Wikipedia:Sockpuppet investigations/Mouse001/Archive

16 February 2016

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Both banned user Mouse001 and ICat Master, in addition to having related usernames, seem to be single purpose accounts editing the same limited subset of political articles - mostly related to Hillary Clinton. The ICat Master user was created after the Mouse001 user was banned, and immediately set about performing similar "ideological" edits to similar pages. The gap between one account being blocked and the other being created makes it impossible to produce diffs with similar edits; nevertheless, I find the coincidences compelling. There's evidence of similar edits to pages: Like I said, however, it is the choice of articles and the apparent ideological approach that leads me to suspect sock activity. Scjessey (talk) 23:33, 16 February 2016 (UTC)
 * Mouse001 edit to Rand Paul article, ICat Master edit to Rand Paul article

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * This editor is frequently involved in edit conflicts with me, edit conflicts in which he is always forced to end due to consensus and lack of adequate rationale. When looking at his edit history, and reasons for edits, it is clear that he is attempting to further an ideological agenda. I do not feel that it is appropriate to silence and oppress me. I am merely trying to build a neutral encyclopedia which is shown in my edit history.


 * My account was not created directly after this Mouse001 user was banned, and I have not edited the same precise articles as that user, although there has been some overlap. I have only made one edit to the Rand Paul article. Note that User:Wikidemon, who has a similar ideological approach to editing as Scjessey, submitted reports here here based on Scjessey's insinuation that I am a sock puppet of Mouse001. His reports have gotten precisely no where. I do not appreciate this witch hunt. I hope that the administrator will review this case fairly and objectively. I have nothing further to add.--ICat Master (talk) 01:00, 17 February 2016 (UTC)

This is a case of WP:DUCK. No new user to this project would instantly after creating a new account get involved in edit warring, accusations against long-term editors, and process-gaming, on high-traffic articles having to do with a current national election. This all has a ring of familiarity about it, probably a second account of someone else active in the political articles. The only question is who this is, not whether the account is legitimate or whether we should take their !votes or edits as legitimate. Until further notice, I suggest their edits simply be reverted without regard to WP:ER or anything like that, they are gaming the system by these rules. - Wikidemon (talk) 06:35, 17 February 2016 (UTC)
 * You are twisting facts. I did not get involved with edit warring "instantly" after creating a new account. I didn't get involved in an edit war until well over a week after creating my account, and I was editing in good faith.
 * Your blatant disregard for due process is distasteful.--ICat Master (talk) 08:05, 17 February 2016 (UTC)
 * The sock's process gaming here is a blight on Wikipedia, the sort of thing that makes participating so annoying and unpleasant. Within their first few edits they were advocating and edit warring POV positions on American political candidates, and launching accusations against the longstanding editors. Please indef this account promptly, and any other accounts found to be operated by this person. - Wikidemon (talk) 12:09, 17 February 2016 (UTC)
 * I was not edit warring POV positions, and please be clear about the accusations you are referring to. This is starting to feel like a kangaroo court. Please post diffs of your accusations.--ICat Master (talk) 07:21, 19 February 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Please, compare those accounts.  Vanjagenije  (talk)  10:38, 29 February 2016 (UTC)
 * The two accounts are ✅. I've blocked and tagged the puppet and tagged the master. Closing.--Bbb23 (talk) 05:25, 2 March 2016 (UTC)

07 April 2016

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Both these IPs appear to be attempts by banned editor Mouse001 to circumvent a full ban (which has previously happened). The only edit of 68.104.219.26 was to remove an SPA tag from a comment Mouse001 made. 2600:8800:2180:22A:509B:63E0:E5FD:9BCF made exactly the same edit previously made on multiple occasions by Mouse001. Then the IP blanked an IP sock tag, just as Mouse001 did on multiple occasions. Both IPs geolocate to Arizona. Obviously there is not a huge body of work to compare, but if it quacks like a duck... Scjessey (talk) 23:19, 7 April 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I'm not sure how the use of 68.104.219.26 is circumventing a ban when that IP appears to have been used when Mouse was unbanned. The mention of that IP is wholly irrelevant to your sockpuppet case. I was briefly looking through the edit history of the Clinton Foundation article and reverted your revision because I did not agree with it. I deleted the tag from my talk page because it is not true.--2600:8800:2180:22A:509B:63E0:E5FD:9BCF (talk) 04:22, 9 April 2016 (UTC)

I don't dispute the duck evaluation, but a v6 /32 is 4 million addresses. Thats probably banning the entire ISP. Is there something more tactical/narrow that can be done? Gaijin42 (talk) 15:59, 11 April 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Regarding the listed IPs, based on provided diffs. 68.104.219.26 appears to last have edited last December, so it isn't worth blocking. The following IPs come from the same IPv6 range have all, within the last few months, edited Clinton-, Sanders-, or other American politicians' pages:
 * I haven't done more looking than that, but I'll wrap this up by tomorrow if no one else has beaten me to it. It looks like an IPv6 rangeblock may be helpful, however. Kevin ( aka L235 ·&#32; t ·&#32; c) 04:05, 11 April 2016 (UTC)
 * I haven't done more looking than that, but I'll wrap this up by tomorrow if no one else has beaten me to it. It looks like an IPv6 rangeblock may be helpful, however. Kevin ( aka L235 ·&#32; t ·&#32; c) 04:05, 11 April 2016 (UTC)
 * I haven't done more looking than that, but I'll wrap this up by tomorrow if no one else has beaten me to it. It looks like an IPv6 rangeblock may be helpful, however. Kevin ( aka L235 ·&#32; t ·&#32; c) 04:05, 11 April 2016 (UTC)
 * I haven't done more looking than that, but I'll wrap this up by tomorrow if no one else has beaten me to it. It looks like an IPv6 rangeblock may be helpful, however. Kevin ( aka L235 ·&#32; t ·&#32; c) 04:05, 11 April 2016 (UTC)
 * I haven't done more looking than that, but I'll wrap this up by tomorrow if no one else has beaten me to it. It looks like an IPv6 rangeblock may be helpful, however. Kevin ( aka L235 ·&#32; t ·&#32; c) 04:05, 11 April 2016 (UTC)
 * I haven't done more looking than that, but I'll wrap this up by tomorrow if no one else has beaten me to it. It looks like an IPv6 rangeblock may be helpful, however. Kevin ( aka L235 ·&#32; t ·&#32; c) 04:05, 11 April 2016 (UTC)
 * I haven't done more looking than that, but I'll wrap this up by tomorrow if no one else has beaten me to it. It looks like an IPv6 rangeblock may be helpful, however. Kevin ( aka L235 ·&#32; t ·&#32; c) 04:05, 11 April 2016 (UTC)

This is now stale, so instead of blocking I'm going to give you Katie's Quick IPv6 Addressing Tutorial. Your /32 range is WAAAYYY too big and unnecessary. See in this group how the first four sets of alphanumeric groups are the same? That's all you need to know. This is one end user, and the range is 2600:8800:2180:22A::/64. Any time you have a list of IPv6 addresses and the first four groups of alphanumeric digits are the same, 99% of the time it's one person. It is possible that there are more users in the /128 range, but it's very unlikely and only happens in special circumstances. If he returns, and the first four groups are 2600:8800:2180:22A, it's your guy. Katietalk 02:22, 26 April 2016 (UTC)
 * Admin action needed - Quack. Entire /32 range A range left to the discretion of the blocking admin needs blocking for a mid-length amount of time. All the IPv6s in the range have either edit warred, vandalized, or otherwise disrupted articles about Clinton and Sanders, similar to master. (One IP only edited Jim Gray (American politician), but coming from the same range, that also assists in the DUCK determination.) Kevin ( aka L235 ·&#32; t ·&#32; c) 15:25, 11 April 2016 (UTC)
 * You're right that a more tactical solution is probably preferred, and a /32 block blocks a significant portion of the ISPs addresses (the direct allocation is /28, registered to Cox Communications). However, IPv6 is rather peculiar in that we can't really tell who has what based on allocation size; it's trivial to recieve a /48 allocation, and I wouldn't put it past, say, a company to have a full /32 allocation. I don't know; specifics on the rangeblock should be left to the admin. Kevin ( aka L235 ·&#32; t ·&#32; c) 16:40, 11 April 2016 (UTC)
 * Addendum: The socks have demonstrated the ability to reach all across the /32 range, from the lowest address being 2600:8800:2180:22A:1D86:E24A:9205:AA37 and the highest address being 2600:8800:2180:22A:CCC7:67B9:947B:56AF. Just noting for the blocking admin. Kevin ( aka L235 ·&#32; t ·&#32; c) 16:48, 11 April 2016 (UTC)
 * I think I momentarily forgot how numbers worked. (No, Kevin, (2^128)/(2^64) ≠ 2^32.) Heh. Thanks, Kevin ( aka L235 ·&#32; t ·&#32; c) 02:30, 26 April 2016 (UTC)