Wikipedia:Sockpuppet investigations/Joe Circus/Archive

;Suspected sockpuppets

• {{checkuser|1=Aussie1947}}
• {{checkuser|1=California Mom}}
• {{checkuser|1=EditTalk}}
• {{checkuser|1=Off-wiki-gal}}
• {{checkip|1=12.72.149.104}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=Joe%20Circus User compare report] Auto-generated every hour.

Since Joe Circus was blocked on November 6th, a number of new users have appeared with a slightly different but remarkably similar posting style. Every one of these users has signed their posts (with the exception of a probable typo from California Mom), and have written full edit summaries. This seems unlikely for new and inexperienced users. Each user has edited Talk:Circumcision as their first (or almost first) edit; however some of these users (Joe Circus, California Mom, and Aussie1947) created a user page as their first edit. Jakew (talk) 20:50, 10 November 2011 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

California Mom is a {{possible}} bordering on {{likely}} match to Joe Circus - same ISP and geographic area. Comparing Aussie1947 and EditTalk to them would be {{inconclusive}}, as they appear to be editing from proxies of some description in different continents, however from my perspective I would still be willing to say it's {{likely}} they themselves are related to each other. No comment on the IP. Whatever's going on here, I don't think it can be reconciled with the policy on using multiple accounts. WilliamH (talk) 21:33, 10 November 2011 (UTC)

There is some geographic similarity between Off-wiki-gal and Joe Circus, but other than that, they are technically {{unrelated}}. But remember {{Pixiedust}}. WilliamH (talk) 22:03, 10 November 2011 (UTC)

• After revisiting the technical data, I've blocked California Mom indefinitely as a very {{likely}} sock of Joe Circus. I've also indefinitely blocked Aussie1947 and EditTalk - spurious proxy related stuff aside, there is a definite association between them which I won't go into here. As I said before, there is some geographic proximity with Off-wiki-gal and Joe Circus, but because of where Off-wiki-gal is editing from, examining a connection with CheckUser is {{inconclusive}}. Meatpuppetry could be a reasonable explanation (not least if the name is anything to go by). WilliamH (talk) 19:03, 11 November 2011 (UTC)
• {{clerknote}} Everyone's blocked. — HelloAnnyong ^{(say whaaat?!)} 13:40, 12 November 2011 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=Fred the Fred}}
• {{checkip|1=46.19.140.174}}
• {{checkuser|1=Fellows of Gilgal}}
• {{checkip|1=193.105.134.152}}
• {{checkuser|1=Wazzup bro}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=Joe%20Circus User compare report] Auto-generated every hour.

Last week I blocked Joe Circus for inappropriate behavior at Talk:Circumcision and his own Talk: page. Since then Joe has been socking using various accounts and IP proxies, which have now been blocked. Yesterday and today my user and talk pages were vandalized by this new account and IP, and the edit summary makes it clear it's about the same issue. Jayjg ^(talk) 17:32, 13 November 2011 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

A new sockpuppet has just appeared: {{checkuser|Fellows of Gilgal}} (This one is obvious, compare with [http://en.wikipedia.org/w/index.php?title=User_talk:Joe_Circus&diff=prev&oldid=459371130 this edit].) Jakew (talk) 17:00, 14 November 2011 (UTC) (edited 09:32, 15 November 2011 (UTC))

• The IP has already been blocked, and I've indefinitely blocked the account. Nothing else to report. No comment on any association. WilliamH (talk) 17:58, 13 November 2011 (UTC)
• You can't talk about any association at all? If Joe Circus is repeatedly socking here, then we should at least consider a longer block for him. — HelloAnnyong ^{(say whaaat?!)} 18:15, 13 November 2011 (UTC)
• Sorry, I meant no comment on any association between the IP and account here. As for this account and Joe Circus, we are talking different continents, but given the previous smattering of accounts using international proxies and the behaviour, it quacks loudly. WilliamH (talk) 18:25, 13 November 2011 (UTC)
• Alright, cool. I've reset Joe Circus' block to two weeks. — HelloAnnyong ^{(say whaaat?!)} 20:14, 13 November 2011 (UTC)

{{vandal|193.105.134.152}} has now vandalized my Talk: page in the same way. It might make sense to do a CU to find other socks. Can this one be added to the case and blocked? Jayjg ^(talk) 05:16, 14 November 2011 (UTC)

:{{Relisted}} Another suspected sock has popped up (see Jakew's addition). Alexandria (talk) 17:42, 14 November 2011 (UTC)

• actually, both IPs are open proxies/misconfigured servers. The first IP, 46.19.140.174, is part of a tiny range (46.19.140.168/29) owned by privatelayer.com. The second is a misconfigured server or open proxy. No other accounts on either of these, from what I can see - Alison ^❤ 01:35, 15 November 2011 (UTC)

• I think it is {{Likely}} that {{checkuser|1=Fred the Fred}} is {{checkuser|1=Wazzup bro}}. Another CU may want to confirm/reject. -- Avi (talk) 04:46, 15 November 2011 (UTC)

::The two accounts are {{confirmed}} as each other but are {{inconclusive}} (on technical evidence) as to any relation to Joe Circus (behaviors will be needed to determine socking). However, the two accounts were using an open proxy, which I hardblocked. –MuZemike 17:00, 17 November 2011 (UTC)

• Were done here. -- DQ (t) (e) 09:49, 18 November 2011 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=Gilgal Puppet}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=Joe%20Circus User compare report] Auto-generated every hour.

Quack quack, another account with some weird obsession with some sort of Gilgal conspiracy. Ian.thomson (talk) 14:28, 20 November 2011 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Nothing to report via CheckUser, but an obvious duck indeed, blocked. For the same reason, also blocked {{user|We scalp dicks}}. WilliamH (talk) 18:00, 20 November 2011 (UTC)
• {{adminnote}} Socks were already blocked, but I tagged them. I've also indefinitely blocked the sockmaster for repeatedly socking. — HelloAnnyong ^{(say whaaat?!)} 18:21, 20 November 2011 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=Sunfox1}}
• {{checkuser|1=TheDarkSideHasTacos}}
• {{checkuser|1=Debunk Da Junk}}
• {{checkuser|1=Jasont3671}}
• {{checkuser|1=Feathergun}}
• {{checkuser|1=Uranioradioattivo}}
• {{checkuser|1=Marylibrary}}
• {{checkuser|1=GothHick49}}
• {{checkuser|1=FatStrat87}}
• {{checkuser|1=Acoyoa Chaemetay}}
• {{checkuser|1=Tobias8844}}
• {{checkuser|1=XantorAmnobius}}
• {{checkuser|1=Thermoelectric}}
• {{checkuser|1=Noodlemaz}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=Joe%20Circus User compare report] Auto-generated every hour.
• [http://toolserver.org/~snottywong/editorinteract.html Editor interaction utility]

Behavioral. Joe Circus has dozens and dozens of socks, and makes extensive use of proxies, therefore his IPs geolocate to dozens of countries. Existing known socks generally have a pattern of getting created, making a few nondescript edits over the next few days or weeks, sleeping for a while, jumping into the conversation at Talk:Circumcision, and then not getting used again. These accounts follow that general pattern, have made edits to Talk:Circumcision in the past year or so, have a low total edit count (59 or less) and a low total number of unique pages edited, most of them 1 to 3 pages. Requesting a check for sleepers as well, but I know that because open proxies are used this is hard to do. Zad68 20:04, 3 March 2013 (UTC)

• Thanks for your patience and investigative skills, I believe this is my first SPI request and I'm still learning what's expected from a filing. Appreciate it. Zad68 04:34, 4 March 2013 (UTC)

• Give me a day to make a closer review and I'll see if I can come up with a short list of strong candidates. Am I correct in assuming that if proxies were being used, I would have seen action happen? Zad68 13:35, 4 March 2013 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I find it unlikely that a single sockmaster controls puppets using unlisted, non-public proxies on different continents. More likely, random intactivists register on WP to push their point of view, find it hard to achieve instant results, then drop out, but soon another one of their number steps up to the plate and the cycle repeats. If one had the time to trawl through their many web forums, I am sure one would find many calls to right the grievous wrong that is WP's article on circumcision.89.204.137.49 (talk) 11:44, 6 March 2013 (UTC)

:I think this is a good observation and is in line with the observed editing behavior and technical detail at that page. My thanks to DQ and Someguy for investigating; I don't have any further requests here or evidence to bring at this time. Cheers... Zad68 13:51, 6 March 2013 (UTC)

• {{moreinfo}} - I need diffs. I'm not sorting through a crap ton of users whom are mostly stale to make your case for you because they edit the same talkpage and don't have more than x edits. -- DQ (ʞlɐʇ) 23:49, 3 March 2013 (UTC)
• {{clerknote}} - Just making a tidier list here - these are the suspected socks who are not stale:

:*{{checkuser|Uranioradioattivo}}

:*{{checkuser|GothHick49}}

:*{{checkuser|FatStrat87}}

:*{{checkuser|Acoyoa Chaemetay}}

:*{{checkuser|Tobias8844}}

:*{{checkuser|XantorAmnobius}}

:*{{checkuser|Thermoelectric}}

• Someguy1221 (talk) 01:05, 4 March 2013 (UTC)
• {{clerknote}} I am of the opinion there is enough evidence here to warrant a checkuser. I have to run, however, and will submit my evidence later tonight. Someguy1221 (talk) 01:14, 4 March 2013 (UTC)
• {{Endorse}} - Looking at just the first six of the above seven accounts I have listed, we have six editors whose only and immediate interest upon registering was to edit the Circumcision talk page. There are also some unusual actions for alleged newbies, such as [http://en.wikipedia.org/w/index.php?title=Wikipedia:Requests_for_permissions/Confirmed&diff=prev&oldid=520515315 requesting confirmation as one's first edit], or making a bunch of userspace edits and waiting to get autoconfirmed before actually doing anything. Behavioral similarities between some sets of accounts I see are: registering an account just ot make a single edit request [http://en.wikipedia.org/w/index.php?title=Talk:Circumcision&diff=prev&oldid=533674663][http://en.wikipedia.org/w/index.php?title=Talk:Circumcision&diff=prev&oldid=536913583]; and making a hard return before signing: [http://en.wikipedia.org/w/index.php?title=Talk:Circumcision&diff=prev&oldid=536052652][http://en.wikipedia.org/w/index.php?title=Talk:Circumcision&diff=prev&oldid=539371995][http://en.wikipedia.org/w/index.php?title=Talk:Circumcision&diff=prev&oldid=540212000]. This is a controversial topic and I'm sure many newbies are naturally drawn to the controversy, or directed to that talk page by offsite canvassing, but I believe there is enough evidence to suggest that someone is socking on that talk page. Someguy1221 (talk) 04:23, 4 March 2013 (UTC)
• I ran Thermoelectric and Acoyoa Chaemetay as they looked the most suspicious to me for being previous users. They are {{unrelated}} (polar opposites in location on the globe). Since edit requests and RfPs for confirmed are not rare among newer users, and inconsistencies with the way users write on these talkpages, and bearing in mind the result I just gave, I am of the opinion that there is {{moreinfo}} to run a check on the rest of the users since this is also known as a hot topic area. Thank you for your work so far in looking through the contributions, it's appreciated. -- DQ (ʞlɐʇ) 10:45, 4 March 2013 (UTC)
• {{clerknote}} Aside from the three I thought were behaviorally similar (Tobias and the two you mentioned), I didn't find any striking behavioral similarities. I still think there's something strange going on at that talk page, but I guess it's not sockpuppetry. Someguy1221 (talk) 11:12, 4 March 2013 (UTC)
• {{clerknote}} If proxies are being used, that simply means that technical evidence will be unhelpful. Action may still be taken in the case of strong behavioral evidence. Someguy1221 (talk) 19:53, 4 March 2013 (UTC)
• I went back and checked two additional users after finding enough to count things as highly suspicious, and cross compared. Of the four users I have checked, all are {{unrelated}} and there is no indication of proxy use. -- DQ (ʞlɐʇ) 03:33, 5 March 2013 (UTC)
• Closing per Zad68. -- DQ (ʞlɐʇ) 17:10, 9 March 2013 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=‎Circuscision}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=Joe%20Circus User compare report] Auto-generated every hour.
• [http://toolserver.org/~snottywong/editorinteract.html Editor interaction utility]

Joe Circus has a long history of "cleverly"-named socks used to complain about the Circumcision article, see :Category:Wikipedia_sockpuppets_of_Joe_Circus Zad68 17:29, 9 July 2013 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Blocked, closing. King of ♥ ♦ ♣ ♠ 03:17, 10 July 2013 (UTC)
• {{checkuser|1=Circuscision Defence}} edited this archive, then was blocked by me as a self-admitted sock. Dennis Brown | 2¢ | WER 16:45, 11 July 2013 (UTC)

----