Wikipedia:Sockpuppet investigations/Mikequfv/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

User Mikequfv was blocked for his disruptive editing last month. He broke his first block and then, as a result, had his block length increased to "indefinite" and had the IP that he used to circumvent the original block, blocked as well. (Reports are here and here.) Since the original two blocks, there have been edits from other IPs (1, 2, 3, 4, 5) that match his style of editing and thus seem to be him. Today there has been a renewed effort to push his changes on articles where he's previously made attempts that were reverted, at Victoria, BC and Arica with this IP. [reported at WP:ANI by 03:27, 7 June 2016 (UTC), moved here by Ivanvector  🍁  (talk) 17:45, 10 June 2016 (UTC)]

There is new, recent activity under IP:



Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
yes, the user has been using IPs to edit around their block, as exemplified by this IP edit which is identical to the master's edit on that page, and all of the IPs' common obsession with changing colours in climate-related infoboxes. However, none of the IPs are active: although the filer restored the ANI thread from archive today, I don't see any edits newer than four days ago. In fact the master's block was changed to indef for block evasion on May 20, but was not tagged. I have tagged the master but no further action is required at this time. Ivanvector 🍁  (talk) 22:18, 10 June 2016 (UTC)

Admin assistance needed: please block the newly-reported duck IP 72 hours, their only edits repeat the same template colour changes as noted above. Ivanvector 🍁  (talk) 22:54, 10 June 2016 (UTC)
 * ✅ and closing.  Vanjagenije  (talk)  22:19, 11 June 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same obsession with changing colours in climate-related infoboxes; compare with a previously blocked IP's. Ivanvector 🍁  (talk) 00:33, 12 June 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Admin assistance required: this IP appears to be static and assigned to a government institution, and was used for the same purpose a week ago. Please block the IP for ten days. (also I would appreciate the admins' feedback as to the appropriateness of the block lengths I'm suggesting) Ivanvector 🍁  (talk) 00:46, 12 June 2016 (UTC)
 * Blocked 1 month, but your block lengths seem fine to me. Thanks,  Nakon  04:06, 13 June 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same type of edit that the user was blocked for. IP comes from the same area. Diff: 1 Air.light (talk) 01:25, 23 June 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
I've declined the CU request as we rarely publicly disclose the IP(s) of named accounts.--Bbb23 (talk) 13:34, 23 June 2016 (UTC)
 * Not taking any action here because the IP's single edit is too old and I'm not completely sure the address isn't dynamic and might not end up being given to someone else. Closing now.  —  Rich wales (no relation to Jimbo) 03:52, 26 July 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same type of edit user was originally blocked for. IP traces to the same city as all the others. Diff here. Air.light (talk) 03:04, 27 June 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Not taking any action here because the IP's edits are too old and I'm not completely sure the address isn't dynamic and might not end up being given to someone else. Closing now.  —  Rich wales (no relation to Jimbo) 03:52, 26 July 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same type of edit user was originally blocked for. IP traces to the same city as all the others. Diff is here. Air.light (talk) 22:38, 27 June 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I've range-blocked the IPv6 address's /64 subnet until November (the block will expire around the same time as an IPv6 in the same /64 that was blocked in May). Closing now.  —  Rich wales (no relation to Jimbo) 03:52, 26 July 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Behaviour in the first IP is the same that had him blocked the first time. All edits thus far resemble this. The second IP is active again and was in a previous report but it didn't end up with a block. Air.light (talk) 00:13, 30 June 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I'm putting this SPI on a (hopefully brief) hold pending an off-wiki discussion. —  Rich wales (no relation to Jimbo) 02:48, 25 July 2016 (UTC)
 * ✅: ​—DoRD (talk)​ 12:42, 25 July 2016 (UTC)
 * I've range-blocked the IPv6 address's /64 subnet until November (the block will expire around the same time as an IPv6 in the same /64 that was blocked in May). I'm not blocking the other IP because its edits were three weeks ago and I'm not completely sure the address isn't dynamic and might not end up being given to someone else.  Closing now.  —  Rich wales (no relation to Jimbo) 03:52, 26 July 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

The same style of editing many of the same pages and changing climate chart colours against consensus. This diff includes vandalizing climate data which the user has had an issue with in early, past edits. All IPs are from the same location. All edits are evidence. Air.light (talk) 18:25, 13 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Yep, these are all edits by the same blocked user. Admin assistance: the 116.x.x.x IP is stale; please block the others for 72 hours. If so inclined, a rangeblock on 221.179.97.0/24 will save you time, I don't see any edits from that range that are not vandalism by this user. Ivanvector 🍁  (talk) 02:09, 14 August 2016 (UTC)
 * Added another IP currently active. Admins? Bueller? Ivanvector 🍁  (talk) 12:25, 15 August 2016 (UTC)


 * Range blocked. Case closed.  Vanjagenije  (talk)  16:26, 15 August 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Another one, reverting to the edits of the last blocked IP. Ivanvector 🍁  (talk) 00:00, 17 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Admin requested to block the IP duck 48 hours. Ivanvector 🍁  (talk) 00:02, 17 August 2016 (UTC)
 * ✅. marking as closed. Mkdw talk 02:10, 17 August 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Another one. Reverting the same edits. Ivanvector 🍁  (talk) 15:03, 17 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Admins, please block this IP 48 hours, and please semiprotect Climate of Vancouver and Eureka, Nunavut for a week. Ivanvector 🍁  (talk) 15:06, 17 August 2016 (UTC)
 * ✅ Mkdw talk 16:55, 17 August 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Quack. Reverted to his preferred version of Eureka, Nunavut, which seems to have escaped semiprotection after yesterday's activity. Ivanvector 🍁  (talk) 15:52, 18 August 2016 (UTC)

re: 222.171.49.77 Exact same style of edits. Air.light (talk) 05:21, 20 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Admins, please block these IPs 48 hours, and semiprotect Eureka, Nunavut for one week. (See the investigation directly above this one). Ivanvector 🍁  (talk) 15:53, 18 August 2016 (UTC)
 * Done. Both isp's blocked for 48 hours, article semi protected for 2 weeks. TomStar81 (Talk) 07:33, 21 August 2016 (UTC)
 * Closing. Mike V • Talk 16:47, 21 August 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same type of edit, same targeted wiki, IP drawing from same geographical region. Air.light (talk) 17:47, 24 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
I don't want to step over you, but that's clearly him. I just reverted their edits, and came to report and request a block before I realized the new IP had already been reported. Matches pattern of user geolocating to Chinese ISPs changing climate-related infoboxes in North American city articles. Please block 24 hours. Ivanvector 🍁  (talk) 15:07, 25 August 2016 (UTC)
 * - In order to facilitate and expedite your request, please provide diffs to support your case. Please give two or more diffs meeting the following format:
 * 1) At least one diff is from the sockmaster (or an account already blocked as a confirmed sockpuppet of the sockmaster), showing the behaviour characteristic of the sockmaster.
 * 2) At least one diff per suspected sockpuppet, showing the suspected sockpuppet emulating the behaviour of the sockmaster given in the first diff.
 * 3) In situations where it is not immediately obvious from the diffs what the characteristic behaviour is, a short explanation must be provided. Around one sentence is enough for this.  Vanjagenije   (talk)  14:42, 25 August 2016 (UTC)
 * Blocked for 48 hours. Case closed.  Vanjagenije  (talk)  15:12, 25 August 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Today's edits: diff 1a, diff 1b. Recent edits that ended in a block: diff 2a, diff 2b. Thanks. Air.light (talk) 17:41, 26 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Yep, it's him. Please block 48 hours. Yeesh, people this dedicated to IP spoofing usually do something more interesting than just change the colours of infoboxes. Ivanvector 🍁  (talk) 13:43, 27 August 2016 (UTC)
 * Blocked and closed.  Vanjagenije  (talk)  14:51, 27 August 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same editing pattern as who has been blocked as a sock. Block evasion as well based on what I read on the SPI page. Walter Görlitz (talk) 02:09, 29 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Yeah, plus another that I just added. Both certainly Mikequfv, both now stale. He has used the 221 IP before, but I can't say whether it's static or not, and doubt a block would be effective. Some pages have been protected, that should help. Closing. Ivanvector 🍁  (talk) 00:43, 4 September 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Infobox vandalism on Climate of Vancouver and others. Ivanvector 🍁  (talk) 13:02, 7 September 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
- IP is active now, please block 48 hours. He's hitting these almost the moment they come off protection: let's try pending changes for one month on Surrey, British Columbia, Eureka, Nunavut and Climate of Vancouver. Ivanvector 🍁  (talk) 13:06, 7 September 2016 (UTC)
 * Blocked. Unless you need the report for tracking reasons, you'd probably want to report at WP:AIV instead. This is obvious enough sockpuppetry/vandalism that it can be handled quickly there. I've also semi-protected the pages again. ~ Rob 13 Talk 15:06, 7 September 2016 (UTC)
 * I think you should confer with the folks at AIV, they repeatedly insist that sockpuppetry must be reported here, no matter how obvious nor how clearly vandalism. Anyway with some sockmasters it helps to record obvious IP cases so that we might be able to establish a pattern and make better filters/blocks. This one is pretty adept at IP-hopping though. Ivanvector 🍁  (talk) 16:53, 7 September 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Only edit is restoring a previous sock's edit, partially blanking a climate-related infobox. Ivanvector (Talk/Edits) 18:06, 21 October 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * please block 72 hours. Ivanvector (Talk/Edits) 18:07, 21 October 2016 (UTC)
 * I blocked the whole /64 range for a month. It has been obviously used by the same user since early September. Case closed.  Vanjagenije  (talk)  18:46, 21 October 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Fits the pattern, mostly filing the report for recording purposes, pretty ducky. Beeblebrox (talk) 02:31, 26 December 2017 (UTC)
 * Also, might be worth looking into a rangeblock, as it seems those have been effective with this socjpupeteer in the past. Beeblebrox (talk) 02:32, 26 December 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

I've blocked these two IP ranges as socks of the apparently long-dormant Mikequfv. They exhibit the same telltale behaviour: a specific sort of fiddling with climate infoboxes in multiple articles, but especially cities in the Pacific northwest. Ivanvector (Talk/Edits) 17:20, 20 October 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Socks already blocked, filed as closed. Ivanvector (Talk/Edits) 17:20, 20 October 2022 (UTC)