Wikipedia:Sockpuppet investigations/Taharqa/Archive

Report date April 6 2009, 04:34 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by Soupforone (talk)

I suspect that the user above has been using sockpuppet accounts to revert edits he does not agree with, and in doing so, manage to avoid breaching WP:3RR. On the Arab Slave Trade article, the Taharqa account performed between 17:55, 5 April 2009 and 19:32, 5 April 2009 a series of edits which removed reliable sources from the article. This series of edits, which were all performed to one section of the rather large article titled 'Arab views on black people', were capped off by one lone edit by an anonymous IP less than 30 minutes later to the exact same section of the article. I've checked the IP's contributions, and he appears to have edited a number of the exact same articles (and sections of articles at that) as User:Taharqa, and often-times only minutes after the latter's own edits. For example, on the Musa (mansa) article, the 24.5.197.91 IP in question edited a section of the article which the Taharqa account then followed up on only about 20 minutes later. In fact, Taharqa even admits in this edit summary that the 24.5.197.91 IP was him ("sorry. that was me (forgot to log in)"). The above would perhaps seem harmless enough were it not for the fact that another very similar IP (24.7.71.73) on the Arab Slave Trade article reverted my restoration of the sources User:Taharqa had removed, and did so only minutes after I had finished editing. This 24.7.71.73 IP's contributions also indicate that this lone revert is his/her only edit. I therefore again restored the sources that the IP this time had removed (i.e. he/she reverted back to User:Taharqa's version of the article), and told the IP in my edit summary that I was confident that he was Taharqa. However, I was promptly reverted by the User:Sunjata321 account, an account which hadn't been used since February 21st of this year, which incidentally was also the same day that that account was created. In his edit summary, the User:Sunjata321 account also claimed responsibility for the one-off 24.7.71.73 IP, a move rather reminiscent of User:Taharqa's aforementioned owing up to being IP 24.5.197.91 on the Musa (mansa) article. So that's basically the situation. I also just noticed as I was formulating this paragraph that User:Taharqa apparently already had a sockpuppet case opened against him. It seems that many of the same concerns regarding his edits were raised as far back as two years ago. I am therefore requesting a Checkuser if possible. Soupforone (talk) 04:34, 6 April 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by Soupforone (talk) 04:34, 6 April 2009 (UTC)
 * CheckUser requests

No convincing argument for a CU for "other" reasons (code F), and I can find no potential WP:3RR violation here. Mayalld (talk) 13:48, 6 April 2009 (UTC)


 * Clerk, patrolling admin and checkuser comments
 * Soupforone, you chose F, meaning other reason. To do a checkuser we need a reason as to why it would be warranted, for example; are there any reasons why this case would not pass the duck test? Foxy Loxy  Pounce! 12:38, 6 April 2009 (UTC)
 * Hey Foxy Loxy. I'm not sure what you mean. Do you mean that this case is so obvious that it doesn't really require a CheckUser? If so, what do you think I should do? Will an administrator deal with it directly or something else maybe? I'm not sure how this works; please advise. But if I have to provide a reason, I think it's a pretty obvious attempt to skirt WP:3RR by using multiple accounts to revert the same edits over the same space of time. Soupforone (talk) 13:24, 6 April 2009 (UTC)
 * Foxy logged off about an hour ago, but broadly speaking, CU will not be authorised if there is obvious socking going on that doesn't need CU to confirm. If the socking is less than blindingly obvious and falls into one of the coded reasons, you need to supply evidence (so if it is 3RR using socks, we need diffs). Code F (some other reason) is much abused and you need a very convincing explanation to get CU under code F. Mayalld (talk) 13:30, 6 April 2009 (UTC)
 * Thanks for the rapid response. I guess then, looking at the letter codes, that perhaps letter D is the best option here. But in all honesty, I think the "obvious, disruptive sock puppet" option strikes me as the most fitting, especially considering that there was already apparently another case opened on this user before. Soupforone (talk) 13:40, 6 April 2009 (UTC)
 * The prior cases didn't conclude with confirmed socking, and generally there needs to be policy violations aside from editing while logged out or using an alternate account. In this case you've mentioned edit-warring, but from the contribs of the suspected socks you've listed that might not even garner a block. Avruch  T 13:46, 6 April 2009 (UTC)
 * Perhaps I didn't present the situation above clearly enough, but what basically happened was that three separate accounts (User:Taharqa, the 24.7.71.73 IP, and User:Sunjata321) reverted me within minutes of each other. Two of those accounts, the IP and User:Sunjata321, were essentially newbies that came literally out of nowhere, as their user contributions show. Noticing the IP (and another one a couple of edits before it using the same range), I accused User:Taharqa of using IPs to skirt 3RR. But User:Taharqa did not deny this or claim to be this reverting IP on the Arab Slave Trade article. In fact, he didn't respond at all. Instead, that's when the one-off User:Sunjata321 showed up and in his edit summary claimed responsibility for the IP; very similar to how User:Taharqa claimed responsibility for an anonymous IP days ago on another page (please follow the links above for the edits and pages in question). Soupforone (talk) 14:03, 6 April 2009 (UTC)


 * Conclusions
 * User:24.5.197.91 == User:Taharqa. (User admits here and here).
 * User:24.7.71.73 == User:Sunjata321 (User admits)

The question is does User:Sunjata321 == User:Taharqa. I can answer this by looking at three things.
 * 1) First the fact that this edit sequence exists gives reason for suspicion: User:24.7.71.73 revert, User:Taharqa revert, and finally User:Sunjata321 revert (and claim of the User:24.7.71.73 revert).
 * 2) Second, whois data points to the same ISP (comcast, a large ISP).
 * 3) Third, traceroute on 24.7.71.73 and 24.5.197.91 put through to the same destination, putting the location of the two IPs in the same area. (Both go to te-9-2-ur03.pinole.ca.sfba.comcast.net (68.87.192.94)).
 * So... based on the above evidence, I can confidently say User:Sunjata321 likely User:Taharqa. ——  nix eagle email me 19:20, 8 April 2009 (UTC)

I have to go to class, so if another admin wishes to review and do the appropriate blocks, I would appreciate it. Thanks ——  nix eagle email me 19:20, 8 April 2009 (UTC)

I think we can say conclusively that =  =  =. That said both IPs are no longer active, making a block punitive as there is a possibility they have changed owners since then. As such I have only blocked and left a note with  that they may only operate one account. Any further socking should be reported here, and appropriate action will be taken. Tiptoety talk 23:15, 15 April 2009 (UTC)