Wikipedia:Sockpuppet investigations/Bamanh27/Archive

19 July 2011

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Bamanh27 created the article, which apparently is a paid for article. Bamanh27 then removed the COI tag placed on it by another editor. When the COI tag was re-added, DME2010, Cottreda and Pcola30 all removed it again at least once each. Their edit summaries are quite similar to each other. On Talk:Laura Stack where they are defending the removal of the tag, all of them except Bamanh27 use an unusual style of formatting (replies indented but signatures not). Bamanh27 has very few edits outside this topic, the others have no edits outside this topic. --Demiurge1000 (talk) 17:23, 19 July 2011 (UTC)
 * Add - Pcola30 has also been removing a COI tag from which Bamanh27 created. --Demiurge1000 (talk) 17:26, 19 July 2011 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
It seems that all of four of these named accounts are ❌ to each other. TN X Man 17:41, 19 July 2011 (UTC)
 * Actually, I'm overruling the checkuser on this. Per behavioral evidence I've blocked all three socks. —  Hello Annyong  (say whaaat?!) 01:58, 20 July 2011 (UTC)

29 May 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Evidence is external to Wikipedia (it's on Elance), so I'm unsure if it's reliable. In June 2011 an Elance contractor was hired to create a page for Sahpreem A. King. That page was created by User:Bamanh27 in July. The same Elance contractor was hired again to create a page for Jon Gordon. This page was created by User:SunLover77, which is a new account created on the same day as the article was. I brought this issue to WP:ANI and a user recommended I request a SPI for sockpuppets and sleepers. LawrenceDuncan (talk) 21:24, 29 May 2012 (UTC)


 * Update After SunLover77 was blocked, WestCoast91 (a new account) made these changes to the article that SunLover77 created. WestCoast91 uses same citation style as SunLover. Username based on a similar format. Block evasion? LawrenceDuncan (talk) 02:05, 31 May 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Permalink to ANI discussion. ​—DoRD (talk)​ 22:34, 30 May 2012 (UTC)
 * Nothing else to report via CU, the technical evidence is irrelevant anyway. Please also consider my comment at ANI here. WilliamH (talk) 23:03, 30 May 2012 (UTC)
 * Definite block evasion. WestCoast91 blocked. WilliamH (talk) 12:08, 31 May 2012 (UTC)

17 August 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Bamanh27 was blocked for misuse of accounts after it was found that the user was employing them to create and protect articles sourced from Elance. The same Elance user has continued to accept contracts to create articles on WP, and has been paid for the work, so unfortunately it seems that he has been contining to edit here. The target articles for four of those new (post block) contracts were:


 * Logistics Bureau
 * Paul Davis (Irish author)
 * James F. Capalino
 * Amateur Ballplayers League

The articles were created by: OrganizedGuy ; 2012BizStudent ; and RonnieSoftball48, and they are the sole significant editors of the four articles. Thus they look pretty certain to be the socks that were used.

In addition, there were three more WP contracts that I was unable to identify, and a possibility of a couple more. As he seems to be generally using one account per contract, I guess that means that there may be at least three more accounts floating around.

Due to the risk of outing, I can't pass along the off-wiki links here, but if needed I have them to send to a checkuser. Bilby (talk) 04:35, 17 August 2012 (UTC)


 * I've sent an email. :) As mentioned there, this is a bit tricky, as a real name was used off-wiki and I don't want to out the editor. In regard to an on-wiki pattern:


 * Each of the three new editors made, as their first edit, a one-line userpage:
 * They then made a short series of edits to topics related to the target article, before creating the new article. The edits made no real changes to content, but were mostly to remove broken or dead links - pretty much the same pattern as with the confirmed sock, and similar to.
 * These early edits all use the same basic edit summaries: "removed dead link", "dead link" or just "removed broken link"  including on the older accounts.
 * The article itself is created in a single edit each time, with full wiki markup and full handcoded inline refs not using the ref templates.
 * Each editor then makes a few more edits to remove dead/broken links before ceasing to edit.


 * I'm not sure if that was what you were looking for, but hopefully with offwiki links in the email that may help. To be honest, I'm always impressed by and agree with the caution of checkusers in regard to SPIs, so no problems if there isn't enough to proceed, but I'll provide anything that I have that may help. :) - Bilby (talk) 03:43, 20 August 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - - The methods and styles are so common that there is little doubt a link of some kind exists.  Requesting a CU with sleeper based upon the history of Elance socks. Dennis Brown -  2&cent;    &copy;   Join WER 13:56, 19 August 2012 (UTC)
 * - I don't see all the connections I need to see, all though I do see some. Another CU may disagree with me, but I like to play it safe. There is also a fine line between paid editing and sockpuppet, of which one I would check, and the other I couldn't. If you want to list a decent map that connects the dots, my email is open to you. Also any behavoir evidence, such as similar type edits, given in diffs would help your case. -- DQ  (ʞlɐʇ)  02:08, 20 August 2012 (UTC)
 * Several Webhosts --  DQ  (ʞlɐʇ)  15:58, 24 August 2012 (UTC)
 * With that, I think that this can be closed. ​—DoRD (talk)​ 20:12, 27 August 2012 (UTC)

09 May 2015

 * Suspected sockpuppets
 * (original master for this and following cases)


 * User compare report Auto-generated every hour.
 * Editor interaction utility

1) Operator of BiH has been moving many articles a few minutes after their creation by other users to proper capitalization. Examples:

This could be from newpage patrolling, but combined with evidence below, the highly focused nature of the moved pages, and the transient nature of the creating editors, it looks bad.
 * [//en.wikipedia.org/w/index.php?title=Kashmora&diff=658951921&oldid=658951836], one minute after creation
 * [//en.wikipedia.org/w/index.php?title=Kerrelyn_Sparks&diff=649951901&oldid=649951769], two minutes after creation
 * [//en.wikipedia.org/w/index.php?title=Except_the_Dying_(novel)&diff=651048774&oldid=651047942], six minutes after creation
 * [//en.wikipedia.org/w/index.php?title=Excellence_Canada&diff=659558043&oldid=659555759], <20 minutes after creation
 * [//en.wikipedia.org/w/index.php?title=Recycled_diamond&diff=653326162&oldid=653326124]

2) Account's "workshop" subpages also have a bad smell, with rapid creation of multiple likely PR-seeking (corp/celebrity) articles at a pace unlikely for one innocent editor. Here's a non-exhaustive list; timestamp of last edit is given: Apparently, each "workshop" is edited, contents moved to article space, blanked, then abandoned with a remarkably repeatable process. This is by the way in addition to at least a dozen other corp articles BiH created since January this year, listed at User:Brianhe/COIbox2.
 * User:BiH/Workshop15 19 December 2014 → AdSparx
 * User:BiH/Workshop17 13 January 2015 → Kiwi Time
 * User:BiH/Workshop18 19 January 2015 → Kourtney Compton
 * User:BiH/Workshop20 24 January 2015 → Planview
 * User:BiH/Workshop21 31 January 2015 → Fernox
 * User:BiH/Workshop12 2 March 2015 → Coresystems
 * User:BiH/Workshop25 12 March 2015‎ → Carol Margolis
 * User:BiH/Workshop10 8 April 2015 → PhoneSheriff
 * User:BiH/Workshop14 16 April 2015 → Pet Circle
 * User:BiH/Workshop19 19 April 2015 → Frame Destination

3) A particularly fishy case over a single article, Pixelmatic, where BiH rescued an abandoned article from another user's blanked sandbox:
 * [//en.wikipedia.org/w/index.php?title=User:Swdandap/sandbox&diff=next&oldid=586310431 blanked] by Swdandap
 * [//en.wikipedia.org/w/index.php?title=Pixelmatic&oldid=600023772 created] Pixelmatic created months later, without attribution

This has the feel of a factory for paid editing with probable involvement of other accounts. Those listed in this case are just a sample. Brianhe (talk) 04:37, 9 May 2015 (UTC)

4) Added one or more SPAs who quickly took over articles started by the sockmaster, e.g. [//en.wikipedia.org/w/index.php?title=David_W._Lowry&diff=599124227&oldid=599091317], [//en.wikipedia.org/w/index.php?title=LLamasoft&diff=593732053&oldid=593717955], [//en.wikipedia.org/w/index.php?title=User:BiH/HireJungle&diff=570679016&oldid=570664259]

Additional evidence (4) signed Brianhe (talk) 07:26, 9 May 2015 (UTC) 5) Articles for deletion/Coupay should be self explanatory. Brianhe (talk) 07:45, 9 May 2015 (UTC)

6) Any editors who collaborated in any of the workshops listed above should be considered (potential) sockpuppets, example [//en.wikipedia.org/w/index.php?title=User:BiH/Workshop11&diff=636809431&oldid=636785141], [//en.wikipedia.org/w/index.php?title=User:BiH/Workshop23&diff=642199195&oldid=641983925]

Additional evidence (6) signed Brianhe (talk) 08:46, 9 May 2015 (UTC)

7) Added user Herzlicheboy (a blocked sock account) on the strength of co-involvement in The Mutiny Hotel, another article that has a strong odor of COI about it. — Brianhe (talk) 00:19, 10 May 2015 (UTC)

8) Added user Aksnahar, [//en.wikipedia.org/w/index.php?title=Dr._Samieh_Rizk&oldid=615102687 created] Dr. Samieh Rizk from User:BiH/Samieh Rizk created by BiH about a month earlier. Brianhe (talk) 00:27, 10 May 2015 (UTC)

Another note, this username came up in a COI investigation furball that ended up spawning another SPI in October 2014. — Brianhe (talk) 03:16, 10 May 2015 (UTC)

@Bbb23 The Mutiny Hotel was [//en.wikipedia.org/w/index.php?title=The_Mutiny_Hotel&oldid=576540428 created] by Herzlicheboy in 2013, expanded by BiH in 2015 into something quite different; now up for deletion as promotional, even though toned down from the [//en.wikipedia.org/w/index.php?title=The_Mutiny_Hotel&oldid=649515516 brochure] that it was. It doesn't look like collaboration to me now, and their writing styles are quite different, I'm willing to say that was a mistake on my part. However I'd also like to point out that User:Brianhe/COIbox2 is now up to over 80 articles created by BiH, nearly all of which could be seen as promotional, and many are now up for deletion or already deleted, it was perhaps easy to cast too wide a net in this investigation. As for Rizk, I don't know exactly what was going on, but it seemed important to list an occurrence of the apparent connection, given the easy-to-see collaboration in BiH "Workshop" pages. I notice now that a Rizk article had been deleted earlier, so maybe they both had access to the deleted content with the intent to re-reference it and recreate the article? Without BiH's meaningful participation here it's all kind of speculative. Brianhe (talk) 16:14, 19 May 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Added IP 173.174.119.149, their only 2 edits are on Planview here and here. Joseph2302 (talk) 09:59, 17 May 2015 (UTC)


 * I have no connection whatsoever with these users mentioned above and CheckUser will confirm that. In my opinion, I was working on the legit articles with established notability with references being perhaps bad or weak in some of them, but other users have full right to challenge that and to remove or improve as such. I was expecting some constructive advice though. The way I was handled and tagged by User:Brianhe in his edit comments is not something I was expecting from a future admin. I was putting a lot of my time handling vandalism in recently created articles and with a lot of success, and that was somehow neglected and I was tagged as a spammer, vandal, disruptive, etc. --BiH (talk) 07:48, 19 May 2015 (UTC)
 * I am talking about unnecessary comments such as, I quote: "diamonds, a spammer's best friend", "London (IP) calling", etc. It's somewhat rude or let's say childish to accuse someone of being something without seeing the wider picture. However, I've seen that Brianhe has done the similar in the past, so I can understand the reaction. --BiH (talk) 13:14, 19 May 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - - This might be some kind of paid editing ring, not sure if they are same person, or a group of paid editors. Anyway, editing each other's "workshops" in the userspace is suspicious enough to run a CheckUser.  Vanjagenije   (talk)  19:36, 15 May 2015 (UTC)
 * Two questions. Could you please elaborate with diffs on your comment about Herzlicheboy? I don't follow it. Also, why would BiH nominate the Rizk article for speedy deletion if he was invested in the article for whatever reason? Could you please explain what you mean by Brianhe's "edit comments"? Thanks.--Bbb23 (talk) 12:28, 19 May 2015 (UTC)
 * My findings:
 * All of the non-stale accounts are ❌ to BiH. With the exception noted below, all of the accounts are ❌ to each other.
 * and are ✅. However, careful thought should be given to blocking either account. It's not clear their edits were disruptive. Moreover, the master edited only once, and then the sock took over and the master never edited again. They never edited together. However, the clerk and/or administrator who closes this SPI may do whatever they think appropriate.
 * In my view, there's no basis to block the IPs.
 * --Bbb23 (talk) 23:33, 20 May 2015 (UTC)
 * Closing without action as there seems to be no substantiated evidence of sock or meatpuppetry. In the case of Tocar, it is nothing malicious. I'm making no comment on the quality of BiH's contributions. If there is still a question about that, it should be handled elsewhere. Someguy1221 (talk) 04:32, 23 May 2015 (UTC)

14 September 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:BiH is a self declared paid editor of whose many paid creations have already been deleted or are currently under AfD and/or tagged for CSD. User has been indefinitely blocked on 14 September 2015 per ANI and closed by  here

User:Verbhg7 has made only 3 edits: all to Articles for deletion/Nextiva, an article created by BiH.   

User:Bigm07 has only edited Nextiva where among other edits they twice removed the AfD template  and and added Wikilinks to Nextiva at List of Arizona companies and List of corporations in Phoenix and List of unified communications companies and with fewer than 15 edits added themselves as a teahouse host

user:Walkeryh has made only 2 edits: Removal of AfD template at Nextiva and deletion of user votes

Kingglass 2 edits only, both to Articles for deletion/Nextiva at  and 2

User:Willi Joseph, ostensibly a paid editor 'working as a content creator' added Wikilinks to the Nextiva page, and created several promotional pages (since deleted). Kudpung กุดผึ้ง (talk) 22:25, 14 September 2015 (UTC)
 * Added Lily87h, SPA with exactly two edits: one at Maggie Szabo and one at Tomas Gorny, both created by BiH. It's also curious that several accounts are of the pattern h (including the possible sockmaster) or 7 and, in this case, 7h. — Brianhe (talk) 23:03, 14 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

The pattern of creating an account [//en.wikipedia.org/w/index.php?title=User:Willi_Joseph&oldid=588961145], which then goes dormant for months until needed to work on a COI-ful article [//en.wikipedia.org/w/index.php?title=Nextiva&diff=prev&oldid=674347216], is a screaming, flaming red flag. — Brianhe (talk) 22:45, 14 September 2015 (UTC)


 * Willi Joseph is pretty obviously a paid editor, but I doubt he's related to BiH or the others. His only edit to Nextiva was to add a link in the "See also" section to one of the articles he created . He did that to two other unrelated articles. However perhaps should be added to this SPI as a sock or meat of the various new editors listed above. His first edit was to Talk:Nextiva protesting the AFD. Note also this edit to Kudpung's talk page which he later removed. The style and gist are very similar to this one by Verbhg7 at the AfD. Voceditenore (talk) 23:05, 14 September 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
All blocked and tagged except Willi Joseph. Kudpung กุดผึ้ง (talk) 00:59, 15 September 2015 (UTC)
 * With respect to the declared paid work of any editor, I do not think we ought to delete declared paid articles except under our usual criteria. This is especially true if an individual is an undeclared editor trying to reform. At this point, if someone did that, we might find ourselves in a situation requiring us to delete all their future declared work regardless of merit, and this would be insanely counter-productive. Even automatically deleting their earlier undeclared work once they declared themselves would discourage any incentive to reform.  DGG ( talk ) 23:29, 14 September 2015 (UTC)
 * Group 1 – The following accounts are ✅ to each other and ❌ to BiH:
 * is to Group 1 and ❌ to BiH.
 * is ❌ to Group 1 and to BiH.--Bbb23 (talk) 23:41, 14 September 2015 (UTC)
 * is to Group 1 and ❌ to BiH.
 * is ❌ to Group 1 and to BiH.--Bbb23 (talk) 23:41, 14 September 2015 (UTC)
 * is to Group 1 and ❌ to BiH.
 * is ❌ to Group 1 and to BiH.--Bbb23 (talk) 23:41, 14 September 2015 (UTC)
 * is to Group 1 and ❌ to BiH.
 * is ❌ to Group 1 and to BiH.--Bbb23 (talk) 23:41, 14 September 2015 (UTC)
 * is ❌ to Group 1 and to BiH.--Bbb23 (talk) 23:41, 14 September 2015 (UTC)
 * I created a new case for this group at Sockpuppet investigations/Spamfree007. Closing this now.  Vanjagenije  (talk)  09:19, 15 September 2015 (UTC)

17 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Attempt at start some sock linkage between accounts User:BiH. Evidence:
 * promo only. Undisclosed COI. NOTHERE. poss sock of blocked User:BiH User:Arr4
 * Article overlap with User:Arr4 (a blocked sock of User:Orangemoody))
 * see connected on Talk:MSpy
 * History of EEE
 * Note doesn't list EEE as overlap (maybe too far apart).  Widefox ; talk 10:08, 17 September 2015 (UTC)

Comments by other users

 * Linguistic similarities/self disclosures suggest master and both Slavic lang family users. Sockpuppet farms have engaged in retaliatory deletions before; further info at WP:Conflict of interest/Noticeboard/Archive 87. Arr4 has engaged in, and admitted to, retaliatory blankings before [//en.wikipedia.org/w/index.php?title=Wikipedia:Conflict_of_interest/Noticeboard&diff=672391999&oldid=672364587]. Looked at in this light, his extensive SPI participation is suspicious as well.

Compare these two cases to see if retaliatory nomination fits the profile. I don't know whether Pudkovka is BiH or maybe a competitor but a checkuser for all parties is certainly indicated. — Brianhe (talk) 16:51, 17 September 2015 (UTC)
 * (blocked sock) noms creation of (suspected UPE) [//en.wikipedia.org/w/index.php?title=BankBazaar&diff=next&oldid=669342632]
 * (blocked Op. Orangemoody sock) noms creation of (this one) [//en.wikipedia.org/w/index.php?title=MSpy&diff=prev&oldid=617982920]

''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Added. Stick with me, this gets complex. Sandiselins is an SPA with suspicious involvement with mSpy [//en.wikipedia.org/w/index.php?title=MSpy&diff=prev&oldid=652046035] as well as Mobile Spy which is a creature of Retina-X Studios who also created PhoneSheriff. PhoneSheriff socking was one of the pieces of the BiH SPI that I was involved in, back in May. My working theory is there are two competing sockfarms trying to deny each other market share. This was hinted at in Arr4's [//en.wikipedia.org/w/index.php?title=Wikipedia:Conflict_of_interest/Noticeboard&diff=672391999&oldid=672364587 comment] and I think we should investigate. Recommend running checkuser against all accounts rounded up in the May SPI iteration. — Brianhe (talk) 16:59, 17 September 2015 (UTC)


 * I'm not knowledgable on Orangemoody, but a gut feeling is that your mental model may make more sense than this being Orangemoody sock. Don't even know if there's the same way of operating. Somehow overlapping on some articles - especially interesting EEE being a dab is interesting, don't know if helpful. I was advised to track the user activity in an SPI rather than on the (deleted) article and AfDs. Widefox ; talk 19:41, 17 September 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  17:12, 10 October 2015 (UTC) — Berean Hunter   (talk)  17:12, 10 October 2015 (UTC)
 * I've declined the CU request. First, this is reaching. Second, one of the accounts is, and the other has barely any edits, and none since July.--Bbb23 (talk) 22:35, 20 September 2015 (UTC)
 * Indeffing socks and closing.

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

New WP:SPA editing of, created by previous SPA puppet. Not tagged for CU, leaving that to clerk/admin discretion. Murph 9000 (talk) 11:29, 5 October 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * There are several phrases inserted into the article that match the contributions of previously blocked socks. BiH was originally blocked in part due to paid edits, so it's possible this could be a different editor paid to include similar phrases. Either they're the same person, in which case they should be blocked for sockpuppetry, or a different paid editor, in which case they should be blocked for TOU violations. Either way, blocked. ~ Rob 13 Talk 23:04, 29 October 2016 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Runforlimit505 made about 10 contributions to AfDs to get autoconfirmed, then removed controversy section from Miroslava Duma. Prior socks of User:BiH have done similarly. It appears likely that this is at the least UPE and I apologize if it would be more correct to report this elsewhere. Here's a diff from sock Plaxie, here the most recent edit. Russ Woodroofe (talk) 08:43, 13 June 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Obviously not Runforlimit505's first time on the dance floor. Following the same footsteps as other BiH socks & UPEs. Blocked, tagged, closing. Cabayi (talk) 11:15, 13 June 2020 (UTC)
 * , on the basis of 's tag on User:BiH, Special:Diff/903204466 and "off wiki evidence" this case and its archives need to merge to Bamanh27. Thanks to for catching that. Cabayi (talk) 13:59, 13 June 2020 (UTC)
 * Jaust to clarify: the whole BiH case should be merged into the Bamanh27 case?  Vanjagenije  (talk)  15:08, 18 June 2020 (UTC)
 * , yes, the whole lot. Thanks, Cabayi (talk) 15:30, 18 June 2020 (UTC)


 * Done, closing. Kevin ( aka L235 · t · c) 17:19, 21 June 2020 (UTC)