Wikipedia:Sockpuppet investigations/42isthedefiniteanswer/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Several behavioral red flags including possible account takeover followed by probable undeclared paid editing by the master, who was blocked for covert advertising, then article began to be edited a couple days later by the suspected sock, at the time an incompletely-declared paid editor  who has been blocked for using proxy. The suspected sock has refused had refused to provide removed a link to their putative Upwork account with which the actual timeline of the job can be established. But from the multiple articles created by the master (WP:COIN) it’s clearly a package around an organization and probably PR around a book being published.

There are more specific concerns about job board identity misappropriation – at least confusion over who took which job and when – noted by

Bottom line This is a mess due to the account operators' own malfeasance. The checkuser is required to determine whether this is a genuine disclosed paid editor, or just a continuation of the blocked master. Especially important since they are asking for an unblock and will undoubtedly continue editing the master's draftified articles, seeking payment for them. ☆ Bri (talk) 17:14, 5 May 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

As per the Upwork advert, a freelancer from a different continent than what was hired to create these pages so, I don't think we are going to see any technical relation, but it will be helpful to see if there are more accounts in their sock drawers. Since these freelancers are known for sub-contracting others and some of them even have a group of freelancers who operate accounts from different countries and states WP:MEAT is possible in this case. GSS &#x202F;&#128172; 04:50, 6 May 2020 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Technical evidence sheds some doubts on Charmanderblue's Upwork profile and it's not possible to make a technical connection between Wikipedia and other websites anyway, but based on all available evidence Charmanderblue is strongly . Regardless, they will need to disable their anonymizing proxy if they are unblocked.
 * for 42isthedefiniteanswer, formerly known as User:GeorgeTopouria. It is likely this account is compromised. Ivanvector (Talk/Edits) 14:50, 6 May 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

It looks like the emailed evidence changed the admins' minds, and now Charmanderblue is tagged as a sock. Just wanted to get that fact entered into the SPI so that the records pointing from the account tag to the SPI are consistent. ☆ Bri (talk) 15:06, 7 May 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Nothing to do here. Sir Sputnik (talk) 22:47, 7 May 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Khurspak was registered the same day Charmanderblue was blocked and created User:Khurspak/sandbox for which Charmanderblue was hired and Alejo Pidal created the same in draftspace (Draft:Marti Buckley) today with almost the same contents. GSS &#x202F;&#128172; 18:37, 19 May 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
 
 * the connection between Draft:Marti Buckley and User:Khurspak/sandbox certainly seems like enough to block them on behavior, but also worth CU to confirm and see what else it finds. -- RoySmith (talk) 20:00, 19 May 2020 (UTC)
 * Blocked this lot on a proxy. I can't tell if Khurspak's IP is a proxy or not, if it isn't, it's ❌. So take that as you will. -- Amanda  (aka DQ) 01:51, 20 May 2020 (UTC)
 * ^  The SandDoctor  Talk 14:22, 20 May 2020 (UTC)
 * I'm not sure where that leaves us with Khurspak. I'm assuming DQ's "take that as you will" means to evaluate based on behavior, in which case I'd say User:Khurspak/sandbox is pretty good evidence of sock/meat behavior, but unclear what the next step would be.  Block? Uw-agf-sock?  -- RoySmith (talk) 14:39, 20 May 2020 (UTC)
 * , yeah it's effectively a behavioural evidence needs evaluation. As we're saying that Khurspak is either a sock (and using a proxy) or a meatpuppet (and not using a proxy) of a blocked master, the sock (Khurspak) is then also indefinitely blocked. Callanecc (talk • contribs • logs) 09:04, 22 May 2020 (UTC)
 * Blocking Khurspak. G5 User:Khurspak/sandbox.  Closing. -- RoySmith (talk) 13:16, 22 May 2020 (UTC)