Wikipedia:Sockpuppet investigations/Ceco31/Archive

;Suspected sockpuppets

• {{checkuser|1=Ceco31}}
• {{checkip|1=130.204.140.105}}
• {{checkip|1=81.229.53.130}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=Ceco31 User compare report] Auto-generated every hour.

I suspect that Ceco31 and user with IPs 130.204.140.105 and 81.229.53.130 could be one and the same person. Listed suspect has made a series of significant alteration in a short period of time in the article Turks in Bulgaria some of which clearly unsourced and containing POV against the article. Please see below first edit by user 130.204.140.105 and later the same by Ceco31, in between there are 4 edits by IP 130.204.140.105 and 4 edits by IP 81.229.53.130:

[http://en.wikipedia.org/w/index.php?title=Turks_in_Bulgaria&oldid=478403654]

[http://en.wikipedia.org/w/index.php?title=Turks_in_Bulgaria&oldid=478964535]. As an additional evidence looking at the edit history for Template:Turks at http://en.wikipedia.org/w/index.php?title=Template:Turks&action=history user IP:s 130.204.140.105 and 81.229.53.130 have been making simultaneus edits to the same template and some times within minutes of each other. Hittit (talk) 16:46, 26 February 2012 (UTC) Hittit (talk) 16:46, 26 February 2012 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{clerknote}} Based on edit patterns, I'd say the 130 IP and Ceco are the same, and that the user just decided to register an account. The 81 IP geolocates far away from the other IP, and their edits make me think they're unconnected. Since there's no overlap in the 130 IP and Ceco, I'm closing with no action taken. — HelloAnnyong ^{(say whaaat?!)} 02:19, 1 March 2012 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=Ximhua}}
• {{checkuser|1=Drustur90}}
• {{checkip|1=89.134.203.238}}
• {{checkip|1=77.85.13.195}}
• {{checkip|1=69.253.167.49}}
• {{checkip|1=50.11.215.2}}
• {{checkip|1=65.202.157.163}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=Ceco31 User compare report] Auto-generated every hour.

A content dispute arose on the Bulgaria page a while back. It concerns a date in the infobox - the year 681, or 632 and 1185, which were removed after consensus which the user does not wish to accept. Ever since, a number of IPs kept adding the dates to the infobox. Not always the same group of dates, but the 681 is present in all edits. Me, User:Chipmunkdavis, User:Future Perfect At Sunrise and User:WilliamThweatt have reverted the edits, but the IPs continued changing the content. User:Ceco31 made the same reverts as the anonymous users and has the same demands as these two newly-registered users, along with a number of other similarities as shown below. He was active in making these reverts [http://en.wikipedia.org/w/index.php?title=Bulgaria&action=history immediately before and after] the IP attacks.

One of the IPs mentions in a summary [http://en.wikipedia.org/w/index.php?title=Bulgaria&diff=next&oldid=503844712 this] ("removing 12 centuries of Bulgaria's history is vandalism"). User:Ximhua [http://en.wikipedia.org/w/index.php?title=User_talk:Ceco31&diff=next&oldid=504197764 used the same statement] on the talk page of the supposed puppetmaster. Ximhua, like the IPs, [http://en.wikipedia.org/w/index.php?title=User_talk:Ximhua&diff=504297028&oldid=504241409 has the habit of not signing his comments] [http://en.wikipedia.org/w/index.php?title=Talk:Bulgaria&diff=prev&oldid=504103325 ], speaking to me of a haste to write the comment. Ximhua was registered [http://en.wikipedia.org/w/index.php?title=Special:Log&user=Ximhua on 25 July]. He also uses et cetera (etc.) [http://en.wikipedia.org/w/index.php?title=Wikipedia:Dispute_resolution_noticeboard&diff=504282532&oldid=504281289 far too often], much like Ceco31.[http://en.wikipedia.org/w/index.php?title=Talk:Bulgaria&diff=500785154&oldid=500700417 ] Ceco31 claims there are [http://en.wikipedia.org/w/index.php?title=Bulgaria&diff=prev&oldid=503988332 10 people against], while in fact the number is exaggerated. Ximhua does the same thing - stating the number of people against the current consensus, while including the IPs and the assumed puppets.[http://en.wikipedia.org/w/index.php?title=Talk:Bulgaria&diff=prev&oldid=504159035 ] Very obvious that he is trying to create a false majority to win the dispute. Ximhua [http://en.wikipedia.org/wiki/User_talk:Noleander#Bulgaria_Dispute posts] a message to User:Noleander's talk page stating at least twice that he is new and that this is his "first dispute". Obviously an act - I have never before seen new Wikipedians who directly engage in content dispute and know exactly where to start it. Ximhua is the one who turned to the [http://en.wikipedia.org/w/index.php?title=Wikipedia:Dispute_resolution_noticeboard&diff=prev&oldid=504197430 discussion board in the first place]. Apart from reverts, Ximhua is engaged [http://en.wikipedia.org/w/index.php?title=Wikipedia:Dispute_resolution_noticeboard&diff=504411348&oldid=504391358 in trolling] at the dispute.

An interesting observation would be [http://en.wikipedia.org/w/index.php?title=User_talk:Ceco31&diff=prev&oldid=504306009 this]. Ximhua asks for help Ceco31, who was last active on [http://en.wikipedia.org/wiki/Special:Contributions/Ceco31 July 24] at the evening. The first mass IP attacks [http://en.wikipedia.org/w/index.php?title=Bulgaria&dir=prev&offset=20120716113432&action=history began] in early July, and the registered puppet appeared on the 25th, after Ceco31 stopped his edits. Looks quite dubious to me, if not quite obvious.

Drustur90 [http://en.wikipedia.org/w/index.php?title=Wikipedia:Dispute_resolution_noticeboard&diff=504301667&oldid=504300846 also used et cetera] in a similar fashion to Ceco31 and his other puppet. Drustur90's first contribution was exactly [http://en.wikipedia.org/wiki/Special:Contributions/Drustur90 at the noticeboard], and he was registered [http://en.wikipedia.org/w/index.php?title=Special:Log&user=Drustur90 on July 26]. Guy finds his way well among Wikipedia's noticeboards. - ☣Tourbillon ^{A ?} 18:50, 26 July 2012 (UTC)

One more piece of evidence: Drustur90 forgets to log in, and misspells his own username as [http://en.wikipedia.org/w/index.php?title=Wikipedia:Dispute_resolution_noticeboard&diff=next&oldid=504488808 Druster90]. Ximhua does the same little mistake [http://en.wikipedia.org/w/index.php?title=Wikipedia:Dispute_resolution_noticeboard&diff=504654083&oldid=504653543 a bit later]. Ceco31 mentions him as [http://en.wikipedia.org/w/index.php?title=Wikipedia:Dispute_resolution_noticeboard&diff=next&oldid=504654083 Drastar90] - no idea if he is aware of the investigation and deliberately makes the errors as misinformation tactics, or that Drustur90 is a meatpuppet. I'm very doubtful how such an error can be made accidentally. Looks more like it's made on purpose. In any case we're talking about an obvious puppet here. - ☣Tourbillon ^{A ?} 22:01, 28 July 2012 (UTC)

And finally, convenient timing on July 28:

• [http://en.wikipedia.org/wiki/Special:Contributions/Ximhua Ximhua]'s last activities in the afternoon are in 17:00. [http://en.wikipedia.org/wiki/Special:Contributions/Ceco31 Ceco31] comes next, making some edits in 19:55, 19:56 and 20:17. His next contribution will not come until 21:45, an hour and a half later.
• During this pause, Ximhua makes edits in 21:16, 21:34, 21:44 (a comment on the dispute page) and a minor edit in 21:45. In 21:45, less than a minute later, Ceco31 [http://en.wikipedia.org/w/index.php?title=Wikipedia:Dispute_resolution_noticeboard&diff=prev&oldid=504654234 lands] this statement of support, repeating old statements and obviously done in haste.
• Ximhua makes two more edits in 22:00 and 22:14 (another [http://en.wikipedia.org/w/index.php?title=Wikipedia:Dispute_resolution_noticeboard&diff=prev&oldid=504657741 comment]). He will then mark a pause in contributions until 1:40, when his comment on this page will appear.
• During this 22:14-1:40 pause Ceco31 begins activity once more, with a [http://en.wikipedia.org/w/index.php?title=Wikipedia:Dispute_resolution_noticeboard&diff=prev&oldid=504659577 longer comment] in 22:31, edits in 22:33, 22:57, 22:59, 23:16, 00:24 and last edit in 00:26. The two accounts have no overlapping of activities, and precise timing, especially the 21:44 and 21:45 switch. - ☣Tourbillon ^{A ?} 07:12, 29 July 2012 (UTC)

:You are for banning, dear Tourbillon, I tolerated your inappropriate behavior and the lies about me, unlike you I did not report when you made 3RR and was insolently intruding your decision as the onlyone owner, which you do all the time, but now I will request your banning. Dear ladies and gentlemen, I can guarantee that I have never edited through the IPs or accounts shown in the lie above by Tourbillon. I will notice a COMPLETE different thing, I used an IP but for the last time before several months, but this is a COMPLETE different question, this IP is noone from the lie above, but a COMPLETE different one - 130.204.140.105. There was lied that I made the same arguments as others, before taking a decision, please read them and you will see that this is a lie, Tourbillon just want me blocked beacause I stand in his way - that's all the matter.--Ceco31 (talk) 15:12, 29 July 2012 (UTC)

::The presented evidence speaks otherwise, and you can also tell the users below that "they are for banning". I wonder where that will get you. - ☣Tourbillon ^{A ?} 19:59, 29 July 2012 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Comment I too suspect that there is some definite meatpuppetry, if not outright sockpuppetry going on with these users/IPs.

:*User:Ximhua, User:Drustur90, User:89.134.203.238, User:77.85.13.195, and User:50.11.215.2 all appear to be Single Purpose Accounts.

:*When 69.253.167.49 was [http://en.wikipedia.org/w/index.php?title=Special:Log/block&page=User%3A69.253.167.49 blocked] for violating WP:3RR, 65.202.157.163 began reverting and was [http://en.wikipedia.org/w/index.php?title=Special:Log/block&page=User%3A65.202.157.163 blocked as well], at which point 50.11.215.2 began reverting and was subsequently [http://en.wikipedia.org/w/index.php?title=Special:Log/block&page=User%3A50.11.215.2 blocked].

:*On 24 July, the Bulgaria article [http://en.wikipedia.org/w/index.php?title=Bulgaria&diff=503954549&oldid=503952917 was semi-protected] for "block evasions" and suddenly, User:Ximhua was created to carry on the "fight".

:I've no doubt that these IPs/users are connected, if not the same. As for their connection to User:Ceco31, a quick comparison of the contribution histories and a brief survey of the style of arguments and specific words used leads me to believe strongly that they are sock/meatpuppets, which, if it is indeed the case, amounts to a fairly egregious and premeditated violation of policy considering the edit warring, 3RR violations and block evasions.--William Thweatt ^TalkContribs 01:07, 27 July 2012 (UTC)

• Two passing comments: First, note the similarity in signature style between [http://en.wikipedia.org/w/index.php?title=User_talk:Drustur90&diff=prev&oldid=504426947 Ximhua] and [http://en.wikipedia.org/w/index.php?title=Wikipedia:Dispute_resolution_noticeboard&diff=prev&oldid=504433759 Drustur90] (signature in parentheses) and, second, if puppetry is determined it should be noted that Bulgaria is subject to discretionary sanctions under the DIGWUREN case. Regards, TransporterMan (TALK) 16:20, 27 July 2012 (UTC)
• Comment I agree that there is something up with the users here. Under the technical meaning of socking Ximhua may not be considered a sock as the account was created after the IPs. However, there is an apparent clear violation of the spirit of not socking. Comments such as [http://en.wikipedia.org/w/index.php?title=Talk%3ABulgaria&diff=504167260&oldid=504161415 this one] (Tourbillion posted some similar high vote number examples above), where Ximhua claims "at least 7 users that have expressed their desire in writing on this page that this is amended." There were four registered users, and one who was undecided if we're pushing it, but Ximhua seems to be counting themselves as separate from the IPs, and I highly doubt any completely new user would make a first edit right in the middle of a discussion with seemingly full grasp of the discussion already. Especially as since Ximhua appeared, the IPs disappeared.
• Although the IPs can't be looked at through checkuser, behaviourally they are all definitely linked. The only ones which have ever made edits outside of this immediate dispute (the 65 and 69 ones) are both focused on Bulgarian topics. If it's relevant in any way, this case would fall under WP:ARBMAC. CMD (talk) 17:07, 27 July 2012 (UTC)

Since this mentions me, I can clearly state the following: I have no relation what so ever to ceco31, Drustur90 or any of the other named users who are part of the Bulgaria Infobox dispute. I've been using Wikipedia for a while, yet indeed registered very recently and in order to keep track of my comments.

Please, note that the comments above, are from users who are on the opposing side of the dispute in question. The user Tourbillion for example has insulted other users and even entire nations on a number of occasions. Here are couple of examples:

'''

"you seek to impose your skewed, petty nationalistic point of view. Now, feel free to tell me once more that somebody calling himself a "patriarch" or a "Tsar" is evidence of continuity. I will gladly feel free to ignore it, as will any user who has less patience than me in dealing with trolls. - ☣Tourbillon A ? 16:35, 24 July 2012 (UTC)"'''

"apart from "luk oder country Poland czech republic etc." and lack of common sense. .... . - ☣Tourbillon A ? 21:24, 28 July 2012 (UTC)"

I will not comment any further on this page and hope that WP officials will take these comments into consideration.

(Ximhua (talk) 01:40, 29 July 2012 (UTC))

After reading more about this at: http://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/SPI/Guidance#Defending_yourself_against_claims, I'd like to state, that prior to registering I've been also using Wikipedia (as stated earlier) and editing without a username, so naturally this is via IP and I don't think this is a violation. However, once I registered I started using my username ximhua. Again, I have no relation what so ever to Ceco31 or Drustur90. (Ximhua (talk) 23:53, 29 July 2012 (UTC))

:Out of curiosity, could you please tell us under which IP address you made your previous edits ? - ☣Tourbillon ^{A ?} 15:25, 30 July 2012 (UTC)

:: From this [//en.wikipedia.org/w/index.php?title=User_talk:Lord_Roem&diff=prev&oldid=505031687] edit it seems evident that Ximhua is the same as the IP editor who was edit-warring and got blocked on the Bulgaria page immediately before the account was created, but that much was pretty clear anyway. Fut.Perf. ☼ 06:47, 31 July 2012 (UTC)

• {{CURequest}} - {{Selfendorse}} - Requesting a CU check (on the named accounts only). I see the similarities here, but it's not enough for me to be certain. I think there's enough behavioural evidence here to warrant a check, especially as it may have an impact on a mediation case, combined with the fact that the area is subject to discretionary sanctions. Steven Zhang ^{Get involved in DR!} 07:49, 30 July 2012 (UTC)

::{{possible}}: Drustur90 as a sock of Ceco31. Although they edit from the same country, they use separate ISPs. Behavioural evidence will need to be taken into account in order to reach a final determination, and the possibility of meat- rather than sockpuppetry must be considered. Ceco has also not disclosed that he appears to operate {{checkuser|Kahvehane}}, which is {{tallyho}} from his main account but appears to only contribute to articles about Turkey.

::Ximhua edits from a different continent, and is therefore technically {{unrelated}}. AGK [•] 12:41, 30 July 2012 (UTC)

• {{clerknote}} It is difficult to do much here. The technically linked account doesn't appear to be used in an abuse way, a requirement to be declared a sock. Drustur90 may be a meatpuppet, but it isn't definitive from my observations and I would leave that to the discretion of the admin at the board. The unrelated case is, unrelated. Closing with no prejudice to refile or take action if more evidence becomes available. Dennis Brown - 2¢ © Join WER 02:31, 1 August 2012 (UTC)

----