Wikipedia:Sockpuppet investigations/Chelsea232024/Archive

19 August 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

See this thread at AN for background. A company is advertising that they can add spam links to WP and Tzufun's edits are given as examples on the site. Here is an example edit. Their behavioural pattern is reference spamming and that thread lead to these non-stale accounts being located as possible socks. (More diffs to come). SmartSE (talk) 17:32, 19 August 2015 (UTC)


 * WilliamFinnHarrison is already blocked for spam and this edit at Ion exchange made me notice AdrenM29 as they made an reference spamming edit to the same article one day later. It was to a different site but a look through their contribs shows that almost all of their edits contained refspam.


 * The company also offers article writing services and User:Chess pointed out that EBY3221 (also already blocked) added a section to Mike Long about his internet marketing company http://www.omgmachines.com/. On this page there is a testimonial of an employee of the company recommending their services.


 * The last four are all SPAs that appeared on the 17-18th. Their first edits were to create a userpage and with their second edit they reference spammed. They do seem a bit different to the others but I think the similarities between them are pretty clear cut. Diffs of ref spam:   . If there were four accounts in 2 days the chances are there are more. SmartSE (talk) 17:59, 19 August 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * is.
 * Group 1 – The following accounts are ✅:
 * Group 2 – The following accounts are ✅ and ❌ to Group 1:
 * Group 3 – The following accounts are ✅ and ❌ to Groups 1 and 2:
 * Group 4 – The following accounts are ❌ to each other and to Groups 1, 2, and 3:
 * is to Group 1.
 * Group 1 is obviously the largest group. Therefore, a clerk or has to decide whether they should be tied behaviorally to Tzufun. If not, a separate SPI should be created with the oldest of the accounts. My own superficial analysis is the accounts do not relate to Tzufun. The other groups should remain here or in the new SPI created from Group 1. If those groups increase in the future, then a separate SPI can be created.--Bbb23 (talk) 07:58, 20 August 2015 (UTC)
 * Thanks for the check. I'll try to look at this more closely later on to see whether they match up. I've already found another suspicious one as well ( . SmartSE (talk) 10:10, 20 August 2015 (UTC)
 * Group 2 – The following accounts are ✅ and ❌ to Group 1:
 * Group 3 – The following accounts are ✅ and ❌ to Groups 1 and 2:
 * Group 4 – The following accounts are ❌ to each other and to Groups 1, 2, and 3:
 * is to Group 1.
 * Group 1 is obviously the largest group. Therefore, a clerk or has to decide whether they should be tied behaviorally to Tzufun. If not, a separate SPI should be created with the oldest of the accounts. My own superficial analysis is the accounts do not relate to Tzufun. The other groups should remain here or in the new SPI created from Group 1. If those groups increase in the future, then a separate SPI can be created.--Bbb23 (talk) 07:58, 20 August 2015 (UTC)
 * Thanks for the check. I'll try to look at this more closely later on to see whether they match up. I've already found another suspicious one as well ( . SmartSE (talk) 10:10, 20 August 2015 (UTC)
 * Group 3 – The following accounts are ✅ and ❌ to Groups 1 and 2:
 * Group 4 – The following accounts are ❌ to each other and to Groups 1, 2, and 3:
 * is to Group 1.
 * Group 1 is obviously the largest group. Therefore, a clerk or has to decide whether they should be tied behaviorally to Tzufun. If not, a separate SPI should be created with the oldest of the accounts. My own superficial analysis is the accounts do not relate to Tzufun. The other groups should remain here or in the new SPI created from Group 1. If those groups increase in the future, then a separate SPI can be created.--Bbb23 (talk) 07:58, 20 August 2015 (UTC)
 * Thanks for the check. I'll try to look at this more closely later on to see whether they match up. I've already found another suspicious one as well ( . SmartSE (talk) 10:10, 20 August 2015 (UTC)
 * Group 4 – The following accounts are ❌ to each other and to Groups 1, 2, and 3:
 * is to Group 1.
 * Group 1 is obviously the largest group. Therefore, a clerk or has to decide whether they should be tied behaviorally to Tzufun. If not, a separate SPI should be created with the oldest of the accounts. My own superficial analysis is the accounts do not relate to Tzufun. The other groups should remain here or in the new SPI created from Group 1. If those groups increase in the future, then a separate SPI can be created.--Bbb23 (talk) 07:58, 20 August 2015 (UTC)
 * Thanks for the check. I'll try to look at this more closely later on to see whether they match up. I've already found another suspicious one as well ( . SmartSE (talk) 10:10, 20 August 2015 (UTC)
 * Group 1 is obviously the largest group. Therefore, a clerk or has to decide whether they should be tied behaviorally to Tzufun. If not, a separate SPI should be created with the oldest of the accounts. My own superficial analysis is the accounts do not relate to Tzufun. The other groups should remain here or in the new SPI created from Group 1. If those groups increase in the future, then a separate SPI can be created.--Bbb23 (talk) 07:58, 20 August 2015 (UTC)
 * Thanks for the check. I'll try to look at this more closely later on to see whether they match up. I've already found another suspicious one as well ( . SmartSE (talk) 10:10, 20 August 2015 (UTC)


 * Domains spammed by Group 1:
 * Domains spammed by Group 2:
 * Domains spammed by Group 3:
 * Domains spammed by Group 2:
 * Domains spammed by Group 3:
 * Domains spammed by Group 3:
 * Domains spammed by Group 3:


 * Additional spammers of the domains in Group 1:
 * I've blacklisted the Group 1 domains, undecided on the rest. MER-C 11:32, 20 August 2015 (UTC)
 * I've blacklisted the Group 1 domains, undecided on the rest. MER-C 11:32, 20 August 2015 (UTC)
 * I've blacklisted the Group 1 domains, undecided on the rest. MER-C 11:32, 20 August 2015 (UTC)
 * I've blacklisted the Group 1 domains, undecided on the rest. MER-C 11:32, 20 August 2015 (UTC)
 * I've blacklisted the Group 1 domains, undecided on the rest. MER-C 11:32, 20 August 2015 (UTC)
 * I've blacklisted the Group 1 domains, undecided on the rest. MER-C 11:32, 20 August 2015 (UTC)
 * I've blacklisted the Group 1 domains, undecided on the rest. MER-C 11:32, 20 August 2015 (UTC)
 * I've blacklisted the Group 1 domains, undecided on the rest. MER-C 11:32, 20 August 2015 (UTC)
 * I've blacklisted the Group 1 domains, undecided on the rest. MER-C 11:32, 20 August 2015 (UTC)
 * I've blacklisted the Group 1 domains, undecided on the rest. MER-C 11:32, 20 August 2015 (UTC)


 * There are also:
 * 
 * 
 * (to .co.nz this time, so that might need blacklisting too).
 * Who all added the same links as group 1 and:
 * Who've been making similar edits to Calcenium.Bae (and others) who make many small edits and then revert immediately them presumably to try and bury the ref spam that was added in previous edits by other users. SmartSE (talk) 13:00, 20 August 2015 (UTC)
 * I've blacklisted all of the regional variants of businesses2sell.com.au (.com, .co.nz, .co.za, .co.uk) as well. MER-C 13:10, 20 August 2015 (UTC)
 * Could we get another check on all these other accounts? I presume it may turn up more. SmartSE (talk) 20:52, 20 August 2015 (UTC)
 * Oh and realistically, I don't think we have any evidence to link group one to Tzufun and I think that Chelsea232024 is the oldest account listed here although there are almost certainly older ones out there. SmartSE (talk) 20:57, 20 August 2015 (UTC)
 * Who've been making similar edits to Calcenium.Bae (and others) who make many small edits and then revert immediately them presumably to try and bury the ref spam that was added in previous edits by other users. SmartSE (talk) 13:00, 20 August 2015 (UTC)
 * I've blacklisted all of the regional variants of businesses2sell.com.au (.com, .co.nz, .co.za, .co.uk) as well. MER-C 13:10, 20 August 2015 (UTC)
 * Could we get another check on all these other accounts? I presume it may turn up more. SmartSE (talk) 20:52, 20 August 2015 (UTC)
 * Oh and realistically, I don't think we have any evidence to link group one to Tzufun and I think that Chelsea232024 is the oldest account listed here although there are almost certainly older ones out there. SmartSE (talk) 20:57, 20 August 2015 (UTC)
 * Who've been making similar edits to Calcenium.Bae (and others) who make many small edits and then revert immediately them presumably to try and bury the ref spam that was added in previous edits by other users. SmartSE (talk) 13:00, 20 August 2015 (UTC)
 * I've blacklisted all of the regional variants of businesses2sell.com.au (.com, .co.nz, .co.za, .co.uk) as well. MER-C 13:10, 20 August 2015 (UTC)
 * Could we get another check on all these other accounts? I presume it may turn up more. SmartSE (talk) 20:52, 20 August 2015 (UTC)
 * Oh and realistically, I don't think we have any evidence to link group one to Tzufun and I think that Chelsea232024 is the oldest account listed here although there are almost certainly older ones out there. SmartSE (talk) 20:57, 20 August 2015 (UTC)


 * Admin action needed -   For the beginning, can you please block those accounts already confirmed to each other?  Vanjagenije   (talk)  21:23, 31 August 2015 (UTC)
 * That's done, but it seems a bit pointless tagging them. SmartSE (talk) 21:49, 31 August 2015 (UTC)
 * I believe those that you listed as "Additional spammers of the domains in Group 1" are connected, but those are all throwaway accounts used for a day or two. Feel dree to block them, but I don't think it's necessary. I support moving this to Chelsea232024, as that account is the oldest. Do you agree?  Vanjagenije  (talk)  21:58, 31 August 2015 (UTC)
 * Since no answer was recieved, i moved the page.  Vanjagenije  (talk)  10:08, 13 September 2015 (UTC)
 * Admin action needed - Please, block all those accounts listed above at "Additional spammers of the domains in Group 1". They all added exactly the same spam links as those listed in Group 1.  Vanjagenije  (talk)  10:19, 13 September 2015 (UTC)
 * I did a spot check of a few of the accounts that listed below and they look similar. BNT those ones as well?  Mkdw talk 20:04, 13 September 2015 (UTC)


 * Admin action needed - Yes, you are right. Those should be all blocked.  Vanjagenije   (talk)  21:01, 13 September 2015 (UTC)
 * Mkdw talk 23:04, 13 September 2015 (UTC)


 * Apologies for not responding before. It looks like Mkdw has taken care of all of those accounts now but the final group hasn't been checked or blocked. It's probably a bit pointless though since the sites are blacklisted but, it would be worth looking to see if there were any other accounts linked that weren't adding the same links. SmartSE (talk) 21:22, 13 September 2015 (UTC)
 * CU was run on 20 August. All those accounts were active before that, so there is no need to run another CU check. Original CU check would caught them if they are technically related. I'm closing this now.  Vanjagenije  (talk)  23:23, 13 September 2015 (UTC)