The following discussion is an archived debate of the case of suspected sockpuppetry. Please do not modify it. No further edits should be made to this page. All edits should go to the talk page of this case. If you are seeing this page as a result of an attempt to open a new case of sockpuppetry of the same user, read this for detailed instructions.

User:Benkenobi is a retardate[edit]

Suspected sockpuppeteer

Benkenobi is a retardate (talk · contribs · deleted contribs · page moves · block user · block log)

Suspected sockpuppets

Auson (talk · contribs · deleted contribs · page moves · block user · block log)
Ausonia (talk · contribs · deleted contribs · page moves · block user · block log)
Italicus (talk · contribs · deleted contribs · page moves · block user · block log)
Catholicus (talk · contribs · deleted contribs · page moves · block user · block log)
189.31.111.134 (talk · contribs · deleted contribs · page moves · block user · block log)

Report submission by

• ~ Troy (talk) 19:01, 27 August 2008 (UTC)[reply]

Evidence

• It has already been confirmed that Ausonia and Italicus were socks of 200.215.40.3 (see Wikipedia:Suspected sock puppets/200.215.40.3 for all of the previous IPs that were involved)

• The usernames are extremely similar and the edit summaries are really redundant.

• User:Auson was indefinitely blocked for harassment of users and manipulating sock accounts (see the Block log).

• According to that block log, Auson tried to evade a block when User:Benkenobi is a retardate was indefinitely blocked

• Benkenobi is a retardate is listed as a record of the first known user account operated by the same person ...who goes as far back as 200.215.40.3. "Benkenobi is a retardate" is also the first highly suspected account that is available to me now, as the IP addresses keep changing in the same old malicious manner (I wasn't even able to list absolutely every single IP in the other report; ie: 189.73.73.228).

• After I reverted one of User:Auson's page moves on 26 August, User:Catholicus moved the same page again (see the history of List of Roman Catholic Bishops of Kraków).

• 189.31.111.134 is evidently the same user as 189.31.111.24, both of which are in an immense IP range (for simplification; they can both be found in the close range of 189.31.111.0/24). Moreover, both have similar editing patterns, and if their identities match, the more recent IP has the potential to evade blocks.

• The IPs have several global (cross-wiki) contributions: the most notorious one was originally 200.215.40.3; the most recent one is 189.31.111.134.

• All of the IPs edit similar subjects as the user accounts (ie: Catholicus's edit on Sigismund, Holy Roman Emperor and 189.31.111.134's edit just 36 minutes later).

• Most importantly, all of the IPs are registered by an ISP based in South America, all of the WHOIS reports state that the ISP is Latin American and Caribbean IP address Regional Registry (see the WHOIS reports for 200.215.40.3 and 189.31.111.134).

• 189.31.111.134 [cross-wiki contribs] diff changed the template on Pope Benedict VI just like Auson contribs diff did on Template:Pope (which is being considered for deletion, but that's besides the point).

• User:Auson tried to evade the block of User:Benkenobi is a retardate and still attempted to harrass User:Benkenobi18 with this edit. It should be noted that User:Ausonia (talk|contribs) and especially User:Auson, made several page moves that were undiscussed, which puts what Auson said in contradiction.

• Every user I warned/notified became more active and responded negatively: when I filed the report for 200.215.40.3, 201.67.241.178 went too far and continued edit warring. That user was blocked for instigating an edit war. A few minutes later, Italicus did the exact same thing until he/she was also blocked (for 24h). For a third time, User:Ausonia continued that edit war within less than 24 hours. All of these users are either evaded blocks or worked under the same articles in the same manner. Even while this is being reported today, Ausonia's edits are continuing.

• All of these accounts have (creation) logs that were subsequent. In short, this means that all of the sock accounts are held under the possesion of the same person except for the indefinitely blocked ones (Benkenobi is a retardate and Auson). This poses the risk of the same debacle that I had with the accounts that happened the last time I filed a sock report.

• Almost all of these users say "rv unexplained edit" or "rv unexplained change" or "rv vandalism in several edit summaries. This is really just over-using the term and, sometimes (particularly with Auson's edits), the previous edit was explained, which (again) contradicts the edits made by these socks and, quite frankly, indicates that these editors are not willing to discuss their controversial page moves, major edits, or name changes (which either redirect to another page or are against naming conventions). Also, see Wikipedia:Vandalism#Types of vandalism for clarification on edit summaries (listed as "sneaky vandalism").

• Users that use starkly similar edit summaries are as follows (not including IPs): Auson, Ausonia (older 50), 201.67.241.178 and Italicus.

• In diff pages (and a few edit summaries), these users make POV statements. While people are free to have personal bias (basic rights, of course), it should not be incorporated into the article just because of their personal POV per se. According to WP:NPOV, if there is a POV, it should be compared/contrasted properly with all other POVs which, in a subtle sense, should be inclusive and not favour one side over the other. There are so many POV summaries and changes, and thus, there is no need for me to explain them to the same extent as before (it has been examined somewhat before with that other report). However, I will note that even the recent edits (like to Sigismund, Holy Roman Emperor) are POV-oriented (ie: edit summary by Catholicus:"The head of Christendom is the Pope"; it's a claim and can be said as an opinion, but to be fair, it is to be counted as a "fact" for an NPOV).

• Since vandalism is described as "any addition, removal, or change of content made in a deliberate attempt to compromise the integrity of Wikipedia", then almost all (if not all) of these edits can be described as such. Also, if I notice any similar edits by these users before this case is carefully looked at, I will revert them immediately based on those grounds and will ask for assistance if needed. Further, I demand that these users withdraw from any such juvenile edits, tactics or desperation for making the same changes without being fair to other users.

• Just a brief recap: asides from all of the above issues, the evidence is pretty much based on these simple facts ...similar editing behaviour, similar user names/tactics, edit summaries used over and over again, and IPs that are all registered under the same ISP and start with either "200. ...", "201. ..." or "189. ...".

Comments

• -I would like to add that if any a checkuser matches any of these users as "confirmed" sock puppets, then please deal with the issue under the following conditions:

1. That every account involved gets blocked indefinitely and that email is blocked as a precaution for preventing any form of harassement (that includes unblocking the already indefinitely blocked accounts and then reblocking with the addition of email de-activation).
2. That all cross-wiki (IP) contributions be carefully looked at and reverted. As another precaution, I strongly suggest that those Wikimedia projects be monitered in the case of further socks (which may result in blocks over there). Keep in mind that I know what I am talking about with Wikipedia's policies on blocking: it is not to be confused with (community) bans and is to prevent articles from being negatively affected (not to punish users).
3. That any trusted administrator who looks at this case may be someone that I can quickly refer to about more of these sock puppets in any future event: it is not usually safe to confront the issue alone.

...please make sure that we don't miss anything here. Thanks, ~ Troy (talk) 19:01, 27 August 2008 (UTC)[reply]

Conclusions

• I've cleared out a pretty obvious sock drawer. There were six as-yet unused socks in the pile as well. There were several dozen different IPs used, so interwiki blocks and contributions won't be particularly enlightening. Is there actually a history of email abuse by this editor? (Pardon me if I missed it.) --jpgordon^∇∆∇∆ 21:08, 27 August 2008 (UTC)[reply]
  • First of all, please also pardon my long report. To answer your question: "no", there wasn't email abuse, but I don't want to risk it. It was just a suggestion as I was still remembering the events from last time. Other wiki projects have only been affected by the IPs, and so that is very hard to track. However, as I was careful to spot it, I thought that it was worth mentioning. Further, the rarely used socks, as you may have noticed, were likely spares in order to evade blocks. For that reason, blocking all of the user accounts would at least put a dagger in all of those undiscussed page moves. The IPs, on the other hand, are too risky. I think that we need careful monitering for those. If there should only be IP blocks in extreme cases, then I suggest that users just be aware of this guy and revert any edits that could be POV, controversial, or undiscussed when they really should be. I have been meaning to ask: do we need a checkuser for the less obvious ones (and may be Italicus)? Thanks, ~ Troy (talk) 22:06, 27 August 2008 (UTC)[reply]
    • Oh, sorry I didn't make it clear enough -- all these usernames have been checkusered and blocked. The IPs include what appear to be major providers in a large country, so not much can be done there. --jpgordon^∇∆∇∆ 22:55, 27 August 2008 (UTC)[reply]
      • That's alright. I didn't make myself clear either: I'm not asking about the IPs (unfortunately, there's waay too many of them). I'm asking about Italicus. According to his block log, he wasn't indefinitely blocked. Is ...that right? ~ Troy (talk) 23:10, 27 August 2008 (UTC)[reply]
        • Accidental omission on my part. --jpgordon^∇∆∇∆ 23:12, 27 August 2008 (UTC)[reply]
• Well, at least it's alright now. You're a checkuser? No wonder I asked for your help. It was getting out of hand the last time I filed the case. It was all over me ...but now that that's over with, I still have a couple of concerns (:|). Firstly, what should I do if this happens again? I don't want to waste the time of admins or other folks, but I am quite powerless with handling with socks by myself. If there's a guy who will be familiar with this case so that I don't have to repeat myself, that would be great. I am still a little disturbed from the contribution-stalking from last time. ~ Troy (talk) 23:35, 27 August 2008 (UTC)[reply]
  • Oh! I assumed that's why you asked for my help in the first place! Since this guy is a confirmed sockpuppeteer, you can just list it at WP:RFCU, and one of us will get to it. --jpgordon^∇∆∇∆ 00:48, 28 August 2008 (UTC)[reply]
    • Sorry, I was busy with the cross-wiki edits. Well, I will list it there if you don't mind. Also, check out the Portugese article on "His Holiness". The similar/same bunch of IPs just bombarded that page ...eventually, it subsided, but I didn't even notice! If the guy wasn't in such a huge range, I would've been able to hunt down his edits project by project, but unfortunately, I can't. I did come across cross-wiki edits/vandalism once before (that was when I was casually looking at different projects). ...Well, now I have two thoughts: A: somehow deal with the cross-wiki stuff and B: list it at RFCU. ~ Troy (talk) 00:57, 28 August 2008 (UTC)[reply]
      • Definitely the same person at ptwiki. I'll mention it on the checkuser mailing list. --jpgordon^∇∆∇∆ 01:25, 28 August 2008 (UTC)[reply]

---