Wikipedia:Sockpuppet investigations/Spectre7277/Archive

Report date January 25 2009, 02:18 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by tedder (talk)

New user Nugglesmom (1) has the same MO as Spectre7277: cut and pastes talk page replies to several user talk pages and Talk:Jimmy Hoffa, (2) singular obsession with specific information in one Wikipedia page, and (3) posted some entries under an IP address, then signed in and edited that entry.

While not being signed in is understandable, the two IPs are from the same region of the USA on the same ISP. 71.227.51.60 is clearly linked to Sprectre7277, and 68.42.89.19 is clearly linked to Nugglesmom. This may be a simple case of meatpuppeting, or it may be a true sockpuppet trying to further a fringe theory or advert.

The main evidence, besides the geographically linked IP addresses, is the similar editing MO. tedder (talk) 02:18, 25 January 2009 (UTC)

Added User:Medusashield, who MAY be related, based on page vandalism. tedder (talk) 01:38, 27 January 2009 (UTC)


 * Comments by accused parties:  I'm not a sock puppet.  I don't know who the other party is, I believe I made an apology on the discussion board in question.--Spectre7277 (talk) 17:25, 26 January 2009 (UTC)


 * Comments by other users


 * See also - Wikipedia_talk:WikiProject_Spam (permanent link) --Hu12 (talk) 20:25, 26 January 2009 (UTC)
 * Recent vandalism on investigation related pages By seems to indicate he/she has created the vandalism only Sock account  to attack tedder contribs.
 * 01:19, 27 January 2009
 * 01:19, 27 January 2009
 * 01:18, 27 January 2009
 * 01:17, 27 January 2009
 * 01:15, 27 January 2009
 * --Hu12 (talk) 19:05, 27 January 2009 (UTC)


 * Both IP addresses are Comcast Cable IPs from Taylor, Michigan according to WHOIS. Foxy Loxy  Pounce! 11:09, 14 February 2009 (UTC)


 * Clerk, patrolling admin and checkuser comments
 * Given the evidence, I cannot conclusively show that Spectre7277 is Nugglesmom. We can establish the two IPs belong to Spectre7277, and Nugglesmom respectively. If there is more evidence that these two users are the same, please provide it. Failing that I'm going to request close of this case in a few days. ——  nix eagle email me 13:49, 11 February 2009 (UTC)
 * Can you find a link between and either of those users? tedder (talk) 15:59, 11 February 2009 (UTC)
 * Do you think there is one? If so show me diffs and edits supporting that conclusion in the evidence section. ——  nix eagle email me 17:12, 16 February 2009 (UTC)


 * I don't see the behavior relationship between both users (there's no article overlap). Am I missing something? -- lucasbfr  talk 10:24, 17 February 2009 (UTC)


 * The aggressive vandalism from Medusashield occurred around 18:30 on 26 Jan 2009. This is in the same time period as edits from Spectre7277. That's a very circumstantial connection, admittedly, but the edits from Medusashield were obviously centered around my recent Wiki edits, while Spectre7277's edits from 10 minutes earlier were based around blanking this sockpuppet investigation page. tedder (talk) 19:34, 17 February 2009 (UTC)
 * As you acknowledge, this is looking a bit tenuous. The main plank of the argument that they are socks is a certain common purpose is attacking your edits. There is also the comment from Spectre on his talk page which almost seems like a pre-emptive denial of socking (knowing that he will be accused of it). It seems likely to me that there has been socking going on (or possibly there will be), but there just isn't enough evidence at present to show that these particular accounts are the socks. Unless there is any further evidence, I would suggest closing, without prejudice to re-opening if anything further happens. Mayalld (talk) 22:16, 17 February 2009 (UTC)
 * Thanks- and I'm fine with closing/having it closed. tedder (talk) 23:38, 17 February 2009 (UTC)

for the reasons already stated. Mayalld (talk) 08:39, 18 February 2009 (UTC) Mayalld (talk) 08:39, 18 February 2009 (UTC)
 * Conclusions

Evidence submitted by Tedder
Attempt to circumvent ban of sockmaster. New SPA-style editor with a 3RR-level interest in the sockmaster's book (1 2 3 4), which looks really similar to the sockmaster's interest in the book (1 2 3 4 5).

Checkuser may or may not be necessary, but bagging and tagging is necessary. tedder (talk) 22:08, 25 October 2009 (UTC)


 * (edit) Looks like some shopping is going on: 1 2. tedder (talk) 22:09, 25 October 2009 (UTC)


 * Added 71.227.48.151, who was also active today on my page, and has been active in the past 2-6 weeks elsewhere. Note User:Jpgordon already blocked Theboss1970, so this case is probably over anyhow. tedder (talk) 02:34, 26 October 2009 (UTC)


 * (final edit, pasting in some detective work). Other past editors that are interesting, not for CHU but for archiving with this case: (suspected sock),  (fairly obvious sock, never tagged/bagged). tedder (talk) 02:44, 26 October 2009 (UTC)

Comments by accused parties
See Defending yourself against claims.

CheckUser requests
Requested by tedder (talk) 22:08, 25 October 2009 (UTC)


 * . NW ( Talk ) 00:53, 26 October 2009 (UTC)


 * FWIW, before this is closed and archived, some minor MO work and tagging/bagging need to be done. User:jpgordon did the CHU, but not the content part. tedder (talk) 05:10, 26 October 2009 (UTC)

Clerk, patrolling admin and checkuser comments
✅ I disposed of this before I saw this report; the abuse was obvious, so I checked to see if Spectre7277 would come clean; he didn't, so I blocked him for a week and the sock indef. No comment necessary on the IP. --jpgordon:==( o ) 03:52, 26 October 2009 (UTC)