Theonewithreason (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• 212.178.243.250 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 212.178.241.246 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 212.178.224.144 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 212.178.230.23 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

On September 7, Theonewithreason (talk · contribs · deleted contribs · logs · filter log · block user · block log) made this edit. The source didn't support the edit, so @Miki Filigranski: removed it on October, 6. 212.178.241.246 reverted them, 7 minutes later. The reverts continued and Theonewithreason - who hadn't been active since October 1 - joined the IP. The two of them have a total of six reverts. The IP has violated 3RR, while Theonewithreason has made two reverts. 212.178.241.246 is most probably another IP from the same range as 212.178.243.250 (blocked on September 19) and 212.178.224.144 and 212.178.230.23. All four IPs and Theonewithreason edit the same Balkan subtopic about Vlachs in Montenegro and Croatia. X.144's first edit His book does not meet WP:SECONDARY or WP:RELIABLE. is a revert in support of X.23[1]. The edit summary strongly indicates that this is an active editor and not a new, IP editor. @TU-nor: filed an edit-warring report against X.246 on 15:45, 7 October 2020 in relation to Tribes of Montenegro. A few hours later Theonewithreason filed two reports against Miki Filigranski (MF) and @Mikola22: [2][3]. These two reports were quickly closed as there was no edit-warring from either MF or Mikola22. I think that these reports were filed as a response to the report of TU-nor about X.246's activity on tribes of Montenegro.

These editors occupy the same "ecological" space on wikipedia, one's edits are a continuation of the other in the same edit-warring cycle. For example, on Drobnjaci X.246's edits are a continuation of those of Theonewithreason with six reverts in total between them . There's also the fact that all of them focus on Miki Filigranski or Mikola22 - from X.250's edits to the reports by Theonewithreason. Maleschreiber (talk) 14:15, 8 October 2020 (UTC)[reply]

In response to @TU-nor: I understand that it may as well be an issue of off-wiki activity, but I don't know how that can be handled. A CU is a good start in order to get some answers, otherwise we will be dealing with a new IP from the same range every couple of weeks.--Maleschreiber (talk) 15:46, 8 October 2020 (UTC)[reply]

@Ivanvector:@GeneralNotability:@Drmies: thank you all for the very quick response. --Maleschreiber (talk) 16:24, 8 October 2020 (UTC)[reply]

@Drmies: fully agreed, it's a very difficult area. --Maleschreiber (talk) 16:34, 8 October 2020 (UTC)[reply]

• @Ivanvector:@Drmies:@GeneralNotability: It's becoming a very interesting case. Cobalton's first edits had to do with a restart of an older dispute on Vasojevici in late September. The main issue of that dispute had to do with a 1789 document between a representative of this community and the Russian Empire, which Cobalton claimed that it could be used as a source, while other editors explained to them that it's WP:PRIMARY and WP:AGEMATTERS. That was the reason why this particular section was removed a couple of months earlier. The initial reverts had to do with edits which Mikola22 had spotted. So, Cobalton was aware of the exact arguments that had led to its removal[4] - although he wasn't registered at that time. Now, here's a very interesting thing that happened: on September 6 (about 3 weeks before Cobalton's edits), Rustr12 started a very specific discussion on WP:TEAHOUSE, where he asked regarding WP: AGE MATTERS policy does it implies to an old historical letters or documents written between two governments or persons and how old must material be to be considered that is not significant in historical matter. I think that they are referring to the same old dispute which Cobalton would restart a few weeks later. Rustr12 on September 6 Thanks man somehow I understood like that too, the more sources mentioning the material the more is reliable regardless how old it is, but still is a little bit confusing and Cobalton on September 20 Hello, there is an ongoing long discussion without concensus on Vasojevic talk page about the letter send by Radonjic (2 letters in 1788. and 17889.) to Queen Catherine 2 , is it reliable source and does it goes under WP:AGE MATTERS since there is also reference of the letter from an autor from 1900. on WP:RSN --Maleschreiber (talk) 19:45, 8 October 2020 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• I was pinged here by the mention in the report. I have to say I am not convinced. Of cource, all the IP212.178.x.x. are the same editor. They are a pain in the ass, but not necessarily "governed" by a registered account. It could just as well be a "soul mate" using the IP212 range to push their POV. While Theonewithreason has made almost half their edits to talk pages, the IP212s are generally avoiding discussions. Besides, CheckUsers do not normally connect IP addresses to registered accounts. I think that the IP212s need to be handled in another way than this. --T*U (talk) 15:31, 8 October 2020 (UTC)[reply]

The block log of the IP range is quite interesting, and it predates the Theonewithreason account by many years. Let us keep the problems apart. (VJ-Yugo seems a lot more probable.) --T*U (talk) 16:22, 8 October 2020 (UTC)[reply]

•  Check declined by a checkuser - we cannot connect IP addresses with named accounts per the privacy policy.  Behavioural evidence needs evaluation. Note that the listed IPs are all in the range 212.178.224.0/19 (block range · block log (global) · WHOIS (partial)). Ivanvector (^Talk/_Edits) 16:01, 8 October 2020 (UTC)[reply]
• I didn't see that Ivanvector had already commented; I'll just add that that range is full of edits by one single editor, the one whose work prompted this, and various IPs are blocked in that range. I did see sufficient reason to run CU on Theonewithreason, and while there is some logged-out editing, there is no obvious socking. There is one thing, though: there are two other accounts with which they overlap via two of the IP addresses. With one, they overlap in content but not in technical details; with the other, they are a perfect match but the two accounts edit different things. It is possible that the editor is good at separating accounts for different purposes; Ivanvector, perhaps you can have a look at the second of the IP addresses that pops up under Theonewithreason (the 32/114 one--I'm speaking in code, of course). But I'll add that I do not note whether it's worth it, and that it is unrelated, as far as I can tell, to this particular matter. Drmies (talk) 16:17, 8 October 2020 (UTC)[reply]

•  Clerk note: It looks to me like Theonewithreason and the IP range are working together toward the same ends, so even if they aren't the same person they both seem to be working together to edit-war. I have blocked Theonewithreadson and the /19 for a week for edit warring (I see little other activity on that range, so the wide rangeblock should be okay) GeneralNotability (talk) 16:19, 8 October 2020 (UTC)[reply]

  Drmies, looks like we ran into each other here - do you want me to lift the blocks? Even if they're technically unrelated, I find it just a little too convenient that they're tag-teaming to edit war on that page. GeneralNotability (talk) 16:22, 8 October 2020 (UTC)[reply]

  GeneralNotability, the fun part is that in these areas we often suspect meating, when otherwise unrelated editors come together for the same purpose; Maleschreiber subscribes to that too, I believe--so yes, tag-teaming, or tag-meating, really. Anyway, here we have three otherwise unrelated CUs/admins converging on the same SPI, reaching similar conclusions. What are the odds? No, I am perfectly fine with the blocks, esp. the rangeblock, and I thank you for it. Drmies (talk) 16:26, 8 October 2020 (UTC)[reply]

  I thought that range sounded familiar but apparently I haven't had enough coffee today; that's Wikipedia:Sockpuppet investigations/VJ-Yugo for sure, and that's already well-documented from long before I had the CU bit (see User:Ivanvector/Serbian Army vandal). Re-blocked for the longest setting built into the UI.

  As for other accounts (it took me a minute to decode Drmies' encryption), the accounts below are  Technically indistinguishable, and I don't necessarily agree that they're behaviourally unrelated but I'll leave that for second third opinion:

  • Theonewithreason (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Cobalton (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • RuStr12 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

  These are the accounts with edits; there are more that have not edited. If we conclude that these three are sockpuppets, the others should be blocked. Please do not merge this with VJ-Yugo. Ivanvector (^Talk/_Edits) 18:01, 8 October 2020 (UTC)[reply]

  Re-ping just to be sure, since this was closed: @Drmies, GeneralNotability, Maleschreiber, and TU-nor: Ivanvector (^Talk/_Edits) 18:52, 8 October 2020 (UTC)[reply]

  Thanks Ivanvector. Yes, you found them--I wasn't sure if I should list them here, and again, I am not sure what to do with them--they're either separating themselves very well from themselves, or they are really different people. I am not comfortable making the identification. Thanks again, Drmies (talk) 19:02, 8 October 2020 (UTC)[reply]

  Ivanvector, all are interested in Balkans topics (looks like a pro-Serbian viewpoint) and I see some similar linguistic peculiarities in edit summaries shared between Theonewithreason and Cobalton (habit of putting commas after the space instead of before, referring to policies in edit summaries like "WP:Personal attacks" without making them links). I would say there is a reasonable amount of behavioral overlap. GeneralNotability (talk) 19:08, 8 October 2020 (UTC)[reply]

  Sorry, I guess what I should have said is that all of these accounts are definitely being operated by the same person, so  Confirmed. The question open to opinions is whether they're actually violating policies (other than WP:LOUTSOCK, which they absolutely are). I think what Drmies is alluding to is that we normally don't disclose connections unless there's an enforcement reason to do so, and our policy does allow operating separate accounts as long as doing so doesn't violate anything under WP:ILLEGIT, so both of us were hesitant to connect any other accounts here. On the other hand, the same policy strongly recommends that any users deciding to do this clearly disclose their alternate accounts, either publicly or by contacting Arbcom (WP:ALTACCN). They've not done so publicly, at least, and if they did contact Arbcom then they can contact Arbcom again and they'll decide what to do. Based on the facts in front of me, the fact that they're editing maybe not the same articles but definitely articles in the same narrow subject area, as well as editing logged out and that they appear to be working with VJ-Yugo (a very long-term POV pusher and sockmaster) suggests that this is deliberate abuse of multiple accounts. I think I just needed to write this out to get my thoughts straight, but also what Maleschreiber just added is pretty convincing behavioural analysis.

  I'm fine with blocking all of the accounts and sleepers, unless one of you thinks I missed some reason not to. Ivanvector (^Talk/_Edits) 19:50, 8 October 2020 (UTC)[reply]

  Ivanvector, I recommend going for a block, per all of the evidence above, especially the part where they seem to be cooperating with a longtime sockmaster. My gut feeling is that the multiple accounts are being used to evade scrutiny in some way, they've definitely edit-warred on more than one account. Since I can't see where they're editing logged-out I can't say whether the logged-out editing is accidental or intentional. GeneralNotability (talk) 21:54, 8 October 2020 (UTC)[reply]

  I agree that Maleschreiber lays the case out nicely. Ivanvector, one of my doubts was related to a minor technical difference, and it was very minor. Ivanvector, I'm fine with indef blocks for all. Drmies (talk) 22:16, 8 October 2020 (UTC)[reply]

   Done, all confirmed accounts  Blocked and tagged. I did not modify the master's block. Ivanvector (^Talk/_Edits) 12:01, 9 October 2020 (UTC)[reply]

• JohnGotten (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

• This is the second report which I file about Theonewithreason's activity. As a result of the first one, Cobalton (talk · contribs · deleted contribs · logs · filter log · block user · block log) and RuStr12 (talk · contribs · deleted contribs · logs · filter log · block user · block log) as well as several IPs linked to VJ-Yugo (talk · contribs · deleted contribs · logs · filter log · block user · block log) were blocked. The JohnGotten account was created on August 4 and was inactive until October 21 when it made its first edit on [5]. During that time the other accounts were active. They were blocked a couple of weeks ago. In addition to that, many of the articles which JohnGotten edited required autoconfirmed status which was enabled on October 24. These conditions explain the activity gap between registration and the account's first edit.
• Just like Cobalton and Theonewithreason, JohnGotten edits minor Montenegrin subjects and topics which are related to Serbs in Croatia. JohnGotten's first edit [6] on October 21

involved a Montenegrin figure and the "claim" that they were a Serb - just like Cobalton was claiming that Vasojevići (a tribe of Montenegro were Serbs) and Theonewithreason was doing on Drobnjaci (another tribe of Montenegro). When I spotted that first edit of JohnGotten I became suspicious and then I reverted the article to its stable version. 22 minutes later Theonewithreason reverted me. The only three editors who have edited that page in the past 5-6 months are: JohnGotten, Theonewithreason and I. The JohnGotten account immediately after becoming active began to edit-war against the same editors as Theonewithreason and Cobalton before their block. It strongly indicates that this is not a new editor.

• VJ-Yugo's IPs which were also connected with the previous report before getting blocked were active in some very fringe POV pushing on Flag of Serbia[7]. This very obscure fringe narrative which they were putting forward a month ago is the same exact version of the article as the one which JohnGotten wrote on the Portuguese wikipedia on October 21[8] In fact the first revision was a copy/paste of that version in English[9] That cannot be a coincidence. The editor was aware of that dispute, of the fact that that fringe narrative couldn't be promoted anymore on en wiki so they tried to add it somewhere else.
• More details about the activity of these accounts are in the previous report. Another element which the previous and the new accounts have in common is their use of WP:PRIMARY sources and edit-warring about their inclusion without secondary sources. JohnGotten is blocked right now, partially because of editing activity on Serbia and Cobalton's entire editing history involved edit warring about primary sources[10] (more in the previous report)
• Another report which I filed a week ago was closed at that time as having insufficient evidence for CU only for the account to be blocked a few days later [11]. I hope that the above suffice for a CU about Theonewithreason and also about all the possible links to VJ-Yugo which the previous report revealed.

@GeneralNotability:@Ivanvector:@Drmies: who oversaw the previous report. @Peacemaker67: who has done much of the cleanup in the aftermath of many of the VJ-Yugo Ip edits. Maleschreiber (talk) 04:12, 26 October 2020 (UTC)[reply]

I have blocked this one for disruption for 31 hours, but there do appear to be behavioural similarities and consider it worth CUing. Peacemaker67 (click to talk to me) 06:15, 26 October 2020 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I made one edit on Ivan Crnojevic page supported with a source from Britannica (which I believe is not a WP:PRIMARY) and my edits are minimal on wikipedia because I dont have time for that as you can see on my contribution page, you cannot connect me with every user on eng wikipedia that contradicts User Maleschreiber edits because the list would be too long, the User constantly makes controversial edits on Balkan related subjects.

Also it would be fair that someone else (there must be other administrators) makes an investigation since as you can see I am not a JohnGotten account and last time I was blocked so fast I could not respond. I need time because of my working hours. I am happy to answer any question you have and to cooperate to prove that I am not JohnGotten. This harassment needs to stop. User:Theonewithreason (talk) 07:29, 26. October 2020 (UTC)

[moved comment addressed to Ivanvector]

Well thank you ,glad it is cleared and you are right I am not experienced editor, but as you can see I am not in any sort of edit warring, made one edit without any reverting and supported by source britannica.User:Theonewithreason (talk) 13:29, 26. October 2020 (UTC)

• User:Theonewithreason, I think you need to listen more carefully to what editors and administrators are telling you here. Drmies (talk) 16:40, 26 October 2020 (UTC)[reply]

Well I am trying. But you are not helping too. Since my last block I was not in any edit warring, and yet again I was a reported. I do not wish to be part of disruptive editing, I am trying to understand few things here, but as far as I can see I am not the only one who has problems, so maybe a little help wouldn't be too much to ask. User:Theonewithreason (talk) 26. October 2020 (UTC)

• JohnGotten is  Unrelated to both Theonewithreason and VJ-Yugo, but has also been editing logged-out (not since being blocked as far as I can tell). Anti-Serb sentiment semi-protected for 1 month. Courtesy ping Peacemaker67.

@Theonewithreason: you were blocked after the last investigation because it was found that you were using multiple accounts against policy, and we don't entertain explanations for that. As long as you stay logged in to one account while you're editing from now on you won't get in trouble again for sockpuppetry. But mind our other editing policies, especially no edit warring, bold-revert-discuss and discussion is required. You're right that other users will be suspicious of you because you've abused multiple accounts in the past, and you're editing a topic that as Deepfriedokra explained last week tends to attract editors who want to promote their nationalist agenda rather than contribute constructively, so many experienced editors are already suspicious of newcomers in that topic. I don't mean to discourage you, but for example your use of Britannica as a source suggests your heart is in the right place but perhaps you should gain experience editing less controversial topics that interest you, at least until you get more familiar with Wikipedia culture.

Closing. Ivanvector (^Talk/_Edits) 13:41, 26 October 2020 (UTC)[reply]

• 2804:14D:AE84:9CAD:616C:D33E:2C28:198A (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

The user is clearly avoiding block by these IP ranges 2804:14D:AE84:85E3:0:0:0:0/64 and 2804:14D:AE84:9CAD:0:0:0:0/64, possibly others. Most of the pages the anon edited, the history page shows "Theonewithreason" edited too. The clearest sample is Vukašin Mandrapa edits between blocked anon in November 2022 [12] [13] [14] - consecutive . Most of their edit summaries are also identical. I would provide a better EditorInteractionAnalyser link, but I don't know if it could show IP ranges. One could also suspect Serbian POV editing, edit warring and dodgy behaviour resulting in multiple previous sockpuppetry investigations. Pelmeen10 (talk) 02:55, 20 March 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Check declined by a checkuser - CheckUser won't be used to connect an account to an IP address. Callanecc (talk • contribs • logs) 09:53, 22 March 2023 (UTC)[reply]
• Still looking through evidence. The IPv6 ranges could be ΝικόλαοΚαλλιρρόη (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), who is tagged as JohnGotten. MarioGom (talk) 21:35, 14 April 2023 (UTC)[reply]
• 200.137.75.2 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) also seems to be related to Theonewithreason and/or the IPs, and has interesting behavioral similarities to Theonewithreason ([15][16]). MarioGom (talk) 10:07, 15 April 2023 (UTC)[reply]
• There is a pretty deep rabbit-hole here. Socking seems widespread in this topic area, and I can note behavioral similarities to various IP ranges and past socks. But these similarities could be (partially?) attributed to the way editors imitate each other when they participate in the same topic area for a long time.  Closing without action without prejudice of reporting again if there is clearer evidence. MarioGom (talk) 10:53, 15 April 2023 (UTC)[reply]