Icewhiz

Icewhiz (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Populated account categories: confirmed · suspected
For archived investigations, see Wikipedia:Sockpuppet investigations/Icewhiz/Archive.


27 July 2021

– This SPI case is open.

Suspected sockpuppets



Soon after Viking Drummer's block, multiple IP's started to appear, presenting the view of the forbidden sockpuppet.


The above demonstrates that it is the same person Icewhiz/VikingDrummer using a third-party service to generate multiple IPs. GizzyCatBella🍁 23:19, 27 July 2021 (UTC)[reply]

Yet another suspect
Yes, totally possible a new sock of Icewhiz; that's a standard modus operandi of that individual. They follow and harass their chosen victim for months sometimes, and they are highly annoying. Since you were involved in the article Jan Żaryn they were trying to troll; it seems to me that you are on their radar now. Sorry about that. - GizzyCatBella🍁 07:04, 28 July 2021 (UTC)[reply]

And all continues - The user who reverted IP 91.233.157.54 [33] on the same article four minutes later received insults and threats[34] on his talk page from this IP 102.176.125.220 in broken, google translated Polish that reads in English: I curse you forever and ever, in the name of the blood of Jesus, you stupid. You ruined this important info; instead of letting you kiss your name. SHB2000 super vandal wrote you will not have forgiveness, and I will hack your account. I CURSE YOU like WTM, circular, Wiki Polish whores! - GizzyCatBella🍁 08:22, 3 August 2021 (UTC) (unrelated) - GizzyCatBella🍁 09:10, 3 August 2021 (UTC)[reply]

@GizzyCatBella: also, that is not unrelated, but per the duck test, that is also Wikinger. SHB2000 (talk) 09:13, 3 August 2021 (UTC)[reply]
@SHB2000: - Wikinger’s real location is in Poland [35], so they would speak Polish. The insults he wrote were google translated into very bad Polish; it might not be them, actually, because they would write in good Polish. This requires a further investigation. - GizzyCatBella🍁 09:27, 3 August 2021 (UTC)[reply]
But I doubt that. Wikinger uses a VPN so their location is quite unknown. SHB2000 (talk) 10:11, 3 August 2021 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

This is not Icewhiz, but this is WP:LTA/Wikinger, who is Ljupco's impersonator (copies all of Ljupco's attacks, and makes it even worse). The main difference is that Ljupco doesn't know any other language apart from English. Both are IP hopping vandals, and regardless who it is, they're both banned by the WMF. Pinging @Antandrus: since they know a lot more about these vandals than I do. SHB2000 (talk) 09:08, 3 August 2021 (UTC)[reply]
Ljupco (i.e. WP:LTA/GRP) speaks Polish and Serbian. The latter is his native language. I think both 102.176.125.220 and 5.109.23.209 are both GRP. Yes, Wikinger is in Poland; I thought he was in a city east of Warsaw, but could be wrong; anyway his home IP range starts with 83, Orange something-or-other. Wikinger imitates Ljupco all the time, and I've thought for a while there might be a third one imitating them both. Antandrus (talk) 14:54, 3 August 2021 (UTC)[reply]
I'll probably start on Icewhiz's LTA page soon. SHB2000 (talk) 06:54, 5 August 2021 (UTC)[reply]
Just a note that Icewhiz was known to speak limited Polish (either that or was not shy about machine translation back and forth). Piotr Konieczny aka Prokonsul Piotrus| reply here 07:02, 5 August 2021 (UTC)[reply]
Also, to the IP, I suggest you create an account because Ljupco may edit war with me anytime here. SHB2000 (talk) 09:10, 3 August 2021 (UTC)[reply]
I've just added 185.127.21.114 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)). What are the odds an IP found a Wikipedia talk page discussing whether some content added by Icewhiz should be removed, and is sounding exactly like him? Behaviorally, in my experience, this is exactly something Icewhiz would say. Of course, it might be someone imitating him for lolz, shrug. --Piotr Konieczny aka Prokonsul Piotrus| reply here 07:00, 5 August 2021 (UTC)[reply]
Oh, and while we are looking at suspicious accounts, here's one more: Gunter888 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) SPA active in one topic area that speaks a weird mix of German and English that seems almost intentionally fake and funny. He has already been reported (but not checked AFAIK) here before (CTRL+F for Wikipedia:Sockpuppet investigations/Icewhiz/Archive) and Wikipedia:Sockpuppet investigations/Smmurphy/Archive. If it's not Ice it's pretty ducky he is someone else having fun here. --Piotr Konieczny aka Prokonsul Piotrus| reply here 07:08, 5 August 2021 (UTC)[reply]
@Piotrus and Antandrus, this looks more like a jupco edit to me. SHB2000 (talk) 09:26, 9 August 2021 (UTC)[reply]
@SHB2000 What or who is a "jupco"? It's hard to judge much with a single edit. I agree that the other account I report with it on the same day looks much more Icewhizhy... this one is 50/50. Could be someone else indeed. Piotr Konieczny aka Prokonsul Piotrus| reply here 09:46, 9 August 2021 (UTC)[reply]
Sorry. Typo. I meant Ljupco aka GRP. SHB2000 (talk) 09:51, 9 August 2021 (UTC)[reply]
@Piotrus - Yes, Gunter888 is using the same tactics as previously blocked sock-puppet of Icewhiz - KasiaNL (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)).

Both are pretending to speak bad English and blaming their mistakes on "typing fast."

Here are the diff's of KasiaNL (already blocked sock puppet of Icewhiz) justifying making mistakes on "typing fast":

But speaking or typing fast, I can mess up[36] ...big difference if I write fast[37]

And here is Gunter888 with the same story - "typing fast":

Sometimes when I type fast ...my German comes out of the cracks. . from mixing German in when I type faster.[38]

KasiaNL was hiding behind a proxy, Gunter888 is expected also to be using a VPN. - GizzyCatBella🍁 10:35, 5 August 2021 (UTC)[reply]

More: 72.179.185.130 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) --Piotr Konieczny aka Prokonsul Piotrus| reply here 15:15, 5 August 2021 (UTC)[reply]

Yeah, looks like another peer-to-peer proxy IP. - GizzyCatBella🍁 10:57, 6 August 2021 (UTC)[reply]
Wikipedia:Administrators'_noticeboard#Recent_proxy_blocks? --Piotr Konieczny aka Prokonsul Piotrus| reply here 00:04, 7 August 2021 (UTC)[reply]

I've added two more, both SPAs posting on talk in areas of Icewhiz's interest, both sounding like he (ChristianDWP (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)), XN Kowalczyk (talk+ · tag · contribs · filter log · WHOIS · Kowalczyk.html RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))). --Piotr Konieczny aka Prokonsul Piotrus| reply here 16:51, 8 August 2021 (UTC)[reply]

@RoySmith: You guys can still check the non-IP named accounts, right? Volunteer Marek 21:28, 8 August 2021 (UTC)[reply]

I'm sure somebody will do that. I'm not sure I have time to dig into this one beyond the ECP I did to stem the ongoing disruption. -- RoySmith (talk) 00:28, 9 August 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

Categories