Wikipedia:Sockpuppet investigations/Wallflowers98/Archive

Report date January 16 2009, 22:53 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by Snigbrook

Users have all added external links to 4shared.com similar to already blocked accounts.


 * Edits on Made in England (album) by -,  - ,  -


 * Edits on Belfast (song) by -,  -


 * Edits on Experimental music by -,  -

See http://en.wikipedia.org/w/index.php?title=Wikipedia:Requests_for_checkuser/IP_check&oldid=259871243 for a list of confirmed accounts. ÃÂ¢ÃÂÃÂ Snigbrook 16:18, 16 January 2009 (UTC)


 * Another account, : . ÃÂ¢ÃÂÃÂ Snigbrook 17:30, 16 January 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Tiptoety talk 03:41, 17 January 2009 (UTC)    Requested by  Snigbrook  17:30, 16 January 2009 (UTC)
 * CheckUser requests


 * Clerk, patrolling admin and checkuser comments
 * Merged from Requests for checkuser/IP check. Tiptoety  talk 22:53, 16 January 2009 (UTC)

✅ the following:



[[Sam Korn ]] (smoddy) 16:39, 17 January 2009 (UTC)
 * All blocked indef. -- Kanonkas : Talk  15:38, 18 January 2009 (UTC)


 * Conclusions

Report date January 30 2009, 22:13 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by ÃÂ¢ÃÂÃÂ Snigbrook

Accounts adding links to 4shared.com in articles

 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * (although this account may be unrelated to the others)

All accounts have added links to the file sharing site 4shared.com where a song title appears in an article, usually songs by Silverchair, Elton John or Prince. These appear to be related to the earlier request on this page and this request at RFCU/IP. I've now made a request on the spam blacklist talk page (MediaWiki talk:Spam-blacklist). The accounts, and  are blocked (for misleading or disruptive usernames); I don't think the others are. ÃÂ¢ÃÂÃÂ Snigbrook 21:33, 30 January 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by ÃÂ¢ÃÂÃÂ Snigbrook 22:13, 30 January 2009 (UTC)
 * CheckUser requests


 * Clerk, patrolling admin and checkuser comments

He's an AOL spammer, so rangeblocks cannot be considered. I will keep track of several /16 ranges he is operating from, though. Nishkid64 (Make articles, not wikidrama) 01:04, 31 January 2009 (UTC)
 * Conclusions
 * ✅ the following as the 4shared.com spammer:
 * Now that was many socks I had to tag. All accounts taged & blocked. -- Kanonkas : Talk  02:20, 31 January 2009 (UTC)

Tiptoety talk 20:21, 31 January 2009 (UTC)

Report date February 1 2009, 00:14 (UTC)

 * Suspected sockpuppets

Four accounts, JuJuBee2:, Puzznic, AltKaiba and ShaolinMonk20 were all created within just over an hour, and all added links to nitroroms.com into articles, usually where the title is first mentioned. I don't know if this is related to Wallflowers98 but the pattern is similar, also I'm not sure if checkuser is needed or the relation of the accounts (at least to each other) is too obvious. Ã¢ÂÂ Snigbrook 00:14, 1 February 2009 (UTC)
 * Evidence submitted by Ã¢ÂÂ Snigbrook


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by Ã¢ÂÂ Snigbrook 00:14, 1 February 2009 (UTC)
 * CheckUser requests


 * Clerk, patrolling admin and checkuser comments

-- Kanonkas : Talk  17:17, 1 February 2009 (UTC)
 * Conclusions
 * ✅ all. Nishkid64 (Make articles, not wikidrama) 01:32, 1 February 2009 (UTC)

Report date February 2 2009, 13:30 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by Kanonkas : Talk

All likely sockpuppets of Wallflowers98. See their edit pattern & contribs. I've blocked all of the three above accounts under WP:DUCK. I suspect this serial spammer may have more accounts. -- Kanonkas : Talk  13:30, 2 February 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users
 * More accountnames can be found here (1Mb of XML data). I did not see much appropriate use when I clicked some diff-links, though there seems to be some good faith 'use' (creating a list of these sites, on fr.wikipedia IIRC).  Also, it looks more that there is abuse on several wikis (Top 10 wikis where 4shared.com has been added: w:en (789), w:fa (104), w:tr (67), w:pt (62), w:es (38), w:ar (37), w:fr (29), q:en (17), w:id (15), w:it (6)), but until now I did not see many accounts who were active on more wikis (one I did find is IP 189.41.204.210, on pt and en).  Maybe the logs will help with tracking this down further.  --Dirk Beetstra T  C 14:55, 2 February 2009 (UTC)


 * I've made a list of other accounts that have added similar links to articles (see User:Snigbrook/Sandbox). Many of the accounts, such as  appear to be obvious socks, others I'm not sure about. (I haven't compared with the list mentioned by User:Beetstra), many of the accounts in my list will probably be in that list). â Snigbrook  15:04, 2 February 2009 (UTC)
 * Added (not currently blocked) mentioned on MediaWiki talk:Spam-blacklist for this edit. â Snigbrook  20:20, 2 February 2009 (UTC)


 * Clerk, patrolling admin and checkuser comments


 * Conclusions

Report date February 2 2009, 13:30 (UTC)

 * Suspected sockpuppets;


 * Evidence submitted by Kanonkas : Talk

All likely sockpuppets of Wallflowers98. See their edit pattern & contribs. I've blocked all of the three above accounts under WP:DUCK. I suspect this serial spammer may have more accounts. -- Kanonkas : Talk  13:30, 2 February 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users
 * More accountnames can be found here (1Mb of XML data). I did not see much appropriate use when I clicked some diff-links, though there seems to be some good faith 'use' (creating a list of these sites, on fr.wikipedia IIRC).  Also, it looks more that there is abuse on several wikis (Top 10 wikis where 4shared.com has been added: w:en (789), w:fa (104), w:tr (67), w:pt (62), w:es (38), w:ar (37), w:fr (29), q:en (17), w:id (15), w:it (6)), but until now I did not see many accounts who were active on more wikis (one I did find is IP 189.41.204.210, on pt and en).  Maybe the logs will help with tracking this down further.  --Dirk Beetstra T  C 14:55, 2 February 2009 (UTC)


 * I've made a list of other accounts that have added similar links to articles (see User:Snigbrook/Sandbox). Many of the accounts, such as  appear to be obvious socks, others I'm not sure about. (I haven't compared with the list mentioned by User:Beetstra), many of the accounts in my list will probably be in that list). — Snigbrook  15:04, 2 February 2009 (UTC)
 * Added (not currently blocked) mentioned on MediaWiki talk:Spam-blacklist for this edit. — Snigbrook  20:20, 2 February 2009 (UTC)


 * CheckUser requests


 * Looks like Dan started, but the check user not completed. Tiptoety  talk 20:46, 5 February 2009 (UTC)
 * Clerk, patrolling admin and checkuser comments



That's all I found after a quick investigation. I'm really too tired to do a detailed one. --Deskana (talk) 23:48, 3 February 2009 (UTC)


 * I did a more detailed investigation and found nothing else. You may as well go ahead and block ElectronCore, too. --Deskana (talk) 21:20, 5 February 2009 (UTC)


 * Conclusions

Report date February 14 2009, 17:52 (UTC)

 * Suspected sockpuppets

These accounts have added links to 4shared.com and rapidshare.com, with symbols replacing letters to circumvent the spam blacklist, did not add a link, but fixed a typo in a link that had been added a few minutes earlier (it looks like many of the edits are followed by minor edits from other accounts, which may also be sockpuppets.
 * Evidence submitted by — Snigbrook


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by — Snigbrook 17:52, 14 February 2009 (UTC)
 * CheckUser requests


 * Clerk, patrolling admin and checkuser comments
 * All above accounts blocked. I recommend a CU being done to possibly find more socks per history. Also the fact that they're using dynamic AOL IPs to create sleeper accounts. -- Kanonkas :  Talk  18:10, 14 February 2009 (UTC)
 * Agree with Kanonkas.  Syn  ergy 21:26, 14 February 2009 (UTC)

No socks found. AOL is too dynamic to properly search for sleepers anyway. Dominic·t 21:31, 14 February 2009 (UTC)
 * Conclusions
 *  Syn  ergy 21:35, 14 February 2009 (UTC)

Report date March 12 2009, 13:24 (UTC)

 * Suspected sockpuppets




 * Evidence submitted by ChaoticFluffy

All the users listed above have been having a grand old time adding and re-adding links to 4share.com on The Addams Family (film). Some quick investigation of the page history showed that a sock of Wallflowers98 had been blocked some time back for the same actions on the same article. Per CU archives, links to 4shared are characteristic of Wallflowers98. Each time someone reverts the change, a new user appears and re-adds the links. It seems likely there is a drawer of socks to be cleaned out regarding this user.

keɪɑtɪk flʌfi (talk) 13:24, 12 March 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by keɪɑtɪk flʌfi (talk) 13:24, 12 March 2009 (UTC)
 * CheckUser requests

Time to clear out the sock drawer Mayalld (talk) 14:31, 12 March 2009 (UTC)

Blocked the accounts under the duck clause. -- Kanonkas : Talk  22:28, 12 March 2009 (UTC)
 * Clerk, patrolling admin and checkuser comments
 * All accounts looked blocked (no tagging per Nish). If there is nothing else to be done here, I'm moving to close.  Syn  ergy 22:09, 13 March 2009 (UTC)


 * Conclusions
 * . I might as well sweep through the dozen or so /16 AOL IP ranges that Wallflowers98 uses. Nishkid64 (Make articles, not wikidrama) 20:28, 12 March 2009 (UTC)
 * Sockpuppet investigations/Song cloth may be of some relevance here. Tiptoety  talk 22:29, 12 March 2009 (UTC)
 * Song cloth is ❌ to Wallflowers98. The following are ✅ as Wallflowers98:

Damn those AOL IPs. This guy operates on a 11 /16 ranges. Nishkid64 (Make articles, not wikidrama) 21:57, 13 March 2009 (UTC)

Report date March 19 2009, 06:17 (UTC)

 * Suspected sockpuppets
 * (stale, but kept in tact as this was the original spi case name)


 * also, the following - all tagged & blocked




 * Evidence submitted by —  Dæ dαlus Contribs 

Every single account has exactly the same edit, placing into article text, a link to an illegally uploaded song in relation to this song at an ftp server.

I've added another user, for making the exact same edit.


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

E   Requested by —  Dæ dαlus Contribs  06:17, 19 March 2009 (UTC)
 * CheckUser requests

Checkuser is required to see if a rangeblock is possible on this user, it is obviously the same person, per the WP:DUCK test, but we need to see if he can be prevented from causing further harm by doing what he's been doing.—  Dæ dαlus Contribs  06:17, 19 March 2009 (UTC)

Unless and until the vandalism gets more persistent, CU would be over the top. This user is a slow vandal, and checkuser is needed to find out of a range block can be placed on them, as it isn't working otherwise.—  Dæ dαlus Contribs  09:18, 20 March 2009 (UTC)
 * Clerk, patrolling admin and checkuser comments
 * one of the socks is already blocked as a Wallflowers98 sock. Do we want to merge this case there? Mayalld (talk) 07:26, 19 March 2009 (UTC)
 * Merged here from Sockpuppet investigations/TripLikeIDo and endorsed.  Syn  ergy 12:18, 20 March 2009 (UTC)
 * Redirected Sockpuppet investigations/TV Party! here as well, accounts were already merged. Also, motion to close out.  Syn  ergy 12:51, 20 March 2009 (UTC)


 * Conclusions
 * ✅ - with the exception of TripLikeIDo, which was stale - the listed users all match the Wallflowers98 pattern, and most share a handful of AOL IPs. I've blocked & Tagged the ones in this report. Note that Sockpuppet investigations/TV Party! can be merged here, or closed - as they have been confirmed related & blocked. -- Versa geek  12:45, 20 March 2009 (UTC)

Report date March 22 2009, 22:47 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by —  Dæ dαlus Contribs 

The single suspected sock puppet matches Wallflower's MO.


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by —  Dæ dαlus Contribs  22:47, 22 March 2009 (UTC)
 * CheckUser requests

Checkuser is required so a rangeblock can be made. If not, I shall request an abuse filter be made.—  Dæ dαlus Contribs  22:47, 22 March 2009 (UTC)

Additional information needed: Please provide a code letter. SPCUClerkbot (talk) 22:47, 22 March 2009 (UTC)
 * Clerk, patrolling admin and checkuser comments


 * Conclusions
 * ✅, cleaned the sock drawer from the last three days. As mentioned previously, rangeblocks are out of question. This user operates on a dozen high traffic /16 AOL IP ranges. I've also fixed the Spam blacklist and removed all 4shared links currently on WP. Nishkid64 (Make articles, not wikidrama) 00:49, 23 March 2009 (UTC)

Evidence submitted by Chaoticfluffy
Back to his/her old stomping grounds of trying to add links to 4shared to The Addams Family (film). Last time, this action was the canary in the coal mine that showed a whole drawer of socks upon checkuser, so it's probably time to do another sweep.

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments

 * Blocked and tagged. Also, to sweep out other socks. NW ( Talk ) 20:43, 23 November 2009 (UTC)

Conclusions

 * ✅ The following accounts are confirmed as sockpuppets of

--Avi (talk) 03:20, 24 November 2009 (UTC)


 * All blocked and tagged appropriately. NW ( Talk ) 03:22, 24 November 2009 (UTC)
 * to check the suspected sock that was just posted. NW ( Talk ) 03:52, 24 November 2009 (UTC)
 * Ne0Matrix1 is also ✅. Dominic·t 10:45, 25 November 2009 (UTC)

All accounts tagged. MuZemike 16:54, 25 November 2009 (UTC)

Evidence submitted by Snigbrook
Accounts have all added links to 4shared.com, using "nowiki" as it is on the blacklist. Other similarities are that the first account,, has added the same text and links as confirmed socks, on the same article, restored a link added by ,  also created an account, , but has not used it for editing. snigbrook (talk) 23:22, 13 December 2009 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
All accounts blocked and tagged. Kevin (talk) 23:45, 13 December 2009 (UTC)

Evidence submitted by Momusufan
New sockpuppet, Need to see if there are new sleepers out there. Momo san Gespräch 21:17, 3 January 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

CheckUser requests
Requested by Momo san  Gespräch 21:17, 3 January 2010 (UTC)

Need to see if there are sleepers, as has been proven in prior CU requests. Momo san Gespräch 21:17, 3 January 2010 (UTC)

Clerk, patrolling admin and checkuser comments
Already did this independently. Dull Pain is ✅, as well as a mess of others. J.delanoy gabs adds 05:13, 4 January 2010 (UTC)

Evidence submitted by Momusufan
New sock, but now is adding a new URL in nowiki tags.

Comments by accused parties
See Defending yourself against claims.

CheckUser requests
Requested by Momo san  Gespräch 16:26, 5 January 2010 (UTC)

There maybe other accounts that we missed again.

to make another sweep for sleepers per the last couple of checks made on this user. –MuZemike 16:55, 5 January 2010 (UTC)

Clerk, patrolling admin and checkuser comments

 * Just indef-blocked for socking based on this diff:  Willking1979 (talk) 22:15, 5 January 2010 (UTC)

✅, and I blocked all sleepers I could find. I'm getting sorely tempted to rangeblock this guy... J.delanoy gabs <sub style="color:blue;">adds 16:02, 6 January 2010 (UTC)

Evidence submitted by Chaoticfluffy
Generally, any account that tries to add fileshare links to songs in The Addams Family (film) turns out to be a sock of Wallflowers98, and they tend to come in bunches. keɪɑtɪk flʌfi (talk) 15:03, 15 March 2010 (UTC)

Adding, who mysteriously turned up to vandalize my user page the same night an impersonator account (already blocked as a Wallflowers sock) decided to target me. keɪɑtɪk flʌfi (talk) 13:14, 16 March 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Comments by other users
Looks like a sock to me, WF98 has a habit of marking all edits minor.—  Dæ dαlus Contribs 18:27, 16 March 2010 (UTC)

Clerk, patrolling admin and checkuser comments
Requested by keɪɑtɪk flʌfi (talk) 15:03, 15 March 2010 (UTC)

for sleepers. Thanks, SpitfireTally-ho! 17:18, 15 March 2010 (UTC)


 * Blocked and tagged the following as ✅:
 * <em style="font-family:Bradley Hand ITC;color:blue">Hers <em style="font-family:Bradley Hand ITC;color:gold">fold  (t/a/c) 21:21, 18 March 2010 (UTC)
 * <em style="font-family:Bradley Hand ITC;color:blue">Hers <em style="font-family:Bradley Hand ITC;color:gold">fold  (t/a/c) 21:21, 18 March 2010 (UTC)
 * <em style="font-family:Bradley Hand ITC;color:blue">Hers <em style="font-family:Bradley Hand ITC;color:gold">fold  (t/a/c) 21:21, 18 March 2010 (UTC)
 * <em style="font-family:Bradley Hand ITC;color:blue">Hers <em style="font-family:Bradley Hand ITC;color:gold">fold  (t/a/c) 21:21, 18 March 2010 (UTC)
 * <em style="font-family:Bradley Hand ITC;color:blue">Hers <em style="font-family:Bradley Hand ITC;color:gold">fold  (t/a/c) 21:21, 18 March 2010 (UTC)
 * <em style="font-family:Bradley Hand ITC;color:blue">Hers <em style="font-family:Bradley Hand ITC;color:gold">fold  (t/a/c) 21:21, 18 March 2010 (UTC)

Evidence submitted by Zzuuzz
Typical Wallflowers98. All accounts blocked. Checkuser requested for sleepers and any I've missed. Thanks. -- zzuuzz (talk) 16:58, 18 May 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
Requested by -- zzuuzz (talk) 16:58, 18 May 2010 (UTC)

for a sleeper check. Previous investigations have turned out sleepers. I see no reason why this would change. <b style="font-family:Calibri; font-size:medium; color:#4682B4;"> E lockid</b>  ( Talk ) 23:46, 18 May 2010 (UTC)
 * ✅ Lots of sleepers found, as usual. All blocked. J.delanoy <sup style="color:red;">gabs <sub style="color:blue;">adds  03:09, 20 May 2010 (UTC)

Not tagging, per WP:DENY. Tim Song (talk) 03:25, 20 May 2010 (UTC)

Evidence submitted by Biker Biker
Exact same pattern as previous edits by this banned user. --Biker Biker (talk) 12:40, 22 May 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
self endorsed for a sleeper check, please. SpitfireTally-ho! 17:48, 22 May 2010 (UTC)

Found the usual pile, all blocked. I don't think it's worth it to tag, but see here if you want. J.delanoy <sup style="color:red;">gabs <sub style="color:blue;">adds 01:06, 23 May 2010 (UTC)

23 May 2010

 * Suspected sockpuppets

Posting "download free mp3" links in various articles &#124;  Uncle Milty  &#124;  talk  &#124;  20:54, 23 May 2010 (UTC)
 * Evidence submitted by &#124;  Uncle Milty  &#124;  talk  &#124;


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

moved from Sockpuppet investigations/LalwlFowers, see there for original history. Also, this is quite clearly a duck, given that the last check was this morning, I think we can probably block without a CU sweep. Thanks, SpitfireTally-ho! 21:26, 23 May 2010 (UTC)
 * Clerk, patrolling admin and checkuser comments

I've already blocked a few, including this one and another from yesterday - there'll probably be more at some point. -- zzuuzz (talk) 21:36, 23 May 2010 (UTC)
 * I'm just summarily closing this. The edit filter is picking them all up (except those that get blocked before they can get any further). I'm investigating a filter that doesn't need a throttle but that will take some time. Until then, whack-a-mole with filter assistance works. -- Sh i r ik ( Questions or Comments? ) 21:39, 23 May 2010 (UTC)

Evidence submitted by Chaoticfluffy
Adding file sharing links to The Addams Family (film) is a favorite activity of Wallflowers98, and here is a new user adding yet another file-sharing link to it. Sock drawer check, please? keɪɑtɪk flʌfi (talk) 19:23, 20 September 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments

 * ✅. Also found some sleepers:

Tiptoety talk 19:46, 20 September 2010 (UTC)
 * All blocked and tagged. TN <b style="color:midnightblue; font-size:larger;">X</b> Man  20:59, 20 September 2010 (UTC)