Wikipedia:Sockpuppet investigations/Exiledone/Archive

Exiledone

Exiledone (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

23 May 2012

Suspected sockpuppets

134.226.254.162 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
89.101.31.24 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
78.143.160.1 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
134.226.254.178 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

User compare report Auto-generated every hour.

Exiledone has a long history of logging out to edit war and make other disruptive edits. While not using IPs to evade the 3RR rule, it's difficult to keep track of his disruption due to this. A request to edit while logged in was removed without reply.

Examples:

Exildeone makes an addition to Tomás Mac Giolla here using a wordpress blog site as a source. It was removed by me with a clear edit summary, restored by Exiledone without edit summary here, removed by me again, then restored by 134.226.254.162.
Similarly there's the readdition of a different wordpress link to Independent Health Alliance here by 134.226.254.162 and here by 89.101.31.24. The link was originally added in the first version of the page created by Exiledone.
Exiledone has been involved in a lengthy (going all the way back to the start of the year at least) edit war on Paul Gogarty against Darepng (talk · contribs), even this morning we see 134.226.254.162 undoing Darepng's edits without explanation here, here, here, here and here. Also 89.101.31.24 made a series of edits the day before, which certainly appear to revert various parts of this edit by Darepng.
On Willie Penrose Exiledone made this addition which has subsequently been edit-warred over by 134.226.254.162 and 89.101.31.24.
On The Reform Group we have this addition made by Exildeone, then edit warred over by 78.143.160.1, 89.101.31.24, 89.101.31.24 again, 89.101.31.24 again, and 134.226.254.178 .
Just to clarify the inclusion of 78.143.160.1 (see previous example) we have edit warring by that IP on Red Republican Party, followed on by the same revert by 89.101.31.24.
On Bairbre de Brún we have this addition of information including a blogspot source by Exiledone. The offending information was removed by me with a clear edit summary, then edit warred over by 134.226.254.162 and 134.226.254.178.
On Alice Glenn a wordpress addition was made by Exiledone, and the removal of it reverted by 134.226.254.178.
And a small icing on the cake to link 89.101.31.24 and 134.226.254.162 to each other we have this on 25 April 2012 from 134.226.254.162 to the talk page of an IP that hadn't edited since November 2011, and presumably refers to this reversion of this edit by 89.101.31.24, or possibly one of the other edits they made to Joe Higgins, an article not edited by 134.226.254.162....

I could keep going with more but there's hopefully enough already to show the IPs are Exiledone? Since the removal of the talk page warning at 21:42, 17 May 2012 he's been editing logged out at 134.226.254.162 and 89.101.31.24, so it seems a bigger stick than a simple request to edit only while logged in might be needed? 2 lines of K₃₀₃ 10:46, 23 May 2012 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Seems that it could be proved 33% because it is proved that ALL SUSPECTED SOCKS ARE FROM IRELAND(proved from contribs). But it seems like 1 man is editing from different servers, likely to escape Sockpuppet blocking. I thing we need to make sure he doesn't edit again, in other IP accounts.Mir Almaat Ali Almaat ☏ From Trivandrum, Kerala, India(UTC+5:30) 05:04, 2 June 2012 (UTC)[reply]

Socks seem to be editing under 3 servers.Mir Almaat Ali Almaat ☏ From Trivandrum, Kerala, India(UTC+5:30) 05:07, 2 June 2012 (UTC)[reply]

Please do not use the Likely template, you're not a Checkuser. I've removed it from your comment. Sven Manguard Wha? 05:47, 2 June 2012 (UTC)[reply]

Oh! Sorry!Mir Almaat Ali Almaat ☏ From Trivandrum, Kerala, India(UTC+5:30) 05:48, 2 June 2012 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

Note: Archiving AGK [•] 21:32, 12 June 2012 (UTC)[reply]

2 June 2012

Suspected sockpuppets

User compare report Auto-generated every hour.

Glic16 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Edited Master(now retired)'s userpage.
Edits Articles under the scope of Ireland which master and other socks did.

Seems that all socks did not edit since april. — Preceding unsigned comment added by Mir Almaat 1 S1 (talk • contribs) 05:36, 2 June 2012 (UTC)‎[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Please see my comments here regarding Glic16, I'm positively underwhelmed by the "evidence" of sockpuppetry. 2 lines of K₃₀₃ 00:10, 7 June 2012 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

Oh, that was fun. An editor who has been blocked since 2006, User:Shanequinlan01, has suddenly edited for the first time in years and thrown himself into the mix. I suspect he is the owner of the following list of socks. --Elen of the Roads (talk) 22:40, 6 June 2012 (UTC)[reply]

Clerk note: Since his account was compromised [1] I'm guessing he would never have gotten unblocked anyway. I notice the same interests as well. Good find. Does Glic16 connect as well? Dennis Brown - 2¢ © 22:50, 6 June 2012 (UTC)[reply]

All the socks are linked to each other by checkuser evidence and similarity of edits (edit same articles, use same crummy wordpress sources etc). While there are other editors on some of the IPs (two of the ones listed above are proxies belonging to Trinity College, and there are dozens of students editing on them), Shanequinlan, Exiledone and TheOtherRiverR(h) ine coincide at one point with technically identical evidence, and UNATCOReviewer is a match for Exiledone and TheOtherRiverR(h) ine.

Shanequinlan01 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) He must be the master.
Exiledone (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) Confirmed
TheOtherRiverR(h)ine (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) Confirmed
UNATCOReviewer (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) Confirmed

Technically Glic16 displays no similarities other than editing from the Irish Republic as the other socks do, but the quacking is loud and the technical evidence does not prevent him being a duck. Elen of the Roads (talk) 23:24, 6 June 2012 (UTC)[reply]

It appears that someone knew back in 2006 that Exiledone was Shanequinlan01 - see [2], but for some reason the attending admin decided it was alright for an indefblocked user to just start up another account. Things must have been different then. Elen of the Roads (talk) 23:32, 6 June 2012 (UTC)[reply]

I may be mistaken about this due to inconsistent and slightly contradictory WHOIS output, but it looks like Glic16 is editing through a mobile phone connection, making his connection to the other accounts Inconclusive and impossible to determine on a purely technical level. --(ʞɿɐʇ) ɐuɐʞsǝp 00:04, 7 June 2012 (UTC)[reply]

That's what I meant, apologies if it wasn't clear. Elen of the Roads (talk) 00:11, 7 June 2012 (UTC)[reply]

Note: 2000GUN (Shanequinlan01's "brother" who hasn't edited since 2006) is likely also an unblocked sock. I found 52 common articles with confirmed sock Exiledone and Glic16. ZERO with others except 8 with Shanequinlan01. A rather odd, perhaps coordinated set of numbers. Dennis Brown - 2¢ © 00:09, 7 June 2012 (UTC)[reply]
- No other obvious behavioral links found. Dennis Brown - 2¢ © 00:47, 7 June 2012 (UTC)[reply]
  - Clerk note: Elen indicates that Shanequinlan01 is the master so shouldn't this case be renamed?
    ⋙–Berean–Hunter—► 14:03, 12 June 2012 (UTC)[reply]

03 August 2012

Suspected sockpuppets

134.226.254.162 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

User compare report Auto-generated every hour.

One of the IPs detailed at Wikipedia:Sockpuppet investigations/Exiledone/Archive is currently being used by Exiledone to evade his indef block. Rather than regurgitate the same evidence from there, this, this, this and this are the same as edits detailed as evidence in the previous SPI. Similarly this is a revert to a previous version by Exiledone from March (excluding the one spelling correction obviously). The IP seems to be static as Exiledone has been using it since April, so a reasonably lengthy block should help matters (although he does have access to other IPs). 2 lines of K₃₀₃ 16:14, 3 August 2012 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

IP blocked for one month due to excessive overlap. Dennis Brown - 2¢ © Join WER 11:24, 7 August 2012 (UTC)[reply]