Wikipedia:Sockpuppet investigations/Miszatomic/Archive

29 January 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

https://en.wikipedia.org/w/index.php?title=User_talk:Cirt&curid=16051127&diff=644761794&oldid=644761645 Tgeairn (talk) 22:50, 29 January 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked this as evasion and left them a note that they are welcome to await the result of this investigation, but in the meantime, evading the block with sockpuppets (even with disclosure) is not acceptable. ☺ ·  Salvidrim!   ·  &#9993;  00:01, 30 January 2015 (UTC)

25 January 2015

 * Suspected sockpuppets




 * Split off to (see lower)


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Thank you for your time. &mdash; Cirt (talk) 17:18, 25 January 2015 (UTC)
 * 1) already  as a sock of  through Checkuser by, DIFF.
 * 2) It appears we have a large, cross-wiki sockfarm, operating on multiple wiki sites to cause disruption
 * 3) Cross-wiki disruption includes triple-voting at an WP:RFA, DIFF.
 * 4) Requesting further investigation here on en.wikipedia by Checkuser to correlate and block additional sleeper accounts and related accounts in this cross-wiki sockfarm.


 * Thanks,, looks like is related as well, any others? &mdash; Cirt (talk) 23:26, 27 January 2015 (UTC)


 * Note: Please note that (correctly) moved and updated this page to the  sockmaster account, so now the prior sockmaster is now a sock  and will have to be tagged/blocked along with the other socks when this case page is closed/archived. Thank you, &mdash; Cirt (talk) 01:15, 28 January 2015 (UTC)


 * Thank you, . &mdash; Cirt (talk) 01:41, 28 January 2015 (UTC)


 * Re: question by to Tiptoety: Has the technical data between the two cases been compared? &mdash; Cirt (talk) 01:56, 28 January 2015 (UTC)
 * Firstly, DanielTom is stale on this project. Second, there has been no evidence to suggest they are one in the same. CheckUser is not for fishing. Tiptoety  talk 01:58, 28 January 2015 (UTC)
 * Wasn't fishing, was responding to original query by, but thanks, will defer to your judgment. Cheers, &mdash; Cirt (talk) 02:03, 28 January 2015 (UTC)


 * I've added IP, -- see diff at confirmed sock's sandbox page: DIFF. Might give Checkusers some more technical data to look at and correlate with potential other sleeper accounts. Hope that's helpful, &mdash; Cirt (talk) 04:32, 28 January 2015 (UTC)


 * Added another account,, per DIFF. &mdash; Cirt (talk) 04:33, 28 January 2015 (UTC)


 * Added two more IPs: and . Both  and  editing, back-and-forth, in both histories of each user talk page, see LINK1 and LINK2. &mdash; Cirt (talk) 04:35, 28 January 2015 (UTC)


 * Comment:, , -- I think why Billinghurst feels that there may be two different groups of confirmed socks, is that Miszatomic claims to have logged-in to a different vandal's accounts after that vandal claimed to have given away their password.  stated: "whoever keeps logging into my account, PLEASE dont stop doing it. My password is zarbon, ok guys?! AAAHHH!!!" And Miszatomic claims he logged into all those vandal accounts "to check if they were vandals". I'm sorry, but I've never heard of this before -- has any admin ever logged into a vandal account in order to "check if they were vandals" ??? &mdash; Cirt (talk) 17:35, 29 January 2015 (UTC)
 * Note: See also Discrepancies with explanations by Miszatomic. Thank you, &mdash; Cirt (talk) 18:16, 29 January 2015 (UTC)
 * Update: Miszatomic claims he logged into three (3) vandal accounts diff. &mdash; Cirt (talk) 20:52, 29 January 2015 (UTC)
 * Actually Cirt, I pulled my observations from my data investigation, which was reviewed by another steward prior to any public statement. Please don't try and put words into my mouth, or make statements about what I believe or what I am trying to say, it is not necessarily helpful and may misrepresent what I am trying to say. I can speak for myself, though happy to clarify my statements if required. — billinghurst  sDrewth  01:00, 30 January 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Comment by Billinghurst with comprehensive CU data from English Wikiquote

There are issues with these checks as described above. I had run checkuser on enWQ (as a steward) and had a data set prepared for a specific purpose, not related to spamming, and answered an email to Elockid on that basis as part of his investigation, of which I knew little. Subsequently I have undertaken a full analysis of edits at enWQ with relation to the abuse and believe that we have a two sets of data, with an intersect point of one edit.

I wish to separate out the sock groupings to be Miszatomic, Jimmy11234, and Gene96 as one sock combination; then with the others as a different sock combination, including Jody Fosteur belonging to another sock group "Dragonron". So if we have blocked Misaztomic based on the group of three accounts and that data set alone, then that may be reasonable. If the block is based on the other data set then I believe that is an incorrect decision as that relationship is tenuous and not suitable for the punishment that has been meted out, and lacks procedural fairness.

I have emailed Elockid though have not received a response. At this point I would ask the blocking administrators to based any block based on the split of edits of the group of Miszatomic +2, and separate the others to Dragonron as I have eplained above, and if no direct socking has taken place here in the Miszatomic triple, then please look to reverse the block on Miszatomic. I have an email to Miszatomic separately asking him a series of questions to resolve my investigation. If need be checkusers at enWP can contact me for further technical details. — billinghurst  sDrewth  13:39, 29 January 2015 (UTC)
 * Agreeing with Billinghurst, as of now, only 2 confirmed socks of Miszatomic which he confirmed himself and neither of which were involved in vandalism of any sorts (Jimmy11234 and Gene96), the rest belong to a vandals known as Wiki-Star and the fact that he only has one known sock on this wiki is quite concerning..for a sock who has over 200 confirmed socks on ENWQ over the last 7 years and only one here means that sock is probably getting away with vandalism as we speak, again as per billing, please divide this into 2 SPI's. The user has already confirmed he logged into the 2 DanielTom and Jody Fosteur accounts to see if it belongs to the same troll just so that he could block them and every other account. What Cirt is posting here is just speculation and definitely belongs to the real vandal, Wiki-Star..and also, read the ongoing discussion here, it might help with this case-- Stemoc 02:05, 30 January 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Per this, I think running a documented local CU check can't hurt. ☺ ·  Salvidrim!   ·  &#9993;  18:11, 26 January 2015 (UTC)


 * I'm going to put this on hold for now. I may have found something interesting. Elockid  ( Talk ) 23:06, 26 January 2015 (UTC)


 * After some investigation, I can say with confidence that Gene96 is a ✅ sock of . I can also say confidently that some globally locked accounts such as and  are ✅ socks of of Miszatomic. Elockid   ( Talk ) 23:37, 26 January 2015 (UTC)


 * I've also been doing some checking and the following are ✅ socks of


 * I don't believe there are other non-stale sleepers, though Miszatomic is editing from numerous active ranges with quiet a few users so it is possible an account slipped through the cracks.
 * is, though they are confirmed as being operated by Miszatomic here.
 * The following do not exist on the English Wikipedia:


 * Tiptoety talk 01:27, 28 January 2015 (UTC)
 * I just stumbled upon this case, and am reminded of another case. Do you think that they're related, or ? ​—DoRD (talk)​ 01:50, 28 January 2015 (UTC)
 * As I have been following both the Steward CheckUser request at Meta and the ongoing discussion at Wikiquote, I do not believe these are one in the same. Tiptoety  talk 01:53, 28 January 2015 (UTC)
 * Thanks. Having been out of circulation for a while, I wasn't aware of the developments elsewhere. Cheers ​—DoRD (talk)​ 04:03, 28 January 2015 (UTC)


 * I have the master and confirmed socks.  already voa-blocked over a year ago. Nothing to do with the two accounts that don't exist locally. About the IPs, 71.199.210.133 has been globally blocked, I have  90.194.62.44, and the others haven't been used since 2013 (or at all). ☺ ·   Salvidrim!   ·  &#9993;  15:20, 28 January 2015 (UTC)
 * : : I think ping doesn't work. Use u? Anyways, while I'm not doubting your abilites whatsoever, as an enwiki SPI clerk I am kinda bound to give more weight to the enwiki CU result than the enwikq CU result; ideally, we'll wait until Elockid has had a chance to review your e-mail and maybe revise their conclusions? I'm assuming this is being discussed on the CU mailing list also (if not, it's probably a good idea), and will await further guidance from CUs before changing any tags/blocks or splitting the case. ☺ ·  Salvidrim!   ·  &#9993;  15:45, 29 January 2015 (UTC)
 * I would think that an SPI clerk would and should be interested in a fair and reasonable outcome for the individual and the principles for which enWP stands, rather than tied to a process of open vs. closed. I am saying that there is circumstance that has not suitably been covered, that should put this on hold, not closed. That is an ugly result and one that reaks of injustice and procedural failure. Is it the SPI clerk's job to ensure a fair result, or to see that issues are closed? — billinghurst  sDrewth  00:26, 30 January 2015 (UTC)
 * As far as I can see, the user has confirmed using socks, and logging into other people's accounts, which leads me to believe there is significant need for further investigation, which is happening, which is why this case in on hold. As far as I am concerned, everything (including the block) is up in the air and pending some kind of outcome. may very well end up unblocked at the end of this all, but we are awaiting a decision for the Enwiki Checkuser team. ☺ ·   Salvidrim!   ·  &#9993;  00:31, 30 January 2015 (UTC)


 * If Miszatomic has been truthful, yes some socks need to be split into another SPI, but Jimmy & Gene are still his sockpuppets, and they have been used to triple-vote on ENWQ.... which is a difficult position -- projects are generally maintained independently, and historically blocking on ENWIKI for abuse on sister projects is not appropriate, however I am reluctant to be the sole decidor of what, if any, sanctions should be applied for this specific socking incident. I will personally request input from other clerks/CUs. ☺ ·  Salvidrim!   ·  &#9993;  02:13, 30 January 2015 (UTC)


 * After discussion amongst the EnWiki SPI team:
 * &  as confirmed (EnWiki & Cross-wiki CU + user admission) socks of Miszatomic
 * Miszatomic unblocked: triple-voting on ENWQ doesn't lead to sanctions on EnWiki, and both socks aren't active locally (one since 2013, the other never edited). It is noted that Miszatomic logged in (on ENWQ) into the other socks (see lower) using a compromised password to "investigate" since ENWQ had no local CUs, and thus "autocreated" the accounts on EnWiki by navigating to this project, which led to the initial CU results linking these socks to Miszatomic, since the "account creation" log entry matched his CU data.
 * already voa-blocked over a year ago, nothing to investigate, no tags applied.
 * The IPs are either inactive, irrelevant or unproblematic for the moment.


 * ,, , &  have been "untagged" as Miszatomic socks, and split off to Sockpuppet investigations/Dragonron per 's assertion that he's the master (which is understood to have been determined using Steward-CU), as well as a local CU check comparing Miszatomic to the latest confirmed Dragonron sock  confirming they are completely ❌. ☺ ·   Salvidrim!   ·  &#9993;  03:02, 30 January 2015 (UTC)
 * I would have never interpreted the CheckUser results this way, but looking at them with the explanation given I can agree with Billinghurt's assessment. That said, I still believe it shows poor judgement to log into a vandals account. Secondly, I will note there is editing overlap on this wiki between Jimmy11234 and Miszatomic to include some childish vandalism on the part of the Jimmy11234 account. (This was my main reason for running a check). Does that warrant indef blocking? I'm indifferent. Tiptoety  talk 03:20, 30 January 2015 (UTC)
 * We are free to think poorly of actions taken on ENWQ but it is generally agreed that editors aren't sanctioned for actions posed exclusively on sister projects. It seems like Miszatomic might not even be desysopped on ENWQ, it was clearly not something that would've been condoned here, but on smaller projects, without local CUs, I can see what the intent behind it was. Also, on EnWiki Jimmy11234 hasn't been used in a long time, and slapping a block on Miszatomic for stuff that happened so long ago would be purely punitive. It might've warranted a temporary block back then, but as we are now, it is better to let things rest as they are and allow things to evolve forwards from this point on. If there is future poor behaviour, it can be handled then and there. ☺ ·  Salvidrim!   ·  &#9993;  03:32, 30 January 2015 (UTC)