Wikipedia

Wikipedia:Sockpuppet investigations/Kyphis/Archive

< Wikipedia:Sockpuppet investigations | Kyphis


Kyphis

03 June 2011
edit
Suspected sockpuppets

Please list evidence below this line. Remember to sign at the end of your section with 4 tilde characters "~~~~"

Suspected Meatpuppets. Puppet master is unknown - I merely picked a prominent contributor for the SOCKMASTER attribute. These WP:SPA editors have invaded The Dating Guy, Talk:The Dating Guy, Teletoon (Canadian TV channel) and Marblemedia for the purpose of POV-pushing. There are allegations that The Dating Guy plagiarized another show, The Least I Could Do and these editors are doing all they can to put unsourced allegations in the articles, particularly The Dating Guy. For example. After semi-protection of that article, they have converged on Talk:The Dating Guy with frequent edit requests and outrageous interpretations of Wikipedia policy, aimed at putting their POV in the article. For example. Other attacks have included personal attacks against a Teletoon staffer also here. It seems clear to me that the sudden and pronounced uptick in IP editors interested in this article clearly indicates a coordinated meatpuppet attack from off-Wiki. Elizium23 (talk) 22:20, 3 June 2011 (UTC)[reply]

Comments by other users
edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
edit
  •   Clerk endorsed Lets confirm these accounts are meats and which are socks. No Checks on the IPs will be done, I will not block the IPs, as they seem too be hopping, if needed take IPs to AIV or relevant noticeboard. We could protect the talk page of the dating guy to match the article, but I would prefer other clerks/admins comments. -- DQ (t) (e) 18:00, 6 June 2011 (UTC)[reply]
  Checkuser note: I am going to defer to a more-experienced CU on this one. There are similarities among the named accounts; not sure I have more to say at this point.  Frank  |  talk  20:20, 6 June 2011 (UTC)[reply]
Ewww. This is going to be ugly. I'll take a look, but as DQ said, there will be no comments made on the IP addresses. Those will have to be administrated based on behavior alone. Hersfold (t/a/c) 04:12, 15 June 2011 (UTC)[reply]
I think my official response is going to be   Unrelated, but I'll include as much detail as I can for whoever tries to close this mess, as there are some similarities at first glance and my spidey sense says something fishy is going on here.
  • Kyphis appears to be unrelated to almost all named accounts for several reasons. First and foremost, IP whois data puts Kyphis on the opposite side of the world from everyone else. Secondly, that account is using a different operating system from almost all accounts. The only exception to that second point is Sypoth - these two accounts share identical useragents, but again, are on separate parts of the globe according to their IP addresses. Kyphis's IP address is reported as being static by the ISP.
  • All of the other accounts, while not as far away as Kyphis is, are almost definitely not in the same area. Cloudsquall45 appears to be on a different continent from the rest; Oneiros42 is also in a different county from the other accounts. The other accounts are within the same country, but far enough apart that it would be impossible for them to be related, geographically speaking.
  • There were two other accounts I found: Kargie (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) shares an IP address with Dawals25; the useragent is identical once automatic browser updates are taken into account. However, several months have passed between those accounts, and Kargie does not show any other edits since 2010. Additionally, Techieboy45 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) shares an IP address with TheMagicalOnionMan. In this case, the two are using different operating systems and different browser versions (Techieboy45 uses the same browser as shown in one of Dawals25's useragents, however uses a different operating system from all users)
  • There are other useragent matches. Cloudsquall45 and FaheyUSMC share identical useragents. However, there are no uniquely identifying tokens in this useragent; it's a generic UA that would appear for any person using that particular operating system and browser version. Furthermore, the two are separated by an ocean. Sypoth and Kyphis also share useragents, as previously mentioned, but this is an identical case, where the UA is generic and there's an ocean separating the two.
  • As far as I can tell, proxies are not in use. However, one IP address in use by Dawals25 appears to be running an SSH service on a commonly used proxy port. I was unable to establish a connection myself. The other IP address in use by Dawals25 showed all ports as closed - unusual, given that the average IP address will show all of its ports as "filtered", but an indication that an IP address is certainly not a proxy.
I hope this is of some help, but this is about as ugly as these things get. Hersfold (t/a/c) 05:35, 15 June 2011 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Kyphis/Archive&oldid=1038391102"