Wikipedia:Sockpuppet investigations/MyWikiBiz/Archive

Report date April 12 2009, 20:40 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by —  Dæ dαlus Contribs 

Both of these accounts are new, but both of them immediately get involved in an obsecure issue for which there are not real other links. The suspected sockpuppet is obviously someone's sock puppet, and I'm guessing these two accounts are related because of the very close creation times, and editing style.


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by —  Dæ dαlus Contribs  20:40, 12 April 2009 (UTC)
 * CheckUser requests

CU is required to make sure that the above account is indeed connected to the suspected master, and, if not them, then who. It is also required as the obvious sock is harassing another user, so we need to find out if a range block can be issued to prevent further disruption.—  Dæ dαlus Contribs  20:40, 12 April 2009 (UTC)

Endorsed - likely to need review by a checkuser who knows this case. FT2 (Talk 02:41, 13 April 2009 (UTC)
 * Clerk, patrolling admin and checkuser comments


 * It appears to be a collection of open proxies and edits from several different locations, suggesting a coordinated attack. There's no real way to say whether any belong to this banned user or not with technical evidence. Dominic·t 14:20, 15 April 2009 (UTC)

Per Dominic, there appears to be little we can do in terms of blocking. All accounts are blocked. Peter Symonds ( talk ) 16:46, 15 April 2009 (UTC)
 * Conclusions

Adding a brief note before closing. There is external information that the editor behind the original MyWikiBiz account has been impersonated on other sites in recent days. Without some clearcut linking evidence to MyWikiBiz, I think it needs to be emphasized that, while these accounts may be blocked, there is no technical evidence to link them to the editor who previously edited under the MyWikiBiz account. Risker (talk) 01:21, 16 April 2009 (UTC)

16 May 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

208.116.141.100 made two edits to Reliance Globalcom saying he was editing "on advice from MyWikiBiz," and made the same statement on NawlinWiki's talk page. "I thought you might have been talking about the business MyWikiBiz, which has advised me on my edits to Reliance Globalcom." This indicates that the 208 IP is either a sockpuppet or meatpuppet of User:MyWikiBiz.

208.116.141.100 demanded oversight for supposed outing of 2001:558:1400:10:412B:35D4:A950:1B39, edited on his behalf on Jimbo's talk page (see this revert) and said at an AfD  that he had commented at Jimbo's talk page, forgetting that he actually made them as 2001:558:1400:10:412B:35D4:A950:1B39 at. All these IPs have the same identical, abusive writing style, personal attacks and agenda as the MyWikiBiz and Thekohser and their previously identified socks. Coretheapple (talk) 18:59, 16 May 2014 (UTC)

2001:558:1400:10:412B:35D4:A950:1B39, jumped in to defend 208 at AfD, purporting to be two different people. Same abusive writing style, same WP:QUACK. Coretheapple (talk) 20:11, 16 May 2014 (UTC)

Obvious sock 50.144.0.4 has joined in on Jimbo's talk page (see this revert). Coretheapple (talk) 01:02, 17 May 2014 (UTC)

2601:B:BB80:E0:39E8:8E4C:FD09:D212 is now WP:QUACKing on Jimbos talk page (see this revert and the 3RR noticeboard . Coretheapple (talk) 11:29, 17 May 2014 (UTC)

It just has come to my attention that IPs in the 2001 range were blocked as socks of User:Thekohser, which is associated with/alternate account of User:MyWikiBiz, in Sockpuppet_investigations/Thekohser/Archive; registered account indeffed and IPs blocked for three months under similar circumstances. Coretheapple (talk) 20:23, 16 May 2014 (UTC)

@Native, there are two ongoing proceedings in which these socks have been active, one a 3RR report instigated by one of them[ (result: referred to this SPI) and an ongoing AfD in which one of them has posted at length and tendentiously, [[Wikipedia:Articles_for_deletion/Reliance_Globalcom]]. So it's an ongoing issue, and I wouldn't for a moment concede that this sock is done with that AfD, since he's paid by the company to edit it. Also, it's far from likely that this person's edits have ceased, especially since he is one of the regulars on Jimbo's talk page. Coretheapple (talk) 11:29, 18 May 2014 (UTC)

Another MyWikiBiz/Thekohser sock just materialized on Jimbo's talk page. The person who has acknowledged being the banned MyWikiBiz and Thekohser accounts acknowledged authoring the post. See at Sun May 18, 2014 2:38 pm.

So no, you are very much mistaken that the edits have ceased. This IP is pushing the same agenda as 2001:558:1400:10:412B:35D4:A950:1B39 and the 2001 IPs that were blocked at Sockpuppet_investigations/Thekohser/Archive. Same kind of abusive edit summary as 208 and the other IPs. Was blocked for edit-warring and personal attacks, but be assured that he'll move his laptop to another hot spot and return. (And sure enough, he did, to edit-war, as IP 173.84.210.27. and then 2601:b:bb80:e0:ac95:324:1bcb:36bc, and then 50.144.1.132.)

This sock has become so persistent and disruptive that the Wales talk page was semiprotected at 16:25 18 May.

Look I know this is a lot to read, but that's because this guy is a prolific sock. I realize that when a sock uses IPs as this one does, and is persistent, it is a difficult situation. But just simply giving up is not the answer. In the January SPI three-month blocks were given to the IPs on behavioral grounds. The only reason there haven't been more blocks since then, even though he materializes frequently, is that people haven't taken the time to ask for blocks. Coretheapple (talk) 14:40, 18 May 2014 (UTC)


 * Subsequent to the above, more MyWikiBiz/Thekohser socks materialized on Jimbo's talk page and my talk page. Like the previous ones, all with the same Comcast IP locations in Philadelphia and West Chester, Pennsylvania, consistent with previous socking. Definitely an ongoing socking issue, not "ceased." The Wales talk page is now semiprotected for the second time in the past 24 hrs. because of this banned editor's sock IPs. Coretheapple (talk) 00:45, 19 May 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' I am not exactly seeing what is "wrong" with discussions proposed by the IPv6 editor, such as this one. - 2601:B:BB80:E0:2554:42CD:10A6:30A7 (talk) 14:52, 18 May 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Certainly looks possible but the edits of ceased, and there doesn't seem to be much to do at this point (or much point further investigating for that matter). NativeForeigner Talk 11:09, 18 May 2014 (UTC)


 * The user behind many but not all of these IPs is known to have access to a wide range of dynamic IP addresses, most of which can be blocked via WP:DUCK. There is no need to file SPIs and checkuser requests; they will not receive a public response even in this egregious a case, because those IPs *are* dynamic and the next time they're used, they'll probably be used by someone completely different. Please don't tag the IP addresses as socks, either, for that reason.  Risker (talk) 23:10, 19 May 2014 (UTC)