Wikipedia:Sockpuppet investigations/Theserialcomma/Archive

• Duke jd (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

After receiving a ten day block for harassment on November 6, Theserialcomma proclaimed their intention to immediately resume editing under a different account. On November 8, new user account Duke jd made their first edit to Tucker Max, continuing to push Theserialcomma's agenda and using an edit summary stylistically identical to the ones used by Theserialcomma. As Theserialcomma is blocked, this is block evasion on their part.

Per WP:DUCK I believe Checkuser is not necessary. Seth Kellerman (talk) 17:22, 9 November 2010 (UTC)[reply]

• User compare report

Auto-generated every six hours.

See Defending yourself against claims.

i think you've made an error in blocking theserialcomma/theserialcomma2 in relation to sockpuppetry. theserialcomma was not blocked when i made theserialcomma2 just to post on this spi report. i made theserialcomma2 to post because i scrambled the password to theserialcomma so it wouldnt be possible to log into. but theserialcomma was not a blocked account at that time, so it wasn't block evading or sockpuppetry. i'm not sure you realized that theserialcomma was not blocked at the time and it was not a case of sockpuppetry to make a new account and abandon the other one. i'd like for you to unblock the erroneous block you made, except i scrambled all the passwords so it's pointless i guess. i'm also scrambling this password and not using this account again either. my new (unnamed) account is unaffected by any of this as i've not edited with it while other accounts were blocked, so it's also not a case of sockpuppetry. i have no idea who jd duke is. obviously ive abandoned this wikipedia name and any further action is kinda pointless, but i thought i'd just mention that 'abusing multiple accounts' never occurred since theserialcomma/theserialcomma2 were obviously the same person and neither were blocked at the time in question Theserialcomma3 (talk) 05:59, 30 November 2010 (UTC)[reply]

• I made some comments here regarding this editor and sockpuppetry. The material I uncovered likely should not be posted on-wiki per WP:LTA but I will share what I have via email on request. --Tothwolf (talk) 12:09, 12 November 2010 (UTC)[reply]

• I'm not seeing it. Diffs, please. T. Canens (talk) 17:59, 9 November 2010 (UTC)[reply]
  • Compare Duke jd's one edit [1] to these edits by Theserialcomma. [2] [3] [4] [5]. Read the edit summaries.
    
    I'm reluctant to post a long description of Theserialcomma's editing stylistic idiosyncrasies because if he's going to engage in sockpuppetry it would be unhelpful for him to know anything that might help him avoid detection. I currently have email disabled, but would be willing to enable email to communicate off-wiki with an interested administrator.Seth Kellerman (talk) 23:07, 9 November 2010 (UTC)[reply]
    • I've uncovered a number of diffs that show similarity between the edit made by Duke jd and edits made by Theserialcomma, but while searching for these, I also uncovered two more accounts which appear to be sockpuppets. I don't think I should post this material on-wiki yet for the same reasons Seth Kellerman mentioned above but I'll gladly share it with a CU via email. --Tothwolf (talk) 15:05, 12 November 2010 (UTC)[reply]
      • You could email MuZemike (talk · contribs), he is a pretty active CU. You could also email functionaries-l or checkusers-l. There is also IRC if you use it. -- DQ (t) (e) 18:50, 12 November 2010 (UTC)[reply]
        • I've emailed the material to functionaries-en. --Tothwolf (talk) 19:43, 12 November 2010 (UTC)[reply]

Any updates? Nakon 04:14, 21 November 2010 (UTC)[reply]

• I'm not sure on the style here, but since the user claims that they have a new account a checkuser is warranted on that ground alone, per WP:SCRUTINY and WP:EVADE. T. Canens (talk) 21:19, 25 November 2010 (UTC)[reply]
  • Given the material I sent to the functionaries list, I highly doubt the IP used by User:Duke jd would directly match the last IP used by User:Theserialcomma. At the time User:Duke jd made the edit Seth Kellerman linked to above, the IP last used by User:Theserialcomma would have been autoblocked anyway. There was however a test edit made with another IP shortly after User:Theserialcomma was blocked which is connected with the material I sent to the functionaties list and that IP might possibly match the IP used by User:Duke jd. The same IP also made a test edit after shortly after User:Theserialcomma's first block in July 2009, too. Beyond this however, I'm not sure I should publish too much of the details on-wiki just yet per WP:LTA. --Tothwolf (talk) 21:15, 26 November 2010 (UTC)[reply]

• Hmmm - okay, well while Theserialcomma2 (talk · contribs) is  Confirmed as being Theserialcomma (talk · contribs) (no surprises), the other account, Duke jd (talk · contribs) - is  Inconclusive, as it uses a mobile ISP and is editing from a cellphone. While the IP geolocates to quite a different place to the other accounts, it's largely unknowable as this particular ISP isn't very reliable when it comes to reliable geographic location - Alison ^❤ 05:43, 27 November 2010 (UTC)[reply]

Blocked Theserialcomma2 (talk · contribs · deleted contribs · logs · filter log · block user · block log), no action on Duke jd (talk · contribs · deleted contribs · logs · filter log · block user · block log), as CU was inconclusive and has only made one edit. Nakon 17:50, 27 November 2010 (UTC)[reply]

 Clerk note: I have unclosed and  Relisted this case as it has been brought to my attention that this is still an ongoing case and there is private evidence involved. I note that it would be preferable to leave this case's closure to functionaries only. --Shirik (Questions or Comments?) 00:20, 28 November 2010 (UTC)[reply]

For the record: I don't see any violation of WP:SOCK on Theserialcomma2's part, so I have unblocked it. Amalthea 00:54, 4 December 2010 (UTC)[reply]

 Administrator note Blocked Theserialcomma3 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) as this is block evasion, plain and simple. --Shirik (Questions or Comments?) 06:02, 30 November 2010 (UTC)[reply]

Question. After the abuse of multiple accounts and the outing attempt by Theserialcomma2, would it not be reasonable to indef the person behind all the Theserialcomma usernames? Seth Kellerman (talk) 21:49, 1 December 2010 (UTC)[reply]

It seems that way to me. Theserialcomma should be indeffed. - Burpelson AFB ✈ 19:43, 3 December 2010 (UTC)[reply]

Theserialcomma2 did not abuse multiple accounts. Amalthea 00:54, 4 December 2010 (UTC)[reply]

Since when was making an undisclosed new account after being blocked and harassing other users with throwaway socks not considered abuse of multiple accounts? Seth Kellerman (talk) 07:48, 4 December 2010 (UTC)[reply]

The account was disclosed as an alternate through the name and through the edit. The original account was not blocked at the time of the edit. Any larger alleged pattern of abuse is beyond this forum. Amalthea 11:02, 6 December 2010 (UTC)[reply]

 Note: Agree, however, the user has resumed a campaign of harassment, so I have now indef blocked all the accounts, the original, and the replacement, for that behavior (not for sock puppetry). I could have saved you all some trouble, but I only today was notified of the continuation of the harassment for which I had blocked the user a month ago. Jehochman ^Talk 12:35, 6 December 2010 (UTC)[reply]

Amalthea, the "undisclosed account" Seth Kellerman is referring to is the one Theserialcomma makes multiple references to outside of User:Theserialcomma2 and User:Theserialcomma3: "just so you know, my password has been scrambled and i have a new account" [6] "my new (unnamed) account is unaffected by any of this as i've not edited with it while other accounts were blocked, so it's also not a case of sockpuppetry." [7] "i have a new account (not this one)" "i decided to start over by making a new account" "this is another throwaway account" (from the revdel'd comment from User:Theserialcomma2). --Tothwolf (talk) 00:22, 7 December 2010 (UTC)[reply]

 Additional information needed So a check is no longer needed? -- Avi (talk) 04:02, 16 December 2010 (UTC)[reply]

I'm re-closing this. Every known account of Theserialcomma is blocked, CU didn't turn up anything, alleged socks that were communicated to the functionaries mailing list haven't edited in a long time, so I don't see that there is anything that can or needs to be done at this point & venue. Obviously, feel free to open a new investigation if a new issue comes up. Amalthea 22:46, 19 December 2010 (UTC)[reply]

Suspected sockpuppets

• Fiatlut (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Deathblazer (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• 71.211.147.30 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.

Please list evidence below this line. Remember to sign at the end of your section with 4 tilde characters "~~~~"

When User:Theserialcomma was blocked in November 2010, he stated "just so you know, my password has been scrambled and i have a new account." [8]
This "new" account was apparently User:Fiatlut, which at the time we were unable to locate since Theserialcomma had changed IPs.

On March 21, 2011 Fiatlut made this post to Talk:Tucker Max: [9] and this addition to Tucker Max: [10]
On March 26, 2011 Fiatlut made this addition to Tucker Max: [11]
Theserialcomma has previously tried to add the same type of text for years using various accounts and IPs.

Some of these type of edits made with User:Theserialcomma include: [12] [13] [14] [15]
Some of the other past edits also include: [16] [17] [18] [19] [20]
Note that this is in no way an exhaustive list as Theserialcomma has been doing this for years with various accounts and IPs. Details of this were sent to the functionaries list in November-December 2010.

This edit is also indicative of the connection between the Fiatlut and Theserialcomma accounts: [21]

Fiatlut has also been making edits to the article and talk pages for University of California, Los Angeles and History of the University of California, Los Angeles.
In keeping with the same behavioural patterns as "Theserialcomma" he has been in conflict with User:Niteshift36 and has been attempting to bait him. He has even gone as far as to create yet another sockpuppet, User:Deathblazer and use it to make personal attacks against Niteshift36: [22] [23]
See also: Wikipedia:Administrators' noticeboard/IncidentArchive682#Disruptive new account

71.211.147.30 was also used during his argument with Niteshift36 which has apparently already been confirmed via checkuser to be the same as Deathblazer.
Fiatlut slipped up with these edits during his arguments with Niteshift36 and failed to sign back in after switching accounts/IPs: [24] [25]
In this next edit he resigns the text he added as 71.211.147.30 with his Fiatlut account: [26]

He tried to make it look like Deathblazer is not connected to Fiatlut with this edit, but he isn't really fooling anyone. [27]

I think this stuff easily passes the duck test and beings as he has previously demonstrated his ability to change IPs to evade checkuser, I see no reason to request a checkuser check this time. That said, it might still be worth checking to see if there are any other sleeper socks. Tothwolf (talk) 12:07, 3 April 2011 (UTC)[reply]

Because he changed his ISP, it's doubtful he will return to his former IP range. He can be connected to quite a number of other past accounts/IPs fairly easily, although most of those are now old. I've got enough to work up a proper WP:LTA entry but it will take some time to sift through all the material. --Tothwolf (talk) 13:44, 3 April 2011 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

 Confirmed that

• Fiatlut (talk · contribs)
• Deathblazer (talk · contribs)

are the same, that's inappropriate use of multiple accounts.
Theserialcomma's data was quite stable over his last three months of editing here, and does not match Fiatlut/Deathblazer. I can't say how much weight that should carry though, alleged connection to Theserialcomma (and thus the weight of the socking problem) may need to be decided based on behavioral evidence, into which I didn't look too deeply. Amalthea 12:57, 3 April 2011 (UTC)[reply]

The behavioral evidence is quite strong. Therefore, I have blocked Fiatlut indefinitely. (Deathblazer is already indef blocked for vandalism.) Would a clerk please tag both accounts as socks and close this report. Thank you. Jehochman ^Talk 13:40, 3 April 2011 (UTC)[reply]

So done. — HelloAnnyong ^{(say whaaat?!)} 16:26, 3 April 2011 (UTC)[reply]

Suspected sockpuppets

• 69.108.137.221 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.

Please list evidence below this line. Remember to sign at the end of your section with 4 tilde characters "~~~~"

In the last SPI filed, "Theserialcomma" had been using User:Fiatlut and User:Deathblazer for disruption with the University of California, Los Angeles article. He has now returned to the article's talk page with one of his IPs. [28]

This is an IP range from the same pacbell.net ADSL provider he used previously, and it too geolocates to Irvine, CA, as have many of his other IPs and ranges.

For example see:

• 71.135.230.216 - 71.135.230.223 NET-71-135-230-216-1 adsl-71-135-230-221.dsl.irvnca.pacbell.net Irvine, California
  71.135.230.221
• 70.189.128.0 - 70.189.255.255 NET-70-189-128-0-1 ip70-189-224-173.lv.lv.cox.net Irvine, California
  70.189.224.173
• 207.114.152.0 - 207.114.152.254 Hyatt-Regency-Irvine-207-114-152-0 207-114-152-6.static.twtelecom.net Irvine, California
  207.114.152.6
  207.114.152.220

Tothwolf (talk) 01:25, 26 April 2011 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Administrator note IP blocked 1 week. — HelloAnnyong ^{(say whaaat?!)} 02:30, 28 April 2011 (UTC)[reply]

Suspected sockpuppets

• Theserialcolon (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• 166.205.8.33 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.

Please list evidence below this line. Remember to sign at the end of your section with 4 tilde characters "~~~~"

The 166.205.8.33 IP is from the same mobile.mymmode.com (AT&T Wireless) range of IPs Theserialcomma has used before and was used to insert incorrect information [29] into the University of California, Los Angeles article.

For some past examples from the same IP range, see:

• 166.128.0.0 - 166.255.255.255 NETBLK-CDPD-B 166-205-009-066.mobile.mymmode.com AT&T wireless
  166.205.9.66
  166.205.9.70

User:Theserialcolon account appears at least on the surface to be Theserialcomma, as it was used to revert [30] an edit made by User:Niteshift36 on the History of the University of California, Los Angeles article. This is the same stuff he did before with the Fiatlut and Deathblazer accounts, and the 71.211.147.30 Qwest IP. See Wikipedia:Sockpuppet investigations/Theserialcomma/Archive#03 April 2011 for details. That said, I think a CU might be useful here as User:Theserialcolon could just be a copycat/troll from some other banned editor. Tothwolf (talk) 23:55, 8 May 2011 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Clerk endorsed - Endorsing for a potential check; I'm not really sure what accounts aren't stale here. — HelloAnnyong ^{(say whaaat?!)} 00:34, 9 May 2011 (UTC)[reply]
  • MuZemike and I already looked into this in response to an unblock request - Levardi (talk · contribs) = Theserialcolon (talk · contribs) = Fiatlut (talk · contribs). TNXMan 03:07, 9 May 2011 (UTC)[reply]