Wikipedia:Sockpuppet investigations/F1F2F2/Archive

Suspected sockpuppets

 * (case originally opened under this name)


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Similar editing pattern. Make 10 minor edits to random article, turn user and talk page blue. Then one writes an article on a barely notable company and the other, using most of the same sources, writes one on the founder. Suspect a rogue paid editing operation. Furrykiller (talk) 10:27, 13 July 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Cadran77 is, but I'll do a sleeper check. Katietalk 23:03, 13 July 2017 (UTC)
 * This is interesting.
 * QuentinHotel is to, a suspected sock of.
 * However, it's also possilikely to, a suspected sock of . No obvious sleepers.
 * is also possible to QuentinHotel. The technical details here are varied but the ISP is the same, and it's in a region that doesn't have a lot of English edits.


 * I think Azul411 is the more likely of the two, but someone more familiar to both masters should have a look. Pinging and, as they blocked these last two socks. . Katietalk 23:19, 13 July 2017 (UTC)
 * I can confirm that McHoyel and MarianBGalu are the same. I'll see what I have on the others. - Bilby (talk) 18:14, 19 July 2017 (UTC)


 * This is not Azul411; I can't see someone who hates spam with that much passion ever becoming a paid COI editor themself. BusInCordoba appears to be the master here: each sock will make around 10 minor edits, create a user/user talk page, and then create a stub or two on a non-notable company. Please block the non-stale accounts (QuentinHotel and McHoyel). Sro23 (talk) 23:35, 20 July 2017 (UTC)
 * ✅. GABgab 03:01, 21 July 2017 (UTC)

Suspected sockpuppets

 * (case originally opened under this name)




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Editing pattern very similar to that of the identified socks.

Almost all of the articles created using the named accounts were subsequently edited by unregistered users. Their edit summaries (or, in a few cases, the fact that they edited multiple articles created by different accounts) suggest that the IPs were used by the same person.

I also have suspicions with regards to User:Bitzonetick, but its connection to the group is an inconclusive combination of a weak behavioural link and weak off-wiki evidence.

-- Rentier (talk) 17:53, 27 July 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * There is a suspicion (see Conflict_of_interest/Noticeboard) that these accounts may be socks of (Sockpuppet_investigations/Alechkoist). Rentier (talk) 11:28, 28 July 2017 (UTC)


 * Also being discussed at WP:COIN at Conflict_of_interest/Noticeboard. About a hundred articles are involved. Some have been identified as matching with ads for paid editing on Upwork. Big mess.  COIN is waiting for the results of the sockpuppet investigation so sockpuppet-created articles can be speedily deleted. The rest will need more detailed attention. John Nagle (talk) 19:39, 28 July 2017 (UTC)


 * or another CU, could we have an update on this case? I don't mean to rush, but (his article was matched to an Upwork job) is about to get stale (last activity is 89 days old) and so may other, not yet known accounts. Rentier (talk) 16:03, 29 July 2017 (UTC)
 * Y'all, this is so much that I need more coffee., I blocked every single one of the accounts from the last (stale) batch--by which I mean those below the IPsevery single one except for CoffeeHoot, which does not really meet the usual characteristics. I'll tell you two things I found: a. they play good hand-bad hand: this IP warns a sock (Interloop) about our EL policy. b. one of the articles, Stephan Crasneanscki, goes back a long way--see a short list of blocked editors at User_talk:Bellaheureuse. More later. Drmies (talk) 13:23, 7 August 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * I ran a quick CU just to see how big this got, and it's a bit bigger than I can handle. AngelaGrossman certainly links to ComerBien, who links to, who links to  ArenysDep and two not-yet active accounts,  BonJay44 and JeanSilvaLus, as well as to . I am somewhat hesitant to start throwing blocks around since I don't feel I have the bigger picture, and I am wondering if there are good hand/bad hand accounts or perhaps an innocent user caught up in this.  also needs to be added to this list, and I invite editors to look at . I did block ArenysDep and the associated , and the associated . OK, this is getting kind of exciting, but still too big for me right now. Drmies (talk) 12:46, 28 July 2017 (UTC)
 * - This may take me a while, but I'm working on it. Katietalk 18:50, 29 July 2017 (UTC)
 * Going to do this in small pieces but it looks like a giant sockfarm. They're using a couple of different ISPs and I really can't tell how they're doing it because it's weird, but still. ✅ to each other so far are:


 * Blocked awaiting tags when I get a better handle on it. G5 away, guys.  Would you look at the other accounts that Drmies linked and see if they need to be added, and add them if they do? Thanks. :-) Katietalk 19:32, 29 July 2017 (UTC)
 * More confirmed to each other and the first group:


 * Again, blocked awaiting tags. I think these are true shared accounts being used by multiple users in multiple locations. Katietalk 20:16, 29 July 2017 (UTC)
 * These are all confirmed to the others I've listed above:


 * Blocked awaiting tags. I'll get to more of these later tonight. Katietalk 21:32, 29 July 2017 (UTC)
 * I think I've checked them all now. ✅ to the others previously listed are:

— Berean Hunter   (talk)  18:15, 23 August 2017 (UTC)
 * is but I want someone to carefully look at the behavior.
 * All named accounts listed in the report after the block of IP addresses are.
 * Now that I know what to look for, I reran the non-stale socks from the archive, and I can confirm MarianBGalu to the group. McHoyel is.
 * Blocked awaiting tags. I'm not sure the master is BusInCordoba but apparently it's the best match. If I missed one, ping me. I've made a page in my user space on the CU wiki with technical details. Katietalk 01:21, 30 July 2017 (UTC)
 * Katie had popped up on my radar before as a newbie apparently cleaning up COI. More recently, though they've made more typical UPE edits e.g. these at UNILAD which essentially are part of a re-branding exercise (the last edit was by an IP, 7 minutes after RenaultMurnles). Similarly this AFD nom would fit the MO of reputation management. Looking at the edits that first caught my eye at Scott Jacoby (producer), it also seems suspicious that they removed coi only a 10 days after the disclosed paid editor  had removed it. Seems like enough reason to block IMO. SmartSE (talk) 13:54, 30 July 2017 (UTC)
 * SmartSE, the link with the IP is interesting but I won't comment. CU confirms a link between Renault and various other socks, including NewCrossG and ArenysDep, both of whom are CU-blocked; Katie already noted a technical possibility, and I am convinced also by way of behavior, and will place a brief note on Katie's CU page. I am blocking based on a possible technical match and on behavior (the seasoned editor will know what I mean). I find very tenuous connections, technical and behavioral, for two other users (Jérôme Maeder and ScienceGuard)--not enough to block, but enough to at least raise some questions. Drmies (talk) 15:00, 7 August 2017 (UTC)
 * Casename moved to F1F2F2 as that is the oldest that I can see and tags applied. Closing.
 * Casename moved to F1F2F2 as that is the oldest that I can see and tags applied. Closing.


 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * The suspect's first edit vs confirmed sock's first edit + the overall editing pattern matches the socks. -- Rentier (talk) 00:03, 4 September 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Yes, it does... and this may not be the only extant sock. Thanks, GABgab 01:53, 4 September 2017 (UTC)
 * Based on location, seems . No other suspect accounts located. Yunshui 雲 水 13:27, 4 September 2017 (UTC)


 * Now, closing. GABgab 19:57, 4 September 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

LibreriaRei - similar editing pattern to many of the blocked. Make a number of copyediting edits to random article, turn user and talk page blue, then create a new article about a borderline notable company. Rentier (talk) 01:38, 19 January 2018 (UTC)
 * Adding more accounts that share the same editing style. Rentier (talk) 01:57, 19 January 2018 (UTC)

Thank you, ! Linking to socks from the archive,, , , I can provide more evidence if needed, but prefer to avoid spilling the WP:BEANS if possible. Rentier (talk) 03:59, 20 January 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
This case is. However, given the history of the case, I am willing to compare the suspected socks to each other, but for each account there has to be diffs providing evidence of a relationship to the master or to any of the many socks in the archive. At this point there are none. ?--Bbb23 (talk) 20:55, 19 January 2018 (UTC)
 * Here, I'll add the diffs. Each account uses the same style of short edit summaries (" Better")   ("Edit")   ("Clean up" or "cleaning up")   . I added a couple more possible socks which I noticed from the page creations of Swizz Lina and Bean Owl. Please look for more accounts. Sro23 (talk) 03:25, 20 January 2018 (UTC)
 * ✅ that these accounts belong to F1F2F2:
 * This included a sleeper check. The drawer is quite extensive. - Mailer Diablo 11:40, 20 January 2018 (UTC)
 * Socks tagged. Sro23 (talk) 22:51, 20 January 2018 (UTC)
 * This included a sleeper check. The drawer is quite extensive. - Mailer Diablo 11:40, 20 January 2018 (UTC)
 * Socks tagged. Sro23 (talk) 22:51, 20 January 2018 (UTC)
 * This included a sleeper check. The drawer is quite extensive. - Mailer Diablo 11:40, 20 January 2018 (UTC)
 * Socks tagged. Sro23 (talk) 22:51, 20 January 2018 (UTC)
 * This included a sleeper check. The drawer is quite extensive. - Mailer Diablo 11:40, 20 January 2018 (UTC)
 * Socks tagged. Sro23 (talk) 22:51, 20 January 2018 (UTC)
 * This included a sleeper check. The drawer is quite extensive. - Mailer Diablo 11:40, 20 January 2018 (UTC)
 * Socks tagged. Sro23 (talk) 22:51, 20 January 2018 (UTC)
 * This included a sleeper check. The drawer is quite extensive. - Mailer Diablo 11:40, 20 January 2018 (UTC)
 * Socks tagged. Sro23 (talk) 22:51, 20 January 2018 (UTC)
 * This included a sleeper check. The drawer is quite extensive. - Mailer Diablo 11:40, 20 January 2018 (UTC)
 * Socks tagged. Sro23 (talk) 22:51, 20 January 2018 (UTC)
 * Socks tagged. Sro23 (talk) 22:51, 20 January 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

This account created Soundwalk Collective. Account was then blocked for username violation for being User:Collectivesoundwalk and changed their name to User:Sonnenalle44, which is still almost the same name but passes. Account then submitted Draft:Stephan Crasneanscki, and a reviewer raised the issue of conflict of interest. They deny any conflict of interest, which is incredible in the sense of not warranting belief by a rational H. sapiens. Anyway, Stephan Crasneanscki was once deleted as G5, attributed to this sockpuppet family, which creates drafts on marginally notable companies and their founders. This is another case of a marginally notable company and its founder. I am filing it under the current name of this sockpuppet family, although there may be an even older account.

Not requesting CheckUser because evidence is stale. Same swimming and flight pattern. Robert McClenon (talk) 22:35, 3 April 2019 (UTC)

See https://en.wikipedia.org/wiki/Wikipedia:Conflict_of_interest/Noticeboard/Archive_118#Undisclosed_paid_editing_sockfarm. Robert McClenon (talk) 22:50, 3 April 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Cabayi (talk) 10:01, 5 April 2019 (UTC)
 * - The link to Stephan Crasneanscki raises the possibility that its creator who registered after the last report may also involved. Please CU for sleepers. Cabayi (talk) 10:05, 5 April 2019 (UTC)
 * - Everything is . Salvio Let's talk about it! 10:14, 5 April 2019 (UTC)
 * CU in the following case returned nothing for this suspect. Closing. Cabayi (talk) 14:06, 12 April 2019 (UTC)

Suspected sockpuppets


The following accounts are stale for CU, but mentioned for context:


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Yet another UPE sock/meat farm:
 * Spamming of royalholloway.stream:.
 * See deleted contributions of James Holloway.
 * Spamming of sleepopolis.com:
 * UPE: Cheq AI Technologies, IV.AI, Matt Thomas (entrepreneur) and deleted contributions of the stale accounts.
 * corresponds to Special:Undelete/MT Finance, created by . Note the first reference on that user page (also present in the deleted article).
 * Matt Thomas (entrepreneur) was created by a week after Matt Thomas (businessman) (created by ) was redirected.

MER-C 13:01, 6 April 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Except Van1970, all of the non-stale accounts are likely operated by the same person. They are all using different and dubious IPs, running the gamut from suspicious to clear proxies. Van1970 is ❌. I've blocked Jakartajena without tags.--Bbb23 (talk) 17:59, 6 April 2019 (UTC)
 * royalholloway.stream and sleepopolis.com blacklisted. MER-C 09:04, 7 April 2019 (UTC)
 * Closing. TonyBallioni (talk) 02:55, 16 April 2019 (UTC)