Jump to content

Wikipedia:Sockpuppet investigations/Karunyan/Archive

Add links
From Wikipedia, the free encyclopedia


Karunyan

18 May 2010
Suspected sockpuppets
Evidence submitted by -- AnmaFinotera (talk · contribs)

All IPs already pretty much confirmed on behavioral and all being from the Tamil Nadu area of India, but feel an SPI is needed to really have hard evidence on these ranges for easier cataloging and ID by others. All exhibit the same behavior as Karunyan, namely his continued, disturbing wikihounding of myself, primarily through List of Blood characters, and the random addition of "vandal shrine" notices on various Long Term Abuse reports with each IP. As he has continued to evade his ban, also asking for check user to check for possible sleepers as it seems unlikely he is satisfied with just IP socking when he had at least one named sock. See Wikipedia:Administrators' noticeboard/IncidentArchive604#Karunyan Continuing Wikihounding/Trolling After 72 hour block for the original discussion which led to his indef block and to the revelation of his using socks. Already suspect range blocks aren't likely to be a possibility, but posing that question as well. -- AnmaFinotera (talk · contribs) 05:47, 18 May 2010 (UTC)[reply]

Comments by accused parties    See Defending yourself against claims.


Comments by other users


CheckUser requests
Checkuser request – code letter: F (Other reason )
Current status – Declined, the reason can be found below.    Requested by -- AnmaFinotera (talk · contribs) 05:47, 18 May 2010 (UTC)[reply]

 Clerk declined – It's darn clear that these IPs all are from the sockmaster. No CU necessary. –MuZemike 06:31, 19 May 2010 (UTC)[reply]

I don't think the range block worked. He vandalized this page right before you posted that (removing the one named sock that has been uncovered), and my user talk (again) afterward[1][2] I was thinking of CU primarily to find any other named sleepers, or even actives. -- AnmaFinotera (talk · contribs) 12:42, 19 May 2010 (UTC)[reply]
Clerk, patrolling admin and checkuser comments

information Administrator note 59.96.16.0/20 blocked 1 week. List of Blood characters also semi-protected for a while. –MuZemike 06:31, 19 May 2010 (UTC)[reply]

59.96.0.0/16 (block range · block log (global) · WHOIS (partial)) blocked for one week. Tim Song (talk) 04:32, 20 May 2010 (UTC)[reply]
This case has been marked as closed. It has been archived automatically.
14 June 2010
Suspected sockpuppets
Evidence submitted by AnmaFinotera

Three more spoof accounts doing the usual wikistalking and vandalizing of various articles I've edited, including branching into page move vandalism and vandalizing other various India oriented articles. Usual check to confirm they are him, check for sleepers, and see if the current IP range block from the last ANI can be extended/expanded. Some of those named above seem to have been created at the same time as that discussion, so possible sleepers were missed in the last CU, however some have also been made since then. -- AnmaFinotera (talk · contribs) 23:15, 14 June 2010 (UTC)[reply]

Add one newer one, and two older ones which may possibly stale, but that seem to be along the same line of being spoof accounts. Some possibly are Bambifan rather than Karunyan based on dates, but either is possible. -- AnmaFinotera (talk · contribs) 23:25, 14 June 2010 (UTC)[reply]
Comments by accused parties

See Defending yourself against claims.


Comments by other users
Clerk, patrolling admin and checkuser comments
Checkuser request – code letter: E (Community ban/sanction evasion )
Current status – Completed: Reviewed by a Checkuser, results and comments are below.    Requested by -- AnmaFinotera (talk · contribs) 13:27, 14 June 2010 (UTC) [reply]

Collectonian-1 (talk · contribs) and Collectonianiscrazy (talk · contribs) are  Stale.

 Confirmed Karunyan (talk  · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) =

Fun fun...wonder where the Zombie motif came from. Looks like the SIayer one isn't blocked though?-- AnmaFinotera (talk · contribs) 05:59, 15 June 2010 (UTC)[reply]
This case has been marked as closed. It has been archived automatically.
26 June 2010
Suspected sockpuppets


Evidence submitted by TheFarix

Obvious socks of puppeteer PWeeHurman (talk · contribs) making the same edits to Talk:Dragon Ball as a self-identified sock PWeeHurman3 (talk · contribs). CheckUser requested to find additional sleepers. —Farix (t | c) 21:55, 26 June 2010 (UTC)[reply]

Comments by accused parties

See Defending yourself against claims.


Comments by other users
Clerk, patrolling admin and checkuser comments
Checkuser request – code letter: CODE LETTER (Unknown code )
Current status – Completed: Reviewed by a Checkuser, results and comments are below.    Requested by —Farix (t | c) 21:55, 26 June 2010 (UTC) [reply]
This looks like a joe job to me. J'onn J'onzz made an edit, which was reversed as an edit by a sock of a banned user, but I decided it was a misidentification; and then someone else -- I think User:Karunyan -- decided to entertain himself on our dime. The checkuser mismatch between J'onn J'onzz and the others is profound; we're talking other side of the planet and no similarities at all. --jpgordon::==( o ) 04:23, 28 June 2010 (UTC)[reply]
 Clerk note: Moved from Wikipedia:Sockpuppet investigations/PWeeHurman, see there for the full history. T. Canens (talk) 04:27, 28 June 2010 (UTC)[reply]
This case has been marked as closed. It has been archived automatically.
26 June 2010
Suspected sockpuppets
Evidence submitted by Jeff G.

One more spoof account and one more IP Address. Please see 1; 2; and the signature in 3. Usual check to confirm they are him, check for sleepers, and see if the current IP range block from the last ANI can be extended/expanded.   — Jeff G. ツ 23:17, 26 June 2010 (UTC)[reply]

Would love to know how that thing got around the filter....grrr....-- AnmaFinotera (talk · contribs) 23:28, 26 June 2010 (UTC)[reply]
It appears to have been a sleeper from 05:04, 8 April 2010 (UTC).   — Jeff G. ツ 23:35, 26 June 2010 (UTC)[reply]
Yeah, I see that now...but two CUs have been done since then at it was missed? That is concerning :-( -- AnmaFinotera (talk · contribs) 23:38, 26 June 2010 (UTC)[reply]

I added more members of Category:Suspected Wikipedia sockpuppets of Karunyan.   — Jeff G. ツ 01:05, 27 June 2010 (UTC)[reply]

Comments by accused parties

See Defending yourself against claims.


Comments by other users
  • agree for need for CU to find sleepers since this one has been around since April and got past the user name filter. Also, agree with need to possibly extend range block, since he fully intends to continue to evade his community ban[3] -- AnmaFinotera (talk · contribs) 23:34, 26 June 2010 (UTC)[reply]
Added TheOneTrueCollectonian (talk · contribs) per WP:DUCK. Already blocked. -- AnmaFinotera (talk · contribs) 01:55, 28 June 2010 (UTC)[reply]
Clerk, patrolling admin and checkuser comments
Checkuser request – code letter: E (Community ban/sanction evasion )
Current status – Completed: Reviewed by a Checkuser, results and comments are below.    Requested by   — Jeff G. ツ 23:17, 26 June 2010 (UTC)[reply]
information Administrator note both blocked per WP:DUCK, with the IP hard blocked. Per above, a sleeper check and a possible extension of a rangeblock would be nice. CU/clerk- if the IP block needs to be shortened, feel free to do so without further consultation with me. HJ Mitchell | Penny for your thoughts? 00:03, 27 June 2010 (UTC)[reply]
His ranges (59.96.0.0/16 and 59.92.96.0/19) are already softblocked on June 5 for 3 months by yours truly. I've unblocked the IP since it last edited in April and I seriously doubt that the user is using that IP right now. In addition, it is part of one of the blocked ranges. T. Canens (talk) 02:56, 27 June 2010 (UTC)[reply]
I've blocked ConductDiscuss (talk · contribs) per WP:DUCK - the account seemed to be only interested in restoring Karunyan's edits. PhilKnight (talk) 12:19, 27 June 2010 (UTC)[reply]
Yep, that's another of his naming patterns. Not very creative is he... -- AnmaFinotera (talk · contribs) 17:00, 27 June 2010 (UTC)[reply]
  •  Confirmed that all the *Coll* accounts are on 59.92.*.*, except for IloveColl* which is  Stale. I'm afraid these are busy ranges, with lots of new accounts being created, so blocking the range has a lot of collateral damage. If it is necessary to block, please be careful to ensure the blocked anons know how to create an account around the block.
    Based on the data, Karunyans (talk · contribs) is  Likely related to the *Coll* accounts and Karunyan (talk · contribs), and I see an edit or two which support it.
    I'm not sure how 117.97.177.12 (talk · contribs · WHOIS) relates to all this, given that it has no edits. Anyway, there has been no recent activity from 117.97.177.0/26. John Vandenberg (chat) 17:56, 29 June 2010 (UTC)[reply]

information Administrator note Summing up, I think - Tim Song has softblocked two of the IP ranges and the named accounts are already blocked. There doesn't appear to be much more to do, so I will mark for closing. TNXMan 01:16, 30 June 2010 (UTC)[reply]

This case has been marked as closed. It has been archived automatically.
01 July 2010
Suspected sockpuppets
Evidence submitted by AnmaFinotera

Yet another spoof name sock doing the same old stuff, different day and pages. Need usual checkuser for sleeper check and see if latest range can be blocked. -- AnmaFinotera (talk · contribs) 14:20, 1 July 2010 (UTC)[reply]

Two more added from today. From behavior, seems most likely to be in this batch, though the second is also a grawpy sounding one. -- AnmaFinotera (talk · contribs) 05:32, 2 July 2010 (UTC)[reply]
Comments by accused parties

See Defending yourself against claims.


Comments by other users
Clerk, patrolling admin and checkuser comments

 Clerk endorsed Something is up here and expanding the rangeblock will help us greatly. Kevin Rutherford (talk) 00:36, 2 July 2010 (UTC)[reply]

Which brings to question of how did it escape the sweeper checks which have been done since then? ~confused~ -- AnmaFinotera (talk · contribs) 05:10, 2 July 2010 (UTC)[reply]
Either I'm out of my minds or something is wrong here. The range was blocked on June 5; the account was created on July 1. T. Canens (talk) 15:56, 2 July 2010 (UTC)[reply]
Guessing from MuZemike's note below, he is now creating accounts on other wikis then using unified to bypass the blocks. -- AnmaFinotera (talk · contribs) 17:07, 2 July 2010 (UTC)[reply]
More specifically, he's creating them on other wikis to avoid CU detection via the user creation log; i.e. CU wouldn't be able to catch "sleeper socks" the traditional way. These socks must make an edit here first in order for CU to pick up anything. –MuZemike 19:10, 2 July 2010 (UTC)[reply]
Oh fun. Guess he gets 2 points for sneakiness. So how would we request a global CheckUser? Is there anyway to deal with him on a wiki wide level instead of just EN to stop it? -- AnmaFinotera (talk · contribs) 19:49, 2 July 2010 (UTC)[reply]

 Relisted – we're going to eventually need a global CheckUser here. Karunyan creates these accounts on other wikis first and then unifies them and edits here. –MuZemike 05:34, 2 July 2010 (UTC)[reply]

Finding them via local CU is not efficient (see bugzilla:24231, and I doubt that global CU is going to be any more efficient. The simplest approach is to block them when they appear. btw, I was wrong about "Collectonian no jutsu" being created before the rangeblock; as you and others have pointed out, these accounts where created on other wikis to bypass our blocks. Is there a bug about this? John Vandenberg (chat) 23:57, 2 July 2010 (UTC)[reply]
So that's it? We're powerless against someone who is obviously exploiting the software and is battering another user (and others) senselessly with socks? Ridiculous. I just hope hoards and hoards of other banned sockmasters don't follow suit. –MuZemike 02:23, 3 July 2010 (UTC)[reply]
This case has been marked as closed. It has been archived automatically.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Karunyan/Archive&oldid=1138673690"