Misplaced Pages

:Sockpuppet investigations/Renamed user 51g7z61hz5af2azs6k6/Archive: Difference between revisions - Misplaced Pages

Article snapshot taken from Wikipedia with creative commons attribution-sharealike license. Give it a read and then ask your questions in the chat. We can research this topic together.
< Misplaced Pages:Sockpuppet investigations | Renamed user 51g7z61hz5af2azs6k6 Browse history interactively← Previous editNext edit →Content deleted Content addedVisualWikitext
Revision as of 22:34, 4 January 2016 editVanjagenije (talk | contribs)Autopatrolled, Administrators130,600 editsm Reverted edits by Elvey (talk) to last version by Vanjagenije← Previous edit Revision as of 05:13, 8 January 2016 edit undoSlimVirgin (talk | contribs)172,064 edits + noteNext edit →
Line 177: Line 177:
If anyone knows how to fix this page so the <u>User compare report</u> works properly, please do so. I'm giving it a shot. If anyone knows how to fix this page so the <u>User compare report</u> works properly, please do so. I'm giving it a shot.
'''Update:''' Adding entries like I just did up at the top with the 3 IPs that were in the very stale User compare report that was appearing improved it somewhat - to 7 entries - but the numbers still show as off e.g. still 0 for the 2600:1010: IPs (@archive/D68i8). --]<sup>(]•])</sup> 03:38, 21 December 2015 (UTC) '''Update:''' Adding entries like I just did up at the top with the 3 IPs that were in the very stale User compare report that was appearing improved it somewhat - to 7 entries - but the numbers still show as off e.g. still 0 for the 2600:1010: IPs (@archive/D68i8). --]<sup>(]•])</sup> 03:38, 21 December 2015 (UTC)

*{{u|Elvey}}, thank you for catching this. This user edits in the interests of the pharmaceutical industry, and avoids scrutiny by swapping accounts and IPs. I first encountered him in March 2013 at ]. As ], he was removing text and RS about whistleblowing, reverting when it was restored, and adding text about a Dutch whistleblower who had been sued by the drug company he worked for, as though this was the only example of whistleblowing that had ever occurred.

:After about it, he retired his account. He returned elsewhere as a series of IPs (e.g. 98.155.21.76, 98.115.169.20 and 50.113.65.200), then in October as ] he returned to ] and made the same edits, without making clear that he was a returning account. (These diffs are just examples.)

:A similar thing happened at ] (GSK) in April 2015. As Formerly 98, he made a series of edits about Avandia, a diabetes drug that GSK had promoted for off-label use, which resulted in a large fine. His edits included adding unsourced material. I requested a source twice on talk. He stopped responding and appeared to stop editing the article. A month later, he had his user page deleted, changed his name to ] and stopped editing. But he continued with IPs and in November 2015 returned with several IPs to edit the same section of GSK.

:He has now posted some of the IPs on his user page, but there are several missing. Pinging {{u|Vanjagenije}} and {{u|Xeno}}, who made the name change. ] <small><sup>]</sup></small> 05:13, 8 January 2016 (UTC)


====<big>Clerk, CheckUser, and/or patrolling admin comments</big>==== ====<big>Clerk, CheckUser, and/or patrolling admin comments</big>====

Revision as of 05:13, 8 January 2016


Renamed user 51g7z61hz5af2azs6k6

Renamed user 51g7z61hz5af2azs6k6 (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

05 December 2015

Suspected sockpuppets

I believe someone is using sock puppets in the form of at least the three initially listed IPs. They are being used by one or more logged out users to do abusive things socks typically are used to attempt/do - including avoid scrutiny, give the impression of more support for a position than actually exists, edit project space, avoid sanctions, contribute to the same page or discussion in a way that suggests they are multiple people, editing logged out to mislead.

Their handful of edits (<10, <10, <100) (diffs below) show this. Edits indicate that one longtime editor is using multiple IPs. I'd like a clerks and/or checkusers to indicate whether they see evidence that the IPs are connected to each other, and whether or not any are connected to users with accounts. I encourage the IPs to come clean - to at lease indicate (yes/no) whether they have any wikipedia accounts - or not. I don't think checkuser evidence is needed for an initial evaluation by a clerk of whether there's a connection - I think there's enough behavioral evidence for a yes on that, but a checkuser should therefore follow to find the additional connected account(s).
Random add'l info/clues:

  • 3 of the four edits by 2600:1010:b043:ec75:efad:9d0c:d710:2720 (For short: 2600...2720) included edits to MY signature.
  • 169.230.155.123 is AKA udp071243uds.ucsf.edu .

Diffs:

--Elvey 22:36, 5 December 2015 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

  • Two sock IPs blocked for 3 days, master IP warned. Range-block is not possible, as the range is very large. CheckUser can't help here, it is used only to compare named accounts, not anonymous IPs. I'm closing the case. Vanjagenije (talk) 01:24, 6 December 2015 (UTC)

20 December 2015

Suspected sockpuppets


This case was formerly opened under the above listed IP and has been moved to the above named account of the vanished user. So far, the only thing that I have seen in their behavior which may be confirmed to be wrong is that they have not followed our vanishing guideline correctly but I'm not sure that would be something to block over. Some evidence has been presented in the archive but I haven't seen convincing evidence of IP socking or other illegitimate uses so far. I will add IPs below but will leave it to the original filer or other investigators to show clear sockpuppetry if it exists. One can compare this version of their deleted user page with their statements here as well as compare the articles that they edit to see that this is the same user.

Collection of IPs used by editor
Ranges
Single IPv6s taken from this range
  • There is a handful of distinct editors using this range anonymously; one edits plant articles, one is a game developer, one is a long term abuse vandal, one owns a sex enterprise, one edits German subjects (either the plant guy or our chemical doctor being looked at) and our Chem PhD that is the subject of the SPI. Some of ChemPhD's edits may still be in this range but with less certainty, I have not included those here. Those listed below are the ChemPhD unless otherwise noted.
  • This account used to be known as Formerly 98 but that is now an unregistered account so linking to it would do no good. I refer to him above as the ChemPhD guy. This is strictly about behavior and does not involve checkusers as I see nothing that they could do here.
     — Berean Hunter (talk) 23:02, 20 December 2015 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

This account that used to be known as Formerly 98 is the one I initially reported as Unknown regular user(s) temporarily logged out - active on MEDRS pages and opposed to rigorous evidence based-medicine when I first opened the first SPI on this user.

Do take note: the archived diffs show it's done abusive things socks typically are used to attempt/do - including avoid scrutiny, give the impression of more support for a position than actually exists, edit project space, avoid sanctions, contribute to the same page or discussion in a way that suggests they are multiple people, editing logged out to mislead. EACH of these is a violation of POLICY WP:SOCK.

I am flummoxed by the statement, "I haven't seen convincing evidence of IP socking or other illegitimate uses so far. I will add IPs below but will leave it to the original filer or other investigators to show clear sockpuppetry if it exists". If it't not clear whether this user's behavior constitutes socking, I propose an RFC on that question. Posting from many different IPs on many different networks for months without disclosing, by a user who has had an account while violating our vanishing guideline is socking.

Here's one example, where in a 12-hour period, this one editor edits the same talk page using three different IPs: First, using two different IPs, the user posts these (1) comments (2), separately signed and attributed. With the edit marked (2), the sock, which is infamous for scrubbing articles of information critical of big pharma, claims that there is no controversy about this drug in the peer reviewed literature. And as another IP, with the edit marked (1), the sock, argues that the article is balanced if there is no coverage of controversy in it. However, I find controversy about this drug in the peer reviewed literature without difficulty and add it to the article very soon after. With this edit, I revert the two edits, using the edit summary: "rv sock avoiding scrutiny" The user goes to war: the user revert me, using yet another IP address, 5 minutes later, with a very threatening edit summary: {tq|"do not revert my additions to the talk page again unless you want to finish this convo at ANI."}} The socking user goes into hiding to avoid further scrutiny after I turn up the heat, by more loudly calling out the socking behavior by filing the first SPI on the user. It's also several HOURS after I've warned the user to stop socking.

If anyone knows how to fix this page so the User compare report works properly, please do so. I'm giving it a shot. Update: Adding entries like I just did up at the top with the 3 IPs that were in the very stale User compare report that was appearing improved it somewhat - to 7 entries - but the numbers still show as off e.g. still 0 for the 2600:1010: IPs (@archive/D68i8). --Elvey 03:38, 21 December 2015 (UTC)

  • Elvey, thank you for catching this. This user edits in the interests of the pharmaceutical industry, and avoids scrutiny by swapping accounts and IPs. I first encountered him in March 2013 at Pharmaceutical industry. As User:Alfred Bertheim, he was removing text and RS about whistleblowing, reverting when it was restored, and adding text about a Dutch whistleblower who had been sued by the drug company he worked for, as though this was the only example of whistleblowing that had ever occurred.
After a discussion about it, he retired his account. He returned elsewhere as a series of IPs (e.g. 98.155.21.76, 98.115.169.20 and 50.113.65.200), then in October as User:Formerly 98 he returned to Pharmaceutical industry and made the same edits, without making clear that he was a returning account. (These diffs are just examples.)
A similar thing happened at GlaxoSmithKline (GSK) in April 2015. As Formerly 98, he made a series of edits about Avandia, a diabetes drug that GSK had promoted for off-label use, which resulted in a large fine. His edits included adding unsourced material. I requested a source twice on talk. He stopped responding and appeared to stop editing the article. A month later, he had his user page deleted, changed his name to User:Renamed user 51g7z61hz5af2azs6k6 and stopped editing. But he continued with IPs and in November 2015 returned with several IPs to edit the same section of GSK.
He has now posted some of the IPs on his user page, but there are several missing. Pinging Vanjagenije and Xeno, who made the name change. SarahSV 05:13, 8 January 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

  •  Additional information needed. I'm putting this off-hold after discussing with Berean Hunter. @Elvey: We all agree (since the beginning) that all those IPs belong to the same person, and we don't need evidence for that. But, we need some convincing evidence (WP:diffs) of abusive socking. You made accusations of several kinds of abusive behavior ("avoid scrutiny, give the impression of more support for a position than actually exists, avoid sanctions, contribute to the same page or discussion in a way that suggests they are multiple people, ..."), but I don't see any evidence for those accusations. The two diffs you provided show this user leaving two comments on a talk page in a way so to make it obvious that he is the same user. In other words, this example clearly shows them not trying to suggest they are multiple people. Vanjagenije (talk) 22:50, 21 December 2015 (UTC)