Wikipedia:Sockpuppet investigations/Sonic2030/Archive

Evidence submitted by Daedalus969
First, let me start off by saying that this is a violation of WP:SOCK as it is avoiding scruiteny, as well as 'vote stacking', in the sense that the user is pretending to be two different people. However, it becomes obvious that they are not when they use the same language in edit summaries, as evidenced below:


 * Marlin: Undid revision 328840145 by Morphh (talk) This is not your site and your POV is not the main concern for your hero. 3RR ? Take to TALK
 * 169: Undid revision 388794546 by Daedalus969 (talk) Is in TALK page. Report yourself as VANDAL

Those are just two of many; just a quick review of 169's recent contribs and Marlin's contribs shows a similar editing style between the sock and the master. Such as the above, shown where they all-cap specific words.

The pattern is pretty recognizable; the words that they all-cap have been shown to be 'talk': /, 'ref': , , / , , , and, '3rr': , , /.

On top of all-cap'ing certain words, they both share similar traits in regards to behavior. As shown in the diffs above, they commonly edit war and note 3rr in their edit summaries, but there is more than just that; they also call users vandals that they are in conflict with.

Given this obvious socking, I request that blocks be issued on both accounts. Both accounts has cross-over in edits, as evidenced by the user compare report below, and as evidenced in the first linked diff, they are pretending to be two different people to win content disputes.

Please tag and bag per WP:DUCK.

http://toolserver.org/~betacommand/UserCompare/Marlin1975.html —  Dæ dαlus Contribs 03:17, 10 October 2010 (UTC)
 * User compare report:

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
Agreed with the report. Blocking IP. Still thinking about the rest. -- Sh i r ik ( Questions or Comments? ) 04:27, 10 October 2010 (UTC)
 * Marlin1975 blocked 1 week. Normally would go with a warning on the first offense, but his account and the IP each have a block history. Will leave a note about what's going on. -- Sh i r ik ( Questions or Comments? ) 04:32, 10 October 2010 (UTC)

05 August 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Suspected sockmaster Still-24-45-42-125 has a recent history that includes two reports for edit-warring, on consecutive days, one of which resulted in a 24-hour block that he appealed repeatedly   and generally made a stink about (diff from Talk:Jimbo Wales ). Over the last couple of weeks, he has been involved with the high-conflict article Chick-fil-A and related articles Focus on the Family, WinShape Foundation and S. Truett Cathy. He has twice initiated DRN resolutions regarding content disputes at Focus on the Family  and another DRN regarding content at Political positions of Mitt Romney (DRN thread here:). Without going into unnecessary detail, I will simply point out that he was the adverse party, by clear consensus, in all three cases. It is also quite clear that this user is monitoring my contribs. 

Suspected sockpuppet User:Still-Jim is a very new account with only 8 edits in its history (2 of which were page creations for his own user and talk pages). This purportedly brand new user made it's first appearance on 7/25 at Talk:Chick-fil-A, displaying a distinctive POV concerning the article, in agreement with Still-24's, and quoting Wikipedia policy. Then today, the account made an appearance at Talk:Radical gay activism, which is very interesting because the article had just been created three hours earlier, and could not have been credibly found by any other means than monitoring my own contributions, or those of the other two editors who had touched the article up to that point. (See: Occam's Razor)

Suspected sockpuppet IP 72.196.235.207 (currently on a 1-week block for disruptive editing and, I believe, socking) is a relative low-use account that seems to only be used during periods of Still-24-45-42-125's inactivity. On 7/24 this IP swooped in and reverted three edits in Still-24's favor during a period of several hours when Still-24 was not active. One at WinShape Foundation, one at Focus on the Family , and one at Chick-fil-A.  Belch fire - TALK 01:20, 5 August 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I fail to see see any grounds mentioned for any sockpuppet investigation. The Chick-fil-A article is very high profile at the moment; new accounts appearing on it are to be expected. IRWolfie- (talk) 01:47, 5 August 2012 (UTC)

The summary of my behavior is so biased and inaccurate as to make it impossible to assume that this is a good-faith accusation. Belchfire is one of a small group of people who've been reporting and harassing me repeatedly, including a false 4RR accusation that nonetheless got me blocked. What's really hilarious is that my IP is well known to be 24.45.42.125, so it's not like I'm hiding anything at all. It would be insulting to investigate me, but utterly fruitless, so do whatever you want, then apologize. Still-24-45-42-125 (talk) 17:11, 5 August 2012 (UTC)

* Perhaps they are linked to this IP: Special:Contributions/98.195.84.153. It seems to have come out of nowhere with knowledge of how wikipedia works; all posts are at ANI. Note Marlin appears to be a previous sockmaster: Sockpuppet_investigations/Marlin1975/Archive. IRWolfie- (talk) 18:43, 5 August 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Both have been at Talk:Chick-fil-A and Talk:Radical gay activism with similar names and points of view. 24.45.42.125 was added as it is still active and is claimed to be the former, with 25 overlaps. That is surprising, but the recent activity justifies a closer look. Happy to hear other explanations, but a link is certainly possible here. Dennis Brown -  2&cent;    &copy;   Join WER 18:19, 5 August 2012 (UTC)

Still-24-45-42-125 is telling the truth. However, the following accounts are ✅ as each other:



I'm suspecting some other shenanigans going on here, as Still-Jim popped out of nowhere, and Marlin1975 was created in December 2007 and has returned from 2 years of inactivity. The latter is indicative of a sleeper sock, but I do not know of whom if that is the case.

Just to be clear, Still-24-45-42-125 is ❌ to the two socks I mentioned above. No comment of my own with regard to the IP addresses mentioned. --MuZemike 18:30, 5 August 2012 (UTC)
 * I had a sneaky suspicion that something similar just might be the case, and only CU would flush it out. Dennis Brown -  2&cent;    &copy;   Join WER 18:32, 5 August 2012 (UTC)
 * Still-Jim indef'ed as a sock of Marlin, who gets 1 month for a repeat performance. Still-24.45.42.125 is obviously innocent and caught up in the fray.  Dennis Brown -  2&cent;    &copy;   Join WER 18:39, 5 August 2012 (UTC)

17 December 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

New-ish user Sonic2030 (who seems to have pretty good Wiki knowledge, considering his sign-up date) has made a substantial portion of his short career Special:Contributions/Sonic2030 about un-doing my edits. He seems particularly interested in edits that air LGBT grievances against The Salvation Army.

Today, after racking up 3 reverts, he was given a 3RR "Stop Sign" warning for his activities at that article.

Almost immediately thereafter, previously unseen and unknown IP 96.54.183.71 arrives and begins to repeat some of the same edits that Sonic has been reverting.  Belch fire - TALK 22:53, 17 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - No need for CU, fairly obvious. Blocked. ( X! ·  talk )  · @007  · 23:10, 17 December 2012 (UTC)

19 December 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

This is a continuation of a case from yesterday (Sockpuppet_investigations/Sonic2030/Archive) wherein sockmaster Sonic2030 was blocked, and then had his block extended for his behavior afterward.

In the initial case, it appeared he had logged out in order to continue an edit war at The Salvation Army. Along the way, we learned that the IP originated from Canada.

The newest sock returned immediately to Salvation Army within one minute of account creation and repeated the same edits as before,  then proceeded to display an interest in hockey. (Yeah, I know... stereotypes are bad. But SHEESH!)  It seems fairly obvious that "HelferLad" is also the IP, and it was also obvious that the IP was "Sonic2030". Thus, the commutative law says they are all the same person.  Belch fire - TALK 00:28, 19 December 2012 (UTC)  Belch fire - TALK  00:28, 19 December 2012 (UTC)


 * Addendum In light of the new information brought forward by the CheckUser, I'm going to suggest/request that we take a look at the following IPs.  These are US Federal Government IPs originating at the Department of Homeland Security.  The IP-hopping user who edits from this range is especially obnoxious and has a long term pattern of stalking my edits and editing tendentiously:

See: [] See: See: See: See: See: See: See:

The pattern of behavior seen from this list of IPs fits well with the pattern seen from the list of socks below. If it's the same person, hopefully we can block the entire range and lodge a complaint with the government.  Belch fire - TALK 01:26, 21 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - - I think there's enough to link the two registered accounts. CU would be helpful.  Basa lisk  inspect damage⁄berate 19:23, 20 December 2012 (UTC)
 * I don't see behavoir alone being enough for a block, so I ran the check. though there is some evidence leaning towards this being him, proxies are being used. Take that as you will, but he's now indef'd. --  DQ  (ʞlɐʇ)  19:37, 20 December 2012 (UTC)
 * Thanks for the check. Closing. Basa lisk  inspect damage⁄berate 19:39, 20 December 2012 (UTC)
 * I found some additional data, ✅:
 * Several IPs belonging to webhosts, mostly blocked as open proxies already.
 * Several IPs belonging to webhosts, mostly blocked as open proxies already.
 * Several IPs belonging to webhosts, mostly blocked as open proxies already.
 * Several IPs belonging to webhosts, mostly blocked as open proxies already.
 * Several IPs belonging to webhosts, mostly blocked as open proxies already.
 * Several IPs belonging to webhosts, mostly blocked as open proxies already.


 * onhold There could be someone else behind this bunch, so i'm holding off on closing this. -- DQ  (ʞlɐʇ)  22:53, 20 December 2012 (UTC)
 * So I actually have nothing more, I do note that one of these socks has a sock tag for Marlin1975. -- DQ  (ʞlɐʇ)  02:51, 21 December 2012 (UTC)


 * All accounts and IPs that can be blocked, have been blocked, this is only awaiting clerk tagging now. -- DQ  (ʞlɐʇ)  03:24, 21 December 2012 (UTC)
 * I've tagged the named accounts and one IP. There's nothing else to be done here. Closing. Basa lisk  inspect damage⁄berate 11:12, 21 December 2012 (UTC)

26 December 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Please see Sockpuppet_investigations/Sonic2030/Archive for recent history on this sockmaster. Note that CheckUser made a connection between this set of socks and User:Marlin1975.

The most recent sock has re-emerged here: The IPv6 address appears to originate on a web server, thus is most likely a proxy.  Belch fire - TALK 23:35, 26 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The /32 from the webhost is already blocked so there's nothing left to do here.  Amalthea  14:14, 4 January 2013 (UTC)

08 January 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Yet another in a string of socks, easily ID'd by the brand new account making a beeline for one of my edits and throwing a recent edit summary back in my face, which is a consistent pattern of behavior going back several months.

For history on this case see: Sockpuppet_investigations/Sonic2030/Archive ►  Belch fire - TALK 18:20, 8 January 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I've blocked the sock. Closing. Reaper Eternal (talk) 04:24, 9 January 2013 (UTC)

10 January 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Another day, another sock. The giveaways are the total lack of self-control and the propensity to put "TALK" in all-caps.

Case history is here: ►  Belch fire - TALK  00:47, 10 January 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ match to, indeffed. Amalthea  10:37, 10 January 2013 (UTC)
 * Tagged and closed. Reaper Eternal (talk) 11:33, 10 January 2013 (UTC)

17 March 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
CU blocked. Could a clerk please merge this case with Sockpuppet investigations/Sonic2030? <b style="font-family:Calibri; font-size:14px; color:#4682B4;">Elockid</b>  ( Talk ) 18:53, 17 March 2013 (UTC)

21 April 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Long term edit warring on John Coleman (news weathercaster), just previous suspects. This diff matches with diff, as the 96.231 is one of the extension that is frequently used by him. One of his sock,, was also blocked for evading with this extension and the IP was 96.231.161.128.

Also check previous archive, 216.81.94 has been always his major extension.  Occult Zone  (Talk • Contributions • Log) 06:20, 21 April 2015 (UTC)


 * I have added PediaAcc. Who was blocked by, following this discussion.
 * Another special similarity between above IP addresses and Sonic2030 is, that they both use section title as edit summary, similar to the previous socks.  Occult Zone  (Talk • Contributions • Log) 15:26, 29 April 2015 (UTC)
 * Should we treat them as socks and semi-protect this article in question for a while?  Occult Zone  (Talk • Contributions • Log) 15:43, 29 April 2015 (UTC)
 * I asked it per WP:DENY, if answer is yes, then sure I can seek protection.  Occult Zone  (Talk • Contributions • Log) 00:45, 1 May 2015 (UTC)
 * Right after DoRD's comment (from 29 April) here, we can still see some activity from 216.81.81.80.  Occult Zone  (Talk • Contributions • Log) 09:42, 1 May 2015 (UTC)
 * I don't see any policy violation there. ​—DoRD (talk)​ 12:54, 1 May 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * PediaAcc was already confirmed and blocked days ago, as you noted above, and the IPs are stale for blocking purposes, so what are you asking for here, ? ​—DoRD (talk)​ 15:42, 29 April 2015 (UTC)
 * That depends on what you mean by treat them as socks. If you mean to stick IPsock tags on them, the answer is no. As for protection, RFPP is thataway. ​—DoRD (talk)​ 18:12, 30 April 2015 (UTC)
 * Closing the case.  Vanjagenije  (talk)  23:24, 30 April 2015 (UTC)

13 May 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

There's no doubt that it is Sonic2030, same same edits on John Coleman (news weathercaster), like previous socks, this IP looks so similar to  and who also edited this article..  Occult Zone  (Talk • Contributions • Log) 17:00, 13 May 2015 (UTC)


 * You removed my comment and restored sock. There is no consensus for those irrelevant edits, you were there to WP:WIKIHOUND. IPs don't need to be confirmed, they can be just dealt per WP:DENY since they have same characteristics like previous socks.  Occult Zone  (Talk • Contributions • Log) 21:37, 13 May 2015 (UTC)
 * You never edited this page ever before, you went there by my contribution history in order to favor a sock because that is your only aim. These IPs are socks, can confirm too, since he had blocked this IP on Coleman as a sock already.(block log) We don't connect IPs with the account but still act due to the same characteristics. Thus your claim "not confirmed" is frivolous.  Occult Zone  (Talk • Contributions • Log) 22:00, 13 May 2015 (UTC)
 * No? If you had any different aim, then why you misrepresented the actual event that the IP was blocked as a sock already? You claimed that it was never blocked.  Occult Zone  (Talk • Contributions • Log) 22:53, 13 May 2015 (UTC)


 * Article had been protected by JzG, because of sock puppetry.  Occult Zone  (Talk • Contributions • Log) 12:14, 19 May 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

The IP in question reverted edits by another IP. The "another" IP reverted my edits. The edits were agreed to on Talk:John Coleman (news weathercaster). Also, OcultZone, removing the talk page discussions because they are a "confirmed sock". and reverting edits made to the article because "rv sock of sonic2030" is not called for. It has not been confirmed. None of the other IPs you gave were blocked. OccultZone removed an edit agreed to on the talk page. Bgwhite (talk) 20:19, 13 May 2015 (UTC)
 * The page is on my watchlist as I've edited there very recently. You revert the edit to the article which I took responsibility for.  WP:DENY is an essay, it never says to revert socks. Again, an IP reverted my edit.  72.196.233.185 reverted the IPs.  It was not doing vandalism and restoring an edit agreed to on the talk page.  Bgwhite (talk) 21:52, 13 May 2015 (UTC)
 * Saying I'm wikihounding you and my only aim is to aid a sockpuppet is not AGF or being civil. I'm done.  Bgwhite (talk) 22:42, 13 May 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * No edits from this IP in over a week, so it is for blocking purposes. Closing. ​—DoRD (talk)​ 13:13, 19 May 2015 (UTC)