Wikipedia:Sockpuppet investigations/Mbhiii/Archive

{{SPIcat}}

;Suspected sockpuppets

• {{checkip|65.246.126.130}}

• {{checkuser|Rotwechsel}}
• {{checkip|74.242.254.148}}
• {{checkip|74.162.153.126}}
• {{checkip|74.242.253.149}}
• {{checkip|74.162.155.159}}
• {{checkip|74.162.150.237}}
• {{checkip|74.162.128.82}}
• {{checkip|74.162.128.133}}
• {{checkip|74.242.254.205}}
• {{checkip|74.162.152.170}}
• {{checkip|74.162.148.154}}
• {{checkip|74.242.231.95}}
• {{checkip|74.242.254.110}}
• {{checkip|74.162.149.2}}
• {{checkip|74.162.148.147}}
• {{checkip|74.242.231.144}}
• {{checkip|74.242.254.23}}
• {{checkip|74.162.148.196}}
• {{checkip|74.248.20.123}}
• {{checkip|74.162.156.19}}
• {{checkip|74.162.156.10}}

;Evidence submitted by User:dicklyon

Edits to Reciprocity (photography) and Arundhati Roy and their talk pages show a clear pattern of 65.246.126.130 adding unsourced interpretive material, and then Mbhiii following up when the page get semi-protected ([http://en.wikipedia.org/w/index.php?title=Reciprocity_(photography)&diff=284358067&oldid=284350410 here] and [http://en.wikipedia.org/w/index.php?title=Arundhati_Roy&diff=280460762&oldid=280369590 here], respectively); I haven't looked for more. I've asked both (User_talk:Mbhiii#Sock.2C_etc. and Talk:Reciprocity_(photography)#Sockpuppetry) to at least admit the relationship so that we can carry on one conversation, but the IP has denied it [http://en.wikipedia.org/w/index.php?title=Talk:Reciprocity_(photography)&diff=285328817&oldid=284647100 here]. I wouldn't mind the sockpuppetry if the editing behavior wasn't so passive-aggressively disruptive.

:He and I disagree as to what is unsourced or interpretive. Since the IP is not used for multiple votes, it's no violation of policy. All the the rest (sockpuppetry, passive-aggressive, disruptive) is name-calling. -MBHiii (talk) 15:49, 28 April 2009 (UTC)

I also just noticed what I had suspected, that some 74... IP addresses are the same guy. Mbhiii made many votes or comments at Wikipedia:Articles_for_deletion/Unholy_Alliance_(geopolitical) according to others on that page, using various IPs. [http://en.wikipedia.org/w/index.php?title=Reciprocity_(photography)&diff=283893188&oldid=283878620 Here] he refers to "you two" to pretend to be another party to the discussion; I had thought that was same as User:Rotwechsel, but now I think they're all one. Some of the newly added 74's have edited the two main articles I mentioned where Mbhiii shows up on semi-protect.

:See note "To Themfromspace" - not the same person. Though I've used some 74s, others have, too, on the same articles. -MBHiii (talk) 15:49, 28 April 2009 (UTC)

User:74.242.254.23 was blocked for block evasion in March. Master Mghiii was also blocked; 65.246.126.130 was co-editing with the 74s on Antisemitism at the time, but didn't get blocked or listed among the confirmed socks of Mbhiii; we need to add that. Maybe we need a range block for the 74s?

:This issue has been raised in the past as a diversion during an edit war; that seems to be the case again. -MBHiii (talk) 15:49, 28 April 2009 (UTC)

See also the AN/I item at Wikipedia:Administrators%27_noticeboard/Incidents#Mbhiii_sockpuppetry_disruptive_edits for info on the ongoing disruption.

:Nothing there. -MBHiii (talk) 15:49, 28 April 2009 (UTC)

Rotwechsel and 74.162.156.10 have been recently co-active supporting stuff that others object to at The Clone Republic. Someone else just noticed and added Dream Focus as another adding the same there, and possibly therefore another sock. Some checkusers would be helpful...

:Again, see note "To Themfromspace". -MBHiii (talk) 15:49, 28 April 2009 (UTC)

Dicklyon (talk) 01:20, 22 April 2009 (UTC)

;Comments by accused parties    See Defending yourself against claims.

Baloney, I do this, to the extent I do, for convenience and relative anonymity, not for the purpose of multiple votes (that may have been an accidental result), all of which is allowed in WP. Much of Dick's difficulty with this current disputed article results from what seems to be his failures to read carefully, as in [http://en.wikipedia.org/w/index.php?title=Reciprocity_(photography)&action=history here] and [http://en.wikipedia.org/wiki/Talk:Reciprocity_(photography)#Sockpuppetry here]. Also, there may be neighbors, friends, relatives, or co-workers, to whom I've mentioned what I'm doing, who've decided to take a look and render an opinion or edit. It's happened before, especially from shared IPs. -MBHiii (talk) 17:09, 22 April 2009 (UTC)

• Nonsense. Look at my edit history. With the amount of writing I've done, do you see anything that makes me look familiar to anyone else? I've been around for years, had quite a number of edits, and find my sudden inclusion to this list just now absurd. Someone you think is a sockpuppet posted in an article that I had worked on months ago, and then recently, asking for a third opinion to get more people down there[http://en.wikipedia.org/wiki/Talk:The_Clone_Republic#Tech_section.2C_important_or_not] to help settle a disagreement between me and another editor on whether certain text should remain. Did the person you accuse also participate in another article which had asked for a third party view? Perhaps that's how they found this place. Anyway, kindly look into this farther, before just arbitrarily adding someone to a list. Dream Focus 16:46, 24 April 2009 (UTC)

::Note, Dream Focus was added to the list by User:Toddst1 after his repeated addition of a section of unsourced interpretative material at The Clone Republic was supported by two of the Mbhiii socks. It seems like a plausible enough conjecture, but may not be right. Dicklyon (talk) 17:34, 24 April 2009 (UTC)

:::After my repeated reverting of another user's deletion of material... This person's socks all have the same first numbers in their IP address, and apparently few edits for each of them. Does my IP address look remotely similar? You can trace an IP address to see what location their ISP is in. Dream Focus 17:55, 24 April 2009 (UTC)

::::Actually, Mbhiii uses both 65. and 74. IPs; I have no way to tell what IP you use. But I do believe you're not them. Hopefully some admin will do a checkuser and help clarify all this. Dicklyon (talk) 19:24, 24 April 2009 (UTC)

• The two others that reverted it [http://en.wikipedia.org/wiki/Special:Contributions/74.162.156.10] [http://en.wikipedia.org/wiki/Special:Contributions/Rotwechsel] have participated in another article which I have nothing to do with as well. Both articles are connected, by the fact that they are listed at Wikipedia:Third_opinion#Active_disagreements right now. So if these two editors turn out to be socks, that's how they found their way to the article I'm involved in, I clearly not a sock. Dream Focus 18:00, 24 April 2009 (UTC)

• To Drmies - I grab edits, on different PCs, between jobs I'm running. Others at work here, I believe, do the same. The main issue for Admins should be whether this behavior is to avoid policy (which it is not, or, if occasionally occurring, is inadvertent.) Until WP changes its policies on anonymous edits, the reasons for allowing them should still count. With anonymity comes no need to identify oneself; that is, after all, what anonymous means. You should respect that, without assuming any pretense. Realize that pretense is much more often inferred than intended. Setting up an account shouldn't trap you into having to edit forever from it. Please note, too, that editing from IPs reduces protection from WP:3RR, since no stable ID goes with the edits, so with convenience comes a price.
• To Themfromspace - Like others, I started following users listed or posting here to see what they are doing. After Dream Focus posted, I followed him to The Clone Republic and made an edit. He's not me; 65... often is, but not always; Rot... isn't; some 74's probably were, at least sometimes, but there are 1000s of engineering and science professors, students, practitioners, and amateur and professional photographers within a 2 mile radius of my house, some of whom I see often, as neighbors, friends, relatives, and co-workers.

:::-MBHiii (talk) 22:02, 25 April 2009 (UTC)

::::Mhbiii, you could probably help the process in a couple of ways; first, make it clear to your family members and co-workers that if they follow you around and support you, they do more the destroy your credibility than to support it. Second, since it is a reasonable interpretation for us to believe that every edit by 65... and 74... edit on the three articles in questions are all by you, do let us know if you see any of those that are NOT by you, and help us understand what's from you and what's not, since that's the issue that you've been avoiding for so long. Dicklyon (talk) 22:11, 25 April 2009 (UTC)

:::::I just did, in part, but you seem to think I have more time for this than I do. -MBHiii (talk) 22:25, 25 April 2009 (UTC)

;Comments by other users

• I'm no expert in socks and meats (besides bacon, of course) and IPs, but I have noticed the exact same pattern that Dicklyon describes, including the "there's thousands of people in the Research Triangle," though I wouldn't know where to find that diff--it's been a month or two since I saw that. My experience with Mbhiii is on the Arundhati Roy page (see [http://en.wikipedia.org/w/index.php?title=Arundhati_Roy&action=history history], where IPs 74.242.254.110, 74.162.150.237, and 65.246.126.130 worked in tandem with Mbhiii to insert what Mbhiii called simple math, and what other editors, including myself, called OR giving undue weight to a short section on an editorial by Roy. The history shows how much time and effort went into finding a compromise--I think RegentsPark and myself basically just acquiesced ourselves to the IPs and Mbhiii occupying a note. See the talk page for the article also, Talk:Arundhati_Roy#Guardian_article.2C_original_claims.2C_and_undue_weight where one of the IPs enters the discussion making the exact same argument as Mbhiii. I referred to one of the IPs as Mbhiii in my edit summary, [http://en.wikipedia.org/w/index.php?title=Arundhati_Roy&diff=279853820&oldid=279747909 here], but received no response--certainly not a denial, and the next edit was Mbhiii's, who reverted my edit. In the end, one good thing came out of it--removal of a Buruma critique of Roy's, which was, as Mbhiii correctly spotted, also a matter of undue weight--but the whole process was more exasperating than I care for on WP.

  Mbhiii's defense part 2, above, yeah, of course those things are possible, just as it is possible that someone else in my homestate has hacked into my WP account and is making the exact same argument I would make, under my name. As far as I'm concerned, WP:DUCK applies here; besides, I think Mbhiii is a disruptive editor in the first place, as is also borne out by his defense part 1--the bologna about relative anonymity and accidental multiple votes. Mbhiii has not pointed out that in the pattern of reverts the multiple IPs are a convenient way to get around WP:3RR, which was quite irritating in the Roy process. Drmies (talk) 04:28, 23 April 2009 (UTC)

• I was just heading to create this page on the Mbhiii-Rotwechsel connection, but it appears that somebody beat me to it and did some extra homework. As an aside, Dream Focus is a much more established editor than any of the others, with a more varying edit pattern, so I don't think he should be blocked without check user evidence. The connection with Rotwechsel is obvious, as both moved from the main locus of dispute to a random article (The Clone Republic) to take the same side in an edit war. ThemFromSpace 23:52, 24 April 2009 (UTC)

;Clerk, patrolling admin and checkuser comments

• See :Category:Wikipedia sockpuppets of Mbhiii and :Category:Suspected Wikipedia sockpuppets of Mbhiii. -- Avi (talk) 17:04, 22 April 2009 (UTC)
• {{clerk-note}} So, if I can attempt to summarise what is happening here;
• Mbhiii usually edits without logging in, utilising the pseudo-anonymity of a DHCP IP to avoid linking his edit history.
• Edits coming from 65.246.126.130 appear to be the web proxy of this user's employer, and all edits by employees will appear to originate from a single address.
• Mbhiii may have suggested that work colleagues edit, and it will be difficult to distinguish their edits from his
• Edits coming from 74.* addresses that share an interest with Mbhiii, and don't overlap with other 74.* ranges sharing interests are likely to be Mbhiii
• Mbhiii logs in when he needs to perform edits that need autoconfirmed status.
• Would Mbhiii care to agree or disagree with the above? Mayalld (talk) 19:49, 28 April 2009 (UTC)

;Conclusions

• Anything in the 74.162.*.* range is Mbhiii so long as they are editing intersecting topics. Its happening too much to be a coincidence. For example [http://en.wikipedia.org/w/index.php?diff=285863685&oldid=prev ip edit] and then [http://en.wikipedia.org/w/index.php?diff=285928660&oldid=prev Mbhiii edit]. In that example Mbhiii attempts to make the IP edit appear to be a different user.
• Mbhiii Discussion here indicates that 65.246.126.130 is his work IP and is a "proxy"/"gateway" through which the company's employees are funneled through.
• Note the votestacking at Wikipedia:Articles for deletion/Unholy Alliance (geopolitical). Notice how 74.162.153.126 (note that its 74.162.*) + 74.242.254.148 (not the same range but the same ISP) + 65.246.126.130 (his work IP) + himself all !vote at the same AFD. This votestacking in an AFD is enough for me to request a checkuser to confirm my thoughts, especially that on 74.242.254.148.
• See http://toolserver.org/~eagle/spi/1240958521.html for more evidence of the connections between the accounts and ips.

• {{RFCU|C|No2ndLetter|Checked}}
• Wikipedia:Articles_for_deletion/Unholy_Alliance_(geopolitical), vote stacking with suspected socks/ips. (see above). All 4 went with keep and the result of the debate was keep. (result was effected). What I would like to know, has Mbhiii ever edited on 74.242.0.0/16? Also please try to access likelihood that other employees are using 65.246.126.130 to edit similar topics. —— nixeagle^{email me} 23:13, 28 April 2009 (UTC)

please note that I am holding any action pending the result of the checkuser. —— nixeagle^{email me} 23:13, 28 April 2009 (UTC)

• {{endorse}} please see nixeagle's above comment, which sums things up pretty well. — Jake Wartenberg 23:23, 28 April 2009 (UTC)

----

• See :Category:Wikipedia sockpuppets of Mbhiii. -- Avi (talk) 02:47, 29 April 2009 (UTC)
• {{Confirmed}}
• {{checkip|65.246.126.130}} is already self-admitted (and beyond doubt) the work IP of User:Mbhiii.
• {{checkuser|Rotwechsel}} Currently available technical and behavioral evidence.
• On 74.242.252.0/22, as well as on 74.162.128.0/19 User:Mbhiii and User:Rotwechsel both appear with the same technical and behavioral data.
• {{Likely}}
• {{checkuser|Popsucketry}} Technical and behavioral evidence.
• {{Possible}}
• {{checkuser|Itsnemo}} Technical evidence.

-- Avi (talk) 03:34, 29 April 2009 (UTC)

{{SPIclose|archive}}--Blocked and tagged. The two ranges have been blocked (AO, ACB) for 1 month. PeterSymonds (talk) 14:49, 29 April 2009 (UTC)

;Suspected sockpuppets

• {{checkuser|1=Trift}}
• {{checkuser|1=Somedifferentstuff}}
• {{checkip|1=74.162.*.*}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=Mbhiii User compare report] Auto-generated every hour.

Pattern of edits and topics like banned user Mbhiii/Welhaven/Siparuna. Stalks user edits after an editor edits a page he is interested in. Also habit of deleting other editors comments within talk pages. Many of the IPs are list at http://en.wikipedia.org/wiki/Category:Suspected_Wikipedia_sockpuppets_of_Mbhiii.

Possibly User:Somedifferentstuff is a sock as well based on editing style and some tag teaming, but not as sure of that. 68.169.165.137 (talk) 15:05, 14 September 2011 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• I think it's possible the two accounts are connected, but I'm not sure. The connection to the master is long gone, but I'm endorsing to see if the accounts are the same. — HelloAnnyong ^{(say whaaat?!)} 01:28, 16 September 2011 (UTC)

:* Technically speaking: {{Unlikely}}. AGK [•] 11:56, 16 September 2011 (UTC)

• {{clerknote}} Like I said, I wasn't sure, and these results don't help at all. I'll close with no action taken for now. — HelloAnnyong ^{(say whaaat?!)} 03:51, 17 September 2011 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=Dawakin}}
• {{checkuser|1=Somedifferentstuff}}
• {{checkuser|1=Attleboro}}
• {{checkuser|1=Trift}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=Mbhiii User compare report] Auto-generated every hour.

Please see my talk page, "Mbhiii sockpuppets (including probably User:Dawakin and User:Trift)". An IP has once or twice now alerted me to such edits/editors, and I think they're probably right about these (caveat: I am not so sure about Somedifferentstuff, but there are thematic similarities). Might as well check them out (the ones that are still up and running): they do all edit the same things (articles like Money trail and Redistribution of wealth) in the same left-wing anti-establishment vein with, unfortunately, a bit too much OR and synthesis and way too much socking (I am convinced they can't help it anymore--it's a disorder). Drmies (talk) 04:22, 8 February 2012 (UTC)

• I forgot: I should have checked the CU box for "yes"... Drmies (talk)
• And now I see that Trift and Somedifferentstuff were already looked into in a previous installment of this serial. Well, scratch them from the list, at least Stuff--I am pretty much convinced that Trift is Mbhiii, from style and behavior. Drmies (talk) 04:27, 8 February 2012 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Master and prior socks are stale, will need to be decided by behavior. Can you provide diffs to show where they are alike? Amalthea 13:28, 9 February 2012 (UTC)
• Dawakin and Trift are doing the same thing with those edits (and the image) on Money trail--see [http://en.wikipedia.org/w/index.php?title=Money_trail&diff=prev&oldid=475520290 Dawakin] and [http://en.wikipedia.org/w/index.php?title=Money_trail&diff=prev&oldid=461125480 Trift]; and on Friedrich Hayek ([http://en.wikipedia.org/w/index.php?title=Friedrich_Hayek&diff=prev&oldid=475523721 Dawakin], [http://en.wikipedia.org/w/index.php?title=Friedrich_Hayek&diff=prev&oldid=460999577 Trift]. They are one and the same person.

  The link with Mbhiii took a bit more digging, but it's in the [http://toolserver.org/~pietrodn/intersectContribs.php?wikiDb=enwiki_p&firstUser=Mbhiii&secondUser=Trift&sort=0 intersection of edits], which is eclectic and coincidental; it's nailed for instance [http://en.wikipedia.org/w/index.php?title=List_of_films_considered_the_best&diff=prev&oldid=460194195 here, Trift], and [http://en.wikipedia.org/w/index.php?title=List_of_films_considered_the_best&diff=349655273&oldid=349071831 here, Mbhiii]. Does that suffice? I have little doubt that this list is easily expanded.

  Thanks Amalthea--I guess I should have done all this digging earlier, but (as you know) it's kind of a drag, and I always prefer someone else (like you, or Tnxman) to do the dirty work for me, haha. Drmies (talk) 16:16, 10 February 2012 (UTC)

• One more thing: I noticed {{ip|75.111.64.198}} on Redistribution of wealth. What a coincidence: after Dawakin got ratted out on my userpage, they disappeared, and then this IP comes by for some cleanup. Note their nicely formatted edit summaries (phrasing, initial capitalization, proper pucntucation), which are perfectly with those of Mbhiii and the others. But I'm sure there's a billion IPs they can lay their hands on; perhaps they'll come by here shortly and explain something about being wireless in the Research Triangle. And for old times' sake: {{user|Truthinthewind}}. Drmies (talk) 16:23, 10 February 2012 (UTC)
• {{endorse}}. Actually, I'm going to endorse this case for a checkuser. It's true that Mbhiii and their socks are stale, but CU can tell us if these accounts are the same. I'm doing this because there is something really weird going on here]. First off, all four of these accounts have edited Redistribution of wealth; three have edited Money trail; and then there are a handful of others that they all share in common. At least Somedifferent, Dawakin and Trift share similarities in edit summaries, in terms of use of vocabulary, capitals and full stops ([http://en.wikipedia.org/w/index.php?title=Occupy_Wall_Street&diff=prev&oldid=475744123 1], [http://en.wikipedia.org/w/index.php?title=Money_trail&diff=prev&oldid=475528368 2], [http://en.wikipedia.org/w/index.php?title=Preventive_war&diff=460814977&oldid=460388757 3]). And Trift and Dawakin made the [http://en.wikipedia.org/w/index.php?title=Friedrich_Hayek&diff=460999577&oldid=460870739 same] [http://en.wikipedia.org/w/index.php?title=Friedrich_Hayek&diff=475523721&oldid=473676741 edit] on Friedrich Hayek, and [http://en.wikipedia.org/w/index.php?title=Preventive_war&action=historysubmit&diff=460815432&oldid=460388757 also] [http://en.wikipedia.org/w/index.php?title=Preventive_war&diff=475525713&oldid=469424204 on] Preventive war, so there's certainly overlap there. The evidence isn't overwhelming enough to block per WP:DUCK, but I definitely think there's a reason for a checkuser to be run. — HelloAnnyong ^{(say whaaat?!)} 15:03, 11 February 2012 (UTC)
• Thanks HelloAnnyong. I have to say that Amalthea's prodding me has only confirmed my suspicions here, and I hear the quacking loud and clear. Then again, blocking these accounts won't do a thing: Mbhiii is obsessed with editing Wikipedia and won't stop socking. Semi-protecting articles isn't much use either, since they're guided by the news and current political discussion and will simply move on as the world does. I wish they were a better editor... Drmies (talk) 06:01, 12 February 2012 (UTC)
• {{In progress}} - I have some prior data on the master. Tiptoety ^talk 18:38, 13 February 2012 (UTC)

• So, like I said above I was able to dig up a range that {{User|Mbhiii}} edited from in 2010. I do not have any useragent info on them so the technical evidence is shaky at best, but nonetheless this is what I came up with:

:*{{Checkuser|Dawakin}} is {{possible}} bordering on {{likely}} related to the master. They are editing from the exact same range (and obviously geolocate the the same city).

:*{{Checkuser|Trift}} is {{unlikely}} related to the master. That said, they appear to be editing from an educational ISP that appears to possibly have some open ports (though, when running nmap, it does not list any ports as being open). They do geolocate the the same area as Dawakin and the master. That said, the Dawakin and Trift edit at different times of the day.

:*{{Checkuser|Attleboro}} and {{checkuser|Somedifferentstuff}} are {{unrelated}} both to the master, to one another, and to the rest of the suspected socks listed.

• I hope that helps. Tiptoety ^talk 18:54, 13 February 2012 (UTC)
• Thank you all. I have blocked Dawakin. Trift, I'm leaving it be since it's an old account anyway. But what you noted about different times: Mbhiii is an academic working in the research triangle. Different editing times can be expected given that it was a different semester. Drmies (talk) 04:27, 18 February 2012 (UTC)
• {{clerknote}} Eh, I say we leave Trift alone for now, as it's stale. — HelloAnnyong ^{(say whaaat?!)} 04:30, 18 February 2012 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=Czeczewo}}
• {{checkuser|1=Zimtenga}}
• {{checkuser|1=Somedifferentstuff}}
• {{checkip|1=72.37.249.60}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=Mbhiii User compare report] Auto-generated every hour.
• [http://toolserver.org/~snottywong/editorinteract.html Editor interaction utility]

Already blocked, not yet tagged. Edits to Patient Protection and Affordable Care Act are clear enough. A claim was made on my talk page that the IP's edits to ARA involved Mbhiii's company. I don't know if that's true or not. Drmies (talk) 01:46, 14 November 2013 (UTC)

• I added Somedifferentstuff: not blocked, but a suspicion was uttered (by a little birdie on my talk page), and I can see some validity to the suspicion. Please check it. Drmies (talk) 04:14, 14 November 2013 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{Cudecline}} - Somedifferentstuff has over 6500 edits. You'll need to make a better case than this to get a checkuser to investigate him. Please provide diffs showing the alleged sockpuppetry. Thank you. Reaper Eternal (talk) 05:36, 15 November 2013 (UTC)
• Closing after nothing else was provided. Rschen7754 01:20, 17 November 2013 (UTC)

----