Wikipedia:Sockpuppet investigations/Fangusu/Archive

Add links
From Wikipedia, the free encyclopedia

User:Fangusu[edit]

Fangusu (talk · contribs · deleted contribs · page moves · block user · block log)
Report date January 17 2009, 04:33 (UTC)[edit]
Suspected sockpuppets


Evidence submitted by Icarus3 (Talk)

Fangusu is an indefinitely blocked user with a long history of sockpuppetry (see Wikipedia:Requests for checkuser/Case/Fangusu, Category:Suspected Wikipedia sockpuppets of Fangusu, Category:Wikipedia sockpuppets of Fangusu). I am requesting a CheckUser both to verify these three socks, and to do a sweep for sleeper accounts, in line with previous checks for this user.

  • Contributions from ILovePeanutsAndVideoGames (shortened to "ILovePeanuts" in the rest of this report) show typical Fangusu pattern of undoing my reversions of a previous Fangusu sockpuppet's edits and editing pages on topics that are known Fangusu targets. See ILovePeanuts's first edit [1] and compare to nearly identical edit summary [2] and faux-warning [3] from other known sockpuppets when I undid edits by earlier sockpuppets (I can give more than a dozen additional examples of a new sock undoing a reversion I - or sometimes another editor - did of an older sock's edit, if anyone wants more evidence that this is one of Fangusu's characteristic patterns). The other articles ILovePeanuts edited were mostly to articles another sock edited in the past ([4] undoes my undo of [5], [6] undoes Wknight94's undo of [7]) or otherwise related to an article or subject known to interest Fangusu ([8] shows edit to article edited by Fangusu and a sock [9][10], interest in Spyro and Crash Bandicoot [11] reflected in earlier sock's username [12])


  • TigerSharksFan has only edited on the same days and around the same times as ILovePeanuts, with no overlaping time periods. Shortly after I submitted a CheckUser request against ILovePeanuts [13] (I'm making this report now since making that report revealed the protocol change), TigerSharksFan suddenly took an interest in the Fangusu case despite claiming to not know who Fangusu is (and despite the improbability of a completely unrelated user finding no less desiring to get involved in the report) [14]. TigerSharksFan also took a sudden, inexplicable interest in getting on the good sides of myself [15] and Wknight94 [16] (an admin who has also been involved in this case, for instance, as a blocking admin for many previous socks: [17][18][19][20] and more). TigerSharksFan also pleaded [21] for Fangusu to be given another chance in a manner very similar to Fangusu's previous pleas [22][23]. The plea is very emotional for someone claiming no connection to or prior knowledge of Fangusu.


  • 59.183.41.81 begins with 59.183, as do all of Fangusu's known IPsocks. It has, as of when I'm writing this, edited only two articles, both ones ILovePeanuts was involved with. [24] is to the same article as [25], and [26] redirects an article to one created by ILovePeanuts [27].

--Icarus (Hi!) 04:33, 17 January 2009 (UTC)[reply]


Comments by accused parties    See Defending yourself against claims.


Comments by other users


CheckUser requests
Checkuser request – code letter: E (Community ban/sanction evasion )
Current status – Completed: Reviewed by a Checkuser, results and comments are below. Xclamation point 04:34, 17 January 2009 (UTC)    Requested by --Icarus (Hi!) 04:33, 17 January 2009 (UTC) [reply]


Clerk, patrolling admin and checkuser comments


Conclusions
This case has been marked as closed. It has been archived automatically. 
-- lucasbfr talk 09:20, 17 January 2009 (UTC)[reply]



Report date March 8 2009, 19:19 (UTC)[edit]
Suspected sockpuppets



Evidence submitted by --Icarus (Hi!)

Fangusu is an indefinitely blocked user with a long history of sockpuppetry under literally dozens of usernames and IP addresses (see Wikipedia:Requests for checkuser/Case/Fangusu, Category:Suspected Wikipedia sockpuppets of Fangusu, Category:Wikipedia sockpuppets of Fangusu). I am requesting a CheckUser both to verify this sock, and to do a sweep for sleeper accounts, in line with previous checks for this user.

The IP addresses may not require any action, but I consider their involvement to be at very least part of the evidence, as will be demonstrated by noting that all Fangusu IP addresses have started with 59.183, and their involvement with Enco1984's editing patterns. I include them both to keep the record as complete as possible, and to hopefully provide evidence that an IP range block is still necessary. Fangusu will assuredly continue to create sockpuppets, but they will be easier to track down if they all have names.

The following evidence has led me to strongly suspect that Enco1984 is the same user:

  • Account created 2 weeks after the most recent sockpuppet investigation banned previous socks (see archive link at the top of this case)
  • User soon started re-doing edits originally done by earlier Fangusu socks, across a variety of otherwise unrelated articles:
    • [28] redoes [29], and 59.183.21.147 also did the same edit [30] and has the same 59.183 IP as previous Fangusu IPsocks
    • [31] redoes [32]
    • [33] redoes [34] (regarding the tense, not the pluralization)
  • User has also edited other specific articles that previous Fangusu sockpuppets had taken a strong interest in. I will use previous sockpuppet usernames as evidence where appropriate. There are a lot of socks and edits to wade through, so if this is adequate I'd love to spare myself the time and effort. If the admin who handles this feels it is necessary, however, I will dig through the socks' histories for diffs (there are many cases where another sock edited the same articles, too, but didn't have such a clearly relevant username).
  • IPs:
    • Enco1984 was clearly working with 59.183.40.35 (with no overlapping edits, in a manner strongly suggesting the same person as all edits seem to be related to the effort to create a new article with the removed material) in this history (see edits from 00:21, 23 February 2009 through 01:04, 23 February 2009). The IP starts with the exact same 59.183 that all Fangusu IPSocks do, and previous Fangusu socks have also taken an interest in this article (for example [41]). A day later, 59.183.12.243 also edits this article [42].
    • 59.183.6.178 begins with 59.183 like all Fangusu IPsocks and edits [43], an article recently edited by Enco1984 [44]
    • 59.183.16.6 vandalizes [45], which Enco1984 puts an inappropriate speedy deletion template on next day [46]
    • 59.183.27.131 edited the same article as Enco1984, a couple of hours later [47] and [48], which Enco1984 had edited the previous day [49], and [50], which a previous Fangusu sock has edited in the past [51]
    • 59.183.15.246 and 59.183.6.139 have both been editing (and the 59.183.15.246 was temporarily blocked for edit warring on) Spyro-related articles during the time Enco has been active, doing similar edits (compare Enco: [52] to 59.183.6.139: [53]
  • There is other evidence as well, such as certain characteristic Fangusu patterns found in the actual edits in addition to simply the sorts of articles targeted. I can dig down into the nitty-gritty of it if necessary, but I think I've made my case pretty clearly by now.

--Icarus (Hi!) 19:19, 8 March 2009 (UTC)[reply]

Comments by accused parties    See Defending yourself against claims.
Comments by other users


CheckUser requests
Checkuser request – code letter: E (Community ban/sanction evasion )
Current status – Completed: Reviewed by a Checkuser, results and comments are below.    Requested by --Icarus (Hi!) 19:19, 8 March 2009 (UTC) [reply]



Clerk, patrolling admin and checkuser comments

I've checked Fangusu a few times, previously; from a purely technical standpoint, Enco1984 is active on the same range. – Luna Santin (talk) 19:30, 8 March 2009 (UTC)[reply]

 Clerk endorsed For a possible review, and to see if range is busy. Synergy 21:56, 8 March 2009 (UTC)[reply]

Conclusions
This case has been marked as closed. It has been archived automatically.

13 August 2015[edit]

Suspected sockpuppets


Zapp Brannigan: [54], [55] (revert stating "leave me alone", along with a threat, after reverting Fangusu's edit), [56] (basically same comment by Fangusu after revert)
DigiDestined: [57], [58]
Doom II RPG: [59], [60]

The IP and Fangusu seem to edit the same articles. Similar articles besides the ones listed in the diffs above include Duke Nukem (character), The Genie Family, and Temporary tattoo. As provided in the diffs above for Zapp Brannigan, the IP threatened me (referring to the previous edit as their own, which was actually Fangusu's), and then Fangusu followed with basically the same threat. (I'm not requesting CheckUser since this seems like a WP:DUCK.) Steel1943 (talk) 17:07, 13 August 2015 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Please close this case now, Steel1943. You are ruining my reputation. Also, I am not evil. Fangusu (talk) 22:03, 16 August 2015 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Clerk note: @Fangusu: Do you admit using this IP for logged-out editing? Vanjagenije (talk) 00:25, 17 August 2015 (UTC)[reply]
    • Yes. Yes I do. Could you please close this? I am not inherently evil, OK? Fangusu (talk) 02:29, 17 August 2015 (UTC)[reply]
  •  Clerk note: @MaxSem: This user was indeffed because of the sockpuppeting. You unblocked him, but he is obviously socking again ([61][62],[63][64],[65][66]). What shall we do here? Vanjagenije (talk) 07:56, 17 August 2015 (UTC)[reply]
Um, what do you want from me, to forever be the point of contact for everything that happens to this user? I'm not convinced that this is a clear-cut case of malicious sockpuppetry to warrant shooting on sight, so feel free to start an ANI discussion on that. Max Semenik (talk) 19:00, 17 August 2015 (UTC)[reply]

26 November 2015[edit]

Suspected sockpuppets


Per this editor's SPI investigation archive, this IP is a WP:DUCK WP:SOCK of Fangusu. This editor thinks that their idea of "useful edits" supersedes their consensus-established site ban, and thus socks with IPs. This IP's entire contribution list proves this; for some proof, here's some edits on Undergarment: [67] [68] (latter IP blocked as sock of Fangusu), and Zapp Brannigan [69] [70]. Steel1943 (talk) 02:20, 26 November 2015 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I honestly consider these edits potentially useful. This is why I want you to leave them alone and overlook my negative qualities altogether. The usefulness of edits is more important than who they are coming from. Please try and get this policy changed. 24.237.109.124 (talk) 02:47, 26 November 2015 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

18 December 2015[edit]

Suspected sockpuppets


Edit performed by the IP in this report ([71]) essentially matches the description of another edit on the same page, reverting the same information ([72]); the IP in the latter edit has already been blocked as a sock of Fangusu, as shown in the archives. On that page, Total Drama: Revenge of the Island, the latter IP (the already-blocked Fangusu sock) reverted reverts of that information they added several times in a few minutes. Steel1943 (talk) 18:56, 18 December 2015 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  • IP blocked two weeks for block evasion per behavioral evidence. Closing case for now. Mark Arsten (talk) 01:00, 19 December 2015 (UTC)[reply]

22 December 2015[edit]

Suspected sockpuppets


Per this edit ([73]), this IP is clearly a sock of Fangusu. Per the sockpuppet master's SPI archives, sockmaster edits articles such as the one referenced in the diff, and in one way or another, reveals it blatantly obvious that they are using the IP to avoid their site ban. (Or, in this case, the IP asked to be unblocked, basically admitting that they are a sock of another editor.) Steel1943 (talk) 03:58, 22 December 2015 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

23 December 2015[edit]

Suspected sockpuppets


During the apparently never ending quest of Fangusu to continuously IP-hop to add edits to the articles which they were editing previously instead of adhering to the advice on their talk page to get unblocked/unbanned, apparently, yet another IP that Fangusu has started using has come out of the woodwork. Prior to Fangusu being banned from the English Wikipedia, one of the articles that they "frequented" to add edits was Undergarment, as seen in this series of three edits. Afterwards, an IP sock of Fangusu performed an edit ([74]) which I subsequently reverted ([75]). A few minutes ago, I received a notification that the latter revert was reverted by an IP editor, the one referenced in this report, even though the edit notice created by the IP did not reflect this ([76]). The common verbiage used in edit notices by Fangusu during such reverts is a "Why was/is this..." type of edit notice, and the aforementioned edit notice meets that bill. Also, after I started writing this report, the same IP performed another edit on Undergarment ([77]), which was a reinstatement of a change that another IP sock of Fangusu made ([78]) which I later reverted ([79]). Steel1943 (talk) 21:40, 23 December 2015 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • Also, it is probably worth noting that this is the 2nd IP that Fangusu has used in the "208.54.39.###" IP range, both with the 4th quadrant being higher than "128". Possible dynamic IP lease renewal with the same device or a different device in the same network. Steel1943 (talk) 21:50, 23 December 2015 (UTC)[reply]
  • Mark Arsten (or any other admin or SPI clerk), unless the investigation for a rangeblock is going to happen, would you be able to close this case? I'm not 100% sure what the procedure is for SPIs, but ... I think I may have discovered a sock of Fangusu's that is a registered account (first time I've ever seen this), and I'm not clear on whether I should add it to this investigation, or start a new one. Steel1943 (talk) 23:02, 29 December 2015 (UTC)[reply]
  • I see now. The next case should be created soon. Steel1943 (talk) 23:07, 29 December 2015 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • I have semi-protected Undergarment for three months due to the sockpuppetry. A range block might be possible here, but I'll have to leave that decision to an admin who knows more about range blocking. Mark Arsten (talk) 22:15, 23 December 2015 (UTC)[reply]
  • I wouldn't advise a rangeblock here. It would probably be ineffective and would cause too much collateral damage. ​—DoRD (talk)​ 22:28, 4 January 2016 (UTC)[reply]


30 December 2015[edit]

Suspected sockpuppets


Well, this is a first for Fangusu this year if proven true (using a registered account) but it seems like this has been going on for a while. I suspect that DJ Autagirl is a sockpuppet of Fangusu. (If this is a sock of Fangusu, I'm a bit shocked since this account'a first edit was prior to Fangusu having their 7-year block lifted, as well as being prior to their site ban.) The two editors have edited several of the same articles, and in most cases, reinforced the same additions to the articles (which I will provide evidence here in a moment.)

The reinstated edit that set me off to this account possible being a sock of Fangusu is re reinstatement of adding "camisole" to Undergarment (group of edits by Fangusu sock vs. DJ Autagirl). Then, I started looking at other articles that their edits have in common, including:

  1. Zapp Brannigan (Fangusu & Fangusu sock vs. DJ Autagirl)
  2. DJ Autagirl recreating several Digimon-related pages that Fangusu nominated for deletion, but creating them as redirects, including:
    1. List of Digimon Adventure V-Tamer 01 characters (AfD)
    2. List of Digimon Data Squad characters (AfD)
    3. List of Digimon Frontier characters (AfD)
    4. DigiDestined (AfD)
  3. Interest in articles related to Doom (series), including Marine (Doom) (recent contribution list on Marine (Doom) where both editors are present)
  4. A habit of merging (blanking) entire articles and converting them into redirects without merging anything or enough, and prior to consensus or against consensus, including:
    1. DJ Autagirl on Marine (Doom) - reverted
    2. Fangusu on Temporary tattoo (reverted by me soon after)
    3. DJ Autagirl on List of Spyro characters - reverted
    4. Fangusu on Doom II RPG (reverted by me soon after)
  5. I also noticed that Fangusu nominated List of Invader Zim characters for deletion (AfD), and DJ Autagirl recently edited that page (edit).

Since this is the first time I have seen Fangusu use a possible registered-account sockpuppet, I am requesting a CheckUser check for this case since the last one for Fangusu (if any) would have been done over 7 years ago and DJ Autagirl's first edits were in 2013, though I am not sure how useful this will be since Fangusu has proven to IP-hop to/from ranges that are completely unrelated to each other. Steel1943 (talk) 00:04, 30 December 2015 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Clerk endorsed Endorsing check per Steel's evidence. Mark Arsten (talk) 00:59, 30 December 2015 (UTC)[reply]
  •  Confirmed. ​—DoRD (talk)​ 22:28, 4 January 2016 (UTC)[reply]


05 January 2016[edit]

Suspected sockpuppets


Restoring edits made by now-blocked sock User:DJ Autagirl, for example [80] and [81]. (Compare with [82] and [83] by DJ Autagirl.) Edit summaries admit that this is a sock. Meters (talk) 02:32, 5 January 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

06 January 2016[edit]

Suspected sockpuppets


WP:DUCK sock of Fangusu per its edit notices on recent edits on Toe socks and Talk:Spyro (series). Both pages have WP:RFPP requests as targets for anon socks. Steel1943 (talk) 22:36, 6 January 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • The IP seems to have been blocked for 31 hours by HighInBC. The protection requests are still pending an answer. Steel1943 (talk) 22:42, 6 January 2016 (UTC)[reply]
  • Block for evasion based on this edit summary: [84]. Not sure who it is other than that they claim to be banned. HighInBC 22:56, 6 January 2016 (UTC)[reply]
  • Has anyone made a toe-sock-puppet joke yet? Drmies (talk) 18:21, 8 January 2016 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • I've declined the RFPP request. The pages haven't been edited for months except for the IP, which has been blocked. I'd only recommend semi-protection if it persists. Mike V • Talk 00:38, 7 January 2016 (UTC)[reply]

22 January 2016[edit]

Suspected sockpuppets


Quack.

  • Requesting restoration of reverted edits made by a previous sock of Fangusu. [85], [86]
  • Returns to articles just off protection from last batch of Fangusu socks to make same edits. [87] [88] [89] and [90] [91] Meters (talk) 23:25, 22 January 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

02 February 2016[edit]

Suspected sockpuppets

More IPs in the 134.154.x.x and 172.56.x.x range battling over "original research" in Melissa Duck ([92], [93], [94], [95]) and hounding myself and User:Steel1943 across multiple pages ([96], [97], [98], [99]). Ivanvector 🍁 (talk) 18:33, 2 February 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • @Ivanvector: As much as I appreciate this report given all of my personal dealings with this site banned editor, what exactly are you trying to accomplish here? This sockpuppet master, to my knowledge, uses only IPs (with the exception of DJ Autagirl which has since been blocked.) The only useful action that could be accomplished against this editor is an IP rangeblock, but the IPs that the editor uses vary so greatly that an IP rangeblock (or multiple ones, in this case) would be so difficult to calculate that collateral damage against unrelated editors would be inevitable. Steel1943 (talk) 22:31, 2 February 2016 (UTC)[reply]
So that there's a record of their ongoing abuse. I know we probably can't do anything about it in terms of technical actions, but say they come back with the main account six months from now (or today) and make a standard offer unblock request. Anyone can check this page for a record of all of the times that they've violated the ban in the meantime, and quickly declining the request will be uncontroversial. Perhaps this should be an WP:LTA, and if there's agreement that that's a better course of action then I'll consider doing that instead. Ivanvector 🍁 (talk) 15:21, 3 February 2016 (UTC)[reply]
@Ivanvector: Fair enough. I started doing something similar by "mentioning" IPs they were using on User talk:Fangusu, but their persistent daily socking with usually brand new IPs made me a bit tired of doing so after doing so with just 1 IP. And yeah, that edit you referenced on my talk page ... agreed, this editor has been informed multiple times on their main talk page what to do, and seems to act oblivious on the start of each new day of being told anything regarding how to properly request their ban lifted. I seriously think WP:LTA may be in order at this point as well; if that doesn't work, I may run for WP:RFA just to be able to have access to the "block" and "protect" functions since I seem to be the primary first responder to this sockmaster, and I believe that action needs to be taken on the spot at any time this editor violates their ban. I think it took about 2 hours once for action to be taken against this editor's IP socking, and by that time, they had already managed to reinstate about 5 of their edits multiple times. (Seriously, I wish I wasn't serious about thinking about undergoing an WP:RFA for this reason alone.) Steel1943 (talk) 15:40, 3 February 2016 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

10 February 2016[edit]

Suspected sockpuppets


I noticed that a new-ish editor started performing edits on Undergarment, which seems to be a common pattern with Fangusu's previous edits (series of edits by Fangusu sock vs DodingBeast). Then, I noticed that the series of edits that DodingBeast performed to become auto confirmed seem very similar to the subjects that Fangusu (and/or related socks) has edited in the past, including pages relating to Futurama (DodingBeast on Teenage Mutant Leela's Hurdles vs almost half of the most recent edits on Zapp Brannigan performed by Fangusu and/or socks), and nominating anime-related pages for deletion (Wikipedia:Articles for deletion/Editing of anime in American distribution (2nd nomination) (DodingBeast) vs Wikipedia:Articles for deletion/List of Digimon Fusion characters (Fangusu)). And lastly, I find it quite interesting that a new user has a rather good understanding of how to edit Wikipedia in less than 50 edits. Anyways, I'm requesting CheckUser, but I'm not sure how much it would help since most of DodingBeast's recent edits are tagged as mobile edits. Steel1943 (talk) 18:16, 10 February 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

 Confirmed, blocked, and tagged.  No sleepers immediately visible. Closing.--Bbb23 (talk) 20:30, 10 February 2016 (UTC)[reply]

16 February 2016[edit]

Suspected sockpuppets

Restoring ([100], [101]) previously reverted edits ([102]) to Teenage Mutant Leela's Hurdles, one of Fangusu's favourite targets. Account created three days after the previous sock was banned. Ivanvector 🍁 (talk) 15:54, 16 February 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Please believe me on this matter. I have no idea where Emizangel came from. I did not create that account. Regards, Fangusu 172.58.33.83 (talk) 15:57, 16 February 2016 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

Blocked and tagged based on behavior. CU not needed. Closing.--Bbb23 (talk) 16:10, 16 February 2016 (UTC)[reply]

16 February 2016[edit]

Suspected sockpuppets

WP:DUCK: IP admits sockpuppetry: [103]. Separate nomination so as not to confuse with CheckUser, although I think that's moot. Ivanvector 🍁 (talk) 16:02, 16 February 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

Blocked 72 hours. Closing.--Bbb23 (talk) 16:11, 16 February 2016 (UTC)[reply]

24 February 2016[edit]

Suspected sockpuppets


Quack. I don't normally bother with the many IPs of this banned user, but this IP is a multiple reoffender. Back from a 2 month block evasion block (the fourth one) and immediately back to one of Fangusu's favourite articles, Camisole [104] and a similar article [105] Compare with [106] and [107] by two previously blcoked Fangusu socks. This typical Fangusu behaviour. Meters (talk) 04:51, 24 February 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]


24 February 2016[edit]

Suspected sockpuppets

Another admitted IP sock. "Could you please make an exception?" in edit summary: [108], [109] and appeals to users she's appealed to previously: [110], [111]. Worth noting that this IP has been used within the last two months by a user who does not appear to be a Fangusu sock; probably dynamic.

Admins, is there a better/faster/lighterweight process for flagging and blocking these IPs? Ivanvector 🍁 (talk) 15:53, 24 February 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • @KrakatoaKatie: Agreed about this probably being a dynamic IP. The only static IP I suspect that Fangusu uses is 69.42.15.3 (the IP used in the previous report.) I suspect that all other IPs are mobile devices whereas the static IP is probably a home computer. Steel1943 (talk) 17:48, 24 February 2016 (UTC)[reply]
I did a bit of checking myself, and I agree. She might also be using a VPN, some of her IPs geolocate to ... far-off lands, let's say. Ivanvector 🍁 (talk) 17:54, 24 February 2016 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

 Blocked but awaiting tags I think this is a dynamic IP too, but I blocked for two weeks. Not sure tagging would be worth it. Katietalk 16:45, 24 February 2016 (UTC)[reply]

No need for tagging. Closing the case. Vanjagenije (talk) 20:00, 24 February 2016 (UTC)[reply]


25 February 2016[edit]

Suspected sockpuppets

WP:DUCK: reverting to restore previously blocked socks' unblock appeals ([112], [113]). Ivanvector 🍁 (talk) 15:55, 25 February 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

 IP blocked Three months. Not tagged yet - AIV is backed up. Seriously considering semi-protecting this page as she's reverted it a few times now. Katietalk 19:39, 25 February 2016 (UTC)[reply]

No tagging needed. Closing the case. Vanjagenije (talk) 00:10, 26 February 2016 (UTC)[reply]

02 March 2016[edit]

Suspected sockpuppets

User continues the same editing pattern as other blocked users/IPs. Had removed requests for page protect for Talk:Yoga pants at WP:RFPP as well. RickinBaltimore (talk) 15:26, 2 March 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

03 March 2016[edit]

Suspected sockpuppets

Unblock request on my user page ([114]). Ivanvector 🍁 (talk) 04:08, 3 March 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

06 March 2016[edit]

Suspected sockpuppets

Guess who. [115] Ivanvector 🍁 (talk) 17:57, 6 March 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

24 March 2016[edit]

Suspected sockpuppets

[116] - created a user page containing only a request to unblock Fangusu. Textbook WP:DUCK. Ivanvector 🍁 (talk) 16:30, 24 March 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • @HighInBC: no, there's no need for an investigation at all. We can't do a rangeblock that will catch all of her IPs apparently, so every few days when she shows up on a new one and admin assistance is needed to block her, I've been told repeatedly that this is the place to report. She admits it's her each and every time, but we don't have an lightweight, AIV-like "report obvious sockpuppets" noticeboard. Ivanvector 🍁 (talk) 17:04, 24 March 2016 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

I have blocked the IP for block evasion and they have been directed to UTRS. I don't see much need in an investigation. HighInBC 16:35, 24 March 2016 (UTC)[reply]

29 March 2016[edit]

Suspected sockpuppets

Some people say that ham is best at Easter, but I think you'll find that WP:DUCK is much nicer. Ivanvector 🍁 (talk) 20:41, 29 March 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • On a related note, I just added 2 pages to my watchlist. Steel1943 (talk) 21:39, 29 March 2016 (UTC)[reply]
  • @Ivanvector and Meters: Looking back at these pages, I'm shocked that you were able to discover these socks since I looked through the histories and could not find proof that any of Fangusu's accounts edited these pages. How did you two figure this out? I though I had a strong Fangusu-sock-finding nose, but wow. (I mean, these are totally WP:DUCKs now since Fangusu admitted it. Anyways, if you care to share, beware WP:BEANS.) Steel1943 (talk) 21:46, 29 March 2016 (UTC)[reply]
Apologies, I thought this was obvious from the IPs involved so I didn't bother elaborating. Semiprotected edit requests in my watchlist catch my attention because they're often simple to respond to and there's always a backlog. 134.154.38.62's first (and only) edit was requesting an edit which happened to be a restoration of an edit by one of Fangusu's previous admitted socks ([117]) with her usual ban appeal in the edit summary. The IP also matches a range which Fangusu frequents. I was watching the page, either because of a previous edit request, or more likely because she had disrupted it enough in the past for it to earn semiprotection. It was clearly ban evasion, so I reverted. She managed to swap IPs after that, and the second IP reverted my edit only two minutes later. At that point it didn't matter whether the second IP was her or not, it was restoring her edits, so I reverted again, but the IP was close enough that I also reverted the other edits it had made today (on Indian chess, which wasn't on my watchlist before and I think is a new article for her). Later, the second IP admitted to being Fangusu by creating an IP talk page with an unblock request (her fifth this week) but that page has been deleted. I don't think WP:BEANS applies here: Fangusu has shown a pattern of not paying attention to any information we give her, and none of this info is particularly special. Ivanvector 🍁 (talk) 04:19, 30 March 2016 (UTC)[reply]
Yeah, even with their lack of taking advice from others, ya never know when the WP:BEAN will get cha. Anyways, I may be passing on my Fangusu-sock sensor to you soon; I've been at this for almost a year now, and things really haven't changed (except for several pages related to them now bring semi-protected.) Steel1943 (talk) 15:02, 30 March 2016 (UTC)[reply]
Sorry, I didn't reply because I thought that was sarcasm at bothering to list obvious socks. Meters (talk) 20:52, 30 March 2016 (UTC)[reply]
@Meters: Yeah, surprisingly enough, I was serious. I still wouldn't have realized these were socks unless Fangusu admitted it after a revert. I must be getting a bit rusty at this. Steel1943 (talk) 21:46, 30 March 2016 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • The IPs are either range-blocked or stale. Closing. Bbb23 (talk) 23:40, 19 April 2016 (UTC)[reply]

04 May 2016[edit]

Suspected sockpuppets

After a decent period without socking in which we might have thought that Fangusu was finally getting the message, she has returned to reverting her old sock edits on her usual articles. This IP was blocked as her sock previously, see contribs for evidence. Ivanvector 🍁 (talk) 21:31, 4 May 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  • I probably shouldn't, but I'm self-closing. IP already blocked. Ivanvector 🍁 (talk) 21:33, 4 May 2016 (UTC)[reply]

19 May 2016[edit]

Suspected sockpuppets


Quack. Latest batch of IP socks. Geolocates to California again. Characteristic interests... girls, breasts, training bras. Compare, for example, [118]and [119] by Fangusu (the original user account, not a sock) with [120] and [121] by the IPs. The same edit and a nearly identical edit summary. Also note the characteristic pleading to an editor reverting her as a Fangusu sock [122] to allow edits to stand [123] Meters (talk) 17:32, 19 May 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  • information Administrator note Sure enough. Blocked both IPs and closing up. Favonian (talk) 17:44, 19 May 2016 (UTC)[reply]

10 June 2016[edit]

Suspected sockpuppets[edit]

Restoring previous socks' edits on Camisole and Amar Chitra Katha: previous sock, new IP. Ivanvector 🍁 (talk) 16:50, 10 June 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Admin assistance needed: this user hops IPs frequently; their previous IPs have been blocked anywhere from 24 hours up to three months, but I don't think a block of any more than a few days is worthwhile. Let's say block for 48 hours. Ivanvector 🍁 (talk) 16:55, 10 June 2016 (UTC)[reply]
  • Blocked and the pages are now protected. Case closed. Vanjagenije (talk) 22:22, 11 June 2016 (UTC)[reply]

21 September 2016[edit]

Suspected sockpuppets[edit]

Continuing to request the same edit at Talk:Toe socks after having admitted to being Fangusu's sock just two days ago. Ivanvector (Talk/Edits) 21:30, 21 September 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

Pink clock Awaiting administrative action: this user has a knack for both IP-hopping and waiting out blocks to redo edits, but this IP does not seem to be dynamic. Please block for one month. Ivanvector (Talk/Edits) 21:32, 21 September 2016 (UTC)[reply]

29 September 2016[edit]

Suspected sockpuppets[edit]


Seems to be a WP:DUCK per behavioral evidence. What set me off was this editor reverting an anon (probably also Fangusu) blanking Wikipedia:Long-term abuse/Fangusu and then reverting their revert, re-blanking the page. Per this account's contribution page, since its first edit in March 2016, it has edited several of Fangusu's (and her socks') usually-edited articles such as Doomguy (1), Jazz Jackrabbit (2), Honey Bunny (3), and articles regarding women's clothing such as Boyshorts (4) and Backless dress (5). Steel1943 (talk) 03:57, 29 September 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • I was going to say the same as Vanjagenije, it should be possible given this sockmaster's history to make some kind of judgement based on IP address alone, even if there's nothing useful in the log. But even if not, the IP that first blanked the LTA page is from one of Fangusu's usual ranges, and this new account reverted that only 8 minutes later. It's a pretty loud quacking. Note also that Fangusu has been found to be incubating sleepers in the past. Ivanvector (Talk/Edits) 13:16, 29 September 2016 (UTC)[reply]
  • "SteelKalu", eh? Interesting, considering umm ... my account name. Steel1943 (talk) 16:09, 29 September 2016 (UTC)[reply]
And, for the record, SteelKalu edited Pantalettes (1), Panties (2) and Doomguy (3), some of Fangusu's usual editing grounds. Steel1943 (talk) 16:41, 29 September 2016 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

02 October 2016[edit]

Suspected sockpuppets[edit]

Restoring previously blocked sock User:SteelKalu's edits and appealing their block in edit summaries. Ivanvector (Talk/Edits) 19:26, 2 October 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

Pink clock Awaiting administrative action: this IP is outside her usual range, but she has used it before. Please block for one month. Ivanvector (Talk/Edits) 19:27, 2 October 2016 (UTC)[reply]

05 October 2016[edit]

Suspected sockpuppets[edit]

WP:DUCK. Here's the confession by the IP. Steel1943 (talk) 16:47, 5 October 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • Comment: Per the IP's block log, the IP may need to be blocked for a few days since it seems this IP is recently exclusive to Fangusu. Steel1943 (talk) 17:18, 5 October 2016 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Straight out of the old block and into the new, longer, one. Closing. Favonian (talk) 17:33, 5 October 2016 (UTC)[reply]


05 October 2016[edit]

Suspected sockpuppets[edit]

WP:DUCK. Edit restores an edit by previously-blocked IP address (see this SPI's archives) and addressing me by name (part of Fangusu's behavior, sometimes addressing editor who she reverts directly in edit notice.) Steel1943 (talk) 23:28, 5 October 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I added another one. Same behavior, continuing same reverts. As the French say, coin-coin! Grayfell (talk) 05:26, 6 October 2016 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

 Clerk note: clearly her, but all IPs stale; closing. See you next time. Ivanvector (Talk/Edits) 22:27, 6 October 2016 (UTC)[reply]

18 October 2016[edit]

Suspected sockpuppets[edit]

Restoring her persistent edit request at Talk:Teenage Mutant Leela's Hurdles, again. I normally don't bother with Fangusu's IPs any more since she's never going to get through a ban appeal given her 8-year socking history, but she's been using this IP consistently throughout October so action is warranted. Ivanvector (Talk/Edits) 17:09, 18 October 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

Pink clock Awaiting administrative action: please block for 1 week. That ought to cover Fangusu's next impulse to edit. Ivanvector (Talk/Edits) 17:10, 18 October 2016 (UTC)[reply]

information Administrator note Made it a month in view of the edit history. Closing. Favonian (talk) 17:11, 18 October 2016 (UTC)[reply]

21 October 2016[edit]

Suspected sockpuppets[edit]

See previous case in Fangusu's SPI archive. Same situation, and obvious WP:DUCK. Steel1943 (talk) 16:54, 21 October 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

 Sounds like a duck quacking into a megaphone to me. Please block 72 hours. Ivanvector (Talk/Edits) 16:58, 21 October 2016 (UTC)[reply]

  •  Done. Marking as closed. Mkdwtalk 03:37, 22 October 2016 (UTC)[reply]

27 October 2016[edit]

Suspected sockpuppets[edit]

Need a block on Fangusu's most recent IP. Same IP as was spamming edit requests at Talk:Teenage Mutant Leela's Hurdles before it was protected. Now she's just moved on to different articles in her set of regular targets. Ivanvector (Talk/Edits) 01:44, 27 October 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

Pink clock Awaiting administrative action: please block 72 hours. Ivanvector (Talk/Edits) 01:44, 27 October 2016 (UTC)[reply]

  • information Administrator note Blocked as per request. Marking as closed. Mkdwtalk 01:56, 27 October 2016 (UTC) Mkdwtalk 01:56, 27 October 2016 (UTC)[reply]

27 October 2016[edit]

Suspected sockpuppets[edit]

Fangusu quacking again. Ivanvector (Talk/Edits) 17:56, 27 October 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Pink clock Awaiting administrative action: please block 31 hours. If someone is willing, a rangeblock on 134.154.255.0/24 would be appreciated. Ivanvector (Talk/Edits) 17:58, 27 October 2016 (UTC)[reply]
Range blocked for a month. Closing. Favonian (talk) 18:13, 27 October 2016 (UTC)[reply]

05 November 2016[edit]

Suspected sockpuppets[edit]

New user editing a Final Fight article, one of Fangusu's known areas of interest, edit warring in Fangusu's usual style of mass-reverting until a page is protected (1 2 3, protected) and then waiting for protection to expire before reverting again (same revert after protection expires). Also editing Fangusu's LTA, as previous socks have done. Ivanvector (Talk/Edits) 02:30, 5 November 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Self-endorsed by clerk for checkuser attention per above. Ivanvector (Talk/Edits) 02:43, 5 November 2016 (UTC)[reply]
  •  Confirmed. No sleepers detected. Mike V • Talk 02:46, 5 November 2016 (UTC)[reply]

23 November 2016[edit]

Suspected sockpuppets[edit]

WP:DUCK. Editor restored edits performed by another one of Fangusu's socks. (1). (See Fangusu's LTA report for more details if more clarification is needed.) Steel1943 (talk) 00:39, 23 November 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

 Sounds like a duck quacking into a megaphone to me - textbook Fangusu. Why aren't you letting this edit stick? Ivanvector (Talk/Edits) 00:59, 23 November 2016 (UTC)[reply]

27 November 2016[edit]

Suspected sockpuppets[edit]

WP:DUCK, per recent edits. Per the IP's edit history, Fangusu has also used this IP in the past few days before it was blocked. Steel1943 (talk) 20:14, 27 November 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Blocked for two weeks without talk page privileges. Closing. Favonian (talk) 20:17, 27 November 2016 (UTC)[reply]

05 December 2016[edit]

Suspected sockpuppets[edit]

[124] [125] WP:DUCK Sro23 (talk) 17:56, 5 December 2016 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

27 January 2017[edit]

Suspected sockpuppets[edit]

WP:DUCK. Reinstating another Fangusu sock's edit by "undo"ing one of mine. See this edit. Steel1943 (talk) 06:48, 27 January 2017 (UTC)[reply]

Also, the first two quadrants of the IP look like other IPs Fangusu has used in the past. Steel1943 (talk) 06:49, 27 January 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  • IP hasn't edited anymore, closing. GABgab 14:58, 28 January 2017 (UTC)[reply]

15 February 2017[edit]

Suspected sockpuppets[edit]

WP:DUCK. IP reverted an edit I had reverted of another one of Fangusu's socks a while back, and seems to meet the identity of Fangusu per their LTA with their edits on Sweater girl. In addition, the IP is in the range of Fangusu's recent socks. Steel1943 (talk) 07:40, 15 February 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Clerk note: Fangusu's range 134.154.0.0/18 blocked for 72 hours. Ivanvector (Talk/Edits) 12:51, 15 February 2017 (UTC)[reply]

17 February 2017[edit]

Suspected sockpuppets[edit]

Above IP is the most recent IP caught, but below is a large table of IPs. I used Twinkle to initiate the SPI for convenience-sake.

I've been following a set of vandal IPs for a few weeks now and I've come to the conclusion they are Fangusu. Their behavior did not match what I new of Fangusu from the LTA page, but the overlap is too great to be mere coincidence. Below is a partial copy-paste of my "investigation" from User:EvergreenFir/socks#Southwest.

Habit: Changes end date of TV shows to "present". Example edits: [126], [127], [128], [129], [130], [131], [132], [133], [134], [135]. Frequently targets Kid vs. Kat, El Tigre: The Adventures of Manny Rivera, Hi Hi Puffy AmiYumi, Franklin (TV series), and Bobby's World. Also add incorrect channels to the infobox (e.g., [136]).

Range: 172.56.30.*; 172.56.31.*, 208.54.39.*

ISP: T-Mobile USA (Wireless Broadband)

Connection to Fangusu - The 208.54.39.* range seem to have been used by Fangusu (e.g., restoring Fangusu sock edits ([137]), filing ANIs about Fangusu blocks ([138]), asking for unblocks in edit summaries ([139]0, and being blocked for block evasion ([140], [141], [142], [143]). Perhaps clearest link between Fangusu (known in part for for edits on underwear) and the cartoon vandalism are these reverts by 172.58.17.158 ([144], [145], [146], [147], [148], [149]) and edit history of Special:Contributions/172.58.25.2. Steel1943 put an suspected sock notice ([150]) on a 208.54.39.221's talk page. I just reverted that user for triggering the abuse filter ([151], [152]).

User also seems to target Univision and Telemundo pages, but that pattern of vandalism is not documented here. See 172.58.25.80 (talk · contribs · WHOIS) and 172.58.25.85 (talk · contribs · WHOIS) for clear link.

Edit filter made by MusikAnimal to detect this vandal. See this archived discussion.

Table of IPs, dates, edits, geolocation, and other notes in chronological order
IP address Date Number edits Geolocation Notes
172.56.31.52 (talk · contribs · WHOIS) 13-14 March & 23 December 2016 19 La Puente, CA
172.58.25.229 (talk · contribs · WHOIS) 16 March 2016 3 San Bernardino, CA T-Mobile ISP
172.58.25.85 (talk · contribs · WHOIS) 18-19 April 2016 11 San Bernardino, CA
172.56.31.153 (talk · contribs · WHOIS) 21-22 April 2016 9 La Puente, CA
172.58.25.80 (talk · contribs · WHOIS) 22-25 April 2016 14 San Bernardino, CA T-Mobile ISP
172.56.31.161 (talk · contribs · WHOIS) 15 May 2016 7 La Puente, CA
208.54.39.227 (talk · contribs · WHOIS) 14-15 July & 26 October 2016 13 La Puente, CA T-Mobile ISP; Blocked on 15:55, 27 October 2016 by JamesBWatson for 3 months for "Long-term persistent disruptive editing, using a number of IP addresses, and evading blocks on individual IP addresses."
172.56.30.0 (talk · contribs · WHOIS) 31 July 2016 8 Whittier, CA
172.56.30.90 (talk · contribs · WHOIS) 1 August 2016 8 Whittier, CA
172.56.30.70 (talk · contribs · WHOIS) 2 August 2016 12 Whittier, CA
208.54.39.175 (talk · contribs · WHOIS) 4 August 2016 2 La Puente, CA T-Mobile ISP
208.54.39.250 (talk · contribs · WHOIS) 13 August 2016 4 La Puente, CA T-Mobile ISP
172.56.30.17 (talk · contribs · WHOIS) 15 August 2016 6 Whittier, CA
172.56.31.185 (talk · contribs · WHOIS) 21 August 2016 2 Monterey Park, CA
208.54.39.188 (talk · contribs · WHOIS) 23 August 2016 2 Monterey Park, CA T-Mobile ISP; Editing 2 days after above IP on same page ([153])
172.56.31.228 (talk · contribs · WHOIS) 13 September 2016 1 La Puente, CA
172.56.31.205 (talk · contribs · WHOIS) 30 September 2016 11 La Puente, CA
172.56.30.76 (talk · contribs · WHOIS) 8 October 2016 8 Whittier, CA
172.56.31.173 (talk · contribs · WHOIS) 9 October 2016 2 La Puente, CA
172.56.31.124 (talk · contribs · WHOIS) 16 October 2016 5 La Puente, CA
172.56.31.43 (talk · contribs · WHOIS) 16-17 October 2016 4 La Puente, CA
172.56.31.151 (talk · contribs · WHOIS) 17 October 2016 3 Bakersfield, CA
172.56.31.47 (talk · contribs · WHOIS) 17-18 October 2016 9 La Puente, CA
172.56.30.193 (talk · contribs · WHOIS) 19-20 October 2016 10 Whittier, CA
172.56.30.12 (talk · contribs · WHOIS) 21-22 October 2016 17 Whittier, CA
208.54.39.252 (talk · contribs · WHOIS) 22 October 2016 5 La Puente, CA T-Mobile ISP; Blocked on 15:56, 27 October 2016 by JamesBWatson for 3 months for "{{Anonblock}}"
208.54.39.195 (talk · contribs · WHOIS) 25 October 2016 1 La Puente, CA T-Mobile ISP; Blocked on 15:55, 27 October 2016 by JamesBWatson for 3 months for "Long-term persistent disruptive editing, using a number of IP addresses, and evading blocks on individual IP addresses."
208.54.39.210 (talk · contribs · WHOIS) 27 October 2016 5 La Puente, CA T-Mobile ISP; Blocked on 15:54, 27 October 2016 by JamesBWatson for 3 months for "Long-term persistent disruptive editing, using a number of IP addresses, and evading blocks on individual IP addresses."
172.56.30.184 (talk · contribs · WHOIS) 28-29 October 2016 22 Whittier, CA
172.56.30.148 (talk · contribs · WHOIS) 4-5 November 2016 9 Whittier, CA
172.56.30.150 (talk · contribs · WHOIS) 5 November 2016 13 Whittier, CA
172.56.30.139 (talk · contribs · WHOIS) 6 November 2016 1 Whittier, CA IP formerly used by Fangusu. Evidence for this sock is [154]
172.56.30.234 (talk · contribs · WHOIS) 9 November 2016 5 Whittier, CA
208.54.39.196 (talk · contribs · WHOIS) 12 November 2016 10 La Puente, CA T-Mobile ISP; Blocked on 21:38, 12 November 2016 by Widr for 31 hours
208.54.39.211 (talk · contribs · WHOIS) 18 November 2016 1 La Puente, CA T-Mobile ISP
208.54.39.169 (talk · contribs · WHOIS) 21-22 November 2016 9 La Puente, CA T-Mobile ISP; Blocked on 14:08, 22 November 2016 by Jauerback for 31 hours
208.54.39.226 (talk · contribs · WHOIS) 24 November 2016 9 La Puente, CA T-Mobile ISP
208.54.39.152 (talk · contribs · WHOIS) 27-28 November 2016 7 La Puente, CA T-Mobile ISP
208.54.39.190 (talk · contribs · WHOIS) 13 December 2016 4 La Puente, CA T-Mobile ISP
172.56.30.97 (talk · contribs · WHOIS) 20 December 2016 4 Whittier, CA
172.56.31.194 (talk · contribs · WHOIS) 21-22 December 2016 10 La Puente, CA
172.56.31.114 (talk · contribs · WHOIS) 22-23 December 2016 24 La Puente, CA
208.54.39.223 (talk · contribs · WHOIS) 24 December 2016 4 La Puente, CA T-Mobile ISP; Blocked on 21:48, 24 December 2016 by Widr for 1 week for "Disruption, multiple IPs".
172.56.30.173 (talk · contribs · WHOIS) 26 December 2016 3 Whittier, CA
172.56.31.26 (talk · contribs · WHOIS) 26 December 2016 1 La Puente, CA
172.56.31.126 (talk · contribs · WHOIS) 26 December 2016 3 La Puente, CA
172.56.31.5 (talk · contribs · WHOIS) 27 December 2016 6 La Puente, CA
208.54.39.157 (talk · contribs · WHOIS) 28 December 2016 3 Los Angeles, CA T-Mobile ISP
172.56.30.65 (talk · contribs · WHOIS) 28 December 2016 2 Mission Viejo, CA
172.56.31.48 (talk · contribs · WHOIS) 29 December 2016 4 La Puente, CA
172.56.31.145 (talk · contribs · WHOIS) 29 December 2016 2 La Puente, CA
172.56.31.187 (talk · contribs · WHOIS) 30 December 2016 1 La Puente, CA
172.56.30.214 (talk · contribs · WHOIS) 30 December 2016 2 Whittier, CA
208.114.121.18 (talk · contribs · WHOIS) 31 December 2016 - 2 January 2017 25 Miami, FL Same behavior ([155])
208.54.39.183 (talk · contribs · WHOIS) 7 January 2017 1 La Puente, CA T-Mobile ISP
172.56.31.164 (talk · contribs · WHOIS) 8 January 2017 1 La Puente, CA
172.56.31.35 (talk · contribs · WHOIS) 10-11 January 2017 12 La Puente, CA
172.56.31.73 (talk · contribs · WHOIS) 11-12 January 2017 6 La Puente, CA
172.56.31.138 (talk · contribs · WHOIS) 12 January 2017 3 La Puente, CA
208.54.39.246 (talk · contribs · WHOIS) 14-15 January 2017 6 La Puente, CA T-Mobile ISP
172.56.30.129 (talk · contribs · WHOIS) 15 January 2017 4 Whittier, CA
172.56.31.255 (talk · contribs · WHOIS) 19-21 January 2017 24 La Puente, CA
172.56.30.229 (talk · contribs · WHOIS) 22 January 2017 7 Whittier, CA
172.56.31.122 (talk · contribs · WHOIS) 22 January 2017 2 La Puente, CA
172.56.30.219 (talk · contribs · WHOIS) 23 January 2017 1 Whittier, CA [156]
172.56.31.180 (talk · contribs · WHOIS) 23 January 2017 1 La Puente, CA
172.56.30.34 (talk · contribs · WHOIS) 24 January 2017 5 Whittier, CA
208.54.39.187 (talk · contribs · WHOIS) 26 January 2017 3 La Puente, CA T-Mobile ISP; Previously blocked as Fangusu ([157])
208.54.39.173 (talk · contribs · WHOIS) 27-28 January 2017 4 Los Angeles, CA T-Mobile ISP
172.56.31.184 (talk · contribs · WHOIS) 31 January 2017 9 La Puente, CA
74.2.222.197 (talk · contribs · WHOIS) 4 February 2017 2 Irvine, CA Different IP (static IP from MegaPath Corporation). Same behavior on frequently-targeted pages and geographically close to others.
172.56.30.90 (talk · contribs · WHOIS) 5 February 2017 13 Whittier, CA
172.56.30.174 (talk · contribs · WHOIS) 5 February 2017 5 Whittier, CA
172.56.31.157 (talk · contribs · WHOIS) 5 February 2017 3 La Puente, CA
208.54.39.199 (talk · contribs · WHOIS) 6-7 February 2017 7 Los Angeles, CA Targeting same pages as IPs in the 172.54.* range. Blocked by MusikAnimal for long term abuse.
172.56.30.51 (talk · contribs · WHOIS) 8 February 2017 3 Whittier, CA Blocked by MusikAnimal for 31 hours for long term abuse
172.56.31.31 (talk · contribs · WHOIS) 10 February 2017 8 Monterey Park, CA Blocked on 15:10, 10 February 2017 by JamesBWatson for 6 months for "Vandalism, edit-warring, and block-evasion, on a number of articles, by one person, over a very long period."
172.56.30.127 (talk · contribs · WHOIS) 11 February 2017 4 El Monte, CA Blocked on 23:01, 11 February 2017 by Widr for 31 hours
172.115.88.188 (talk · contribs · WHOIS) 11-12 February 2017 18 Upland, CA Blocked on 01:32, 13 February 2017 by Ad Orientem for 1 week
172.56.30.14 (talk · contribs · WHOIS) 13 February 2017 1 El Monte, CA Blocked on 20:18, 13 February 2017 by Widr for 31 hours
208.54.39.192 (talk · contribs · WHOIS) 14 February 2017 1 Bell Gardens, CA Targeting same pages as IPs in the 172.54.* range. Same subnet as vandal from 6-7 February.
172.56.31.240 (talk · contribs · WHOIS) 16 February 2017 6 Mission Viejo, CA T-Mobile ISP. Static IP?
172.56.31.110 (talk · contribs · WHOIS) 16-17 February 2017 27 Monterey Park, CA T-Mobile ISP; Blocked on 05:34, 17 February 2017 by Oshwah for 31 hours
208.54.39.221 (talk · contribs · WHOIS) 17 February 2017 2 La Puente, CA

tl;dr - The overlap of the IP ranges used by Fangusu and the person doing these "present" vandalism edits is significant. It seems unlikely that 3 IP ranges known to be used by Fangusu are also being used to do this vandalism. Requesting possible confirmation or analysis by admin(s). Would be interested in pursuing rangeblocks as well (but that might need to be done at ANI?)

Thank you! EvergreenFir (talk) 17:38, 17 February 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Clerk note: 100% Fangusu. Nuisance edits to cartoon articles, redoing old reverted edits, begging to be unblocked. I blocked 134.154.0.0/18 a couple days ago because of her, but it looks like we can get a bit more specific based on this activity. 172.56.30.0/23 and 208.54.39.128/25 blocked for 1 month. Ivanvector (Talk/Edits) 18:16, 17 February 2017 (UTC)[reply]

04 March 2017[edit]

Suspected sockpuppets[edit]

[158] Long-term, static IP Sro23 (talk) 15:13, 4 March 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

24 March 2017[edit]

Suspected sockpuppets[edit]

Seems to be an obvious sock. The editor has already only performed edits in the last 24 hours, and two of them set off my "sock" radar: edit related to Final Fight on Cody (Final Fight), and a specific thing that Fangusu does to my edits that I may consider adding to the LTA: performing an undo of reverts I performed on an edit of a Fangusu sock, but not including the auto-generated "undo" text: aforementioned edit on Category:Fictional adoptees ... compared to the previous edit ... by me. Also, there's this edit related to Street Fighter, another common Fangusu field of editing per their LTA report. Steel1943 (talk) 02:35, 24 March 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Also, @Steel1943: I personally haven't ever seen Fangusu perform a revert without the automatic revert text being included, but if that is a thing that she does (or a new thing) then yeah that should go in the LTA. Ivanvector (Talk/Edits) 13:41, 24 March 2017 (UTC)[reply]
  • @Ivanvector: Fangusu ... when I dealt with this ages ago in 2015 ... created quite a few redirects. But, of course, most, if not all, of them have been deleted since. I would imagine that some examples have to be present in the SPA archives. But yes, Fangusu constantly performs undos (using the "undo" function) without the auto-generated "undo" text to my edits quite frequently; in fact, I wold say that 98%, if not 100%, of the time, Fangusu does just that. But, unfortunately, only I can confirm that since I get a notification that an editor I have never heard of before undid one of my edits ... that just happens to be a revert of an edit Fangusu did ... and the editor's undo has the auto-generated undo text removed. But yeah, I noticed the unrelated edits as well ... but the "undo" issue/habit I stated above has convinced ... at least me ... that this account is a WP:DUCK. Steel1943 (talk) 14:58, 24 March 2017 (UTC)[reply]
    In fact, if you want to go way back in time ... back to my first report of Fangusu ... Wikipedia:Sockpuppet investigations/Fangusu/Archive#13 August 2015 ... the edits I cited where Fangusu told me to boil my head, those were performed by Fangusu using "undo" as I was notified those edits had been performed, but Fangusu didn't include the auto-generated undo text ... and she's been doing that with socks ever since. Steel1943 (talk) 15:27, 24 March 2017 (UTC)[reply]
  • Also, this is not the first time that Fangusu has attempted to constantly change information on a category page: see Category:Final Fight. I also note that whenever Fangusu uses an account rather than an IP, she will not perform edit wars with edits that happen in quick succession. With accounts, the edit war is considerably slower to a point where it is quite a ways away from meeting WP:3RR. And, for these who are familiar with Fangusu, compare almost any group of edits performed by her as an IP to those made by a logged-in account (with the exception of User:Fangusu itself): the IP edits made by her assume a bit of a WP:BATTLEGROUND mentality, whereas logged-in accounts will almost never respond to any inquiries, will not acknowledge almost any notification on their talk page, and will actually go out of their way to not interact with anyone ... as is what happened with User:DJ Autagirl. Steel1943 (talk) 15:43, 24 March 2017 (UTC)[reply]
Just a side note, I originally didn't place a note on this user's talk page for some reason that I don't remember ... but probably because I thought its WP:DUCK-iness wasn't going to be in doubt, but then who I also consider a bit of a strong "Fangusu historian" had some doubts. Anyways, I placed the required notice on their talk page. Steel1943 (talk) 15:51, 24 March 2017 (UTC)[reply]
  • ...And now, I just discovered that this account performed an edit on a clothing article. The article isn't specific to women's clothing (per the LTA), but still, too many coincidences. Steel1943 (talk) 16:09, 24 March 2017 (UTC)[reply]
  • @Ivanvector: This account just started editing Jazz Jackrabbit... Steel1943 (talk) 18:32, 24 March 2017 (UTC)[reply]
    Checkuser needed Given the fact that there seems to now be definite proof that this account is Fangusu due to the Jazz Jackrabbit editing, I'm now requesting Checkuser to see if there are any sleeper accounts. Steel1943 (talk) 18:39, 24 March 2017 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • CU confirmed, blocked. I'll leave the paperwork for you all. Drmies (talk) 18:43, 24 March 2017 (UTC)[reply]
Seems as though all the forms are correctly filed. Ivanvector (Talk/Edits) 23:26, 24 March 2017 (UTC)[reply]

08 April 2017[edit]

Suspected sockpuppets[edit]


Vanjagenije (talk) 17:47, 8 April 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

This user is already blocked by Drmies. Drmies asked me to "ask another CU to look at the various IPs" (See [159]). Vanjagenije (talk) 17:47, 8 April 2017 (UTC)[reply]

  • Thanks Vanjagenije. Yes, it's the possible overlap with that other account that I need someone else to look at--and I didn't have time to file this paperwork. Drmies (talk) 17:55, 8 April 2017 (UTC)[reply]
  • Not sure what is meant by "that other account", but I looked at the range block issue, and I'm done. Closing.--Bbb23 (talk) 21:19, 8 April 2017 (UTC)[reply]

17 April 2017[edit]

Suspected sockpuppets[edit]

Suspicious account has a consistent history of adding unsourced content to pages and topics known to be frequented by Fangusu, including classic and modern Looney Tunes, Johnny Bravo, Earthworm Jim, Sonic the Hedgehog, Street Fighter, and Jazz Jackrabbit (see Fangusu's LTA for frequented topics). This account has also been warned repeatedly about adding unsourced content and has never responded other than to redo their unsourced edits after being reverted. Requesting CheckUser to confirm. Ivanvector (Talk/Edits) 23:54, 17 April 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

9 April 2018[edit]

Suspected sockpuppets[edit]

After a long apparent absence, Fangusu has returned. Filing for information. See the IPs' edit history from the past couple days, or the edit history of Teenage Mutant Leela's Hurdles. Ivanvector (Talk/Edits) 12:52, 9 April 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

23 January 2019[edit]

Suspected sockpuppets[edit]

Saw someone using that IP in the -unblock IRC channel today, claiming to be Fangusu. Both the IP itself and the behaviour seem to be in line with Fangusu's past appearances. Huon (talk) 18:19, 23 January 2019 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

IP blocked. SPI filed solely for bookkeeping purposes. Huon (talk) 18:19, 23 January 2019 (UTC)[reply]

Yeah that's Fangusu, or a very sophisticated joe-job. Ivanvector (Talk/Edits) 18:51, 23 January 2019 (UTC)[reply]

22 January 2020[edit]

Suspected sockpuppets[edit]

First IP reversions on USS Callister. Second IP only edits to revert the ban reverts of the first IPs edits. Both blocked and this is just for filling. Dreamy Jazz 🎷 talk to me | my contributions 23:10, 22 January 2020 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

Blocked both IPs for ban evasion. Dreamy Jazz 🎷 talk to me | my contributions 23:10, 22 January 2020 (UTC)[reply]

20 February 2020[edit]

Suspected sockpuppets[edit]

See below Dreamy Jazz 🎷 talk to me | my contributions 03:09, 20 February 2020 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

Ongoing ban evasion by this LTA on this range recently. I have applied a 3 month range block to the named IP range. The range itself is very quiet (all edits for the last 4 months have been this LTA). For filing only. Dreamy Jazz 🎷 talk to me | my contributions 03:09, 20 February 2020 (UTC)[reply]

02 July 2023[edit]

Suspected sockpuppets[edit]

See findings, below. Yamla (talk) 17:14, 2 July 2023 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

While reviewing a WP:UTRS unblock request for an IP address range (privacy reasons prohibit me from linking to that here), purportedly for Fangusu, I ran a checkuser. This  Confirmed 81blazko92 to Fangusu. A subsequent email to me from 81blazko92 removed any possible doubt. --Yamla (talk) 17:14, 2 July 2023 (UTC)[reply]

Since it's already blocked and tagged, I'm closing this case. Courcelles (talk) 20:43, 5 July 2023 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Fangusu/Archive&oldid=1163629845"