Wikipedia:Sockpuppet investigations/TheMetallican/Archive

10 June 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Soon after User:TheMetallican was blocked for two weeks due to constant changing of genres on music articles, the account User:Musicstuff0324 created an account, and began changing genres on some of the same pages. See, for example, this edit by TheMetallican and compare it to this one by Musicstuff0324. Also, I've recently been contacted by Musicstuff0324, saying "im sorry to be a constant bother" as if I know this user from somewhere. (I reverted some of TheMetallican's edits before, so I'm guessing this is what they're referring to.) Thank you for your time. Friginator (talk) 18:11, 10 June 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ❌. AGK  [•] 22:26, 12 June 2012 (UTC)
 * Closing investigation AGK  [•] 21:28, 13 June 2012 (UTC)

13 September 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

BEATWEAKer was recently blocked for genre warring across music articles. I made a good-faith effort to help him get on the right track, but it didn't work out. The IPs above just showed up and are making very similar edits to BEATWEAKer, in the same families of articles (mainly those related to the bands Bullet for My Valentine, Blink-182, Green Day, The Exploited, Twisted Sister, Bauhaus, Siouxie and the Banshees, and Avenged Sevenfold). The similarity of the edits, and the crossover in the artists, gives me a very strong suspicion that this is BEATWEAKer editing anonymously. At the very least the 2 IPs appear to be the same person: compare these edits ...in the latter 2601:A:4100:5A:D5C8:ACEC:6C6A:6F98 says "Like I said just ignore it", referring to the previous edit by 69.255.233.231 who said "the ones who disagree just ignore". Pretty clearly the same person. IllaZilla (talk) 21:07, 13 September 2012 (UTC)

Update: I have added a couple more IPs and the new account. There is so much overlap in the articles edited, and so much similarity between the edits, that I strongly believe them to all be the same person. --IllaZilla (talk) 15:04, 19 September 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I have no idea who Beatweaker is. Some people have shiyloads in common. You're the one who always reverts edits without consensus including with sourced ones and then you think I'm that guy? I found these sources to prove these things under something. — Preceding unsigned comment added by 69.255.233.231 (talk) 22:18, 14 September 2012 (UTC)

The IP address looks similar to another banned user,. Though BEATWEAKer seems to be editing bands of a slightly different genre, their MO seems to be pretty similar. Might be worth looking into. See Sockpuppet investigations/Gunmetal Angel/Archive. —Fezmar9 (talk) 23:06, 14 September 2012 (UTC) Actually, I take that back. Another IP, whose edits more closely resemble those of Gunmetal Angel, is currently making his rounds. It's unlikely these two are related. Fezmar9 (talk) 00:06, 15 September 2012 (UTC)

I feel it's safe to say that I know BEATWEAKer and TruSkoolHooligan are the same person, or, if not, meatpuppets. Per WP:OUTING I'm not going to saw how I know this, but I can pretty much guarantee that any Checkuser search will agree with me there. Cross-referencing their contributions pages gives us two bands whose articles they've edited: Five Finger Death Punch and My Chemical Romance. Looking at the contributions for the anons you listed, not one of them has edited articles for both of those bands. Friginator (talk) 22:42, 19 September 2012 (UTC)


 * Yeah, but when you compare them all there is a lot of overlap. Like BEATWEAKer was editing articles related to bands A, B, and C. He gets blocked, and a day or so later the first IP pops up making the exact same kind of edits to band C, then moves on to band D. The next day, a new IP picks up with the same type of edits to band D and then moving on to E and F, and so forth. Example: Bittersweet Memories and Bauhaus (band) both have overlap from BEATWEAKer, 69.255.233.231, and 2601:A:4100:5A:D5C8:ACEC:6C6A:6F98. Avenged Sevenfold has overlap from BEATWEAKer, 69.255.233.231, and 2601:A:4100:5A:EC7A:ECA5:15F6:C925. And Chelsea Grin (band) has overlap from 2601:A:4100:5A:EC7A:ECA5:15F6:C925 and TruSkoolHooligan. When you take all the editing history into consideration there is so much crossover between these 2 accounts and 4 IPs that it becomes pretty obvious they're the same person. Even more so when you start looking at the content of the edits, which are all of the same nature: nearly all are changes to the "genre" field of the infobox, sometimes with no explanation at all, other times adding sources and they're all adding the same sources in the same format. If they're not all the same person, it's a pretty remarkable coincidence. --IllaZilla (talk) 23:05, 19 September 2012 (UTC)
 * I don't see any reason to think that is. And here's why: look at this chart I made, of the edits made to 8 of the different bands, their albums and songs:

Keep in mind that TruSkoolHooligan is definitely a sockpuppet. I happen to know that, but can't say how per WP:OUTING. But doesn't overlap once. So I'm doubting their involvement in this. And look at some of the pages the user has edited. List of Oh My Goddess! soundtracks? U.S. Consulate attack in Benghazi? I think that one is someone else. Friginator (talk) 23:33, 19 September 2012 (UTC)


 * Well some of those edits are from 2006, and it is an IP address, so probably it was another person making the edits (same for the consulate attack article). But when you look at pretty much all the edit from Sept. 17 and 18 it has BEATWEAKer written all over it. The 69.255.233.231 IP has tons of overlap with BEATWEAKer, and 69.225.139.31 overlaps 69.255.233.231 on Deathcore and Emmure. He now also overlaps TruSkoolHooligan and 2601:A:4100:5A:EC7A:ECA5:15F6:C925 on Chelsea Grin (band). The edits are similar and mostly to bands of the same small group of genres. With IP addresses it's often hard to tell, because anyone could be sitting behind the computer. If BEATWEAKer edited from the 69.225.139.31 address on the 17th and 18th, for example, and it was a public computer, someone else may be using that computer today and editing an entirely different set of articles. And a checkuser would be of no help unless either of the accounts were created from that same IP address. That's often why IP addresses don't get blocked; to prevent collateral damage. I'm interested to see what a checkuser turns up. --IllaZilla (talk) 03:51, 20 September 2012 (UTC)


 * In any case, 69.225.139.31 ought to be chastised for this edit summary. --IllaZilla (talk) 04:17, 20 September 2012 (UTC)


 * I've added to the pile, as they seem suspect too. Still having my doubts about \, though I'll leave a clear message on their talk page concerning their comments. Here's a new, improved chart:


 * I made 2 changes to the chart: 69.225.139.31 has edited Chelsea Grin (band). I also added Deathcore to the chart to show overlap between two of the IPs. --IllaZilla (talk) 23:28, 20 September 2012 (UTC)
 * CheckUser confirmed that and  are both sockpuppet accounts of, so I've combined the edits of all three of those users, since we know they're the same person. I've also added Twisted Sister and AFI to the chart. Friginator (talk) 17:32, 21 September 2012 (UTC)
 * TheMetallican, eh? The plot thickens... --IllaZilla (talk) 17:46, 21 September 2012 (UTC)
 * I'd also watch for IPs such as, , , and . I don't see enough to add them on the chart, but you can't be too careful. Friginator (talk) 18:06, 21 September 2012 (UTC)

21 September 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

On June 25, was blocked for the constant disruptive editing of genres on music-related articles. On September 2, more than 2 moths later, created an account, and began making the exact same types of edits to the exact same articles. Then, when that account was blocked (albeit temporarily), the account was created. I happen to know (I'm just going to be safe and not say how) that BEATWEAKer and TruSkoolHooligan are the same person. Per WP:OUTING I'm not really sure how to argue that, though. One clear diff in this unsourced, non-constructive edit to the page My Chemical Romance: As edited by TheMetallican and as edited by BEATWEAKer. They all tend to edit articles by specific bands like The Exploited, Five Finger Death Punch, My Chemical Romance and Twisted Sister. Friginator (talk) 00:24, 21 September 2012 (UTC)

Here's a chart showing six of the different bands (and various articles related to those bands) that the accounts have edited, showing where they overlap through diffs:

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

There's also a separate SPI going on at Sockpuppet investigations/BEATWEAKer. Jafeluv (talk) 06:53, 21 September 2012 (UTC)

So are either sockpuppets (BEATWEAKer and TruSkoolHooligan) going to be blocked or listed as sockpuppets. TheMetallican stopped editing through TruSkoolHooligan, but BEATWEAKer was only blocked temporarily, and that block expires in a few hours, if I'm not mistaken. — Preceding unsigned comment added by Friginator (talk • contribs) 18:11, 22 September 2012‎ (UTC)

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  18:42, 22 September 2012 (UTC) — Berean Hunter   (talk)  12:52, 23 September 2012 (UTC)
 * ✅ ​—DoRD (talk)​ 12:26, 21 September 2012 (UTC)
 * The above also applies to Sockpuppet investigations/BEATWEAKer, which will need to be merged here. ​—DoRD (talk)​ 12:26, 21 September 2012 (UTC)
 * Case BEATWEAKer merged to TheMetallican.
 * Indeffing socks with tags and closing.

23 September 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

I have identified 3 more IPs that are User:TheMetallican editing against his indef block. User:TruSkoolHooligan was recently confirmed as one of TheMetallican's socks (see previous report, dated 21 September 2012). TruSkoolHooligan is also active at Commons, where today he uploaded File:The-exploited band.jpg (currently marked for deletion as copyvio). 2 minutes later, the IP 2601:A:4100:5A:CC3E:6E3C:D8D5:BCB3 added said image to Wikipedia. This makes it quite clear, IMO, that 2601:A:4100:5A:CC3E:6E3C:D8D5:BCB3 is TruSkoolHooligan aka TheMetallican. At 1:38 this morning this IP stopped editing, but 2 new IPs have popped up making the exact same edits. Compare these edits:
 * 2601:A:4100:5A:CC3E:6E3C:D8D5:BCB3: Five Finger Death Punch, American Football The Exploited, Skullhead, I Feel Nothing
 * 2601:A:4100:5A:4445:410A:767C:837F: Five Finger Death Punch, American Football, The Exploited, Skullhead, I Feel Nothing
 * 2601:A:4100:5A:7E61:93FF:FE8F:B688: Five Finger Death Punch, American Football, Skullhead

If you cross-reference with TheMetallican and his sockpuppets BEATWEAKer and TruSkoolHooligan, you'll see that these IPs are editing the exact same articles as TheMetallican, making the exact same edits. To whit: Five Finger Death Punch and The Exploited. I'm sure a user compare report will provide much more evidence.

Also, the copyvio image that was added by these IPs to Skullhead was uploaded to Commons by a newly registered user, CaptainSpaulding1978. TheMetallican's sockpuppets and  have both been active at Commons, where they repeatedly upload copyrighted photos of bands that they then add to Wikipedia under the aforementioned IPs. These images are continually marked as copyvio and deleted, but they just keep on uploading them. If is very obvious to me that CaptainSpaulding1978 is a new sockpuppet of the TheMetallican that he is using on Commons. It also seems obvious that TheMetallican is not going to stop editing Wikipedia, despite being indef-blocked. He just keeps coming back anonymously under ever-changing IPs (see the list IPs named in the previous report as well). So what is to be done? Do we have to resort to a rangeblock in order to stop this guy (the IPv6 addresses all come from the same range: 2601:A:4100:5A:xxxx:xxxx:xxxx:xxx)? And how do we handle his Commons accounts? IllaZilla (talk) 18:34, 23 September 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

That means we're dealing with edits by:



So yeah, a rangeblock would DEFINITELY be warranted in my opinion. If not, how else is the problem going to be solved? It doesn't take a genius to realize these are all the same person. Friginator (talk) 22:20, 23 September 2012 (UTC)

And here's another chart:

Since I posted this chart, a new sock, has started edit warring on one of TheMetallican's favorite pages. Adding the user to the chart.. Friginator (talk) 23:57, 23 September 2012 (UTC)


 * Man, I'm glad you & I seem to be on top of this guy. He's been evading his block for 3 months, giving WP the runaround with socks & dynamic IP addresses. In situations like these I used to run the IPs through a locator website to see if they all traced to the same origin, but with these new IPv6 addresses I don't know how it works. I haven't found a site that can track them. --IllaZilla (talk) 05:38, 24 September 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  12:53, 24 September 2012 (UTC) — Berean Hunter   (talk)  14:45, 24 September 2012 (UTC)
 * I've rangeblocked 2601:A:4100:0:0:0:0:0/46 for 3 months to curtail him. The Commons accounts pointed out by IllaZilla on my talk page are also now blocked. If he pops back up please refile and we will see what we can do.
 * Post note: Block was modified to a /64

24 September 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

I'm not going to go into all the details. A user compare report should show the obvious: Same exact articles and edits as all the previous sockpuppets and IPs of TheMetallican. His IPv6 range was just rangeblocked, so he's back to standard IP addresses. Based on his history my guess is he edits from 2 locations (either home/work or home/school), one of which uses IPv6 and one of which uses standard IPs. Based on the rangeblock applied yesterday I recommend a block of at least the 69.255.233.231 address, which has popped up in all the previous SPIs and seems to be his static IP address. IllaZilla (talk) 20:44, 24 September 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  21:26, 24 September 2012 (UTC)
 * Blocking 3 months..

27 September 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

This one was brought to my attention by Danteferno on my talk page (see here). One of TheMetallican's IP sockpuppets made an intrusive edit to the Bay Area thrash metal page and shortly thereafer, an autoconfirm, (User:FunnyPatrol99), is persistently trying to sustain the same edit,. I've come to know TheMetallican and his various sockpuppets' behavior patterns quite well over the last couple of weeks, and FunnyPatrol99's are definitely of the same flavor, and on the same families of articles (ie. Five Finger Death Punch and Metalcore). I also find it not coincidental that FunnyPatrol99 began editing on September 25, the day after we rangeblocked TheMetallican's IPs (see the most recent archived investigations). The timing, combined with the near-identical topic areas and edit content, is very suspicious. TheMetallican, through his various socks, was also fond of uploading non-free content to Commons under false licenses, and I note that FunnyPatrol99 has also registered at Commons. IllaZilla (talk) 23:30, 27 September 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I just went ahead and requested CheckUser on this. I'd be surprised if it wasn't the same guy, knowing his history of editing in this exact manner. Friginator (talk) 23:59, 27 September 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * so I blocked them. It may be best to check for sleepers. -- Guerillero &#124;  My Talk  01:07, 28 September 2012 (UTC)
 * ✅, but since many of the edits are coming from a mobile phone range, detecting sleepers is problematic, at best. ​—DoRD (talk)​ 02:26, 28 September 2012 (UTC)
 * Tags applied, marking for close. Jafeluv (talk) 06:51, 28 September 2012 (UTC)

29 September 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Just recently, Five Finger Death Punch, Korn and Waking the Demon, all previous targets of TheMetallican and his sockpuppet accounts, were edited by this IP. And look at this edit by one of the Metallican's socks. Then look at this edit by 174.255.17.35. Quack quack quack. Friginator (talk) 21:20, 29 September 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * I concur with Friginator. Geez, does this guy never quit? The irony is that some of his edits would actually be acceptable improvements if not done in violation of a block. --IllaZilla (talk) 22:41, 29 September 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked per WP:DUCK. Jafeluv (talk) 09:48, 30 September 2012 (UTC)

04 October 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Unfortunately, it looks like he's at it again. Two pages frequently edited by TheMetallican and/or his sockpuppets, Waking the Demon and Korn. It should be noted that the user frequently talks about the genre Nu-Metal, uses the phrase "ain't", and has through various confirmed sock accounts made the same edit to the article for the band Korn several times now. here is the most recent edit by 174.252.119.40.


 * Here is the same edit made by the confirmed sock account FunnyPatrol99.


 * Here is the same edit made by the IP 174.255.17.35, an IP that is currently blocked because of its use by TheMetallican.


 * Here is an edit made by TheMetallican himself, going to great lengths to describe the band as "Nu-Metal," writing an entire paragraph about it.

As for the article Waking the Demon, just looking at the edit history you can see that he's tried at least half a dozen IPs on to make the same edit, shown here and here. This is the edit that 174.252.119.40 just made. Friginator (talk) 01:15, 4 October 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  01:42, 4 October 2012 (UTC)
 * Blocking IP one week and added protection on his targets to deter him.

20 October 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Looks like he's back with some new sock accounts. At this point, it's easy to identify the guy from his edits. Bands like Five Finger Death Punch, Bullet for My Valentine, etc. All non-constructive genre-warring. Though he's edited through so many IPs, it may be hard to do a Checkuser on him. Still, it looks like a duck. Friginator (talk) 20:41, 20 October 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I concur with Friginator's assessment: the articles and types of edits are all consistent with TheMetallican's activity, and these are all new accounts since his latest block which adds to the level of suspicion. A checkuser is warranted due to the high level of socking TheMetallican has done lately. I would not be surprised if a CU turned up even more than these 3. --IllaZilla (talk) 22:42, 20 October 2012 (UTC)


 * I do not who TheMetallican is at all. Neither those above users. Now really, if you learn that edits aren't always supposed to identify one. Now first, I only edit for core bands and modern rock. But what does he edit anyway? I don't care for editing FFDP. Looking at the comments here. So here's the deal, try letting me resume on editing and report if you see similar pages used. I may edit sold core bands mostly like post hardcore metalcore and more. I have seen many people label BFMV as melodic metalcore. Although they have it contributed by many users. But you can't declare someone guilty by like 12 edits on like 5 pages. So learn to be a better juror --Barmy1981 (talk) 18:31, 21 October 2012‎ (UTC)


 * Comment TheMetallican has come back here and here with an open admission of socking, but doesn't name any of the socks. --IllaZilla (talk) 23:09, 22 October 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  22:52, 22 October 2012 (UTC) — Berean Hunter   (talk)  23:05, 22 October 2012 (UTC) — Berean Hunter   (talk)  23:33, 22 October 2012 (UTC) — Berean Hunter   (talk)  13:51, 23 October 2012 (UTC) — Berean Hunter   (talk)  14:20, 25 October 2012 (UTC)
 * I know from mast time that checking for sleepers is hard in this case. It might still be best to confirm the behavioral evidence -- Guerillero &#124;  My Talk  03:44, 22 October 2012 (UTC)
 * to check for sleepers as he appears to be socking rampantly. Adding which I have already blocked today.
 * 2 more - and.
 * Hardblocked 2600:1003:B024:1D00::/64 range.
 * The following accounts are a ✅ match:
 * I also checked and, but the results are . As DoRD said earlier, detecting sleepers is problematic, in this case; and, since I preferred to err on the side of caution, I might have missed some of his socks...  Salvio  Let's talk about it! 13:39, 23 October 2012 (UTC)
 * Blocked and tagged all of the conclusive socks.
 * I also checked and, but the results are . As DoRD said earlier, detecting sleepers is problematic, in this case; and, since I preferred to err on the side of caution, I might have missed some of his socks...  Salvio  Let's talk about it! 13:39, 23 October 2012 (UTC)
 * Blocked and tagged all of the conclusive socks.
 * I also checked and, but the results are . As DoRD said earlier, detecting sleepers is problematic, in this case; and, since I preferred to err on the side of caution, I might have missed some of his socks...  Salvio  Let's talk about it! 13:39, 23 October 2012 (UTC)
 * Blocked and tagged all of the conclusive socks.
 * I also checked and, but the results are . As DoRD said earlier, detecting sleepers is problematic, in this case; and, since I preferred to err on the side of caution, I might have missed some of his socks...  Salvio  Let's talk about it! 13:39, 23 October 2012 (UTC)
 * Blocked and tagged all of the conclusive socks.
 * I also checked and, but the results are . As DoRD said earlier, detecting sleepers is problematic, in this case; and, since I preferred to err on the side of caution, I might have missed some of his socks...  Salvio  Let's talk about it! 13:39, 23 October 2012 (UTC)
 * Blocked and tagged all of the conclusive socks.
 * Blocked and tagged all of the conclusive socks.
 * Nothing else to do at this time so closing.

09 December 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

This list doesn't even include the 20-plus accounts and IPs he's already been blocked from. Same behavior as the last few times. I'd appreciate it if a rangeblock were considered. Friginator (talk) 00:01, 9 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I concur with Friginator; these need to be checked out. He & I have reported enough of TheMetallican's socks to recognize his behavior pretty straight-off: genre warring in particular genre areas like metalcore and deathcore, with a handful of pet articles like Five Finger Death Punch. Looking at the contribs of these accounts, they're all of that flavor, and given TheMetallican's long history of socking I'd say a checkuser is definitely in order, and rangeblocks to stop the many IPs. --IllaZilla (talk) 01:47, 9 December 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Blocking these IPs would be useless, they are wireless. You can get a new IP in less than one minute.  Page protection at WP:RFPP is the only answer for those.  Still reviewing named accounts. Dennis Brown -  2&cent;    &copy;   Join WER 23:04, 9 December 2012 (UTC)
 * Certain specifics of behavior are a dead ringer for the named accounts. Blocked, tagged and templated.  Closing. Dennis Brown -  2&cent;    &copy;   Join WER 23:09, 9 December 2012 (UTC)

15 December 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

The behavior is so repetetive it's getting fairly easy to spot socks at this point. I believe this is the case with these guys. But look at this edit by one of the previous socks next to this one by 197666 years, for example. And User:197666 years edited the "Indie and Emo" section of this page, something that two other sockpuppets of User:TheMetallican have done. That's a pretty big coincidence, especially considering Plus, both user accounts listed were created around same time that the previous socks were being discovered and blocked. As for the IPs, if you look at the previous adresses he's used, you'll notice they're in about the same range and have edited the same sorts of articles. Friginator (talk) 22:04, 15 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * The first five IPv6 addresses appear to be mobile IPs. The last four can only be covered by 2602:306:CF31:9890::/64, 2602:306:32E2:820:81E8::/64, and 2602:306:245E:22C9::/64 - these are all AT&T and so a /32 is out of question - I see too many IPv6 addresses in that /32 making good edits for that to be considered. The two IPv4 addresses by 69.225.136.0/22, but again there's potential for collateral damage. While CheckUser can't connect those IP addresses with the accounts, it can verify whether rangeblocks are feasible (esp. for IPv4).--Jasper Deng (talk) 22:17, 15 December 2012 (UTC)
 * I concur with Friginator's assessment. This guy is pretty easy to spot by his activity. It's pretty clear at this point that he's not going to stop socking or editing anonymously. We can certainly block the accounts, but the IPs keep coming from so many places there's not a whole lot we can do about that. --IllaZilla (talk) 22:30, 15 December 2012 (UTC)
 * Can we tailor semi-protections to make his disruption more difficult? I am not sure how many pages he effects -- Guerillero &#124;  My Talk  22:39, 15 December 2012 (UTC)
 * Honestly, unless we can semi-protect music-related article that names a genre ending in "--core", I don't see that as an option. The M.O. of this guy is (for the most part) going around and messing with any music article that falls under the subcategory of "deathcore" or "metalcore" or "grindcore" or "hardcore" or "post-hardcore" or "thrashcore" or "spamcore" or "post-spamcore" or whatever ends in "core." It's really bizarre and stupid. Friginator (talk) 22:50, 15 December 2012 (UTC)
 * The next option possible is an edit filter, if his pattern is very well-defined.--Jasper Deng (talk) 22:51, 15 December 2012 (UTC)
 * There are maybe a handful of "pet articles" that we could protect (Five Finger Death Punch and Deathcore come to mind) but Friginator's right: though this guy's edits are patterned enough to be recognizable, they jump around to so many articles at random that protecting a few probably won't curb the behavior. --IllaZilla (talk) 22:59, 15 December 2012 (UTC)
 * ✅ -- Guerillero &#124;  My Talk  23:08, 15 December 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ 197666 years with TheMetallican and several of his socks. Ptvpro was, now blocked. Heartcrusher is ❌, other side of the globe. I'm also not sure all the IP address you have listed here belong to your friend, but that's just my opinion. -- DQ  (ʞlɐʇ)  23:02, 15 December 2012 (UTC)
 * We'll see if protection works. Aside from that, there's not much left to do here. Closing. ( X! ·  talk )  · @022  · 23:31, 15 December 2012 (UTC)

25 February 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Similar style of username (lots of gibberish), [en.wikipedia.org/w/index.php?title=Tennessee_Williams&diff=prev&oldid=540138007 first edit] already vandalism. Not really that much evidence, but it seems clear to me.  TheStickMan [✆Talk] 01:13, 25 February 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * This is not an account, but an IPv6 address, which this sockpuppeteer is known to hop around with. I also don't see a very strong behavior linkage (also, this one is AT&T while I believe he's been using Comcast addresses).--Jasper Deng (talk) 01:13, 25 February 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Nothing interesting here, just an IPv6 vandal. Someguy1221 (talk) 01:17, 25 February 2013 (UTC)

02 May 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Obsessively changes genres, has poor grammar skills, cites numerous unreliable sources and leaves angry hidden notes just like Metallican and his socks.

Here's some evidence of him and his socks editing the same articles in the same manner - I call the big one bitey (talk) 23:27, 2 May 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - - Adding checkuser request per the evidence provided. Also note the extreme overlap in articles edited. TheMetallican is not stale because he recently posted a load of garbage to his talk page. Reaper Eternal (talk) 13:07, 3 May 2013 (UTC)
 * ✅ along with:
 * ​—DoRD (talk)​ 13:37, 3 May 2013 (UTC)
 * ​—DoRD (talk)​ 13:37, 3 May 2013 (UTC)
 * ​—DoRD (talk)​ 13:37, 3 May 2013 (UTC)
 * ​—DoRD (talk)​ 13:37, 3 May 2013 (UTC)


 * I've blocked all the sockpuppets. Closing. Reaper Eternal (talk) 13:48, 3 May 2013 (UTC)

04 May 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

All these accounts have popped up changing genres one day after Metallican's previous sock got blocked, all editing the exact same articles as before. The IP's are also in the same range as Metallicans' previous IP socks. I call the big one bitey (talk) 22:47, 4 May 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Definitely looks like it to me. Friginator (talk) 16:40, 5 May 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Looks pretty obvious to me. Sleeper check worth doing considering we found a few last time. Steven   Zhang  Help resolve disputes! 09:06, 6 May 2013 (UTC)
 * ✅ plus . . ​—DoRD (talk)​ 11:55, 6 May 2013 (UTC)
 * I've blocked the sockpuppet accounts. As for the IP ranges, they are way too dynamic to block. Closing. Reaper Eternal (talk) 12:14, 6 May 2013 (UTC)

10 May 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

I'm not familiar with this sockmaster, so please bare with me. Firstly, a user that IS familiar with the master has tagged 9Greenday4 as being a suspected sock. Secondly, both these users appear to engage in identical genre-changing behaviour, irrespective of sources. These aren't recently created accounts, but they appear to match the master's modus operandi, and both are music-related names, with a CU requested to see if any more accounts are lying around. Luke no 94 (tell Luke off here) 19:50, 10 May 2013 (UTC)
 * Greenday: (calling Allmusic unreliable... impressive)  (first ever edit, immediately involving genres, even if the edit itself may well be good)
 * BFMV: (15 edits included in that diff),  (unsourced creation of a genre within an article)
 * Also listing Zuagery, whom has been blocked for genre warring: - I will note that a blocked sock of Metallican did revert Zuagery, but that could easily be a cover-up or something similar.  Luke no 94  (tell Luke off here) 19:57, 10 May 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

9Greenday4 definitely looks like TheMetallican, due to editing the exact same articles in a very similar manner to Metallican and his other socks, although i'm certain Zuagery isn't a Metallican sock, infact if you check The Escape the Fate and Craig Mabbitt pages you'll see he was engaged in an edit war with another Metallican sock and even commented on his talk page. I'm not really sure about the other account. I call the big one bitey (talk) 21:41, 10 May 2013 (UTC)
 * I did check the pages, I've seen these sorts of cover-up things before, and as I wasn't familiar with the master (and it is their sort of behaviour), I listed them. But you are familiar with the master, and you've been proven right about Greenday. Luke no 94  (tell Luke off here) 07:38, 11 May 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
WilliamH (talk) 00:05, 11 May 2013 (UTC)
 * 9Greenday4 is a ✅ sock, as is.
 * BFMV4LIFEE is ❌, technically.
 * Zuagery has not been checked.
 * Blocked an tagged confirmed socks. Closing. Dennis Brown - 2¢  © Join WER 10:12, 11 May 2013 (UTC)

19 May 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

For 24.128.86.238, matches  by a blocked sock of this user. Also made this edit, which is essentially the same (the difference is, I'd added more genres and reffed the lot). 148.88.244.99 is stale, but and  are also consistent with TheMetallican. Luke no 94 (tell Luke off here) 16:36, 19 May 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked 24.128.86.238 as a sock. The other IP has most likely switched to another person since those edits. -- Guerillero &#124;  My Talk  18:15, 19 May 2013 (UTC)
 * Looks like we are done here, closing. Dennis Brown - 2¢ - © - @ - Join WER 18:59, 19 May 2013 (UTC)

15 June 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

First off, let me say that I completely realize that It's not the job of administrators to research a subject for themselves. There's a good reason for that. However, simply looking at this IP's edit history makes it pretty clear that this is the same guy. Shouldn't their edit history speak for itself at this point? I'm pretty sure that every single page this IP has edited has, at one point or another, been edited by a confirmed sock account of TheMetallican. To be honest, I'm wondering if I should even waste my time reverting and reporting him at this point. I'm really not sure how (and if) I should be handling this mess. Anyway, thanks for your time. Friginator (talk) 16:05, 15 June 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Due to the Privacy policy, we will almost never connect a named user to an IP address. ​—DoRD (talk)​ 16:36, 15 June 2013 (UTC)
 * Duck blocked. Closing. Dennis Brown / 2¢ / © / @ 17:11, 15 June 2013 (UTC)

23 July 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Per duck test. Persistently changes genres with unreliable sources or sources that do not support them on various articles relating to bands such as Green Day, Sum 41 and Avenged Sevenfold, just like his other accounts and IPs. Here's a few examples:

http://en.wikipedia.org/w/index.php?title=Holiday_(Green_Day_song)&diff=565400672&oldid=565392496 http://en.wikipedia.org/w/index.php?title=Minority_(Green_Day_song)&diff=prev&oldid=565368131 http://en.wikipedia.org/w/index.php?title=Nice_Guys_Finish_Last&diff=prev&oldid=565161884

As you can see, he desperately tries whatever he can to get pop punk off of the Green Day articles (a genre that Green Day are often associated with), often citing unreliable sources or sources that doesn't support the other genre. This is exactly what other socks of TheMetallican has done in the past. Also, here's a few other examples:

http://en.wikipedia.org/w/index.php?title=Chuck_(album)&diff=prev&oldid=565402408 http://en.wikipedia.org/w/index.php?title=All_Killer,_No_Filler&diff=562995546&oldid=562336577 http://en.wikipedia.org/w/index.php?title=Avenged_Sevenfold_(album)&diff=565422461&oldid=565422173

It's really gotten out of hand now. Pages like these need serious protection and I don't mean just protecting them from IPs and new users, because he'll just make another account and wait until he's able to edit them again. He's done the same in the past whenever a page was semi-protected. Therefor, I request Pending changes level 2 protection on some of the recently affected articles that has seen extensive sockpuppetry, such as Holiday (Green Day song), Minority (Green Day song), Chuck (album) and Avenged Sevenfold (album). Kokoro20 (talk) 15:46, 23 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

"Blink182182" immediately smacks me as a potential Metallican sock from that - the SOPs of creating an account named after a band, and regularly edit-warring to change genres against consensus. The others all fit the pattern, and edit areas that Metallican has been known to frequent. It quacks to me as well. Luke no 94 (tell Luke off here) 15:57, 23 July 2013 (UTC)


 * I just added another IP. He's following the same behavior as the other Metallican socks. The IP's only two edits so far are a dead giveaway:


 * http://en.wikipedia.org/w/index.php?title=%C2%A1Tr%C3%A9!&diff=prev&oldid=565552342
 * http://en.wikipedia.org/w/index.php?title=X-Kid&diff=prev&oldid=565551092 Kokoro20 (talk) 09:23, 24 July 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - - Okkayth diffs:, . Matermakar diffs: , . Pradppo diffs: , . Iambrred diffs: , . They're all contribs confirmed, requesting CU for sleepers. All accounts indeffed, IPs for 1 month.  Basa lisk  inspect damage⁄berate 13:29, 25 July 2013 (UTC)


 * The listed socks are technically to the socks listed in the archive. They are ✅ matches to each other. Also, following accounts are ✅ matches to the socks listed.
 * on the IP addresses. Elockid  ( Talk ) 01:36, 26 July 2013 (UTC)
 * on the IP addresses. Elockid  ( Talk ) 01:36, 26 July 2013 (UTC)
 * on the IP addresses. Elockid  ( Talk ) 01:36, 26 July 2013 (UTC)


 * Dalescohen and Iozu99 blocked as well. Not sure there's a need for pending changes on the articles yet, but if you'd like you can post it at WP:RFPP to see what people think there. Jafeluv (talk) 10:17, 26 July 2013 (UTC)

19 August 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Genre changes, same articles, same m/o, just created account a few days ago, seems to know an awful lot about Wikipedia even with the first edit. Recently rangeblocked, is possibly using this previously created account to evade the IP rangeblock. Just edited an article the blocked IP did a short time ago. Conicidence? Personally, I don't think so. I have no knowledge of how rangeblocks work if a user chooses to block and rangeblock evade through an already registered account, but have to wonder if because Gunmetal is no longer able to edit as an IP he just logged in with this account created not too long ago. Or......maybe this is User:TheMetallican? The two have been confused before. Because their IPs are so similar, the idea that they might be roommates, brothers, good friends, whatever, has also been thrown around. Looking at the user compare report, there are A LOT of the same articles they have edited. Many more than the reported party claims below. Of course, it's up to an SPI administrator to decide. If it were me, I'd say definitely yes to this account being a sock of Gunmetal, from the genre and number of same articles edited quacking alone (there are upwards of 27 articles they have in common). -- Winkelvi ● ✉ ✓ 23:31, 19 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

This user named Gunmetal Angel's confirmed sock was an IP. I looked at the IP and I do notice I made an edit on the same page he made, Waking the Cadaver, however, I'm not him. First off, I don't edit metal articles that much. I mostly edit punk, emo, etc. However, I do know that band. But if you look at his contrib, he posted on the talk page saying they aren't deathcore which is a genre they are associated with and he then added slam death metal to the article and I restored deathcore since that was the sourced genre and slam isn't really a wiki genre anyways. Why would I be a sock if I undo what he did? The gunmetal angel user seems to be a metal editor, much more editing on metal than I do.

Kznn11 (talk) 23:36, 19 August 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Please note that the only reason that I ran a check was because I am familiar with TheMetallican and this looks more like him/her. Otherwise, this request would have been declined by a clerk or another CU for two reasons. First reason is that the socks in this case are. Even though there are IPs listed here, they cannot be linked (the blocks above are purely on the duck test and did not involve checks of any kind). Secondly, there needs to be diffs showing the similarities between the accounts.

Anyways, is a ✅ match to User:TheMetallican along with  and. Elockid  ( Talk ) 12:55, 20 August 2013 (UTC)

— Berean Hunter   (talk)  19:04, 20 August 2013 (UTC) — Berean Hunter   (talk)  19:13, 20 August 2013 (UTC)
 * Moved case from Gunmetal Angel to TheMetallican.
 * Indeffing socks with tags but leaving close to another clerk to check my work.
 * Closed. Nothing more to do here. Reaper Eternal (talk) 18:57, 21 August 2013 (UTC)

27 December 2013
OK, here is the edit: this edit shows that this IP address is a blocked user TheMetallican. Here's the quote: "I am an IP address of a blocked user". Also here are the following usernames that this IP address used: These usernames and the IP address should prove that TheMetallican used them. Thewikiguru1 (talk) 03:36, 29 December 2013 (UTC)
 * Suspected sockpuppets
 * User:TruSkoolHooligan
 * User:BEATWEAKer
 * User:CaptainSpaulding1978


 * Request was malformed at the time and thus remained unlisted, no action needed at the moment, closing. Amalthea  10:50, 26 January 2014 (UTC)