Wikipedia:Sockpuppet investigations/Leanne/Archive

Add links
Source: Wikipedia, the free encyclopedia.



Leanne

Leanne (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Report date April 19 2009, 20:29 (UTC)
Suspected sockpuppets



Evidence submitted by Paul Erik (talk)(contribs)


  • I first became suspicious that someone was attempting to evade detection of dubious AfD activity when I noticed that A-Kartoffel was falsifying date stamps in his AfD contributions. [1] [2] [3]
  • A-Kartoffel placed his !vote part-way through the discussion instead of at the end, [4] something that experienced AfD contributors just don't do, but which is a habit that JamesBurns also has done on occasion. [5]
  • A-Kartoffel's first contributions, prior to making nothing but the briefest edits to mainspace, were to add [6] a {bots|allow-none} on his talk page, and setting up an MfD, which indicates that he is not a new user.
  • Once I told A-Kartoffel that I saw something suspicious was going on with his account,[7] he stopped editing [8] on 14 April and then Iam, who had been relatively inactive, starting editing on 16 April, showing the same AfD editing pattern of supporting JamesBurns (and vice versa) where support is needed. [9] [10] [11] JamesBurns and Iam also tend to use similar deletion reasons. [12] [13]
  • JamesBurns [14] [15] (Chatswood is a suburb of Sydney) and Iam [16] both have, at some point, identified themselves as musicians from the Sydney area of Australia. Both also used the identical non-standard template to say they were on "permanent Wikibreaks" [17] [18] within a day of each other in early August 2006. Iam later claims on his user page that he is a fan of robots in science fiction [19] but in fact has not edited such articles, instead having the same focus as JamesBurns and A-Kartoffel.


Comments by accused parties    See Defending yourself against claims.
Comments by other users


CheckUser requests
Checkuser request – code letter: C (Vote stacking affecting outcome )
Current status – Completed: Reviewed by a Checkuser, results and comments are below. Wikipedia:Articles for deletion/List of R&B musicians is one example of a closed vote that was likely affected.    Requested by Paul Erik (talk)(contribs) 20:29, 19 April 2009 (UTC) [reply]



Clerk, patrolling admin and checkuser comments

 Clerk endorsed Nathan T (formerly Avruch) 20:32, 19 April 2009 (UTC)[reply]

 Clerk note:: This report is handy reading for this case - 133 intersecting pages, practically all deletion discussions. Nathan T (formerly Avruch) 20:36, 19 April 2009 (UTC)[reply]

{{Inprogress}} -- Avi (talk) 22:00, 19 April 2009 (UTC)[reply]

Damn, on it too :D. We'll compare notes. -- lucasbfr talk 22:24, 19 April 2009 (UTC)[reply]
Conclusions

I would be happy to wait until Lucas confirms or corrects the above. -- Avi (talk) 22:52, 19 April 2009 (UTC)[reply]

I have the exact same list (in fact I missed Edlemand and Steve3848, but I double checked and agree with you). -- lucasbfr talk 22:58, 19 April 2009 (UTC)[reply]

 IP blocked Focused ranges and IPs have been blocked. -- Avi (talk) 23:19, 19 April 2009 (UTC)[reply]

 Done All accounts except User:Paul Schuback now blocked. Paul Erik (talk)(contribs) 02:46, 20 April 2009 (UTC)[reply]

This case has been marked as closed. It has been archived automatically.


Report date April 20 2009, 10:06 (UTC)
Suspected sockpuppets


Evidence submitted by --Avant-garde a clue-hexaChord2

I suspected this for months, but the recent case of User:JamesBurns having lots of socks vor !votes at AfDs brought this back to mind. I think User:Duffbeerforme just didn't make it to the recent list, since this account was not touched for the last two weeks. At least User:Duffbeerforme seems to be another music interested editor from Australia (in the light of his edits outside of AfDs), doing lots of !votes at music related AfDs, just like User:JamesBurns and his army of sockpuppets. Another strange thing is that User:Duffbeerforme sometimes does not edit for one or two weeks, but is always handy when needed for discussion, just like User:A-Kartoffel and User:TheClashFan. --Avant-garde a clue-hexaChord2 10:06, 20 April 2009 (UTC)[reply]

Comments by accused parties    See Defending yourself against claims.
  • Wow, what a flimsy reason for a sock puppet report. Editor is a music interested editor from Australia who participates in afds therefore must be a sock. Accusations of vandalism and an ANI report went nowhere so lets try sock puppetry.
When have I been handy when needed for discussion in a strange way?
Yes I started editing with this account in Feb 2008, over a year ago. Yes I had been around before. I did not have an account. My edits were from IP addresses. I started an account partly to participate in AFDs in an open way. In that time I have started over 100 articles, improved many more and rescued some. Was I doing all this just so I could stack votes on AFDs? Duffbeerforme (talk) 04:05, 22 April 2009 (UTC)[reply]
Comments by other users
  • To me (the user who initially uncovered the JamesBurns situation), Duffbeerforme does not look like he or she has the same habits as JamesBurns and his socks. To take just one example, Duffbeerforme has put some effort into saving articles (see Wikipedia:Articles for deletion/Operator generator) which, from what I've seen, is something that JamesBurns does not appear to ever do. Paul Erik (talk)(contribs) 16:19, 20 April 2009 (UTC)[reply]
  • This is sad, because he was such a good editor. THE AMERICAN METROSEXUAL 17:55, 20 April 2009 (UTC)[reply]
  • OMG!!! I cannot believe what I have seen! I am in extreme shock! I thought JamesBurns was a good editor who was only helping to fairly rid Wikipedia of non-notable music articles. He has voted delete at the very last four AfDs I have started, so that has become my impression of him. As for A-Kartoffel, I am also in extreme shock. A-Kartoffel was the one who previously reported me to WP:SSP in mid-December, so I thought he was trying to help rid WP of sockpuppets. I did admit to socking with User:NumberOneDisturbedFan and took a two week block for it, because I had promised that I was going to stick to this account from then on. Looking at A-Kartoffel's contribs, I see that he has been around for a good period of time and his contribs suggest that most of his activity has to do with finding sockpuppets and voting at AfDs. Sorry if my language here was a bit harsh, but I just cannot believe this. This puts me in total shock. You may wonder if I may have anything to do with JamesBurns or his socks, as seen by how he agreed with my last four AfDs by voting delete at them. I will be honest, I don't want to be banned for sockpuppetry again, it will kill me on the inside. Some of your proof that I am in no way related to JamesBurns or his socks is that I am not from Australia, nor am I currently there. In fact, I could care less about Australia (no offense). If I were to be CU'ed, evidence would show that I am in the U.S., and further to that, I don't remember ever editing articles related to Australia (from this account or my now blocked socks). I'll be back soon, as I have a feeling that there may be more sock additions for this case.--DisturbedNerd999 19:48, 21 April 2009 (UTC)[reply]
    • I don't know about this, but it may be possible that another former sockpuppeteer who claimed to be "retired" is also from Australia and edits music articles such as those related to Led Zeppelin. This user is User:Tom.mevlie. A-Kartoffel had asked another editor, User:Edelmand if he knows anything about this sockmaster, as Edelmand had also been editing similar articles [23]. According to what A-Kartoffel said, Tom.mevlie is using an Australian ISP. The reason for why this is important is because Edelmand then replied on A-Kartoffel's talk page saying that he is in no way related to Tom.mevlie [24]. The thing that really gets me suspicious is that A-Kartoffel didn't open up a sockpuppetry case for Edelmand if he really thought that Edelmand has something to do with Tom.mevlie. Now I wonder if Tom.mevlie and Edelmand can be added to this list of JamesBurns socks if A-Kartoffel is confirmed to be one of his socks. That would be a heck of a lot more socks, as Tom.mevlie has plenty of them.--DisturbedNerd999 20:09, 21 April 2009 (UTC)[reply]
      • Avi, I saw your reply in the page history. You made a mistake, and mispelled this user Edelmand as Edlemand. I know that Edlemand is confirmed, but Edelmand isn't yet. Do you think that with the similarity of names that the user in question (JamesBurns) was trying to impersonate Edelmand by making another account called Edlemand? If that's not impersonation, then I'd be 99.9% sure that Edelmand is also a sock of JB. And further to that, my question about Tom.mevlie and his socks aren't yet answered. Is it possible that JB had operated Tom.mevlie and his many socks? The fact that all of these users appear to have roots in Australia and they are interested in similar music could be a possible reason.--DisturbedNerd999 03:17, 22 April 2009 (UTC)[reply]
CheckUser requests
Checkuser request – code letter: C (Vote stacking affecting outcome )
Current status – Declined, the reason can be found below.    Requested by --Avant-garde a clue-hexaChord2 10:06, 20 April 2009 (UTC)[reply]
Wikipedia:Articles for deletion/It (MSI Singles)
Wikipedia:Articles for deletion/Darling (ESTK song)
Wikipedia:Articles for deletion/Joseph Casamassima
Wikipedia:Articles for deletion/Rules of the Game (EP)
Wikipedia:Articles for deletion/The Blackmarket EP
Wikipedia:Articles for deletion/December EP
Wikipedia:Articles for deletion/Skruff
(just for the last four weeks)

 Clerk declined Having reviewed the AFDs above, there are several that would very clearly have been closed in exactly the same way even if we counted these two users as one. Mayalld (talk) 14:18, 20 April 2009 (UTC)[reply]

Could you take another look. This isn't any old sockpuppet. This is an abusive prolific sockpuppeteer who has created multiple socks and disrupted multiple debates. The fact that these debates would have closed the same anyway does not affect that this is abusive socking. Theresa Knott | token threats 15:39, 20 April 2009 (UTC) Also having taken a look myself I think that you may well be counting some of his other socks when coming to your conclusion. Theresa Knott | token threats 15:45, 20 April 2009 (UTC)[reply]
 Clerk declined I'm afraid that the fact that the debates would have closed the same way IS relevant. CU is reserved for the most serious sockpuppetry allegations. Where vote stacking is concerned, the convention is that the result must be affected to justify use of CU. Mayalld (talk) 15:56, 20 April 2009 (UTC)[reply]
Clerk, patrolling admin and checkuser comments

no Declined I just ran the report on JamesBurns yesterday and Lucas double checked me. User:Duffbeerforme did not appear in the results. -- Avi (talk) 15:44, 20 April 2009 (UTC)[reply]

Is that because this editor hasn't edited in the last two weeks? I'm not familiar with the process here. Is the decline just for the checkuser? Why is the case being marked as close when behaviour is very suspect. Basically what I am asking is can I block a pretty obvious sockpuppet for failing the duck test? Theresa Knott | token threats 16:42, 20 April 2009 (UTC)[reply]
Checkuser data goes back three months, so yesterday's CU checks would have caught this particular editor if it was a JamesBurns sock following the same pattern. The decline means that another CU check today wouldn't have different results in this instance. Nathan T (formerly Avruch) 16:54, 20 April 2009 (UTC)[reply]
Theresa, Paul, who is the editor who submitted the request that found the JamesBurns sockfarm, said above that User:Duffbeerforme is not an obvious sock, so I would not counsel blocking User:Duffbeerforme as a sock without more investigation as to behavior. As for a CU check, I ran a very detailed analysis yesterday and User:Duffbeerforme did not appear. There is no need to check again without strong evidence, which I am not seeing. I would be happy to hear from other CU's or clerks as well if they agree or disagree with my understandings. Thank you. -- Avi (talk) 16:56, 20 April 2009 (UTC)[reply]
OK fair enough. I didn't realise that checkuser went back that far. Seems I was too hasty in making a judgement.Theresa Knott | token threats 19:16, 20 April 2009 (UTC)[reply]

information Note:Before this is closed, what is the decision about User:Duffbeerforme being a sockpuppet of JamesBurns vis-a-vis behavioral evidence. -- Avi (talk) 17:57, 20 April 2009 (UTC)[reply]

Avi: I thought you and Paul just said its not an obvious sock. Am I wrong in assuming that there was no obvious socking, and also no CU evidence? Synergy 19:24, 20 April 2009 (UTC)[reply]
No, you aren't wrong at all. It's just that I think there should be some formal finding before we close it, so for closure, I think we can tag this as Unlikely. -- Avi (talk) 19:41, 20 April 2009 (UTC)[reply]
I see, you just want to be thorough. I generated a report comparing them just in case. Synergy 19:43, 20 April 2009 (UTC)[reply]

 Clerk note:: Should be noted that the report Synergy links above shows a pretty strong relationship. 137 intersecting pages, mostly deletion discussions. I checked ten or fifteen and didn't find any contradictory votes. Nathan T (formerly Avruch) 20:01, 20 April 2009 (UTC)[reply]

  • That's what I'm talking about. Actually, there are some contradictory votes, but that could be part of the game as well, bearing in mind that almost all are a) AfDs b) or at least about music and c) the editors all come from Australia (clear evidence in the edits outside AfD). If it's unlikely IP wise - which seems to be - it's not at all proven to be wrong. --Avant-garde a clue-hexaChord2 20:30, 20 April 2009 (UTC)[reply]
  • On the subject of intersections, I have a report from a meatware toolserver:

    As I have been processing the long list of potentially affected AFD discussions, one additional name, of a now-retired account, has tended to leap out at me, as always there, alongside JamesBurns and Iam. Two particular AFD discussions, one where this account is the only one to agree with JamesBurns, and another where this account was very careful not to say "per JamesBurns" when others did, have given me pause, although there are several others besides.

    If my suspicion is correct, this sockpuppetry has been going on at AFD since February 2005, and this person is not "retired" at all. The account in question dates to 2003, and there are other behavioural indicators, and items on the now-deleted user page, that indicate at the very least a shared area of interest in Wikipedia and a common geographic location.

    There might be sockpuppetry here that checkuser cannot help with investigating. Bear that in mind when rolling this sockpuppet investigation along the normal "It's been through checkuser, so now close it." conveyor belt. ☺ Uncle G (talk) 21:28, 20 April 2009 (UTC)[reply]

    • While I might be wrong on Duffbeerforme, this case is that disturbing, it should be investigated more by several editors. I think I know what you are talking about - at least I found the deleted userpage very fast as well as some other suspect editors from Down Under. --Avant-garde a clue-hexaChord2 22:09, 20 April 2009 (UTC)[reply]
      • Australia's a big place, mate. Not everyone who is interested in music articles and who claims to come from Australia is automatically suspect, nor should be. (That would make Capitalistroadster suspect.) There are some far more geographically specific connections in the deleted revisions in this one case that I suspect. We're very probably on the same page with respect to that one account. Uncle G (talk) 22:44, 20 April 2009 (UTC)[reply]
        • Of course, but everybody contributing to music related AfDs recently should have noticed that something's going wrong badly, at least I did. I even noticed the strange placing of !votes by A-K (at the Queen tour articles) but was not clever enough to see the faked time stamps. It needed Paul to resolve this. Hats off! Now we learn that this goes back to February 2005 at least. Wow. Well, am I allowed to suspect someone from Down Under who since 2006 is around music related AfDs a lot, mostly !voting "delete" along JB and his socks? I'm not naming anybody, just like you did before - but I found those two people you cited and am on your side. Maybe someone will find my guy as well. --Avant-garde a clue-hexaChord2 23:19, 20 April 2009 (UTC)[reply]
    • ps: Now I found the editor who claims to be retired for a longer period (but edited lots anyway, as recent as March 2009) as well as what looks like to be the missing link between JB and Dbfm, some editor who might have taken over the role of the editor with the deleted userpage in 2006. OMG... --Avant-garde a clue-hexaChord2 22:39, 20 April 2009 (UTC)[reply]
      • You can rule out any account who was editing as recently as last month. I ruled out Esradekan, another name that kept coming up as I am reviewing the past AFD discussions, on that basis (amongst other things). As pointed out above, any account editing that recently would have been spotted by CheckUser. Uncle G (talk) 18:12, 21 April 2009 (UTC)[reply]
        • That assumes that the sockmaster is not technically savvy enough to divvy up his sockfarms in such a way as to throw off CUs. Nathan T (formerly Avruch) 02:55, 22 April 2009 (UTC)[reply]
          • Yep, I easily could use three completely different IP ranges (work, own flat, partner's flat) which have connection points in cities that are several hundred kilometers apart (which is much in European countries!). I don't know if CU also touches things like browser and OS data, but these would be different too of course, not to mention day times. And this does not include several possibilities of IP masking (at least good enough for some one line !votes at AfD or other discussions). --Avant-garde a clue-hexaChord2 05:35, 22 April 2009 (UTC)[reply]
    • Duffbeerforme's contributions just don't fit the pattern of the other sockpuppets, so I don't think this is a sockpuppet either. However, when examining some of the older AfD's I saw two accounts that looked suspicious; both have feminine names, one is probably the account referenced above which started editing in 2003 and whose userpage is now deleted. The other started editing in 2004 and is currently indef-blocked for suspected hijacking. Curiouser and curiouser this gets as we go down the rabbit hole. DHowell (talk) 04:09, 22 April 2009 (UTC)[reply]
      • There are significant dissimilarities with Megan1967, both in interests and in behaviour. Again, we're very probably on the same page with respect to that other account, though. Uncle G (talk) 19:35, 22 April 2009 (UTC)[reply]
        • That account has a clear connection to our sockpuppeteer, however, if you look at the edit history of Megan1967's talk page, and the early contribution history of known sock account EastHills. If Megan1967 was not created as a sockpuppet, the account was probably hijacked by none other than our puppeteer, perhaps in Feb. 2005 when the AfD stacking started happening. You don't see a striking resemblance between Megan1967's post-Feb. 2005 editing patterns and those of some of the known sockpuppets? Of course it would be kind of pointless to report this account, since the account is already blocked, but it might aid in the investigation to see if there are more sleeper sock accounts. (As an aside, investigating this case is somewhat entertaining: Did anyone else notice the three sockpuppets in Talk:Led Zeppelin ganging up to accuse another editor of sockpuppetry—while later on a fourth sockpuppet makes a comment in the same thread?) DHowell (talk) 20:41, 22 April 2009 (UTC)[reply]
          • And User:Leanne, starting with many LZ related edits and ending with many AfDs along Megan1967 and JB would be the missing link to LZ fan MegX. Leanne's account is the non blocked one. It looks at least hijacked, mind the gap between Nov. 2003 and April 2004 and the changing behavior, most notably in February 2005. This account was not used much recently, but nonetheless made edits in both, 2007 and 2008. BTW: What do you think about User:Xoloz? Claiming to be retired in January 2008, but making about 100 edits since, most notably votes at ArbCom and RfAs etc. as recently as December 2008? They edited in March 2009 though, what's unlikely CU-wise. --Avant-garde a clue-hexaChord2 22:29, 22 April 2009 (UTC)[reply]
          • ps: RE Megan1967, see Megan1976 (talk · contribs · deleted contribs · page moves · block user · block log) - *lol* --Avant-garde a clue-hexaChord2 22:48, 22 April 2009 (UTC)[reply]
            • First of all, I think Xoloz is a long-term admin who has absolutely nothing to do with this case. Why did you bring that name into this? It's clear that Xoloz is nowhere near as active now as before Jan. 2008, so that's likely what "retired" means. Assume good faith and don't grasp at straws, hexaChord, look for real evidence. Anyway, I have a feeling that at least some of the sockpuppets and suspected sockpuppets were not originally created as such, but were likely created by friends or acquaintances of the puppeteer (or created by the puppeteer for his friends and acquaintances), and while originally used by these real people, eventually those people stopped editing and the puppeteer took them over. DHowell (talk) 23:32, 22 April 2009 (UTC)[reply]
              • Are you implying that there may have been meatpuppetry involved? That I can definitely believe.--DisturbedNerd999 23:42, 22 April 2009 (UTC)[reply]
              • You're probably right about Xoloz, but for cases like this there's {{semi-retired}}. This plus several older AfDs made this editor at least a bit suspicious for me. That's why I asked, no more, no less. Actually I even hope you're right. Regarding this certain sock sub-page, I had the idea that our friend JB works or worked for the IT department of some school / university etc. and therefore had access to some students' / teachers' / public computers. The meat puppet / friend idea is another idea. I guess we have to resolve the background a bit to understand the whole picture. I fear a lot of accounts are sleeping or disguised and will be activated as soon as the smoke is coming down a bit. Someone who successfully manipulated WP to such a great amount for at least four years will not be stopped that quick. It seemed to be a large part of their life. --Avant-garde a clue-hexaChord2 23:57, 22 April 2009 (UTC)[reply]
                • Sockpuppetry is a pretty serious accusation on WP, and even just asking about certain editors in a sockpuppet report, without some pretty convincing evidence, could be taken as a personal attack. Saying one is retired but still editing is really not enough evidence for anything; there are no policies that say you have to stop editing after putting the {{retired}} template on your userpage. And happening to agree with sockpuppets in a few AfD debates neither is convincing evidence. Believe me, there are several editors whom I wish I could find evidence for sockpuppetry, but I'm not going to throw around accusations without having serious evidence. DHowell (talk) 00:55, 23 April 2009 (UTC)[reply]

information Note: If there is sufficient evidence for another SPI report, by all means, file one. -- Avi (talk) 15:12, 22 April 2009 (UTC)[reply]

  • There's strong behavioural evidence to base a suspicion upon, that three editors appear to have spotted independently. The edits are far too old for CheckUser. But there are AFD discussions where, if this account is a sockpuppet, discounting the duplicated opinions would have affected the outcome. I'm concerned about privacy, however. Uncle G (talk) 19:35, 22 April 2009 (UTC)[reply]
Conclusions

 Unlikely At this point, it appears that User:Duffbeerforme is unlikely related to the above sock farm. Australia is a big place, and interest in Australian music doth not sockpuppetry imply. We have enough investigators that say that User:Duffbeerforme's editing pattern is sufficiently different from JamesBurns et al. and the checkuser report from JamesBurns shows User:Duffbeerforme as Red X Unrelated. Any other possible socks of JamesBurns should be reported as a new section, and other potential sockpuppet/masters should be reported in their own section so as not to confuse the filings. Thank you. -- Avi (talk) 15:16, 22 April 2009 (UTC)[reply]

Oh good grief! I was about to respond to you, DHowell, saying that there's a difference in that Megan1967 has the whole LGBT interest that isn't exhibited in the present sockpuppet accounts, when I came across a EastHills edit that not only has shed an enormous amount of light, but has eliminated all concerns that I had about the privacy policy here. It relates to a deleted edit of User:Megan1967 that neither of you two can see, unfortunately.

Avraham, I'm just about to open Wikipedia:Sockpuppet investigations/Leanne. You might want to give the Arbitration Committee a tap on the shoulder about this one.

Clerks, yes, please close this discussion. But please synchronize your talk page edits with User:Paul Erik, per this discussion. We're going to need that list. Uncle G (talk) 00:12, 23 April 2009 (UTC)[reply]

Don't you think it would be better for all concerned to simply decide the case on the basis of policy, instead of having all this head-counting nonsense which only encourages abuse of multiple accounts? Canvasback (talk) 00:18, 23 April 2009 (UTC)[reply]

Now can you tell me who are you? --Avant-garde a clue-hexaChord2 00:24, 23 April 2009 (UTC)[reply]
Do you always answer questions with other questions? Canvasback (talk) 00:29, 23 April 2009 (UTC)[reply]
Who wants to open the SPI for Canvasback (talk · contribs · deleted contribs · page moves · block user · block log)? --Avant-garde a clue-hexaChord2 00:31, 23 April 2009 (UTC)[reply]
This case has been marked as closed. It has been archived automatically.

Nathan T (formerly Avruch) 00:57, 23 April 2009 (UTC)[reply]



Leanne

Leanne (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Report date April 23 2009, 05:37 (UTC)
Suspected sockpuppets


Evidence submitted by Uncle G (talk)

This is long. There's a lot of evidence here. This case goes back to 2003.

It has recently been determined, by CheckUser, that JamesBurns (SPI reports) was managing a set of sockpuppet accounts, which were being used to stack discussions at AFD. A list of these discussions can be found at User:Paul Erik/AfDs affected. I have been one of the editors processing this list, revisiting the AFD discussions and seeing whether they require the fresh attention of the closing administrator or Deletion Review, in light of the sockpuppetry. You can see the annotations on M. Erik's list.

Whilst I was helping to process that list, two names leaped out at me as being always there, alongside JamesBurns and Iam. The first was an active editor, Esradekan. I ruled out suspecting xem on several grounds, not the least of which was that the CheckUser investigations for JamesBurns would have caught that. There is fairly strong evidence that Esradekan has no part in this, and I only bring the name up because some editors have tended to leap to conclusions, and might well mention this name if I had not.

The second name was Leanne. Several AFD discussions involving this account and the JamesBurns sockpuppets gave me pause, two in particular. At Wikipedia:Articles for deletion/Fog (song), Leanne was the only editor agreeing with JamesBurns, in the face of an otherwise unanimous consensus to merge. At Wikipedia:Articles for deletion/List of ancient Egypt mysteries, Leanne was careful not to say "per JamesBurns", even though (back in 2005) it was common for such "per XYZ" contributions in AFD discussions to echo the rationales immediately preceding them.

At this point, for later context, we need a digression on the form that this sockpuppetry takes. There are several points:

The sockpuppetteer likes to impersonate
It came to light in the JamesBurns investigation that several of the sockpuppets were named after the accounts that created the articles that the sockpuppets nominated for deletion. User:Marvin Cee was a significant contributor to Lucifer Rising (album) (AfD discussion) and the creator of the deleted version of Christopher Dietler. The sockpuppeteer impersonated xem repeatedly as User:Marvin Ceee. User:E-Kartoffel was the creator of "The Above Ground Sound" of Jake Holmes (AfD discussion), and the sockpuppeteer used User:A-Kartoffel to nominate that article for deletion. And, of course, Steve3848 was an outright impersonation of Steve3849.
The sockpuppetter likes to imitate
A clear pattern in the AFD discussion contributions of the CheckUser-confirmed sockpuppets is that when possible the sockpuppetteer takes a previous rationale by someone else in the discussion and echoes it, to avoid all of the sockpuppets saying the same thing. (A corollary of this is that when only the sockpuppetteer agrees with a course of action, the sockpuppets all tend to present the same argument and speak with what is clearly, in hindsight, a single voice.)

See Wikipedia:Articles for deletion/List of ancient Egypt mysteries, where the sockpuppetteer echoes RickK, for example. Or see Wikipedia:Articles for deletion/Tuff Monks where the second sockpuppet echoed Esradekan, rather than JamesBurns.

The sockpuppets are used to bolster weak discussions
This was observed in the original JamesBurns SPI report. The sockpuppets come into play when discussions show signs of not going the sockpuppeteer's way. Again, see Wikipedia:Articles for deletion/Tuff Monks, where as further "keep" opinions arrived, further sockpuppet accounts were brought to bear to attempt to "out-vote" them.
The sockpuppeteer has certain geographic associations and subject interests
Again, this was observed in the original JamesBurns SPI report. The sockpuppeteer is a Led Zeppelin fan, claims to be a musician, and claims to live in Sydney. The LZ obsession is to the point of absurdity, including a singlehanded defence of a Led Zeppelin song being the primary topic at Presence (Talk:Presence_(Led Zeppelin album)#Move Discussion), attempts to delete Presence (amplification), blanking of AFD discussions that say that one LZ song is "unremarkable" (and even untranscluding the discussion sub-page), and multiple sockpuppets accusing other people of being sockpuppets at both Talk:Led Zeppelin and Talk:Led Zeppelin Radio.

Further than that, it can be observed, from the BLP violations that the sockpuppetteer used multiple sockpuppets to edit war into the biography of Australian musician Lindy Morrison (I'm not supplying diffs. The article's subject, Lindymorrison (talk · contribs), had to go to OTRS to stop this. I will not link directly to the BLP violations.) and from the contributions to the AFD discussions for various Australian bands and for articles on tours of Queen (Wikipedia:Articles for deletion/The Works Tour and Wikipedia:Articles for deletion/Hot Space Tour) and Pink Floyd (Wikipedia:Articles for deletion/Pink Floyd Wish You Were Here Tour 1975), that the sockpuppetteer's obsession extends to an outright antipathy to musical groups and musicians who are not Led Zeppelin. It extends to disregarding BLP concerns.

Yes, Lindy Morrison mentions the Tuff Monks.

A third account common to these AFD discussions, spotted by DHowell, is Megan1967. There is behavioural evidence supporting a conclusion that there's no link here. The JamesBurns sockpuppets have little activity (but some, such as this) in LGBT related areas, whereas Megan1967 does. But it's far outweighed by the supporting evidence, for both Megan1967 and Leanne.

The starting point for this is the deleted revisions of User:Leanne. In the 20030627100228 revision, the editor states that xe is "a graduate from the University of Sydney" and "a guitarist and a fan of Jimmy Page and Led Zeppelin for many years". (I had privacy concerns about revealing this content of these deleted revisions. For reasons to be explained shortly, these concerns no longer exist.) This is both a commonality of interest with and a geographical link to User:JamesBurns.

The link from Leanne to Megan1967 and thence to the JamesBurns sockpuppets can be made through behavioural evidence in many AFD discussions. At Wikipedia:Articles for deletion/Genocides in history, for example, they opine almost wholly en bloc, with much the same rationale, and are the only accounts apart from the nominator arguing for deletion. At Wikipedia:Articles for deletion/Falling Up (band) they were the only accounts that were unconvinced by the rewrite. (JamesBurns continues discussion in place of Leanne there at one point, notice.) At Wikipedia:Articles for deletion/Cloud N. Candy they were the only accounts opining deletion at all. At Wikipedia:Articles for deletion/Best selling Female artist only these accounts, Kappa, and Vorash (clearly not taking things seriously) opined to "keep and cleanup".

At Wikipedia:Articles for deletion/Lorna Nogueira/vote3 there is a definite echo: "Keep, WP:POINT" by Megan1967, then "Keep, WP:POINT" by JamesBurns, then "Keep, WP:POINT" by Leanne. The only other editor opining this way is Davenbelle (q.v.). At Wikipedia:Articles for deletion/Muliebrity the sockpuppets, all opining "keep and expand", "keep, and expand", and "keep expanded article", were used to prop up the sockpuppeteer's change of mind.

There's a far more direct link from Leanne to Megan1967: Leanne claims attribution for the edits of 203.185.240.11 (which APNIC reports as assigned to Sydney, NSW, by the way). So, too, does Megan1967, twice. Special:Contributions/203.185.240.11 is a strong indicator that this isn't a dynamically-assigned IP address. (Administrators should also see the bottom of the 20030627100228 revision of User:Leanne. CheckUsers might wish to check that IP address and 124.171.115.31, per this edit, for further sockpuppets.)

There's also a far more direct link from Megan1967 to the JamesBurns sockpuppets. It is this revision of User:EastHills/contacts. One of those names is repeated by Megan1967 in this edit. (There is a Lismore, New South Wales.) There are also some direct parallels to the deleted revisions of User:Megan1967. Note in particular revision 20050212002020, where xe disclaims being "That other Megan", giving the same name and address as the EastHills edit. In fact, this is just the sockpuppeteer's modus operandi in action: This sockpuppetteer likes to impersonate. The "other Megan" was supposedly born in 1967. And the account is "Megan1967". This is impersonation of another person, just as "EastHills" is impersonation of East Hills Boys Technology High School (in Sydney, NSW), and as "Marvin Ceee" , "Steve3848", and "A-Kartoffel" were impersonations of others. As can be seen, HelenWatt is an impersonation of another person, too.

There's further connection, too. Megan Ireland was expanded with biographical detail by Iam, and Megan Louise Ireland was created and solely written by A-Kartoffel. As explained in Wikipedia:Articles for deletion/Megan Ireland, this is a hoax biography of a living person. (Also observe that the claim that this is a teacher aligns with the claim to be a school teacher in revision 20050621054302 of User:Megan1967.)

Hence my privacy concerns going away somewhat. Much of this supposed personal information is an extensive system of falsehood. It's not personally identifying of a real person, because it is fiction and fraud. The name, address, and telephone number for "Megan" are taken from an advanced fee fraud scam message, circulated some months before the account was created, that can be found here, for example. Each account has a different "biography". (EastHills was purportedly a NSW policeman, for example.) There's no reason to believe any of them to be true.

As such, I think that you'll find that Megan1967 wasn't hi-jacked by a vandal. It belonged to a vandal all along.

Uncle G (talk) 05:37, 23 April 2009 (UTC)[reply]

Evidence submitted by DHowell (talk)

Uncle G has probably presented sufficient evidence for a determination: the EastHills "contact list" with Megan1967's "girlfriend" in Lismore was enough to convince me, and was what I found that led me to clue in Uncle G that Megan1967 was another sock. I was also reluctant to directly link to those edits due to privacy concerns, but I had not discovered at the time that the "girlfriend" name was also used in 419 scam and spam postings as well. But here is more evidence for your consideration:

As early as February 2005, the accounts Leanne & Iam had raised one editor's suspicion that they were sockpuppets in Wikipedia:Articles for deletion/Democrazy (movie). This edit by Leanne was shortly followed by this edit by Iam, both of which insert their comments between comments already made, an unusual practice which is also occasionally done by known socks User:A-Kartoffel (example) and User:JamesBurns (example).

There are 9 AfDs in May 2005 in which both Leanne and Megan1967 are in lockstep with both JamesBurns and Iam, some of which Uncle G reported above; there is also Wikipedia:Articles_for_deletion/Jiwang, which was nominated by JamesBurns and was leaning towards keep until Megan1967 argued to delete, and later Leanne and Iam added their similar deletes to a few deletes by more established editors; Wikipedia:Articles for deletion/Henry seeley, in which Leanne, Iam, and Megan1967 all support nominator JamesBurns; and Wikipedia:Articles for deletion/Ju Ju Babies, in which all four accounts argued to keep (it is now a redirect to Misty Woods).

Leanne used the same non-standard template as JamesBurns and Iam to indicate a "permanent wikibreak". I have not seen this template anywhere else.

The IP address 202.74.179.159 may also be worth looking at; though the sole 2 edits are from 2004, they are clearly related to this case.

DHowell (talk) 23:58, 23 April 2009 (UTC)[reply]

Comments by accused parties    See Defending yourself against claims.


Comments by other users

Both Leanne and Megan1967 have not edited this calendar year. As such, I doubt CheckUser can turn up any substantial data on them. TML (talk) 15:54, 23 April 2009 (UTC)[reply]

I am not entirely convinced that the names and contact details are fictitious, though they are probably obsolete due to prior publication in spam/scam e-mails and postings. If the contact details were simply taken from such postings, it seems too much of a coincidence that the names are all related to the area in which the sockpupputeer is from (New South Wales). There is a verifiably real Helen Watt who was a college professor in NSW and was also associated with the University of Michigan; and there are fake bios floating around for Megan Ireland (probably the same as the ones deleted from Wikipedia) which purport her to be a former school teacher in NSW. So it wouldn't surprise me if the sockpuppeteer had a grudge against certain teachers and professors and was trying to Joe job them, and so may have also been responsible for the 419 scam and spam postings. (A real 419 scam starts with an e-mail intended to appear that the recipient was specially selected—such a posting on a newsgroup seems more likely to have the purpose of discrediting the person who it purports to be from, and making them the recipient of angry responses.) The interest in LGBT affairs by User:Megan1967 may have even been part of this Joe-jobbing. DHowell (talk) 23:58, 23 April 2009 (UTC)[reply]

I am a bit concerned about a new account that appears to have started editing only a couple of days ago, by the name of Canvasback (talk · contribs). This user appears to be a single-purpose account that has participated in a number of AfDs since his start on April 22. Most of the AfDs are about relations between certain nations, and JamesBurns has claimed before that he was a historian. If you look at Canvasback's contribs, this user does not look one bit new, as his very first contrib was an AfD. This user had also been seen at JamesBurns' previous sockpuppet investigation, which was after JamesBurns and his confirmed socks were all indef'ed. This makes me suspicious that Canvasback is a new account of JamesBurns that is being used to evade an indefinite block. I'm not completely sure if this guy really is him, but this account's contribs really make me wonder if he is related to JB. As mentioned above, this guy doesn't appear to be new.--DisturbedNerd999 (Delete!) 02:43, 24 April 2009 (UTC)[reply]

The JamesBurns sockfarm did not appear to have any interest in the various "X-Y relations" articles, which had been going on for a while before JB et al were blocked. However, I do find the contributions of these blocked accounts curiously similar: Special:Contributions/JustOneMoreQuestion, Special:Contributions/IfYouDontMind, Special:Contributions/Goesquack. Also compare this with this. DHowell (talk) 07:21, 24 April 2009 (UTC)[reply]
Actually I missed that Canvasback has already been blocked as a sock of User:Hilary T. DHowell (talk) 07:40, 24 April 2009 (UTC)[reply]

'Twas me who submitted the original JamesBurns report. My opinion is that the evidence presented here is convincing that User:Leanne and User:Megan1967 are indeed part of the JamesBurns sock puppet collection. We do need to come to a conclusion about that, not so much because of the question of blocking Leanne (although that should be done, in my opinion) but more because of the questions of handling some of the old AfD discussions listed in User:Paul Erik/AfDs affected. Paul Erik (talk)(contribs) 22:41, 24 April 2009 (UTC)[reply]

I noticed that nobody had tagged Leanne as a suspected sock puppet of JamesBurns. Not to worry though, I just did that myself. If we can confirm that Leanne really is a sock puppet of JamesBurns, then we can change the template by adding the "confirmed" parameter, as well as a link to this case.--DisturbedNerd999 (Delete!) 04:14, 25 April 2009 (UTC)[reply]

One other thing, I noticed that a new user (Mergellus (talk · contribs)) seems to have just started editing and already, in his first contribs, has gotten involved in AfDs. One of the more recent AfDs is the most recent one I started, Wikipedia:Articles for deletion/Make It. JamesBurns had !voted "Delete all" there before being blocked, and Mergellus' initial !vote there was also "Delete all" per JamesBurns. I then looked at his contribs and saw that this user participated in discussions about the "X-Y relations" articles, but his first AfD was for the song Escape From Paris. Now I'm a bit suspicious that this user is either a JamesBurns or a Hilary T sock.--DisturbedNerd999 (Delete!) 15:10, 25 April 2009 (UTC)[reply]

I thought I said this earlier, but I guess I'll say it now: nevermind Mergellus. It's just another sock of Hilary T, like Canvasback was.--DisturbedNerd999 (Delete!) 19:49, 27 April 2009 (UTC)[reply]
CheckUser requests
Checkuser request – code letter: B (Ongoing serious pattern vandalism )
Current status – Completed: Reviewed by a Checkuser, results and comments are below.    Requested by Uncle G (talk) 05:37, 23 April 2009 (UTC) [reply]

Has this sockpuppetry influenced discussions? Yes. We've already had to re-visit several of the recent AFD discussions affected by this. And there are of course the talk pages of the various Led Zeppelin articles. Now there are others to look at. Wikipedia:Articles for deletion/Motherland is an example. It's over the long term, as well. Leanne and Iam were both active in 2003.

Long term sock puppetry (for five and a half years), hoax articles, BLP vandalism, AFD disruption, talk page discussion disruption, sockpuppet edit warring, completely overboard Led Zeppelin POV pushing — I think that code B is the closest. Locating and blocking other as yet undiscovered sockpuppet accounts associated with the above two IP addresses, for the reasons given above, is the aim, in any case. Uncle G (talk) 05:37, 23 April 2009 (UTC)[reply]

As far as CheckUser goes, neither of the IPs have been used recently. However, they certainly do come from the same city as JamesBurns. Dominic·t 22:54, 23 April 2009 (UTC)[reply]
Clerk, patrolling admin and checkuser comments

 Clerk note:: The only remaining question seems to be whether its worth blocking Leanne, since the account hasn't been used in so long. The connection to the JamesBurns sock farm seems to be clearly established; in fact, the JamesBurns cases have been merged with Leanne as the new sockmaster. When the decision is made to block or not block Leanne, please note it here either way and I will close the case. Nathan T (formerly Avruch) 22:00, 24 April 2009 (UTC)[reply]

  • I went ahead and blocked Leanne (talk · contribs). It's likely a formality, since the account is so stale, but it's probably best to tie up all the loose ends here. We can probably close this, unless there are any other accounts that need to be looked at? MastCell Talk 16:15, 27 April 2009 (UTC)[reply]
Conclusions
This case has been marked as closed. It has been archived automatically. 
CanadianNine 23:35, 27 April 2009 (UTC)[reply]


Report date July 1 2009, 16:11 (UTC)
Suspected sockpuppets


Evidence submitted by User:Piriczki
Note: Copied from User talk:Aervanath#Another sock of User:Piriczki:
Thank you for your consideration in closing this case. Regarding the above comments by User:Trevvvy, I declare unequivocally that I am not User:JimmyRRPage nor do I have any association with that user, whose edit history pre-dates mine by a year by the way. Further, I firmly believe this accusation was made in bad faith by a blocked user who is retaliating against other editors who have corrected her inaccurate or inflated contributions to articles related to the rock band Led Zeppelin.


This accusation appears to have been prompted by my recent edit to the article James Patrick Page: Session Man Volume One which corrected false information first introduced by User:MegX. At this point, some background information may be helpful. This user's obsession with Led Zeppelin extends to the point of removing from wikipedia any information which might reflect unfavorably toward the group. It also manifested itself in an absurd campaign to eliminate all references to Jake Holmes, a folk singer who originally wrote and recorded the song "Dazed and Confused", later popularized by Led Zeppelin without credit to Holmes. Led Zeppelin had been criticized for borrowing from other artists' work without giving credit, hence the animosity toward Holmes. See Wikipedia:Articles for deletion/"The Above Ground Sound" of Jake Holmes for an example.
User:MegX first erroneously removed Jake Holmes from the article in question with this edit [25]. That edit was first corrected by User:216.65.144.24 here [26] only to be immediately reverted [27] by MegX. The article was subsequently corrected again [28] by User:JimmyRRPage. Later, new user Cradleofrock again removed Jake Holmes [29] which was reverted by me [30]. I also added a reference. User:Trevvvy then responds with a false accusation of sockpuppetry.
You may wish to simply ignore User:Trevvvy which is entirely appropriate. But just in case this new user's behavior should continue, I have alerted two administrators who are probably familiar with this user's history. Piriczki (talk) 14:53, 1 July 2009 (UTC)[reply]
Comments by accused parties    See Defending yourself against claims.
Comments by other users


CheckUser requests
Checkuser request – code letter: E (Community ban/sanction evasion )
Current status – Self-endorsed by clerk for Checkuser attention.    Requested by Aervanath (talk) 16:11, 1 July 2009 (UTC) [reply]



Clerk, patrolling admin and checkuser comments

 Clerk note: This is getting too complicated to figure out without CheckUser evidence.--Aervanath (talk) 16:11, 1 July 2009 (UTC)[reply]

See also Wikipedia:Sockpuppet_investigations/Leanne#Report_date_July_1_2009.2C_16:11_.28UTC.29; this is a pattern of tit-for-tat sock-reporting that needs to be either a) supported with CheckUser evidence or b) disproven completely so this can stop.--Aervanath (talk) 16:16, 1 July 2009 (UTC)[reply]
 Confirmed the following match each other:
  1. Trevvvy (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  2. Artyline (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
 Likely verging on confirmed that Cradleofrock (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) matches the above two listed. – Luna Santin (talk) 22:12, 1 July 2009 (UTC)[reply]
Conclusions

 Completed All blocked and tagged.--Aervanath (talk) 02:41, 2 July 2009 (UTC)[reply]

This case has been marked as closed. It has been archived automatically.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Leanne/Archive&oldid=1087296741"