Wikipedia:Sockpuppet investigations/Troll1212/Archive

30 June 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Wasn't sure which to report as the puppeteer as they're all IP's. All recently vandalized Kreayshawn (see page history), or her former group members Lil Debbie (history) and V-Nasty (history) within a small space of time, all first time edits to the page, with only a few edits prior to the vandalism. Edits include writing "wigga" on pages and switching pictures for Nazi flags or rectums. All extremely similar IP numbers. Some have taken to abusing Willow Smith related-pages in the same image swapping type vandalism.  Azealia 911  talk  18:47, 30 June 2015 (UTC)

Above IP has not vandalized any previously mentioned pages, but has just vandalised two of my sandboxes (1,2) in the same way all previous IP's have to articles, and includes the similar IP to all listed above.

First user reported in this string, pulled the "flag" vandalism at Kreayshawn, and them vandalized 21st Century Girl, as a previous IP did.

Note: I rarely open SPI's, or deal with IP blocks, but I do belive a range block may be suitable here. I have no idea how to or who to ask for such block, but considering the amount of vandalism from IP's beginning with 173.209.211 as of late, it may be worth looking in to. I imagine the clerk who deals with this will have significant more knowledge than me, so I'd appreciate it if they considered/considered asking about one.  Azealia 911  talk  21:22, 30 June 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked for one week per ANI complaint (permalink). See range contributions. Since this range is provided by Hosted Solutions, I think webhostblock should apply and recommend at least a two-month hardblock. The full range is probably 173.209.192.0/19 (per whois) but before blocking that, someone might want to look around and be sure that's correct. EdJohnston (talk) 15:06, 1 July 2015 (UTC)

This page says:
 * Hosted Solutions, based in Raleigh, N.C., is a leading regional data center and managed hosting provider focused on enterprise-class Infrastructure as a Service (IaaS) solutions (managed hosting, managed services, colocation, cloud computing and bandwidth) for small and medium-sized business customers as well as large enterprises. The company serves more than 600 customers and has approximately 125 employees.


 * The acquisition of Hosted Solutions will transform Windstream’s data center business, increasing the scale and scope by adding five state-of-the-art SAS 70 Type II certified data centers in Raleigh, N.C.; Charlotte, N.C., and Boston with a total of 68,000 square feet of data center capacity. As a result, Windstream will have a combined total of 12 data centers across the country.

EdJohnston (talk) 15:25, 1 July 2015 (UTC)

— Berean Hunter   (talk)  23:04, 1 July 2015 (UTC)
 * I've moved the case to the named master. That range actually has several static addresses labeled to their customers. Range analysis. Hosted Solutions has the range 173.209.192.0 - 173.209.223.255 . This edit crosses over into an indef blocked user with another sock case. This edit correlates to a current ANI thread subject. This edit may reveal other socks but not necessarily related to the previously mentioned (see the names of the users in the previous edit). Editors may want to look through these range contribs as it may reveal other sock activity as well as show what kind of collateral damage may be present for IPs. It won't reveal collateral damage for logged in editors...that would take a checkuser. Comparison to AHLM13 may warrant a CU alone.
 * This June edit from the range (173.209.211.151) is a BLP violation on the article of Darryl Roberts (American football). EdJohnston (talk) 02:18, 5 July 2015 (UTC)


 * Closing.  Vanjagenije  (talk)  14:33, 23 July 2015 (UTC)