Wikipedia:Sockpuppet investigations/Lgfcd/Archive

05 September 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

I highly believe that 200.219.132.104, 200.219.132.105 and User:Lgfcd are one and the same, exhibiting identical editing patterns, down to the frequent use of letter-by-letter identical editing descriptions (e.g. fix. [including that distinctive fullstop at the end]). Both 200.219.132.104 and User:Lgfcd seem to be taking an interest in the exact same articles around the same time the other account has been used to edit it, my main examples of this being HMS Hood (51) and Molotov–Ribbentrop Pact. Both editors seem to have a passion for breaking WP:CITEVAR, converting citations to their own personal preference (and arriving on the same article to do so); two independent editors following each other around with identical timing, article choices, and agendas seems beyond coincidental. In the following two example differences on the HMS Hood article, the two accounts seem to have operated together to undo a reversion of a citevar violation: and. On the Molotov–Ribbentrop Pact article, both IPs and the user account have been used 50 or so times within 24 hours to rapidly convert the article from one citation style to another; all three working with identical descriptions and editing with extremely similar aims; see the following sets of edits:  and. User:Lgfcd has been frequently explained to and warned about the meaning of CITEVAR and how his edits regularly break that principle by dozens of editors, as can be witnessed on his talkpage; switching inbetween IP and logged in user accounts may be an attempt to evade 'heat' for continuing to ignore this point. The editor's account was also banned about 9 months ago, due to suspensions of being a bot account performing these citevar violations, this may be a motivating factor for establishing such an evasive editing pattern of routinely flip-flopping between IP and account edits. Kyteto (talk) 16:00, 5 September 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - CheckUsers can't comment on any connection between a named account and IP addresses. ​—DoRD (talk)​ 16:58, 5 September 2013 (UTC)
 * I don't really see a sockpuppetry case here. It looks more to me like Lgfcd is sometimes forgetting (or not bothering) to log in to his account, and that either his home ISP is switching him between dynamic IP addresses, or else maybe he's using two different computers (with two different IP addresses) at a public library, or something like that.  What I'm failing to see here is any evidence that Lgfcd is alternating between his account and the IP addresses as part of an effort to evade scrutiny or to masquerade as multiple individuals.  I do recognize there is a potential WP:CITEVAR problem here, but that isn't within the purview of SPI.  Now, if Lgfcd ends up being blocked for disruptive editing, and then uses IP addresses to evade his block, then we would have a clear SPI case (assuming behavioural evidence supported it — as DoRD correctly pointed out, CU action is normally ruled out if the result would be to associate an account with an IP address).  —  Rich wales (no relation to Jimbo) 18:33, 5 September 2013 (UTC)
 * Closed — Per my previous comment, and no further comments from anyone else after 2+ days. — Rich wales (no relation to Jimbo) 05:23, 8 September 2013 (UTC)

30 April 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

For over 16 months, the original user account and several IPs have been heavily reediting the Saab JAS 39 Gripen article; playing the WP:IDIDNTHEARTHAT card routinely and apparently using a user account and multiple IPs in a suspected effort to obfuscate the situation further. Over and over again, both the Lgfcd (see user's talk page) and the IPs (reversions such as here, here, and here) have been challenged and reverted by over a dozen different editors on the basis of WP:CITEVAR, but he and his suspected IP activities have continued unabated and refuses to acknowledge the WP:POINT or even reply to editors for the last ten months. I have now found that the situation has apparently evolved into full blown sock puppeting as the Eleman account has recently come into play with [|this edit] today.

Besides the obvious topic; there is only one editor (more if you count the socks I suppose) who has been adding quotes into the references (90% of the quotes on the current article actually!), being the four or so IPs he is suspected of using (see these quote-adding revisions - all by 'different' IP editors, in exactly the same vein). (Note: A great deal of information on the inks between Lgfcd and the IPs can be found in the archived case, the reasoning being unchallenged but suggested as being benign (this discovery sheds a different light on that determination in my opinion)). The style and wording of the two account's edit reasons are similar, this often use identical wording/phrases; and both users share an highly uncommon trait of placing punctuation, that is to say full stops, at the end of their edit reasons, for this view their contributions histories side-by-side.

In the last investigation in August 2013, the user was given the benefit of the doubt as having simply been "forgetting to log in"; the simultaneous use of dedicated separate accounts being logged into and switching back and forth between the two (not to mention the several IPs) have now exceeded the bounds of that excuse. I would be very, very surprised if the two user accounts were not shown to be the same person by an IP check. Kyteto (talk) 20:21, 30 April 2014 (UTC)


 * Additional information from the Editor Interaction Analyzer has been invaluable in cementing the links between the various accounts involved, and thus as being the same individual. this report] shows a clear activity link between Lgfcd, 200.219.132.104, and 200.219.132.105, editing within minutes of each other on dozens of articles. If we accept that the IPs and Lgfcd are the same person, then Eleman's editing in the same style and focus as the IPs should therefore follow that the two user accounts Lgfcd and Eleman are likely the same person as well. And one of the reasons that it is important to establish that they are the same person is that the Lgfcd account was previously indefinitely banned (but lifted later) for failing to engage with editors and edit-warring over the WP:CITEVAR issue - I believe the use of multiple accounts and IPs is to conceal and minimize the surface appearance of the same behavior that resulted in his prior banning, and thus is deliberately using multiple mouthpieces/accounts to continue carrying out these activities. Kyteto (talk) 21:58, 30 April 2014 (UTC)

Unfortuantly, a large part of my observations hinges upon those IP's edits, using an "If A = B and B = C, so A = C" logic; in other words if Lgfcd was the same individual as the IPs and Eleman was the same individual as the IPs, that would very likely mean Lgfcd and Eleman were the same. An exclusion of those IPs under which most of the edits are performed wipes out most of the evidence; and it was practically accepted in the last review that the IPs were indeed the same person as Lgfcd. It struck me as odd that an independent account showed up exhibiting several of the writing/behavoural trends/styles of those IPs, which had been concluded to have been Lgfcd. For instance, nearly all of the quotes on the Gripen article were added by the suspected Lgfcd-controlled IPs; one of the very few editors other than Lgfcd-IPs to add a quote to the article just happens to do so on their sole edit to the article - Not substancial on its own, I would agree. Lgfcd (and the IPs) have an odd tick with their punctuation, they love using full stops at the end in their edit summaries, not impossibly uncommon, but unusual; the same punctuation habit appearing on Eleman, sharing that the same quotation habit, it raises an eyebrow that it's a little more than coincidental, but again not substantial. But I guess I've got nothing hard without those IPs then. The quotations were all done under the IPs, and trying to do diffs of his writing system such as the full stop at the end of the edit reason, his preoccupation with adding the phrase "Mid" to month-year statements, that wouldn't amount to anything as substantial. I can fetch those diffs on the aforementioned writing style if you believe it'll be worthwhile, but without the quote preoccupation that was exclusively performed under IPs the case looks a hell of a lot weaker. I agree with your assessment of the Boko Haram edits, which were made after my report above and thus couldn't be taken into account. Kyteto (talk) 17:45, 11 May 2014 (UTC)
 * Yes, individually the stylistic elements aren't anything substantial; I actually noticed no less than five 'boot prints' of Lgfcd-style edits in Eleman's own contributions, the use of the full stop at the end of his edit reasons being one of them. I shall proceed to detail the other four, and in some cases why they are quite uncommon/'conicidental'. Firstly, let's look at 18 Dec 2013 rev of the Gripen article, focusing on the Switzerland section, note how none of the citations have any quotations at this point. This of course changed, all of the added quotes over the next three months were by a total of only two parties: 1. Lgfcd-controlled IPs (see several [examples]) 2. Eleman. That two independent editors would appear with an affection for quotes would appear on the same section; a very specific niche subsection of an already niche subject - in a typical situation it is likely to be completely innocent, unless there were also multiple flagging 'boot prints' of Lgfcd-stylings in the 'independent' editor's work. The very specific subsection of a not too busy article to begin with, the quotations, the timing in line with other Lgfcd-IPs editing the article that day, and (yes...) that habit of the full stop in the edit reasons. And there's just something about the wording of that edit reason that rings familiar - I struggle to put it into words however. I agree that it is a cluster of far-fetched coincidences, but they pile up - which made me think that there was more than just several coinciding coincidences at play here; something that may justify a check, but that's my opinion alone. Kyteto (talk) 20:53, 12 May 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
, please provide diffs that show a connection between the two named accounts (put the IPs aside for the moment). Bear in mind that if they are the same individual, Eleman would be the master as they are a much older account (with far fewer edits). I believe the two accounts have interacted only on three articles. I took a look at one, Boko Haram, and the edits by the two users are completely different. Lgfcd made edits to citations, supposedly cleaning them up, whereas Eleman made substantive edits to the article.--Bbb23 (talk) 16:30, 11 May 2014 (UTC)
 * , thanks for your response. The connection between the IPs and Lgfcd is blatant. However, the connection between the IPs and Eleman is much less so. Please confirm I've got this right. The main connections you see with Eleman are that he puts a period at the end of his edit summary and that he added quotes to an article. If that's so, it's pretty tenuous. Is there something else that would help establish a connection? I'm willing to with the a=b=c logic, but I'm having trouble completing it. I can't block based on that behavior; in my view, I can't even endorse a CU request.--Bbb23 (talk) 19:41, 11 May 2014 (UTC)
 * , in my view, you've added nothing new. Therefore, I'm not blocking Eleman. Nor am I blocking the IPs because their editing is stale. However, in my view, since the last report, there is now evidence that Lgfcd is intentionally using IPs to disruptively edit. Therefore, I have blocked Lgfcd for two weeks.--Bbb23 (talk) 00:59, 13 May 2014 (UTC)

01 November 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

It appears, after coming back multiple times under IPs following the indefinite banning of the main User:Lgfcd account over a year ago, the user has now created a new user account, User:Dutral. This user has shown the same behavior as previous incarnations to the same article the user appears fixated in, Saab JAS 39 Gripen. The same behavior as the other accounts has been exhibited, the nuisance conversion of reference formatting against consensus, the alterations continuing down to the editing of the same references in the same style (a remarkable coincidence maybe?); my instinct says that they are the same user. Several of Lgfcd's socks also use the same short-hand edit description (great socks think alike?), in addition to their similar fascination with editing the same citations to conform with the apparent same formatting, on the same article; see the following diffs: By 177.175.207.250, By Dutral By 187.104.207.100. That they share the same shorthand edit descriptions and formatting subsections could be coincident; but considering the user's persistent track record, I believe it is worth examining. Kyteto (talk) 12:31, 1 November 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  17:36, 11 November 2015 (UTC)
 * - Lgfcd and his socks are, so technical investigation is not possible. All findings have to be based on behavior. You have to provide stronger evidence. You have to show (using diffs) and explain strong similarities in editing and/or behavior.  Vanjagenije   (talk)  15:26, 1 November 2015 (UTC)
 * Indeffing sock, hardblocked 187.104.207.100 for 3 years, hardblocked 200.219.132.0/24 range for three years. These are all him going back years. Closing.