Wikipedia:Sockpuppet investigations/UnsungKing123/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Filing for the record: a user trying to push the view that Morgan Spurlock is a propagandist and conspiracy theorist, a view for which the user has failed to provide any sources at all. They have been blocked repeatedly on the 98.0.33.169 IP (currently for a year) and after using the other two IPs listed here they resorted to multiple-account sockpuppetry after the page was protected. Likes to say things about living persons that require revision deletion, and to use unblock requests to claim "they" will "never stop me".

Clerks and admins: talk page access should be revoked for socks of this user. Ivanvector (Talk/Edits) 15:33, 7 August 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Filed for the record. Ivanvector (Talk/Edits) 15:33, 7 August 2018 (UTC)
 * I threw in, after CU. Don't archive this yet. Drmies (talk) 15:43, 7 August 2018 (UTC)
 * , I found something odd. I need a CU to look over my shoulder because I think there's a strange match; the moment the CU looks at it they'll know what I mean, and I'll email you separately. CU: look at the dates, when the other account stopped and the Spurlocking began, and look at the older version of that user's user page--the userboxes. Drmies (talk) 15:46, 7 August 2018 (UTC)
 * (implied). Ivanvector (Talk/Edits) 15:47, 7 August 2018 (UTC)


 * OK I think I figured enough. There is a CU match with another account,, which may not have overlap in article space, but there are some eery factors here. , I'll leave it to you to spell it out; in the meantime, I endorse a block of what basically seems to me like a good hand-bad hand situation. Drmies (talk) 18:20, 7 August 2018 (UTC)
 * In email, without revealing private information, described the CU result as a perfect match. That's an odd and surprising result, as at first glance there is little obvious behavioural connection between UnsungKing123 and the accounts in this sockfarm. But digging into it further reveals some interesting things:
 * The IP 98.0.33.169 earned a one-month block for a spree of vandalism on some rock music articles on what would have been two weekends. They were re-blocked for more vandalism in early January over what would have been the winter holidays. This IP geolocates to Cape Elizabeth, Maine, where there is a campus of the University of Southern Maine. Their January block was for three months but they complained about having been blocked for a year, which is odd.
 * In April, nearly three months to the day from the IP's block, UnsungKing123 begins editing. On his userpage, he described himself as an editor interested in rock music and gaming, and also included the User:UBX/McDonald's userbox which is what I presume Drmies is referring to. Curiously, on the day that UnsungKing123 becomes autoconfirmed he requests protection of his user page due to vandalism, though the page has not been vandalized (the only two edits are his).
 * Over the next three months UnsungKing123 builds a fine hat collection but stops editing on June 30. Is that the end of the school year, or was the end of the school year April? He comes back on July 19 declaring retirement, and asking for his user and talk pages to be deleted, noting he's interested in vanishing . The request to delete his talk page was declined so he asked for all prior revisions to be revdeleted instead, which was also declined.
 * The IP has not edited at all since January, but two days after UnsungKing123's retirement and request to vanish, the IP (again on a weekend) resumes editing rock music articles before leaning hard into the McDonalds conspiracy thing and getting blocked for a year. The two other IPs listed here, which also geolocate to the same area in Maine, tried to pick up the conspiracy torch over the next week before also being blocked.
 * That's when the Spurlock socks started. The three accounts here were all created within 2 minutes of each other on August 3, the next weekend following the IP blocks. Sporganmurlock picked up the IPs' edits until being voa-blocked and having the page protected. Then Spurlockian made their autoconfirmation-gaming edits to rock music and video game articles, and also joined in on an edit war with another obviously-a-sockpuppet case at Angelic 2 the Core. SuperSizeMe2004 was picked up by CU before making any edits, in a check which also picked up UnsungKing123.
 * Now I'll admit that if someone else had made this case separately and suggested that UnsungKing123 were the sockmaster based on this evidence, I would say something rude to them and then summarily dismiss the case. But with the checkuser result, there's little I can do but agree that this is good hand bad hand editing, and reasonably sophisticated. UnsungKing123 also seemed to be familiar with userrights and sockpuppetry, given their retirement statement (admins can find it on their deleted userpage), and so I find it plausible that their requests to vanish and erase their userpages were a deliberate attempt to cover their tracks to preemptively evade future detection, or perhaps to secure an extended-confirmed sleeper for future use. And I also strongly suspect that we have not identified the master.
 * All accounts are, all of them indef since the socks' edits have been especially disruptive. courtesy ping since you salted the user's talk page, I am tagging through your protection. Ivanvector (Talk/Edits) 15:53, 8 August 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Yet another one of the many UnsungKing123 socks that so loves to call Morgan Spurlock a conspiracy theorist. Same edits, same naming pattern. I don't think a checkuser is necessary here considering these diffs. (confirmed sock) (the new sock.) Simonm223 (talk) 18:46, 20 August 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
This was misfiled. Please fix.--Bbb23 (talk) 19:55, 20 August 2018 (UTC)
 * ✅. I had already blocked and tagged the sock, and in the meantime they also woke up, 5 days old and now also blocked. - obviously keeping a stable of sleepers. Ivanvector (Talk/Edits) 12:45, 21 August 2018 (UTC)
 * ✅. No other unblocked accounts seen.--Bbb23 (talk) 14:32, 21 August 2018 (UTC)
 * Thanks. I don't expect that means there aren't any, but thanks for looking. Ivanvector (Talk/Edits) 15:19, 21 August 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Sleepers located by CU, filing for record only, please archive. Yunshui 雲 水 16:07, 22 August 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
All listed accounts ✅,. Yunshui 雲 水 16:07, 22 August 2018 (UTC)
 * just checking: are they confirmed only to each other, or are they also confirmed to the master? Ivanvector (Talk/Edits) 16:14, 22 August 2018 (UTC)
 * Sorry, should have been clearer - Ngi$ alloD yT is confirmed to the master, the others are confirmed to Ngi$ alloD yT. Yunshui 雲 水 07:19, 23 August 2018 (UTC)
 * And that makes three. Tags updated. Ivanvector (Talk/Edits) 12:00, 23 August 2018 (UTC)