Wikipedia:Sockpuppet investigations/Bretthuk72/Archive

09 July 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

I noticed Acorn was banned for a COI. This IP admits to a COI. Certainly seems suspect being the COI's are the same and the work in this area took place in such a close time period. Looks like a duck to me. Not sure if it's a mallard or a meatpuppet. -Serialjoepsycho- (talk) 01:18, 9 July 2015 (UTC)
 * IP's language that they will move on to another client suggests to me that they may possibly have other accounts. -Serialjoepsycho- (talk) 05:24, 9 July 2015 (UTC)




 * User compare report Auto-generated every hour.
 * Editor interaction utility

There is a very strange campaign running, probably under the control of the alleged sockmaster, to enhance the rather limited notability of Acorn Mobility, an article which has been edited extensively by single purpose IP editors. My suspicion is that we have a mixture of sockpuppets and meat puppets, probably operating through proxy servers, and possibly from paid editors. The linguistic abilities of one IP editor suggests the Asian subcontinent, an area where less scrupulous paid editors use proxy servers to appear to be different individuals. My feeling is that the sock/meat 'army' has been recruited by the alleged sockmaster or his org to enhance the reputation of the org.

It is worth examining Articles for deletion/Acorn Mobility as well, to see the campaign being waged by what I believe to be sock/meat puppet IPs

To be fair, I'm not sure whether a report for sock puppetry is the right home for this, though it is, in my view, sockpuppetry. It seems to me to be initial evidence of a pervasive usage of proxy or similar style servers to create spam on Wikipedia. Those who investigate sock puppetry should, please, consider the wider implications of this little nest of vipers.

Because these are IP addresses and "seem" separate (WHOIS records) I am not requesting checkuser help. However a judgement should be made on whether this will aid the investigation.

There are, however, two very close edits to the AfD by 'different' IP editors Finding the diffs is hard, so forgive me if I quote them here instead:

ONE: Special note: advertising and promotion Advertising is prohibited as an official Wikipedia policy. Advertising should be removed by following these steps, in order: 1. Clean up per Wikipedia:NPOV 2. Erase remaining advertising content from the article 3. Delete the article by listing it at Wikipedia:Articles for deletion if no notable content remains. Why did we go straight to step 3 ? 99.232.13.165 (talk) 21:59, 8 July 2015 (UTC)

and TWO Special note: advertising and promotion Advertising is prohibited as an official Wikipedia policy. Advertising should be removed by following these steps, in order: 1. Clean up per Wikipedia:NPOV 2. Erase remaining advertising content from the article 3. Delete the article by listing it at Wikipedia:Articles for deletion if no notable content remains. Protocol not been followed here guys needs to pass steps 1 and 2 first43.245.164.116 (talk) 09:01, 9 July 2015 (UTC)

The majority of the evidence is at the AFD where there appear to be attempts at vote stacking and/or tag teaming to answer opinions for deletion by experienced editors Fiddle   Faddle  17:47, 9 July 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Checkusers will not tie named accounts to IPs unless the abuse is severe enough to justify a responce of an elevated nature. This case does not justify that. — Jeremy  v^_^v  Bori! 18:05, 9 July 2015 (UTC)
 * Indeed not. However, if this is part of a trend it is disturbing. This is why I think this may be more than a pure matter of sockpuppetry, and may be the tip of an unpleasant iceberg. Fiddle   Faddle  18:58, 9 July 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Is it possible for an admin to check if those IPs are some proxy servers or something like that? They are all engaged in promoting Acorn.  Vanjagenije  (talk)  23:01, 9 July 2015 (UTC)
 * 213.229.101.59 and 43.245.164.116 are proxy servers, both operated by the same company, and both working on port 23502, while 99.232.13.165 is a Virtual private network. In view of their editing history, together with that of "Acorn Publications", I have no doubt that they have been used both to evade Acorn Publications's block, and to give the spurious impression of independent support in the AfD discussion, so I have blocked them for a while. (I have also found evidence that 213.229.69.46 may have been previously used for IP-sockpuppetry by another editor.) I am still investigating the two other IP addresses. I have got as far as finding that 80.193.74.227 has several open ports, so it may well be a proxy, and possibly even an open proxy, but I can't tell yet. The editor who uses the pseudonym "JamesBWatson" (talk) 11:04, 10 July 2015 (UTC)
 * Well, it turns out that the identity of 80.193.74.227 can be found by a much quicker and easier method than checking for open ports and such like. From a combination of information from whatismyipaddress.com and whois.domaintools.com, I learn that the IP address is allocated to a host named "ms.acornstairlifts.com" on a network named "ACORN-MOBILITY-SERVICES". 86.168.159.176 geolocates to the city in which Acorn Mobility is based, so again, together with the behavioural evidence I think that's enough. However, neither of those two IP addresses has been used while the account has been blocked, nor have they edited the AfD page, so I can't see that there has been any abusive use of them and so I see no justification for blocking either of them. The editor who uses the pseudonym "JamesBWatson" (talk) 11:35, 10 July 2015 (UTC)
 * This case is a little confusing. This SPI was opened on 9 July. But than, on 10 July, user account was renamed to  (see the log). 13 minutes alter, new account, again named Acorn Publications was created, and than blocked by you. Now, who is the sockmaster here? Original Acorn Publications or the new one?  Vanjagenije   (talk)  21:32, 10 July 2015 (UTC)
 * That's an interesting point, which I hadn't thought of. The answer is that it's the original account, so I guess the SPI should probably be moved from Sockpuppet investigations/Acorn Publications to Sockpuppet investigations/Bretthuk72. The editor who uses the pseudonym "JamesBWatson" (talk) 09:38, 11 July 2015 (UTC)
 * In that case, do we need some action against ?  Vanjagenije  (talk)  09:48, 11 July 2015 (UTC)
 * In my opinion, no. Bretthuk72 is a perfectly good-faith editor who, like most new editors, came here not knowing Wikipedia's guidelines and policies. At least one of the IP addresses seems to have been used by someone acting as a consultant for Acorn Mobility, probably appointed to act for the company in good faith, not realising that doing so would be regarded as meatpuppetry, and contrary to Wikipedia policy. Other IP addresses may have been used by either Bretthuk72 or someone else working for Acorn Mobility while Bretthuk72 was blocked, but again, probably without realising that this would be regarded as illicit block-evasion. Since Ritchie333 lifted the block on Bretthuk72, Bretthuk72 has clearly been making every effort to edit within Wikipedia's conflict of interest guidelines, and I don't think anything useful would be achieved by taking any further action on the basis of mistakes which were, I think, perfectly understandable for an editor new to Wikipedia, and which are now in the past. The editor who uses the pseudonym "JamesBWatson" (talk) 10:17, 11 July 2015 (UTC)