Wikipedia:Sockpuppet investigations/ROXELANA22/Archive

13 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

The first 4 socks have been used to vandalize many of the same articles as the master (including AN/TPS-43, concerning a military radar system), with many of the accounts' edits consisting of adding white space. Of these, the master and the first three socks have already been blocked but the fourth has not. The last three have not edited but are probably sleepers based on the usernames.  General Ization  Talk   15:48, 13 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - RATROADANTPS1 did edit today (see: and ). I'm endorsing the CU to compare those accounts and to look for (more) sleepers.  Vanjagenije   (talk)  16:33, 13 September 2015 (UTC)


 * Mike V • Talk 17:57, 13 September 2015 (UTC)
 * Mike V • Talk 17:57, 13 September 2015 (UTC)
 * Mike V • Talk 17:57, 13 September 2015 (UTC)
 * Mike V • Talk</b> 17:57, 13 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 17:57, 13 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 17:57, 13 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 17:57, 13 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 17:57, 13 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 17:57, 13 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 17:57, 13 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 17:57, 13 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 17:57, 13 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 17:57, 13 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 17:57, 13 September 2015 (UTC)

21 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Resumes vandalism of AN/TPS-43 after 1 byte edits to other articles to attempt autoconfirmation. <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   18:49, 21 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked as a very annoying WP:DUCK. Better let the CU go through, considering the previous outcomes. Favonian (talk) 18:58, 21 September 2015 (UTC)
 * The following accounts are ✅:
 * Blocked, tagged, closing.--Bbb23 (talk) 19:28, 21 September 2015 (UTC)
 * Blocked, tagged, closing.--Bbb23 (talk) 19:28, 21 September 2015 (UTC)
 * Blocked, tagged, closing.--Bbb23 (talk) 19:28, 21 September 2015 (UTC)
 * Blocked, tagged, closing.--Bbb23 (talk) 19:28, 21 September 2015 (UTC)
 * Blocked, tagged, closing.--Bbb23 (talk) 19:28, 21 September 2015 (UTC)
 * Blocked, tagged, closing.--Bbb23 (talk) 19:28, 21 September 2015 (UTC)

11 January 2016

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

WP:DUCK. Vandalizes AN/TPS-43 as first edit after a series of one-byte edits to bypass autoconfirmation. <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   20:47, 11 January 2016 (UTC)
 * Adding User:NeoplanTPS, already blocked after recently exhibiting the same behavior but apparently not reported here as a probable sock. <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   20:59, 11 January 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ✅:
 * Blocked unblocked accounts. Will tag and close momentarily.--Bbb23 (talk) 21:10, 11 January 2016 (UTC)
 * All tagged. Closing. Bbb23 (talk) 21:14, 11 January 2016 (UTC)
 * Blocked unblocked accounts. Will tag and close momentarily.--Bbb23 (talk) 21:10, 11 January 2016 (UTC)
 * All tagged. Closing. Bbb23 (talk) 21:14, 11 January 2016 (UTC)
 * Blocked unblocked accounts. Will tag and close momentarily.--Bbb23 (talk) 21:10, 11 January 2016 (UTC)
 * All tagged. Closing. Bbb23 (talk) 21:14, 11 January 2016 (UTC)
 * Blocked unblocked accounts. Will tag and close momentarily.--Bbb23 (talk) 21:10, 11 January 2016 (UTC)
 * All tagged. Closing. Bbb23 (talk) 21:14, 11 January 2016 (UTC)
 * All tagged. Closing. Bbb23 (talk) 21:14, 11 January 2016 (UTC)

22 February 2016

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

WP:DUCK. 10 meaningless edits followed immediately by vandalism to this article, per previous socks. <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   14:49, 22 February 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * . The account has been blocked by another administrator. You don't explain why you're requesting a CU. However, because of the last check, I'll look for sleepers.--Bbb23 (talk) 19:02, 22 February 2016 (UTC)
 * The following accounts are ✅:
 * Unblocked accounts blocked. All tagged. Closing.--Bbb23 (talk) 19:11, 22 February 2016 (UTC)
 * Unblocked accounts blocked. All tagged. Closing.--Bbb23 (talk) 19:11, 22 February 2016 (UTC)
 * Unblocked accounts blocked. All tagged. Closing.--Bbb23 (talk) 19:11, 22 February 2016 (UTC)
 * Unblocked accounts blocked. All tagged. Closing.--Bbb23 (talk) 19:11, 22 February 2016 (UTC)
 * Unblocked accounts blocked. All tagged. Closing.--Bbb23 (talk) 19:11, 22 February 2016 (UTC)

12 May 2016

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same pattern as always; 10 random 1-byte edits to become autoconfirmed, then vandalizes AN/TPS-43. Please CU to look for sleepers. <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   01:45, 12 May 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ✅:
 * Blocks and tags (shortly). Closing. — Preceding unsigned comment added by Bbb23 (talk • contribs)
 * Blocks and tags (shortly). Closing. — Preceding unsigned comment added by Bbb23 (talk • contribs)
 * Blocks and tags (shortly). Closing. — Preceding unsigned comment added by Bbb23 (talk • contribs)
 * Blocks and tags (shortly). Closing. — Preceding unsigned comment added by Bbb23 (talk • contribs)
 * Blocks and tags (shortly). Closing. — Preceding unsigned comment added by Bbb23 (talk • contribs)
 * Blocks and tags (shortly). Closing. — Preceding unsigned comment added by Bbb23 (talk • contribs)
 * Blocks and tags (shortly). Closing. — Preceding unsigned comment added by Bbb23 (talk • contribs)
 * Blocks and tags (shortly). Closing. — Preceding unsigned comment added by Bbb23 (talk • contribs)
 * Blocks and tags (shortly). Closing. — Preceding unsigned comment added by Bbb23 (talk • contribs)
 * Blocks and tags (shortly). Closing. — Preceding unsigned comment added by Bbb23 (talk • contribs)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Both accounts are already blocked. CU may also be helpful here to check for possible sleeper accounts. 172.58.111.27 (talk) 18:31, 9 August 2016 (UTC) 172.58.111.27 (talk) 18:31, 9 August 2016 (UTC)


 * Second the request for CU. Both accounts were created on June 30 and snoozed in the grass until now. The existence of more sleepers seems likely. Favonian (talk) 18:46, 9 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
✅ and tagged. No other accounts seen. Closing.--Bbb23 (talk) 19:56, 9 August 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Usual MO. Series of 1 byte edits to achieve autoconfirm, immediately followed by edits to AN/TPS-43. <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   12:42, 24 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * User:Fosfogeno's edit history shows that they made just enough WP:DUMMY edits to enable their account to vandalize the pending-change-protected article AN/TPS-43. – wbm1058 (talk) 12:58, 24 August 2016 (UTC)
 * . Favonian (talk) 19:10, 24 August 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same MO as sockmaster, ten random edits then vandal edits to AN/TPS-43 RickinBaltimore (talk) 12:40, 25 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * The account was created on 8/14, could a CU possibly check for any sleepers? RickinBaltimore (talk) 12:41, 25 August 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. Case closed.  Vanjagenije  (talk)  14:30, 25 August 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same MO as always. <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   12:54, 26 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Please check for sleepers as it is clear this person most likely has very many accounts that have yet to be detected. Sro23 (talk) 12:37, 27 August 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked by . Closing. Favonian (talk) 14:19, 27 August 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

WP:DUCK, both accounts made just enough dummy edits in order to gain the right to edit AN/TPS-43. Sro23 (talk) 12:11, 28 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Both blocked. Closing. Bbb23 (talk) 14:44, 28 August 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

The usual pattern of a series of 1-byte edits to autoconfirm followed by an attack on AN/TPS-43. WP:DUCK. <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   21:55, 21 September 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Sock is already blocked. I put the article under ECP for a year. Semi-protection wasn't doing anything. NinjaRobotPirate (talk) 00:49, 22 September 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

. Obvious ducks. Editing patterns are pretty much identical. The reason why I'm opening this case is because we need a Sleeper Check and Rangeblocks. For the first named account, the sock was active primarily at the Spanish Wikipedia and Wikimedia Commons, but the edits at those sites are a direct giveaway; however, this account also exists on the English Wikipedia. This vandal/troll has also taken a liking to stalking/attacking my talk page on Commons (User:BlueHypercane761), which is quite evident in the revision history. He has been trolling me on Commons since March 2016, which indicates a long-term trolling problem from this vandal as well. He also made a number of implicit death threats, as seen here (these vandal edits will probably slow down or crash your web browser), so the WMF staff and/or the Stewards should be notified about this vandal's persistent abuse. This user has also been vandalizing the AN/TPS-43 article since July 2006, (as seen in the revision history), which is a very indicative of Long-term abuse. Requesting a Sleeper Check to be run on the underlying IP Ranges and the recent sock accounts, because this user often switches back and forth between using IP socks and named accounts, so it's difficult to tell whether or not he has any more socks lying around.  Light and Dark2000  (talk) 11:06, 26 November 2017 (UTC)
 * In addition, a Long-term abuse report needs to be filed on this sockmaster, due to very long-term abuse from the socking/vandalism, and the more recent spate of trolling/personal attacks. If it helps, his known recent IP ranges are: 181.49.88.0/21, 181.57.240.0/20, and 181.63.210.0/20 (slightly older range). The first range is already blocked on Commons, due to the persistent abuse coming from it. He may have switched to another IP range at this point, but the data provided should help construct effective rangeblocks, if implemented. ROXELANA22 should also be rangeblocked here on Wikipedia for several months (shorter blocks have already proven ineffective); in any event, all of the recently-used IPs by this sockmaster should definitely be blocked for a duration of months, at the least. Needless to say, I have already filed a request on Metawiki to alert the Stewards, but one of the more familiar CheckUsers here should probably go inform the Stewards about this LTA abuser, in order to get more assistance on this problem.  Light and Dark2000  (talk) 11:06, 26 November 2017 (UTC)
 * By the way, ROXELANA22's service providers should be notified in order to get his IPs blacklisted (the said IPs can be found in the revision history of my Commons talk page, or the range contributions page on Commons). It would be even better if his internet providers could limit his internet access.  Light and Dark2000  (talk) 11:11, 26 November 2017 (UTC)
 * Due to this vandal's familiarity and tendency to sock on other Wikimedia Project sites (such as the Spanish Wikipedia and Wikimedia Commons), all of this vandal's sockpuppet accounts should be Globally Locked by a Steward, especially the newer accounts.  Light and Dark2000  (talk) 11:16, 26 November 2017 (UTC)
 * Interestingly, in this personal attack, ROXELANA22 claimed to be a sockpuppet of User:Anibal1, so perhaps Anibal1 is the original sockmaster account. However, Anibal1 is registered only on ROXELANA22's home project, the Spanish Wikipedia.  Light and Dark2000  (talk) 11:33, 26 November 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * . All accounts globally locked already; closing. ~ Rob 13 <sup style="margin-left:-1.0ex;">Talk 14:40, 26 November 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

. Obvious ducks. Sock account vandalizes the same articles and talk pages as usual, and the editing behavior is pretty much identical. Also note that this sock account attacked my talk page on Commons, again. Requesting a Checkuser to check for Sleeper accounts (and maybe implement a rangeblock), given this users' history of prolific socking and very disturbing attacks.  Light and Dark2000  (talk) 08:31, 12 February 2018 (UTC)
 * And please run a Sleeper Check on all of his latest socks and known IP Ranges, since the sockpuppet 1MICOLOC was a Sleeper Account that went unnoticed since it registered in November 2017.  Light and Dark2000  (talk) 08:57, 12 February 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Taken care of by Zzuuzz. Closing. Sro23 (talk) 11:54, 12 February 2018 (UTC)
 * Taken care of by Zzuuzz. Closing. Sro23 (talk) 11:54, 12 February 2018 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

The first listed account, User:Fundamentos Generalidades, is a currently unblocked, suspected account. The other sock accounts listed have all been indef blocked and Locked, and are listed for reference. The suspected sock account, User:Fundamentos Generalidades, is currently registered here on the English Wikipedia. The account's only edits on Commons was pretty much spamming his talk page with junk info in Spanish, a known behavior of ROXELANA22 socks. During this time, the named account interacted with 2 other known IP socks of User:ROXELANA22, with the IP socks building upon the named account's edits, as seen in the revision history of the account's talk page. Within a day, the junk edits were deleted and the user was warned. However, one of the IP socks then returned to the talk page and essentially restored the deleted content, before adding even more junk. Due to the account's interactions with known ROXELANA22 socks, the editing behavior, and the naming pattern, this User:Fundamentos Generalidades is probably a Sleeper Account of User:ROXELANA22, and if a CheckUser confirms this, the account should be blocked indefinitely. It's very important for this account to be indef blocked if it is an actual sock, because ROXELANA22 is notorious for leaving behind Sleeper Accounts and cross-wiki abuse.  Light and Dark2000  (talk) 08:03, 24 February 2018 (UTC)
 * By the way, 6-12 month rangeblocks would be really helpful here in suppressing IP socking and serial sock creation. (Shorter rangeblocks have already proven ineffective.) His most recent known IP ranges are: 181.49.88.0/21 (already rangeblocked on Commons), 181.57.240.0/20 (probably his most recent IP range), and 190.27.176.0/20 (less frequently used). In order to avoid collateral damage, the rangeblocks could be broken down into several smaller rangeblocks that end up cumulatively covering all of the IPs has has used to sock/create accounts within the past year. Perhaps 4 to 10 smaller rangeblocks would suffice to cover all of his known IPs recently, without causing a whole lot of collateral damage. Global IP Rangeblocks should be considered, due to his recent spree of increasing Cross-wiki vandalism, but at the very least, the ranges should all be blocked extensively on this site, Commons, and the Spanish Wikipedia, since he vandalizes those sites most frequently.  Light and Dark2000  (talk) 08:03, 24 February 2018 (UTC)
 * A Long-term abuse report should be filed on this sockmaster, given the extent and the severity of his cross-wiki vandalism. This user has been socking as IPs since July 2006, and even had an earlier sock family, User:Macallla, back in 2008. Since this user has a history of leaving behind Sleeper Accounts and using a series of "sneaky" edits to game the system (in order to have access to Extended Confirmed protected articles), an LTA report would be really useful for this vandal.  Light and Dark2000  (talk) 08:09, 24 February 2018 (UTC)
 * I'm also requesting a CheckUser to check for Sleeper Accounts, because this user has been known to leave behind Sleeper Accounts for close to 6 months before "reactivating" them, and even "migrating" socks from one project site to another (even if blocked on the first site). By the way, given this user's penchant for quickly creating more socks soon after being blocked, it would be very helpful to run another Sleeper Check on all recent socks (and IP ranges) within a few days and/or a week from now, given his sock creation patterns.  Light and Dark2000  (talk) 08:03, 24 February 2018 (UTC)
 * Can you please get someone to do another Sleeper Check within a week? Judging by this vandal's past history of socking, he will likely have created more Sleeper Accounts by then. Monthly Checks on his recent IPs and accounts would also be helpful.  Light and Dark2000  (talk) 20:47, 24 February 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Closing. It looks like a sleeper check was recently done by Zzuuzz. The first account appears to be someone else, and it's not even active on the English Wikipedia. Sro23 (talk) 18:03, 24 February 2018 (UTC)
 * Closing. It looks like a sleeper check was recently done by Zzuuzz. The first account appears to be someone else, and it's not even active on the English Wikipedia. Sro23 (talk) 18:03, 24 February 2018 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Another obvious sock. Requesting a CheckUser to run a Sleeper Check, because this lowlife is very notorious for leaving behind Sleeper accounts. And ideally, someone needs to rangeblock this guy's IPs for 1 year (though a Global Rangeblock would be best), because obviously, he's still socking.  Light and Dark2000  (talk) 07:59, 12 March 2018 (UTC)
 * By the way, someone seriously needs to file a Long-term abuse report on this vandal. He has been vandalizing and attacking other users across so many different Wikimedia sites for nearly 12 years now. Quite honestly, even that description is putting it lightly. If no one writes a Long-term abuse report on this vandal, then I will. To be honest, I've had it with his bullsh*t. Twelve fr**kin years of this sh*t (and 2 years of dumping his crap onto my Commons talk page), and I've had it. I doubt that I'm the only one. I don't care if I have to edit war with this vandal across every Wikimedia Project site for 50 years if I have to, but I won't allow him to get away with even one act of vandalism. If he keeps this up, I will consider contacting the US Government for considering possible terrorist-criminal charges (based on the context of his vandalism), or even notifying the WMF Staff in some way, because 12 years of personal attacks and degrading vandalism is unacceptable by any standards. Even for this site.  Light and Dark2000  (talk) 07:59, 12 March 2018 (UTC)
 * By the way, this vandal also seems to have taken a liking to vandalizing the Hurrem Sultan article (and its cross-wiki equivalents). It will be worth watching that article. By the way, someone needs to construct edit filters for this vandal's favorite forms of vandalism (including phrases, pictures. etc.), and maybe even a filter for his account creation naming patterns.  Light and Dark2000  (talk) 08:10, 12 March 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * A sleeper check is not warranted. Closing. Bbb23 (talk) 14:06, 12 March 2018 (UTC)
 * A sleeper check is not warranted. Closing. Bbb23 (talk) 14:06, 12 March 2018 (UTC)