Wikipedia:Sockpuppet investigations/RolandR/Archive

;Suspected sockpuppets

• {{checkuser|1=Goodwinsands}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=RolandR User compare report] Auto-generated every hour.

Editor Off2riorob placed a template on my home page indicating that he thinks I'm a sockpuppet of User:RolandR. I am not a sockpuppet, have no other active accounts, have never been banned or blocked, and believe the accusation was made in bad faith. Could someone please do a checkuser to publicly confirm that I am not RolandR, clear my name, and encourage Off2riorob not to make bad-faith SP/I accusations? Goodwinsands (talk) 23:12, 8 November 2011 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Of course Goodwinsands is not my sock, as would be apparent from even a cursory glance at my edits. We may agree in our assessment of Gilad Atzmon, but I would never cite Alan Dershowitz to prove my case. Therre are plenty of other differences too, and I concur that this was not a good-faith accusation. RolandR (talk) 00:04, 9 November 2011 (UTC)

• {{clerknote}} No, we're not doing that. This is a rather spurious claim on Off2riorob's part, and we'll not entertain it here. — HelloAnnyong ^{(say whaaat?!)} 23:52, 8 November 2011 (UTC)
• Edit conflict, declined by a CheckUser. If he has made that allegation, then the onus is on him to consolidate his evidence for it. WilliamH (talk) 23:59, 8 November 2011 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=RolandR}}
• {{checkuser|1=RolandR2}}
• {{checkuser|1=Zaminamina}}
• {{checkuser|1=LiquidWater}}
• {{checkip|1=37.46.112.159}}
• {{checkip|1=54.234.91.166}}

• [http://toolserver.org/~betacommand/cgi-bin/uc?uc=RolandR User compare report] Auto-generated every hour.
• [http://toolserver.org/~snottywong/editorinteract.html Editor interaction utility]

This is a very™ complex SPI. Plus, not only is there duck and behavior evidence, I found his network, ips, and have lots of hard data. Wish I could show everyone but hey – is what it is.

Here is the Network

(Private – sent to CheckUser team email)

Special Instructions to Checkusers (Justification is the 13 sockpuppet indicators/behaviors that follow these special instructions)

• Here is his ISP IP: (Private – sent to CheckUser team email). Its located in Germany but has a Netherlands extension. http://route.robtex.com/(Private – sent to CheckUser team email)
• It has all sorts of redirects from the Wikipedia side – like several layers. Hopefully you can read the diagrams better than I.

(Private – sent to CheckUser team email)is the UK virtual server. The .com one is in the US via(Private – sent to CheckUser team email)also (I think). Don’t be surprised if you find an IP from UTC +5-6 – there are some old Russian language ones floating out there too. Of course the Wiki Anon IPs wont match the actual IPs due to redirects, and some of these will be “blocked” but I assume you can figure that out.

• Youll basically see RolandR and Zaminamina a.k.a. LiquidWater with their initial IPS up to Datestamp: 18:14, 19 March 2013 (UTC), then taking anonymous IPs –
• The Runshit Attacks Users kick off at around 12:17 UTC 20 March 2013 and will be: Self-Hating Commie Jew, Rolands funeral, and User:54.234.91.166 (This actual IP will be different, though, because it’s a redirect).

then “Runtshit” stalkers taking RolandR’s, LiquidWater, and a 3rd person’s IP (effectively cleaning them) – then around the 24 March returning their pre 19th March IPs and releasing their anonymous IPs to do the things they were normally doing.

{{hat|Complete rubbish - stats.grok.se measures page views, not edits}}

• If you didn’t know, I stumbled across this neat thing – if you leave out the user at the traffic stats page – you can see the date when a user uses their anonymous IP. Here are:

::RolandR: http://stats.grok.se/en/201303/RolandR

::RolandR2: http://stats.grok.se/en/201303/RolandR2

::Zaminamina: http://stats.grok.se/en/201303/Zaminamina

::LiquidWater: http://stats.grok.se/en/201303/LiquidWater - Note the Anon IP switch on the 22nd, then back on the 25th.

::Self-Hating Commie Jew: http://stats.grok.se/en/201303/RolandR%20the%20Self-Hating%20Commie%20Jew (In use by someone)

::Rolands Funeral: http://stats.grok.se/en/201303/Rolands%20funeral – Note this IP was sanitized and is now in use as an anonymous IP on the 25th of March

::RolandRunt: http://stats.grok.se/en/201109/RolandRunt (In use by someone)

::54.234.91.166 (RolandR called this IP a Runtshit): http://stats.grok.se/en/201303/54.234.91.166 (In use by someone)

- And last special instruction – I think he turns his machines off, or at least some of them between 2400 UTC and 0800 UTC. He is very punctual at 0800 UTC. Well at least until he reads this.

{{hab}}

Justifications/Evidence:

1.The First Indicator was when I joined an RFC (I like them, see my user page) and after a quick agreement, observed sock-like behaviors – for example Zaminamina, without any apparent connection to the group or RFC makes a vote within 45 seconds of RolandR, to even out the vote and keep it split, (without being obvious….well not really when you have Marxism on your user page – of course that’s all deleted with the name switch).

Edit Interaction Analyzer:

http://toolserver.org/~snottywong/cgi-bin/editorinteract.cgi?user1=RolandR&user2=RolandR2&user3=Zaminamina&user4=LiquidWater&user5=&user6=&user7=&user8=&user9=&user10=&ns=none&startdate=20130130&enddate=20130326

2. The second indicator was Kate a.k.a. Malkin calling to close the RFC soon after all but one agreed on a change.

DIFF: http://en.wikipedia.org/w/index.php?title=Talk%3AKarl_Marx&diff=545055464&oldid=545037250

3. The third indicator was within 30 minutes of me (Private – sent to CheckUser team email) for some questions on March 19th (US CST) – Zaminamina puts in a request to change his/her name “Because I want to.”

DIFF: http://en.wikipedia.org/w/index.php?title=Wikipedia:Changing_username/Simple&diff=prev&oldid=545498257

And then the change – oh wait this is the log of the original LiquidWater IP account creation, and him deleting two pages (click both moves, they were all deleted).

DIFF:

http://en.wikipedia.org/w/index.php?title=Special%3ALog&type=&user=LiquidWater&page=&year=&month=-1&tagfilter=&hide_patrol_log=1&hide_review_log=1

4. The fourth indicator was editing on the article stopped for 4 days. So at this point I’m watching everyone, and not trusting anyone. I call out the suspicious activity

DIFF: http://en.wikipedia.org/w/index.php?title=Talk%3AKarl_Marx&diff=545519779&oldid=545515890

And call out suspected sockpuppet

http://en.wikipedia.org/w/index.php?title=Karl_Marx&diff=545744243&oldid=545518121

5. The fifth indicator was when RolandR bails and makes RolandR2– claiming “For use of potentially insecure connections” because we all know when someone is about to take over our account – especially after we’ve been called out as a sockpuppet. More on that later.

http://en.wikipedia.org/wiki/Wikipedia:Edit_filter/False_positives

6. The sixth indicator was - Funny – this was deleted from the log. This is the Anonymous IP sock RolandR had (out of many) and this is where LiquidWater most likely went to(or someone from the RFC) – because RolandR had Zam a.k.a. Liquid Water on his UK virtual server – and if checkusered he’d be caught “moving” with RolandR to Germany/Netherlands/Norway. This IP switch was necessary because of that. Note this datetimestamp matches exactly RolandR2 switch

Line 1,001:;Date and time ;Date and time: 12:10, 20 March 2013 (UTC) : 12:10, 20 March 2013 (UTC)

+ ;Comments++

+ ==37.46.112.159==

+ ;Username

+

: {{user|37.46.112.159}}

({{plainlinks|URL=http://en.wikipedia.org

/wiki/Special:AbuseLog?title=Special:AbuseLog&

wpSearchUser=

{{urlencode:37.46.112.159}}|NAME=filter log}})

7. The Seventh Indicator was: Of course RolandR’s plan is to get this IP blocked, so LiquidWater wont come up on checkuser – since Checkuser will say its already blocked AND he has IP redirects on the Wikipedia side - The perfect cover.

http://en.wikipedia.org/wiki/Special:AbuseLog?wpSearchUser=37.46.112.159&wpSearchFilter=&wpSearchTitle=

8. The eighth indicator was (Private – sent to CheckUser team email) blocks this anonymous IP (LiquidWater) – note only for 31 hours.

(Private – sent to CheckUser team email)

9. The 9th indicator was when this IP is magically cured of bad habits, and starts editing normally on the 24th of March for the article http://en.wikipedia.org/wiki/Brecon

http://en.wikipedia.org/w/index.php?title=Brecon&diff=prev&oldid=546792785

10. The 10th indicator was when, as if on queue – his personal Sockpuppet Stalkers showed up where of course they were immediately blocked. This sanitizes RolandR, LiquidWater, and a third, maybe RolandR2 IP addresses (Because it was their real ones) – then RolandR assigns them all new IPs and they are scot free.

11. The 11th indicator - Ahh yes – RolandR’s Stalker Sockpuppets - http://en.wikipedia.org/wiki/Category:Suspected_Wikipedia_sockpuppets_of_Runtshit

How do I know RolandR’s sockpuppets sanitized RolandR’s and the others? He did the exact same thing around 8-9 June 2009 – only back then he didn’t have virtual servers set up and he had to shut down his UK server (Got that from his (Private – sent to CheckUser team email)– heh) Note the dates of his (Private – sent to CheckUser team email) coincide with the “Runtshit Attacks”

(Private – sent to CheckUser team email)

(Private – sent to CheckUser team email)

(Private – sent to CheckUser team email)

(Yes I have a .pdf of this if you want)

His (Private – sent to CheckUser team email)

12. The twelfth indicator is RolandR isn’t a (Private – sent to CheckUser team email) in the UK – hes some (Private – sent to CheckUser team email) from (Private – sent to CheckUser team email)… (Private – sent to CheckUser team email)

(Private – sent to CheckUser team email)

(Private – sent to CheckUser team email)

13. The 13th indicator was when I noticed (Private – sent to CheckUser team email) just had a page that said (Private – sent to CheckUser team email) and when I tried to get the IP I got a message that there were too many IPS to identify. But I went to the handy Robtex site – here is RolandR’s Sock network, complete with (Private – sent to CheckUser team email). I think he is trying(Private – sent to CheckUser team email), but that is the next installment.

(Private – sent to CheckUser team email) Patriot1010 (talk) 06:30, 26 March 2013 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

;Response by RolandR

What the hell is this? I don't even understand the allegations against me, so find it difficult to respond.

I don not have or operate any socks, and I never have done. I openly created User:RolandR2 because I have recently acquired a smartphone, and am concerned about the security implications of editing using it on a potentially insecure connection. If this was intended as a sock, I would certainly not have called it RolandR2, and publicly declared that I had opened it.

As for the rest, it is entirely groundless. I have come across LiquidWater/Zanamina, but it should be patently obvious that this editor is not me. Our interests barely overlap; apart from anything else, I know less than nothing about football, and have even less interest in the subject.

One of the IPs identified is already blocked as an obvious Runtshit sock. Is Patriot claiming that I am the Runtshit vandal? This is absurd. The other IP is in Luxemburt. My own IP, as could be seen by any checkuser, is set by my ISP and located in Britain. I have never used either of these IPs, and have only very occasionally, and by accident, edited from an IP. I have always acknowledged such edits.

I really have no idea what the rest of this report means. If it is suggested that I am using sophisticated means to create socks and evade detection, I plead technological inability to do this even if I wanted to do so. I can't respond to the detailed claims since I don't even understand them.

And, above all, what is the alleged purpose of all of these socks? What abusive edits am I claimed to have made? This is so laughably ridiculous that I request and expect that it be struck out immediately, and that Patriot be cautioned to show greater care and discrimination before making any future such allegations. RolandR (talk) 11:34, 26 March 2013 (UTC)

::Ahh, good, so you are fine with me posting the ISP locations, ip's and the various domains? Because since its not, as you say, you?Patriot1010 (talk) 12:50, 26 March 2013 (UTC)

Patriot, if I'm going to be frank, this is a load of horseshit. Drop it. But I'll humor you for a minute:

1. Two experienced editors disagree with you in close proximity. I note this is the first time they have ever interacted in the same discussion. Big whoop.
2. What does this even show??
3. Name changes have what to do with sockpuppetry?
4. What does this even show??
5. What does this even show??
6. Nothing is deleted from the logs. I can see everything, and I see nothing suspicious.
7. You don't seem to understand how checkuser works.
8. What does this even show??
9. What does this even show??
10. You don't seem to understand how checkuser works.
11. You don't seem to understand how checkuser works.

Someguy1221 (talk) 08:45, 26 March 2013 (UTC)

• {{Decline}} - per myself, above. Someguy1221 (talk) 08:45, 26 March 2013 (UTC)

:: Not surprised, here is when your anon IP puppets were used last Someguy1221: http://stats.grok.se/en/201303/Someguy1221 Patriot1010 (talk) 12:00, 26 March 2013 (UTC)

:: Also, it is highly premature since the private information was sent to the functionary email - so how can you make a decision without talking about that information? That is the real BS here, and the fact you are too chicken to run check user and interpret the results with the known IP locations. You admitted your own guilt right there.Patriot1010 (talk) 12:55, 26 March 2013 (UTC)

:::Your point about using stats.grok.se to find out when someone is editing logged-out is complete nonsense. Also, I am subscribed to the functionaries email list, as is Someguy1221, and nothing relating to this case has appeared in my inbox. ​—DoRD (talk)​ 14:19, 26 March 2013 (UTC)

:::::* Well, I sent an email to this address : functionaries-en@lists.wikimedia.org

:::::* The email was sent 1:42 AM (7 hours ago), the opening text is below: (Timestamps are CST)

:::::* "to functionaries-Hi - when you see this on my SPI case - where you see (Private – sent to CheckUser team email) is located here. Please email me if you need more info."

:::::* I received a reply from stating "Your message to Functionaries-en awaits moderator approval" from functionaries-en-bounces@lists.wikimedia.org at 1:42 AM (7 hours ago)

:::::* So please tell me where I should send the sensitive-outside data essential for this SPI besides the email above, thanks!

:::::* I used stats.grok.se to find an anonymous IP puppet here:Wikipedia:WikiProject_on_open_proxies/Requests#207.195.240.33, which I compared an entry indicated on stats.grok.se with the IP address of the ISP in question here, whose IP range is in the list and network map sent to functionaries-en@lists.wikimedia.org. I can demonstrate the entire process if you wish.Patriot1010 (talk) 14:44, 26 March 2013 (UTC)

• There is no case here. Even factoring in for unknown, private evidence, there are some major technical misunderstandings about how CheckUser works, about how stats.grok.se works and, apparently, how the Internet works. In addition, attacking another editor for declining your CU request is beyond the pale. Closing. ​—DoRD (talk)​ 14:50, 26 March 2013 (UTC)

----