Wikipedia:Sockpuppet investigations/I love you/Archive

I love you (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• Muhammad Alfarezal (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)  Clerk note: Original case name
• 125.160.67.6 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Actively evading block. Very self-explanatory, considering the edits to 4KidsFriend talk page and the MfD 4KidsFriend was involved in. Curbon7 (talk) 06:55, 18 October 2021 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• 125.160.64.0/21 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) is mostly them.  Range blocked for two weeks, will extend if they continue. Closing, thanks for reporting. --Blablubbs (talk) 09:40, 18 October 2021 (UTC)[reply]

---

• 4KidsFriend (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• CoffeyFan (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• MAlfarezal (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Muhammad Alfarezal 2 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Muhammad Alfarezal (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Ciko&Reza (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Mister Suitcase (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• 61.5.115.152 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 125.160.64.0/21 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Mostly pro-forma, see below. --Blablubbs (talk) 12:14, 24 October 2021 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Since this master seems highly persistent, I figured some housekeeping was in order. This was originally handled with Muhammad Alfarezal as the master, but I love you is by far the oldest account, so I've moved the case there. The list above is everyone who has previously been blocked and tagged as part of this sock group, plus two accounts that were blocked without tags (now tagged). Closing. --Blablubbs (talk) 12:19, 24 October 2021 (UTC)[reply]

---

• 36.85.37.41 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

"I love you" appears to be the master account. Otherwise maybe User:Muhammad Alfarezal. This IP has popped up in the last two days and is editing Draft:Pathé Distribution, which has otherwise been edited only by socks. Is this address swimming in the same pond? Robert McClenon (talk) 04:37, 11 November 2021 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• It's them. 36.85.32.0/21 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) blocked for two weeks, closing. --Blablubbs (talk) 22:33, 14 November 2021 (UTC)[reply]
  • Also noting for the record that I think Rezal Ciko (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) is part of this group.  Tagged as suspected. --Blablubbs (talk) 22:40, 14 November 2021 (UTC)[reply]

---

• 118.96.40.132 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 125.160.69.198 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 125.160.65.110 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 125.160.65.194 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

These IP addresses are creating drafts on companies that have been merged into GlaxoSmithKline that have also been edited by blocked socks of this sock farm. Robert McClenon (talk) 04:59, 11 November 2021 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• The bottom three were already blocked per Wikipedia:Sockpuppet investigations/I love you/Archive#18 October 2021 – I see no new activity on the range, so there's no reason to reblock. The first listed IP hasn't edited in quite some time. Closing. --Blablubbs (talk) 22:31, 14 November 2021 (UTC)[reply]

---

• 125.160.40.25 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• MuhammadAlfarezalBot (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same "Aftermath"-section nonsense like previous socks, e.g. Muhammad Alfarezal on St. Jude Medical. Also they created a draft redirect Draft:UTV Software Communications previously edited by 4KidsFriend – NJD-DE (talk) 23:34, 5 January 2022 (UTC)[reply]

Added MuhammadAlfarezalBot to this based on edits on same page like previous IP socks (User:Sandbox), and obviously because of the username similarity. – NJD-DE (talk) 23:47, 5 January 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Looks like a duck to me --Trialpears (talk) 23:59, 5 January 2022 (UTC)[reply]

• @Trialpears: It's good to say what you did, i.e., blocked the IP for one month.--Bbb23 (talk) 00:02, 6 January 2022 (UTC)[reply]

  @Bbb23 Sorry, really should have. Especially since it would have been reasonable to do a range block as well. I looked at it and decided not to since 125.160.40.25/22 has had another user editing from it in the past month and IPs from the range wasn't in the archive. --Trialpears (talk) 00:19, 6 January 2022 (UTC)[reply]

@Bbb23 Sorry, really should have. Especially since it would have been reasonable to do a range block as well. I looked at it and decided not to since 125.160.40.25/22 has had another user editing from it in the past month and IPs from the range wasn't in the archive. --Trialpears (talk) 00:21, 6 January 2022 (UTC)[reply]

---

• 118.96.88.115 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Editing Draft:B.R. Films created by sock Muhammad Alfarezal, adds {{R from fictional location}} to East High School (High School Musical) like recently blocked IP sock, requests CV-revdel on Noble Energy for edits made by blocked IP sock. – NJD-DE (talk) 12:22, 9 January 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  IP blocked for three days, though I suspect I'll have to turn that into a rangeblock down the road. Closing. --Blablubbs (talk) 14:36, 9 January 2022 (UTC)[reply]

---

• 110.139.9.3 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same geolocation like previous socks. Same article (Noble Energy). Admits being a sock of I love you (Special:Diff/1065318954). – NJD-DE (talk) 23:22, 12 January 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• 4KidsFriend 2 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Suspicious edits; refer 4KidsFriend (talk · contribs). — Manticore 23:52, 12 January 2022 (UTC)[reply]

• 4KidsFriend2 Already blocked by Bbb23. The IP has been inactive for over 24 hours, but it looks like 110.139.8.231 a month ago was also them. And the /23 is inactive for two years before that, so there's no obvious collateral damage in giving the range a month off, but I'm a bit hesitant to do that over 11 edits, while a shorter block wouldn't make sense due to the long resting periods between edits. So, no action on the range for now, but if it pops up again, can be given a month or two. Closing. -- Tamzin^{[cetacean needed]} (she/they) 01:30, 14 January 2022 (UTC)[reply]

---

• 36.85.32.0/21 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same IP blocked twice previously as an ILY sock range. (See Wikipedia:Sockpuppet investigations/I love you/Archive § 11 November 2021.) Immediately after one-month block, returns to edits about Disney topics and to weird sandbox edits (compare), in this case targeting a sandbox that I (the closing clerk on the last SPI) was the most recent editor on. [1] -- Tamzin^{[cetacean needed]} (she/they) 20:52, 14 January 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Sounds like a duck quacking into a megaphone to me. Looks to have been on this range contininuously since late October with few to no others using it, so  Awaiting administrative action: Please block 36.85.32.0/21 with expiry 3 months (anon. only, account creation disabled). -- Tamzin^{[cetacean needed]} (she/they) 20:52, 14 January 2022 (UTC)[reply]
• Yup.  Range blocked, closing. --Blablubbs (talk) 21:39, 14 January 2022 (UTC)[reply]

---

• Muhammad Alfarezal mother (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Similar username like previous socks. Tries to get rid of Noble Energy‎. – NJD-DE (talk) 22:26, 14 January 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Well, they just thanked me for filing the previous SPI, so yeah. Between that and literally everything else about their contribs,  Awaiting administrative action as a proven sock of I love you. -- Tamzin^{[cetacean needed]} (she/they) 22:36, 14 January 2022 (UTC)[reply]
• Welp, at least the rangeblock seems to be working, sort of.  Blocked and tagged, closing. --Blablubbs (talk) 23:17, 14 January 2022 (UTC)[reply]

---

• 110.139.150.63 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

On the same /16 as some past IPs. Same interest in Disney Channel and East High School (High School Musical) (edit | talk | history | protect | delete | links | watch | logs | views). Recreated Draft:UTV Software Communications (edit | talk | history | links | watch | logs). All-around duck. -- Tamzin^{[cetacean needed]} (she/they) 10:02, 26 January 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Awaiting administrative action: Please block 110.139.150.63 with expiry 72 hours (anon. only, account creation disabled). Thanks. -- Tamzin^{[cetacean needed]} (she/they) 10:04, 26 January 2022 (UTC)[reply]
• Blocked as recommended by Tamzin. --Trialpears (talk) 10:22, 26 January 2022 (UTC)[reply]

---

• TheWikiBoy2007 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• 180.248.83.183 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

• IP welcomed the user: diff, reference diff
• IP re-created draft (as redirect): Draft:Predecessor to GlaxoSmithKline
• User self-admitted: here, and here
• User requesting move of draft created by sock to article space: move-request, draft in question

– NJD-DE (talk) 11:56, 20 February 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Sounds like a duck quacking into a megaphone to me. This, this, their edits to User:Sandbox, their interest in Pathé films, and their interest in HBO is pretty conclusive. The IP's welcome of the sock and recreation of Draft:Predecessor to GlaxoSmithKline and Draft:UTV Software Communications is also pretty conclusive. The IP doesn't look to have been hopping when I check out to the /18, and it doesn't look like there'd be any collateral on the single IP (although they've only been static on it for 24 hours).  Awaiting administrative action - Please block TheWikiBoy2007 indef with no talkpage or email per the above note, and 180.248.83.183 for a week. --Jack Frost (talk) 12:32, 20 February 2022 (UTC)[reply]
• Seems to be wrapped up already; closing. Girth Summit _(blether) 13:12, 21 February 2022 (UTC)[reply]

---

• 20th Century Studios Fan 2020 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Proforma - already blocked. Thanked me for closing previous report, self-confessed on their talk, various ducky behaviours. Girth Summit _(blether) 09:36, 21 April 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

---

• 36.85.34.109 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Has the same Indonesian range as 180.248.118.218 and 180.246.137.4, the latter of whom was caught as I love you after making an incomprehensible request at ANI. Both 180.24x IPs and the 36.85 trio have started or supported barely-coherent RMs made in rapid succession at Talk:Can't Stop Feeling. Immediately after an RM started by 36.85.39.196 and supported by 36.85.36.95 was closed as no consensus, 36.85.34.109 launched another one. Nohomersryan (talk) 05:42, 26 April 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• That's them. I'll bump the current partial rangeblock up to full. Closing. Ping @Sdrqaz: FYI. --Blablubbs (talk) 09:38, 27 April 2022 (UTC)[reply]

---

• MuhammadAlfarezal2007 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Username like previous socks. Admitted block evasion on userpage. – NJD-DE (talk) 13:33, 20 November 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Ran a quick check for sleepers, didn't see any.  Blocked without tags,  Global lock(s) requested, closing. --Blablubbs (talk) 19:26, 20 November 2022 (UTC)[reply]

---