Wikipedia:Sockpuppet investigations/Pitzzaboy/Archive

Pitzzaboy

Pitzzaboy (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

24 November 2021

Suspected sockpuppets

Fastestboii (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

DUCK sock based on username.

Requesting CU since I have a hunch that this user may be a sock of an LTA User:Meteorological Person. Both this user and MP have created [drafts https://en.wikipedia.org/w/index.php?title=Draft:Cyclone_Paddy&oldid=1056804706] [1] direct copied from the season article about tropical cyclones without attribution.

I have a hunch that this is. User:Pitzzaboy. Similar names, this IP user (who is presumed to be the same person) added this image uploaded by Pitzzaboy. Also, both users have issues regarding copyright, see Pitzzaboy's User_talk:Pitzzaboy#September_2021 talk page and this draft direct copied from the season article about tropical cyclones without attribution. Destroyeraa (Alternate account) 01:18, 24 November 2021 (UTC)[reply]

@Tamzin: I don't know if you saw my later addition - I have a hunch that this is a Pitzzaboy sock given the evidence posted above. Destroyeraa (Alternate account) 01:26, 24 November 2021 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

@Destroyeraa: There is no policy against abandoning one account in favor of a new one, and the username similarity suggests that there was no intention to evade scrutiny. As to whether they're an MP sock, the behavior you're referencing doesn't seem distinctive enough to justify a check. Lots of people violate attribution when creating drafts based on mainspace content, and the tropical cyclone topic area is known for having many users who engage in similar behavior to one another. Clerk declined. Closing without action. -- Tamzin^{[cetacean needed]} (she/they) 01:23, 24 November 2021 (UTC)[reply]
- @Destroyeraa: I had not seen your edits when I made the above comment. I think my reasoning regarding this being an MP sock also applies to this being a Pitzzaboy sock. If anything, the existence of two different sockmasters known to create drafts from season articles without attribution shows that this is not distinctive behavior of the sort that would justify a check. You're right that the edit by that one IP presents some evidence for that IP being a Pitzzaboy sock, but checkusers will not links IPs to usernames, and you haven't presented any evidence for why this IP is Fastestboi(i). I see that they both edited the Cyclone Paddy draft, but again, that isn't enough evidence of being the same person to justify a check. -- Tamzin^{[cetacean needed]} (she/they) 01:39, 24 November 2021 (UTC)[reply]

25 November 2021

Suspected sockpuppets

Fastestboi (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: original case name)
Pitzzaboy (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: original case name)

Fastestboii (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Behavioral evidence:

The suspected master and the suspect socks have two common interests: tropical cyclones and 2021 California wildfires. See this (Pitzzaboy) and Fastestboii. For tropical cyclones, both users have created drafts by copying within Wikipedia without attribution. See this (Pitzzaboy) and Fastestboi.

IPs

I suspect that this IP: 12.186.46.8 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) is also Pitzzaboy and Fastestboii. The IP contributed to Draft:Cyclone Paddy which was created by Fastestboi. Also, the IP added an image uploaded by Pitzzaboy. Finally, the suspected IP sock geolocates to the same area (LA, California) as 12.201.132.138 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) (geolocation), who was blocked by GeneralNotability as a Pitzzaboy sock. There is ample behavioral evidence provided above to connect this IP to Pitzzaboy and connect the suspected users as socks of Pitzzaboy.

I am requesting CU to provide technical evidence regarding the user accounts. Destroyeraa (Alternate account) 01:22, 25 November 2021 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Isn't Pitzzaboy the oldest account here? It clearly says that Pitzzaboy's account was created on August 7th of this year. --DarkMatterMan4500 (talk) (contribs) 00:34, 30 November 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

The evidence presented still falls just a bit short of what I'm willing to endorse on; as I said at Wikipedia:Sockpuppet investigations/Fastestboi/Archive, a certain amount of leeway has to be granted for the tendency toward very similar editing styles in this topic area. However, looking at the named accounts' contribs, I see similar ES style, including lots of typos, and this is a close enough typo to this that I'd like to know what CU has to say. Clerk endorsed with respect to the named accounts (although, as I found at the previous SPI, it seems almost certain that Fastestboi == Fastestboii, and there is not a policy violation there if there isn't also a previous block being evaded).
As to the IPs, three different services give me a combined six geolocations for them up and down the length of California, which I'm guessing has something to do with proxy use (they don't appear to be proxies themselves, but someone at both IPs uses the same proxy service). Fortunately we don't need to rely on geolocation here, as [2] [3] show a repeated typo that is characteristic enough to block on (ctrl+f here for comparison) . Awaiting administrative action: Please block 12.186.46.8 with expiry 72 hours (anon. only, account creation disabled). @Destroyeraa: If they return to that IP after that, please report to the blocking admin or AIV for a quick re-block. -- Tamzin^{[cetacean needed]} (she/they) 04:24, 26 November 2021 (UTC)[reply]
In progress - -- RoySmith (talk) 13:09, 26 November 2021 (UTC)[reply]
Pitzzaboy, Fastestboi, and Fastestboii are all confirmed to each other. -- RoySmith (talk) 13:14, 26 November 2021 (UTC)[reply]
PS, this needs to be merged with Wikipedia:Sockpuppet investigations/Fastestboi -- RoySmith (talk) 14:42, 26 November 2021 (UTC)[reply]
Thanks, Roy. Clerk assistance requested: Could an admin-clerk please merge the Fastestboi case into this one? Thanks. -- Tamzin^{[cetacean needed]} (she/they) 22:23, 26 November 2021 (UTC)[reply]
Cases merged as requested. Sir Sputnik (talk) 23:15, 28 November 2021 (UTC)[reply]
Moved back to older master. Sorry for any confusion. Closing. -- Tamzin^{[cetacean needed]} (she/they) 00:57, 30 November 2021 (UTC)[reply]

16 February 2022

Suspected sockpuppets

Sodaman32 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
2601:643:8300:A4B0:F8DB:E1B5:3609:13B9/64 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
24.23.163.220 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

The IP is self admitted [4] and has continued disruption in the exact same topic areas as their account, storms, floods, wildfires, elections.

Sodaman32 created Draft:2022 Florida Brushfires, which was declined as unsourced. Following that an IP editor from the self-admitted range showed up to add a source to it [5]. Also note the username similarity, "Soda Man" vs "pizza boy". 192.76.8.70 (talk) 23:24, 16 February 2022 (UTC)[reply]

24.23.163.220 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) Is also obviously them based on the recent edit war at 2021–22 North American winter. The IP geolocates to the same place as their self admitted IP range and showed up to join in an edit war with the edit summary "stop it User :MarioProtIV" followed by reinserting a change made by their now confirmed sock Muffinhea. The IP has also made edits like these [6] [7] 192.76.8.77 (talk) 20:29, 17 February 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

This case is being reviewed by Jack Frost as part of the clerk training process. Please allow him to process the entire case without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate.

Whilst the crossover with the self-admitted range and subject matter is pretty compelling, there's a couple of non-stale socks in the archive and I'd like confirmation this isn't a strange joe-job (I doubt it, but stranger things have happened). Clerk endorsed - For comparison of Sodaman32 to the accounts in the archive. --Jack Frost (talk) 07:10, 17 February 2022 (UTC)[reply]
In progress - -- RoySmith (talk) 19:32, 17 February 2022 (UTC)[reply]
Sodaman32 is Confirmed. Also, uptagging previously found Legensd (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) to Confirmed. No comment with respect to IP address(es) No sleepers immediately visible -- RoySmith (talk) 19:43, 17 February 2022 (UTC)[reply]
I spoke too soon about the lack of sleepers. Muffinhea (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) is Confirmed -- RoySmith (talk) 19:48, 17 February 2022 (UTC)[reply]
Moving this back to checked so somebody can look at the IP. -- RoySmith (talk) 19:50, 17 February 2022 (UTC)[reply]

@RoySmith: Did you not mean to block and tag Muffinhea?--Bbb23 (talk) 19:52, 17 February 2022 (UTC)[reply]
So many checkboxes, so few neurons :-) -- RoySmith (talk) 19:53, 17 February 2022 (UTC)[reply]

Clerk note: 24.23.163.220 is clearly them, as is the /64. Both have been recently active, and both have been static since at least July 2021. The IPv4 doesn't seem to be hopping when I check out to the /20, however the /64 is hopping across a /49 which has no collateral since July 2021. Therefore Awaiting administrative action - please anonblock 24.23.163.220 for 9 months and consider anonblocking 2601:643:8300:8000::/49 for the same period. Jack Frost (talk) 02:27, 19 February 2022 (UTC)[reply]
@Jack Frost If you're looking for clear evidence of block evasion, how about Special:Permalink/1058601900? -- RoySmith (talk) 15:25, 19 February 2022 (UTC)[reply]
@RoySmith: Ah, I see we're beyond ducks and well into ostrich territory now... --Jack Frost (talk) 00:58, 20 February 2022 (UTC)[reply]
I'm not too excited about blocking a /49, but I did block 2601:643:8300:A4B0::/64 and 2601:643:8300:AD50::/64 and we'll see how things progress from there. -- RoySmith (talk) 15:32, 19 February 2022 (UTC)[reply]

15 April 2022

Suspected sockpuppets

Mazum24 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: originally filed under this user)

Brishzombie (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Evidence is based partly on activity on the Commons, where the user has repeatedly made false copyright ownership claims on tornado-related images ([8]), similar to a previous sock I've dealt with, Flopbean (talk · contribs) [9] (note that several such files were deleted for copyright violation). This user has also started to edit war over images [10], [11], [12], which I understand is another pattern for this person. User has also been reported on the Commons here. TornadoLGS (talk) 02:51, 15 April 2022 (UTC)[reply]

They have also shown an interest in another sockmaster, User:Pitzzaboy. [13]. TornadoLGS (talk)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

@Mz7: Does that mean Pitzzaboy and Mazum24 could be the same? TornadoLGS (talk) 18:02, 19 April 2022 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

I blocked Brishzombie as a probable sock of Pitzzaboy given their comment here and overlap in editing interests. If there is a different finding as a result of this SPI then feel free to undo/amend my block as needed. firefly ( t · c ) 10:29, 16 April 2022 (UTC)[reply]
Brishzombie is Confirmed to the accounts confirmed in the most recent Pitzzaboy case at Wikipedia:Sockpuppet investigations/Pitzzaboy/Archive#16 February 2022 (i.e. Muffinhea, Sodaman32, Legensd). These accounts are Possible to Mazum24 based on historical information from CU wiki. Mz7 (talk) 07:14, 19 April 2022 (UTC)[reply]
@TornadoLGS: It’s certainly possible from a technical standpoint. It depends on how convincing we think the behavioral similarities are. I will defer to the next clerk or admin on that question. Mz7 (talk) 20:10, 19 April 2022 (UTC)[reply]
I moved this case to Pitzzaboy based on the CU and behavioural evidence (Mazum24 seems to be better at spelling and is more interested in hurricanes than tornadoes). Tagging as confirmed, will request lock. Closing. Thanks, Spicy (talk) 09:37, 23 April 2022 (UTC)[reply]

23 May 2022

Suspected sockpuppets

NoobJamie345 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Already blocked for disruptive editing and they'd set off sock radar earlier, but they just tagged their own Talk as a sock. Guessing it's a different LTA, but not sure there's a better place to file this for investigation. Star Mississippi 20:55, 23 May 2022 (UTC)[reply]

@Beeblebrox FYI that this is here since I just saw your revert. Star Mississippi 00:46, 24 May 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

Confirmed plus Soda4321 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). Blocked without tags per WP:DENY. I'm loath to tag here given how attention-seeking tagging one's own sock is. Closing. Mz7 (talk) 00:54, 25 May 2022 (UTC)[reply]
Global lock(s) requested. Mz7 (talk) 01:09, 25 May 2022 (UTC)[reply]

11 August 2022

Suspected sockpuppets

Cabin134 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Procedural request, user has tagged themselves as a sock in keeping with the previous MO. ~ Matthewrb ^{Talk to me · Changes I've made} 16:39, 11 August 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

CheckUser requested - to confirm and look for other accounts. Global locks should be requested after check is completed. Bbb23 (talk) 18:00, 11 August 2022 (UTC)[reply]
Confirmed, also Uganda knukles14. Will request locks. Girth Summit _(blether) 10:37, 13 August 2022 (UTC)[reply]

25 September 2022

Suspected sockpuppets

HiltonCalifornia (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: original case name)

Reversion history on a draft, Reversion history on the redirect of previous draft, reversion history of another monkeypox article, Edit contribution history matches dead on to Cabin314 (Pitzzaboy) with weather/monkeypox articles. 2-day old account should not have even know the draft linked first existed, let alone challenge a unanimous merge proposal a long time ago. Obvious Cabin314 (Pitzzaboy) behavior. Elijahandskip (talk) 14:05, 25 September 2022 (UTC)[reply]

Evidence Match:

2034 Winter Olympics#Bidding: (HiltonCalifornia - 4th edit on Wikipedia) | (Cabin134 - One of last edits on Wikipedia)
Reversion history on Draft:2022 monkeypox outbreak in Florida
Reversion history on the redirect of 2022 monkeypox outbreak in Florida

Update: Even more suspicious on this user after they uploaded a NY Times article image to Wikipedia commons and claimed it was their own. (In process to delete it, but that is the image). Elijahandskip (talk) 05:06, 27 September 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

Clerk assistance requested: - Please merge to WP:Sockpuppet investigations/Pitzzaboy. Thanks, Spicy (talk) 14:10, 25 September 2022 (UTC)[reply]
Confirmed. I'll move, look for other accounts, and block. Girth Summit _(blether) 05:34, 27 September 2022 (UTC)[reply]
ALso confirmed:
- Fiji145 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
That's all I see at the moment. Will request locks. Girth Summit _(blether) 05:40, 27 September 2022 (UTC)[reply]

25 May 2023

Suspected sockpuppets

CostcoantimationsS (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Tools: Editor interaction utility · Interaction Timeline · SPI Tools

WP:DUCK with matching editing interests. In Olympic and weather articles: 2024 Summer Olympics & Tornadoes of 2022 & Tornadoes of 2023. Matching the most recent 2 socks (HiltonCalifornia) & (Cabin134). Also trolling on both of the weather articles listed (adding false information), which they received 4 separate warnings for this month. Editing history says sock, so SPI was started rather than AIV. Elijahandskip (talk) 01:53, 25 May 2023 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

Confirmed - I'm just poking around to see if I can find any others. Girth Summit _(blether) 15:06, 31 May 2023 (UTC)[reply]
Don't see any others. Lock requested. Closing. Girth Summit _(blether) 15:09, 31 May 2023 (UTC)[reply]