Wikipedia:Sockpuppet investigations/FlorWillson54/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

As their very first edits, these two users both created similar user pages with a spam URL promoting some website called "11bet". They both introduced themselves in similar manners: compare and. Other admins have declined to block at WP:AIV on the basis of insufficient warnings, but I suspect that the similarity in behavior makes it likely that these two are connected as part of some kind of spam. To checkusers: are these two accounts related, and are there any other accounts related to them? Thanks, Mz7 (talk) 02:19, 27 June 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * 5 albert square (talk) 02:29, 27 June 2018 (UTC)

You ready? GeoffreyKim47 is also Elinor1948, JenniMolinari90, GenevaKim29878, Earnest55S, EldenRasp640. I looked at one of them (can't remember which-- blocked them for running afoul of some spam list. ShaunBusch2123 is also MelvaToh523604, ChanelTovell5, OttoKoop6316, MahaliaNies8010, LacyAsche6022. That last one was also blocked by Kuru and may be the oldest (12 June) of the batch. All those accounts are blocked already, and GeoffreyKim and Shaunbusch are matches. I am sure there is more to this; maybe Kuru knows a bit more, or maybe you can dig around to see what all these have in common. I wouldn't be surprised is there was an older account/SPI here. I see that is running around blocking so I'll save this quick. Drmies (talk) 02:30, 27 June 2018 (UTC)
 * Whoa. Yeah, I suspected there might be other accounts, but I did not expect this many. Thanks for checking, . Mz7 (talk) 02:32, 27 June 2018 (UTC)
 * Ha there's more! I'm about to drop a rangeblock; the oldest account that I see in here is User:FlorWillson54, blocked earlier this month by . There's a dozen more accounts in there which I won't list here, but in my log you can see a few more CU blocks. I hope that maybe Kuru and MER-C know more or can help figure out more. I looked at a few user pages; I think I saw Cyrillic characters in some of them. Maybe that's a hint for someone. Drmies (talk) 02:38, 27 June 2018 (UTC)
 * JenniMolinari90 and EldenRasp640 weren't blocked so I've blocked them. I've not tagged them though, in case we don't want to give them attention.--5 albert square (talk) 02:42, 27 June 2018 (UTC)
 * That's an ancient spammer/bot. He used to hop around on single use IPs in eastern europe/russia/china, always quickly adding as many iterations of the same links as possible to his user page and talk page. Presumably testing the blacklist. At some point he switched to bot-generated accounts with/without crappy flavor text around the links, but still rotating through the same 20 or so spam domains (xembongdahd.com in that run). He's easy to spot on the blacklist logs; it looks like this run included a link that was not yet blacklisted. may have some long-term knowledge of this person if needed.  Kuru   (talk)  02:45, 27 June 2018 (UTC)
 * Just out of morbid curiosity, did show up as related in this?  Kuru   (talk)  02:56, 27 June 2018 (UTC)
 * No, and I found nothing else (yet) under the two related IPs they used. Drmies (talk) 03:37, 27 June 2018 (UTC)
 * , can you handle a holy shit? I'm about to drop a bunch of CU blocks. Also YGM. Drmies (talk) 03:40, 27 June 2018 (UTC)

use User:COIBot/Poke with LinkSummary for domains, UserSummary/IPSummary on users, wait for the COIBot reports to be generated and use them to snowball (create reports for all users in LinkReports, and all domains in UserReports, within reason). —Dirk Beetstra T C 07:41, 27 June 2018 (UTC)
 * To be honest, I don't bother pursuing these beyond blocking. It's not worth it until the WMF get their arses moving and implement a CAPTCHA that is actually fit for purpose. MER-C 09:40, 27 June 2018 (UTC)
 * Moved case, closing. GABgab 15:17, 11 August 2018 (UTC)