English Wikipedia @ Freddythechick

English Wikipedia @ Freddythechick:Sockpuppet investigations/Atac2/Archive

< English Wikipedia @ Freddythechick:Sockpuppet investigations/Atac2


Atac2

Atac2 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)

13 December 2021

Suspected sockpuppets


The master account was committing vandalism with addition of false information to various articles by adding "Ron Merkle" to them, including the Scientology article. The Santana Smooth account has repeated the same addition in Scientology.

The master account repeatedly made this edit which is did not have the name in the source and is likely false information. The Julius Al Mohammed account has made a similar edit.

The Jamal Tyrones account added deliberate false information (SF and LA are in the same coast) to the article which mentions "Ron Merkle". This might be a legit Ron Merkle as it is information from years back in the article history.

Note: Only the Julius Al Mohammed account seems to have been created after user:Widr blocked Atac2, so it would not be surprising if there are other accounts. Whpq (talk) 18:00, 13 December 2021 (UTC)

It looks like some IP accounts, like User:2A00:23C7:84A7:4B01:4464:BD16:CF63:3C25, have picked up on the vandalism. Liz Read! Talk! 02:41, 14 December 2021 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  •   In progress - Girth Summit (blether) 18:46, 13 December 2021 (UTC)
  • Santana's Smooth and Julius Al Mohammed are both   Confirmed to Atac2. The other account doesn't appear to be related, technically at least. Girth Summit (blether) 18:54, 13 December 2021 (UTC)
  • Jamal hasn't edited in over a month, so a block would not be in compliance with WP:BP. I'll close this; please file another report if disruption persists. -- RoySmith (talk) 00:28, 17 December 2021 (UTC)

07 January 2022

Suspected sockpuppets


Previous socks were inserting the name "Ron Merkle" into various articles. Same behaviour including adding teh assertion of a gyrocopter record for coast-to-coast speed when the starting and ending cities are on the same coast. Plus the user name. Is Wikipedia:Sockpuppet investigations/Molotov Cock related to this? Whpq (talk) 13:02, 7 January 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

10 January 2022

Suspected sockpuppets


These accounts were connected to previous socks through checkuser and technical evidence. I'm creating this SPI retro-actively for record-keeping and accountability purposes. The accounts are blocked and tagged, and this SPI report will be filed as 'closed'. ~Oshwah~(talk) (contribs) 00:21, 10 January 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

These accounts are already blocked and tagged, and this SPI is already closed. No further action is needed here (short of archiving, of course)... ~Oshwah~(talk) (contribs) 00:24, 10 January 2022 (UTC)

02 March 2022

Suspected sockpuppets

While both accounts were already blocked today — the sock by Liz and the presumed puppeteer by Jake Wartenberg — the sock turned out to be a month-old sleeper. Therefore, I would like to use this SPI to request a CheckUser to look for further sleepers. IceWelder [✉] 21:26, 2 March 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

26 June 2022

Suspected sockpuppets

"Ron Merkle" nonsense like multiple other socks: [7]

Requesting CheckUser for sleeper check. Edits by these socks often go unnoticed, so I need to know whether there are currently unknown puppets. IceWelder [✉] 16:03, 26 June 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • Behaviourally, this looks like a match, so I am blocking and tagging as suspected. I've looked at the CU records, and I don't see any other accounts. I actually wonder whether this account was hijacked - this account was created in 2012, and made a single edit (which was vandalism). The CU data shows attempts to log into a bunch of old, abandoned accounts. This was the only success that I saw - perhaps the password was just 'password' or similar, and easily guessable, but once it had been accessed, the Ron Merkle nonsense started. Use strong passwords, folks. Girth Summit (blether) 17:50, 26 June 2022 (UTC)

16 July 2022

Suspected sockpuppets

"Ron Merkle" nonsense once again.[8][9] The former account was already active in May, before I last requested a sleeper check, which apparently came up empty-handed. The user is active from an IP range as well (Special:Contributions/2001:14bb::/37)[10][11][12][13][14][15][16] with IPs changing multiple times a day. Maybe a range block is in order. Can a user be prevented from logging in on a blocked range? IceWelder [✉] 18:08, 16 July 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I am not Atac2. — Preceding unsigned comment added by The Lord Above (talk • contribs) 01:58, 17 July 2022 (UTC)

  • @Materialscientist: You unfortunately had to deal with several socks this night. What do you think about the few I listed above that have not yet been blocked, as well as the IP range? IceWelder [✉] 06:22, 18 July 2022 (UTC)

Huh. General Kerr Melon (talk) 07:11, 18 July 2022 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

It's difficult to be specific, but these are all apparently related to each other. Going mostly by behaviour, Atac looks about right. I've blocked about 30 related accounts,[17] using various levels of confirmation to other accounts. Most are compromised. Many are on proxies. -- zzuuzz (talk) 22:25, 18 July 2022 (UTC)

21 July 2022

Suspected sockpuppets

"Merkle" vandalism including page moves, plus [18]. --Blablubbs (talk) 21:53, 21 July 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

22 July 2022

Suspected sockpuppets

[19]. Sleeper check requested like always. IceWelder [✉] 07:19, 22 July 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

Confirmed. Other compromised accounts:

-- zzuuzz (talk) 07:58, 22 July 2022 (UTC)

FWIW, Jamieis8 is now the oldest account, but I don't know if there's any value in renaming the case. -- RoySmith (talk) 12:23, 22 July 2022 (UTC)
I don't think so. We've gotten a new oldest account since this one was discovered, and there will probably be more down the line (and I'm not a huge fan of having compromised accounts listed as masters anyway). --Blablubbs (talk) 05:45, 23 July 2022 (UTC)
  • Yes, same party. These accounts have been compromised:

-- zzuuzz (talk) 00:49, 23 July 2022 (UTC)

  Global lock(s) requested. --Blablubbs (talk) 08:15, 23 July 2022 (UTC)

23 July 2022

Suspected sockpuppets

[20]. Already blocked but reported for tagging and CU. IceWelder [✉] 08:18, 23 July 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

There is another account, AngelaMerkelFan. I saw it at WP:ANI. Quandane Dingle (talk) 08:58, 23 July 2022 (UTC)

Noting Quandane Dingle, renamed to Tennismanlol5190 is check user blocked. Deepfriedokra (talk) 19:17, 23 July 2022 (UTC)
But not part of this sock farm.--Bbb23 (talk) 20:32, 23 July 2022 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

24 July 2022

Suspected sockpuppets

[21]. Requesting sleeper check yet again. IceWelder [✉] 18:26, 24 July 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

Confirmed, near enough.   No sleepers immediately visible. -- zzuuzz (talk) 18:40, 24 July 2022 (UTC)

29 July 2022

Suspected sockpuppets

Account evidently compromised today.   Blocked without tags,   Global lock(s) requested. Requesting check for other compromises by the same master. (Guessing you might also find a lot of failed login attempts against some accounts.) -- Tamzin[cetacean needed] (she|they|xe) 07:15, 29 July 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  •   Self-endorsed by clerk for checkuser attention. -- Tamzin[cetacean needed] (she|they|xe) 07:15, 29 July 2022 (UTC)

30 July 2022

Suspected sockpuppets

Another clear compromise. This one doesn't have the same obvious method of compromise as the last one.   Blocked without tags.   Global lock(s) requested. CU requested for sleepers again. -- Tamzin[cetacean needed] (she|they|xe) 02:42, 30 July 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  •   Self-endorsed by clerk for checkuser attention -- Tamzin[cetacean needed] (she|they|xe) 02:42, 30 July 2022 (UTC)
  • Checked this earlier. Nothing else to be done. -- Amanda (she/her) 08:18, 30 July 2022 (UTC)

30 July 2022

Suspected sockpuppets

Already blocked; reporting for tagging and sleeper check. IceWelder [✉] 08:43, 30 July 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  •   Clerk declined since we've already had a sleeper check in the past few hours. And I'm gonna decline to tag, seems like Atac likes the attention. Closing. -- Tamzin[cetacean needed] (she|they|xe) 09:35, 30 July 2022 (UTC)

31 July 2022

Suspected sockpuppets

More compromised accounts. IceWelder [✉] 08:56, 31 July 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

31 July 2022

Suspected sockpuppets

Both have exceedingly long usernames, both accounts first edits were to their user page adding dashes in 9 edits then blanking them (obvious attempt to game the system for autoconfirmed status) Lavalizard101 (talk) 11:38, 31 July 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

01 August 2022

Suspected sockpuppets

'nother compromise. Already locked. CU for sleepers. -- Tamzin[cetacean needed] (she|they|xe) 04:30, 1 August 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  •   Self-endorsed by clerk for checkuser attention -- Tamzin[cetacean needed] (she|they|xe) 04:30, 1 August 2022 (UTC)
  • Doesn't look like anything more. -- Amanda (she/her) 09:21, 1 August 2022 (UTC)

13 August 2022

Suspected sockpuppets

[22]. Sleeper check requested as usual. IceWelder [✉] 19:44, 13 August 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

Confirmed, compromised. Several glocks requested. -- zzuuzz (talk) 21:57, 13 August 2022 (UTC)

16 August 2022

Suspected sockpuppets

Duck. Sleeper check please. IceWelder [✉] 21:08, 16 August 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

Confirmed to this previous sock.   No sleepers immediately visible. -- zzuuzz (talk) 21:19, 16 August 2022 (UTC)

29 August 2022

Suspected sockpuppets

This user has just created 49 pages about a Ronald Merkle with the ever so slightest variations in the same. Seems likely that based on the Ronald Merkle spam they're this sockpuppeteer. Hey man im josh (talk) 16:29, 29 August 2022 (UTC)

For those who are as confused as I was, the "slightest variations" consist of things like using an upper case "I" in place of a lower case "l", which looks identical in some fonts. -- RoySmith (talk) 16:36, 29 August 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • The account is now indeffed. Tagging and closing. Bbb23 (talk) 16:37, 29 August 2022 (UTC)
    We edit-conflicted, but   Confirmed to Atac2. And, wow, going back to 2009! Probably worth a case rename. -- RoySmith (talk) 16:47, 29 August 2022 (UTC)
    I strongly advise against renaming. They keep compromising old accounts (there's one in the archive that was created in 2001), so we might be moving and retagging quite frequently. It would also be fairly confusing if the original owners regain access to their accounts. --Blablubbs (talk) 16:52, 29 August 2022 (UTC)
    Actually, @Zzuuzz: you previously identified a lot of Atac2 socks as compromised accounts. Maybe this is another of those? I'm still a little hazy on how to spot compromises, but you seem to have it figured out. -- RoySmith (talk) 16:54, 29 August 2022 (UTC)
    @Blablubbs, as is often the case, I see you were one step ahead of me :-) -- RoySmith (talk) 16:55, 29 August 2022 (UTC)
    Definitely compromised, and I'll just mention that I/we blocked/glocked a bunch of Atac2/compromised accounts earlier today. @RoySmith: I'll drop you an email later. But for now, if it's older than a few months and spouting merkle, assume it's compromised. -- zzuuzz (talk) 17:13, 29 August 2022 (UTC)

29 August 2022

Suspected sockpuppets

Leonidlednev (talk) 03:00, 29 August 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

03 December 2022

Suspected sockpuppets

More insertion of 'Ron Merkle' into articles: [23], [24]. Also, 'Return of the Merkle' suggests it's not this user's first rodeo. ◇HelenDegenerate◆ 18:27, 3 December 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • Now blocked. Spicy (talk) 21:31, 3 December 2022 (UTC)

21 December 2022

Suspected sockpuppets

[25]. WP:DUCK ◇HelenDegenerate◆ 21:01, 21 December 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I wholeheartedly disagree with this rude accusation. Ach afri ke (talk) 21:08, 21 December 2022 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

  • Blocked, closing. Bbb23 (talk) 21:12, 21 December 2022 (UTC)

21 December 2022

Suspected sockpuppets

[26] IceWelder [✉] 21:47, 21 December 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • Blocked, closing. Bbb23 (talk) 22:05, 21 December 2022 (UTC)

21 December 2022

Suspected sockpuppets

[27], [28] IceWelder [✉] 21:48, 21 December 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • Blocked, closing. Bbb23 (talk) 22:06, 21 December 2022 (UTC)

22 December 2022

Suspected sockpuppets

More Ron Merkle nonsense. I've already blocked the account but a check for sleepers may be in order. Whpq (talk) 13:50, 22 December 2022 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

Confirmed, along with the following, who currently need a glock:

-- zzuuzz (talk) 11:31, 24 December 2022 (UTC)

Retrieved from "https://enwiki.freddythechick.net/index.php?title=English_Wikipedia_@_Freddythechick:Sockpuppet_investigations/Atac2/Archive&oldid=6081811"