Wikipedia:Sockpuppet investigations/Puffmuffin/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Puffmuffin a user account dedicated to editing only Quetta article used many IPs to do edit-warring on that same. He also hinted in one of his comments using an IP that he is not edit-warring on Khyber Pakhtunkhwa page anymore because i provided proper sources. This was a clear indication that the accounts which were edit-warring with me on Khyber Pakhtunkhwa before were his. Account which edit-warred with me on Khyber Pakhtunkhwa extensively was User:HassanKhan95 on which he announced that he will not be using that account anymore for editing, a clear indication that he has other accounts which he will be using to edit. After retiring HassanKhan95, he moved it to User:Df32jhhhhhds5 so it can be hard to trace. He did all this after i hinted at ANI that i will be filing an SPI on Puffmuffin soon. To protect himself, he retired HassanKhan95 and moved it to this other username so if i do not already know that these both accounts belong to him then it can be hard for me to find that out. Jasimkhanum10 was warned many times about his editing behavior which led to a editing ban for three months. Puffmuffin started HassanKhan95 after Jasimkhanum10's ban expired just to give himself a fresh start using the new sock because it would have been easier for Jasimkhanum10 to get blocked again because of his history of violations. A new sock means the new user do not know about policies so there is a room for warnings until an actual block can happen.


 * Behavioral evidence:


 * The page history of Quetta clearly shows how he used all these IPs just to revert one edit over and over again: Puffmuffin (diff), 2001:16a2:466:1600:2:5334:365c:6612 (diff), 2001:16a2:577:dd00:a53e:e034:83d1:40b3 (diff), 2001:16a2:583:7a00:b974:8a3c:7a0d:15da (diff), 2001:16a2:466:1600:cea:7721:1633:8e22 (diff), 119.160.119.118 (diff), 182.183.128.230 (diff), 182.183.160.24 (diff), 182.183.184.127 (diff), 182.183.193.84 (diff), 182.183.239.72 (diff), 119.160.119.135 (diff), 182.183.183.191 (diff), 2.89.242.201 (diff)
 * Same three sources added by Puffmuffin and the IPs to continue with edit-warring: Puffmuffin (diff), 182.183.230.82 (diff), 182.183.229.207 (diff)
 * Puffmuffin and IPs use same reason in the summary line, using words dead and fake: Puffmuffin (diff), 119.160.119.135 (diff), 182.183.239.72 (diff)

I will provide more evidence if asked otherwise this should be enough.  Sh eri ff  |  ☎ 911  | 12:25, 23 August 2016 (UTC)

Let's do it step by step then so we do not confuse things too much.


 * Step 1:

Q. Did Puffmuffin sock using the IP addresses?

A. He claimed that I abused him in Pashto (1), (2), but actually his IP sock 119.160.119.118 was abused by a LanguageXpert IP sock, in blaming me, he inadvertently accepted that the IP (182.183.128.230) which complained about the abuse was him and also the IP (119.160.119.118) towards whom the abuse was hurled was him too. Blaming me for that abuse might be coming from his recognition of abusing me previously using [https://en.wikipedia.org/w/index.php?title=Quetta&type=revision&diff=715009903&oldid=714932593 an IP address (182.183.183.191). The summary was revdelled. It started something like that "SheriffIsInTown, you son of a....."], i am not writing what was next because i do not want to abuse myself. Notice the similarities in the IP addresses, 182.183.183.191 is based at same location if you check WHOIS as is 182.183.128.230, his accepted sock.

All these IPs and Puffmuffin edited the same page Quetta and restored same content over and over again, This establishes that he did sock using IP addresses so he should be blocked as it does not matter whether he socked with IPs or user accounts. This puts Puffmuffin behind as a socker. In next step I will prove with evidence that why I think HassanKhan95 (now Df32jhhhhhds5) is him as well.


 * More behavioral evidence:


 * Similar way of talking e.g. expresstion of doubt: Puffmuffin (know the intentions of User:SheriffIsInTown. I suspect that he's using multiple IDs), (I am aware of that and I clearly know what your intentions are), (If you have to lock the page please first investigate the intentions of User:SheriffIsInTown.), Df32jhhhhhds5 (i understand your purpose behind this), (i know ur purpose)  Sh eri ff  |  ☎ 911  | 16:57, 26 August 2016 (UTC)


 * Step 2:

Q. Is User:Df32jhhhhhds5 (HassanKhan95) Puffmuffin?

A. First of all, let me clarify that Df32 is not stale as he last edited on 13 June 2016 so we still have time to run a check on him. It’s proven indirectly through use of IP socks and also through behavior and topic interest that Df32jhhhhhds5 and Puffmuffin might be two accounts of same user. Only a check user can confirm whether they are same are not.

Here is the behavioral evidence which led me to believe that they are same people, they did not edit same pages as a registered user but their IP socking suggests that they are editing from same IP ranges if not the same IP address and that also can only be confirmed by running a CU.

There are many diffs for each behavioral evidence presented below but I am just including one per user per bullet.
 * Overlapping interest and behavioral matches:
 * Huge interest in demographics especially determined to replace sourced demographics with their own version where Pashto language speaker percentages or Pashtun population figures are bumped up and tries to degrade Punjabi language: Df32jhhhhhds5 (diff), Puffmuffin (diff)
 * Show of determination, an example of WP:BATTLEGROUND: Df32jhhhhhds5 (all unsourced things are removed,If u have WP:RS then I'll let u keep these otherwise it will be not added until realable references are provided.), Puffmuffin (No one will ever allow you to vandalize the page)
 * Use of "u" instead of "you", Df32 and the IP address which claimed that i abused him uses "u" like that and the IP address was Puffmuffin as proved in Step 1: Df32jhhhhhds5 (diff 1), (diff 2), 119.160.119.135 (diff), 182.183.128.230 (diff)
 * Similar way of addressing a user e.g. user:SheriffIsInTown with all lower case “user”: Df32jhhhhhds5 (user:Burnfloo), Puffmuffin (user:Karim Jan), 69.42.58.191 (user:LanguageXpert)
 * Threats of reporting but never reports (at least not as a logged in user), continues edit-warring: Puffmuffin (diff), Df32jhhhhhds5 (diff)
 * Gives tit for tat edit-warring notice, another example of WP:BATTLEGROUND: Df32jhhhhhds5 (21:07, 8 February 2016) in response to (20:44, 8 February 2016), Puffmuffin (08:52, 29 May 2016) in response to (22:03, 28 May 2016)


 * Step 3:

Q. Is Jasimkhanum10 related to HassanKhan95 (now Df32jhhhhhds5) and Puffmuffin?

A. There is more evidence for linking Jasimkhanum10 to Df32. Also Jasimkhanum10 and Df32 have edited the same pages.


 * Evidence:


 * Typing behavior, please note, lower case i and lower case “m” for “am”: Jasimkhanum10 (i m moving this section to the talkpage after a consensus and discussion), Df32jhhhhhds5 (i m also using mobile,its looking good,i understand your purpose behind this), (I m listening here Hindko in Peshawar, all hindko speaking community consider it a seperate language.)
 * Obsession with demographics data: Jasimkhanum10 (diff), Df32jhhhhhds5 (diff), Puffmuffin (diff)
 * Considers Hindko as separate language: Jasimkhanum10 (It is a distinct Language not dailect. Further discussion should be done on talk page if some disagree), Df32jhhhhhds5 (I m listening here Hindko in Peshawar, all hindko speaking community consider it a seperate language.)
 * Biggest WP:DUCK so far, (Sorry Weak English): Jasimkhanum10 (diff), Df32jhhhhhds5 (diff)
 * Obsession with LanguageXpert and his presumed socks, in following diffs Jasimkhanum10 clearly shows obsession with LX while HassanKhan95 (Df32) and Puffmuffin hints that he considers me an LX sock, the IP 2001:16a2:57b:b500:f142:391b:c08a:ed1a files an SPI against me which has same behavior trait of odd spacing: Jasimkhanum10 (diff 1), (diff 2), (diff 3), Df32jhhhhhds5 (i understand your purpose behind this), (i know ur purpose), 2001:16a2:57b:b500:f142:391b:c08a:ed1a (diff), 69.42.58.191 (diff), Puffmuffin (know the intentions of User:SheriffIsInTown. I suspect that he's using multiple IDs), (I am aware of that and I clearly know what your intentions are), (If you have to lock the page please first investigate the intentions of User:SheriffIsInTown.), 2001:16a2:583:7a00:b974:8a3c:7a0d:15da (If u revert this thousands of time, I'll revert it back, I know ur punjabi nationalist agenda behind this. Don't revert this unsource and unfaction table otherwise i'll report to admin, and also check user to investigate your new puppets.)
 * Odd spacing before/after periods and before/after commas, sometimes forgets to space, sometimes adds a space before comma or period but forgets doing that after and sometimes adds a space before and after comma and period, there are many diffs but I will limit them to only few here: Jasimkhanum10 (diff), Df32jhhhhhds5 (diff 1), (diff 2), (diff 3), 2001:16a2:57b:b500:f142:391b:c08a:ed1a, 2001:16A2:396:A600:15C3:EA0D:4D99:2926 (diff), 2001:16a2:396:a600:10d7:93d4:4ae9:8638 (diff), 69.42.58.191 (diff)
 * Acceptance by Df32 that 2001:16A2:396:A600:15C3:EA0D:4D99:2926 who canvassed User:Massagetae was him, why it’s important, just to prove a behavior trait that this IPs edits has same sort of odd spacing, see above bullet point: (diff 1), (diff 2)
 * Accusations of nationalism or Punjabi nationalism: Jasimkhanum10 (diff), Df32jhhhhhds5 (diff), 2001:16a2:57b:b500:f142:391b:c08a:ed1a (diff), 69.42.58.191 (diff), 2001:16a2:583:7a00:b974:8a3c:7a0d:15da (diff)
 * Signature replacement of 2001:16a2:396:a600:10d7:93d4:4ae9:8638 by HassanKhan95, this proves that the editor has many IPs at his disposal, notice the space being missed after comma: (diff)
 * Similar way of talking: Jasimkhanum10 (Hope you will understand), Df32jhhhhhds5 (Hope you will understand), 69.42.58.191 (hope you'll understand.)
 * Show of determination (WP:BATTLEGROUND): Jasimkhanum10 (tujhe mai ne chorna nahi lakh koshish kar tujhe kamyab nahi hone donga, translates: I will not leave you alone, try million times, I will not let you succeed), (lakh koshish karlo par Aaj ke baad tu Pashtuno ke khelaf kuch nahi lekh payega tujhe mai sabaq sikhane wala hoon, translates: “Try a million times, you will not be able to write anything against Pashtuns, I am going to teach you a lesson”), Df32jhhhhhds5 (all unsourced things are removed,If u have WP:RS then I'll let u keep these otherwise it will be not added until realable references are provided.), Puffmuffin (No one will ever allow you to vandalize the page), 2001:16a2:577:dd00:a53e:e034:83d1:40b3 (It will be restored when reliable sources are provided) - Note: This IP is using almost same summary line as Df32 but you can also see this same IP making exactly same edit as Puffmuffin. I have highlighted these items as bold now., 2.89.242.201 (The reference doesn't support the data, it will be not re-added until provide WP:RS), 2001:16a2:583:7a00:b974:8a3c:7a0d:15da (If u revert this thousands of time, I'll revert it back)
 * Misspells “violating” as “voilating” and “violated” as “voilated”: Jasimkhanum10 (diff), Df32jhhhhhds5 (diff)  Sh eri ff  |  ☎ 911  | 18:24, 26 August 2016 (UTC)

I think i am done for now. I think i have quite clearly matched all of the reported users to one another. I have first added why i think Puffmuffin is all those or some of those IPs and using multiple IPs alongside with a username on the same page is also considered socking. Then I matched Df32 with Puffmuffin or some of the shared IPs and through those shared IP ranges, they have socked on same pages as well. Then, i behaviorally matched Df32 with Jasimkhanum10. Behavioral evidence linking Df32 and Jasimkhanum10 is strong enough to do a duck block on both those accounts and Puffmuffin can just be blocked for his admitted IP socking.  Sh eri ff  |  ☎ 911  | 18:47, 26 August 2016 (UTC)

Hi, Salvidrim, thanks for your help with the other SPI the other day. If you have some time, please check the evidence presented in this case and see if you see what i see here. Regards  Sh eri ff  |  ☎ 911  | 13:32, 31 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

2.89.242.201 is most possibly Jasimkhanum10. He has used this IP range before for which he was blocked by Ponyo. -- S M S Talk 22:36, 3 September 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * I need more evidence concerning Df32jhhhhhds5 (Jasimkhanum10 is ). Df32 is a renamed account. Your hint at subterfuge is meritless. Df32's last substantive edit was in February 2016. Please explain with diffs how Df32 and the Puffmuffin socked on or before that time.--Bbb23 (talk) 13:48, 23 August 2016 (UTC)
 * I still find the evidence connecting Df32 and Puffmuffin thin. However, I've reinstated the CU request and will allow a clerk to endorse the check if they think differently.--Bbb23 (talk) 18:49, 26 August 2016 (UTC)
 * . I feel any case against Df32 can be adequately established (or not) via behavioural evidence; I don't see a compelling argument for a CU check.  As Bbb23 has noted, Jasimkhanum10's edits are all stale and cannot be compared by a CU anyway — and as we hopefully all know, CU's won't deal in IP's except in the rarest of situations (not including this one).  And I'm unconvinced that any sleepers are likely to be found here — assuming for the sake of conjecture that all or most of the IP's are in fact this same sockmaster, anyone who would edit using a zillion different IP's is (IMO) unlikely to have also made a bunch of sleepers but not used them.  —  Rich wales (no relation to Jimbo) 03:08, 3 September 2016 (UTC)


 * Closing with no action. Bbb23 (talk) 12:12, 28 September 2016 (UTC)