Wikipedia:Sockpuppet investigations/LouiseTsun/Archive

16 April 2015

 * Confirmed sockpuppets




 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

These accounts have been repeatedly blanking the reference desk pages, and they often target the same pages or a group of them. The supected socks are often engaged in edit wars with other users who revert their actions. Updated five times. xHoch Msg me  Contribs  14:59, 20 April 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

And: Those last three are all from yesterday (4/15)...older than the master of this report (4/15). There are also a bunch of IPs doing it on 4/11. See Wikipedia talk:Reference desk. DMacks (talk) 14:44, 16 April 2015 (UTC)

And: Will probably do rangeblock myself if this keeps up (will at least solve the problem). Based on account-creation timestamps, these named accounts are using different IPs from each other. DMacks (talk) 14:50, 16 April 2015 (UTC)

More: Getting old ... but will keep rolling back until he gets bored or loses his Internet access after this. -- McDoob AU93  14:56, 16 April 2015 (UTC)

And: I applied a rangeblock, will see if it's large enough... DMacks (talk) 15:06, 16 April 2015 (UTC)

Compiling from this afternoon's attacks:
 * --20:58, 16 April 2015 (UTC)
 * --21:00, 16 April 2015 (UTC)
 * --21:01, 16 April 2015 (UTC)
 * --21:04, 16 April 2015 (UTC)
 * --21:09, 16 April 2015 (UTC)

Another lot of accounts which have been part of the assault on the refdesks over the last 6 days.



The unusual one is User:SebastianHelm, who has an active account with lots of constructive edits, but who blanked the Miscellaneous desk (with the edit summary "Hey guys, how about if we tackle this from the other end?", on 13 April while the page was protected. --Nicknack009 (talk) 22:19, 16 April 2015 (UTC)

Also, User:Takkunsas is not blocked despite being a vandalism-only account. --Nicknack009 (talk) 22:29, 16 April 2015 (UTC)


 * If it helps any, given the timing of the assault, I have strong suspicions this is User:86.24.128.230, who was blocked for trolling prior to the recent assault. He's also used (and been blocked under) different IP addresses in the past with the same identical pattern of behavior.  -- Jayron 32 22:51, 16 April 2015 (UTC)


 * Also, I'm 99% certain the SebastianHelm thing was a good-faith goof instead, and not this guy. -- Jayron 32 22:53, 16 April 2015 (UTC)


 * I hope so. I singled him out because he does seem to be an exception. --Nicknack009 (talk) 23:15, 16 April 2015 (UTC)


 * New batch:

Is there any chance that a rangeblock could stop article creation so we can shut down this sock farm? Also, anyone who's good with edit filters, I've put in a request at WP:EF/R to try to solve this problem from a different direction. -- Jayron 32 21:06, 17 April 2015 (UTC)

Did we need to block Takkunsas? They seemed to be trying to ask a question and doing it wrong, whereas the others were obviously up to no good. ekips39 (talk)  21:31, 17 April 2015 (UTC)


 * Hard to say. We'd need a checkuser to confirm or deny a connection.  The "question", which matches the known pattern of questions asked by the troll, also blanked the desk at the exact same time the troll was busy with a bunch of brand-new throw-away accounts.  It could be collateral damage, but I doubt it.  Seems like another one of his socks.  But that's why we have a checkuser.  -- Jayron 32 21:39, 17 April 2015 (UTC)

And more:



--Nicknack009 (talk) 22:50, 17 April 2015 (UTC)

{{TakeNote} A few more have come in. xHoch <sup style="font-weight:normal; color:#30E">Msg me  <sup style="color:#90E">Contribs  15:48, 20 April 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Endorsing the CU to look for sleepers. By the way, the title of the page is wrong, it should be CapriSon33333, and not CapriSun33333. But, title "CapriSon33333" is blacklisted, and I don't know why. Anyway, is older than CapriSon33333.  Vanjagenije   (talk)  21:06, 16 April 2015 (UTC)
 * Started at the bottom of the list with Scorpharve and got as far as Sammytalawa before it was time to move along. is a match. So are a couple of sleepers - and, both now blocked.  Anyone with time to spare, feel free to keep working up from there. -- Euryalus (talk) 05:55, 20 April 2015 (UTC)


 * - These have already been mostly checked by myself and random other checkusers when they appear. They are (or at least were) just rapidly hopping IPs on a busy network and occasionally using proxies. Revert, block, and ignore is the best strategy for these trolls. Closing. Reaper Eternal (talk) 18:32, 20 April 2015 (UTC)
 * Oh, and I can tell without checking that the admin is obviously not part of the sock farm. Reaper Eternal (talk) 18:35, 20 April 2015 (UTC)
 * I moved the case to the name of, who is, I believe, the oldest of these.  Vanjagenije  (talk)  20:58, 20 April 2015 (UTC)