Wikipedia:Requests for checkuser/Case/Littleteddy

If you are creating a new request about this user, please add it to the top of the page, above this notice. Don't forget to add
{{Wikipedia:Requests for checkuser/Case/Littleteddy}}
to the checkuser page here. Previous requests (shown below), and this box, will be automatically hidden on Requests for checkuser (but will still appear here).
The following discussion is preserved as an archive of a Request for checkuser. Please do not modify it.

Littleteddy

request links: main • edit • links • history • watch
Filed: 13:19, 27 March 2008 (UTC)

Noting that I still don't believe LT was ever involved, so this is more a check against the other accounts such as User:Cg9806 and User:Goodbo - this spate of vandalism over the last two days is entirely consistent with some of the other accounts, including shall we say some favourite themes of the young editors in question. Note that the "Timeshift" nick is an attempt to impersonate User:Timeshift9, a regular at the Australian Politics wikiproject - another consistent theme is attacking editors who bust them. Orderinchaos 13:19, 27 March 2008 (UTC)[reply]

Note also the case at IP check initiated by Lucasbfr, which mentions the following accounts. One is clearly a CG sockpuppet, but I won't give away how I know on here.
Orderinchaos 13:37, 27 March 2008 (UTC)[reply]

Littleteddy

request links: main • edit • links • history • watch
Filed: 02:20, 20 March 2008 (UTC)

While checking IPs of vandal accounts, I discovered that Littleteddy is  Confirmed as the puppetmaster of the following accounts:

In addition he is  Likely the puppetmaster of these accounts:

Extended content

Thatcher 02:20, 20 March 2008 (UTC)[reply]

Hi, I can't see the connection here - my IP according to whatismyipaddress.com is 203.189.4.98. I use a shared computer to edit... maybe that is it? I have frequently neglected to log out in the past and I found that my account was twice used for vandalism. I'll also copy this to AN/I. Littleteddy... keep me in a good mood 03:18, 20 March 2008 (UTC)[reply]
 Clerk note:The conversation doesn't seem over yet. -- lucasbfr talk 13:58, 20 March 2008 (UTC)[reply]
I don't see why, as it seems to be a simple unrelated to me. Littleteddy... keep me in a good mood 14:03, 20 March 2008 (UTC)[reply]
Taking my admin hat off here, the account names above do not correlate from a common-sense point of view to the person I've come to know from a distance offline. In general he writes with proper English, has a particular way about him etc and the above just looks like stereotypical teenage vandalism. (Per WP:BEANS I won't outline what other features Littleteddy consistently exhibits, but good faith admins/checkusers are more than welcome to ask privately.) Question to checkusers - is there clear cases of sockpuppetry between 7am and 3pm UTC (which corresponds to afternoon our time, after everyone's gone home from school), or are they limited to Perth daytime hours (roughly 11pm to 7am UTC)? Orderinchaos 15:59, 20 March 2008 (UTC)[reply]
There is additional information on my talk page. The edits are made within the same time frame as Littleteddy's normal editing, which seems to be 5pm-11pm Perth time. Gnangarra on my talk page says he attends a residential school. The accounts I marked as "confirmed" edit from the same ISPs as Littleteddy, usually on the same day. The "likely" edits are on IP addresses in the same ranges with other identifying characteristics. I don't know how the school IT dept is configured; whether there really are shared IPs, whether students have internet in the rooms or only libraries and such, etc. The technical evidence can not rule out the possibility that these are friends and fellow students playing silly buggers, neither can it rule out the possibility that this is the work of a single individual, or even a hybrid explanation. For example, at one point Littleteddy makes an ordinary edit, and 4 minutes later someone from the same IP and user agent makes a logged-out edit containing an offensive remark toward an admin. Without a time-traveling reverse web cam, there is no way for me to know who made that edit, but those kinds of synchronicities show up many times. Thatcher 16:14, 20 March 2008 (UTC)[reply]
Have had offline confirmation (not from the user concerned, but from another person associated with the school) that there are several real names of Year 9 and 10 (14-15yo) students at the same school in and with the above. (Darryl Hair, meanwhile, is a controversial cricket umpire who made news a year or two ago.) Orderinchaos 19:42, 20 March 2008 (UTC)[reply]
  • (Cross-posted from AN/I) This is somewhat technical, and I can not share the specifics, obviously. However, I attempted to analyze Littleteddy's IP use with whois and traceroute. The IP he gives above, 203.189.4.98, is true, and is registered to Crox Development, and there are shenanigans on it, and it is certainly plausible that it is a shared IP at his school. Littleteddy has used over a dozen other IP addresses registered to a different ISP that I will call "Kangaroo." Some of these IPs only have Littleteddy's edits but some of them also have shenanigans. There are also a large number of vandal-only accounts that also use "Kangaroo" IPs and traceroute puts them on the same network branch with the same first-upstream-server as IPs used by Littleteddy. I can not be positive that Littleteddy's school does not have internet service from two different providers, but it seems unlikely. I can not be positive that the "Kangaroo" IPs are not shared, but it seems unlikely. It seems more likely that "Kangaroo" ISP edits come from Littleteddy's home. That's about the most I could ever say technically. Make of it what you will. Thatcher 16:21, 21 March 2008 (UTC)[reply]
The above discussion is preserved as an archive of the Request for checkuser. Please do not modify it.
Subsequent requests related to this user should be made above, in a new section.


Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Requests_for_checkuser/Case/Littleteddy&oldid=1138657731"
Uses material from the Wikipedia article Wikipedia:Requests for checkuser/Case/Littleteddy, released under the CC BY-SA 4.0 license.