Wikipedia:Sockpuppet investigations/UxUmbrella/Archive

21 September 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

, on multiple occasions, attempted to restore Umbrella (music video), an article that significantly contributed to which was merged to Umbrella (song) following a discussion at the latter's talk page. This IP joined UxUmbrella at this talk page discussion and clearly attempted to make it look as if they are separate users (after IP's initial postings, UxUmbrella chimed in, "I disagree too!")

,, and were used to edit war at Umbrella (song), restoring a version of the article that UxUmbrella prefers against consensus. From 05:49, 11 September 2014‎ to 18:52, 15 September 2014, the three IPs took turns restoring to UxUmbrella's preferred version, with only two (comparatively) minor edits by UxUmbrella within this window: 1, 2. When the article was semi-protected on 06:40, 16 September 2014‎, UxUmbrella immediately resumed editing.

Shortly before UxUmbrella was blocked today for disruptive editing, I notified him/her that I tagged File:Rihanna holding award and Chris Applebaum at MTV VMA 2007.jpg for speedy deletion, and removed it from two articles where it was being used: Chris Applebaum and Rihanna videography. After UxUmbrella was blocked, added the image back to both articles: 1, 2.

is currently blocked as a proxy, and it is likely the other IP addresses are proxies as well. UxUmbrella is clearly socking to edit war, make it look like his/her edits have support among other users, and otherwise cause disruption. Obvious case of WP:DUCK here. –Chase (talk / contribs) 17:38, 21 September 2014 (UTC)


 * Should also be noted that UxUmbrella and all of the IPs primarily edit Rihanna-related articles such as Princess of China and Rihanna videography. –Chase (talk / contribs) 17:45, 21 September 2014 (UTC)

UPDATE 19:43, 21 September 2014 (UTC): and  have now been added as suspected sockpuppets. The former IP restored Umbrella (music video) with this edit; the latter made only a minor change, but it was only a few minutes later and their contributions are empty sans that edit. –Chase (talk / contribs) 19:43, 21 September 2014 (UTC)

UPDATE 02:24, 24 September 2014 (UTC): is a new account whose first edit restored UxUmbrella's preferred version of Umbrella (song). –Chase (talk / contribs) 02:24, 24 September 2014 (UTC)

UPDATE 12:14, 25 September 2014 (UTC): Special:Contributions/95.72.175.87 –Chase (talk / contribs) 12:14, 25 September 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

The IP addresses have never edited before and came in to edit to make the exact same edits once UxUmbrella had made three reverts and theoretically could have been blocked. As soon as the article was semi-protected, UxUmbrella made reverts again, this time getting blocked for edit warring. Two new IP addresses pop up recreating the music video article. XCyberNavy, a completely new registered account, pops up and makes exactly the same edit on the song article. This clearly fails WP:QUACK and the block should be lengthened for using the sock puppets to evade a block as I discussed in the last two sentences. Aspects (talk) 18:35, 24 September 2014 (UTC)


 * Suspected sockpuppets
 * User compare report Auto-generated every hour.
 * Editor interaction utility
 * Editor interaction utility

Has done similar action to previous user on Umbrella (song), and evidently a block evasion. IPadPerson (talk) 10:12, 24 September 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Checkuser comments:
 * No technical relation between and . Consider whether this could be meatpuppetry.
 * has been editing logged out including editing logged out while blocked. No suitable IP range to block though, as there are good users including unregistered users on the ranges.
 * Suggest giving consideration to an extended semi-protection to the article at the focus of most of this socking. Consider whether the URLs that are repeatedly being inserted might be added to the spam blacklist. Risker (talk) 16:50, 4 October 2014 (UTC)
 * XCyberNavy is technically unrelated, and gone for over a month, so there is no action to take at the present time. While it appears likely (from a behavioural investigation) that one or more of the IP addresses was indeed used to evade the block on UxUmbrella, it would've been relevant to block them and extend the block on the account when that disruption happened, but a month after the fact, it is now too late to go back on it and take action now; that would be purely punitive. If/when UxUmbrella finds themselves blocked again for disruption, we will see if they evade the block again, and hopefully respond to it in a more timely manner then. ☺ ·  Salvidrim!   ·  &#9993;  15:38, 30 October 2014 (UTC)
 * Closing as no action taken now (though action should've been taken last month). There have been a few page protections peppered around by various admins but nothing immediately jumps out as needing additional protection at the moment (request WP:RFPP or block the user if necessary)). ☺ ·  Salvidrim!   ·  &#9993;  15:38, 30 October 2014 (UTC)

23 December 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

UxUmbrella has a history of making changes to Umbrella (song) against consensus. comes along and, on his first edit, restores UxUmbrella's preferred version of the article, demonstrating knowledge with Wiki markup (piping UxUmbrella's username) and common abbreviations ("ELs" - "external links"). It should be noted that UxUmbrella is currently blocked with talk page access revoked. Clear case of DUCK and BE. No checkuser needed - user is likely editing via proxy (see previous case). –Chase (talk / contribs) 05:13, 23 December 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * 213.24.126.208 blocked for evasion on behavioural evidence and previous (likely) IP-evasion; block is for a period matching the account's block. Umbrella (song) SPP'ed for 2 months. ☺ ·  Salvidrim!   ·  &#9993;  13:53, 23 December 2014 (UTC)

22 January 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

There's really no doubt about it here - UxUmbrella admitted here to block evasion via IP addresses, claiming to "have Internet connection with dynamic IP routing i.e. I have a new IP address everyday". The listed IP wrote on 's talk page signing UxUmbrella's name and including the user name in their edit summary. UxUmbrella has made it no secret that he is evading blocks (now an indefinite one) and will continue to do so to edit disruptively. CheckUser is being requested to catch a range of IPs and stop him from editing even with his dynamic routing. –Chase (talk / contribs) 00:20, 22 January 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * for one week. I don't think a full SPI is needed for such obvious IP block evasion, I recommend AIV or directly to an admin. ☺ ·  Salvidrim!   ·  &#9993;  01:10, 22 January 2015 (UTC)
 * I just now saw your request for a rangeblock evaluation; the latest report before this one was in a similar range, but the September one across a wide range, so I have doubts as to how feasible a rangeblock will be. I'll and leave it up to a CU to determine, though.  ☺ ·   Salvidrim!   ·  &#9993;  01:13, 22 January 2015 (UTC)
 * I've blocked the IP range for a year, but I've only blocked the IPs - logged in editors will be able to edit normally. Hope this is ok. PhilKnight (talk) 20:19, 22 January 2015 (UTC)
 * Thanks; hopefully it should be sufficient. ☺ ·  Salvidrim!   ·  &#9993;  20:23, 22 January 2015 (UTC)