Wikipedia:Sockpuppet investigations/InkHeart/Archive

__TOC__

{{SPIarchive notice|InkHeart}}

{{SPIpriorcases}}

=== <big>Report date November 24 2009, 04:23 (UTC)</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkuser|1=DelaClaire}}
  • {{checkip|1=99.243.97.117}}

====<span style="font-size:150%"> Evidence submitted by [[User:PC78|PC78]] </span>====

{{ul|DelaClaire}} is a newly created account (within the last 24 hours) whose first edit was an unexplained and rather bold revert of some cleanup I did at A.F.R.I.K.A. [http://en.wikipedia.org/w/index.php?title=A.F.R.I.K.A.&diff=prev&oldid=327461409], and later another revert at the same article to restore numerous issues including copyvios and poor spelling [http://en.wikipedia.org/w/index.php?title=A.F.R.I.K.A.&action=historysubmit&diff=327541655&oldid=327502376]. User has also made several seemingly innocuous edits at Aoi Miyazaki and Hero (2009 TV series). All three articles have previous contributions by indef blocked user {{ul|InkHeart}} and/or multiple socks including {{ul|Belov}}, {{ul|JKSarang}}, {{ul|69dressings}}, {{ul|192.197.54.136}} and {{ul|192.197.54.28}}. I suspect that the account {{ul|DelaClaire}} is being used to evade that block.

{{ul|99.243.97.117}} also made an edit to A.F.R.I.K.A. restoring contributions (including copyvios) made by {{ul|Belov}} [http://en.wikipedia.org/w/index.php?title=A.F.R.I.K.A.&action=historysubmit&diff=327462195&oldid=327461409]. The IP revealed itself to be {{ul|Belov}} in these recent edits [http://en.wikipedia.org/w/index.php?title=Wikipedia:Administrators%27_noticeboard/Incidents&diff=prev&oldid=327130907][http://en.wikipedia.org/w/index.php?title=Wikipedia:Administrators%27_noticeboard/Incidents&diff=prev&oldid=327131095][http://en.wikipedia.org/w/index.php?title=Wikipedia:Administrators%27_noticeboard/Incidents&diff=prev&oldid=327131360]. IP has previously been exposed as a meat/sockpuppet of {{ul|69dressings}} at Wikipedia:Sockpuppet investigations/69dressings/Archive.

This isn't the first time my contributions have been targeted by this person. There was meat/sockpuppetry involved at Wikipedia:Files for deletion/2009 September 26#File:Thirstdvd.jpg which led to the aforementioned investigation. A dispute I had with {{ul|InkHeart}} at Haeundae (film) (see page history) was later continued by {{ul|192.197.54.136}} who apparently claimed to be someone else [http://en.wikipedia.org/w/index.php?title=User_talk:192.197.54.136&diff=next&oldid=326641741] but was later blocked for violating 3RR. Most recently was a dispute at Kim Ok-bin (see page history) with {{ul|Belov}} who I reported to ANI for misusing Twinkle (here) and who was later blocked for abusing multiple accounts. PC78 (talk) 14:18, 24 November 2009 (UTC) (forgot to sign)

:Further evidence for {{ul|DelaClaire}} is the unexplained reverts at Kim Ok-bin [http://en.wikipedia.org/w/index.php?title=Kim_Ok-bin&action=historysubmit&diff=327642182&oldid=327133471] and Son Dam Bi [http://en.wikipedia.org/w/index.php?title=Son_Dam_Bi&action=historysubmit&diff=327642964&oldid=327100559] to restore revisions by {{ul|Belov}}. PC78 (talk) 14:18, 24 November 2009 (UTC)

====<span style="font-size:150%"> Comments by accused parties &nbsp;&nbsp; </span>====

====<span style="font-size:150%"> Comments by other users </span>====

====<span style="font-size:150%"> CheckUser requests </span>====

{{RFCU| E | No2ndletter | checked }}    Requested by PC78 (talk) 04:23, 24 November 2009 (UTC)

{{endorse}} Not certain on the behavioral evidence here. MuZemike 19:48, 24 November 2009 (UTC)

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

  • {{confirmed}}. Dominic·t 10:41, 25 November 2009 (UTC)

====<span style="font-size:150%"> Conclusions </span>====

{{admin-note}} Blocked and tagged. MuZemike 16:52, 25 November 2009 (UTC)

{{SPIclose|archive}}

----

=== <big>Report date December 17 2009, 12:26 (UTC)</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkip|1=66.199.237.22}}
  • {{checkip|1=72.11.138.103 }}

====<span style="font-size:150%"> Evidence submitted by [[User:Ophois|Ophois]] </span>====

I believe these are sockpuppets of the blocked user {{ul|InkHeart}}. She has been blocked indefinitely for creating sockpuppets. These recent ones have pretty much only edited stuff that Inkheart had, and is following the same MO of removing improvement templates. When I reverted the removal, the user told me to [http://en.wikipedia.org/w/index.php?title=File:InvincibleLeePyungKang_Poster.jpg&diff=prev&oldid=332276857 "f*** off!"]. Ωphois 12:26, 17 December 2009 (UTC)

====<span style="font-size:150%"> Comments by accused parties </span>====

====<span style="font-size:150%"> Comments by other users </span>====

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

====<span style="font-size:150%"> Conclusions </span>====

{{clerk-note}} IPs already blocked. MuZemike 01:02, 19 December 2009 (UTC)

----

=== <big>Report date December 30 2009, 00:26 (UTC)</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkuser|1=InkHeart}}
  • {{checkuser|1=Clara20}}

  • {{checkip|1=24.114.255.83 }}
  • {{checkip|1=66.199.237.22 }}
  • {{checkip|1= 69.159.197.246}}
  • {{checkip|1= 72.11.138.91 }}
  • {{checkip|1=72.11.138.103 }}
  • {{checkip|1= 72.11.138.117}}
  • {{checkip|1=99.253.86.157 }}
  • {{checkip|1=192.197.54.136 }}
  • {{checkip|1=192.197.54.28 }}

====<span style="font-size:150%"> Evidence submitted by [[User:Ophois|Ophois]] </span>====

All of the above have been blocked for being a sockpuppet of InkHeart. InkHeart has been able to repeatedly avoid her ban by using anons, and on the suggestion of an admin, I would like to request a CheckUser to determine an IP range that can be blocked with little collateral damage. Ωphois 00:26, 30 December 2009 (UTC)

====<span style="font-size:150%"> Comments by accused parties &nbsp;&nbsp; </span>====

====<span style="font-size:150%"> Comments by other users </span>====

====<span style="font-size:150%"> CheckUser requests </span>====

{{RFCU| E | No2ndletter | decline }}    Requested by Ωphois 00:26, 30 December 2009 (UTC)

{{decline}} per Nathan. –MuZemike 16:45, 31 December 2009 (UTC)

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

  • You don't really need a checkuser to see if a rangeblock is possible; just looking at what you've listed there, all IPs but one locate to Ontario, Canada. Unfortunately, it looks like they are on multiple different ranges, including shared IPs for Bell Canada and a university in Ontario. That makes the utility of a CU pretty limited. Any reason to suspect that there might be other accounts, either with limited activity or sleepers? Nathan T 22:20, 30 December 2009 (UTC)

::[http://en.wikipedia.org/wiki/Category:Wikipedia_sockpuppets_of_InkHeart This] gives a list of other accounts, although they've been blocked. I've come across some anon's I've suspsected were her, but I couldn't be sure. It would be too difficult to try to find them. Ωphois 22:36, 30 December 2009 (UTC)

====<span style="font-size:150%"> Conclusions </span>====

{{admin-note}} 192.197.54.0/24 blocked 3 months by myself, other separate IPs have already been blocked 3 months, and 72.11.138.64/26 blocked 2 years as a proxy. –MuZemike 16:46, 31 December 2009 (UTC)

{{SPIclose|archive}}

----

=== <big>Report date January 31 2010, 15:23 (UTC)</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkip|1=61.19.243.11}}
  • {{checkip|1=222.166.160.57}}
  • {{checkip|1=222.166.160.22}}

====<span style="font-size:150%"> Evidence submitted by [[User:Phantomsteve|Phantomsteve]] </span>====

  1. Lee Jun Ki article changed to pre-consensus version as favoured by InkHeart
  2. [http://en.wikipedia.org/w/index.php?title=Lee_Jun_Ki&diff=341040484&oldid=335772475 05:51, 31 January 2010] by {{user|61.19.243.11}}
  3. [http://en.wikipedia.org/w/index.php?title=Lee_Jun_Ki&diff=341072090&oldid=341048590 11:38, 31 January 2010] by {{user|222.166.160.57}}
  4. Talk:Lee Jun Ki talk page blanked apart from WikiProject headers
  5. [http://en.wikipedia.org/w/index.php?title=Talk:Lee_Jun_Ki&oldid=341072389 11:41, 31 January 2010] by {{user|222.166.160.22}}

====<span style="font-size:150%"> Comments by accused parties </span>====

====<span style="font-size:150%"> Comments by other users </span>====

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

{{RFCU| E| No2ndletter | Decline }}    Requested by -- PhantomSteve/talk|contribs\ 15:23, 31 January 2010 (UTC)

{{Decline}} IPs geolocate to Hong Kong and Thailand, respectively. Either proxies, or meatpuppetry, or the user has been traveling, since most of his old IPs are from Canada. Checkuser is not going to tell you anything useful here. {{duck}}, I recommend a block on behavior. Tim Song (talk) 02:02, 1 February 2010 (UTC)

{{SPIclose|archive}}

----

=== <big>Report date May 5 2010, 13:54 (UTC)</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkuser|1=Yimiju}}
  • {{checkip|1=220.181.66.163}}
  • {{checkip|1=212.100.250.207}}
  • {{checkip|1=221.130.162.232}}
  • {{checkip|1=60.217.232.66}}
  • {{checkip|1=189.90.240.21}}
  • {{checkip|1=99.243.113.181}}
  • {{checkuser|1=EunSoo}}
  • {{checkip|1=205.211.158.49}}
  • {{checkuser|1=NavalC}}
  • {{checkip|1=173.33.207.56}}
  • {{checkip|1=99.243.108.148}}
  • {{checkip|1=192.197.54.28}}

====<span style="font-size:150%"> Evidence submitted by [[User:ThaddeusB|ThaddeusB]] </span>====

I am told these IPs are the work on blocked user InkHeart. I do not know if that is true or not, but excluding 220.181 they are clearly all the same person (switching IPs to continue edit wars). Most have already been blocked as proxies. However, I am requested CU for a few reasons:

  • While there is no doubt Yimiju and 220.181 are the same, there is a slim chance Yimiju is unrelated to the other IPs
  • 189.90 seems to be a transparent proxy, so the user's real IP should appear in the log headers, if I'm not mistaken. I don't know if that info will help prevent further abuse or not, but I thought it might help
  • If Yimiju is related, as I suspect, there may be other sleeper accounts out there.

Thanks, ThaddeusB (talk) 13:54, 5 May 2010 (UTC)

Adding EunSoo as possibly related to Yimiju based on:

  • Very similar editing interests
  • EunSoo sought adoption, which is not all that well known, on his first edit [http://en.wikipedia.org/w/index.php?title=User:EunSoo&oldid=358260614]. Yimiju had previous discovered adoption.[http://en.wikipedia.org/w/index.php?title=Wikipedia_talk:Adopt-a-User&diff=prev&oldid=351036019] ... InkHeart also [http://en.wikipedia.org/w/index.php?title=User_talk:Phoebe&diff=prev&oldid=326541331 sought a mentor]
  • Both users uploaded fair use TV show posters early in their careers. [http://en.wikipedia.org/w/index.php?title=File:Personalpreference.jpg&action=history][http://en.wikipedia.org/w/index.php?title=File%3ANana_movie.jpg&action=historysubmit&diff=359987380&oldid=298807969], showing sophistication beyond their age.

--ThaddeusB (talk) 19:00, 5 May 2010 (UTC)

More suspects:

  • 205.211 has a strange edit history - [http://en.wikipedia.org/w/index.php?title=My_Girl_%282005_TV_series%29&diff=prev&oldid=351570431 first recent edit] has ES of "same as sock" -and geolocates to Ontario. Other 205.211.158.Xs are involved with unrelated history.[http://en.wikipedia.org/wiki/Special:Contributions/205.211.158.102][http://en.wikipedia.org/wiki/Special:Contributions/205.211.158.59][http://en.wikipedia.org/wiki/Special:Contributions/205.211.158.26][http://en.wikipedia.org/wiki/Special:Contributions/205.211.158.18][http://en.wikipedia.org/wiki/Special:Contributions/205.211.158.141] Likely a set of public computers; candidate for range block.
  • NavalC is already blocked on DUCK grounds, but may not yet be stale.
  • 173.33 is almost certainly related and geolocates to Toronto.
  • 99.243 geolocates to Whitby, Ontario is a candidate for range blocking
  • 192.197 geolocates to Whitby, but also has some apparently unrelated history - likely a public computer

--ThaddeusB (talk) 19:39, 5 May 2010 (UTC)

====<span style="font-size:150%"> Comments by accused parties </span>====

====<span style="font-size:150%"> Comments by other users </span>====

These can't all be InkHeart, unless she moves around a lot:

class="wikitable"

!IP

!Geographical location
(WHOIS)

189.90.240.21Brazil
220.181.66.163China
221.130.162.232China
60.217.232.66China
212.100.250.207GB

I think the CU should be restricted to areas that InkHeart is known to have edited from. -- PhantomSteve/talk|contribs\ 14:02, 5 May 2010 (UTC)

:All of those are proxies, kind regards, SpitfireTally-ho! 14:04, 5 May 2010 (UTC)

::OK, sorry for that -- PhantomSteve/talk|contribs\ 14:06, 5 May 2010 (UTC)

:::The trout is just thawing out at the moment. {{=)|tongue}} SpitfireTally-ho! 14:08, 5 May 2010 (UTC)

::::This is why I don't very often get involved with commenting on SPIs - apart from the couple I've reported myself, of course! -- PhantomSteve/talk|contribs\ 19:15, 5 May 2010 (UTC)

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

{{RFCU| E | No2ndletter | Checked }}    Requested by ThaddeusB (talk) 13:54, 5 May 2010 (UTC)

{{Endorse}} Pretty convincing behavior here. Kevin Rutherford (talk) 20:04, 5 May 2010 (UTC)

{{possible}} that the following users are the same (maybe this IP is a proxy):

  • {{checkuser|Yimiju}}
  • {{checkuser|Livapol}}

{{confirmed}} that the following users are the same:

  • {{checkuser|Yimiju}}
  • {{checkuser|Coconut2Milk}}

{{confirmed}} that the following users are the same:

  • {{checkuser|EunSoo}}
  • {{checkuser|Izsu}}

Beyond this, I know nothing. --Deskana (talk) 14:06, 8 May 2010 (UTC)

:Well the confirmed accounts are blocked, and since Izsu hasn't done anything I see no issue with EunSoo. Closing. ~ Amory (utc) 00:58, 15 May 2010 (UTC)

{{SPIclose|archive}}

----

===<big>08 June 2010</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkuser|Urgenine}}
  • {{checkuser|EunSoo}}

====<span style="font-size:150%"> Evidence submitted by [[User:Dpmuk|Dpmuk]] </span>====

A new user that has only started editing since the potential sockmaster was [http://en.wikipedia.org/w/index.php?title=Special:Log/block&page=User%3AEunSoo blocked]. Similar edit pattern:

  1. Both users moving already existing refimprove tags to the reference section [http://en.wikipedia.org/w/index.php?title=SS501&diff=prev&oldid=365987175 EunSoo] and [http://en.wikipedia.org/w/index.php?title=Oltul_Mic_River&diff=prev&oldid=366868013 Urgenine]
  2. Both users !voting here and here for moves using a similar unusual style.
  3. Same slightly odd language about names already being taken, along with a misunderstanding of how wikipedia works, e.g. [http://en.wikipedia.org/w/index.php?title=Talk:Kahi_(entertainer)&diff=365575219&oldid=365573664 EunSoo] and [http://en.wikipedia.org/w/index.php?title=Talk:Cha_Hyun_Ok&diff=prev&oldid=366869124 Urgenine]

Dpmuk (talk) 21:59, 8 June 2010 (UTC)

====<span style="font-size:150%"> Comments by accused parties </span>====

====<span style="font-size:150%"> Comments by other users </span>====

If checkusers need more examples of this user, you can look on my User talk:Syrthiss#Edit_war:_Girls.27_Generation and the EunSoo sock section following it. I'm only familiar with this user's removal of Japanese characters from infoboxes and disruptive edit warring behavior, but agree that the above looks suspicious. Syrthiss (talk) 11:18, 9 June 2010 (UTC)

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

{{RFCU|E|No2ndLetter|Checked}}

  • {{Endorse}} - The evidence on Syrthiss's page raises a concern because of proxies. A checkuser should help sort out this matters. Icestorm815Talk 17:42, 9 June 2010 (UTC)

{{confirmed}} EunSoo to also be

  • {{checkuser|Urgenine}}
  • {{checkuser|Karry145}}
  • {{checkuser|Izsu}}
  • {{checkuser|CatFinkle}}
  • {{checkuser|CrryM}}

Amalthea 20:30, 9 June 2010 (UTC)

All accounts blocked and tagged. Icestorm815Talk 20:44, 9 June 2010 (UTC)

{{clerknote}} archived from Wikipedia:Sockpuppet investigations/EunSoo. SpitfireTally-ho! 17:09, 22 June 2010 (UTC)

{{SPIclose|archive}}

----

===<big>09 June 2010</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkuser|1=Urgenine}}
  • {{checkuser|1=DePiep}}

====<span style="font-size:150%"> Evidence submitted by [[User:NickCT]] </span>====

These users have a very suspisously timed run of edits discussed here. Additionally, the area of interest is the same, and the language is similar. NickCT (talk) 21:17, 9 June 2010 (UTC)

:Forgot to mention that User:Urgenine became a confirmed sock of User:EunSoo. This is my first SPI filing. Please let me know if I have done anything incorrectly. Thanks, NickCT (talk) 21:19, 9 June 2010 (UTC)

====<span style="font-size:150%"> Comments by accused parties </span>====

See Defending yourself against claims.

:No proof. No sock. Bad Faith and WP:Wikihounding by NickCT. Could someone kill this WP:ATTACK right away? -DePiep (talk) 22:22, 9 June 2010 (UTC)

:: Please don't take it personally, Nick was, I believe, only focusing on Talk:Rain (entertainer), where the comment of a brand new user looked fishy (see here). It was fishy, but the conclusion was wrong. Amalthea 22:51, 9 June 2010 (UTC)

:::I was actually focusing on [http://en.wikipedia.org/w/index.php?title=User_talk%3AMuZemike&action=historysubmit&diff=367052883&oldid=367048499 this]. Does this not look suspisous? NickCT (talk) 23:03, 9 June 2010 (UTC)

::::RE Amalthea: please stop the "I think" and "fishy". Clearly NickCT keeps finding mud in that. Just be explicit in your conclusion. -DePiep (talk) 23:24, 9 June 2010 (UTC)

:::::OK, I only just saw the other, clear post by Amalthea below. -DePiep (talk) 23:26, 9 June 2010 (UTC)

:::: If you look at the whole contributions history of Urgenine and his other incarnations, if you look what he did before and what he did afterwards, if you look at how Urgenine got to those pages, it actually isn't at all suspicious. It's two people editing at the same time, and meeting on the same page once. Amalthea 00:02, 10 June 2010 (UTC)

::: I bow to your greater wisdom and experience. NickCT (talk) 00:07, 10 June 2010 (UTC)

====<span style="font-size:150%"> Comments by other users </span>====

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

{{RFCU| CODE LETTER | No2ndletter | decline}}    Requested by NickCT (talk) 21:17, 9 June 2010 (UTC)

Is there any evidence for it besides taking DePiep's side in that move discussion? As you can see Urgenine commented in six move discussions right away, and DePiep only participated in that one. Urgenine had been pointed towards WP:Requested Moves in the EunSoo incarnation shortly before his block, I assume he just went there with the new account. Amalthea 22:00, 9 June 2010 (UTC)

: Closing this. Besides my above comment I'm confident that I didn't miss anything when I previously checked EunSoo a few hours ago. Amalthea 22:54, 9 June 2010 (UTC)

{{clerknote}} archived from Wikipedia:Sockpuppet investigations/EunSoo. SpitfireTally-ho! 17:09, 22 June 2010 (UTC)

{{SPIclose|archive}}

----

===<big>10 June 2010</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkuser|1=Dreaded22}}

====<span style="font-size:150%"> Evidence submitted by [[User:Dpmuk|Dpmuk]] </span>====

Another newly created editor. Making edits to BI and Bi (disambiguation) to try to achieve the same results as EunSoo has done previously with a (reverted) move (due to the number of edits by both accouts providing diffs is difficult - sorry). When these changes were reverted has resorted to asking for an "unconterversial" move, a tactic EunSoo has used, and Dreaded22's [http://en.wikipedia.org/w/index.php?title=Wikipedia:Requested_moves&diff=prev&oldid=367194290 comment] when asking for it is telling. Asking for check user as a) I don't think it's quite enough for WP:DUCK, b) given the number of sockpuppets discovered yesterday there may well be other newly created accounts out there and c) to investiagte the possibilty of a range block as they don't seem to be going away. Dpmuk (talk) 13:27, 10 June 2010 (UTC)

====<span style="font-size:150%"> Comments by accused parties </span>====

====<span style="font-size:150%"> Comments by other users </span>====

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

{{RFCU| E | No2ndletter | Checked }}    Requested by Dpmuk (talk) 13:27, 10 June 2010 (UTC)

{{confirmed}} Dreaded22 as the same as EunSoo, open proxy blocked. Amalthea 13:42, 10 June 2010 (UTC)

{{clerknote}} archived from Wikipedia:Sockpuppet investigations/EunSoo. SpitfireTally-ho! 17:09, 22 June 2010 (UTC)

{{SPIclose|archive}}

----

===<big>11 June 2010</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkuser|1=Pollosh}}

====<span style="font-size:150%"> Evidence submitted by [[User:Dpmuk|Dpmuk]] </span>====

Newly created account (after block of last known sock). Commenting on the move of Bi a move started by another of their socks. Nearly identical misunderstanding of WP:PRIMARYTOPIC [http://en.wikipedia.org/w/index.php?title=Talk:BI&diff=367426889&oldid=367397673 by Pollosh] and by Eunsoo. Think I've seen more similar statements by EunSoo or one of his socks but currently can't find where. Dpmuk (talk) 17:16, 11 June 2010 (UTC)

====<span style="font-size:150%"> Comments by accused parties </span>====

====<span style="font-size:150%"> Comments by other users </span>====

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

{{RFCU| E | No2ndletter | Checked }}    Requested by Dpmuk (talk) 17:16, 11 June 2010 (UTC)

{{confirmed}}. For what it's worth, this might actually all be Wikipedia:Sockpuppet investigations/InkHeart. Amalthea 18:44, 11 June 2010 (UTC)

{{clerknote}} archived from Wikipedia:Sockpuppet investigations/EunSoo. SpitfireTally-ho! 17:09, 22 June 2010 (UTC)

{{SPIclose|archive}}

----

===<big>21 June 2010</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkuser|1=Mageclansoftheeast}}
  • {{checkuser|1=Carl Francis}}

====<span style="font-size:150%"> Evidence submitted by [[User:Sleep1panic|Sleep1panic]] </span>====

I saw this http://en.wikipedia.org/wiki/User_talk:Chzz#Suspicion and decided to go through what the user said and it turns out that 2 of the 3 users happen to edit the same pages, mostly between User:Mageclansoftheeast and User:Carl Francis. Sleep1panic (talk) 23:11, 21 June 2010 (UTC)

  • http://en.wikipedia.org/w/index.php?title=Mikee_Lee&action=history
  • http://en.wikipedia.org/w/index.php?title=Olango_Island_Group&action=history
  • http://en.wikipedia.org/w/index.php?title=The_Real_Me_%28album%29&action=history
  • http://en.wikipedia.org/w/index.php?title=Patrick_Garcia&action=history
  • http://en.wikipedia.org/w/index.php?title=Maricar_Reyes&action=history
  • http://en.wikipedia.org/w/index.php?title=Mahal_Kita_%28TV_series%29&action=history
  • http://en.wikipedia.org/w/index.php?title=Daniel_Henney&action=history
  • http://en.wikipedia.org/w/index.php?title=Gimik_2010&action=history

====<span style="font-size:150%"> Comments by accused parties </span>====

====<span style="font-size:150%"> Comments by other users </span>====

[http://en.wikipedia.org/w/index.php?title=Ha_Seok-jin&action=history Ha Seok-jin] from 2008. wiooiw (talk) 23:58, 21 June 2010 (UTC)

[http://en.wikipedia.org/w/index.php?title=Janelle_Quintana&action=history Janelle Quintana]

[http://en.wikipedia.org/w/index.php?title=Talk:Unstoppable_Marriage&action=history Talk:Unstoppable_Marriage]

[http://en.wikipedia.org/w/index.php?title=Malaya_Lewandowski&action=history Malaya Lewandowski]

+ a few others. wiooiw (talk) 03:54, 22 June 2010 (UTC)

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

{{RFCU| CODE LETTER | No2ndletter |Checked}}    Requested by Sleep1panic (talk) 23:11, 21 June 2010 (UTC)

  • {{Endorse}} - To check on the filer. T. Canens (talk) 02:48, 22 June 2010 (UTC)

{{Confirmed}} that

  • {{checkuser|Sleep1panic}}
  • {{checkuser|Wetcloth20}}
  • {{checkuser|EunSoo}}

are all the same (Wikipedia:Sockpuppet investigations/EunSoo). Person behind them has edited through numerous proxies, is unsurprisingly also the one who made {{diff2|369423851|the anonymous edit}} on Chzz's page that allegedly caused this SPI case. Amalthea 13:29, 22 June 2010 (UTC)

:{{Admin-note}} Sleep1panic blocked. I would suggest this be filed either under EunSoo or Inkheart, based on Amalthea's last note here. TNXMan 13:41, 22 June 2010 (UTC)

{{SPIclose|archive}}

----

===<big>25 June 2010</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkuser|1=RevHens}}
  • {{checkuser|1=Metafold010}}
  • {{checkip|1=195.228.25.66}}
  • {{checkip|1=123.49.32.232}}
  • {{checkip|1=85.122.26.75}}
  • {{checkip|1=217.196.164.35}}
  • {{checkip|1=61.47.57.234}}
  • {{checkip|1=77.44.255.13}}
  • {{checkip|1=213.178.224.178}}

====<span style="font-size:150%"> Evidence submitted by [[User:Elockid|Elockid]] </span>====

The IPs listed get a lot of hits that they are open proxys when searched on Google. Pretty consistent with previous reports of using open proxies. I've blocked some IPs but require assistance to block the IPs for an appropriate period.

Basically targeting Mageclansoftheeast again and editing the same pages as the other socks. Elockid (Talk) 02:38, 25 June 2010 (UTC)

====<span style="font-size:150%"> Comments by accused parties </span>====

====<span style="font-size:150%"> Comments by other users </span>====

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

{{RFCU| F | No2ndletter | Checked}}    Requested by Elockid (Talk) 02:38, 25 June 2010 (UTC)

{{endorse}} to block whatever proxies they're editing from and a sleeper check or check for any missed accounts. Elockid (Talk) 02:38, 25 June 2010 (UTC)

Blocked a load of proxies, {{confirmed}}

  • {{checkuser|Metafold010}}
  • {{checkuser|RevHens}}
  • {{checkuser|Hny3000}}
  • {{checkuser|GiftSolid}}

as EunSoo. I blocked them, but did not check if further action should be taken. I think it's safe to say that the person behind these accounts is effectively banned, I for one would begin to treat their edits and page creations accordingly. Amalthea 11:55, 25 June 2010 (UTC)

:{{Admin-note}} These accounts have already been blocked and tagged. TNXMan 13:37, 25 June 2010 (UTC)

{{SPIclose|archive}}

----

===<big>29 July 2010</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkuser|1=Yoyuta}}
  • {{checkuser|1=Jenaveev18}}
  • {{checkip|1=93.62.4.207}}

====<span style="font-size:150%"> Evidence submitted by [[User:Jeff G.|Jeff G.]] </span>====

Per [http://en.wikipedia.org/w/index.php?title=Wikipedia:Administrators'_noticeboard/Edit_warring&action=historysubmit&diff=376011100&oldid=376009455 these edits]:

User:93.62.4.207 reported by User:Ophois (Result: 31 hours)

Page: {{pagelinks|Zhang Ziyi}}

User being reported: {{userlinks|93.62.4.207}}

Previous version reverted to: [diff preferred, link permitted]

  • 1st revert: [http://en.wikipedia.org/w/index.php?title=Zhang_Ziyi&diff=376008675&oldid=376007638 diff]
  • 2nd revert: [http://en.wikipedia.org/w/index.php?title=Zhang_Ziyi&diff=376009465&oldid=376009213 diff]
  • 3rd revert: [http://en.wikipedia.org/w/index.php?title=Zhang_Ziyi&diff=376010057&oldid=376009860 diff]
  • 4th revert: [http://en.wikipedia.org/w/index.php?title=Zhang_Ziyi&diff=376010332&oldid=376010217 diff]

Diff of edit warring / 3RR warning: [http://en.wikipedia.org/w/index.php?title=User_talk:93.62.4.207&diff=376010202&oldid=376009397 link]

Diff of attempt to resolve dispute on article talk page: [diff]

Comments: Myself and User:Oncamera believe this anon to be a sockpuppet of User:InkHeart, who has been banned but keeps returning as socks and anons. We also believe that Special:Contributions/Yoyuta, an account that was created today and follows the same editing style, is another sock of hers, as well as Special:Contributions/Jenaveev18. Ωphois 01:11, 29 July 2010 (UTC)

:Blocked by Elockid.   — Jeff G.  ツ 03:38, 29 July 2010 (UTC)   — Jeff G.  ツ 03:44, 29 July 2010 (UTC)

====<span style="font-size:150%"> Comments by accused parties &nbsp;&nbsp; </span>====

====<span style="font-size:150%"> Comments by other users </span>====

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

{{endorse}}. There's something suspicious going on here. If those accounts are InkHeart/EunSoo editing through open proxies, a block on those proxies would be nice. Previous checks have also found other accounts present. Elockid (Talk) 03:54, 29 July 2010 (UTC)

  • nothing additional to be found on proxy {{ip|93.62.4.207}}. John Vandenberg (chat) 13:09, 29 July 2010 (UTC)
  • {{user|Jenaveev18}} was on {{ip|189.19.88.153}} (BR), {{ip|41.217.220.7}} (Africa), {{ip|118.96.146.83}} (ID), {{ip|200.35.36.158 }} (CO) and {{ip|195.55.130.246}}. and {{ip|195.55.130.246}} (ES). IP 41.217.220.7 has a slow stream of other contributors, and it provides XFF. All others have only Jenaveev18 & anon edits which are also Jenaveev18. John Vandenberg (chat) 13:28, 29 July 2010 (UTC)
  • {{confirmed}}: {{user|Jenaveev18}} = {{user|Pollosh}} = InkHeart.
    {{user|Yoyuta}} is {{likely}} (also in Canada). John Vandenberg (chat) 13:35, 29 July 2010 (UTC)
  • {{adminnote}} I've blocked the relevant socks for the relevant period. All the IPs were open proxies, though 195.55.130.246 has possibly since been reformed. -- zzuuzz (talk) 14:54, 29 July 2010 (UTC)
  • {{Admin-note}} Socks tagged, marking for close. TNXMan 15:29, 29 July 2010 (UTC)

----

===<big>06 August 2010</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkuser|1=UltraMiracle}}
  • {{checkip|1=96.45.189.227}}
  • {{checkip|1=66.199.245.40}}

====<span style="font-size:150%"> Evidence submitted by [[User:Dpmuk|Dpmuk]] </span>====

Think they're back again. See these "uncontroversial" move requests - [http://en.wikipedia.org/w/index.php?title=Wikipedia%3ARequested_moves&action=historysubmit&diff=377452949&oldid=377450635] and [http://en.wikipedia.org/w/index.php?title=Wikipedia:Requested_moves&diff=377441249&oldid=377439222]. Same moves, similar reasoning, same bad English, same attempt to run around system by listing as uncontroversial. Requesting checkuser given the number of sockpuppets checkuser has uncovered in the past - when they've come back they've normally done it en-masse. Dpmuk (talk) 10:44, 6 August 2010 (UTC)

Added 66.199.245.40 - has reverted my removal of the move requests twice. Once I could have put down to a concerned editor but given the similar language in the second revert and the simple reverting, rather than moving to contested or starting a full requested move as I suggested in the edit log - which by their comment they're aware of, they've done enough to make me suspicious. Dpmuk (talk) 10:58, 6 August 2010 (UTC)

====<span style="font-size:150%"> Comments by accused parties &nbsp;&nbsp; </span>====

====<span style="font-size:150%"> Comments by other users </span>====

I blocked {{checkuser|66.199.245.40}} for 6 months, just now. It was reverting this SPI request off the page. Syrthiss (talk) 11:55, 6 August 2010 (UTC)

:Actually, I just went ahead and blocked the other IP for 6 months and the named account indef. Syrthiss (talk) 12:01, 6 August 2010 (UTC)

::And {{checkuser|66.199.245.45}}. Syrthiss (talk) 12:04, 6 August 2010 (UTC)

:::And {{checkuser|187.16.247.181}}. Syrthiss (talk) 12:14, 6 August 2010 (UTC)

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

{{endorse}} – I just blocked another one earlier this morning:

  • {{checkuser|PollyAhn}}

MuZemike 13:37, 6 August 2010 (UTC)

{{admin-note}} 66.199.245.40/29 blocked 2 days for clear block evasion. –MuZemike 13:39, 6 August 2010 (UTC)

There's really nothing to do here. --Deskana (talk) 19:26, 9 August 2010 (UTC)

----

===<big>04 September 2010</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkip|1=96.45.189.199}}
  • {{checkip|1=201.88.202.10}}
  • {{checkip|1=189.10.100.34}}
  • {{checkip|1=77.245.75.51}}
  • {{checkip|1=201.90.74.2}}

====<span style="font-size:150%"> Evidence submitted by [[User:SKS2K6|SKS2K6]] </span>====

WP:DUCK. See previous examples — specifically, requested "non-controversial" page moves for Kahi (entertainer) and Jessica (entertainer). IPs very close to previous socks. SKS (talk) 06:18, 4 September 2010 (UTC)

====<span style="font-size:150%"> Comments by accused parties &nbsp;&nbsp; </span>====

====<span style="font-size:150%"> Comments by other users </span>====

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

  • 96.45.189.199 is in Canada - WP:DUCK
  • {{ip|201.88.202.10}}, {{ip|189.10.100.34}} and {{ip|201.90.74.2}} are all proxies in Brazil.
  • {{ip|77.245.75.51}} is probably a proxy.

John Vandenberg (chat) 07:24, 4 September 2010 (UTC)

  • {{adminnote}} All Brazil proxies blocked for 3 months, the other one for 1 year (may up the expiry time). It's a web proxy (easy-hide-ip). Bsadowski1 07:35, 4 September 2010 (UTC)
  • Marking for close. TNXMan 13:54, 4 September 2010 (UTC)

----

===<big>05 September 2010</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkip|1=89.184.39.190}}

====<span style="font-size:150%"> Evidence submitted by [[User:SKS2K6|SKS2K6]] </span>====

Again with Jessica (entertainer). This one is a bit less clear, only because the IP has made previous edits (way before) outside of the Korean pop world, but Google confirms that it's a proxy. The IP is also quite insistent on re-adding the page move request made by previous socks. SKS (talk) 16:55, 5 September 2010 (UTC)

====<span style="font-size:150%"> Comments by accused parties &nbsp;&nbsp; </span>====

====<span style="font-size:150%"> Comments by other users </span>====

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

  • {{decline}}. Obvious, and the latest have been IPs rather than accounts. CheckUser won't be useful here. PeterSymonds (talk) 17:05, 5 September 2010 (UTC)
  • {{clerknote}} Proxyblocked the IP for a year. PeterSymonds (talk) 17:05, 5 September 2010 (UTC)

----

===<big>14 September 2010</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkuser|1=Okaiyo}}
  • {{checkIP|200.31.107.98}}
  • {{checkIP|210.243.157.250}}
  • {{checkIP|189.84.116.88}}
  • {{checkIP|201.16.244.186}}
  • {{checkIP|118.98.160.138}}

====<span style="font-size:150%"> Evidence submitted by [[User:SKS2K6|SKS2K6]] </span>====

Again with Kahi (entertainer). For a "new" user, s/he seems to know how to do page moves and contact the admin previously involved with the move. SKS (talk) 16:27, 14 September 2010 (UTC)

:Edit: added an IP that did only edit: to request Jessica Jung to be moved.... SKS (talk) 16:46, 14 September 2010 (UTC)

::Even more, related to Kahi and Jessica....... SKS (talk) 18:26, 14 September 2010 (UTC)

====<span style="font-size:150%"> Comments by accused parties &nbsp;&nbsp; </span>====

====<span style="font-size:150%"> Comments by other users </span>====

  • I blocked it. Whether or not it is InkHeart (pretty sure), its was clear that it was doing null edits to get autoconfirmed just so it could move the page. Syrthiss (talk) 16:36, 14 September 2010 (UTC)
  • In http://en.wikipedia.org/w/index.php?title=User_talk%3AAnthony_Appleyard&action=historysubmit&diff=384839294&oldid=384835941 this edit to my user talk page, User:99.243.104.16 altered the text of messages left there by other people. Anthony Appleyard (talk) 21:53, 14 September 2010 (UTC)

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

The account is already blocked. I'll leave this open for a while in case something new comes along. TNXMan 16:33, 14 September 2010 (UTC)

{{adminnote}}: I need {{user|201.16.244.186}} to be blocked an appropriate length. Elockid (Talk) 22:15, 14 September 2010 (UTC)

:and {{user|118.98.160.138}} Elockid (Talk) 22:16, 14 September 2010 (UTC)

:Also Talk:Kahi (entertainer) semi-protected. Elockid (Talk) 22:20, 14 September 2010 (UTC)

  • Everything seems done here. -- DQ (t) (e) 02:20, 15 September 2010 (UTC)

----

===<big>19 September 2010</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkip|1=219.87.154.164}}
  • {{checkip|1=99.243.108.148}}

====<span style="font-size:150%"> Evidence submitted by [[User:SKS2K6|SKS2K6]] </span>====

So...back to Kahi. The reason I'm asking for a CheckUser request is that the two IPs are making concurrent edits on the same page, seemingly going against each other...but 219.87.154.164 appears to be a proxy, whereas 99.243.108.148 has historical edits that are similar to InkHeart's edit history. SKS (talk) 01:19, 19 September 2010 (UTC)

====<span style="font-size:150%"> Comments by accused parties &nbsp;&nbsp; </span>====

====<span style="font-size:150%"> Comments by other users </span>====

[http://en.wikipedia.org/w/index.php?title=Special:Log&type=block&page=User%3A99.243.108.148 Check not necessary.] -- wiooiw (talk) 03:49, 19 September 2010 (UTC)

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

{{decline}} Followed CU's previous action for the latter IP. The former IP is blocked as a proxy. Nothing more to do here, so declining the check and closing. --Shirik (Questions or Comments?) 04:09, 19 September 2010 (UTC)

----

===<big>04 November 2010</big>===

{{SPIcat}}

====<span style="font-size:150%"> Suspected sockpuppets </span>====

  • {{checkuser|1=Ohlly}}

====<span style="font-size:150%"> Evidence submitted by [[User:Syrthiss|Syrthiss]] </span>====

Editor reinstated an edit from a blocked proxy (likely Inkheart) on Talk:Sunny (Korean entertainer). When I removed the edit, user came to my talk page and asked why a proxy block would == a banned user. This is kind of the same disingenuous stuff Inkheart does, so its probably worthwhile to do a check. I didn't see an obvious editing indication that this was InkHeart, but they did have some dustups immediately upon editing and that was around when the last IPs from Inkheart were blocked. Syrthiss (talk) 17:25, 4 November 2010 (UTC) Syrthiss (talk) 17:25, 4 November 2010 (UTC)

:At the moment, the user is indefblocked by me for restoring the removed comments as 'vandalism' on my part. Syrthiss (talk) 17:32, 4 November 2010 (UTC)

====<span style="font-size:150%"> Comments by accused parties &nbsp;&nbsp; </span>====

====<span style="font-size:150%"> Comments by other users </span>====

====<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====

{{confirmed}} plus {{User|XemaLee}}. –MuZemike 17:37, 4 November 2010 (UTC)

:Marking for close. TNXMan 17:46, 4 November 2010 (UTC)

----