Wikipedia:Long-term abuse/Bugmenot123123123

Bugmenot123123123, BMN123

Wikilifespan	2016–present
ISP	St. Louis Community College (STLCC); St. Louis Public Library; numerous others
Known IPs	12.28.52.123; 71.14.221.120; many open proxies; P2P proxies; residential proxies probably using a subscription service of some kind
Instructions	Most cases can be reported to WP:AIV on sight, for more complex cases link the WP:ANI / WP:AN3 reports to this long-term abuse page. For crosswiki abuse, consider reporting to SRG for lock-evasion.
Status	Active

A prolific sockmaster primarily focused on Cyber Anakin. BMN123 has been repeatedly blocked since 2017, and was globally locked in 2018 for crosswiki abuse.

Basic Information

Bugmenot123123123 (talk · contribs · block log · arb · SPI ^confirmed _suspected)

Comprehensive edits analysis

Normally edits through proxies with occasional throwaway sock accounts. Mainspace edits usually add extraneous, poorly sourced, and sometimes outright unsourced material relating to Cyber Anakin. Talk page edits attempt to justify the additions through specious references to essays or PAGs. When these edits are challenged or reverted a long-term pattern of on, off, and cross-wiki harassment against the responsible editors commences.

Consensus has uniformly been against these additions (for a sample see 1,2,3,4). Once discussions conclude BMN123 archives them and attempts to conceal them by noindexing the archive pages; Sometimes discussions are just blanked instead. In order to disguise these targets individual proxy IPs will also archive or remove discussions on unrelated pages. Attempts to add the rejected material to the article continue with the sockmaster edit-warring through multiple proxies.

Targeted areas, pages, themes

Cyber Anakin as well as the larger Anonymous (hacker group) topic area; from 2022 the Space Race topic area has also been frequently targeted although sporadic edits there were already occurring there from 2016.

Habitual behavior

BMN123 canvasses extensively onwiki, offwiki, and crosswiki, changing proxies frequently and using external rather than normal links (to avoid backlinking) in an attempt to conceal its extent, often seeding in random editors among those targeted as likely supporters.

Edits to Cyber Anakin focus on maintaining the sockmaster's preferred narrative. They will edit-war (Special:Diff/1113301828, Special:Diff/1112087106) and leave long rambling talk page posts (Special:Diff/1113134519, Special:Diff/1112288532) in effort to restore their preferred version when it is disturbed, occasionally leaving warning templates on the talk pages of people who revert them (Special:Diff/1112090413).

Edits on other Anonymous area pages attempt to spam mentions of Cyber Anakin or incidents associated with Cyber Anakin everywhere (Special:Diff/1082332024, Special:Diff/757938463) subsequently edit-warring to retain them (Special:Diff/1117016182 Special:Diff/757940419). In an unblock request they outright stated their intent to spam Cyber Anakin across many pages (Special:Permalink/1117032979#Request_to_downgrade_block_to_partial_block_of_some_pages).

Edits to Space Race articles attempt to add content stating either that Yuri Gagarin was not the first man in space or that he did not complete a spaceflight Special:Diff/1096114678 Special:Diff/1097370928 often these use the sockmaster's own WP:SYNTHy interpretation of primary sources. As with the Cyber Anakin edits, there has been a clear consensus against theses additions whenever discussed (one example).

Archive edits almost all consist of attempts to blank Special:Diff/1120129888 or NOINDEX Special:Diff/1125730289 pages, they even attempt to blank discussions prior to archival Special:Diff/759687688, occasionally more complex disruption occurs (example).

Once an editor catches their patterns and begins to revert them consistently they begin a persistent campaign of harassment in an attempt to drive the editor off or get them blocked; in some cases the pattern has persisted for years.

The sockmaster does not like being associated with earlier accounts or having his socks tagged and may attempt to remove tags from socks or add messages suggesting a voluntary departure or the use of meatpuppets instead. The sockmaster has also attempted to add fake death notices to previous acounts to avoid being associated with them.

The LTA page you're currently reading has been repeatedly ([1], [2], [3], [4]) blanked by IP addresses, as well as redirected to the sockpuppet investigation casepage archive and then suggested that the redirect be brought to MfD for staleness.

Recommendations

• Block currently active sock IPs on sight, usually they are sufficiently obvious that an AIV report will suffice (consider linking this LTA page). In more complex cases an ANI may be necessary. All IPs should be reported to WPOP for investigation as they are usually proxies unless assigned to public St. Louis networks. Residential proxy networks are sometimes used so port scans may be innefective; IPQualityScore, Spur, and the stalktoy should be consulted.
• In cases of crosswiki abuse consider reporting to SRG or #wikimedia-stewards ^connect as BMN123 is evading a global lock.
• Semi-protect pages if disruption persists; the sockmaster has claimed access to unlimited proxies [5] and past activity suggests that whatever services they are using do indeed have sizable pools available.
• Do not engage in discussions as they are huge time sinks and may cause you to become one of their targets for harassment.
• Do not leave vandal warnings per WP:DENY; leaving them may also cause you to become one of their targets for harassment.
• If case of severe harassment consider contacting Trust and Safety (cawikimedia.org).

Other Comments

BugMeNot is a service that allows users to share accounts; while it presently restricts accounts from being listed under Wikipedia.org they can still be found listed under aliases or other Wikimedia wikis. Bugmenot123123123 was likely neither created by the sockmaster nor their oldest account just the earliest known to have been extensively used. Wizzak was also compromised using that service and it's likely some other accounts were as well.

It is possible that more than one editor is responsible. They've directly claimed to have hired others to edit [6] and have posted on and off-wiki attempting to form a dirty tricks cabal [7]. Regardless policy is clear that when there is uncertainty whether a party is one user with sockpuppets or several users with similar editing habits they may be treated as one user with sockpuppets so the detail is not particularly important.

They've also shown on ability to trick journalists from some marginally reliable sources to defame Wikipedia editors and subsequently post the ultimately self-sourced statements in mainspace as part of their harassment campaign.

Their two areas of interest may seem odd, but an old reddit post helps to understand the connection [8].

Users Familiar

Please contact one of these users if you are looking for more information about giveaways/behavioral tells, history, etc.

• Sideswipe9th (talk)
• Softlemonades (talk)
• GeneralNotability (talk)
• Drmies (talk)