• Shutterbug (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki) formerly (user:COFS)
• Misou (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• Shrampes (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• Proximodiz (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• TaborG (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• Derflipper (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)

• Code letter: B, F

See prior evidence/history: Wikipedia:Requests for checkuser/Case/COFS#COFS and Wikipedia:Requests_for_arbitration/COFS/Evidence and Wikipedia:Requests_for_arbitration/COFS. Directly-applicable rulings from the Arbitration Committee: Responsibility of organizations, Multiple editors with a single voice, Use of Church of Scientology-owned IPs.

Checkuser at en.wikinews: n:Wikinews:Requests_for_CheckUser/Archive_3, revealing that User:Misou uses open proxies in addition to ws.churchofscientology.org. User:Shutterbug has been blocked at en.wikinews also for using open proxies to evade blocks: Sockpuppetry: Block evasion via proxies.

The other above users have all become active lately after long periods of inactivity, and edit in tandem with interests of Shutterbug/Misou [1], [2], [3], [4]. I believe that Shutterbug/Misou is now using more accounts to avoid scrutiny, as the organization is aware of the scrutiny its edits already bring from its main Shutterbug account and Misou account. Possibly all are editing from the same open proxy(s) so this may be a complex case.Cirt (talk) 06:28, 6 December 2008 (UTC)[reply]

Your statement about Wikinews is another of your lies, Cirt. I have not been blocked there for sockpuppetry but for disruptive behavior (which is just as bad, I know, as was giving in to your provocations there). Please correct this, and I ask you for the last time to stop the continuous insult of calling me "an organization". I bleed when you cut me, organizations don't. Shutterbug (talk) 06:03, 9 December 2008 (UTC)[reply]

Just FYI, if it's relevant, this user appears to be editing from the corporate network of the Church of Scientology International. krimpet✽ 06:13, 9 December 2008 (UTC)[reply]

Giant fishing expedition. Note that behavior such as this on the part of Cirt is an open topic at Wikipedia:Administrators' noticeboard/Arbitration enforcement and Wikipedia:Requests for arbitration/Scientology. --Justallofthem (talk) 13:59, 9 December 2008 (UTC)[reply]

 Confirmed that User:Proximodiz and User:Shutterbug have been editing from ns1.scientology.org

 Confirmed that User:TaborG, User:Shutterbug, and User:Derflipper have been editing from what appears to be an open proxy in Asia

 Confirmed that User:Shrampes has been editing exclusively from now-blocked proxies (yourfreedom.net) as well as the free dialup service sdfree.net, which is indistinguishable from an open proxy

 Unrelated Misou's IP usage is unrelated to the others.

Note that this is very similar to the pattern detected in the prior COFS ArbCom case.[5].

I'd suggest this is more suitable for arbitration enforcement than anything else. --jpgordon^∇∆∇∆ 02:03, 12 December 2008 (UTC)[reply]

•  Note: - I have combined this technical evidence with previous evidence from this checkuser case page, and from the prior COFS Arbitration Case into a table on the talk page. Please see Wikipedia_talk:Requests_for_checkuser/Case/COFS#Update:_Additional_confirmations_in_COFS_checkuser_case. Thank you, Cirt (talk) 04:57, 12 December 2008 (UTC)[reply]

 Clerk note: Not acting, I feel this should go to the more knowledgeable folks at WP:AE. -- lucasbfr ^talk 09:58, 16 December 2008 (UTC)[reply]

•  Note: - II have blocked several proxies used by these users. — Rlevse • Talk • 00:25, 23 December 2008 (UTC)[reply]

• COFS (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Renamed to Shutterbug (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• CSI LA (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• Misou (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• Grrrilla (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• Makoshack (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)

• Code letter: F

In my experience CSI LA first appeared after COFS was blocked around April 9. After COFS returned, CSI LA's contributions declined and then stopped around April 14th. COFS has been blocked again, and CSI LA has returned.

• CSI LA diffs: [6] [7] [8]

• COFS diffs: [9] [10] [11]

Their styles are very similar, see above diffs. It also seems suspicious that this statement appears on COFS user page:

I am a Scientologist from Los Angeles area. I had been editing earlier in Wikipedia and sorry, I totally forgot my username and password. So, here is my new one. Feel free to ask questions.

I realize this could be an innocent mistake, but taken in with the information above it makes me wonder if CSI LA is the forgotten account since it was created three days prior to COFS. Anynobody 21:05, 25 April 2007 (UTC)[reply]

Update

COFS block expired, and CSI LA hasn't edited since about an hour before expiration.

• COFS first edit back from block: [12] Revision as of 20:40, 25 April 2007

• CSI LA last edit [13] Revision as of 19:58, 25 April 2007

Anynobody 07:42, 26 April 2007 (UTC)[reply]

• Notice here. COFS 19:01, 26 April 2007 (UTC)[reply]

 Confirmed --jpgordon^∇∆∇∆ 16:13, 29 April 2007 (UTC)[reply]

Thank you jpgordon, I appreciate your time. Anynobody 21:51, 29 April 2007 (UTC)[reply]

Yes, thank you jpgordon, for dealing with this disruptive problem. Smee 04:48, 2 May 2007 (UTC).[reply]

Another sock identified

Fred Bauder recently said that another editor not previously mentioned above is also in this IP range. (Wikipedia:Administrators' noticeboard/Incidents#COFS indef blocked) How difficult would it be to find out who else edits in the same ranges? I realize it might not be possible (from a privacy angle) to mention the usernames involved if discovered but I'd be happy knowing general info like: There are X editors in this range. (X being the number of course).

The more I read about banned users in the archives the more I think this may be the latest incarnation of some old troublemakers. Anynobody 11:07, 3 May 2007 (UTC)[reply]

1. Misou (talk • contribs • page moves • block user • block log)
2. Grrrilla (talk • contribs • page moves • block user • block log)

To make a record easily found in future archives about this issue. Anynobody 21:34, 4 May 2007 (UTC)[reply]

Note this diff:[14] discussing how the IP works. Anynobody 21:46, 4 May 2007 (UTC)[reply]

 Confirmed. --jpgordon^∇∆∇∆ 03:05, 5 May 2007 (UTC)[reply]

And what's this "how the IP works" stuff? There were multiple IPs involved. Not ranges, either. --jpgordon^∇∆∇∆ 04:45, 5 May 2007 (UTC)[reply]

That would be referring to one of the IPs that was autoblocked, I think. Other users say they found themselves unable to edit when I blocked COFS and CSI LA. ··coelacan 04:53, 5 May 2007 (UTC)[reply]

Since I haven't seen the actual IP address(es) I feel ackward describing the situation. That was my best term to describe info I don't have access to myself, I'm sorry if that was wrong. Anynobody 05:03, 5 May 2007 (UTC)[reply]

I do want to say thank you again for your time and patience, jpgordon^∇∆∇∆ I really appreciate it. Anynobody 00:16, 6 May 2007 (UTC)[reply]

• Makoshack (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki) added to the list, for more, see the talk page. Smee 09:10, 6 May 2007 (UTC).[reply]

Makoshack  Confirmed. --jpgordon^∇∆∇∆ 15:29, 6 May 2007 (UTC)[reply]

jpgordon^∇∆∇∆ you mentioned different IPs being used, I realize you can't release the actual numbers involved, but could you say which usernames share the same IP? Anynobody 19:05, 8 May 2007 (UTC)[reply]

Additional request confirmation(s)

1. Bravehartbear (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)

Smee 22:01, 7 May 2007 (UTC).[reply]

1. 4.247.128.139 (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
2. 4.247.128.205 (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
3. 66.96.216.181 (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki) -- These 3 have been used by confirmed sock, Makoshack (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki). Request confirmation. Smee 04:44, 9 May 2007 (UTC).[reply]
4. 205.227.165.244 (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki) - User:COFS using an anon-ip to attempt to evade a block. Smee 10:52, 10 May 2007 (UTC).[reply]

• The 205. address is easy enough -- that's ws.churchofscientology.org. --jpgordon^∇∆∇∆ 16:25, 10 May 2007 (UTC)[reply]
  • Is that a confirmation ? What of the other 3? Thank you for your time. Smee 16:35, 10 May 2007 (UTC).[reply]
    • What of the other 3? You already said "they've been used by confirmed sock"; what else do you need? We generally don't connect editors to specific IPs here. --jpgordon^∇∆∇∆ 16:47, 10 May 2007 (UTC)[reply]
      • Oh, okay. In that case, I suppose mention here with your comments in response is fine. I had not noticed that ws.churchofscientology.org info, that is most interesting as well... Smee 16:51, 10 May 2007 (UTC).[reply]
        • FYI: User:4.247.128.139 and User:4.247.128.205 both come from the same location in Florida, and use the same internet provider as ws.churchofscientology.org. Smee 16:57, 10 May 2007 (UTC).[reply]

Possible sock of Misou

Lsi john (talk ·  · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki) This looks like it could be an unsuccessful attempt at a self conversation to reduce suspicion of the account being another sock. [15] [16] [17] [18] [19] [20] [21] Anynobody 00:24, 8 May 2007 (UTC)[reply]

 Unrelated, and let's knock off the fishing. --jpgordon^∇∆∇∆ 02:31, 8 May 2007 (UTC)[reply]

I did not think this one was likely to be a sock/meatpuppet... Smee 02:32, 8 May 2007 (UTC).[reply]

Thanks for looking anyway, I do appreciate the effort. Anynobody 10:53, 8 May 2007 (UTC)[reply]

For the record, the concept certainly ran through my mind, as well. I don't think it was fishing as much as evidence that seemed to suggest something that just happened to be false. EVula // talk // ☯ // 19:50, 8 May 2007 (UTC)[reply]