Wikipedia:Sockpuppet investigations/Craytonconstanceb/Archive

13 June 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Currently being discussed at Administrators'_noticeboard/Incidents where a checkuser SPI is recommended. All of these accounts register, make one edit adding a spam link using the same edit summary "Added informative link", and then don't edit again. Clearly this is an effort to spam Wikipedia by using multiple accounts to avoid full detection. It is likely that there are other related throwaway accounts that haven't been noticed and reverted yet. If they could be identified by checkuser, their spamming could be reverted too. Deli nk (talk) 14:14, 13 June 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ✅:
 * Blocks and tags where needed. Closing.--Bbb23 (talk) 14:45, 13 June 2015 (UTC)
 * Blocks and tags where needed. Closing.--Bbb23 (talk) 14:45, 13 June 2015 (UTC)
 * Blocks and tags where needed. Closing.--Bbb23 (talk) 14:45, 13 June 2015 (UTC)
 * Blocks and tags where needed. Closing.--Bbb23 (talk) 14:45, 13 June 2015 (UTC)
 * Blocks and tags where needed. Closing.--Bbb23 (talk) 14:45, 13 June 2015 (UTC)
 * Blocks and tags where needed. Closing.--Bbb23 (talk) 14:45, 13 June 2015 (UTC)
 * Blocks and tags where needed. Closing.--Bbb23 (talk) 14:45, 13 June 2015 (UTC)

13 June 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Sorry to open up another one so soon, but using Special:Linksearch on the links spammed by the previously blocked socks, I have found all these other accounts. They follow the same behavior, have similar names, spammed the same links, and used the same edit summary. I suspect there are still more. Deli nk (talk) 19:30, 13 June 2015 (UTC) Deli nk (talk) 19:30, 13 June 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I'll check, but depending on the results, the master will probably change. Thus, when I post my results, I will not immediately block/tag. Instead, I'll move this to the correct master first.--Bbb23 (talk) 19:43, 13 June 2015 (UTC)
 * The following accounts are ✅:
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)
 * --Bbb23 (talk) 21:43, 13 June 2015 (UTC)
 * Blocks and tags here and retags to the archived accounts. Closing. Bbb23 (talk) 22:56, 13 June 2015 (UTC)
 * Domains blacklisted. MER-C 03:24, 14 June 2015 (UTC)

14 June 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

I've blacklisted and cleaned the domains added by the socks in the previous SPI, finding the above unblocked accounts in the process. Once again, we have similar usernames, similar behaviour and the "added informative link" edit summaries (but not all the time).



is a maybe, there was the "added informative link" edit summary, but this one also created a userpage. MER-C 03:39, 14 June 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Holy crap, how many accounts does this group (it must be) have? O___o Zeke Essiestudy (talk) 04:28, 14 June 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * It's late and I'm not going to have time to check this. It takes a while because of the number of listed puppets and the probable sleepers I've found before. I'll try to do it tomorrow morning (my time - Pacific US). Thank you for blacklisting the domains. I noticed that you are an edit filter manager. Is there any kind of filter that would help staunch the flow?--Bbb23 (talk) 04:40, 14 June 2015 (UTC)
 * Special:AbuseFilter/696. MER-C 04:44, 14 June 2015 (UTC)
 * Thanks. I have a few questions, but I'll ask them tomorrow.--Bbb23 (talk) 04:51, 14 June 2015 (UTC)
 * Mike V • Talk 05:15, 14 June 2015 (UTC)
 * I've found and blocked 100+ accounts so far. I'll try and post the accounts here tomorrow. Mike V • Talk 06:29, 14 June 2015 (UTC)
 * I went through the accounts you had blocked and found 37 more domains (blacklisted and cleaned) and three additional spammers:
 * MER-C 10:50, 14 June 2015 (UTC)
 * MER-C 10:50, 14 June 2015 (UTC)
 * MER-C 10:50, 14 June 2015 (UTC)
 * MER-C 10:50, 14 June 2015 (UTC)


 * This appears to be a SEO service that inserts spam links into articles. There seems to be a couple of different devices in use, but the behavior is exactly the same. Thus, there may be more than one individual involved here, but for all intents and purpose the following accounts are ✅ to the same group:


 * Mike V • Talk 16:29, 14 June 2015 (UTC)

14 June 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Overlapping spam with confirmed sock on Street furniture Andy Dingley (talk) 09:43, 14 June 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I found this domain in the followup to the previous SPI and have blacklisted it. MER-C 10:51, 14 June 2015 (UTC)
 * I blocked the last four after confirming edits match. Dennis Brown - 2&cent; 13:37, 14 June 2015 (UTC)

17 June 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

More 'informative link' spam, detected by Special:AbuseFilter/696. All accounts have the same behaviour of adding a single spam link with an 'informative link added' edit summary. I think most of the above were blocked by the blacklist (though I haven't verified this), but I've reverted and blocked the three that successfully edited. See the filter log for those accounts which don't appear to have made edits. CheckUser may help identify other accounts. Sam Walton (talk) 10:09, 17 June 2015 (UTC)
 * Three more accounts added. MER-C 13:41, 17 June 2015 (UTC)
 * Added two more that the edit filter missed but are otherwise the same behaviour. Sam Walton (talk) 14:16, 17 June 2015 (UTC)
 * Added another four from the filter. Sam Walton (talk) 09:07, 18 June 2015 (UTC)
 * And another. Sam Walton (talk) 10:22, 18 June 2015 (UTC)
 * Added two more. Sam Walton (talk) 08:28, 19 June 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

The latest spamming blitz consists of a new account adding a one-word greeting to his user talk page such as "hey" or "ola!", often a nationality template to his user page, then adding a spam link masquerading as a reference to a single article. Examples ; //en.wikipedia.org/w/index.php?title=Gautier_furniture&diff=prev&oldid=667455986, //en.wikipedia.org/w/index.php?title=Defoamer&diff=prev&oldid=667445472, //en.wikipedia.org/w/index.php?title=Rikuo_Motorcycle&diff=prev&oldid=667453519, //en.wikipedia.org/w/index.php?title=Beba_Village_Community_in_Cameroon&diff=prev&oldid=667441645, //en.wikipedia.org/w/index.php?title=Biotherm&diff=prev&oldid=667440849, //en.wikipedia.org/w/index.php?title=Baby_Gender_Mentor&diff=prev&oldid=667443925, //en.wikipedia.org/w/index.php?title=Mespilus&diff=prev&oldid=667436230, //en.wikipedia.org/w/index.php?title=Charlie_Bradberry&diff=prev&oldid=667446816, //en.wikipedia.org/w/index.php?title=Applied_arts&diff=prev&oldid=667444659, //en.wikipedia.org/w/index.php?title=Sunday_drive&diff=prev&oldid=667360702, //en.wikipedia.org/w/index.php?title=Tell-tale_(automotive)&diff=prev&oldid=667354958, //en.wikipedia.org/w/index.php?title=Marketing_buzz&diff=prev&oldid=667343522, and lots more.

This typical page: //en.wikipedia.org/w/index.php?title=Special:Contributions&offset=20150617044701&tagfilter=&contribs=newbie&target=newbies&namespace=3&newOnly=1 shows several such user talk pages being set up. Can a Checkuser be done? . .Mean as custard (talk) 09:20, 18 June 2015 (UTC)
 * This behaviour seems different to that associated with the 'informative link' spam, but is something worth addressing. Might be best to move this to WP:WPSPAM. Sam Walton (talk) 09:23, 18 June 2015 (UTC)
 * ...Or its own SPI. Sam Walton (talk) 09:25, 18 June 2015 (UTC)
 * Copied to WP:WPSPAM. I don't know how to raise a SPI. . . Mean as custard (talk) 09:29, 18 June 2015 (UTC)
 * Opened at Sockpuppet investigations/Imsess. Sam Walton (talk) 10:33, 18 June 2015 (UTC)

Any chance that a rangeblock can be effective or appropriate in this case? Deli nk (talk) 14:13, 18 June 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Two new domains among this lot (onlinecricketbetting.net, realmoneyslotsonline.com) but no obvious new accounts that have added them. Blacklisted. MER-C 11:35, 17 June 2015 (UTC)
 * All of these are DUCKS, and I have blocked those that were not already blocked. Blocks are not really likely to be very useful, as the spammer usually uses each account for just one edit and then abandons it, but there have been exceptions, so they may as well be blocked. Blacklisting and edit filtering are more likely to be effective. However, in view of the history, a CheckUser to look for further accounts would be useful. The editor who uses the pseudonym "JamesBWatson" (talk) 18:26, 17 June 2015 (UTC)
 * Four domains blacklisted today. MER-C 12:04, 18 June 2015 (UTC)
 * I have blocked a few /24 ranges for 3 months. These blocks certainly won't stop the behavior, we can continue to blacklist the domains and check any new WP:DUCKS that show up to consider further range blocks. -- Versa geek  20:26, 18 June 2015 (UTC)
 * Two more range blocks applied based on the new DUCKS. -- Versa geek  16:43, 19 June 2015 (UTC)


 * It looks like Versageek got the bulk of it here. I've found a few additional accounts that are ✅:


 * Mike V • Talk 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 02:07, 20 June 2015 (UTC)

30 June 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same behaviour as the 'informative link' spam. They appear to have stopped using that edit summary, but this user was flagged through other behavioral evidence in the edit filter. Requesting checkuser as I suspect the previous rate of editing is still occurring but with new behaviour. Sam Walton (talk) 13:22, 30 June 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Thanks Bbb23. For the record, this could definitely be a false flag from the filter, the behavioural evidence isn't as completely airtight. Sam Walton (talk) 16:16, 30 June 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * is . .--Bbb23 (talk) 16:02, 30 June 2015 (UTC)
 * Just one edit, hard to prove anything behaviorally. CU results not enough to block. Closing this with no action.  Vanjagenije  (talk)  22:49, 26 July 2015 (UTC)