Jump to content

Wikipedia:Sockpuppet investigations/Mwalla/Archive

Add links
From Wikipedia, the free encyclopedia

User:Mwalla

[edit]
Mwalla (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Mwalla

Mwalla (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Report date February 28 2009, 00:44 (UTC)
[edit]
Checkuser request – code letter: E (Community ban/sanction evasion )
Current status – Completed: Reviewed by a Checkuser, results and comments are below.

Mwalla was blocked for a week [1]. Two newly opened accounts Freerangeraider and Closetindex reverted edits in several articles to Mwalla's versions against the opinion of several other editors. [2] [3] [4] [5]. They also use the same way to sign their contributions on the Talk pages as Mwalla, for example, "([[User talk:Freerangeraider|talk]]) 00:30, 21 March 2009 (UTC)Freerangraider" [6]. The Sceptical Chymist (talk) 11:08, 21 March 2009 (UTC)[reply]

 Clerk endorsed Above suggestions, and to find any other connections and socks. Foxy Loxy Pounce! 03:48, 22 March 2009 (UTC)[reply]
Suspected sockpuppets
Evidence submitted by The Sceptical Chymist (talk)


Similar pattern of disruptive edits on all 4 accounts and pattern of not signing comments on the other users' pages and article Talk pages. User 161.150.2.55 was blocked once for disruptive editing[7] and user Mwalla was blocked twice for personal attacks and violation of 3RR.[8] Spreading disruptive editing over several accounts allows user Mwalla to avoid scrutiny and harsher penalties.

These user accounts also have been used for contributions to the same discussion creating impression of a wider support of Mwalla's POV. For example see edit by Mwalla [9] and by 161.150.2.55 [10], and edit by Mwalla [11] and by 24.15.179.168 [12]. These user accounts have been used for multiple reverts to avoid the appearance of edit warring. For example, see deletions to duloxetine by Mwalla [13][14][15] and by 161.150.2.55 [16][17][18].

Mwalla in essense admitted that 24.15.179.168 and 161.150.2.55 are his socks by accidentally marking edits for these IPs by "Mwalla", see [19] and [20]. Originally, I presumed that Mwalla is a new editor and warned him that sock accounts are frowned upon at WP and asked Mwalla to provide links to the socks on his page.[21] Mwalla deleted my warning[22] and stopped using his 24.15.179.168 account. However, he continues to use his sockpuppet account 161.150.2.55 without disclosing that. Indeed, Mwalla is no newbie as the history of Mwalla's sockpuppets 161.150.2.55 and 161.150.2.56 goes back several years.

Additional evidence. Look for example at February 20. At 14:51 161.150.2.55 left a message on Skier_Dude page, where he continued the argument started as 161.150.2.55 earlier.[23] Then he logged in as Mwalla at 14:55 and made several edits between 14:55 and 17:12, including starting another discussion on Skier_Dude page [24]. Then he logged out and made two edits between 19:07 and 19:09 as 161.150.2.55 [25]. Then he logged in at 19:24 [26] to leave a couple of messages under Mwalla's name. Then again he logged out at 21:04 to continue the discussion as 161.150.2.55 at WP:MED [27]. This logging in and out is not accidental. You can see that every edit on February 20 by Mwalla is signed by four tildes while none of the edits by 161.150.2.55 is signed. Mwalla and 161.150.2.55 consistently participated in separate discussions, for example on Skier_Dude page. At the same time, these discussions were on the same topic. That means that the sockpuppeteer consciously tried to maintain separate identities and used them to create pressure on an admin (Skier_Dude) to unprotect a paroxetine page. This also means that Mwalla does not have a legitimate excuse of maintaining two separate identities to edit in two different areas.

Furthermore, Mwalla did not provide links to his IP accounts when I asked him to do that[28]. This indicates that he was not acting in good faith.The Sceptical Chymist (talk) 01:20, 3 March 2009 (UTC)[reply]

I added another IP for Mwalla (67.133.55.18). The same pattern of edits to the same articles, for example, paroxetine. The same address via whois - Downers Grove,IL. And now he is stalking another article I am editing with nonsensical changes and reverts, see [29] with edit summary "rv vandalism". Please note that this case is 3 weeks old. I appreciate that there is a backlog of SPI cases, but, perhaps, it is on the top of that backlog by now. The Sceptical Chymist (talk) 01:15, 16 March 2009 (UTC)[reply]

Regarding the possibility that Mwalla's log-ins and log-outs may be accidental. It is made unlikely by the fact that all but one of his edits to user/project pages on February 19 and 20 are signed [30] [31] [32] [33] [34] , while all of the edits by 161.150.2.55 (which were close in time to Mwalla's) are unsigned [35] [36] [37] [38] [39] [40]. The Sceptical Chymist (talk) 11:02, 21 March 2009 (UTC)[reply]

Here Mwalla on yet another recent sock they created despite this sock investigation started to recruit editors trying to give myself grief on articles by trying to recruit people who they suspect would disagree with edits. This was done in retaliation for me I believe reverting their vandalism, they follow my recent edits and then harass me on these other articles that I have recently edited.[41] More edits [42], [43]. After reading the article talk page, seeing that they had created a dispute that they had gotten me involved in they then craftily created a sock puppet to try and make it look like I was using sock puppet.[44] See my additional comments below for more information on these edits to understand why they are desruptive and the background to them. As you can see their motive for editing the article actually contradicts their initial edits on their previous edit.--Literaturegeek | T@1k? 15:43, 21 March 2009 (UTC)[reply]

  • Xports added due to it being an account created in sync with some of the edits noted already, and further the wording used and the target of the report here at the 3RR noticeboard. Nja247 12:46, 22 March 2009 (UTC)[reply]

Xports was just making invalid and bogus reports of edit warring to try and get be blocked. This is what they do use socks to harass people. I see that Xports also made a bogus submission against 70.137.xxx.xxx Wikipedia:Sockpuppet_investigations/70.137.151.133/Archive who is a frequent editor of wikipedia and who was also harassed by Mwalla and various socks and had their comments altered by Mwalla etc. The really ironic and almost laughable thing is that Xports used one of his own socks to file a bogus check user sock report against anon 70.137.xxx.xxx!!! Crazy.--Literaturegeek | T@1k? 19:01, 22 March 2009 (UTC)[reply]

All of Mwalla's contributions that I have seen have been disruptive, trying to get misrepresentation of refs inserted into paroxetine or else following editors about on socks posing as a valid editor challenging his "enemy's" edits to annoy them. His enemies are anyone who dare's to revert their vandalism or disagree with them on a talk page. Something needs done to sort this Mwalla person out. They have been nothing but a headache for everyone since they appeared on wikipedia.--Literaturegeek | T@1k? 19:06, 22 March 2009 (UTC)[reply]

Here is some more evidence of paroxetine (Seroxat, Paxil) page having to be protected at least 3 times in a short period of time because of Mwalla repeatedly inserting fake data, false representation of references and triggering endless revert wars and filling up the talk page with endless arguments over their fake data and using socks to try and reach consensus etc. Here are the page protections because of Mwalla.[45], [46], [47], [48], [49] I hope that this is of use. You can check the edit history of the page to see all of the reverts both manual and undo options and their socks causing mayhem and drama for months.--Literaturegeek | T@1k? 19:33, 22 March 2009 (UTC)[reply]

I know that anon 70.137.xxx.xxx had problems with Mwalla inserting unsigned comments into their comments to make it look like it was 70.137 who was making the comments on the wiki project medicine page and other talk pages I believe.[50], [51], [52]. They lost their temper with Mwalla here, User_talk:161.150.2.55#Paroxetine for altering or inserting comments into other people's commentsand they said to me that they wouldn't be backon wiki much more, not sure if Mwalla had anything to do with that or not. As anon 70.137 seems to have left wiki now and that they use a dynamic ip address I can't track down all of the problems they had with Mwalla and their socks.--Literaturegeek | T@1k? 20:00, 22 March 2009 (UTC)[reply]

Comments by accused parties    See Defending yourself against claims.


Comments by other users
  • I would like to note that whilst there may be something to look into here, there has been a general breakdown assuming good faith by both parties, and further another editor has made unsubstantiated personal attacks on the accused parties talk page here (additionally here. The initial findings of National City bank in Illinois do not support the claims that the user works for a big pharmaceutical company with a POV. Nja247 08:51, 21 March 2009 (UTC)[reply]
It is incorrect to say that "there has been a general breakdown assuming good faith by both parties". I cannot control what User:Literaturegeek writes and s/he is only commenting and is not a side in this investigation. Please note that I, The Sceptical Chymist (talk),—who requested this investigation—have never personally attacked Mwalla. It has been difficult to AGF after Mwalla called me "You are a douche. You do not even qualify as a douche bag, you are merely a douche." [53], edited my words on a talk page to mean something else [54], accused me on this page[55] and elsewhere[56], called an administrator "a prick"[57], and badgered another administrator here[58] to a point of "being disruptive" (Hersfold's words), see here review for Fred M. Levin. But I have always tried to AGF and be civil, please see my response to Mwalla's accusations on this page [59]The Sceptical Chymist (talk) 10:54, 21 March 2009 (UTC)[reply]
I agree with The Sceptical Chymist's comment above. I will comment further in turn below, but I wanted to 'second' briefly here.TVC 15 (talk) 20:46, 22 March 2009 (UTC)[reply]


  • I believe that they may have personal stocks and shares invested in GSK. The reason I suspect this is the lengths they go to in trying to insert fake data and misrepresent refs on paroxetine article and fill the talk page up arguing about it. I think that them working for GSK is possible but probably very unlikely but I stand by my accusation that they probably have some financial connection to paroxetine and the manufacturer, more likely personal shares/stock than working for them based on the fact that they edit from a major banking institute and their behaviour. It just doesn't add up that they are a regular editor due to the extreme lengths they have gone to such as using sockspuppets and deleting users comments and altering them to say the opposite and filling up the paroxetine talk page with endless arguments over their misrepresentation of refs and the article having to be locked several times. Anyway the main issue for me is their use of sockpuppets and their repreated insertion of misrepresented data into paroxetine, altering people's comments and other behaviour such as altering recent edits to articles by editors who have reverted their vandalism or disagree with them on an article talk page rather than speculative accusations for their actions. I am actually beginning to regret reverting their vandalism and getting involved in this as paroxetine is not a drug I am particularly interested in. I do admit I did lose my temper with mwalla on their talkpage and I appologise for that.--Literaturegeek | T@1k? 09:25, 21 March 2009 (UTC)[reply]
  • I have become involved in this because I now am getting harrassed by Mwalla. After I reverted vandalism to a users comments on an article talk page where Mwalla made a person say the opposite of what they said, Mwalla then looked up my recent edits and edited them to say the opposite of what the refs said. I reverted it as vandalism. Then several editors who hadn't read the refs assumed I was being biased and POV (they didn't read the refs) and then started reverting me and caused me conflict with several editors on the talk page. Mwalla also started adding comments to the talk page trying to stir up more conflict. This is what they do, if you challenge their misrepresentation of references, revert their vandalism, they then start harassing you on articles you have been productively editing and try to stir up arguments. See here for one example. [60], [61]. After reading the article talk page, seeing that they had created a dispute that they had gotten me involved in they then craftily created a sock puppet to try and make it look like I was using sock puppet.[62] They did this once before a while back when I disagreed with them on a consensus issue. They attacked one of my recent edits. This has lead me into disputes with other editors on major depressive disorder talk page and also with an administrator on my talk page.User_talk:Literaturegeek#Note who are not familar with this Mwalla person. All that I did was revert vandalism to user comments.--Literaturegeek | T@1k? 11:25, 21 March 2009 (UTC)[reply]
  • I agree with Literaturegeek. While collaboration requires assuming good faith, Mwalla's edits disprove that assumption. (For example, deliberate edit warring while mocking discussion [63], making false accusations against me on User:SoWhy's Talk page, and the many more vivid examples above.) Also, even if some of the URLs above turn out not to be sock puppets of Mwalla, they appear to be sock puppets / alter egos of each other (e.g. 161.150.2.55 and 161.150.2.56) and follow Mwalla's pattern of disingenuous edits (e.g. [64]). Where an obviously disruptive user makes disingenuous edits pushing a pharma agenda, it is reasonable to look for evidence why. The accounts above concentrate on promoting specific drugs, e.g. paroxetine. Some players in the pharma industry have earned a reputation for misleading people about drugs, especially whether those drugs are addictive (see GlaxoSmithKline and Purdue Pharma). Addictive drugs can be the most profitable, for obvious reasons, so there is a huge temptation to conceal their negative effects. As those effects include ruined lives and even deaths, it would be naive to assume the perpetrators somehow respect the rules of Wikipedia. Also, to an individual prescriber facing litigation or disciplinary action for prescribing a controversial drug without warning of significant risks, making the risks appear less well known may seem easier than admitting ignorance of widely known facts. The URLs above share the same agenda and sometimes tactics.TVC 15 (talk) 21:44, 22 March 2009 (UTC)[reply]

I see Armadude is a sock of Mwalla, so they were stalking my edits on long term effects of alcohol, inserting pro alcohol data and templating me etc. Unbelievable, oh well at least they are blocked now.--Literaturegeek | T@1k? 09:36, 23 March 2009 (UTC)[reply]

Clerk, patrolling admin and checkuser comments
  • 24.15.179.168 is a residential address in Downers Grove, Illinois and the two 161.*.*.* accounts are both registered to the National City Corporation bank, which (checking their wikipedia article) have branches in Illinois. Looks like a bank worker going between home and work to me. Foxy Loxy Pounce! 10:34, 28 February 2009 (UTC)[reply]
  •  Additional information needed it appears pretty clear that the IPs are consistent with the account. However, editing whilst logged out is not necessarily contrary to WP:SOCK. It can happen accidentally, and even extensive carelesness in this area isn't proscribed. If we are to consider this as abusive sockpuppetry, we need a clear timeline, which shows a pattern of deliberately logging out to make an edit. Mayalld (talk) 12:32, 2 March 2009 (UTC)[reply]
  •  In progress I am reviewing the sequence of edits outlined by The Sceptical Chymist above. Mayalld (talk) 08:59, 3 March 2009 (UTC)[reply]
  •  In progress I am slightly concerned about a failure to assume good faith here. As I said, editing as an IP is not against the rules, still less when there is no deliverate intent, and the warning was rather WP:BITEy. Deletion of warnings is permitted, and should be taken as acknowlegment that the warning has been seen, so I see no need to make any more of it. If we look at the edits that you listed for 20th February, from the account and a work IP address, and translate to local time (UTC-6), the timeline is as follows;
  • 08:51 - IP edit
  • 08:55 - Account edit
  • 10:52 - Account edit
  • 11:07 - Account edit
  • 11:12 - Account edit
  • 13:07 - IP edit
  • 13:09 - IP edit
  • 13:24 - Account edit
  • 14:18 - Account edit
  • 15:04 - IP edit
In the spirit of WP:AGF, we must now ask ourselves whether there is an innocent explanation of this edit pattern.
  • The first edit of the day at 08:51 is innocent enough, and can be easily explained as forgetting to log in.
  • The series of logged in edits in the morning is fine.
  • A pair of logged out edits in the early afternoon is slightly more problematic, although we know that this user is editing from work, and we might surmise that he is obliged to log out (rather than simply lock) when going to lunch.
  • Two afternoon logged in edits are, again, fine.
  • The edit at 15:04 is more problematic. There seems no obvious reason for logging out, and I would like to hear from Mwalla on this point. Mayalld (talk) 09:32, 3 March 2009 (UTC)[reply]
 Clerk note: Mwalla has not taken up my invitation to comment on logged in/logged out edit patterns. In the absence of explanation, it is difficult to assume good faith on the 15:04 edit from the list above. Mayalld (talk) 14:10, 9 March 2009 (UTC)[reply]
I will let you draw your own conclusions on the issues raised by The Sceptical Chymist. He has a POV and does not assume good faith. He has consistently harrassed me. Wikipedia is a big place, but he chooses to follow me around. When he has a disagreement with an established editor such as Orangemarlin[65], he does not try to compromise and instead tries to get them blocked [[66]] he also recruits other editors to opine on his behalf. Mwalla (talk) 14:52, 18 March 2009 (UTC)mwalla[reply]
In reality, I worked out the compromise wording between the opposing views of Orangemarlin and Xasodfuih, with which they both agreed -- see my post here [67]. I also asked the blocking admin to unblock Orangemarlin, if possible, here [68] The Sceptical Chymist (talk) 22:39, 18 March 2009 (UTC)[reply]

Just to step in here. I today reverted mwalla's vandalism to the paroxetine talk page. The response of mwalla was then to harrass me by following my edits and altering them on articles to make them say the opposite and then opposing my edits on talk pages. Mwalla is the one who follows people around. They also harrassed people who voted to delete an unnoteworthy article that they created. Mwalla is the type of person who if you revert their malicious vandalism or fake data inserted into articles they will harrass you as "pay back". As for socks, yes mwalla has been suspected by a number of users of using sockpuppets. If you look up their ip address you will see that at least one of them edits from a banking institution and judging by the type of edits and their fanaticism with the paroxetine article and their fake data I think that they have stocks and shares in the banking institute with the drug manufacturer or something similar and that is why they behave the way they do. Mwalla has picked a fight with me so I am now having to defend myself by exposing them. They are malicious and malignant and Sceptical is innocent. Mwalla is now harrassing Sceptical on other people's talk pages spreading malicious lies about other editors being harrassers etc when it is them that are the harrassers. Mwalla was blocked today for one week for malicious vandalism and have been blocked before but they blank their talk page of warnings.--Literaturegeek | T@1k? 17:52, 19 March 2009 (UTC)[reply]

Conclusions
A number of these IPs appear to be businesses and could be public terminals or free wi-fi. If problems continue, we could consider range blocks on 161.150.2.48/28 (one regular user who would need IP exempt) and 67.133.55.16/29. --Versageek 03:19, 23 March 2009 (UTC)[reply]
This case has been marked as closed. It has been archived automatically.

I've blocked all confirmed and likely accounts. I did not block 69.243.189.111 as the behavior evidence on that one is weak. There is a small chance its the same user, but I cannot say with enough likelyhood to warrant a block. Plus blocking it would not do much as its last edits are over a month ago. I did block Freerangeraider as a sock based on behavior evidence alone. You can see a report that I generated for my use to analyze this report at http://toolserver.org/~eagle/spi/hold/Mwalla.1.html . —— nixeagleemail me 04:00, 23 March 2009 (UTC)[reply]

Report date June 15 2009, 02:52 (UTC)
[edit]
Suspected sockpuppets


Evidence submitted by Tiptoety
  • Similar edits to Paroxetine. Both users are pushing a strong POV that the antidepressant does not have birth defects associated with it. See [69], and [70]. I would like a CheckUser to confirm my suspicion and work on a IP block (based on the prior CU, there were a number of IPs involved) Tiptoety talk 02:52, 15 June 2009 (UTC)[reply]
Comments by accused parties    See Defending yourself against claims.
Comments by other users
CheckUser requests
Checkuser request – code letter: D  + F (3RR using socks and another reason)
Current status – Completed: Reviewed by a Checkuser, results and comments are below.    Requested by Tiptoety talk 02:52, 15 June 2009 (UTC) [reply]


Clerk, patrolling admin and checkuser comments
Conclusions
This case has been marked as closed. It has been archived automatically.




Report date August 28 2009, 18:36 (UTC)
[edit]
Suspected sockpuppets


Evidence submitted by Literaturegeek

Editors on talk page alledge that he is misrepresenting sources. Edit warring using socks, [71], [72], [73] It should be noted they edit warred one edit with one of their own socks after I accused them of being a sock on their userpage to make them look innocent. Vandalising article,[74] and using edit summary to look legit and part of a dispute when it was just vandalism. A brand new editor but yet knows about "NPOV", sounds like an experienced editor.[75] Mass deletes lots of referenced text with first edit from that account to the article.[76] If you scroll through the contribs you will see same type of behaviour typing to multiple editors trying to recruit people to join his team. I was hoping that tiiptoey could have done the check user as tiptoey is familar with the case but they are no longer check user. This is a sockpuppeteer who creates on mass sockpuppets. I believe that their ip block has expired and here they are back again sockpuppeting. This supposedly banned user goes straight to admin board when I accuse them of sockpuppeteering.Wikipedia:Administrators'_noticeboard/Incidents#User:Literaturegeek, Mwalla did this last time with one of his "brand new" sockpuppets. They have a particular interest in the paroxetine page. Please review the previous sockpuppet investigatiion archive as this is a very lengthy repeating problem for the past year.Wikipedia:Sockpuppet_investigations/Mwalla/Archive He is now finding people on my talk page to and messaging them. Check edit history of Neurofish, they went on a mission to message as many people as possible to smear me. Mwalla always did this, one of their socks are banned but you nneed to block the IP address(es) as they will make sockpuppet after sockpuppet after sockpuppet continuously. Thanks for listening. Mwalla if you check his block log and the mwalla sock archive is meant to be permanently banned, so is ban evading, edit warring and trying to smear my name to multiple people on their talk page and filing bogus reports on admin noticeboard. See contribs of sockpuppets, just a repeat performance that has been going on now for over a year, had been quiet for a while but ip block expired.--Literaturegeek | T@1k? 19:30, 28 August 2009 (UTC)[reply]

Comments by accused parties    See Defending yourself against claims.
Comments by other users


CheckUser requests
Checkuser request – code letter: D  + E (3RR using socks and community ban/sanction evasion)
Current status – Completed: Reviewed by a Checkuser, results and comments are below.    Requested by Literaturegeek | T@1k? 18:36, 28 August 2009 (UTC) [reply]



Clerk, patrolling admin and checkuser comments

Additional information needed: Please provide a code letter. SPCUClerkbot (talk) 19:08, 28 August 2009 (UTC)[reply]

Conclusions
This case has been marked as closed. It has been archived automatically.



Report date October 13 2009, 15:21 (UTC)
[edit]
Suspected sockpuppets
[edit]


Evidence submitted by DKqwerty
[edit]

Editing Paroxetine in a similar manner to known Mwalla sockpuppet Abcdohrayme: this ≈ this

Comments by accused parties   
[edit]

See Defending yourself against claims.

Comments by other users
[edit]
CheckUser requests
[edit]
Checkuser request – code letter: CODE LETTER (Unknown code )
Current status – Declined, the reason can be found below.    Requested by DKqwerty (talk) 15:21, 13 October 2009 (UTC) [reply]



Clerk, patrolling admin and checkuser comments
[edit]
  •  Clerk declined: Identical edit (second listed above, includes the bit about paroxetine and the risk to unborn children) is enough for a duck block for me. Looks like past checkusers haven't definitely identified new accounts that weren't already listed, and Abcdorayme edited only from a cellphone. Nathan T 19:38, 13 October 2009 (UTC)[reply]
Conclusions
[edit]
This case has been marked as closed. It has been archived automatically.



Report date November 12 2009, 13:35 (UTC)
[edit]
Suspected sockpuppets
[edit]


Evidence submitted by Literaturegeek
[edit]

If you check the dozen or so contribs he is misrepresenting refs and using irrelevant refs, over the same material that Mwalla has been abusing multiple sockpuppets for a year or so, i.e. suicide and pregnancy on the paroxetine article. He is also edit warring on the paroxetine article. Hopefully the ip addresses can be hardblocked for a long time as his disruption is getting tiresome. From past experiences with sock investigations, staff are just blocking based on WP:DUCK, although a checkuser may be needed to block ip addresses? Not sure, anyway thanks. Please refer to Mwalla SPI archive for evidence if not familar with this case. :)--Literaturegeek | T@1k? 13:39, 12 November 2009 (UTC)[reply]

Comments by accused parties
[edit]

See Defending yourself against claims.

Comments by other users
[edit]
Clerk, patrolling admin and checkuser comments
[edit]
Conclusions
[edit]

information Administrator note Blocked and tagged. MuZemike 23:46, 13 November 2009 (UTC)[reply]

This case has been marked as closed. It has been archived automatically.


Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Mwalla/Archive&oldid=1143401093"