Misplaced Pages

:Requests for checkuser/IP check: Difference between revisions - Misplaced Pages

Article snapshot taken from[REDACTED] with creative commons attribution-sharealike license. Give it a read and then ask your questions in the chat. We can research this topic together.
< Misplaced Pages:Requests for checkuser Browse history interactively← Previous editNext edit →Content deleted Content addedVisualWikitext
Revision as of 23:23, 10 April 2008 view sourceSpellcast (talk | contribs)Administrators37,107 editsm +← Previous edit Revision as of 01:47, 11 April 2008 view source Thatcher (talk | contribs)Extended confirmed users28,287 edits User:P.wormer: removeNext edit →
Line 30: Line 30:
*No others that I can see at this time. ] 11:00, 10 April 2008 (UTC) *No others that I can see at this time. ] 11:00, 10 April 2008 (UTC)


=== User:P.wormer ===


* {{checkuser|P.wormer}}
* {{checkuser|Virginia fried chicken}}
* {{checkuser|Southern Beau}}

Do the above three accounts have the same underlying IP addresses? The accounts seem to be inserting deliberate sneaky vandalism.

The details were reported to me by {{User2|Acer}}.

At ], see , two users vandalized the page - ] and ] - right after the other, {{User2|Acer}} suspects them of being the same person. Looking at their edit histories which despite being quite small show a curious similarity.

Interestingly, while navigating through the list of edits, there was user name ] that {{User|Acer}} had seen at ]s forums. A few days ago {{user|jbmurray}} had made a post to their blog: ] and Wormer was one of the people who participated in the discussion. {{User|Acer}} checked other articles edited by both of the accounts above and most of them were at some point edited by Wormer if not started by himself. {{User|Acer}} suspects that all three were the same person.

{{User|Acer}} believes that ] has been using those two accounts to insert subtle errors into articles he had worked in the past or authored himself. One exmaple of this is: ] which was written by him, you can see by looking at the history that ] made an edit saying it was ''minor corrections'' but which changed the content of the article subtly. {{User|Acer}} decided to check citizendium as he figured ] would've copied his article over there and the article was there also written by ]. The part that was changed by ]! was also there in its original form meaning that the change to the wp article was indeed vandalism.
Here are some exemples that were edited by all three: and by two: . {{User|Acer}} thinks ] did not like the post {{user|jbmurray}} made at the blog, saying that WP had higher standards than CZ and so he vandalised the essay.

Cheers! ] (]) 00:48, 7 April 2008 (UTC)

{{Clerk request}} This is not an IP request as defined in the instructions. Please reformat as a user RFCU. ] 10:58, 10 April 2008 (UTC)

:Oh! OK. Cheers! ] (]) 12:53, 10 April 2008 (UTC)


=== Dereks1x/Archtransit open proxy check === === Dereks1x/Archtransit open proxy check ===

Revision as of 01:47, 11 April 2008

Checkuser pages
Requests: UnlistedIP checkOn hold
Archives: MainOlderIP checksUnsorted
Clerk pages
Clerk OverviewNoticeboardProcedures
Shortcut
This page can be quickly accessed through:
WP:RFCU/IP
IP/A

Requests for IP check

  • Vandal and attack accounts may be listed here for the purpose of identifying and blocking the underlying IP address or open proxy. Requests to confirm sockpuppets of known users should be listed in the sockpuppet section above.
  • If you already know the IP address of the suspected open proxy, list it at Misplaced Pages:Open Proxies instead.
  • Use === Subsections ===; do not create subpages.
  • List user names using the {{checkuser|username}} template. Add new reports to the top of the section.
  • Requests may be acted on or declined according to the discretion of the checkuser admins. Responses will be noted here. Specific evidence of abuse in the form of diffs may be required so as to avoid the impression of fishing for evidence.
  • Answered requests will be moved to Misplaced Pages:Requests for checkuser/IP check/Archive for 7 days, after which they will be deleted. No separate archive (other than the page history) will be maintained.

Bsrboy

After 86.29.132.226 was blocked for personal attacks and vandalism (example), Bsrboy made the same edits as the IP (link). When Bsrboy made the edit, perhaps he thought he wasn't signed in. The timing of the edits by the IP and the user don't conflict, and the IP leads to the UK where his userpage says he lives. Spellcast (talk) 23:19, 10 April 2008 (UTC)

Matttkachu

This guy created his own RFCU... Could someone empty the sock drawer please? I know I triggered an autoblock by blocking the master :). -- lucasbfr 09:25, 10 April 2008 (UTC)


Dereks1x/Archtransit open proxy check

The IP addresses track to locations within India, but they are using very similar wording as Harry59b who was recently blocked for being an Archtransit sock. The IP addresses was mysteriously able to pull a close approximation to Dereks1x out of nowhere while accusing myself, Jersyko, and HailFire (but no Tvoz again *sigh* Maybe next time, Tvoz) of being POV pushers. Harry59b did the same thing in his attempted ArbCom request against Jersyko. Archtransit/Dereks1x are known to be in the US, so an IP from India is probably an open proxy. --Bobblehead 02:35, 4 April 2008 (UTC)

Red X Unrelated see the WP:OPP page. I am another person falsely accused of being a sock (Harry59c). I was blocked because Jersyko wanted to show that he can behead anyone he wants. I am signing on with my IP to prove that I am not in India or the US. I can't figure why he blocked me except I think he created DJ3 and just picked on me for sadistic pleasure. 165.21.155.113 (talk) 06:55, 6 April 2008 (UTC)

The above comment is further evidence - only someone involved in the case would even know who DJ refers to. Apparently the Dereks1x/Archtransit sockmaster has found a way to log in with the appearance of being in Singapore or India and perhaps elsewhere. Other involved IPs include: 122.164.121.238, 122.164.134.73 and 116.12.165.227 as well as KVSTamilNadu (talk · contribs · deleted contribs · page moves · block user · block log). Behavior points clearly to these all being the same person, and I think people with greater knowledge of how proxies, etc work should look into this further. This person has wasted a lot of project time and resources in defiance of his well-deserved bans. Tvoz |talk 07:44, 7 April 2008 (UTC)
Also, please note that IP 165.21.155.113 was not listed on this request or on the OPP, so why is he coming here if he is a different person? I would assume it's another one. Tvoz |talk 07:49, 7 April 2008 (UTC)
  • These do not seem to be open proxies, but the person's knowledge of the case is peculiar given the previous location of Archtransit. crystal ball CheckUser is not a crystal ball, but my best guess after new evidence is that Dereks1x/Archtransit has taken a holiday or a new job in a new location. One of Dereks1x/Archstransit's topic interests ties in neatly with one of his new IPs. Thatcher 14:03, 7 April 2008 (UTC)
Another location, same m.o. Tvoz |talk 17:31, 8 April 2008 (UTC)
I don't have any more information on this other than that it is in Korea and does not appear on standard checks to be an open proxy. Thatcher 11:54, 9 April 2008 (UTC)

I also would ask if a connection is found between 116.12.165.227 (talk · contribs · deleted contribs · page moves · block user · block log) and Differentuninvolved (talk · contribs · deleted contribs · page moves · block user · block log) and/or Uninvolved (talk · contribs · deleted contribs · page moves · block user · block log), which would tie the IP to the Dereks1x/Archtransit/Harry59c sockfarm. Tvoz |talk 03:36, 9 April 2008 (UTC)

Already answered here. Interestingly, Archtransit has emailed me that he has never left home and has no interest in Obama, and this is someone else. Without my crystal ball I really can't say one way or the other, but the behavior is certainly duckish. Thatcher 11:54, 9 April 2008 (UTC)
Misplaced Pages:Requests for checkuser/IP check: Difference between revisions Add topic