TonyBallioni (talk | contribs) |
TonyBallioni (talk | contribs) |
||
Line 93: | Line 93: | ||
====<big>Clerk, CheckUser, and/or patrolling admin comments</big>==== |
====<big>Clerk, CheckUser, and/or patrolling admin comments</big>==== |
||
*On a proxy, which is consistent with past accounts that were likely Icewhiz. Also using a similar device but that’s very common so not much on its own. {{behav}}. [[User:TonyBallioni|TonyBallioni]] ([[User talk:TonyBallioni|talk]]) 13:31, 24 April 2020 (UTC) |
*On a proxy, which is consistent with past accounts that were likely Icewhiz. Also using a similar device but that’s very common so not much on its own. {{behav}}. [[User:TonyBallioni|TonyBallioni]] ([[User talk:TonyBallioni|talk]]) 13:31, 24 April 2020 (UTC) |
||
**{{u|François Robere}}, your comments here are not helpful and |
**{{u|François Robere}}, your comments here are not helpful and your arguing with others here does nothing to help clerks and patrolling admins. Please don’t use SPI as a venue for continuing content area disputes. Continuing to do this may result in you being asked to refrain from commenting at SPI. [[User:TonyBallioni|TonyBallioni]] ([[User talk:TonyBallioni|talk]]) 05:03, 30 April 2020 (UTC) |
||
* Muddymuck is also {{inconclusive}} because they are using a different VPN. {{behav}}. [[User:Reaper Eternal|Reaper Eternal]] ([[User talk:Reaper Eternal|talk]]) 14:38, 27 April 2020 (UTC) |
* Muddymuck is also {{inconclusive}} because they are using a different VPN. {{behav}}. [[User:Reaper Eternal|Reaper Eternal]] ([[User talk:Reaper Eternal|talk]]) 14:38, 27 April 2020 (UTC) |
||
Revision as of 05:04, 30 April 2020
Icewhiz
- Icewhiz (talk · · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
24 April 2020
– A checkuser has completed a check on relevant users in this case, and it is now awaiting administration and close.
Suspected sockpuppets
- Pestilence Unchained (talk · · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Muddymuck (talk · · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Fireslow (talk · · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.
I don't go out of my way to look for Icewhiz socks, but few hours ago I had a run in with a new account that looks mighty suspicious. Short version of this report: recent account (Feb'20) that is a very quick learner of the wiki-ways, 100% of edits are innocent and SPA about coronavirus... then today it suddenly jumped into an obscure Polish history topic with fringe antisemitism arguments. Effectively looks like a sleeper account which build up credibility with a bunch of simple edits / comments and now is revealing its "true colors". Here is the more in-depth analysis with diffs:
- 1st Feb 2020: account created. In his first few edits on the talk page he "doesn't know" how to WP:SIGN but...
- 4th Feb 2020: first red flag: he pings an editor. He would not do it again later - I think this was an accident, too much knowledge shown, that didn't fit the 'I am a n00b learning the ropes' pattern
- he makes few dozen of innocent minor edits and simple talk page comments, nothing too time consuming, all minor stuff.
- late MArch: he clicks through Wikipedia:Adventure. The account then lies dormant for a month (might be worth checking if this coincides with wide range blocks affecting known Israel VPNs which are likely related to a bunch of his previously reported sock going offline)
- 31st March: comes back and now he now signs his talk properly. Good job retaining the WP:ADV skills from a month ago that he never had the opportunity to put in practice :>
- same day: he correctly formats a vote in a RM and indents it using a *: [1]
- same day: he posts in a WikiProject talk discussion, indenting it with a : [2]. As someone who has taught many new editors through educational and outreach initiatives, I know that it is very rare for a new editor to even know about WikiProjects, much less to engage in talk page discussions or such. Or RM votes...
- April 11: now he discovers template talk namespace [3], another strange place for a new editor to stumble upon. Oh, and he uses the wiki-term stub. Another slip.
- same day: he also knowns how to link to a subsection of a talk discussion: [4]
- April 24: [5] proper formatting of an EL in a discussion
- same day: comments in another WikiProject talk discussion: [6]
- same day: [7] He adds controversial content (but it is referenced, I believe this is the first time he made such an extensive edit and used references). Also uses the blockquote template, another advanced skill.
- here is where the plot thickens further: I revert him (no undo, just edit old version). A new account with no history of revert warring or such, new to a topic area, would likely take several days before checking... but our 'genius n00bie' knows this is not how things work here. He reverts back within an our, I revert him the second time and mention BRD, and he reverts back within two minutes [8] and posts on talk [9] within another two minutes. Even through I didn't link WP:BRD in my edit summary, he knows what is expected - engage in discussion, another sign of experience (or intuitive wiki genius...?). As he is reverted once again by another editor this time, our young genius 'evolves' again, [10] this time not reverting, no, he wouldn't want to get to 3RR, right? Instead he adds another controversial claim to the article, as well as, lo and behold, {{POV}} just like Icewhiz - diff/[11] and {{unreliable sources}}
- then I got to file this report per WP:DUCK :) Extremely unlikely to be a new account and fits patterns of previous likely socks of Icewhiz.
- (update) next day: he dodges the question how he arrived at this topic, he however dredges a diff from... 2005, suggesting advanced wiki skills (I am not even sure what tool you need to find such obscure piece of info in an archival history of someone's userpage!). [12]. In the next edit he uses {{quote}} properly.
- [13] Makes a comment at a Good Article discussion (that requires more clicking through than normal talk page, and even noticing such a review is in progress).
- From that day he finally tries to 'diversify' his edits, making edits to several WWII-related topics.
Do note that it just takes him a few edits to learn a new advanced trick. Having taught hundreds of students, well, if he is not a sock he is a rare wiki genius. Anyway, the above shows that 1) he is not a new editor but 2) he is trying to pretend he is. Through of course we can AGF and assume he is a rare 1% genius but... the problem is why this editor, interested solely in cornavirus (where he build up his edit count with minor edits and short talk comments) suddenly becomes interested in a niche Polish history topic? And how he discovers that there is a recent discussion (inside a Good Article review too boot) related to antisemitism (which is a major area of interest to Icewhiz's)? The odds of a new editor stumbling into such an esoteric area are abysmally low. Further, this account fits the pattern of other suspicious accounts reported here which I'll note I was told, privately by several Checkusers, are very likely Icewhiz but due to privacy reasons (or because they don't want to publicly disagree with another CU) they cannot admit it here: all created recently, making few dozens of minor 'good' edits in short spurts lasting a day or so with several days of break in between (alternating with another sock account, possibly?) before suddenly veering into a topic area that Icewhiz was interested in. All also stopped editing shortly after being reported here (burned...?) or after being hit by a wide range block covering Isreal's VPNs. How much WP:DUCK coincidences we need before someone will say openly those are likely Icewhiz socks? For what it is worth, I had spend dozens of hours before he got his indef talking to him and became familiar with his pattern of edits, and what topics I can expect him to appear, and what kind of edits/arguments he will make. This is classic Icewhiz, adding UNDUE claims about subject's antisemitism. Evidence of this being a common pattern in his edits can be seen at Wikipedia:Arbitration/Requests/Case/Antisemitism_in_Poland/Evidence#WP:BLPVIO, Wikipedia:Arbitration/Requests/Case/Antisemitism_in_Poland/Evidence#Anti-Polish_POV_of_Icewhiz, both of those sections discuss a number of edits similar to the diff above. But also since a direct diff is often good rather than a list of them, consider [14]: Icewhiz adds claims of antisemitism to another biography of Kot's contemporary (WWII-era) Polish person; note similar reference style too. Similar topic, similar POV, similar wiki editing skills. Again, this is not an exception, see linked ArbCom sections. Also, one more interesting match: in [15] PU cites a book by Zimmerman; Icewhiz was well aware of that book and cited in on numerous occasions: [16], [17], [18], [19], [20]. What are the odds, eh? Oh, and to dig this hole deeper, in [21] he references an article by Polonsky, another scholar Ice cited and extensively used in the past: [22], [23], [24], [25], [26] and edited his bio [27]... So to be clear: not only PU jumps into a new topic area making edits fitting Icewhiz POV and modus operandi, he also uses virtually the same sources (Polonsky, Zimmerman - those are not household names; they are academic authors only people with a deep interest in this topic area would know; I want to stress that as someone who cites them myself in this context I can think only of a dozen of so Wikipedians who are familiar with this niche literature...).
Also please note, Icewhiz, just like PU, didn't use citation templates much in references, he formatted them manually. Compare [28]/[29] (I) to [30]/[31] (PU, note similar manual style of noting page ranges). Through this can be easily changed, I fully expect the next sock to use automatic citations... still, it's telling PU knows he needs to provide page ranges, and despite learning a lot of advanced wiki skills. has not surpassed Icewhiz when it comes to mediocre formatting of references.
Lastly, I will inform several other editors familiar with Icewhiz pattern of edits and ask them to comment here, so let's see if others familiar with that editor will think I am over-reacting, or am I right about the behavioral pattern discussed here.--Piotr Konieczny aka Prokonsul Piotrus| reply here 12:58, 24 April 2020 (UTC) Piotr Konieczny aka Prokonsul Piotrus| reply here 12:58, 24 April 2020 (UTC)
Comments by other users
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
This is also obviously the same person as the one behind this account User:Muddymuck. Note the peculiar overlap in interests (edits on the Coronavirus pandemic [32] [33] + Icewhiz style interest in Eastern Europe, same as this Pestilence account) and also the “fake bad English” comments and edit summaries that skip words like “have” or use wrong tense “I rearranged” “I remove” (despite using pristine articulate English, big words and all, elsewhere [34]. Pestilence has done the same thing (as have other Icewhiz socks) [35] (and elsewhere) and for articulate English see their user page [36]. It’s the same person behind both accounts. Volunteer Marek 08:22, 26 April 2020 (UTC)
- But what is the connection to Icewhiz of all those account except interest in Polish topics and having opposite POV?--Shrike (talk) 09:25, 26 April 2020 (UTC)
- Muddymuck is not that clear yet, I don't see a "smoking gun", so I wouldn't report it (yet). Worth monitoring further though. But for PU, I explained things above in quite a lot of detail. Obviously a sock (too quick of a learner), same POV and inexplicable interest in fringe topics combined with knowledge of the same obscure academic sources make it very likely - 99% or such. As I said, as someone active in this topic are and familiar with editors and their POV, and editing patters, I can only think of 2-3 other people, over the period of 10+ years, who would fit this pattern. And Icewiz is the only one who got banned... and he demonstrated willingness to create socks like this before, numerous times (see earlier reports here). Editing beind a proxy is a very bad sign and consistent with previous reports, too. PS.I think it is clear that his strategy is to create semi-SPAs (like AstuteRed) editing topics he is interested in (one for LBGT issues, one for Poland, probably there are others for US politics, Isreali-Palestinian topics, and such, plus 'other in training'. Interest in Covid can be random false flag to throw us off and to build edit count (note that all of those edits are 'fast', nothing complicated - just racking up edit count with simple edits/comments), just like other socks played with some random topic ideas or simple patterns. Or just like you noted, Covid is popular, maybe he really is interested in it. You can never prove behavioral stuff at 100%, not unless you expect one of them to admit it :) --Piotr Konieczny aka Prokonsul Piotrus| reply here 01:58, 27 April 2020 (UTC)
And we have another one [37], this time trying to claim Polish government was tied to German Final Solution[38]...before the war even started. Very similar to Icewhiz behaviour and claims.--MyMoloboaccount (talk) 12:26, 28 April 2020 (UTC)
- I added it to the list above, it is suspicious but like with Muddymuck, too few edits to for me to call it as obvious as in the case of the PU account. Could be a sock of Janj9088 instead? --Piotr Konieczny aka Prokonsul Piotrus| reply here 14:26, 28 April 2020 (UTC)
Comments by Shrike
I did some research in those accounts Fist of all Covid is issue number one in the wold today so its only natural that many users will edit those articles
- Muddymuck (who have almost not edited covid at all) - [39] - supports removal of leakage from Wuhan lab.
- Pestilence Unchained (who seems to be focused on covid , other pandemics, and death) - [40]- think that the Wuhan lab is mostly known for the covid leakage conspiracy.
- So they have opposing POV about Covid. Hard to find much else as they edit totally different topics.
- The editing times of MuddyMuck (11:00-16:00 UTC) and Pestilence Unchained (02:00-10:00 UTC) are totally different.
About older reports of alleged socks
- AstuteRed - wp:SPA on LGBT issues.
- JoeZ451 - mostly edited Ukraine, local Kansas, conflict between Ukraine/Poland, and the Ukrainian Orthodox Church. Appears to have a devout Christian of Ukrainian background - its difficult to see how they connected to icewhiz --Shrike (talk) 19:23, 26 April 2020 (UTC)
- Regarding 1 and 2, that is incorrect. The comments by Pestilence and Muddymuck are NOT contradictory. In fact they are both vague "not enough information" statements. Muddymuck says "It is a plausible scenario". Pestilence says "There is no "Wikimafia ", but I agree that the institute is best known for this controversy or speculation". 'Plausible scenario' and 'best known for' are actually pretty similar. This is NOT "opposing POV about Covid" at all.
- While we're here I think the statement from Pestilence about "there is no "Wikimafia"" is also another indication (as we needed more) that this is a sock puppet. He's been here 2 months. How would he know?
- As far as the difference in editing times - Muddymuck seems to have edited almost exclusively on Sundays between 10:00 and 16:00 UTC. That actually lines up almost exactly with "taking over" from Pestilence who made edits on Sundays between 6:00 and 10:00 UTC. In fact, this shows that the person behind accounts would just edit with Pestilence first, then switch socks at around 10:00 AM each Sunday. And the pattern is quite strong (if they were two different people you'd expect to see more randomness and overlap) so this point actually reinforces the suspicion that they're the same person (lack of overlap is usually taken to increase the probability of sock puppetry since presumably it's messy and difficult to edit with two accounts at the same time - experienced sock puppeteers know that this makes it easier to make a mistake which reveals their sockpuppetry)
- There is a clear connection between Icewhiz's edits and Pestilence, already documented exhaustively by Piotrus above. There's also a pretty strong connection between Muddymuck's mass removals of "Jewish atheists" category from many articles [41] and many Icewhiz edits where he made similar arguments (this actually came up during the ArbCom case). (And that's not in any way a judgement regarding whether such categories belong or do not belong in these articles - I have no opinion on the matter)
- Bottomline - there's a pretty clear connection between Pestilence and Icewhiz behaviorally. We know Pestilence is using proxies to hide their IP, just like many other socks in the topic area. We know Pestilence build up an "innocent" edit history for two months and then all of sudden jumped into Poland related topics, made POV comments and edits that match Icewhiz exactly AND tried to torpedo Piotrus' GA nomination. And Piotrus was also one of Icewhiz's targets. I think there's very little doubt here.
- As for Muddymuck - simple question: is this account ALSO editing from behind a proxy? If not, I would revise my assessment that this account and Pestilence/Icewhiz are the same. But if Muddymuck IS editing from behind a proxy, then yeah, it's the same dude. Volunteer Marek 21:19, 26 April 2020 (UTC)
- Didn't we conclude that Joe was a sock of Ice's buddy Yaniv? Or was it Kaiser von Europa? It was a while ago, so that one is not very relevant here anyway. --Piotr Konieczny aka Prokonsul Piotrus| reply here 01:52, 27 April 2020 (UTC)
@Reaper Eternal: note that in my comment above I predicted that Muddymuck was using a proxy. All these socks are using proxies, and yes, they are using several ones. Before he started creating named sock puppets, right after his indef ban, Icewhiz used several anonymous IP addresses with proxies as well. And those also involved several different proxies. This guy is serious about his sock puppetry.
But in each case the pattern is the same. Use proxy server. Make a bunch of legit edits to an unrelated topic to build edit history. Then jump into some Poland-related controversy. Follow a pretty well defined anti-Polish POV. Oh and also this whole "In one place I'm going to use perfect English with fancy words and all but in another place I am going to pretend I no speak good English" is another peculiar feature all these socks have in common (I think he forgets the fictional backstory to a specific sock cuz he's created so many of them). User:I dream of Maple (see also [42]) was another one that fit this pattern and there were at least half a dozen others though I can't remember their usernames right now. Volunteer Marek 20:02, 27 April 2020 (UTC)
- IIRC he was also interested in LGBT, US politics and Israeli issues. I expect that if we keep catching his socks that are designed for Poland topics, we may see him into those, and they would be doing more than just fast/minor edits in those areas. Just a prediction in the areas of content that future socks may appear to have. Anyway, yeah, "what are the odds" of so many new accounts getting interested in obscure Polish history, sharing Ice's POV and sources, and using VPN... --Piotr Konieczny aka Prokonsul Piotrus| reply here 02:06, 28 April 2020 (UTC)
- Piotrus, aren't you tired of these wild goose chases? You and VM have been crying "socks" for months now, with little to show on SPI. You went as far as accusing editors on AE without any evidence whatsoever![43] You're buck-shotting editors who present a range of POVs, on a range of subjects Icewhiz never showed any interest in. Don't you think it would be better - not least for the benefit of good faith - if you stopped throwing these accusations around as easily as you do?
- IIRC he was also interested in LGBT, US politics and Israeli issues. I expect that if we keep catching his socks that are designed for Poland topics, we may see him into those, and they would be doing more than just fast/minor edits in those areas. Just a prediction in the areas of content that future socks may appear to have. Anyway, yeah, "what are the odds" of so many new accounts getting interested in obscure Polish history, sharing Ice's POV and sources, and using VPN... --Piotr Konieczny aka Prokonsul Piotrus| reply here 02:06, 28 April 2020 (UTC)
- Oh, and by the way: people use VPNs and proxy servers for a range of reasons, including privacy, security, speed, access to "walled" content, and others. There's not much to it, especially now.[44] François Robere (talk) 16:39, 28 April 2020 (UTC)
- Annnnddd, right on cue. Volunteer Marek 01:16, 29 April 2020 (UTC)
- You mean like the other week when you dropped out of the blue into my TP and joined Piotrus, GCB and MMA in a flurry of PAs against me when an admin was watching? Gosh, that was a strange coincidence! François Robere (talk) 08:55, 29 April 2020 (UTC)
- Please link the diff of any personal attack I have made against you or apologize for the false accusation directed at myself. Thank you in advance. Oh, and what "admin was watching" this? How come they didn't intervene? Please ping them here so they can explain themselves. --Piotr Konieczny aka Prokonsul Piotrus| reply here 09:45, 29 April 2020 (UTC)
- You mean like the other week when you dropped out of the blue into my TP and joined Piotrus, GCB and MMA in a flurry of PAs against me when an admin was watching? Gosh, that was a strange coincidence! François Robere (talk) 08:55, 29 April 2020 (UTC)
- "a range of POVs, on a range of subjects Icewhiz never showed any interest in" <-- completely false. These are *precisely* the subjects (Poland, anti-semitism, LGBTQ) and *precisely* the POV that Icewhiz "showed interest in". Volunteer Marek 01:22, 29 April 2020 (UTC)
- Right, it is just a coincidence that all of those new accounts, sharing Icewhiz POV and style, just happen to be on VPNs. And it is also a coincidence, surely, that a number of times you supported them in reverting / comments. You know, this is not helping dissipate the suspicions of meatpuppeting raised recently at AE... --Piotr Konieczny aka Prokonsul Piotrus| reply here 01:11, 29 April 2020 (UTC)
These are *precisely* the subjects... that Icewhiz "showed interest in"
I don't recall Icewhiz concerning himself with Finland, Russia or the "Wikipedia Adventure", whatever the hell that means.sharing Icewhiz POV and style
Have you seen Fireslow's edits? Those are hardly Icewhiz's typical style, so either Icewhiz is intentionally trying to look like an idiot (and he did have a sense of humor, you must admit), or it's someone else. Incidentally, "Fireslow" was blocked by Guy for being an (apparently) unrelated "puppet", so naming them here is redundant. Incidentally, PiotrusW - another editor you accused of "socking" for Icewhiz - also ended up getting blocked for "socking" for someone else.- But anyway, that's not the point. The point is you and VM have been busy with "defending" the TA (from which VM is banned, I should add) from editors you don't know nor like, instead of focusing on building constructive relations with anyone willing to contribute. How did your accusations against Tino Cannst end up? And the quadruple assault against me that other week? This approach isn't very conducive to WP:AGF. François Robere (talk) 08:55, 29 April 2020 (UTC)
- Annnnddd, right on cue. Volunteer Marek 01:16, 29 April 2020 (UTC)
- Oh, and by the way: people use VPNs and proxy servers for a range of reasons, including privacy, security, speed, access to "walled" content, and others. There's not much to it, especially now.[44] François Robere (talk) 16:39, 28 April 2020 (UTC)
As a general question, it has been my understanding that editing via proxy is generally prohibited, per WP:NOPROXY, and that in fact Wikipedia preemptively blocks proxy IP ranges - which means that in order to successfully edit via proxy the user in question has had to gone to considerable effort to find an unblocked ip range. It is has also been my understanding that the only way you can edit from behind a proxy or vpn is if you apply for special permission/exemption. I’m assuming that none of the accounts listed above has done that. Is this correct? Volunteer Marek 07:24, 29 April 2020 (UTC)
- WP:NOPROXY explicitly concerns itself with abusive editing and block avoidance, not with legitimate use. François Robere (talk) 09:35, 29 April 2020 (UTC)
- Well, block avoidance and abusive editing is the issue here. --Piotr Konieczny aka Prokonsul Piotrus| reply here 09:45, 29 April 2020 (UTC)
Clerk, CheckUser, and/or patrolling admin comments
- On a proxy, which is consistent with past accounts that were likely Icewhiz. Also using a similar device but that’s very common so not much on its own. Behavioural evidence needs evaluation. TonyBallioni (talk) 13:31, 24 April 2020 (UTC)
- François Robere, your comments here are not helpful and your arguing with others here does nothing to help clerks and patrolling admins. Please don’t use SPI as a venue for continuing content area disputes. Continuing to do this may result in you being asked to refrain from commenting at SPI. TonyBallioni (talk) 05:03, 30 April 2020 (UTC)
- Muddymuck is also Inconclusive because they are using a different VPN. Behavioural evidence needs evaluation. Reaper Eternal (talk) 14:38, 27 April 2020 (UTC)