Wikipedia:Sockpuppet investigations/RobotRat/Archive

23 February 2016

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

My most substantiated suspicion here is that 111.223.94.226 is RobotRat, mainly because 111.223.94.226's first edit consisted in reinstating content reverted from RobotRat, and the rest is WP:SPA(ddress) behavior on related articles. This is part of a series of editors aggressively editing against (if not harassing), as the ANI case shows in more detail. I ask for checkuser because, again as the ANI case suggests, there are other editors who are a potential issue, but I am unable to provide definite enough evidence to even list them among the suspected socks; I just think the behavior against Lemongirl942 has gotten beyond worrying. LjL (talk) 15:49, 23 February 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * The edits by 111.223.94.226 are suspiciously similar to previous edits by Aricialam (and their sock RobotRat), including the narrow focus on specific topics. Apart from LjL's evidence, the edit summary of another diff says "ends an edit war for once and for all" and created a new section which was being debated on the talk page. Aricialam had constantly supported having this section,, even though other editors (including me) had disputed this ,,.  Lemongirl942 (talk) 08:31, 24 February 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Whatever your motives, the CU request is declined. As I imagine you know, we rarely publicly disclose the IP(s) of named accounts.--Bbb23 (talk) 16:08, 23 February 2016 (UTC)
 * yes, I wasn't expecting disclosure of IP connections, but as I mentioned, the ANI report gives reason to suspect there could be other named accounts, either already active in accusing Lemongirl942 or dormant, and I thought those could be investigated. In particular, I would like to underline my good faith in making this assumption based on the fact that an administrator,, actually said that "You should assume these IPs and any new accounts are one and the same, imo.". In any case, I now learn that has blocked RobotRat and Aricialam as socks on CheckUser evidence, so further CheckUser use may not in fact be needed. LjL (talk) 18:28, 23 February 2016 (UTC)


 * I've semi-protected the main article of interest to help calm down the trolling, though some ripening socks might still get through. Following the ANI discussion I encourage CheckUsers to monitor this situation and make any investigations they consider appropriate behind the scenes without necessarily disclosing any information.
 * As for this investigation, the IPv6 is already blocked. The other IP is one I expect to change before their next edit. The actual user behind the IP addresses is unlikely to be confirmed - whether it's RobotRat or the original sockmaster is academic. My advice remains to apply the duck test and not view this as more than one user. -- zzuuzz (talk) 19:22, 23 February 2016 (UTC)


 * Master blocked, IPs not active any more. Closing.  Vanjagenije  (talk)  12:19, 29 February 2016 (UTC)

21 March 2016

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

(Note to checkuser: I listed the IPs to assist in the investigation. You do not need to tell publicly if the accounts are linked to the IPs, but I request you to use Checkuser for your internal investigation. Would also help to identify sleepers).
 * For context see this incident. Users seem to have a narrow interest in Calvin Cheng and are either sockpuppets or meatpuppets of "Aricialam" / "RobotRat".


 * IP "14.100.135.108" placed another veiled threat on my talk page as was placed earlier by "180.255.240.107"  and "14.100.132.155" . Also reinserted a WP:SYNTH see  like "RobotRat"  (see also previous investigation archive).


 * User "Samuraiofbugis" did a false report of vandalism which was subsequently declined .Also placed a vandalism warning message here . "RobotRat" had placed similar false vandalism accusations on my talk page as had "2406:3003:3049:2:60c:ceff:fedb:9328"


 * User "Historicalchild" (recently changed username from "JuiceBaby") seems to be a sleeper which recently awoke. The user was created on 23 February 2016, right after the previous incident happened and is trying (too hard) to disguise the fact that it is interested in Calvin Cheng. It lay dormant for a long period of time and then suddenly awoke. I have a strong suspicion that it is linked to user "JamesShong" (see and, in particular the first line). If not sockpuppets, seem to be meatpuppets.


 * User "Historicalchild" denies being related to "one of the blocked users" although I never specified which users. I find it highly suspicious that "Historicalchild" knows which blocked users.


 * In addition, if you look at the edits of "Historicalchild", it is clear that an attempt is being made to disguise the interest in Calvin Cheng. All the edits seem to be small "drive by" edits to increase diversity in topic editing. Some sample edits: (article has citations),,  (tagging cn when article already has template). However, I suggest someone else have a look at the edit history and decide, since my view could be biased.


 * IP "180.255.248.124" did an edit described as "reverting vandalism" but actually removed templates as well. Very similar to  by "Aricialam".


 * IP "180.255.248.215" admitted a possible conflict of interest here. . Also doing WP:PUSH at Talk:Calvin Cheng. This WP:PUSH seems to have been resumed by user "Historicalchild", although now considerably milder.


 * IP "203.123.15.254" left this "message (about me)" on my userpage . (Note: I have reverted it) For civility reasons, not typing it out here.


 * Summary: I feel all the users and IPs are somehow collaborating. I would like to know if the accounts are connected to each other. I do not need information connecting IPs to usernames as I understand it violates the privacy policy. Lemongirl942 (talk) 08:16, 21 March 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Letting you know since you were there at ANI last time. Here are the relevant sections of my talk page Interaction with IP and Interaction with "Historicalchild" for reference. --Lemongirl942 (talk) 08:26, 21 March 2016 (UTC)
 * Just to note - this has been bad enough that I've had to repeatedly semi-protect User:Lemongirl942's talkpage. SQL Query me!  22:27, 21 March 2016 (UTC)
 * I'm afraid I have nothing really useful to add, also considering I haven't followed the latest developments, but seeing how only one of the accounts could be confirmed as a sock with certainty, I will offer the people involved my understanding of the overall frustration with this continuing issue and targeting of one editor. LjL (talk) 00:36, 25 March 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - The IPs are certainly connected. I blocked one that was still active, others are not. I need a CU to compare those accounts. They are all interested in promoting Calvin Cheng, see:, and (reporting an IP for making this).  Vanjagenije   (talk)  09:56, 21 March 2016 (UTC)
 * The following account is ✅.


 * The following accounts are.
 * PhilKnight (talk) 00:10, 25 March 2016 (UTC)
 * PhilKnight (talk) 00:10, 25 March 2016 (UTC)
 * PhilKnight (talk) 00:10, 25 March 2016 (UTC)


 * I don't feel the evidence is strong enough. Will close soon unless I hear differently. Kevin ( aka L235 ·&#32; t ·&#32; c) 04:43, 10 April 2016 (UTC)
 * Closing. Kevin ( aka L235 ·&#32; t ·&#32; c) 22:33, 21 April 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

First, this case should really be under which is the oldest account dating back to 2007. Was blocked at the same time as. At the time Aricialam was blocked in Feb 2016, that person had succeeded in getting the article into this horrendously promotional condition.

All of these accounts remain focused on Calvin Cheng and write in the same very polite voice that misrepresents what it is doing and what others are doing, each goes to the talk pages of people trying to keep the article neural and chides them, and each relentlessly pushes to add promotional content to the article and to remove negative content. The pattern is exactly the same as the one identified by LemonGirl in the now-archived case. In the archived SPI Historicalchild was found to be ~possible~ but no action was taken.

This person is back and things are ugly.

Among the accounts named above, Blackdot_sg is the oldest.


 * Blackdot_sg was active for one day on Oct 4 and made two sets of edits: this set of two, which was reverted, and like the other socks, this one immediately restored it. If you look at those edits, they emphasis his new business and its IPO and remove detail about his inflammatory remarks and add content about Cheng trying to explain them away. The two edit notes are remarkable.  The 2nd edit in the first one said Updated with more details on the controversy over Cheng's facebook post on Islamic radicalism, and the second one Necessary to provide clear details of the issue and not truncate information to present a limited viewpoint.  This is the kind of misrepresentation I mean.  Polite, mispresenting, and quick with the revert to restore their PROMO contnet.  But that was all that this account did.


 * On Nov 1, IP 118 showed up and did this nonsense edit, changing "fashion entrepreneur" to "business entrepreneur" (what is that?) and then did this, again emphasizing the new company and also new matter, bloating up the LEAD and body with content about an internship program Cheng is launching, per this ref provided with Tembusu Partners. A year and a half ago this gang of socks was trying to use WP to hype plans for a media venture fund (which never seems to have launched) which was also with Tembusu Partners -- see  Talk:Calvin_Cheng/Archive_1.  (If you look there, you will see an editor called Juicebaby which was Historicalchild's username before they changed it. (Calvin Cheng is executive director of a magazine called "Juice", btw. (ref)


 * IP 118's edit was reverted the next day, and on Nov 3 the 2406' IP showed up and restored it with edit note please do not remove sourced content - in perfect continuity with 118 -- and then after that was reverted, again restored it. etc In the midst of that, the '2604 account battered the talk page and popped over to the talk page of another editor, User_talk:BukitBintang8888, and chided them, and misrepresented what they had been doing, as though it were only about the IPO content and not the rest of their changes.


 * I ended up requesting page protection and filing an EWN case on that IP, which is here. As soon as I filed that, the 2604 account vanished.  The page was also protected soon thereafter.


 * Now the '101 account comes into play, and it went to the admin's page who protected the article and a) chided them (!) I do not believe you are being completely objective.... and continued making the arguments that '2604 had been making. See here.


 * Juicebaby/Historicalchild then showed up again after a long absence (their last edit was March 2016 - when the last SPI was ongoing) and of course re-appeared only after the page was protected today and the IPs could not edit, and the EWN case had been filed. The first thing they did was note on the talk page that the IP edits were generally fine and explicitly gives the standard sock line I also think that the section on the terrorist children news is relatively old and over-weighted in the article.


 * I implemented the content about the IPO and updated the lead diff), as some of what the socks had been trying to force in was OK. here here Juicebaby/Historicalchild describes the content as saying "he was a member of The Government" when it says "he was involved in government". These are two very different statements in a parliamentary system (they are correct about that!) but they are misrepresenting the actual content.
 * and today Historicalchild also made this pretty dramatic edit, under the edit summary "Edited with local context", misrepresenting their own edit.


 * Other behavioral things - Juicebaby/Historicalchild felt the need to come drop me a note on my Talk page, writing no wish in getting into an edit war. But you have made several factual errors. (they had been edit warring, and there were no factual error, but this is a sock, so misrepresenting is what they do.) OK.

I am not even asking for a CU as the behavioral evidence is just so clear here. But do one if you like, of course.

This is a person who I believe has been abusing Wikipedia and sucking up the editing community's time for ten years now. Jytdog (talk) 10:08, 4 November 2017 (UTC)


 * So this has happened again. Page protection expired, we had disruption from IP addresses as already described above.  Page protection was re-enacted and the named account  suddenly becomes active again. Again.  I put the question to Historicalchild directly here and they said they are not editing while logged out.  I do not find this credible.


 * here is the protection log for the Cheng article.
 * Please compare
 * Special:Contributions/Historicalchild
 * Special:Contributions/43.252.213.40 Nov 22, 23, and 25
 * Special:Contributions/43.252.213.37 Nov 24, 25
 * Special:Contributions/103.212.223.3 Nov 22, 24, Dec 6
 * Special:Contributions/122.11.164.251 Nov 29
 * Special:Contributions/185.206.225.145 Dec 7
 * And see also the ridiculous amount of IP commentary at Biographies_of_living_persons/Noticeboard/Archive262. Jytdog (talk) 17:29, 8 December 2017 (UTC)


 * The new account (with acknowledged "alt"  appears to me to be another sock of this person.  They made some desultory edits then nominated the Cheng article for deletion.  This is a typical maneuver for a self-promoter when they finally lose control of the article. Jytdog (talk) 20:57, 10 December 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Historicalchild was previously found to RobotRat, but clerk  thought the evidence was not strong enough to block. I disagree, but before I do anything I'll see if Kevin has any input.
 * In the meantime, - please check the two named accounts here against each other and anything else from the archive that's useful. This case also involves harassment (see the block log for, also ping ), so if you could also take a look at the IPs and act if there's anything you can do, even if you can't comment on it here, I'd appreciate it. Ivanvector (Talk/Edits) 19:17, 29 November 2017 (UTC)
 * I'm sorry Ivanvector, I got nothing for you. You have to go on behavior, unless some other CU sees something I don't. OK, I got one tiny little thing and will email you that. Drmies (talk) 19:26, 29 November 2017 (UTC)
 * FWIW, I think you should consider looking at Historicalchild's contributions, the block by, the AC/DS warning on their talk page, and maybe user your power as an administrator to use a topic ban--unless you see enough evidence of disruption to simply block outright. Drmies (talk) 19:33, 29 November 2017 (UTC)
 * Go for it. Kevin ( aka L235 ·&#32; t ·&#32; c) 20:12, 29 November 2017 (UTC)
 * Well it seems this was the last case I left open before I buggered off into semi-retirement, and that it's been left open is entirely my fault. Drmies' email clued me in to something more specific to investigate, and is blocked. Furthermore, given the incessant undeclared commercial editing by numerous IP in a narrow geographic range over a long term I am indefinitely semiprotecting the article. Nonetheless I still don't find a case against Historicalchild - while it is possible-to-likely in my mind that they are also an undisclosed promotional editor, they are not the same editor as the sockmaster in this case. Also, I'm not positive that the checkuser block of Aricialam is clearly related to this case, so I'm not going to rename at this time. Closing. Ivanvector (Talk/Edits) 17:25, 25 January 2018 (UTC)
 * As it turns out the article is already semiprotected through next December, so I'm going to leave it alone. If disruption resumes at that time, the protecting admin should strongly consider indefinite semiprotection as this article will then have been almost continuously protected in some form for three years, with the intervening unprotected gaps filled by disruption from these spammers. Ivanvector (Talk/Edits) 17:31, 25 January 2018 (UTC)