Wikipedia:Sockpuppet investigations/Expertwikiguy/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

-- MarioGom (talk) 22:16, 25 October 2021 (UTC)
 * 1) A few of these accounts participated in dodgy AfDs connected to SpareSeiko or with similar characteristics. The master was blocked as UPE by  during that investigation. See:
 * 2) * WP:Articles for deletion/Mauricio Ramos (businessman): Expertwikiguy and Lesliechin1 !voting keep.
 * 3) * WP:Articles for deletion/IMerit (2nd nomination): Expertwikiguy and Webmaster862 !voting keep.
 * 4) * WP:Articles for deletion/Jay Feldman: Peter303x !voting keep and Expertwikiguy attempted to close as keep.
 * 5) * WP:Articles for deletion/IC Markets (2nd nomination) Peter303x and Lesliechin1  !voting keep.
 * 6) Draft:BizOps 2: created by Expertwikiguy, moved to mainspace 26 March 2021‎ , draftified on 13 April 2021‎, moved back to mainspace by Robertmason1 on 13 July 2021‎.
 * 7) COI Request Tool: installed as the unique user script in August 2021 by Boredathome101  and Lesliechin1.
 * 8) Somewhat characteristic timecards
 * 9) Consolidated contributions show sharp account alternation.
 * 10) Suspicious overlap at Benjamin Wey, together with other accounts that are also suspiciously similar (but left out of the report at the moment).
 * 11) Similar user pages.
 * 12) Similar edit summary style. With some tells that are very unique in statistical terms. Ping me for further info.


 * @MarioGom if you could mail me your additional evidence, I'd appreciate it. From what I see here, I'm on the fence about whether CU is justified. -- RoySmith (talk) 22:21, 26 October 2021 (UTC)
 * I think Roy was right about the undetected proxy usage. The following IPs seem to be the same person:
 * The proxy service is unknown to the checkers we use, but they all share the same fingerprint (HTTP proxy running on ports 3389, 5432, and 5433, all of them with the same fingerprint). MarioGom (talk) 15:54, 7 November 2021 (UTC)
 * had the same proxy fingerprint until 2021-08-31. MarioGom (talk) 17:10, 7 November 2021 (UTC)
 * The proxy service is unknown to the checkers we use, but they all share the same fingerprint (HTTP proxy running on ports 3389, 5432, and 5433, all of them with the same fingerprint). MarioGom (talk) 15:54, 7 November 2021 (UTC)
 * had the same proxy fingerprint until 2021-08-31. MarioGom (talk) 17:10, 7 November 2021 (UTC)
 * had the same proxy fingerprint until 2021-08-31. MarioGom (talk) 17:10, 7 November 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - -- RoySmith (talk) 15:33, 27 October 2021 (UTC)
 * Expertwikiguy is stale, but I was able to find some hints in the CU logs (ping ).  I see four groups, based on geolocation (Webmaster862 is in two groups):
 * Group 1 (Expertwikiguy, Peter303x, Honolulucb) all are in a small area near a major city, and on the same carrier/ISP
 * Group 2 (Boredathome101, Webmaster862, Carlcarterx) all in a major city
 * Group 3 (Webmaster862, Robertmason1) in a major city
 * Group 4 (Lesliechin1) scattered about a large geographic area
 * None of the IPs are classified as proxies by any of our tools. The locations are scattered around the globe.  User agents span a large range of common agents, even within a group.  Overall (and looking just at the technical data), I'd say each group is  within the group.  I would have said  between groups, but I have a vague suspicion there might be proxies in use which are just not being detected by our tools, so I'll call it  between groups and we're definitely in  territory.  I left some notes on cuwiki. -- RoySmith (talk) 17:33, 27 October 2021 (UTC)
 * I don't have anything to add; the one IP I got from my search did not cause me to take any action on the unblock request. --jpgordon&#x1d122;&#x1d106;&#x1D110;&#x1d107; 19:39, 27 October 2021 (UTC)
 * I think we've gone as far as we can with this one. The accounts in my group1 were the ones that seemed the most likely based on the CU data I found, and they've already been blocked.  There doesn't seem to be enough to justify any addition action, so closing. -- RoySmith (talk) 15:09, 6 November 2021 (UTC)
 * Reopening, I'd like to take a second look at this. GeneralNotability (talk) 13:37, 7 November 2021 (UTC)
 * @GeneralNotability are you still working on this? -- RoySmith (talk) 19:22, 16 November 2021 (UTC)
 * Yup, sorry. There is definitely a proxy service in use that we are not currently acquainted with. I would say that Boredathome101, Lesliechin1, Webmaster862, Robertmason1, Carlcarterx, and Honolulucb are all almost certainly using it. Peter303x is also on what appears to be a proxy or webhost, but it has a different signature. Expertwikiguy is . Will block. GeneralNotability (talk) 00:34, 17 November 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Attempting to restore promotional ad for Devel Motors that was cut down to a redirect as per Articles for deletion/Devel Motors. Robert McClenon (talk) 13:41, 4 January 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Semiprotected Devel Motors. -- RoySmith (talk) 18:30, 4 January 2022 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.


 * Jaxarnolds: Consistent timecard, similar edit summary style (e.g. ), ), overlap with Lesliechin1 on Bitfinex, overlap with Boredathome101 on Chad Future, and edits to Gurbaksh Chahal (frequent UPE target). See user pages for shared interest in EDM music and web design (1 vs 2).
 * Sam raggio: Consistent timecard, similar edit summary style (e.g. ), overlap with Boredathome101 on Woody Johnson, overlap with Webmaster862 on CareCloud. See also user page similarity (1 vs 2).
 * Wikivipwiki: Consistent timecard, similar edit summary style (e.g. ), overlap with Carlcarterx on David Stanley Hewett (including Commons upload), suspicious and precocious move to mainspace of an article that had just been draftified at NPP LigoLab (which was a quite obvious UPE creation). Already blocked by.

Note to CheckUser: They use proxies. See my comments on the report 25 October 2021 for information about how to detect the proxies they used last time (at least for logged-out editing). MarioGom (talk) 16:52, 10 January 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * was the creator of LigoLab. Blocked:
 * for the obvious UPE article David Stanley Hewett (which is now quarantined). MER-C 19:58, 10 January 2022 (UTC)
 * for the obvious UPE article David Stanley Hewett (which is now quarantined). MER-C 19:58, 10 January 2022 (UTC)
 * for the obvious UPE article David Stanley Hewett (which is now quarantined). MER-C 19:58, 10 January 2022 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - What I'm able to gather from the checks I ran is, I think, consistent with an unknown proxy.  investigated previously, and is substantially more clued up about this sort of thing than I am - GN, would you be able to comment on whether this is similar to what you have seen previously?   Girth Summit  (blether)  18:38, 10 January 2022 (UTC)
 * Thanks for the ping . This was a tough one, but some quality time with Shodan shows that when Jaxarnolds and Sam raggio were last active, their IPs were showing signs of a proy consistent with previous socks. I am not able to make the same call with respect to Wikivipwiki or RedRockRats, and Thegreatphalanx is . the first two, leaving open for disposition of the rest. GeneralNotability (talk) 02:28, 11 January 2022 (UTC)
 * Everyone's blocked. I tagged the outstanding accounts as suspected based on behaviour. Closing. Thanks, Spicy (talk) 02:56, 11 January 2022 (UTC)

Suspected sockpuppets

 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.
 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Account created after last set of blocks. Recreated EcoFlow, created by master and also edited List of renewable energy organizations like Sam raggio. Edit summaries are similar. Use of the visual editor. Similar editing times. Pika voom Talk 11:17, 21 February 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Use of VPNs makes it impossible to confirm the connection technically, but their use of those VPNs is very similar to the last batch of socks, and the date of creation plus return to some of the same subject areas is telling. I'm sure this is someone's sock, and it's most probably this master.  Girth Summit  (blether)  11:53, 21 February 2022 (UTC)

Suspected sockpuppets
This account has spent quite a bit of time !voting in the sort of "dodgy AfDs" discussed in the archives, and there are similar patterns that I can elaborate on if necessary. But most importantly, there are quite a few odd linguistic similarities here: for instance, the very particular phrase "Not enough news coverage to meet notability", which has only ever been used four times in the history of Wikipedia: once by Chelokabob here and three times by the blocked sockpuppet here, here, and here. There's also the unusual phrase "no significant news coverage", used by Chelokabob here and by a plethora of other socks elsewhere: here,  here, here, here, and here,  here and here,  here and here, and more. We also have "good to meet notability", which has only ever been used twice: once by Chelokabob here and once by here. This account was previously CU'd at an unrelated SPI, where he admitted to using a proxy—a common denominator among Expertwikiguy socks. CU might be helpful to confirm the nature of the proxy, but I think the behavioral evidence should suffice on its own. Extraordinary Writ (talk) 07:24, 10 March 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - -- RoySmith (talk) 15:33, 10 March 2022 (UTC)
 * Based on a bunch of technical data (as put it, some quality time with Shodan), I'll call Chelokabob ✅ to the bunch of socks from 25 October 2021, so I'll tag them as suspected to Expertwikiguy. -- RoySmith (talk) 16:25, 10 March 2022 (UTC)

Suspected sockpuppets
This account, just like the one I reported here yesterday, participates in "dodgy AfDs" and follows a similar broad editing pattern. But as before, I'll focus on the language-related quirks: 1) We have the phrase "not enough citations provided", which has only ever been used twice in the history of Wikipedia, once by Caphadouk here and once by blocked Expertwikiguy sock here. 2) Caphadouk has used here the unusual phrase "not enough news coverage", which has been previously used by, inter alios,  here and  here and here. 3) Caphadouk uses the odd wording "info in Google"; so did here and  here. More behavioral evidence available on request. Feel free to give CheckUser a try: despite the proxy usage, deft CUs have been able to extract useful technical evidence from previous members of this sockfarm. Extraordinary Writ (talk) 07:02, 11 March 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - -- RoySmith (talk) 14:34, 11 March 2022 (UTC)
 * ✅ . More details in cuwiki. -- RoySmith (talk) 14:54, 11 March 2022 (UTC)
 * Sorry, grabbed the wrong menu item. Caphadouk is suspected to Expertwikiguy. -- RoySmith (talk) 14:55, 11 March 2022 (UTC)

Suspected sockpuppets
Similar patterns of fishy behavior at AfD; similar language-related irregularities. A few examples: "not enough news coverage", used by MartinWilder here, has been used by here and here,  here,  here, here, and here, etc. MartinWilder's "does not meet guidelines for notability" here is reminiscent of Peter303x's "does not meet guidelines" here; his "keep as per arguments posted by DGG" here resembles Chelokabob's "Keep as per keep arguments posted above are convincing" here. "Delete Does not meet notability", used by MartinWilder here, also matches similar !votes from Peter303x here and here, here and here,  here and here, and  here and here (among others). CheckUser should be useful here. Extraordinary Writ (talk) 07:08, 12 March 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - -- RoySmith (talk) 14:43, 12 March 2022 (UTC)
 * I can't quite confirm MartinWilder to anybody, but they're based on the CU data, and the behavior described here is more than enough to block on. -- RoySmith (talk) 15:05, 12 March 2022 (UTC)

Suspected sockpuppets
Recreated EcoFlow, created now by two Expertwikiguy socks (Sam raggio, Cherycherylady) recently. Also the username is, well, not imaginative yet authoritarian. Uses the visual editor like previous sock. Pika voom Talk 06:04, 12 April 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - -- RoySmith (talk) 13:55, 13 April 2022 (UTC)
 * are confirmed to each other. Still working on some other stuff. -- RoySmith (talk) 14:16, 13 April 2022 (UTC)
 * These two are to a bunch of other recent socks, but I still can't get any better than suspected to ExpertWiki.  We've got some good notes in cuwiki, so I recommend all future reports in this case be routinely endorsed for CU. -- RoySmith (talk) 14:28, 13 April 2022 (UTC)

Suspected sockpuppets
I noticed these two users while patrolling CSD. Uranium Backup had been tagged for deletion as WP:G11. The article was authored by Jerseyfire, who contested the deletion, which is fairly normal, but Zeddedm also contested the deletion, which is not. They had also at one point when the article was a draft removed the speedy tag. According to the Editor Interaction Analyzer, besides intersecting on Uranium Backup and its Talk page, they also intersected on Kevan Barlow. But what was most damning was that Eddedm had uploaded, which was deleted as a copyright violation on December 27, 2021. On August 3, 2022, Jerseyfire and inserted it into the article. I'm requesting CU to confirm. Bbb23 (talk) 19:51, 30 August 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Unrelated from CU view. No overlap at all, different continents. But the behavior and activity time periods are incredibly suspicious. -- ferret (talk) 23:57, 30 August 2022 (UTC)
 * Given the CU findings, I am closing without any action. Bbb23 (talk) 00:01, 31 August 2022 (UTC)
 * Case merged from Sockpuppet investigations/Zeddedm/Archive. Spicy (talk) 23:54, 6 September 2022 (UTC)

Suspected sockpuppets
Samanthany shows the typical editing pattern of many consecutive edits to articles using the Visual Editor, followed by rapid-fire participation in AfD (compare, , ). Repeated use of phrasing that is consistently used by Expertwikiguy socks (e.g., used by , , , , and ). Removed a COI tag from an article substantially edited by Expertwikiguy socks. Other overlap here and here.

Elliswiki7 has edited several obscure articles in close proximity to blocked socks, uses Visual Editor, and has a similar username pattern to some previous sock accounts. In March 2021 this account added promotional mentions of "BizOps" to several articles. Expertwikiguy and repeatedly tried to create an article on BizOps. Spicy (talk) 18:23, 3 September 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - I'm aware that previous accounts are stale, but I'm requesting CU per RoySmith's comment here. There may be others - I found these while looking into another SPI, and there are some interesting interactions with other suspicious accounts, but I don't have enough evidence to list them here. Thanks, Spicy (talk) 18:25, 3 September 2022 (UTC)
 * - -- RoySmith (talk) 18:27, 3 September 2022 (UTC)
 * Both of these are ✅ or at least to Peter303x and Honolulucb from what I called Group 1 back in 25 October 2021.  I'll block and tag them as suspected to Expertwikiguy.   who both opined about the use of a previously unknown proxy service back then, so might be interested in this. -- RoySmith (talk) 18:50, 3 September 2022 (UTC)

Suspected sockpuppets

 * ( originally filed under this user)

Found this pair of accounts on Articles for deletion/International Beauty Industry Awards. Lovewiki106 is clearly a UPE. Lovewiki106 and Zeddedm are suspiciously similar due to a common interest in AFD and how they create articles.

Geodudegolem is the author of that article but doesn't show this pattern. I've listed them for completeness. MER-C 12:03, 4 September 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Per above rationale. - Please compare the accounts. --Jack Frost (talk) 12:29, 4 September 2022 (UTC)
 * - -- RoySmith (talk) 15:56, 4 September 2022 (UTC)
 * Much the same story as in 30 August 2022, except that Jerseyfire and Lovewiki106 geolocate very near each other. There's lots of proxy use going on in this case, so  is very much the order of the day. -- RoySmith (talk) 16:08, 4 September 2022 (UTC)
 * These two accounts spammed the same domain.
 * I'm waiting for a bot report - chances are there are more accounts. MER-C 19:21, 5 September 2022 (UTC)
 * Found four more spammers manually:
 * 
 * Sockmaster is Expertwikiguy (Sockpuppet investigations/Expertwikiguy)., compare e.g. Special:Undelete/Chance (2019 film). Please relist. MER-C 18:43, 6 September 2022 (UTC)
 * - for a check on the new accounts and comparison to Expertwikiguy per above. Thanks, Spicy (talk) 20:40, 6 September 2022 (UTC)
 * - -- RoySmith (talk) 20:44, 6 September 2022 (UTC)
 * are all to each other, and part of the group I identified in Sockpuppet investigations/Expertwikiguy.
 * Geodudegolem, Zeddedm, and VincentGod11 are due to proxy use.
 * -- RoySmith (talk) 21:15, 6 September 2022 (UTC)
 * I've blocked the ones in the highly likely group.
 * - Please merge to Expertwikiguy and tag/retag. -- RoySmith (talk) 21:27, 6 September 2022 (UTC)
 * Merged from Sockpuppet investigations/Zeddedm. Spicy (talk) 23:51, 6 September 2022 (UTC)
 * - please indef Zeddedm, VincentGod11 and Geodudegolem as suspected socks. VincentGod11's behavioural pattern fits with previous socks and they overlap with EWG on numerous pages . The evidence provided here and in Sockpuppet_investigations/Expertwikiguy/Archive convinces me that Zededdm has, at the very least, engaged in meatpuppetry with respect to Expertwikiguy. I initially found the evidence regarding Geodudegolem suspicious but not quite enough to block them for socking, however I found something in their editing history that convinces me that they are likely a sock/meatpuppet (admins/clerks can contact me if they can't figure out what it is). Thanks, Spicy (talk) 00:25, 7 September 2022 (UTC)
 * --Blablubbs (talk) 22:58, 8 September 2022 (UTC)
 * I've blocked the ones in the highly likely group.
 * - Please merge to Expertwikiguy and tag/retag. -- RoySmith (talk) 21:27, 6 September 2022 (UTC)
 * Merged from Sockpuppet investigations/Zeddedm. Spicy (talk) 23:51, 6 September 2022 (UTC)
 * - please indef Zeddedm, VincentGod11 and Geodudegolem as suspected socks. VincentGod11's behavioural pattern fits with previous socks and they overlap with EWG on numerous pages . The evidence provided here and in Sockpuppet_investigations/Expertwikiguy/Archive convinces me that Zededdm has, at the very least, engaged in meatpuppetry with respect to Expertwikiguy. I initially found the evidence regarding Geodudegolem suspicious but not quite enough to block them for socking, however I found something in their editing history that convinces me that they are likely a sock/meatpuppet (admins/clerks can contact me if they can't figure out what it is). Thanks, Spicy (talk) 00:25, 7 September 2022 (UTC)
 * --Blablubbs (talk) 22:58, 8 September 2022 (UTC)

Suspected sockpuppets
Spam pages with intersection between each other or previous sockpuppets: Sapphire Ventures, Special:Undelete/Jeff Charney. Two of these are still fresh (not Philz2020) and weren't picked up by the previous CU, so there are likely still more accounts out there. MER-C 09:22, 10 September 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - -- RoySmith (talk) 15:04, 10 September 2022 (UTC)
 * Alfasnake and Mike Palms are, but that's the best I can do.  -- RoySmith (talk) 15:21, 10 September 2022 (UTC)

Suspected sockpuppets
Found some more obvious socks. Overlaps:
 * Raffistar:
 * edited Everyday Health and (already blocked) edited its subsidiary BabyCenter.
 * Elliswiki7 and Raffistar overlap on Ava Cadell (their other long-term client).
 * Raffistar linked-spam here.
 * (already blocked) and Raffistar edited Follow Alana.
 * Raffistar edited Benjamin Wey (a lot of UPEs have edited it).
 * Dudeanc:
 * (already blocked) and manipulated the result of Articles for deletion/Namify.
 * Elliswiki7, Dudeanc, Honolulucb, all spammed Randy Armstrong (musician).
 * Alice Jason is another account which they use to game the system. With this account they disclose their status and speed up the edit request with another sock. Like:
 * Alice Jason finally declared their paid status on Talk:Ava Cadell and used talk page. To speed up the process, they used User:Raffistar. Alice gives credit to User:Elliswiki7 (their sock) here.
 * Alice Jason disclosed their paid status again and created Telecommunication Instructional Modeling System page, but they used their socks, to edit it. In fact, they rigged this AfD (Articles for deletion/Telecommunication Instructional Modeling System) by voting and closing themselves.
 * Something fishy here.
 * Use of visual editor is another aspect of their editing pattern. 217.165.157.91 (talk) 22:36, 10 September 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Raffistar is a weak to  (same geolocation, same ISP, different useragent). They are also very likely to, who is quite spammy-looking. I've blocked both.
 * Dudeanc is ..
 * Alice Jason is . GeneralNotability (talk) 01:37, 11 September 2022 (UTC)
 * has the same behavior as Alice Jason. Blocked and tagged Dudeanc. MER-C 11:21, 11 September 2022 (UTC)
 * And blocked the other two on behavioral evidence. MER-C 14:23, 11 September 2022 (UTC)

Suspected sockpuppets
Brand new user, who was created shortly before another puppet of the puppeteer, user:MiamiYamiga was blocked. And even though they are a new user, they went to an article of the other puppet which had been sequestered to draft for UPE concerns, edited it and moved it back, Draft:Howard K. Grossman.  Onel 5969  TT me 10:39, 31 October 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * CU data is inconclusive; editing interests and some other BEANS stuff is enough to persuade me. Blocking, tagging as suspected.  Girth Summit  (blether)  13:06, 31 October 2022 (UTC)

Suspected sockpuppets

 * Jasonboz edited Everyday Health that was previously edited by Experwikiguy sock, like Raffistar. They also created two redirects: ,
 * Omranduk and Bobbassline both edited Randy Armstrong (musician) that was previously edited by Experwikiguy socks, Dudeanc, Elliswiki7, and Honolulucb. 31.205.13.92 (talk) 04:37, 26 February 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments
I've blocked the IP filer for one week for block evasion (User:Neunermialog). I thought you might want to take a look.--Bbb23 (talk) 16:34, 26 February 2023 (UTC)
 * - Timecards are a (weak) match, the overlap is quite suspicious too. MarioGom (talk) 16:04, 12 March 2023 (UTC)
 * - -- RoySmith (talk) 00:59, 13 March 2023 (UTC)
 * Bobbassline is . Jasonboz and Omranduk are  -- RoySmith (talk) 01:07, 13 March 2023 (UTC)
 * Blocked Jasonboz, too similar to the below socks despite not spamming the site. Blocked Omranduk. I also found, blocked, and tagged a similar account:
 * MedPage Today, a subsidiary of Everyday Health. Spam article created: Shasqi, Concept 1, Future rave, Michael Glogauer. No opinion on Bobbassline. MER-C 16:52, 22 April 2023 (UTC)
 * The three blocked accounts share Expertwikiguy's not-too-unique-but-interesting timecard. General behavior close too. Closing. MarioGom (talk) 17:40, 22 April 2023 (UTC)
 * The three blocked accounts share Expertwikiguy's not-too-unique-but-interesting timecard. General behavior close too. Closing. MarioGom (talk) 17:40, 22 April 2023 (UTC)

Suspected sockpuppets
Characteristic behavior. Spam articles created: Proscenic, Fire Department Coffee, Fazale Rana. Sites spammed:

Already blocked and tagged but taking a punt on CU. MER-C 16:28, 22 April 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - given the linkspam, timecard match and editing style. MarioGom (talk) 17:43, 22 April 2023 (UTC)
 * - -- RoySmith (talk) 18:27, 22 April 2023 (UTC)
 * Benjornix is . Operationz is .  Extensive proxy use for both.  They're already blocked, so not really anything else useful to do here, so closing. -- RoySmith (talk) 18:49, 22 April 2023 (UTC)

Suspected sockpuppets
Googleboywonder appears to be a new paid editor, following a pattern seen in previous Expertwikiguy accounts. (Single edit to remove the redlink from their username, editing seemingly randomly to build up a history, then focusing on writing promotional articles in a very small number of edits). I flagged two of the articles as paid, but a second editor has raised concerns that this is Expertwiki, and it seems to match. Given the nature of Expertwiki's paid editing, I suspect other accounts. - Bilby (talk) 02:51, 27 June 2023 (UTC) Bilby (talk) 02:51, 27 June 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Proxy use means no clear link, however, to this case based on CU evidence. Dreamy Jazz talk to me &#124; my contributions 13:17, 27 June 2023 (UTC)
 * - Some of this behavior is common among spammers, but the timecard and proxy use move the needle towards Expertwikiguy. Please, block it as suspected. Thank you. MarioGom (talk) 20:42, 28 June 2023 (UTC)
 * Thanks. Blocked and tagged as suspected. Close. Dreamy Jazz talk to me &#124; my contributions 23:59, 28 June 2023 (UTC)

Suspected sockpuppets
Similar username pattern (x at the end), like previous socks User:Peter303x, User:Thegreatphalanx, User:Benjornix, User:Carlcarterx, and stylometry. Recently, they were hired to fix Benzinga article. 217.165.12.18 (talk) 12:41, 7 February 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - Account is . . Spicy (talk) 15:10, 30 March 2024 (UTC)
 * The suspected sock hasn't edited in over 3 months. If they resume, this report may be refiled. Closing. Bbb23 (talk) 15:16, 30 March 2024 (UTC)

Suspected sockpuppets

 * ( original case name)

Alleged misuse, Other account to afd !vote to look independent, ChaturvediUtkarsh created SMK Tennis Academy, Syed Sadique Hussain !voted keep at Articles for deletion/SMK Tennis Academy.

In this edit Syed Sadique Hussain says that they are Utkarsh Chaturvedi

That was immediately reverted and 3 minutes later ChaturvediUtkarsh makes a near same edit

ChaturvediUtkarsh claims "Original research has been removed, all other issues resolved" on a page created by Syed Sadique Hussain. Edit also add an image uploaded to commons by Syed Sadique Hussain 11 minutes earlier.

Similar to behaviour by Syed Sadique Hussain.

ChaturvediUtkarsh page creation with a longwinded disclaimer "Creating this page for an organisation which has significant coverage, here I have followed all the guidelines strictly and in a neutral point of view, I have added a categories list as well and have written the article in a Wikipedia language format."

As does Syed Sadique Hussain "creating a page after checking the guidelines of Wikipedia with regards to voice over artist and checking it with reliable source as well... after careful research i came into the conclusion that this person has significant coverage in multiple reliable sources which where independent from the topics. i have added the category list as well" "I am creating a biographical page for a fashion designer known as Jeffrey. Since it is a living biographical page i have tried to include as much Citation as possible from primary, secondary, and tertiary source best of my knowledge. i also make sure to write copyright-free content with regard to Wikipedia guidelines and terms. i also added a category box" duffbeerforme (talk) 06:17, 8 February 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked, tagged, closing. The archiving clerk might want to consider requesting a CU to look for others. Bbb23 (talk) 14:44, 8 February 2024 (UTC)
 * , and  came up as sleepers of ChaturvediUtkarsh and have been blocked and tagged. Courcelles (talk) 16:59, 15 February 2024 (UTC)
 * That all said, the geolocation of the Hussain account and the Utkarsh one and their socks does not line up. So I'm not sure what is going on here. Courcelles (talk) 17:18, 15 February 2024 (UTC)

Suspected sockpuppets

 * ( original case name)

–&#8239;Joe (talk) 12:32, 23 April 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments
Per ticket:2024020510012831, it looks like this account and its sockpuppets are socks or meatpuppers of Sockpuppet investigations/Expertwikiguy. Could somebody please merge them? –&#8239;Joe (talk) 12:32, 23 April 2024 (UTC)
 * ✅ —&thinsp;JJMC89&thinsp; (T·C) 00:19, 25 April 2024 (UTC)