District that was reported in this case page previously was used recently, strongly suggesting it is User:Leon103102, as per the 199.80.250.128/29 range link

Also Requesting Checkuser as the Master has a history of using hidden sock accounts as per the archives. Coastie43 (talk) 04:25, 17 October 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ This matter has been handled.  ~Oshwah~  (talk) (contribs)   04:15, 17 November 2023 (UTC)

Suspected sockpuppets
This anonymous user and registered user has editing behavior of making several improperly explained or unexplained edits similar to Leon103102 and edit very similar topics of Aviation (for 24.4.147.8) and railways which the sockmaster and many of Leon's sockpuppets did as well. Further, 24.4.147.8 keeps reverting experienced users' edits in articles and templates to how they want them to be, mostly without proper justification. When a number of 24.4.147.8's edits were undone often due to abusive use/block evasion, 24.4.147.8 and China Railway Inspector keep reverting a number of them to the way they wanted it to be as seen in their contributions history. For example, when I reverted edits made by 24.4.147.8 in Tianjin West railway station, China Railway inspector comes to manually revert the edit back to the same way as 24.4.147.8 did. Hence, I think 24.4.147.8 and China Railway Inspector might be the same person as Leon103102 or at the very least, related to each other due to the similar nature of behavior.

Furthermore, 24.4.147.8 was blocked temporarily in November 2023 because this IP address was used abusively as per Checkuser evidence (Perhaps this IP still is now). ~ SG5536B  ( talkpage  |  contribs ) 00:31, 28 March 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
 * Editing pattern/behavior were also quite similar to the previously addressed IP range 199.80.250.128/29 which seemed to be the same person as Leon103102, was previously range blocked for 6 months in December 2017, and last edited in February 2024. ~ SG5536B  ( talkpage  |  contribs ) 00:58, 29 March 2024 (UTC)

I have tried to email the Arbitration Committee on having me unbanned and none have worked so far so my only choice was to return to editing after 2 years. 24.4.147.8 (talk) 04:19, 30 March 2024 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Chinese Railway Inspector looks fairly to the archives, and is confirmed to the charming .  from a CU perspective, but given that they've admitted to evading a block just above, I've blocked the IP for a while.  Spicy (talk) 01:10, 9 April 2024 (UTC)