Wikipedia:Sockpuppet investigations/ThreeE/Archive

Report date July 8 2009, 20:49 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by BQZip01

On 10 June Grandma Dottie (GD) made an edit to BQ (just 10 minutes after User:ThreeE made one of only two edits in a month). While the edit was certainly within guidelines, it was reverted by me because another guideline contradicts that one and I was unaware of the problem. ThreeE then makes his third edit in two months to defend this person and continues to do so over the next 2 days. Then, largely disappears with only the occasional edit.

Along comes a new user who goes directly to the BQ page, makes a single edit with obvious knowledge of policy, edit summaries, and talk pages (clearly NOT a new user)...now that I've mentioned it, the next "new" user will probably avoid all/part of those "mistakes".

I put Dottie at the top because I am absolutely convinced that GD and GB are the same person. I am only 99% sure ThreeE is the puppetmaster. Also of note: no overlapping edit histories. — BQZip01 — talk 20:50, 8 July 2009 (UTC)


 * Added another sockpuppet. Edit history is the same as the previous. — BQZip01 —  talk 22:41, 8 July 2009 (UTC)
 * Behavior is consistent: Suspected_sock_puppets/ThreeE — BQZip01 —  talk 23:56, 8 July 2009 (UTC)

More evidence
If you will look at all edit histories, 3 of 4 basically have only edits related to BQ. ThreeE has other edits, but has a history of latching on to this page and sockpuppetry similar to this and matches previously blocked behavior. The "coincidence" of the time separating edits seems to be quite telling, IMHO. I am willing to bet that, if you checked, you'd find ThreeE logging out and Grandma Dottie logging in during that 10 minute span. In short, all those not ThreeE should be immediately blocked as clear meatpuppetry at a bare minimum, if not all sockpuppets, and ThreeE as well for being the puppetmaster. — BQZip01 — talk 04:17, 19 July 2009 (UTC)
 * Ok, so with the checkuser evidence, the above annotated behavioral evidence (SPA accounts designed for use on BQ and subsequent misdirection thereafter), I think it is pretty obvious that ThreeE has gone back to his ways of sockpuppetry. I request a long block for ThreeE and indef blocks on the rest. — BQZip01 —  talk 22:13, 19 July 2009 (UTC)
 * This whole process is a kangaroo court. I have nothing to do with any of these other accounts other than editing some of the same pages.  Give me one tangible shred of evidence that says otherwise.  Bring the "evidence" out into the light. ThreeE (talk)
 * Checkuser information and techniques are not available to the public, as it would give block evaders too much information. But checkusers take a cautious approach, and I've never known them to get it wrong. If you are innocent, you have nothing to fear. Baseball Bugs What's up, Doc? carrots 00:23, 20 July 2009 (UTC)
 * I don't "fear" anything in regard to WP. But I've known this process to come to the wrong conclusion once before.  Invisible "evidence" is not evidence and a lot more information could be provided without giving away any private or "tradecraft" information.  For example, the CU comes back with "proxies have been used" as "evidence" that I'm involved in some way.  What does that mean?  I've never used a proxy -- what evidence says that I have?  It's like saying your a witch if you float. ThreeE (talk) 00:36, 20 July 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.

I have no relationship to these other edits/accounts/IP addresses. ThreeE (talk) 03:13, 11 July 2009 (UTC)

I added 24.149.110.134 because it's now getting into the act also - basically an obsession over what BQ stands for. Baseball Bugs What's up, Doc? carrots 00:33, 9 July 2009 (UTC)
 * Comments by other users
 * IFF it is ThreeE, it seems to be more of an obsession with pising me off at any/all costs. See note on your talk page. — BQZip01 —  talk 17:16, 9 July 2009 (UTC)

I would like to see the checkuser do a "sweep", to see if there are any other socks or "sleepers" connected with the suspected socks this case. Baseball Bugs What's up, Doc? carrots 00:18, 20 July 2009 (UTC)


 * Clerk, patrolling admin and checkuser comments

✅ Currently available technical and behavioral evidence indicates that the following accounts are related to each other
 * Evidence doesn't seem convincing enough to justify a block without CU confirmation, but CU has not been requested in this case. Was that intentional or an oversight? Nathan  T 03:21, 17 July 2009 (UTC)
 * It was intentional as I believe such a person is hopping amongst IPs. I don't think a checkuser will do any good, but I'm not ruling it out as a last option. What kind of additional evidence are you looking for? Hopefully I can provide more concrete examples. — BQZip01 —  talk 14:43, 18 July 2009 (UTC)
 * Per this diff, in which the IP refers to "my talk page", even though the IP talk page doesn't even exist: this is definitely somebody's sock, although not clear whose it is.--Aervanath (talk) 16:32, 18 July 2009 (UTC)
 * Conclusions
 * Conclusions
 * Currently available technical and behavioral evidence indicates that the following accounts may be related both to each other and to the two above. Proxies have been used and other technical evidence is indicative, but not completely conclusive. Behavioral and stylistic analysis is suggested.
 * Currently available technical and behavioral evidence indicates that the following accounts may be related both to each other and to the two above. Proxies have been used and other technical evidence is indicative, but not completely conclusive. Behavioral and stylistic analysis is suggested.
 * Currently available technical and behavioral evidence indicates that the following accounts may be related both to each other and to the two above. Proxies have been used and other technical evidence is indicative, but not completely conclusive. Behavioral and stylistic analysis is suggested.

--Avi (talk) 14:08, 19 July 2009 (UTC) Based on behaviour, and the checkuser result "possible", I have blocked and tagged all listed accounts. Peter Symonds ( talk ) 00:46, 20 July 2009 (UTC)

Report date July 21 2009, 15:35 (UTC)

 * Suspected sockpuppets




 * Evidence submitted by BQZip01

User has stated intent to do circumvent his indef block for sockpuppetry; this edit appears to be an attempt to get the last word in and refactor the blocking admin's comments (since reverted). Request a thorough checkuser search to find any additional accounts as well (I realize it won't necessarily be a definitive list, but it's a start).

(see: Sockpuppet_investigations/Grandma_Dottie/Archive for previous history)


 * Re:Comments by the accused party. Blocking KangCrt immediately is appropriate since it is an admitted sockpuppet account. As for "engaging in a which [sic] hunt", this is a clear block evasion and is explicitly prohibited; someone is causing problems and creating multiple accounts to cause problems for myself and others. It isn't a witch hunt. Contributions from sockpuppet accounts of indef blocked users are not welcome on Wikipedia. "Contributions" which alter others' comments are also not welcome. You have forms of redress (explained on your talk page), but instead you chose to violate more rules to circumvent a "loss". If you have no desire to contribute within the framework of Wikipedia, I suggest you spend effort elsewhere. These most recent actions waste your time and ours. — BQZip01 —  talk 21:42, 21 July 2009 (UTC)


 * Added another. Only edit is to BQ; not exactly a shock... — BQZip01 —  talk 20:41, 23 July 2009 (UTC)


 * Thanks to all for swift action. — BQZip01 —  talk 19:22, 24 July 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * I'll save you the effort. This is one of my alternative accounts.  Seems I might as well take this approach if I'm going to get accused of it.  Why you feel the need to engage in this witch hunt is beyond me. KangCrt (talk) 16:03, 21 July 2009 (UTC)


 * Comments by other users
 * I've blocked KangCrt for his admission above. I'm not going to be surprised if he shows up on his talk page and tries to label me as an involved user (since he tried to lawyer his way out of his last block, a checkuser-based block) or if he uses another sockpuppet, so I'll support the request provided it also shuts his IP down a bit longer than an auto- or account creation block affords. -Jeremy (v^_^v Tear him for his bad verses!) 20:11, 21 July 2009 (UTC)
 * Added ; he was registered today and KangCrt edited the account's talk page. He has not edited as of yet, but it's looking likely Sucroe is a sock as well. -Jeremy (v^_^v Tear him for his bad verses!) 20:15, 21 July 2009 (UTC)

Requested by — BQZip01 —  talk 15:35, 21 July 2009 (UTC)
 * CheckUser requests


 * - To check for sleepers and perform an IP block. Tiptoety  talk 20:16, 21 July 2009 (UTC)


 * Clerk, patrolling admin and checkuser comments


 * Conclusions
 * is – IP looks like an open proxy. I will comment in a few hours after I run a port scanner.
 * is – same mobile IP use as Grandma Dotti sock . Nishkid64 (Make articles, not wikidrama) 20:44, 23 July 2009 (UTC)
 * is – same mobile IP use as Grandma Dotti sock . Nishkid64 (Make articles, not wikidrama) 20:44, 23 July 2009 (UTC)


 * Sucroe and Cokea blocked by PeterSymonds. Nathan  T 17:34, 24 July 2009 (UTC)
 * Sucroe's IP doesn't appear to be an open proxy. I'd suggest leaving this account alone for now. Nishkid64 (Make articles, not wikidrama) 17:41, 24 July 2009 (UTC)

Suspected sockpuppets

 * ( original case name)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Author is engaging with the exact same MO as before: taunting, editing BQ to undo my edits, the user's name references a deceased user (User:Cumulus Clouds) (a user that this person quite literally accused me of killing and was rev del'd from my talk page history). Requesting permanent protection for BQ in coordination for persistent vandalism. Buffs (talk) 23:17, 14 November 2021 (UTC)

Could possibly be Category:Suspected Wikipedia sockpuppets of GENIUS(4th power) as well (a.k.a. TomPhan) Buffs (talk) 04:02, 15 November 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * This is someone who has been hassling me for 10+ years and I'm not the only one (see Long-term_abuse/GENIUS(4th_power) which notes harassment as recently as Nov 2021 (not exactly a shock). The reversions on BQ indeed are not a "history of recent socking", but an insidious long-term harassment:
 * Feb 2008
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * Page finally protected
 * June-July 2009
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * Page protection extended 6 months
 * PP lifted a day later once sock was blocked (OMG..why...?)
 * more July 2009
 * 
 * 
 * PP re-enacted, discussion with multiple sockpuppets of the same person on talk page
 * Nov 2020
 * WP:TE and WP:WIKIHOUNDING apply in spades here. Please understand this is 10+ years of harassment, taunting, sockpuppetry, and block evasion. It needs to stop. This isn't the only harassment that has again been reinstated this month.
 * Respectfully, I ask you to reconsider BQ's page protection. Vandalism of BQ by itself, I can just plain deal with. It's this particular user's penchant for continual loooooong-term system abuse that we shouldn't have to deal with. Jumping in and making changes every 6 months or every few years requires completely unnecessary careful monitoring. If you'll look at Genius's edit history and extensive disruption, I think it's warranted. Buffs (talk) 01:26, 24 November 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Well that's something alright. 12 years since the last filing. First, : This case was superseded by Sockpuppet investigations/ThreeE, but wasn't merged. Maybe they didn't merge back then. I dunno. Regardless, when all is said and done, this case should be merged into that.Anyways, this either is ThreeE or someone who wants us to really think they are ThreeE. They need to be blocked either way, but it'd be good to know who if possible. They do seem to meet the MO for GENIUS, and with GENIUS' last confirmed sock being in 2016 that's less ludicrous to think than this being ThreeE returning after over a decade. : GENIUS is stale, but has been abusive enough that some past IPs have been disclosed at Long-term_abuse/GENIUS(4th_power). Or maybe we'll find a trace of some other LTA. I don't see the history of recent socking necessary for a protection here. You can try your luck at WP:RFPP though. --  Tamzin  [ cetacean needed ] (she/they) 06:21, 22 November 2021 (UTC)
 * @Tamzin could you clarify what you would like a CU to do here? The last report in this case is over 10 years old. -- RoySmith (talk) 17:53, 22 November 2021 (UTC)
 * . Having talked to Roy, I realize a few more things I want to look into. Any interested CU is welcome to contact me by email/IRC/Discord. And any admin should feel free to block C.Clouds_V_2.0 while this case is pending. Whoever they are, there's a ~100% chance they're a sock. --  Tamzin  [ cetacean needed ] (she/they) 22:09, 22 November 2021 (UTC)
 * Blocked C.Clouds as a sock (master unknown). CU'd as suspected LTA, didn't see any other accounts of interest. Declining to protect BQ, this is the first time this person has vandalized the page in what, over a decade? That is not enough disruptive activity to merit even semi. GeneralNotability (talk) 00:21, 23 November 2021 (UTC)
 * Thanks, GN. Closing. --  Tamzin  [ cetacean needed ] (she/they) 01:20, 23 November 2021 (UTC)
 * , this is the first time this editor has made this edit to this page in over a decade. Whatever happened between you and this particular editor in 2009, it's far too long in the past for me to consider page protection appropriate. If they keep coming back to this page and making this particular problematic edit, we can talk, but this does not qualify at all for protection. GeneralNotability (talk) 01:55, 24 November 2021 (UTC)
 * Just realized I never handled the merge here. Could an admin-clerk please merge this case into Sockpuppet investigations/ThreeE? Thanks. --  Tamzin  [ cetacean needed ] (she/they) 17:16, 26 November 2021 (UTC)
 * I've done the basic merge., take a look at Sockpuppet investigations/ThreeE/Archive; while spi-helper.js did almost everything right, it got the day sections in the wrong order (it warns you that this is happening).  As a training exercise, I'll leave it to you to fix that.  You'll need to edit the archive page and shuffle things around manually with cut-and-paste.  Another thing to notice is that this is a very old case, and the formatting of SPI pages may have changed over the years, so it's worth giving the archive an extra look just to make sure nothing went off the rails with the automated merge.  Other than that, back to you @Tamzin. -- RoySmith (talk) 17:47, 26 November 2021 (UTC)
 * Reformatting completed and all looks good. Over to you . --Jack Frost (talk) 22:38, 27 November 2021 (UTC)
 * Thanks, Roy and Jack. Closing. Noting as a parting observation that, the more I've thought about this, the more I think likely this is one of the LTAs who likes dredging up old wiki-drama, and the less that it's ThreeE or GENIUS. Sockpuppet investigations/Chelston-temp-1 comes to mind, although this would be a different MO than what they've been known for to-date.  --  Tamzin  [ cetacean needed ] (she/they) 22:22, 29 November 2021 (UTC)