Wikipedia:Sockpuppet investigations/Frost joyce/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

This sockfarm edits since 2012, closely aligned with Allen Shofe and his clients' interests. A small subset was blocked in 2013 by as part of the ExtraBart SPI (some additional accounts in that SPI not listed here, maybe sharing proxies... I couldn't find a behavioral link to all of them), and in 2014 by  (see Category:Wikipedia sockpuppets of RepordRider, RepordRider group from now on). To ease evidence reading, I broke down most of the accounts into subgroups.

Beyond topical overlap, there's a quite characteristic edit summary style shared over long periods of time. Tables of edit summary pattern overlaps and corresponding diffs are presented below. Some accounts share some quirks visible in sandboxes and user pages too. Timecards are quite consistent as far as I've checked.

There is also an old account that, despite the obvious user name similarity, has not enough (undeleted?) edits to connect it very well:.

The following table is a summary of articles edited by this sockfarm and that bear some relation to Allen Shofe clients.
 * Client overlap


 * Azerbaijan group
 * This group is specialized in Azerbaijan.
 * Frost joyce and GularVahabov777 are CU-confirmed to each other on ExtraBart SPI.
 * Marilynhblythe was later CU-confirmed to RepordRider, see Category:Wikipedia sockpuppets of RepordRider. That account is part of the Azerbaijan subgroup, but it's not included here.


 * RepordRider group
 * Already blocked and CU-confirmed subgroup, including it here for completeness.
 * There are article overlaps with both the main group and the Azerbaijan group.


 * Allen Shofe (-2015) group
 * Main group, the most closely aligned with Allen Shofe and Emergent BioSolutions. Accounts until 2015.


 * Qatar group


 * Allen Shofe (2016-) group
 * Accounts in the main group since 2016. Split for clarity, since it seems there were a few behavioral changes in 2015/2016, maybe related to RepordRider blocks.


 * Energy group
 * Subgroup more focused in the Energy sector.


 * Overview


 * All confirmed socks of RepordRider are conflated to the same column.
 * The above Azerbaijan group is conflated to the same column, except Marilynhblythe which is included in RepordRider.
 * The rest of the groups described above are also conflated.


 * Closing remarks

I realize this report is quite big and dense. Please, feel free to ask any question about any behavior or any particular account and I can add further clarifications. MarioGom (talk) 20:14, 28 June 2021 (UTC)


 * For convenience, the (visibly) non-stale accounts are:
 * -- MarioGom (talk) 07:54, 29 June 2021 (UTC)
 * I mentioned the timecard already, but it's also worth mentioning explicitly that edits cluster around 9-5, primarily Monday to Friday in the US. MarioGom (talk) 17:57, 30 June 2021 (UTC)
 * -- MarioGom (talk) 07:54, 29 June 2021 (UTC)
 * I mentioned the timecard already, but it's also worth mentioning explicitly that edits cluster around 9-5, primarily Monday to Friday in the US. MarioGom (talk) 17:57, 30 June 2021 (UTC)
 * -- MarioGom (talk) 07:54, 29 June 2021 (UTC)
 * I mentioned the timecard already, but it's also worth mentioning explicitly that edits cluster around 9-5, primarily Monday to Friday in the US. MarioGom (talk) 17:57, 30 June 2021 (UTC)
 * I mentioned the timecard already, but it's also worth mentioning explicitly that edits cluster around 9-5, primarily Monday to Friday in the US. MarioGom (talk) 17:57, 30 June 2021 (UTC)

Some additional connections based on signup timing:
 * Nhj78992 == Henry3898383 (-2015 group)
 * Nhj78992 sign up: 02:07, 7 August 2013, edits: 02:08
 * Henry3898383 sign up: 02:28, 7 August 2013
 * CsCMRd == AcademicMaestro (Azerbaijan group)
 * CsCMRd sign up: 20:20, 2 October 2013, edits: 20:22
 * AcademicMaestro sign up: 22:10, 2 October 2013
 * Trendyrandy7290 == Aaronkytersly4 (-2015 group)
 * Trendyrandy7290 sign up: 14:59, 18 March 2014, edits: 15:03-15:55
 * Aaronkytersly4 sign up: 17:30, 18 March 2014
 * Brianthebreadwinner == Princessmidhatpasha (Qatar group)
 * Brianthebreadwinner sign up: 16:27, 7 July 2015, edits: 16:30 to 16:54
 * Princessmidhatpasha sign up: 17:50, 7 July 2015
 * 1440wordpower == Zulaikhah 1407 (Energy and Qatar groups)
 * 1440wordpower sign up: 18:45, 1 March 2016, edits: 18:46
 * Zulaikhah 1407 sign up: 19:36, 1 March 2016
 * Zulaikhah 1407 sign up: 19:36, 1 March 2016

And also another account added to the report, Cleveland Todd:
 * Signup close to Michael Powerhouse and Xavier Lehtinen.
 * Overlap on various topics, including Emergent BioSolution, EB-5 programs, opioids and Community Choice Aggregation.
 * Edit style summary particularly similar to late socks (e.g. post 2015, Letita Bodicia).

--MarioGom (talk) 23:15, 1 July 2021 (UTC)

Thanks TNT! Adding one more: Full name with space like some of the socks, including the confirmed. Same focus on Emergent BioSolutions (see recent history ) and Opioid epidemic in the United States. Consistent time card. MarioGom (talk) 21:51, 6 August 2021 (UTC)


 * Thanks for the heads up . I was very confident about my report, and the fact that two accounts came up in CU checks, and these accounts are a fairly good behavioral match too, just reinforced it. Obviously I have no idea about the details of the CU data involved... MarioGom (talk) 16:36, 27 August 2021 (UTC)


 * May I request the case to be reopened for behavioral investigation? A less-than-confirmed CU result on one account doesn't preclude examining behavior. MarioGom (talk) 23:55, 27 August 2021 (UTC)


 * : Yeah, thank you. And sorry for not coming back here before. I've been thinking about whether I should drop the stick or push more evidence. It'll be dropping the stick. Best, MarioGom (talk) 15:18, 1 October 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * IP, please log in to edit (see WP:LOUTSOCK), and don't make implicit threats. You're free to bring up a complaint with the WMF, but I doubt that will go far. Just as a personal tip, I'd recommend either turning off your proxy or, on the off-chance that it isn't one, checking your device. I'm seeing some concerning spam flags there. -- Blablubbs&#124;talk 17:50, 30 June 2021 (UTC)
 * In case anyone is wondering, the IP comment in question has since been revision-deleted. --Blablubbs&#124;talk 23:41, 1 July 2021 (UTC)
 * Checks for the Check God, Audits for the Audit Throne ~TNT (she/her • talk) 20:42, 6 August 2021 (UTC)
 * Are you sitting comfortably? Let's begin.
 * are ✅ to one another.
 * were found, ✅ to the above.


 * Everything else is stale, clearly There's No Time for checkuser-ing. ~TNT (she/her • talk) 21:08, 6 August 2021 (UTC)
 * is ✅ to above grouping. ~TNT (she/her • talk) 21:54, 6 August 2021 (UTC)
 * I have a question about being technically indistinguishable. Are two accounts from distinct ISPs and distinct geolocations (albeit in the same country) indistinguishable because they have identical, vanilla agent strings? --jpgordon&#x1d122;&#x1d106;&#x1D110;&#x1d107; 21:36, 10 August 2021 (UTC)
 * @Jpgordon you might find User_talk:RoySmith/Archive_40 useful. -- RoySmith (talk) 16:13, 27 August 2021 (UTC)
 * As far as I can tell, nothing left to do here, so closing. Given the complexity of the case, pinging  to make sure they give it a look before it gets archived. -- RoySmith (talk) 16:26, 27 August 2021 (UTC)
 * I disagree with the finding on User:Cleveland Todd, and I think it was a bad block. --jpgordon&#x1d122;&#x1d106;&#x1D110;&#x1d107; 21:01, 27 August 2021 (UTC)
 * Hey - if you disagree with my findings and think I've made a bad block, it perhaps would have been better if you had left me a talk page message or sent me an email (or, alternatively, popped an email to the CU list for wider review). This was a large, complex case and its possible I've made a mistake - I am far from perfect, but I do tend to try to be very careful.. I'll review this again shortly, but I'd welcome you letting the list/AC know if you think its necessary. ~TNT (she/they • talk) 21:39, 27 August 2021 (UTC)
 * I just disagree that Cleveland Todd is technically indistinguishable; I find that account at most in that it has an identical vanilla agent string as the other two. If there is behavioral evidence indicating a match, that's a different matter entirely, but it's not technical.  --jpgordon&#x1d122;&#x1d106;&#x1D110;&#x1d107; 22:46, 27 August 2021 (UTC)
 * - findings disputed by above ~TNT (she/they • talk) 21:41, 27 August 2021 (UTC)
 * While I believe my initial block was reasonable based on the CU data and 's table of evidence, 's unblock request and CU data which I'll admit wasn't great make an unblock here the most reasonable response on my part.
 * I always welcome review of my actions, and I thank for raising their concerns. As always, if anyone wishes to have these actions reviewed further, please let me know ~TNT (she/they • talk) 22:49, 27 August 2021 (UTC)
 * Reopened per 's request above. -- RoySmith (talk) 01:45, 28 August 2021 (UTC)
 * @MarioGom what do you want to do here? Most of these are long stale.  I looked at the ones that have edited in 2021 and are not blocked:, , and .  Cleveland was blocked, then unblocked in response to an appeal, so that just leaves the other two.  To be honest, there's a fair amount of TLDR at play here, but maybe you could condense the evidence for these two into something more approachable? -- RoySmith (talk) 14:08, 18 September 2021 (UTC)
 * it doesn't look like this is going anywhere, so reclosing. -- RoySmith (talk) 15:15, 1 October 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Created next month after last round of blocks. Consistent timecard. Very similar edit summary style (compare to Sal2017, for example). After some warm up period of gnoming, created Safeguarding Therapeutics Act, which is within a very specific area of interest of this sockfarm (US legislation of interest to pharma lobbyists). I'm going to avoid an extremely verbose report upfront like last time, but feel free to request more notes. MarioGom (talk) 16:05, 6 November 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * @MarioGom @Spicy is a confirmed sock of .  Is there some reason this wasn't opened under Sockpuppet investigations/ExtraBart? -- RoySmith (talk) 13:24, 8 November 2021 (UTC)


 * Given the complexity of the initial report, and the overlap of accounts in 3 previously blocked sockfarms (ExtraBart, RepordRider, as well as a possibly spurious result of Stephenthrompson in Lesbianadvocate Classyklowngrasper), I decided to make a standalone report and let clerks decide if a merge was due, and where to merge it to. MarioGom (talk) 13:54, 8 November 2021 (UTC) (amended comment with respect to Lesbianadvocate and Classyklowngrasper, see below)


 * Help me out here. I see that RepordRider is blocked, but can't find where it says who they're a sock of.  I also don't see how  Stephenthrompson is connected in any way to Sockpuppet investigations/Lesbianadvocate.  On the other hand, I'm not sure it really matters.  Socks get put in the wrong case all the time, but this case seems particularly convoluted :-) -- RoySmith (talk) 14:43, 8 November 2021 (UTC)
 * The RepordRider group was a series of checkuser blocks without SPI. See Category:Wikipedia sockpuppets of RepordRider. Stephenthrompson is tagged as confirmed Louislover1969 and suspect to Classyklowngrasper. I think Classyklowngrasper is related to Lesbianadvocate, that's why I (incorrectly) remembered that Stephenthrompson was in Lesbianadvocate. If I recall correctly, in the Frost joyce SPI I only included accounts I could link behaviorally in some way, and left out some technical links from other SPIs. I can help trying to figure out the exact historic relations between the groups, but I'm not sure it's worth the effort. MarioGom (talk) 15:17, 8 November 2021 (UTC)
 * I'm sure it's not worth the effort. It's terribly convoluted, undoubtedly contains errors, and is mostly ancient history anyway. -- RoySmith (talk) 16:10, 8 November 2021 (UTC)
 * Yeah, I concur with what is saying. I looked into the links to other sockfarms before archiving but decided that since the cases are very old and merging them wouldn't make any difference w.r.t. the outcome of this case, it wouldn't be a worthwhile use of time to engage in sock archaeology. I realize now that I missed something, though - the recent CU blocked accounts are tagged as confirmed to Frost joyce, but that account is long stale and I see no indication that there is a technical link between them and the later group. Maybe  can clarify if these should be retagged? Spicy (talk) 23:41, 8 November 2021 (UTC)
 * is likely a sock, considering that they just vandalized this page.  Invalid OS talk  15:10, 9 November 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
 
 * - I've spent some time looking at this account and the ones in the previous filing, and I agree there are many behavioural similarities, even beyond what is listed in the filing (would rather not give too many details, but can elaborate privately if necessary). I'm aware that the previous accounts are stale. However, I'm endorsing for a sleeper check because it was effective last time, and for comparison to log data if feasible. Thanks, Spicy (talk) 08:47, 8 November 2021 (UTC)
 * is based on the available technical data, but that's tenuous.  All of the data I compared to was inferred by examining the logs of past investigations (which themselves had questions about correct identifications), and it's wide ranges with common user agents.  If that doesn't spell, I don't know what does.  I've left some notes on cuwiki so at least we'll have more to go on the next time. -- RoySmith (talk) 15:58, 8 November 2021 (UTC)
 * - "possible" is good enough for me; the behaviour is a match. Please indef the sock. Thanks, Spicy (talk) 23:49, 8 November 2021 (UTC)
 * . too.  --Blablubbs (talk) 15:56, 9 November 2021 (UTC)
 * Looks like we've done everything that needs to be done, closing. -- RoySmith (talk) 23:13, 9 November 2021 (UTC)