Wikipedia:Sockpuppet investigations/Norden1990/Archive

07 July 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

The IPs are from Hungary, just like Norden1990. Edit warring is a common feature (see the edit war of the IP at Romanians article and Norden1990's block log)

Both IPs edited at Matthias Corvinus these days, so they are controlled by the same person who has a dynamic IP. Norden1990 contributed in the past at Matthias Corvinus (an example: )

178.164.210.101 contributed at Apor Péc where Norden1900 was the sole contributor.

178.164.179.114 also knows about User:Iaaasi; Norden1990 interacted a lot with Iaaasi (a couple of examples:  ). PersecutedUser (talk) 12:01, 7 July 2014 (UTC)

92.249.130.12 is controlled by the same editor. He uesed the ediit summary "back to stable version, use talkpage and discuss the problem", which was used by Iaaasi in a dispute with the IP sock 178.164.179.114 — Preceding unsigned comment added by Joeqqq (talk • contribs) 11:00, 8 July 2014‎ (UTC) aka

178.164.179.77 removed the same information as 92.249.130.12, so he can be coutned as an IP sock too. Also 178.164.178.190 is from the same range and edited articles where Norden1990 contributed before. 84.236.16.49 is from the same town (Csongrad) and edited typical articles. He requested an action in Hungarian on Borsoka's talk page (Norden1990 also communicated with Borsoka in Hungarian language on his talk page)

Biziclop2 was sleeping for 7 months and came back these days to edit the same article (John Hunyadi) as the above IPs, so it must be checked if this was a back-up account for Norden1990 Buf12345 (talk) 08:11, 9 July 2014 (UTC)

178.164.233.141 and 178.164.163.103 belong to the same person. The editing pattern is the same. — Preceding unsigned comment added by 79.117.196.102 (talk) 11:07, 10 July 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I'm familiar with Norden1990's editing and am aware that he's been socking via unregistered dynamic IPs since his block (though I haven't had time to file any SPIs about this myself). At this time all I can say is that the IPs presented above are from the same ISP as the ones I'm aware of.  I haven't examined the content of the edits yet but can do this by next week, and can give some further analysis then (as well as information on the previous socks I noted). Psychonaut (talk) 07:36, 9 July 2014 (UTC)
 * Apologies I didn't have time to submit further evidence, though as the IP range has already been blocked I suppose it's a moot point now. —Psychonaut (talk) 18:21, 22 July 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - I realize that this was filed by Iaaasi, who shouldn't be editing at all, but he does have a talent for detecting sockpuppets. . ​—DoRD (talk)​ 15:03, 7 July 2014 (UTC)
 * is and has been blocked.  with regards to the IP(s) from a CheckUser standpoint. That said, the behavioral evidence is sufficient and as such I have implemented a .  Tiptoety  talk 17:12, 22 July 2014 (UTC)
 * Tagged and closing. Rschen7754 03:28, 25 July 2014 (UTC)

02 August 2014

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:84.236.42.0 has edited only two articles, Hungarian local elections, 2010 ‎ and List of members of the National Assembly of Hungary (2010–14). Both of these articles were created by Norden1990, and (except for User:84.236.7.157's contributions) all substantial edits to them have been by Norden1990.

User:84.236.7.157 has edited only three articles. One is the aforementioned Hungarian local elections, 2010. The second is Béla III of Hungary (also previously edited by Norden1990, albeit not exclusively). The third is Liberty Statue (Budapest), and it seems their only interest in editing it has been to undo one of my edits. (Norden1990 has been occasionally using sockpuppets here and on Commons to attack some of my edits, presumably in retaliation for my involvement in his CCI.)

Both IP addresses are from Norden1990's usual Hungarian ISP. CU requested for the purposes of adjusting the rangeblock, and because the previous SPI turned up sleepers. Psychonaut (talk) 20:19, 2 August 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' I don't understand what does sockpuppet mean and I don't know Norden1990, I've just corrected a serious error. We don't live in the Cold War, thus description of Hungary's occupation as "liberation" is obsolete and biased view. I thought unregistered users can edit Wikipedia. Yes, I'm Hungarian, as presumably Norden1990 and another 10 million people. — Preceding unsigned comment added by 84.236.7.157 (talk) 19:11, 2 August 2014‎ (UTC)

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  21:24, 16 August 2014 (UTC)
 * - Checkuser cannot tie usernames to IP addresses. Yunshui 雲 水 14:16, 4 August 2014 (UTC)
 * Closing as stale. If there is further evidence of socking please refile. Thank you,

06 September 2014

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

This IP has the same narrow editing interests as Norden1990 (Hungarian politics) and in fact most of the edits are adding images recently uploaded by Norden1990 on Commons. The IP is from the same ISP as ones previously used by Norden1990 (see for example and the SPI archives). Psychonaut (talk) 12:44, 6 September 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
IP appears to be dynamic and the last edit made was over two weeks. Sockmaster has likely moved on to another IP, so I don't see how blocking would prevent anything. Closing. &mdash;  MusikAnimal talk 23:55, 21 September 2014 (UTC)

17 October 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

62.165.251.34 is from the same IP range as 62.165.211.32 (which was confirmed as a sock on 30 September 2014) and edited typical articles (where the main account Norden1990 or the sockpuppets 178.164.233.23, 188.143.79.102, 84.236.24.16 contributed)

188.36.56.163 edited typical articles (for instance Hungarian local elections, 2014, where Norden1990 was the sole contributor, and Hungarian parliamentary election, 2014, where the confirmed sock 195.38.101.221 edited before).

Tomasso89 is a blatant sock account that was used to create the new article Rákosmente (where 188.36.56.163 contributed the next day). Tomasso89 also edited Budapest just 10 minutes after 188.36.56.163.

Below it is a list of recently confirmed socks (maybe they are useful for the CheckUser)

(The IP range 195.38.96.0/20 is also blocked for persistent sockpuppetry)

I think that User:Psychonaut, who knows this sock master very well can confirm my suspicions. Pacpacpoc (talk) 14:19, 17 October 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * what I am supposed to do with this? You blocked the user who created this report. Another account, User:Osugiba, who edited the report, was also blocked, as a puppet of User:Iaaasi. The named account listed by the sock who created this report, User:Nemerjunkkicsiklenni, is indeed a puppet, but of User:Stubes99. Am I supposed to evaluate this based on behavior anyway? I can't believe anything the creator says, even if some of it is accurate.--Bbb23 (talk) 21:50, 9 November 2014 (UTC)
 * Everything here can be considered dealt with. Drop me a line here with any questions. -- DQ   (ʞlɐʇ)  22:24, 9 November 2014 (UTC)

11 December 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Forwarding message delivered at OTRS ...

--- 178.164.220.190 edited András Hegedüs, where he removed File:HegedusAndras.jpg which had been uploaded by Norden1990 himself.

On List of Prime Ministers of Hungary, the IP 178.164.220.190 replaced the coat of arms of Hungary with the file File:András Hegedüs 1956 (crop).jpg (which had been uploaded to Wikimedia Commons by Norden1990 in the same day). Interestingly, the very same replacement (File:András Hegedüs 1956 (crop).jpg instead of the coat of arms) was done by Norden1990 himself, in the same day, to the Belarusian  and the Russian versions of the article List of Prime Ministers of Hungary

178.164.220.190 also edited the article Mihály Károlyi, where Norden1990 had contributed in the past with his main account.

Last but not least, 178.164.220.190 belongs to the typical range 178.164.128.0/17, which was twice blocked in the past by admin Tiptoety as a result of Norden1990's persistent sockpuppetry. I suggest the re-block of this IP range.

++++++++++++++

An obvious sock account is Tomasso89. The evidence is unequivocal:

- Tomasso89 edited Budapest just 10 minutes after the confirmed IP sock 188.36.56.163 and created in the same day the new article Rákosmente - the confirmed IP sock 188.36.56.163 also contributed at Rákosmente one day after the last edits of Tomasso89 - the nickname has an orthographic similarity with "Norden1990" (the ending with digits) - I assume he chose to use an account this time because he wanted to start a new article, something which he could not do with his usual IP socks.

Although it is dormant account, you may consider its block, because it can be reactivated anytime.

+++++++++++++

1. 92.249.130.85

This IP edited the article István Jósika (whose creator is Norden1990 himself) and later removed the files FIle:HitlerHungarianDelegation.jpg and File:Sztojaytrial.jpg (whose uploader is Norden1990 himself) from the article Döme Sztójay, probably after realizing that there are some copyright problems. In addition, the IP is from a typical range. 92.249.130.146 and 92.249.130.175 are older socks. I suggest the block of 92.249.130.0/24 2. 94.21.162.126 This IP also edited the article István Jósika; the IP is similar with former socks: 94.21.44.60, 94.21.62.131, 94.21.62.131, 94.21.92.243,  94.21.148.165, 94.21.211.90. I suggest the block of 94.21.0.0/16 --- Ron h jones (Talk) 19:57, 11 December 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I endorse the report for User:178.164.220.190, and can add that the IP's activity seems to arise from this conversation between Norden1990 and Materialscientist on Commons. I haven't done any detailed check of the activity of the other accounts reported here, though on the surface the reports seem plausible. —Psychonaut (talk) 10:35, 13 December 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Checkuser comments. At best there is a link between:

Links would best be confirmed by analysis of editing; this is not clear-cut from a technical perspective. on the IP addresses. Risker (talk) 23:25, 27 December 2014 (UTC)

Tomasso89 was indefinitely blocked (as a sock of Norden1990) by, a little over 24 hours ago. Since all editing on the two not-yet-blocked IPs is stale by now, I don't see anything left to do here, so I'm going to close. — Rich wales (no relation to Jimbo) 05:25, 17 January 2015 (UTC)