Wikipedia:Sockpuppet investigations/Renamed user 51g7z61hz5af2azs6k6/Archive

05 December 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

I believe someone is using sock puppets in the form of at least the three initially listed IPs. They are being used by one or more logged out users to do abusive things socks typically are used to attempt/do - including avoid scrutiny, give the impression of more support for a position than actually exists, edit project space, avoid sanctions, contribute to the same page or discussion in a way that suggests they are multiple people, editing logged out to mislead.

Their handful of edits (<10, <10, <100) (diffs below) show this. Edits indicate that one longtime editor is using multiple IPs. I'd like a clerks and/or checkusers to indicate whether they see evidence that the IPs are connected to each other, and whether or not any are connected to users with accounts. I encourage the IPs to come clean - to at lease indicate (yes/no) whether they have any wikipedia accounts - or not. I don't think checkuser evidence is needed for an initial evaluation by a clerk of whether there's a connection - I think there's enough behavioral evidence for a yes on that, but a checkuser should therefore follow to find the additional connected account(s). Random add'l info/clues: Diffs:
 * 3 of the four edits by 2600:1010:b043:ec75:efad:9d0c:d710:2720 (For short: 2600...2720) included edits to MY signature.
 * 169.230.155.123 is AKA udp071243uds.ucsf.edu.
 * https://en.wikipedia.org/w/index.php?title=Talk:Valsartan/sacubitril&diff=693827373&oldid=693825836
 * https://en.wikipedia.org/w/index.php?title=Talk:Valsartan/sacubitril&diff=693887733&oldid=693887394 New user referencing WP:ANI!
 * https://en.wikipedia.org/w/index.php?title=Talk:Valsartan/sacubitril&diff=693825710&oldid=693825647 (revert)
 * https://en.wikipedia.org/w/index.php?title=Valsartan/sacubitril&diff=prev&oldid=693825972 (revert)
 * https://en.wikipedia.org/w/index.php?title=Valsartan/sacubitril&diff=prev&oldid=693887979 (revert)
 * https://en.wikipedia.org/w/index.php?title=Talk:Valsartan/sacubitril&diff=prev&oldid=693887394 (revert)
 * https://en.wikipedia.org/w/index.php?title=Valsartan/sacubitril&diff=693825972&oldid=693808751 (revert) - BRAND new user referencing WP:MEDRS AND tagging policy!
 * https://en.wikipedia.org/w/index.php?title=User_talk:2600:1010:B043:EC75:EFAD:9D0C:D710:2720&oldid=693886518 User warned not to sock.

--Elvey(t•c) 22:36, 5 December 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Two sock IPs blocked for 3 days, master IP warned. Range-block is not possible, as the range is very large. CheckUser can't help here, it is used only to compare named accounts, not anonymous IPs. I'm closing the case.  Vanjagenije  (talk)  01:24, 6 December 2015 (UTC)

20 December 2015

 * Suspected sockpuppets



This case was formerly opened under the above listed IP and has been moved to the above named account of the vanished user. So far, the only thing that I have seen in their behavior which may be confirmed to be wrong is that they have not followed our vanishing guideline correctly but I'm not sure that would be something to block over. Some evidence has been presented in the archive but I haven't seen convincing evidence of IP socking or other illegitimate uses so far. I will add IPs below but will leave it to the original filer or other investigators to show clear sockpuppetry if it exists. One can compare this version of their deleted user page with their statements here as well as compare the articles that they edit to see that this is the same user.
 * User compare report Auto-generated every hour.
 * Editor interaction utility example of mentioned results


 * Special:Contributions/73.162.132.47


 * Ranges
 * 169.230.155.0/24 <=== This whole range is him
 * 2601:643:8100:8AF4::/64 <=== This whole range is him


 * Single IPv6s taken from this range:
 * There is a handful of distinct editors using this range anonymously; one edits plant articles, one is a game developer, one is a long term abuse vandal, one owns a sex enterprise, one edits German subjects (either the plant guy or our chemical doctor being looked at) and our Chem PhD that is the subject of the SPI. Some of ChemPhD's edits may still be in this range but with less certainty, I have not included those here. Those listed below are the ChemPhD unless otherwise noted.


 * Special:Contributions/2600:1010:B043:EC75:EFAD:9D0C:D710:2720 (presented in SPI case)
 * Special:Contributions/2600:1010:B01D:46A9:1D35:CF9E:1113:134B (presented in SPI case)
 * Special:Contributions/2600:1010:B06D:5E2F:BA5E:1404:71DE:5437
 * Special:Contributions/2600:1010:B06D:5E2F:93C2:98F7:58A0:619F
 * Special:Contributions/2600:1010:B06C:3130:4634:BA77:9325:5D0F
 * Special:Contributions/2600:1010:B06B:11F9:EB30:3CF2:EEF0:BAE4
 * Special:Contributions/2600:1010:B06A:1268:6143:ED98:CF95:D496
 * Special:Contributions/2600:1010:B066:44E2:8939:E2F8:540C:533F
 * Special:Contributions/2600:1010:B066:44E2:1391:8751:4879:25C7
 * Special:Contributions/2600:1010:B061:CF67:A669:2892:C234:976F
 * Special:Contributions/2600:1010:B05D:EE05:524:C0B8:D3DF:A613
 * Special:Contributions/2600:1010:B05D:7FB1:5E50:DB83:A1BA:A6FE
 * Special:Contributions/2600:1010:B05C:DA55:5CF3:8C7:7549:503C
 * Special:Contributions/2600:1010:B05B:5245:9320:A9A6:5BFE:83CF
 * Special:Contributions/2600:1010:B05A:FD6:A145:835A:8AFE:BE1D
 * Special:Contributions/2600:1010:B05A:FD6:2094:6C31:D447:9910
 * Special:Contributions/2600:1010:B05A:49B8:5DC0:898:273B:7197
 * Special:Contributions/2600:1010:B056:945F:C2C5:6C5E:4E70:26E4
 * Special:Contributions/2600:1010:B055:3C74:C3C7:D622:852D:C8AF
 * Special:Contributions/2600:1010:B055:3031:CDC0:6EC:7F1D:1306
 * Special:Contributions/2600:1010:B055:3031:10EB:78F0:6231:8F9B
 * Special:Contributions/2600:1010:B051:DE80:5C77:3473:20D8:F0CB
 * Special:Contributions/2600:1010:B051:C0DA:0:47:D7F7:7B02 (maybe)
 * Special:Contributions/2600:1010:B050:EA67:0:6B:8A97:E401
 * Special:Contributions/2600:1010:B050:E1FF:D56D:7BBF:8162:67BD
 * Special:Contributions/2600:1010:B04D:EDB:0:63:678B:1801
 * Special:Contributions/2600:1010:B04B:4DE2:F5C7:81FD:11C6:48BE
 * Special:Contributions/2600:1010:B04A:5273:7F:BB10:CBE2:75EB
 * Special:Contributions/2600:1010:B04A:1473:2E9D:8A1A:23C1:16FB
 * Special:Contributions/2600:1010:B047:F0DD:1A9:51E6:F835:BC2C
 * Special:Contributions/2600:1010:B044:5164:ADD5:B5B3:3350:2AD9
 * Special:Contributions/2600:1010:B043:403B:91AA:2EFA:56B2:6F27
 * Special:Contributions/2600:1010:B043:3A89:211:24FF:FE27:C118 (maybe, this is between plant guy and ChemPhD...plant guy's IPs often end in "C118" despite the IP switching)
 * Special:Contributions/2600:1010:B042:9567:262:2640:1B30:E347
 * Special:Contributions/2600:1010:B042:3F75:ADE4:640E:D48A:4068
 * Special:Contributions/2600:1010:B041:214F:DC30:5A83:BB0:9A31
 * Special:Contributions/2600:1010:B041:214F:B975:B62F:674F:6CE1
 * Special:Contributions/2600:1010:B040:5A1D:75C2:579:15AD:E04D
 * Special:Contributions/2600:1010:B02F:E6E1:211:24FF:FE25:1E73
 * Special:Contributions/2600:1010:B02F:7E5F:4DE2:D8EA:F830:BBD2
 * Special:Contributions/2600:1010:B02D:A0E9:B9E7:EF94:3D06:DADB
 * Special:Contributions/2600:1010:B02D:E3AE:E906:CA46:CC16:D319  (maybe game developer or ChemPhD)
 * Special:Contributions/2600:1010:B02D:1A4C:99B0:E8E9:3C06:19C9
 * Special:Contributions/2600:1010:B02B:A742:21DA:4EB1:7617:CFA
 * Special:Contributions/2600:1010:B02B:201:59F3:3529:4A94:9B75
 * Special:Contributions/2600:1010:B029:7A1B:BD00:BE8C:55BC:F043
 * Special:Contributions/2600:1010:B028:8378:0:4D:33A5:AB01
 * Special:Contributions/2600:1010:B028:7E6B:BFF0:EE5C:5853:DF2E
 * Special:Contributions/2600:1010:B028:508D:2060:CA67:3E09:3F6A
 * Special:Contributions/2600:1010:B024:12E0:2F15:BFFF:4B57:3A1C
 * Special:Contributions/2600:1010:B023:A72D:B449:DD9B:C472:8A56
 * Special:Contributions/2600:1010:B020:585E:FE94:F49C:AD3:DE6E
 * Special:Contributions/2600:1010:B01F:BD99:543C:B037:142E:4FA6 (maybe)
 * Special:Contributions/2600:1010:B01E:F222:9F05:90DF:88A8:A88B
 * Special:Contributions/2600:1010:B01E:C2DF:0:2E:3DA5:3301
 * Special:Contributions/2600:1010:B01E:B0A1:0:13:C529:DD01
 * Special:Contributions/2600:1010:B01E:1A64:B3E9:652B:789C:328F
 * Special:Contributions/2600:1010:B01B:C467:0:46:FFEF:D01
 * Special:Contributions/2600:1010:B01B:674D:D959:1E12:B28E:BF2E
 * Special:Contributions/2600:1010:B01B:1B59:3129:F98A:D9AD:4E43
 * Special:Contributions/2600:1010:B019:F144:0:49:755D:2901
 * Special:Contributions/2600:1010:B019:5406:C8CC:F478:4510:588C (Jimbo talk)
 * Special:Contributions/2600:1010:B019:436F:F934:5271:7F89:2B6B
 * Special:Contributions/2600:1010:B018:6D82:481A:BFFA:CC4:C852
 * Special:Contributions/2600:1010:B017:EC70:0:0:0:103
 * Special:Contributions/2600:1010:B017:855F:B1A1:714A:98EA:26EE
 * Special:Contributions/2600:1010:B017:4508:F992:867E:48FA:BDAF
 * Special:Contributions/2600:1010:B016:CE0D:800C:BC6B:CE23:78F0
 * Special:Contributions/2600:1010:B013:47E:6055:E869:8BBE:5460
 * Special:Contributions/2600:1010:B012:ADAB:C49B:7EA:B85C:58B4
 * Special:Contributions/2600:1010:B00F:852E:E47E:6E42:DC4:F05E
 * Special:Contributions/2600:1010:B00F:72E:0:43:B1A0:8B01
 * Special:Contributions/2600:1010:B00D:8618:9127:34DE:86F4:908D
 * Special:Contributions/2600:1010:B00D:79DC:F819:654F:EEDB:D264
 * Special:Contributions/2600:1010:B00D:1936:3FB9:3BEF:F881:DC84
 * Special:Contributions/2600:1010:B00C:B39C:AC8F:DCF5:D371:F16B
 * Special:Contributions/2600:1010:B00A:E586:DDC6:F22B:98BC:C007
 * Special:Contributions/2600:1010:B00A:B9DD:4808:E587:BD2D:F753
 * Special:Contributions/2600:1010:B009:5683:0:30:9A1B:701
 * Special:Contributions/2600:1010:B007:CA70:6BD9:AA25:1C83:9059
 * Special:Contributions/2600:1010:B006:7821:661:249C:BFFA:5FEB
 * Special:Contributions/2600:1010:B004:F3C9:FFC0:86CC:6249:46C6
 * Special:Contributions/2600:1010:B003:FDA9:A9AB:4293:2E44:71C6
 * Special:Contributions/2600:1010:B003:C3D4:0:42:E782:2E01
 * Special:Contributions/2600:1010:B003:C1B5:E09B:797F:22B5:D973
 * Special:Contributions/2600:1010:B003:118B:BD70:C26B:746A:B667
 * Special:Contributions/2600:1010:B002:3B38:A5BA:53FA:AACA:B586
 * Special:Contributions/2600:1010:B002:3B38:6FEF:1CD4:783F:9CB0
 * Special:Contributions/2600:1010:B001:E167:6DD0:CE8D:A181:6B21
 * Special:Contributions/2600:1010:B001:95C7:E562:C480:AF42:E240 (maybe, MP joke)
 * Special:Contributions/2600:1010:B000:C37F:65E7:D34C:83B8:74F
 * Special:Contributions/2600:1010:B000:924E:B57D:A184:E41B:DC51
 * Special:Contributions/2600:1010:B000:3166:0:0:0:103
 * Special:Contributions/2600:1010:B068:6352:8D7:2513:F0FC:AEA9

— Berean Hunter   (talk)  23:02, 20 December 2015 (UTC)
 * This account used to be known as Formerly 98 but that is now an unregistered account so linking to it would do no good. I refer to him above as the ChemPhD guy. This is strictly about behavior and does not involve checkusers as I see nothing that they could do here.

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

This account that used to be known as Formerly 98 is the one I initially reported as Unknown regular user(s) temporarily logged out - active on MEDRS pages and opposed to rigorous evidence based-medicine when I first opened the first SPI on this user.

Do take note: the archived diffs show it's done abusive things socks typically are used to attempt/do - including avoid scrutiny, give the impression of more support for a position than actually exists, edit project space, avoid sanctions, contribute to the same page or discussion in a way that suggests they are multiple people, editing logged out to mislead. EACH of these is a violation of POLICY WP:SOCK.

I am flummoxed by the statement, "I haven't seen convincing evidence of IP socking or other illegitimate uses so far. I will add IPs below but will leave it to the original filer or other investigators to show clear sockpuppetry if it exists". If it't not clear whether this user's behavior constitutes socking, I propose an RFC on that question. Posting from many different IPs on many different networks for months without disclosing, by a user who has had an account while violating our vanishing guideline is socking.

Here's one example, where in a 12-hour period, this one editor edits the same talk page using three different IPs: First, using two different IPs, the user posts these (1) comments (2), separately signed and attributed. With the edit marked (2), the sock, which is infamous for scrubbing articles of information critical of big pharma, claims that there is no controversy about this drug in the peer reviewed literature. And as another IP, with the edit marked (1), the sock, argues that the article is balanced if there is no coverage of controversy in it. However, I find controversy about this drug in the peer reviewed literature without difficulty and add it to the article very soon after. With this edit, I revert the two edits, using the edit summary: "rv sock avoiding scrutiny" The user goes to war: the user revert me, using yet another IP address, 5 minutes later, with a very threatening edit summary:  {tq|"do not revert my additions to the talk page again unless you want to finish this convo at ANI."}}  The socking user goes into hiding to avoid further scrutiny after I turn up the heat, by more loudly calling out the socking behavior by filing the first SPI on the user. It's also several HOURS after I've warned the user to stop socking.

If anyone knows how to fix this page so the User compare report works properly, please do so. I'm giving it a shot. Update: Adding entries like I just did up at the top with the 3 IPs that were in the very stale User compare report that was appearing improved it somewhat - to 7 entries - but the numbers still show as off e.g. still 0 for the 2600:1010: IPs (@archive/D68i8). --Elvey(t•c) 03:38, 21 December 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - This is being discussed by e-mail.  Vanjagenije  (talk)  11:42, 21 December 2015 (UTC)
 * . I'm putting this off-hold after discussing with Berean Hunter. We all agree (since the beginning) that all those IPs belong to the same person, and we don't need evidence for that. But, we need some convincing evidence (WP:diffs) of abusive socking. You made accusations of several kinds of abusive behavior ("avoid scrutiny, give the impression of more support for a position than actually exists, [...] avoid sanctions, contribute to the same page or discussion in a way that suggests they are multiple people, ..."), but I don't see any evidence for those accusations. The two diffs you provided show this user leaving two comments on a talk page in a way so to make it obvious that he is the same user. In other words, this example clearly shows them not trying to suggest they are multiple people.  Vanjagenije   (talk)  22:50, 21 December 2015 (UTC)


 * The last edit from any of those IPs was on 6 December. The activity has stopped since, so I'm closing this.  Vanjagenije  (talk)  15:35, 23 December 2015 (UTC)