Wikipedia:Sockpuppet investigations/Yourname/Archive

Report date April 29 2009, 00:39 (UTC)

 * Suspected sockpuppets

Obsession with adding the "stool" image and other shit related images here, here, here, here, etc. He's been trolling DGG, Chillum, I'm Spartacus and I, among others, after various actions which led to him being blocked, finally indef. Playing whack-a-mole at the moment. StarM 00:39, 29 April 2009 (UTC)
 * Evidence submitted by StarM

Synergy, thanks for re-opening. Maybe these are all proxies, Nakon has certainly blocked some as such, in which case this is moot. Don't wory in SPI much so I may have gone wrong but I thought this was the right path for a person blatantly using multiple accounts/IPs StarM 02:06, 29 April 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Not sure what whosis is telling us, different ISP's in different countries: Cheers,  Dloh  cierekim  00:48, 29 April 2009 (UTC)
 * 69.197.156.202  Kansas City, Missouri
 * 78.53.41.53   Berlin
 * 89.105.196.76 Netherlands
 * 81.17.254.70  Ireland
 * 38.108.178.115

Requested by StarM 00:39, 29 April 2009 (UTC)
 * CheckUser requests


 * Clerk, patrolling admin and checkuser comments
 * All blocked for various reasons, some include block evasion, others are proxy.  Syn  ergy 00:51, 29 April 2009 (UTC)
 * I've taken another look at this as requested by Synergy, and it appears to me that we are looking at proxies here, and that there is nothing useful that CU will tell us.

Everything that can be done on this one has been done. Mayalld (talk) 12:59, 29 April 2009 (UTC) Mayalld (talk) 12:59, 29 April 2009 (UTC)
 * Conclusions

Report date April 29 2009, 21:24 (UTC)

 * Suspected sockpuppets

Obsession with images of poo and similar things. Abce2 (talk) 21:24, 29 April 2009 (UTC)
 * Evidence submitted by Abce2 (talk)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users


 * It's Sockpuppet investigations/Yourname/Archive, which has been closed. They're all proxies and nothing that can be done. Sad but apparently that's the answer StarM 00:49, 30 April 2009 (UTC)

Requested by Abce2 (talk) 21:24, 29 April 2009 (UTC)
 * CheckUser requests
 * Per Toon below. Peter Symonds ( talk ) 22:49, 29 April 2009 (UTC)

WP:QUACK - the IP's first edit was to User talk:DGG, to insert a picture of faeces. No need for CU, I've switched the template to indicate the correlation - this should be at Sockpuppet investigations/Yourname really. IP is blocked for 3 hours already, worth keeping an eye on if he comes back. – Toon (talk)  22:46, 29 April 2009 (UTC)
 * Clerk, patrolling admin and checkuser comments


 * Conclusions


 * Blocks already applied; nothing left to see here, folks. —  Jake   Wartenberg  02:59, 30 April 2009 (UTC)

Report date May 4 2009, 08:31 (UTC)

 * Suspected sockpuppets

Abce2 08:31, 4 May 2009 (UTC)
 * Evidence submitted by Abce2


 * Comments by accused parties    See Defending yourself against claims.

Sockpuppet investigations/Yourname he's proxy hopping. Nothing anyone can do. StarM 12:11, 4 May 2009 (UTC)
 * Comments by other users

Requested by Abce2 08:31, 4 May 2009 (UTC)
 * CheckUser requests
 * Proxy hardblocked for a year, for what it's worth, but CU would tell us nothing we don't already know. Sorry. Peter Symonds ( talk ) 12:17, 4 May 2009 (UTC)


 * Clerk, patrolling admin and checkuser comments


 * Conclusions

Proxy-hopping, per Star Mississipi and verified by nmap. Hardblocked for a year per NOP but it won't stop him. Peter <b style="color:#02b;">Symonds</b> ( talk ) 12:17, 4 May 2009 (UTC)

08 September 2011

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

Sockmaster is unknown, actually. This is apparently a sockpuppet of someone. See discussion at User talk:DoDo Bird Brain.

The editor has retired in a huff after being warned multiple times to stop abusing CSD tags. As discussed on the talk page, this is clearly not a new user account, indicating that this account may be a "good hand" sock for someone, or possibly an attempt to evade a block.

This report is not a fishing expedition, but I know of no other way to identify the sockmaster &mdash; assuming checkuser can be used for such a purpose. If not, please disregard this report. ~Amatulić (talk) 12:25, 8 September 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * because : the user has retired and I'm not particularly inclined to go checking without better cause. If anything more worrying occurs, kindly re-list and we'll look again at this. AGK  [</nowikI>&bull; ] 22:42, 8 September 2011 (UTC)
 * I kinda figured that. The concern was whether the sockmaster had retired. Anyway, thanks. ~Amatulić (talk) 23:30, 8 September 2011 (UTC)

12 November 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

User has personally attacked other users and makes unconstructive edits to articles such as Katrina Johnson identical to the sock master before the master account was blocked (. The user was blocked for a week on November 4, but I feel that a check user is necessary to check if these accounts are the same person. Darth Sjones23 (talk - contributions) 04:29, 12 November 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
. Sorry, but CUs don't publicly link IPs to accounts. <b style="font-family:Calibri; font-size:14px; color:#4682B4;">Elockid</b>  ( Talk ) 04:36, 12 November 2011 (UTC)
 * The 206 IP is stale, but I've blocked 173.64.109.64 for two weeks. Note that the IP was blocked a week ago, and then came back and continued the abuse. —  Hello Annyong  (say whaaat?!) 14:52, 13 November 2011 (UTC)

14 November 2011

 * Suspected sockpuppets










 * User compare report Auto-generated every hour.

Same disruptive edits, same personal attacks. Darth Sjones23 (talk - contributions) 04:56, 14 November 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

14 November 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Reported to http://en.wikipedia.org/wiki/Wikipedia:ANI#Yourname.2C_again. 1966batfan (talk) 23:12, 14 November 2011 (UTC)

Personal attacks on User:Sjones2, the alt. account of Sjones23. 1966batfan (talk) 23:54, 14 November 2011 (UTC)

Same as the previous socks. Personal attacks on User:Sjones2. 1966batfan (talk) 00:01, 15 November 2011 (UTC)

Same pattern as previous socks. 1966batfan (talk) 00:27, 15 November 2011 (UTC)

Another trademark of Yourname socks: a suicide thought. 1966batfan (talk) 00:54, 15 November 2011 (UTC)

Same as last IP. Also made personal attack on my talk page. 1966batfan (talk) 01:41, 15 November 2011 (UTC)


 * CU won't link IPs to accounts, but can find sleepers if possible and justify any possible rangeblocks.Jasper Deng (talk) 01:55, 15 November 2011 (UTC)

Rangeblocks are definitely needed here.--1966batfan (talk) 01:59, 15 November 2011 (UTC)

These IPs are coming from several different places. I did Geolocate on them and found that out. This must be some sort of botnet or something.--1966batfan (talk) 02:02, 15 November 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
– There is nothing more that CheckUser can do here than what is currently being done. Rangeblocks are clearly not possible here. –MuZemike 03:22, 15 November 2011 (UTC)
 * Absolutey nothing we can do here.... -- DQ  (t)   (e)  04:56, 15 November 2011 (UTC)

15 November 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

One of a few IP addresses that vandalized my talk page in the same fashion as previous Yourname IPs, causing it to be protected. 1966batfan (talk) 20:27, 15 November 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * CheckUser can't be used here. While a complete rangeblock would require a /19 (as opposed to the current 1 month rangeblock (/23)), this is an open proxy ("Secure Web Unblock"), and as such should be blocked for 5 years because this address is static.Jasper Deng (talk) 00:57, 16 November 2011 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * I've listed that IP on the open proxy project to have someone check it there. The rangeblock will take care of it for us until someone over there looks at it. —  Hello Annyong  (say whaaat?!) 02:51, 16 November 2011 (UTC)
 * The open proxy is ✅, and I've extended the length of the range block. -- zzuuzz (talk) 08:24, 16 November 2011 (UTC)

29 November 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

These are obvious socks; however, since this user has been using open proxies (such as 178.209.46.143), we should have some one check which IPs these accounts used and whether or not each of these IPs is an open proxy. עוד מישהו Od Mishehu 07:56, 29 November 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I came across some IPs mentioned at Administrators'_noticeboard/IncidentArchive727; there is also .  It Is Me Here   t / c 11:05, 29 November 2011 (UTC)

They attacked my talk page, causing it to be protected for almost a month.--1966batfan (talk) 20:26, 29 November 2011 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - T. Canens (talk) 12:45, 29 November 2011 (UTC)

. Nothing much else of interest. <b style="font-family:Calibri; font-size:14px; color:#AD1C24;">Elockid</b>  ( Talk ) 02:39, 30 November 2011 (UTC)

01 December 2011

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

It is rather unlikely, though I'm submitting this SPI anyway because of the attack-ish username. Yourname has often targeted Sjones23; it seems very unlikely that the choice of this username, Kdjones23, was a coincidence. additionally, they triggered filter 445 (intended to block edits with suicide-like phrases, which are often used by Yourname) when they tried to create Childhood phobias, which includes a brief bit related to that. The article seems to show a level of competence I don't see in Yourname, though a CU might be able to clear it up.  HurricaneFan 25  18:48, 1 December 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - This user is certainly suspicious. Endorsing to clarify. —  Hello Annyong  (say whaaat?!) 02:13, 2 December 2011 (UTC)
 * No comment yet on the a/m accounts, but as a related note was blocked. - Mailer Diablo 12:57, 2 December 2011 (UTC)

– Given that Yourname almost exclusively edits from proxies or a botnet, CU won't tell us anything here. You need to go on behavior, and it looks like Kdjones23 is not him based on the likely false positive on the edit filter. –MuZemike 15:10, 2 December 2011 (UTC)
 * with regards to Yourname because of apparent OP use, but ✅ that is .  with regards to a further link to .  AGK   [</nowikI>&bull; ]  15:16, 2 December 2011 (UTC)
 * Could you clarify the duck comment, specifically, per checkuser, are related Kdjones23 and 1smithmaria related to Kdjones233? -- zzuuzz (talk) 00:00, 3 December 2011 (UTC)


 * I've blocked Kdjones23 and 1smithmaria on behavioral grounds. —  Hello Annyong  (say whaaat?!) 01:01, 3 December 2011 (UTC)

02 December 2011

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

Look at the edits. They have Yourname trademarks 1966batfan (talk) 23:17, 2 December 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
You don't need CU to check for open proxies. –MuZemike 23:18, 2 December 2011 (UTC)
 * All these IPs have already been blocked as open Tor nodes. —  Hello Annyong  (say whaaat?!) 01:01, 3 December 2011 (UTC)

30 March 2016

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Going to add more IPs and users momentarily. Just lost a bunch of work so going to file this now and add evidence after.  Eve rgr een Fir  (talk) Please &#123;&#123;re&#125;&#125; 03:14, 30 March 2016 (UTC)

Resurrecting an ancient SPI here based on comments by on Talk:Defecation. Yourname's primary fixation from the beginning was feces and trying to insert images of them (see here as well as examples of edits:, , (warning, nsfw)). There's been an effort to get a video of defecation put on the article defecation since 2009. I became aware of the effort in August 2015 when there was some edit warring over it. See Sockpuppet_investigations/Yourname/Archive and Talk:Defecation/Archive_1 for more on that.

These past couple weeks there's been renew activity regarding the defecation article as well as edits on Sandbox. The first IP listed in the report seems to be the most active of the bunch, but all the IPs seem related (geolocating to Maryland). The IP editors and other user(s) reported generally have the following in common:
 * Geolocation to Maryland
 * Attempts to add images of feces or other shocking images (e.g.,, , )
 * Harassment of users, especially
 * Blanking of own IP user talk pages as well as other users' talk pages, sometimes to replace content with an image (e.g., old IP, old IP, new IP, new IP, newer IP)
 * Campaigning/GAMING discussion to get video or image on Defecation (e.g.,
 * Editing on Sandbox to add shocking images or content (e.g., )

I understand that this SPI might be too old, in which case I'd ask it be moved to the user account listed as a sock. Also, there are many many IP editors and providing diffs for all of them is hours of work. A quick view of their edit histories should show the pattern quickly enough though. I will attempt to order them from "most active" to least.  Eve rgr een Fir  (talk) Please &#123;&#123;re&#125;&#125; 03:34, 30 March 2016 (UTC)

Pinging who just blocked the first IP listed.  Eve rgr een Fir  (talk) Please &#123;&#123;re&#125;&#125; 03:36, 30 March 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I am certainly convinced that 71.166.33.65 and 173.13.205.205, and the 70.192.* addresses are this same user. The others also seem likely, though they're somewhat older. I could probably find an actual claim from the 70.192.* addresses to be this user if anyone's that interested. However the behavioural analysis makes this somewhat unnecessary. -- zzuuzz (talk) 08:12, 30 March 2016 (UTC)
 * Curious, did one of the IPs publicly state they were Yourname? Or am I misunderstanding you. (Not necessarily to find, but would be interesting to know). FWIW, I filed this SPI mostly so we have something to point to when disruption occurs. Users are likely unfamiliar with this, like I was until your comment, and it would help when filing AIV reports or just shutting down disruption in general.  Eve rgr een Fir  (talk) Please &#123;&#123;re&#125;&#125; 17:21, 30 March 2016 (UTC)
 * 70.192.203.102 and 70.192.210.2 did recently, though it's admin-only. There has recently been a spate of abuse from this range, all the same user, and rather obviously it is indeed this user. You'll have seen Administrators%27_noticeboard/IncidentArchive917 and Administrators%27_noticeboard/IncidentArchive917 - same user. -- zzuuzz (talk) 17:32, 30 March 2016 (UTC)
 * Thank you!  Eve rgr een Fir  (talk) Please &#123;&#123;re&#125;&#125; 18:29, 30 March 2016 (UTC)


 * Noted, thank you Zzuuzz. --Malcolmxl5 (talk) 15:13, 31 March 2016 (UTC)
 * I had blocked 71.166.33.65, and certainly don't object to that being extended into a longer block. Thanks everyone. Paul Erik  (talk) (contribs) 16:27, 31 March 2016 (UTC)

Adding Skyxox109 and 109.7.228.225 and 188.191.30.45. What an odd perseveration this user has.  Eve rgr een Fir  (talk) Please &#123;&#123;re&#125;&#125; 21:56, 31 March 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Putting on my admin hat, I think it's fairly conclusive that the 70.192.* addresses are Yourname. There is currently a short-term block on 70.192/16. Previous range blocks have been applied to 70.192.192/18 and 70.208.128/19

173.13.205.205 and 71.166.33.65 are also the same user - the IPs have probably been static for several months and can probably both expect a longer block.

The IPv6 address is making identical edits from the same network, although some time ago. 2600:1003:b000::/36 is currently blocked, and has been blocked repeatedly.

96.244.249.58 looks like some kind of proxy to me, though it's also Verizon and geolocates to the right area. I think we can safely conclude it's the same user.

98.117.33.218 and 71.246.89.7 are somewhat stale, but it looks like the same user. I don't think we can reach any conclusion about Iamafatlard - the account is blocked.

Pinging a couple of users for FYI. 123. Bar lengthening the aforementioned blocks, this can be closed. -- zzuuzz (talk) 14:57, 31 March 2016 (UTC)
 * Registered users area already blocked. All IPs are rither blocked or stale. Case closed.  Vanjagenije  (talk)  15:42, 22 April 2016 (UTC)

08 April 2016

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Obscene images at WP:Sandbox. Special:Contributions/109.7.228.225 has an admission of sockpuppetry. &mdash; Andy W. (talk · contrib) 22:54, 8 April 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I'm declining the CU request (I haven't read the rest of this); CheckUser generally doesn't publically link IP addresses to usernames (unless there's something I'm missing here). Thanks, Kevin ( aka L235 ·&#32; t ·&#32; c) 04:36, 10 April 2016 (UTC)


 * Most of these IPs are this same user (66.167.141.20 is not). It's likely some proxy service is being used, in addition to the IP ranges mentioned in the previous report (undocumented here). Most of these proxies are not long term, but those that are are tending to experience longer blocks. This can be closed. -- zzuuzz (talk) 23:59, 10 April 2016 (UTC)
 * All of those IPs are either stale or already blocked. Case closed.  Vanjagenije  (talk)  15:39, 22 April 2016 (UTC)