Wikipedia:Sockpuppet investigations/Runtshit/Archive

Report date January 20 2009, 11:58 (UTC)

 * Suspected sockpuppets




 * Evidence submitted by RolandR (talk)

Already blocked as a sock; report submitted for check user to identify and block proxy IPs and sleeper accounts

Diff RolandR (talk) 13:55, 23 January 2009 (UTC)
 * Evidence submitted by RolandR (talk)

Blocked sockpuppets. Reported for CU to identify and block sleepers and IPs RolandR (talk) 15:30, 26 January 2009 (UTC)
 * Evidence submitted by RolandR (talk)


 * Comments by accused parties    See Defending yourself against claims.

This case should not be closed. Evidence of further sockpuppets has been added, after previous IPs have been blocked. CU needed for more IPs. RolandR (talk) 15:56, 26 January 2009 (UTC)
 * Comments by other users

Requested by RolandR (talk) 11:58, 20 January 2009 (UTC)
 * CheckUser requests


 * Clerk, patrolling admin and checkuser comments


 * No obvious sleepers lurking, . – Luna Santin  (talk) 20:05, 20 January 2009 (UTC)
 * Reporter added more accounts after CU run but before closure. Re-opened this to CU these before we finish this case (thanks) Mayalld (talk) 16:07, 26 January 2009 (UTC)


 * Conclusions
 * . No sleepers, open proxies blocked. Nishkid64 (Make articles, not wikidrama) 18:54, 26 January 2009 (UTC)

Tiptoety talk 20:41, 26 January 2009 (UTC)

Report date February 1 2009, 15:49 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by RolandR (talk)

Blocked already for typical Runtshit vandalism. Reported for checkuser to identify sleepers and proxy ips.


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by RolandR (talk) 15:49, 1 February 2009 (UTC)
 * CheckUser requests


 * Clerk, patrolling admin and checkuser comments


 * No obvious sleepers. Probable proxies blocked. – Luna Santin  (talk) 09:10, 2 February 2009 (UTC)


 * Conclusions

Report date February 3 2009, 14:38 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by RolandR (talk)

Yet another blocked vandal. Reported to identify proxy ips and sleepers.


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by RolandR (talk) 14:38, 3 February 2009 (UTC) Mayalld (talk) 17:08, 3 February 2009 (UTC)
 * CheckUser requests


 * Clerk, patrolling admin and checkuser comments

-- Kanonkas : Talk  17:13, 3 February 2009 (UTC)
 * Conclusions
 * . No sleepers found. Nishkid64 (Make articles, not wikidrama) 17:12, 3 February 2009 (UTC)

Report date February 6 2009, 11:07 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by RolandR (talk)

Blocked as a sockpuppet of Runtshit. Reported for checkuser to identify sleepers and proxy IPs


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by RolandR (talk) 11:07, 6 February 2009 (UTC)
 * CheckUser requests


 * Clerk, patrolling admin and checkuser comments

No obvious sleepers lurking,. – Luna Santin  (talk) 11:25, 6 February 2009 (UTC)
 * Conclusions

Report date February 12 2009, 11:48 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by RolandR (talk)

Blocked Runtshit sock; reported to check for sleepers and proxy IPs.


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by RolandR (talk) 11:48, 12 February 2009 (UTC)
 * CheckUser requests


 * - Cases like this could probably be reported to the "quick case" section at the bottom of the mainpage from now on, but there is no issue with doing it here either. Tiptoety  talk 17:36, 12 February 2009 (UTC)


 * Clerk, patrolling admin and checkuser comments


 * Conclusions
 * . Open proxy blocked, no sleepers. Nishkid64 (Make articles, not wikidrama) 19:10, 12 February 2009 (UTC)

Report date February 23 2009, 14:51 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by RolandR (talk)

Already blocked; reported for checkuser to identify proxy IPs and sleepers.


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by RolandR (talk) 14:51, 23 February 2009 (UTC)
 * CheckUser requests


 * Clerk, patrolling admin and checkuser comments


 * Conclusions
 * , no sleepers. IP blocked. Nishkid64 (Make articles, not wikidrama) 18:53, 23 February 2009 (UTC)

Report date February 24 2009, 12:49 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by RolandR (talk)

Already blocked; reported for checkuser to identify proxy IPs and sleepers.


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by RolandR (talk) 12:49, 24 February 2009 (UTC)
 * CheckUser requests


 * another clerk. Whilst it is clear that Runtshit is a serial vandal, and that he is stalking the reporter, the socks that he creates can invariably be blocked as vandals. Running a CU every time he vandalises is just creating a scoreboard for him. Per WP:DENY, and WP:RBI, I would suggest that as his socks get blocked for vandalism soon enough, creating a new SPI report is superfluous. Seeking sleepers and underlying ranges by CU on several occasions hasn't actually put paid to his reign of vandalism. It has merely imortalised it. I am minded to decline this request for CU, and close the case, but would appreciate other opinions on it. Mayalld (talk) 14:38, 24 February 2009 (UTC)

I'm going to partially agree here. I count 5 cases just this month, and one from last month; all of which resulted in no sleepers, and possibly one or two open proxies. Any more should be handled per the usual way.  Syn  ergy 15:39, 24 February 2009 (UTC)
 * Clerk, patrolling admin and checkuser comments

Serial vandal with dynamic IP. Block on sight as per WP:DUCK and ignore. -- Avi (talk) 15:46, 24 February 2009 (UTC)
 * Conclusions

Report date March 4 2009, 19:18 (UTC)

 * Suspected sockpuppets

Identical BLP-violating edit to that by earlier sockpuppet.
 * Evidence submitted by RolandR (talk)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by RolandR (talk) 19:18, 4 March 2009 (UTC)
 * CheckUser requests


 * - Tiptoety  talk 22:35, 5 March 2009 (UTC)


 * Clerk, patrolling admin and checkuser comments
 * - You need to provide us with a suspected sockpuppet. Are you trying to report ? Tiptoety  talk 23:38, 4 March 2009 (UTC)
 * Yes, I thought I had; I don't know what went wrong there! Added again RolandR (talk) 08:05, 5 March 2009 (UTC)


 * Conclusions
 * ✅, although I think is the sockmaster. The last sock  was editing Barry Chamish on the same university IP address and same user agent less than five minutes before a series of Runtshit vandalism occurred. Definiciency edited on the same IP address (with the same user agent) as a whole drawer of Runtshit socks. Nishkid64 (Make articles, not wikidrama) 00:12, 6 March 2009 (UTC)
 * Blocked and tagged as Runshit. Also, I have merged this case to the Runshit case. Tiptoety  talk 00:20, 6 March 2009 (UTC)

27 February 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

''Please list evidence below this line. Remember to sign at the end of your section with 4 tilde characters " ~ "''

Zuminous, who is in turn a proven sockpuppet of Runtshit, was a single-purpose account for the purpose of attacking Barry Chamish. Several socks were blocked under this puppetmaster, before it was confirmed as itself a sock. Following discussion on BLPN, I have looked at the history of the article and discovered the accounts above, many of them SPAs, which have been making edits very similar, or identical, to those made by already proven socks. Although some of these are old and dormant accounts, I think they should all be blocked and the IPs checked as proxies, in order to limit future abuse. RolandR (talk) 22:39, 27 February 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
The following are ✅ matches (please note that some are and also that checkuser cannot disclose links between IPs and named accounts):
 * Group 1:
 * Group 2:
 * Some notes: the two groups are matches to each other, but I cannot make comparisons to older accounts, as they are stale.  TN X Man  23:06, 27 February 2011 (UTC)
 * I moved this case over to Runtshit, and everyone's been blocked and tagged. —  Hello Annyong  (say whaaat?!) 13:20, 28 February 2011 (UTC)
 * Group 2:
 * Some notes: the two groups are matches to each other, but I cannot make comparisons to older accounts, as they are stale.  TN X Man  23:06, 27 February 2011 (UTC)
 * I moved this case over to Runtshit, and everyone's been blocked and tagged. —  Hello Annyong  (say whaaat?!) 13:20, 28 February 2011 (UTC)
 * Some notes: the two groups are matches to each other, but I cannot make comparisons to older accounts, as they are stale.  TN X Man  23:06, 27 February 2011 (UTC)
 * I moved this case over to Runtshit, and everyone's been blocked and tagged. —  Hello Annyong  (say whaaat?!) 13:20, 28 February 2011 (UTC)
 * Some notes: the two groups are matches to each other, but I cannot make comparisons to older accounts, as they are stale.  TN X Man  23:06, 27 February 2011 (UTC)
 * I moved this case over to Runtshit, and everyone's been blocked and tagged. —  Hello Annyong  (say whaaat?!) 13:20, 28 February 2011 (UTC)
 * I moved this case over to Runtshit, and everyone's been blocked and tagged. —  Hello Annyong  (say whaaat?!) 13:20, 28 February 2011 (UTC)

06 November 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

In the last week I have received some 130-150 emails from these 3 accounts; see here and here. The first was: "You know what? It does not matter whether or not the anti-Semitic United Nations creates yet another Arab state. Do you know why? Because the West Bank is part of the Jewish homeland, and you and your subhuman Fakestinians will be exterminated just like you tried to do to us. I cannot wait for the next war to break out so I could start slaughtering Arab scum." Because of the email-adress of the first account (Death2FakeJewsLikeRRance@mailinator.com) I assumed the Runtshit-vandal. But: I know that Grawp has "graced" the Israeli/Palestine-arena also lately, so; is this Runtshit or Grawp...or someone else? (In any case, have now disabled my email-account.) Huldra (talk) 07:24, 6 November 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I too have received such emails from these accounts. But I don't believe this is Runtshit, the behaviour is very different. Judging by previous such abuse (, and many others, it seems more likely that this is Jarlaxleartemis. See previous ANI about this. RolandR (talk) 11:40, 6 November 2011 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * ✅; . Tiptoety  talk 07:27, 6 November 2011 (UTC)

They're all probably him; all of them have incessantly spammed emails, and all such accounts have had email revoked. Other than that, there is nothing else we can do here. –MuZemike 07:29, 6 November 2011 (UTC)

State of Palestine has been full-protected for 1 week. –MuZemike 07:31, 6 November 2011 (UTC)
 * Yeah, and just to clarify there is no way for us to determine if these are Runtshit or not since all the data we have on that user is . It really shouldn't matter much though, they should be blocked on sight either way. Tiptoety  talk 07:32, 6 November 2011 (UTC)

14 December 2011

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

Requesting IP block, already blocked. -- DQ  (t)   (e)  12:30, 14 December 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' These editors are clearly Runtshit. The content of the edits, the articles vandalised, and the user names are all characteristic of this vandal. RolandR (talk) 13:05, 14 December 2011 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Found out they are probably using proxies, but lets triple check. Respect Party semi'd 6mo. -- DQ  (t)   (e)  12:30, 14 December 2011 (UTC)
 * No sleepers. Blocked a few IPs but I'm dubious as to what that'll do. --(ʞɿɐʇ) ɐuɐʞsǝp 16:40, 15 December 2011 (UTC)
 * Ya, well lets shut this one down. -- DQ  (t)   (e)  17:04, 15 December 2011 (UTC)

17 August 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

These accounts have all been used to add defamatory material to Amiram Goldblum, an article about a leader of the Israeli Peace Now group. In most cases, they have made no other edits. In their choice of target, the style of their abuse, the unreliable sources cited, and the usernames, they very strongly resemble the pattern of this serial puppeteer. A CU is needed both to confirm this suspicion, and to flush out further sleepers. RolandR (talk) 13:23, 17 August 2012 (UTC) RolandR (talk) 13:23, 17 August 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ the following are related to previously blocked Runtshit socks:

Furthermore 64.250.114.0/24 is a webhost and the specific IP looks like a proxy and is now blocked. -- DQ  (ʞlɐʇ)  23:50, 18 August 2012 (UTC) — Berean Hunter   (talk)  20:24, 19 August 2012 (UTC)
 * Sabretooth26 and YankeeYiddel are technically ❌ to each other and Runtshit socks, behavior will have be the deciding factor. -- DQ  (ʞlɐʇ)  23:46, 18 August 2012 (UTC)
 * Blocking confirmed socks with no tags per DENY. If there is more evidence of socking, please refile.

07 September 2012

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

Edit-warring and BLP violations on Neve Gordon, a frequent target of this vandal. Edits use the non-reliable Isracampus site, often cited by Runtshit. RolandR (talk) 17:07, 7 September 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  12:14, 8 September 2012 (UTC)
 * - I am endorsing the checkuser request because this looks a lot like Runtshit's modus operandi. Additionally, the links and content are indicative of him. However, it is also possible that YankeeYiddel is unrelated to Runtshit, but simply made the Brary goolam account to engage in edit warfare. If the former, I will indef both. If the latter, then I will indef Barry goolam and give YankeeYiddel a temporary block for making highly disruptive edit-warring socks. Reaper Eternal (talk) 17:25, 7 September 2012 (UTC)
 * ✅ that Barry goolam matches Runtshit (or at least matches a bunch of previously blocked and tagged Runtshit socks), and I found, blocked, and tagged a couple more. YankeeYiddel is technically ❌; different hemisphere. --jpgordon:==( o ) 23:03, 7 September 2012 (UTC)
 * Closing.

19 January 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Vandalism and block evasion Eye  snore 17:55, 19 January 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

These are both clearly Runtshit RolandR (talk) 19:34, 19 January 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Already indefed by . Closing. Basa lisk  inspect damage⁄berate 19:04, 19 January 2013 (UTC)

12 March 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Attacks on Amiram Goldblum; there have been many similar (but now hidden) attacks by previously blocked socks. RolandR (talk) 18:02, 12 March 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Blatant socks blocked. Endorsing for checkuser to block the IP (almost certainly an open proxy) and block sleepers. Reaper Eternal (talk) 20:18, 12 March 2013 (UTC)
 * Editing through a webhost which I've now blocked. Elockid  ( Talk ) 21:55, 12 March 2013 (UTC)

28 March 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Both these accounts have been used to edit Steven Plaut from the apparent POV of the subject, as have several identified socks. Each was created concurrently with recently blocked socks: Liberate cyprus at 12:06 on 27 March, concurrently with blocked sock ; Aardvaik at 09:14 on 28 March, concurrently with blocked sock. Each subsequently edited at the same time as the blocked socks (diffs hidden, so I cannot point to them).

Runtshit has a history of such apparent "clean hand, dirty hand" accounts, and a CU is almost certain to confirm this linkage, and to uncover other possible sleepers. RolandR (talk) 12:15, 28 March 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * These accounts, plus another couple I won't mention, are all the same, and I didn't see any sleepers. ​—DoRD (talk)​ 15:07, 28 March 2013 (UTC)
 * Marking for close, looks like everything's done here. Jafeluv (talk) 00:37, 29 March 2013 (UTC)

19 May 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Identical BLP-breaching personal attacks at Talk:Amiram Goldblum. The article and talk page have been plagued by abusive comments, and one editor has already been topic-banned. These two accounts are clearly socks of another, possibly Runtshit. There are likely to be other linked accounts, or sleepers; though the puppeteer may be using proxies and anonymisers. RolandR (talk) 10:54, 19 May 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ✅:, , , , and .  Salvio Let's talk about it! 16:57, 19 May 2013 (UTC)
 * Will take moving/tagging/blocking, and I'm actively doing so. Dennis Brown - 2¢  - © - @ - Join WER 17:57, 19 May 2013 (UTC)
 * Changed master to common original user, Runtshit. Blocked, tagged, moved and closed. Dennis Brown - 2¢  - © - @ - Join WER 18:03, 19 May 2013 (UTC)

17 July 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Edited the Ilan Halevi article and added a rather non-constructive comment to an editor. Insulam Simia (talk/contribs) 18:14, 17 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

An obvious Runtshit sock, and already blocked. In future, it is much quicker to report such socks directly to WP:AIV. RolandR (talk) 18:36, 17 July 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  18:39, 17 July 2013 (UTC)
 * Closing.

18 July 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Over at Moshé Machover, the edits seemed awfully familiar to User:Second cousing seth. I couldn't review the edits again because they were RevDeleted. See Long-term abuse/Runtshit for more information. --   LuK3      (Talk)   15:24, 18 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Next time you see a Runtshit sock, please report them to AIV/ANI. This makes blocking quicker. Insulam Simia (talk/contribs) 15:26, 18 July 2013 (UTC)
 * Will do, thanks for the note. --   LuK3      (Talk)   15:29, 18 July 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked by another CU. ​—DoRD (talk)​ 16:10, 18 July 2013 (UTC)

11 January 2014

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Edits--now deleted--clearly show a connection with Runtshit. Admins: see deleted edits here Willking1979 (talk) 17:23, 11 January 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * This user has already been blocked indef, why do you want a checkuser at this point? Mark Arsten (talk) 19:43, 11 January 2014 (UTC)


 * To determine sleeper socks. Willking1979 (talk) 20:32, 11 January 2014 (UTC)


 * Nothing else of interest. Elockid  ( Talk ) 03:21, 12 January 2014 (UTC)

22 March 2014

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Vandalism and inappropriate page creation  Eye snore  (pc) 16:18, 22 March 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' These are definitely not Runtshit socks. They share none of this serial malicious vandal's characteristics, and I really can't see why the filer thought they were his work. RolandR (talk) 23:15, 22 March 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Definitely the same person, and I've blocked both accounts as VOAs, but are you sure it's Runtshit? Favonian (talk) 16:28, 22 March 2014 (UTC)
 * These are not Runtshit. Already blocked as VOA, nothing more to do here. Closing. King of &hearts;   &diams;   &clubs;  &spades; 21:45, 23 March 2014 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same edits at Stone Temple Pilots (which is where most of the disruptive editing has taken place), not even resuming their other usual edits.

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
This is unrelated to the user known as Runtshit, and the complaint is unclear... closing. -- zzuuzz (talk) 20:01, 9 May 2018 (UTC)