Wikipedia:Sockpuppet investigations/MileyFan1990/Archive

Evidence submitted by Orderinchaos
Massive disruption campaign and battleground behaviour in recent days at Talk:Robert Brokenshire, Talk:Dennis Hood (two South Australian MPs) and at. As there is an Australian election just two weeks away, it would appear to be organised partisan campaigning for one of the two major parties. The accounts post in an interleaved fashion with each other and the IPs and make identical allegations against User:Timeshift9 and User:Frickeg (two WP:AUSPOL regulars), and all of them have only shown up since around Thursday.

The IPs are from two South Australian universities and a wifi hotspot in Adelaide - checkuser can't tell me any more about those than I can see myself but I've provided them in case they assist checkuser in their own unjumbling of this rather strange case. Orderinchaos 02:19, 8 August 2010 (UTC)


 * Three new accounts have been added as the group seems to have become active again after about 10 days of inactivity. This offsite link may also be of interest. Orderinchaos 23:00, 22 August 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
for a check on all the accounts above, please. Apart from Autorev, Maryogden and MileyFan1990 all the accounts are blocked, and the behavioural evidence linking those blocked accounts seems strong enough to justify a check (see the evidence submitted by Orderinchaos). Autorev, Maryogden and MileyFan1990 all have an established interest in Bob Day, and are linked more strongly to the blocked accounts by Autorev and MileyFan1990's involvement in Dennis Hood, and by the timing of the edits. All the accounts display familiarity with wiki-markup, have similar editing times along with similar areas of interest and there does appear to be evidence of an agenda of some nature against Timeshift9 and Frickeg. If CU could please establish whether Autorev, Maryogden and MileyFan1990 are linked to the other accounts and do a sleeper check, that would be appreciated. Per CheckUser CU is not likely to be able to release any information about whether the IPs listed are connected to the accounts, however, it seems likely based on the behavioural evidence and geolocation data, it should also be noted that except from 203.122.223.121, all the IPs seem to be registered to an educational institution. In the end, it may be more desirable to leave the IPs to auto block. Regards, SpitfireTally-ho! 18:10, 13 August 2010 (UTC)

✅




 * After a second look. Fred Talk 18:45, 17 September 2010 (UTC)
 * After a second look. Fred Talk 18:45, 17 September 2010 (UTC)

✅ =

=

J.delanoy gabs adds 03:38, 24 August 2010 (UTC)

I've just blocked MileyFan1990 and Autorev. All the other accounts have been blocked previously. Nick-D (talk) 08:40, 24 August 2010 (UTC)
 * I blocked a couple more that had weren't blocked in the first list. That should be everyone, so I'm marking for close. TN X Man  14:08, 24 August 2010 (UTC)


 * Added some more tags per CU check -- DQ  (t)  (e)  15:27, 25 August 2010 (UTC)

Suspected sockpuppets

 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)

Evidence submitted by Fæ
Both accounts are SPA. ID9.. created their user page with hi as did Moneyfizza. Both accounts are engaged in the same discussion thread (http://en.wikipedia.org/wiki/Talk:Labshare#Synthesis_problem) with the same point of view a nd Moneyfizza was created at 6:57 after ID9..'s last contribution at 6:30. WP:QUACK would seem to apply so checkuser not required. Fæ (talk) 07:07, 28 August 2010 (UTC)

Similarly the SPA Hardrockfan203 created shortly after Moneyfizza stopped contributing to the same talk page. Fæ (talk) 07:13, 28 August 2010 (UTC)

The SPA KevinDogg35 was active 6:35 to 6:50 (just before Moneyfizza was created) with similar edits. Fæ (talk) 07:52, 28 August 2010 (UTC)

Added a further 4 for consideration. Mostly SPA contributions with account creation and contribution timing dovetailing perfectly. WP:QUACK applies. Fæ (talk) 08:26, 28 August 2010 (UTC)


 * Looking at the similar contributions (i.e. Remote laboratory) of and, the latter is a confirmed sockpuppet of the established disruptive sockmaster . If this is the case, then this SPI should move under that folder as these are highly likely to all be MileyFan's sockpuppets.
 * Finally, if anyone has any doubt, consider the demonstrated sock of MileyFan, . The name varies only by one digit from the primary account originally considered here. Fæ (talk) 23:40, 28 August 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Comments by other users

 * Taking a quick guess User:Labsdir and User:Uts is the world is also involved. wiooiw (talk) 08:23, 28 August 2010 (UTC)
 * Labsdir has been warned for COI, they are an employee but probably not a sock. The second has only made one contribution to the talk page and does not seem that relevant. Fæ (talk) 08:31, 28 August 2010 (UTC)
 * User striked out reverted ID908237835. wiooiw (talk) 08:35, 28 August 2010 (UTC)
 * Added Hash0Love wiooiw (talk) 08:27, 28 August 2010 (UTC)
 * Well spotted. Fæ (talk) 08:33, 28 August 2010 (UTC)


 * ID908237835 has also falsely attributed comments under my signature. Diff: --Stickee (talk)  08:30, 28 August 2010 (UTC)

Clerk, patrolling admin and checkuser comments

 * Checkuser scan . I know it wasn't requested and this seems to be an obvious duck case, but this does appear to be a serial socker and I want to see if there's a range we can knock out. Plus, I'm rusty and need an easy case to get started again. ;-) Hers fold  (t/a/c) 19:55, 1 September 2010 (UTC)


 * ✅ and blocked as MileyFan1990:


 * Still looking into possible rangeblocks; unfortunately, it's a huge range and I don't think they'll be possible. Cross-wiki checkusers notified to keep an eye out for any more SUL account abuse. Hers fold  (t/a/c) 21:09, 1 September 2010 (UTC)


 * Rangeblocks probably aren't going to happen, they're too crowded. Clerks, when archiving, please send this to MileyFan1990's page. Thanks! Hers fold  (t/a/c) 21:25, 1 September 2010 (UTC)

Evidence submitted by Fæ
Continued serial SPA account contributions on the same talk page. QUACK applies. Fæ (talk) 14:16, 2 September 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Comments by other users

 * , which was identified as a MileyFan1990 sock in the last check, has edited in the same area at the same time with a similar purpose/style as these other accounts. I'll ask Ironholds what he meant about an OTRS case. Orderinchaos 14:41, 2 September 2010 (UTC)

Clerk, patrolling admin and checkuser comments

 * Checkuser . Hers fold  (t/a/c) 17:21, 2 September 2010 (UTC)
 * ✅ UTS Tech SysQ. Still need to take a closer look at the other two unblocked accounts. Hers fold  (t/a/c) 17:31, 2 September 2010 (UTC)
 * I've sent my conclusions to the checkuser list for review. Hers fold  (t/a/c) 17:45, 2 September 2010 (UTC)
 * After review, we have

TN <b style="color:midnightblue; font-size:larger;">X</b> Man 18:28, 2 September 2010 (UTC)

Evidence submitted by Fæ
Continued disruption of the same page by sequential SPA accounts - see Talk:Labshare. 'VladimirVaskyFan' is a deliberate disruptive doppelgänger name of another editor in the same discussion threads. Fæ (talk) 21:41, 7 September 2010 (UTC)
 * Considering the 'possible' checkuser conclusion below and recent necessary suppression of a disruptive comment (see history), I suggest a strong case of WP:QUACK applies and this account should be blocked on that basis. Fæ (talk) 14:00, 8 September 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
Given relative geographic area. Behavior is the key here, I think. TN <b style="color:midnightblue; font-size:larger;">X</b> Man 22:08, 7 September 2010 (UTC)
 * Seeing the user is blocked, and now tagged, I am marking this as a close. -- DQ  (t)  (e)  19:18, 12 September 2010 (UTC)

Evidence submitted by Vianello
User has been editing Burnside Council and its talk page today. Nothing wrong with that. The strange thing is, this user has afterwards gone on a curious spree of userpage templating of a bunch of other accounts, every single one of which has exclusively edited the exact same article, in the same timeframe, as the page history makes very clear. (User:AECfan was the only one to have edited any other pages that I noticed). From the page history, I also noticed User:DemiNeesan was another "hub" of template-distribution, again to a slew of accounts (listed below that one) making edits in the same timeframe to the same article (though these users did same to have a few trivial edits to some other articles, mostly redirecting). User:ID982378353 was not tagged by either "hub" account, but did tag his/her own userpage with the exact same template both have been using, and, of course, has the same edit pattern. Quite frankly, I have absolutely no idea what is going on here, but it's a bizarre and massive enough pattern to throw a red flag for me. Might possibly be a large group of related users acting in concert off-wiki rather than sockpuppetry. Seems to have started in strings of minor edits after User:Gencouncil created the article yesterday. This might just be harmless, large group collaborative editing, but the manner of it seems to suggest a single person. Also notice on the article's history the large strings of minor edits, followed by one account abruptly dropping out entirely and another taking its place before repeating this process. Though not discernibly connected to the other accounts in terms of the template sprees, the originator's edits do follow the same pattern. Only the IPs and one or two probably unrelated passing users don't follow this pattern. It MIGHT have been more appropriate to list User:Gencouncil as the sockmaster, but User:Vote4Freedom seems to have directly connected himself/herself to the most other accounts. - Vianello (Talk) 03:53, 22 September 2010 (UTC) - Vianello (Talk) 03:53, 22 September 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments

 * Sufficiently strange (very) to want checkuser for. Are all of these related, and are there more? NativeForeigner Talk/Contribs 04:17, 22 September 2010 (UTC)


 * <em style="font-family:Bradley Hand ITC;color:blue">Hers <em style="font-family:Bradley Hand ITC;color:gold">fold  (t/a/c) 04:32, 22 September 2010 (UTC)

These accounts all belong to and should be archived as such. The following are ✅ and have been mass blocked: The following are based on checkuser evidence but at a glance don't appear to match behavioral patterns. They have not been blocked. Someone will need to take a closer look at them: <em style="font-family:Bradley Hand ITC;color:blue">Hers <em style="font-family:Bradley Hand ITC;color:gold">fold  (t/a/c) 04:54, 22 September 2010 (UTC)
 * (no edits, so may just bear watching)
 * (ditto)
 * (ditto)

Actually, correction - based on the difference in MO, this user may be someone else after all. They're still very likely the same user, and it looks like they were gunning for a block anyway, but it's not totally confirmed. <em style="font-family:Bradley Hand ITC;color:blue">Hers <em style="font-family:Bradley Hand ITC;color:gold">fold  (t/a/c) 04:58, 22 September 2010 (UTC)

And sorry, missed one more - is on a different ISP than all the rest, but is using an identically configured computer and is in the same geographical area. I'll call it especially considering other Miley socks have appeared on that range (but less commonly). <em style="font-family:Bradley Hand ITC;color:blue">Hers <em style="font-family:Bradley Hand ITC;color:gold">fold  (t/a/c) 05:14, 22 September 2010 (UTC)
 * Went ahead and blocked User:Paior, as that plus duck test seems like plenty. It looks like we've more or less handled everything that can be based on the information available, but I'm not labeling this closed just yet in case there's anything to add. If not, though, I'd certainly encourage anyone else to do so. Any thoughts on whether Burnside Council should be G5'ed? - Vianello (Talk) 18:40, 22 September 2010 (UTC)
 * I don't think G5 should be done. Although there is almost no contribution on the article page by anyone not a sockpuppet of this editor, the talk page has had significant contributions by others. Also, I hate to say it but it looks like a pretty good article. On another note, I wonder if the following account is another sockpuppet:
 * That editor's only action is a comment on the talk page of the article in question. --  At am a  頭 19:06, 22 September 2010 (UTC)
 * Good catch. That account is the same as, which is an obvious sock as well. TN <b style="color:midnightblue; font-size:larger;">X</b> Man  19:17, 22 September 2010 (UTC)
 * Blocked & tagged accordingly -- Sh i r ik ( Questions or Comments? ) 19:19, 22 September 2010 (UTC)
 * Blocked & tagged accordingly -- Sh i r ik ( Questions or Comments? ) 19:19, 22 September 2010 (UTC)