Wikipedia:Sockpuppet investigations/Fangusu/Archive

Fangusu (talk · contribs · deleted contribs · page moves · block user · block log)

Suspected sockpuppets

• ILovePeanutsAndVideoGames (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• TigerSharksFan (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• 59.183.41.81 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

Evidence submitted by Icarus3 (Talk)

Fangusu is an indefinitely blocked user with a long history of sockpuppetry (see Wikipedia:Requests for checkuser/Case/Fangusu, Category:Suspected Wikipedia sockpuppets of Fangusu, Category:Wikipedia sockpuppets of Fangusu). I am requesting a CheckUser both to verify these three socks, and to do a sweep for sleeper accounts, in line with previous checks for this user.

• Contributions from ILovePeanutsAndVideoGames (shortened to "ILovePeanuts" in the rest of this report) show typical Fangusu pattern of undoing my reversions of a previous Fangusu sockpuppet's edits and editing pages on topics that are known Fangusu targets. See ILovePeanuts's first edit [1] and compare to nearly identical edit summary [2] and faux-warning [3] from other known sockpuppets when I undid edits by earlier sockpuppets (I can give more than a dozen additional examples of a new sock undoing a reversion I - or sometimes another editor - did of an older sock's edit, if anyone wants more evidence that this is one of Fangusu's characteristic patterns). The other articles ILovePeanuts edited were mostly to articles another sock edited in the past ([4] undoes my undo of [5], [6] undoes Wknight94's undo of [7]) or otherwise related to an article or subject known to interest Fangusu ([8] shows edit to article edited by Fangusu and a sock [9][10], interest in Spyro and Crash Bandicoot [11] reflected in earlier sock's username [12])

• TigerSharksFan has only edited on the same days and around the same times as ILovePeanuts, with no overlaping time periods. Shortly after I submitted a CheckUser request against ILovePeanuts [13] (I'm making this report now since making that report revealed the protocol change), TigerSharksFan suddenly took an interest in the Fangusu case despite claiming to not know who Fangusu is (and despite the improbability of a completely unrelated user finding no less desiring to get involved in the report) [14]. TigerSharksFan also took a sudden, inexplicable interest in getting on the good sides of myself [15] and Wknight94 [16] (an admin who has also been involved in this case, for instance, as a blocking admin for many previous socks: [17][18][19][20] and more). TigerSharksFan also pleaded [21] for Fangusu to be given another chance in a manner very similar to Fangusu's previous pleas [22][23]. The plea is very emotional for someone claiming no connection to or prior knowledge of Fangusu.

• 59.183.41.81 begins with 59.183, as do all of Fangusu's known IPsocks. It has, as of when I'm writing this, edited only two articles, both ones ILovePeanuts was involved with. [24] is to the same article as [25], and [26] redirects an article to one created by ILovePeanuts [27].

--Icarus ^(Hi!) 04:33, 17 January 2009 (UTC)[reply]

Comments by accused parties    See Defending yourself against claims.

Comments by other users

CheckUser requests

Checkuser request –

code letter

: E (Community ban/sanction evasion )

Current status – Completed: Reviewed by a Checkuser, results and comments are below. Xclamation point 04:34, 17 January 2009 (UTC)    Requested by --Icarus ^(Hi!) 04:33, 17 January 2009 (UTC) [reply]

Clerk, patrolling admin and checkuser comments

Conclusions

•  Confirmed all. Nishkid64 _{(Make articles, not wikidrama)} 04:42, 17 January 2009 (UTC)[reply]

This case has been marked as closed. It has been archived automatically.

-- lucasbfr talk 09:20, 17 January 2009 (UTC)[reply]

Suspected sockpuppets

• Enco1984 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• 59.183.40.35 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 59.183.21.147 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 59.183.6.178 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 59.183.16.6 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 59.183.27.131 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 59.183.15.246 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 59.183.6.139 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 59.183.12.243 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

Evidence submitted by --Icarus ^(Hi!)

Fangusu is an indefinitely blocked user with a long history of sockpuppetry under literally dozens of usernames and IP addresses (see Wikipedia:Requests for checkuser/Case/Fangusu, Category:Suspected Wikipedia sockpuppets of Fangusu, Category:Wikipedia sockpuppets of Fangusu). I am requesting a CheckUser both to verify this sock, and to do a sweep for sleeper accounts, in line with previous checks for this user.

The IP addresses may not require any action, but I consider their involvement to be at very least part of the evidence, as will be demonstrated by noting that all Fangusu IP addresses have started with 59.183, and their involvement with Enco1984's editing patterns. I include them both to keep the record as complete as possible, and to hopefully provide evidence that an IP range block is still necessary. Fangusu will assuredly continue to create sockpuppets, but they will be easier to track down if they all have names.

The following evidence has led me to strongly suspect that Enco1984 is the same user:

• Account created 2 weeks after the most recent sockpuppet investigation banned previous socks (see archive link at the top of this case)
• User soon started re-doing edits originally done by earlier Fangusu socks, across a variety of otherwise unrelated articles:
  • [28] redoes [29], and 59.183.21.147 also did the same edit [30] and has the same 59.183 IP as previous Fangusu IPsocks
  • [31] redoes [32]
  • [33] redoes [34] (regarding the tense, not the pluralization)

• User has also edited other specific articles that previous Fangusu sockpuppets had taken a strong interest in. I will use previous sockpuppet usernames as evidence where appropriate. There are a lot of socks and edits to wade through, so if this is adequate I'd love to spare myself the time and effort. If the admin who handles this feels it is necessary, however, I will dig through the socks' histories for diffs (there are many cases where another sock edited the same articles, too, but didn't have such a clearly relevant username).
  • [35] and [36] hearken back to User:3drealmsvsepicgames
  • [37] hearken back to User:Dukevsjazz and User:DukeNukemAndJazzJackrabbit
  • [38] and several other Spyro-related articles hearken back to User:CrashBandicootAndSpyroTheDragon and diff by an IPSock, while edits such as [39] and [40] reflect Fangusu sockpuppets' prior interest in this pair of games such as this edit.

• IPs:
  • Enco1984 was clearly working with 59.183.40.35 (with no overlapping edits, in a manner strongly suggesting the same person as all edits seem to be related to the effort to create a new article with the removed material) in this history (see edits from 00:21, 23 February 2009 through 01:04, 23 February 2009). The IP starts with the exact same 59.183 that all Fangusu IPSocks do, and previous Fangusu socks have also taken an interest in this article (for example [41]). A day later, 59.183.12.243 also edits this article [42].
  • 59.183.6.178 begins with 59.183 like all Fangusu IPsocks and edits [43], an article recently edited by Enco1984 [44]
  • 59.183.16.6 vandalizes [45], which Enco1984 puts an inappropriate speedy deletion template on next day [46]
  • 59.183.27.131 edited the same article as Enco1984, a couple of hours later [47] and [48], which Enco1984 had edited the previous day [49], and [50], which a previous Fangusu sock has edited in the past [51]
  • 59.183.15.246 and 59.183.6.139 have both been editing (and the 59.183.15.246 was temporarily blocked for edit warring on) Spyro-related articles during the time Enco has been active, doing similar edits (compare Enco: [52] to 59.183.6.139: [53]

• There is other evidence as well, such as certain characteristic Fangusu patterns found in the actual edits in addition to simply the sorts of articles targeted. I can dig down into the nitty-gritty of it if necessary, but I think I've made my case pretty clearly by now.

--Icarus ^(Hi!) 19:19, 8 March 2009 (UTC)[reply]

Comments by accused parties    See Defending yourself against claims.

Comments by other users

CheckUser requests

Checkuser request –

code letter

: E (Community ban/sanction evasion )

Current status – Completed: Reviewed by a Checkuser, results and comments are below.    Requested by --Icarus ^(Hi!) 19:19, 8 March 2009 (UTC) [reply]

Clerk, patrolling admin and checkuser comments

I've checked Fangusu a few times, previously; from a purely technical standpoint, Enco1984 is active on the same range. – Luna Santin (talk) 19:30, 8 March 2009 (UTC)[reply]

 Clerk endorsed For a possible review, and to see if range is busy. Synergy 21:56, 8 March 2009 (UTC)[reply]

Conclusions

•  Confirmed. I've looked into rangeblocks in the past, but there's just too much collateral damage. Nishkid64 _{(Make articles, not wikidrama)} 23:02, 8 March 2009 (UTC)[reply]
  • Thank you. Blocked and tagged.

This case has been marked as closed. It has been archived automatically.

Suspected sockpuppets

• 69.42.15.3 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

Zapp Brannigan: [54], [55] (revert stating "leave me alone", along with a threat, after reverting Fangusu's edit), [56]

(basically same comment by Fangusu after revert)

DigiDestined: [57], [58]

Doom II RPG: [59], [60]

The IP and

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Please close this case now, Steel1943. You are ruining my reputation. Also, I am not evil. Fangusu (talk) 22:03, 16 August 2015 (UTC)[reply]

• I think you doing a great job "ruining [your] reputation" yourself by editing with a
  WP:DUCK sock and telling me to "boil (my) head" ... twice. Steel1943 (talk) 00:22, 17 August 2015 (UTC)[reply
  ]

•  Clerk note: @Fangusu: Do you admit using this IP for logged-out editing? Vanjagenije (talk) 00:25, 17 August 2015 (UTC)[reply]
  • Yes. Yes I do. Could you please close this? I am not inherently evil, OK? Fangusu (talk) 02:29, 17 August 2015 (UTC)[reply]
•  Clerk note: @MaxSem: This user was indeffed because of the sockpuppeting. You unblocked him, but he is obviously socking again ([61][62],[63][64],[65][66]). What shall we do here? Vanjagenije (talk) 07:56, 17 August 2015 (UTC)[reply]

Um, what do you want from me, to forever be the point of contact for everything that happens to this user? I'm not convinced that this is a clear-cut case of malicious sockpuppetry to warrant shooting on sight, so feel free to start an ANI discussion on that. Max Semenik (talk) 19:00, 17 August 2015 (UTC)[reply]

• • Please close this case now. I am not an evil criminal. Fangusu (talk) 14:44, 17 August 2015 (UTC)[reply]
• WP:AN discussion started. Closing the case. Vanjagenije (talk) 23:33, 17 August 2015 (UTC)[reply]

Suspected sockpuppets

• 24.237.109.124 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

Per this editor's SPI investigation archive, this IP is a

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I honestly consider these edits potentially useful. This is why I want you to leave them alone and overlook my negative qualities altogether. The usefulness of edits is more important than who they are coming from. Please try and get this policy changed. 24.237.109.124 (talk) 02:47, 26 November 2015 (UTC)[reply]

• IP blocked for 48 hours and closing. Vanjagenije (talk) 08:52, 26 November 2015 (UTC)[reply]

Suspected sockpuppets

• 208.54.39.187 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

Edit performed by the IP in this report ([71]) essentially matches the description of another edit on the same page, reverting the same information ([72]); the IP in the latter edit has already been blocked as a sock of Fangusu, as shown in the archives. On that page, Total Drama: Revenge of the Island, the latter IP (the already-blocked Fangusu sock) reverted reverts of that information they added several times in a few minutes. Steel1943 (talk) 18:56, 18 December 2015 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• IP blocked two weeks for block evasion per behavioral evidence. Closing case for now. Mark Arsten (talk) 01:00, 19 December 2015 (UTC)[reply]

Suspected sockpuppets

• 172.58.25.115 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

Per this edit ([73]), this IP is clearly a sock of Fangusu. Per the sockpuppet master's SPI archives, sockmaster edits articles such as the one referenced in the diff, and in one way or another, reveals it blatantly obvious that they are using the IP to avoid their site ban. (Or, in this case, the IP asked to be unblocked, basically admitting that they are a sock of another editor.) Steel1943 (talk) 03:58, 22 December 2015 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• I've semi-protected Talk:Total Drama: Revenge of the Island for a month and blocked the two most recent IP socks that have posted there for block evasion. Closing case for now. Mark Arsten (talk) 01:24, 23 December 2015 (UTC)[reply]

Suspected sockpuppets

• 208.54.39.221 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

During the apparently never ending quest of Fangusu to continuously IP-hop to add edits to the articles which they were editing previously instead of adhering to the advice on their talk page to get unblocked/unbanned, apparently, yet another IP that Fangusu has started using has come out of the woodwork. Prior to Fangusu being banned from the English Wikipedia, one of the articles that they "frequented" to add edits was

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Also, it is probably worth noting that this is the 2nd IP that Fangusu has used in the "208.54.39.###" IP range, both with the 4th quadrant being higher than "128". Possible dynamic IP lease renewal with the same device or a different device in the same network. Steel1943 (talk) 21:50, 23 December 2015 (UTC)[reply]
• Mark Arsten (or any other admin or SPI clerk), unless the investigation for a rangeblock is going to happen, would you be able to close this case? I'm not 100% sure what the procedure is for SPIs, but ... I think I may have discovered a sock of Fangusu's that is a registered account (first time I've ever seen this), and I'm not clear on whether I should add it to this investigation, or start a new one. Steel1943 (talk) 23:02, 29 December 2015 (UTC)[reply]

• I see now. The next case should be created soon. Steel1943 (talk) 23:07, 29 December 2015 (UTC)[reply]

• I have semi-protected
  Undergarment for three months due to the sockpuppetry. A range block might be possible here, but I'll have to leave that decision to an admin who knows more about range blocking. Mark Arsten (talk) 22:15, 23 December 2015 (UTC)[reply
  ]
• I wouldn't advise a rangeblock here. It would probably be ineffective and would cause too much collateral damage. ​—DoRD (talk)​ 22:28, 4 January 2016 (UTC)[reply]

Suspected sockpuppets

• DJ Autagirl (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• User compare report Auto-generated every hour.
• Editor interaction utility

Well, this is a first for Fangusu this year if proven true (using a registered account) but it seems like this has been going on for a while. I suspect that DJ Autagirl is a sockpuppet of Fangusu. (If this is a sock of Fangusu, I'm a bit shocked since this account'a first edit was prior to Fangusu having their 7-year block lifted, as well as being prior to their site ban.) The two editors have edited several of the same articles, and in most cases, reinforced the same additions to the articles (which I will provide evidence here in a moment.)

The reinstated edit that set me off to this account possible being a sock of Fangusu is re reinstatement of adding "camisole" to

1. Zapp Brannigan (Fangusu & Fangusu sock vs. DJ Autagirl
   )
2. DJ Autagirl recreating several Digimon-related pages that Fangusu nominated for deletion, but creating them as redirects, including:
   1. List of Digimon Adventure V-Tamer 01 characters (AfD)
   2. List of Digimon Data Squad characters
      List of Digimon Data Squad characters (AfD
      )
   3. List of Digimon Frontier characters (AfD)
   4. DigiDestined (AfD)
3. Interest in articles related to
   Marine (Doom) (recent contribution list on Marine (Doom) where both editors are present
   )
4. A habit of merging (blanking) entire articles and converting them into redirects without merging anything or enough, and prior to consensus or against consensus, including:
   1. DJ Autagirl on Marine (Doom) - reverted
   2. Fangusu on Temporary tattoo (reverted by me soon after)
   3. DJ Autagirl on List of Spyro characters - reverted
   4. Fangusu on Doom II RPG (reverted by me soon after)
5. I also noticed that Fangusu nominated
   List of Invader Zim characters for deletion (AfD), and DJ Autagirl recently edited that page (edit
   ).

Since this is the first time I have seen Fangusu use a possible registered-account sockpuppet, I am requesting a CheckUser check for this case since the last one for Fangusu (if any) would have been done over 7 years ago and DJ Autagirl's first edits were in 2013, though I am not sure how useful this will be since Fangusu has proven to IP-hop to/from ranges that are completely unrelated to each other. Steel1943 (talk) 00:04, 30 December 2015 (UTC)[reply]

• Also, seems that they have both edited The Genie Family at some point (edit history). Steel1943 (talk) 00:27, 30 December 2015 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Clerk endorsed Endorsing check per Steel's evidence. Mark Arsten (talk) 00:59, 30 December 2015 (UTC)[reply]
•  Confirmed. ​—DoRD (talk)​ 22:28, 4 January 2016 (UTC)[reply]

• Blocked and tagged, closing. Vanjagenije (talk) 22:48, 4 January 2016 (UTC)[reply]

Suspected sockpuppets

• 172.58.72.113 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

Restoring edits made by now-blocked sock User:DJ Autagirl, for example [80] and [81]. (Compare with [82] and [83] by DJ Autagirl.) Edit summaries admit that this is a sock. Meters (talk) 02:32, 5 January 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Comment: I've requested on
  Zapp Brannigan have temporary semi-protection in an effort to protect them from anon Fangusu socks. Steel1943 (talk) 02:34, 5 January 2016 (UTC)[reply
  ]
  • Pages protected; IP blocked two weeks based on the duck test. Katie^talk 03:35, 5 January 2016 (UTC)[reply]

• IP already blocked. Closing. Vanjagenije (talk) 11:08, 5 January 2016 (UTC)[reply]

Suspected sockpuppets

• 134.154.255.43 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• The IP seems to have been blocked for 31 hours by HighInBC. The protection requests are still pending an answer. Steel1943 (talk) 22:42, 6 January 2016 (UTC)[reply]

• Block for evasion based on this edit summary: [84]. Not sure who it is other than that they claim to be banned. HighInBC 22:56, 6 January 2016 (UTC)[reply]

• Has anyone made a toe-sock-puppet joke yet? Drmies (talk) 18:21, 8 January 2016 (UTC)[reply]

• I've declined the RFPP request. The pages haven't been edited for months except for the IP, which has been blocked. I'd only recommend semi-protection if it persists. Mike V • Talk 00:38, 7 January 2016 (UTC)[reply]

Suspected sockpuppets

• 134.154.39.184 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 134.154.255.53 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

Quack.

• Requesting restoration of reverted edits made by a previous sock of Fangusu. [85], [86]
• Returns to articles just off protection from last batch of Fangusu socks to make same edits. [87] [88] [89] and [90] [91] Meters (talk) 23:25, 22 January 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Both IPs blocked. Closing. Vanjagenije (talk) 23:44, 22 January 2016 (UTC)[reply]

Suspected sockpuppets

• 134.154.36.98 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 134.154.39.41 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 172.56.30.65 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 172.56.31.170 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 172.56.38.239 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

More IPs in the 134.154.x.x and 172.56.x.x range battling over "original research" in

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• @
  site banned editor, what exactly are you trying to accomplish here? This sockpuppet master, to my knowledge, uses only IPs (with the exception of DJ Autagirl which has since been blocked.) The only useful action that could be accomplished against this editor is an IP rangeblock, but the IPs that the editor uses vary so greatly that an IP rangeblock (or multiple ones, in this case) would be so difficult to calculate that collateral damage against unrelated editors would be inevitable. Steel1943 (talk) 22:31, 2 February 2016 (UTC)[reply
  ]

So that there's a record of their ongoing abuse. I know we probably can't do anything about it in terms of technical actions, but say they come back with the main account six months from now (or today) and make a

WP:LTA, and if there's agreement that that's a better course of action then I'll consider doing that instead. Ivanvector 🍁 (talk) 15:21, 3 February 2016 (UTC)[reply

]

@

WP:RFA for this reason alone.) Steel1943 (talk) 15:40, 3 February 2016 (UTC)[reply

]

• Unblocked IPs are not active. Closing. Vanjagenije (talk) 23:31, 6 February 2016 (UTC)[reply]

Suspected sockpuppets

• DodingBeast (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• User compare report Auto-generated every hour.
• Editor interaction utility

I noticed that a new-ish editor started performing edits on

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

 Confirmed, blocked, and tagged.  No sleepers

• Emizangel (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• User compare report Auto-generated every hour.
• Editor interaction utility

Restoring ([100], [101]) previously reverted edits ([102]) to Teenage Mutant Leela's Hurdles, one of Fangusu's favourite targets. Account created three days after the previous sock was banned. Ivanvector 🍁 (talk) 15:54, 16 February 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Please believe me on this matter. I have no idea where Emizangel came from. I did not create that account. Regards, Fangusu 172.58.33.83 (talk) 15:57, 16 February 2016 (UTC)[reply]

Blocked and tagged based on behavior. CU not needed. Closing.--Bbb23 (talk) 16:10, 16 February 2016 (UTC)[reply]

Suspected sockpuppets

• 172.58.33.83 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Blocked 72 hours. Closing.--Bbb23 (talk) 16:11, 16 February 2016 (UTC)[reply]

Suspected sockpuppets

• 69.42.15.3 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

Quack. I don't normally bother with the many IPs of this banned user, but this IP is a multiple reoffender. Back from a 2 month block evasion block (the fourth one) and immediately back to one of Fangusu's favourite articles, Camisole [104] and a similar article [105] Compare with [106] and [107] by two previously blcoked Fangusu socks. This typical Fangusu behaviour. Meters (talk) 04:51, 24 February 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Already blocked. CLosing the case. Vanjagenije (talk) 12:24, 24 February 2016 (UTC)[reply]

Suspected sockpuppets

• 208.54.5.204 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Another admitted IP sock. "Could you please make an exception?" in edit summary: [108], [109] and appeals to users she's appealed to previously: [110], [111]. Worth noting that this IP has been used within the last two months by a user who does not appear to be a Fangusu sock; probably dynamic.

Admins, is there a better/faster/lighterweight process for flagging and blocking these IPs? Ivanvector 🍁 (talk) 15:53, 24 February 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• @KrakatoaKatie: Agreed about this probably being a dynamic IP. The only static IP I suspect that Fangusu uses is 69.42.15.3 (the IP used in the previous report.) I suspect that all other IPs are mobile devices whereas the static IP is probably a home computer. Steel1943 (talk) 17:48, 24 February 2016 (UTC)[reply]

I did a bit of checking myself, and I agree. She might also be using a VPN, some of her IPs geolocate to ... far-off lands, let's say. Ivanvector 🍁 (talk) 17:54, 24 February 2016 (UTC)[reply]

 Blocked but awaiting tags I think this is a dynamic IP too, but I blocked for two weeks. Not sure tagging would be worth it. Katie^talk 16:45, 24 February 2016 (UTC)[reply]

No need for tagging. Closing the case. Vanjagenije (talk) 20:00, 24 February 2016 (UTC)[reply]

Suspected sockpuppets

• 172.56.30.191 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• @KrakatoaKatie: Funny that you should mention that. Steel1943 (talk) 19:41, 25 February 2016 (UTC)[reply]

 IP blocked Three months. Not tagged yet - AIV is backed up. Seriously considering semi-protecting this page as she's reverted it a few times now. Katie^talk 19:39, 25 February 2016 (UTC)[reply]

No tagging needed. Closing the case. Vanjagenije (talk) 00:10, 26 February 2016 (UTC)[reply]

Suspected sockpuppets

• 172.58.32.177 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

User continues the same editing pattern as other blocked users/IPs. Had removed requests for page protect for

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Same for Talk:Camisole. Steel1943 (talk) 15:28, 2 March 2016 (UTC)[reply]
•  IP blocked for 1 month by KrakatoaKatie. Steel1943 (talk) 16:12, 2 March 2016 (UTC)[reply]

• Closing the case. Vanjagenije (talk) 19:15, 2 March 2016 (UTC)[reply]

Suspected sockpuppets

• 172.56.41.43 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Unblock request on my user page ([114]). Ivanvector 🍁 (talk) 04:08, 3 March 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Self-admitting sock blocked for three days. Closing. Vanjagenije (talk) 11:38, 3 March 2016 (UTC)[reply]

Suspected sockpuppets

• 172.56.38.117 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Guess who. [115] Ivanvector 🍁 (talk) 17:57, 6 March 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Already blocked. Closing. Vanjagenije (talk) 09:03, 7 March 2016 (UTC)[reply]

Suspected sockpuppets

• 172.56.30.139 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

[116] - created a user page containing only a request to unblock Fangusu. Textbook

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• @HighInBC: no, there's no need for an investigation at all. We can't do a rangeblock that will catch all of her IPs apparently, so every few days when she shows up on a new one and admin assistance is needed to block her, I've been told repeatedly that this is the place to report. She admits it's her each and every time, but we don't have an lightweight, AIV-like "report obvious sockpuppets" noticeboard. Ivanvector 🍁 (talk) 17:04, 24 March 2016 (UTC)[reply]

I have blocked the IP for block evasion and they have been directed to UTRS. I don't see much need in an investigation. HighInBC 16:35, 24 March 2016 (UTC)[reply]

• Closing the case. Vanjagenije (talk) 22:19, 24 March 2016 (UTC)[reply]

Suspected sockpuppets

• 134.154.255.75 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 134.154.38.62 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 134.154.255.3 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Some people say that ham is best at Easter, but I think you'll find that

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• On a related note, I just added 2 pages to my watchlist. Steel1943 (talk) 21:39, 29 March 2016 (UTC)[reply]
• @
  WP:BEANS.) Steel1943 (talk) 21:46, 29 March 2016 (UTC)[reply
  ]

Apologies, I thought this was obvious from the IPs involved so I didn't bother elaborating. Semiprotected edit requests in my watchlist catch my attention because they're often simple to respond to and there's always a backlog. 134.154.38.62's first (and only) edit was requesting an edit which happened to be a restoration of an edit by one of Fangusu's previous admitted socks ([117]) with her usual ban appeal in the edit summary. The IP also matches a range which Fangusu frequents. I was watching the page, either because of a previous edit request, or more likely because she had disrupted it enough in the past for it to earn semiprotection. It was clearly ban evasion, so I reverted. She managed to swap IPs after that, and the second IP reverted my edit only two minutes later. At that point it didn't matter whether the second IP was her or not, it was restoring her edits, so I reverted again, but the IP was close enough that I also reverted the other edits it had made today (on

WP:BEANS applies here: Fangusu has shown a pattern of not paying attention to any information we give her, and none of this info is particularly special. Ivanvector 🍁 (talk) 04:19, 30 March 2016 (UTC)[reply

]

Yeah, even with their lack of taking advice from others, ya never know when the

WP:BEAN will get cha. Anyways, I may be passing on my Fangusu-sock sensor to you soon; I've been at this for almost a year now, and things really haven't changed (except for several pages related to them now bring semi-protected.) Steel1943 (talk) 15:02, 30 March 2016 (UTC)[reply

]

Sorry, I didn't reply because I thought that was sarcasm at bothering to list obvious socks. Meters (talk) 20:52, 30 March 2016 (UTC)[reply]

@Meters: Yeah, surprisingly enough, I was serious. I still wouldn't have realized these were socks unless Fangusu admitted it after a revert. I must be getting a bit rusty at this. Steel1943 (talk) 21:46, 30 March 2016 (UTC)[reply]

• The IPs are either range-blocked or stale. Closing. Bbb23 (talk) 23:40, 19 April 2016 (UTC)[reply]

Suspected sockpuppets

• 134.154.255.75 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

After a decent period without socking in which we might have thought that Fangusu was finally getting the message, she has returned to reverting her old sock edits on her usual articles. This IP was blocked as her sock previously, see contribs for evidence. Ivanvector 🍁 (talk) 21:31, 4 May 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• I probably shouldn't, but I'm self-closing. IP already blocked. Ivanvector 🍁 (talk) 21:33, 4 May 2016 (UTC)[reply]

Suspected sockpuppets

• 172.56.40.49 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 172.56.41.87 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

Quack. Latest batch of IP socks. Geolocates to California again. Characteristic interests... girls, breasts, training bras. Compare, for example, [118]and [119] by Fangusu (the original user account, not a sock) with [120] and [121] by the IPs. The same edit and a nearly identical edit summary. Also note the characteristic pleading to an editor reverting her as a Fangusu sock [122] to allow edits to stand [123] Meters (talk) 17:32, 19 May 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Administrator note Sure enough. Blocked both IPs and closing up. Favonian (talk) 17:44, 19 May 2016 (UTC)[reply]

• 208.54.5.199 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Restoring previous socks' edits on Camisole and Amar Chitra Katha: previous sock, new IP. Ivanvector 🍁 (talk) 16:50, 10 June 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Admin assistance needed: this user hops IPs frequently; their previous IPs have been blocked anywhere from 24 hours up to three months, but I don't think a block of any more than a few days is worthwhile. Let's say block for 48 hours. Ivanvector 🍁 (talk) 16:55, 10 June 2016 (UTC)[reply]
• Blocked and the pages are now protected. Case closed. Vanjagenije (talk) 22:22, 11 June 2016 (UTC)[reply]

• 134.154.20.152 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Continuing to request the same edit at Talk:Toe socks after having admitted to being Fangusu's sock just two days ago. Ivanvector (^Talk/_Edits) 21:30, 21 September 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

 Awaiting administrative action: this user has a knack for both IP-hopping and waiting out blocks to redo edits, but this IP does not seem to be dynamic. Please block for one month. Ivanvector (^Talk/_Edits) 21:32, 21 September 2016 (UTC)[reply]

• Never mind, Favonian already got 'em. Closed. Ivanvector (^Talk/_Edits) 21:33, 21 September 2016 (UTC)[reply]

• CapeDragon (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• User compare report Auto-generated every hour.
• Editor interaction utility

Seems to be a

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• I was going to say the same as Vanjagenije, it should be possible given this sockmaster's history to make some kind of judgement based on IP address alone, even if there's nothing useful in the log. But even if not, the IP that first blanked the LTA page is from one of Fangusu's usual ranges, and this new account reverted that only 8 minutes later. It's a pretty loud
  quacking. Note also that Fangusu has been found to be incubating sleepers in the past. Ivanvector (^Talk/_Edits) 13:16, 29 September 2016 (UTC)[reply
  ]
• "SteelKalu", eh? Interesting, considering umm ... my account name. Steel1943 (talk) 16:09, 29 September 2016 (UTC)[reply]

And, for the record, SteelKalu edited Pantalettes (1), Panties (2) and Doomguy (3), some of Fangusu's usual editing grounds. Steel1943 (talk) 16:41, 29 September 2016 (UTC)[reply]

• CheckUser requested and endorsed by clerk - Can CU help here? Previous accounts are stale, I know. But, Fangusu's IP ranges are known, so I hope this can be checked. Vanjagenije (talk) 07:53, 29 September 2016 (UTC)[reply]
•  Confirmed + SteelKalu (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). Blocked, tagged, closing.--Bbb23 (talk) 15:55, 29 September 2016 (UTC)[reply]

• 66.234.193.118 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Restoring previously blocked sock User:SteelKalu's edits and appealing their block in edit summaries. Ivanvector (^Talk/_Edits) 19:26, 2 October 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

 Awaiting administrative action: this IP is outside her usual range, but she has used it before. Please block for one month. Ivanvector (^Talk/_Edits) 19:27, 2 October 2016 (UTC)[reply]

• Done. Closing. Favonian (talk) 19:31, 2 October 2016 (UTC)[reply]

• 134.154.18.72 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Comment: Per the IP's block log, the IP may need to be blocked for a few days since it seems this IP is recently exclusive to Fangusu. Steel1943 (talk) 17:18, 5 October 2016 (UTC)[reply]

• Straight out of the old block and into the new, longer, one. Closing. Favonian (talk) 17:33, 5 October 2016 (UTC)[reply]

• 134.154.255.17 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 134.154.16.97 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 134.154.255.28 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I added another one. Same behavior, continuing same reverts. As the French say, coin-coin! Grayfell (talk) 05:26, 6 October 2016 (UTC)[reply]

 Clerk note: clearly her, but all IPs stale; closing. See you next time. Ivanvector (^Talk/_Edits) 22:27, 6 October 2016 (UTC)[reply]

• 134.154.255.17 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Restoring her persistent edit request at Talk:Teenage Mutant Leela's Hurdles, again. I normally don't bother with Fangusu's IPs any more since she's never going to get through a ban appeal given her 8-year socking history, but she's been using this IP consistently throughout October so action is warranted. Ivanvector (^Talk/_Edits) 17:09, 18 October 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

 Awaiting administrative action: please block for 1 week. That ought to cover Fangusu's next impulse to edit. Ivanvector (^Talk/_Edits) 17:10, 18 October 2016 (UTC)[reply]

 Administrator note Made it a month in view of the edit history. Closing. Favonian (talk) 17:11, 18 October 2016 (UTC)[reply]

• 2607:FB90:2857:CBA4:35D2:B89D:C765:32BF (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• User compare report Auto-generated every hour.
• Editor interaction utility

See previous case in Fangusu's SPI archive. Same situation, and obvious

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

 Sounds like a duck quacking into a megaphone to me. Please block 72 hours. Ivanvector (^Talk/_Edits) 16:58, 21 October 2016 (UTC)[reply]

•  Done. Marking as closed. Mkdw^talk 03:37, 22 October 2016 (UTC)[reply]

• 134.154.255.28 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Need a block on Fangusu's most recent IP. Same IP as was spamming edit requests at Talk:Teenage Mutant Leela's Hurdles before it was protected. Now she's just moved on to different articles in her set of regular targets. Ivanvector (^Talk/_Edits) 01:44, 27 October 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

 Awaiting administrative action: please block 72 hours. Ivanvector (^Talk/_Edits) 01:44, 27 October 2016 (UTC)[reply]

•  Administrator note Blocked as per request. Marking as closed. Mkdw^talk 01:56, 27 October 2016 (UTC) Mkdw^talk 01:56, 27 October 2016 (UTC)[reply]

• 134.154.255.95 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Fangusu

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Awaiting administrative action: please block 31 hours. If someone is willing, a rangeblock on 134.154.255.0/24 would be appreciated. Ivanvector (^Talk/_Edits) 17:58, 27 October 2016 (UTC)[reply]

Range blocked for a month. Closing. Favonian (talk) 18:13, 27 October 2016 (UTC)[reply]

• LennonFarrokhChipkali (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• User compare report Auto-generated every hour.
• Editor interaction utility

New user editing a Final Fight article, one of Fangusu's known areas of interest, edit warring in Fangusu's usual style of mass-reverting until a page is protected (1 2 3, protected) and then waiting for protection to expire before reverting again (same revert after protection expires). Also editing Fangusu's LTA, as previous socks have done. Ivanvector (^Talk/_Edits) 02:30, 5 November 2016 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Self-endorsed by clerk for checkuser attention per above. Ivanvector (^Talk/_Edits) 02:43, 5 November 2016 (UTC)[reply]
•  Confirmed. No sleepers detected. Mike V • Talk 02:46, 5 November 2016 (UTC)[reply]

• 2607:FB90:2762:1E1F:18B5:F2B4:A78E:142F (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

 Sounds like a duck quacking into a megaphone to me - textbook Fangusu. Why aren't you letting this edit stick? Ivanvector (^Talk/_Edits) 00:59, 23 November 2016 (UTC)[reply]

• Blocked the ip and protected the page Guerillero | Parlez Moi 05:53, 23 November 2016 (UTC)[reply]

• 24.237.105.147 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Blocked for two weeks without talk page privileges. Closing. Favonian (talk) 20:17, 27 November 2016 (UTC)[reply]

• 134.154.20.32 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

[124] [125]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Indeed. Already blocked by Cenarium; case closed. Ivanvector (^Talk/_Edits) 18:36, 5 December 2016 (UTC)[reply
  ]

• 134.154.19.119 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Also, the first two quadrants of the IP look like other IPs Fangusu has used in the past. Steel1943 (talk) 06:49, 27 January 2017 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• IP hasn't edited anymore, closing. GAB^gab 14:58, 28 January 2017 (UTC)[reply]

• 134.154.21.83 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Clerk note: Fangusu's range 134.154.0.0/18 blocked for 72 hours. Ivanvector (^Talk/_Edits) 12:51, 15 February 2017 (UTC)[reply]

• 208.54.39.221 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

Above IP is the most recent IP caught, but below is a large table of IPs. I used Twinkle to initiate the SPI for convenience-sake.

I've been following a set of vandal IPs for a few weeks now and I've come to the conclusion they are Fangusu. Their behavior did not match what I new of Fangusu from the LTA page, but the overlap is too great to be mere coincidence. Below is a partial copy-paste of my "investigation" from User:EvergreenFir/socks#Southwest.

Habit: Changes end date of TV shows to "present". Example edits: [126], [127], [128], [129], [130], [131], [132], [133], [134], [135]. Frequently targets Kid vs. Kat, El Tigre: The Adventures of Manny Rivera, Hi Hi Puffy AmiYumi, Franklin (TV series), and Bobby's World. Also add incorrect channels to the infobox (e.g., [136]).

Range: 172.56.30.*; 172.56.31.*, 208.54.39.*

ISP: T-Mobile USA (Wireless Broadband)

Connection to Fangusu - The 208.54.39.* range seem to have been used by Fangusu (e.g., restoring Fangusu sock edits ([137]), filing ANIs about Fangusu blocks ([138]), asking for unblocks in edit summaries ([139]0, and being blocked for block evasion ([140], [141], [142], [143]). Perhaps clearest link between Fangusu (known in part for for edits on underwear) and the cartoon vandalism are these reverts by 172.58.17.158 ([144], [145], [146], [147], [148], [149]) and edit history of Special:Contributions/172.58.25.2. Steel1943 put an suspected sock notice ([150]) on a 208.54.39.221's talk page. I just reverted that user for triggering the abuse filter ([151], [152]).

User also seems to target Univision and Telemundo pages, but that pattern of vandalism is not documented here. See 172.58.25.80 (talk · contribs · WHOIS) and 172.58.25.85 (talk · contribs · WHOIS) for clear link.

Edit filter made by MusikAnimal to detect this vandal. See this archived discussion.

Table of IPs, dates, edits, geolocation, and other notes in chronological order

tl;dr - The overlap of the IP ranges used by Fangusu and the person doing these "present" vandalism edits is significant. It seems unlikely that 3 IP ranges known to be used by Fangusu are also being used to do this vandalism. Requesting possible confirmation or analysis by admin(s). Would be interested in pursuing rangeblocks as well (but that might need to be done at ANI?)

Thank you! EvergreenFir (talk) 17:38, 17 February 2017 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Clerk note: 100% Fangusu. Nuisance edits to cartoon articles, redoing old reverted edits, begging to be unblocked. I blocked 134.154.0.0/18 a couple days ago because of her, but it looks like we can get a bit more specific based on this activity. 172.56.30.0/23 and 208.54.39.128/25 blocked for 1 month. Ivanvector (^Talk/_Edits) 18:16, 17 February 2017 (UTC)[reply]

• 66.234.193.118 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• User compare report Auto-generated every hour.
• Editor interaction utility

[158] Long-term, static IP Sro23 (talk) 15:13, 4 March 2017 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Blocked; closing. Favonian (talk) 15:15, 4 March 2017 (UTC)[reply]

• DictatorBoxerClaw (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• User compare report Auto-generated every hour.
• Editor interaction utility

Seems to be an

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Comment only; I'll let another clerk have a look at this one. I have my doubts here. On one hand, this edit summary (Some adoptees are not orphans) seems like a giveaway with previous sock's Not all adoptees fit the technical definition of orphans or Fangusu herself Not all adoptees fit the technical definition of 'orphan'. Also, not all orphans are adopted. On the other hand, this is just removing a category, with an explanation that makes some logical sense. The user has edited in Fangusu's usual range of interest, but a few things stand out. Their edit on
  Wikipedia:Requested articles/music/Performers, bands and songwriters. That's not an area that Fangusu matches and she never tries to ask for help in the proper venues, and when the user was reverted here they didn't respond with an immediate flat revert as Fangusu does but actually responded to the criticism and provided a source. So, I have my doubts that this user is Fangusu. Ivanvector (^Talk/_Edits) 13:38, 24 March 2017 (UTC)[reply
  ]

Also, @Steel1943: I personally haven't ever seen Fangusu perform a revert without the automatic revert text being included, but if that is a thing that she does (or a new thing) then yeah that should go in the LTA. Ivanvector (^Talk/_Edits) 13:41, 24 March 2017 (UTC)[reply]

• @
  WP:DUCK. Steel1943 (talk) 14:58, 24 March 2017 (UTC)[reply
  ]

  In fact, if you want to go way back in time ... back to my first report of Fangusu ... Wikipedia:Sockpuppet investigations/Fangusu/Archive#13 August 2015 ... the edits I cited where Fangusu told me to boil my head, those were performed by Fangusu using "undo" as I was notified those edits had been performed, but Fangusu didn't include the auto-generated undo text ... and she's been doing that with socks ever since. Steel1943 (talk) 15:27, 24 March 2017 (UTC)[reply]

• Also, this is not the first time that Fangusu has attempted to constantly change information on a category page: see
  WP:BATTLEGROUND mentality, whereas logged-in accounts will almost never respond to any inquiries, will not acknowledge almost any notification on their talk page, and will actually go out of their way to not interact with anyone ... as is what happened with User:DJ Autagirl. Steel1943 (talk) 15:43, 24 March 2017 (UTC)[reply
  ]

Just a side note, I originally didn't place a note on this user's talk page for some reason that I don't remember ... but probably because I thought its

WP:DUCK-iness wasn't going to be in doubt, but then who I also consider a bit of a strong "Fangusu historian" had some doubts. Anyways, I placed the required notice on their talk page. Steel1943 (talk) 15:51, 24 March 2017 (UTC)[reply

]

• ...And now, I just discovered that this account performed an edit on a clothing article. The article isn't specific to women's clothing (per the LTA), but still, too many coincidences. Steel1943 (talk) 16:09, 24 March 2017 (UTC)[reply]
• @Ivanvector: This account just started editing Jazz Jackrabbit... Steel1943 (talk) 18:32, 24 March 2017 (UTC)[reply]

  Checkuser needed Given the fact that there seems to now be definite proof that this account is Fangusu due to the Jazz Jackrabbit editing, I'm now requesting Checkuser to see if there are any sleeper accounts. Steel1943 (talk) 18:39, 24 March 2017 (UTC)[reply]