Wikipedia:Sockpuppet investigations/Grenoble jojo/Archive

12 June 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

The accounts above have all participated in a campaign here to insert articles, links, and references to the company Checkmarx and its products. The similarity in contributions and editing style make it clear that many, if not all, of the accounts are operated by the same person or group of people. Most significantly, the articles they create (usually at Checkmarx, CHECKMARX, or Checkmarx (company), or in their user space) have similar or identical wording. Often a new account is registered, makes a few innocuous edits to non-Checkmarx articles, and then dumps a fully-formed Checkmarx article into their user sandbox. The article is then moved to article space, where it ends up getting deleted as non-notable. This led to Checkmarx being salted, so the article is now being recreated under different names.

At least two of the accounts have admitted to being operated by representatives of the company.

Checkuser is requested – many of the sockpuppets lay dormant for months or years before being used, so there may be further sleepers.

Below I list the accounts in order of their creation date (or for IPs their first edit), along with the promotional edits I identified. There may be further diffs in deleted articles; I can't find these as I'm not an administrator.


 * User:Grenoble jojo (27 June 2007) - creates Checkmarx
 * User:Emozlov (10 September 2008) - creates a Checkmarx article in their sandbox, then moves it to article space as Checkmarx
 * User:85.250.243.88 (23 October 2008) - adds links to Checkmarx          ; admits to posting on behalf of the company
 * User:Checkmarx (28 October 2008) - recreates Checkmarx articles at Checkmarx and User:Checkmarx
 * User:CxQL (25 November 2008) - creates Checkmarx article at CHECKMARX; creates CxQL articles at User:CxQL and CxQL; adds links to Checkmarx and CxQL
 * User:79.178.122.210 (10 December 2008) - adds links to Checkmarx
 * User:Adarw (28 September 2009) - recreates CxQL; recreates Checkmarx; adds links to Checkmarx and CxQL    ; admits to working for the company
 * User:Door.been (24 January 2011) - creates a Checkmarx article in their sandbox
 * User:JimJukeBox (31 May 2011) - recreates Checkmarx
 * User:139.190.181.23 (15 May 2012) - adds links to Checkmarx
 * User:Kabirhat (19 March 2013) - creates a Checkmarx article in their sandbox
 * User:CrystalCanine (3 April 2013) - creates a Checkmarx article in their sandbox
 * User:Securechecker1 (22 April 2013) - adds links to Checkmarx
 * User:Ampant (31 May 2013) - creates a Checkmarx article in their sandbox, then moves it to article space as Checkmarx (company)
 * User:Sedmedia (12 June 2013) - adds links Checkmarx

Relevant AfDs:
 * Articles for deletion/CxQL
 * Articles for deletion/Checkmarx
 * Articles for deletion/Checkmarx (2nd nomination)
 * Articles for deletion/Checkmarx (3rd nomination)
 * Articles for deletion/Checkmarx (company)

Relevant pages: — Psychonaut (talk) 09:19, 12 June 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * Comment - not that it is required, but I thoroughly endorse the above and I have to thank Psychonaut for pulling it all together. This is indeed a persistent campaign to use Wikipedia for promotion and the company simply isn't big enough or notable enough to convince me this is the work of many disparate "fans" or "supporters". Though a checkuser might be time consuming (given the potentially stale accounts and 6 year history), I believe it to be necessary in this instance and I thank whichever CU takes the time to consider it. Stalwart 111  09:56, 12 June 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Compliments for the clear report, Psychonaut. IPs in many different parts of the world - my proxy hackles are raised. Not much for CU to do here as most of the accounts are stale. Blocking and page protection is the easiest way to deal with this, and should be made easier now that I have added the company address to the blacklist. WilliamH (talk) 11:23, 13 June 2013 (UTC)
 * Most of this is too stale for blocks and likely abandoned accounts, but archiving to have a point of reference for future SPI action. Dennis Brown &#124; 2¢ &#124; © &#124; WER  12:25, 29 June 2013 (UTC)

07 July 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

WP:DUCK sock. Created ten innocuous edits to become autoconfirmed, then recreated the Checkmarx article in the user sandbox and moved it to Checkmarx (corporation). Psychonaut (talk) 11:31, 7 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked, nothing else to report. An edit filter which will completely shut this nonsense down is now in the works. WilliamH (talk) 19:18, 8 July 2013 (UTC)
 * Tagged. Closing. Dennis Brown &#124; 2¢ &#124;  WER  20:27, 8 July 2013 (UTC)

18 December 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

These accounts have all been used to promote Checkmarx, a software tool that's been the subject of a years-long spam campaign here on Wikipedia. (See the archive of this SPI report for details.)

The evidence for these accounts is as follows:
 * Weirdedsultry - This single-purpose account, self-admittedly with a connection to the company, created a Checkmarx article in their user space and unsuccessfully requested undeletion of the mainspace article at User talk:MBisanz/Archive 19 and Deletion review/Log/2015 August 23.
 * Akorm6 - Created Draft:Checkmarx; mainspace edits to only a couple other Charlotte, NC-based pages. Surname from the account's userpage matches that of the company's Vice President of Sales in Charlotte, NC.
 * Atriaold - SPA that repeatedly recreated the Checkmarx article under the variant title CheckMarx.

I probably didn't catch these in time for CU, though the behavioural evidence is clear enough. Psychonaut (talk) 13:31, 18 December 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - compare three suspected socks per provided evidence.  Vanjagenije  (talk)  01:01, 21 December 2015 (UTC)
 * The three puppets are .--Bbb23 (talk) 13:41, 21 December 2015 (UTC)


 * I blocked three socks based on behavior (they all created promotional pages about CheckMarx, all are now deleted).  Vanjagenije  (talk)  22:11, 21 December 2015 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Another round of accounts creating Checkmarx-related pages (e.g.,  ) or inserting Checkmarx-related material into existing articles. The first two accounts listed above are SPAs, but the last one has edits in other areas. Psychonaut (talk) 19:56, 26 January 2017 (UTC)
 * Given User:Szoke's comments below, I'm inclined to believe that he's not a sock/meatpuppet. Most of the previous sockpuppets were either uncommunicative or admitted to working for Checkmarx.  —Psychonaut (talk) 13:21, 27 January 2017 (UTC)
 * This report also included User:אסף רזון, but User:Bbb23 removed him or her due to inactivity. It's fine with me if that account isn't further investigated, but I'll just mention it in this comment for record-keeping purposes. —Psychonaut (talk) 13:24, 27 January 2017 (UTC)
 * At User talk:אגם רפאלי I asked the user to indicate whether they have operated any of the other Wikipedia user accounts used to promote Checkmarx, and whether they are being paid to write about Checkmarx here. They answered the second question in the affirmative but have not (yet) answered the first question. —Psychonaut (talk) 10:34, 2 February 2017 (UTC)
 * אגם רפאלי says that they have not operated any of the previous Checkmarx accounts. I assume that the Checkuser data we have on the past accounts is stale and therefore that there is no way of proving or disproving any link. אגם רפאלי is also making an attempt to abide by applicable guidelines and policies relating to conflicts of interest and disclosure of paid editing. So we can probably close this report.  —Psychonaut (talk) 11:31, 10 February 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Hi, I don't really understand what sockpuppet is and why I got flagged. I'm the very same user as https://hu.wikipedia.org/wiki/Szerkeszt%C5%91:Szoke (yes, it's a different language wikipedia) and I figured out that the tool my company is currently evaluating (Checkmarx) is missing from the page https://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis so I added it. For evidences I'm a real person please check out http://dotneteers.net/blogs/petersm/, http://twitter.com/MountGellert , https://adeccoitacademy.wordpress.com/2011/10/31/bemutatkozik-novemberi-eloadonk/ , https://www.linkedin.com/in/smulovicspeter , https://www.amazon.com/Programmer-Kanjilal-Hajdrik-Smulovics-published/dp/B00EKYYDP0/ and https://es-la.facebook.com/MountGellert/ — Preceding unsigned comment added by Szoke (talk • contribs) 21:34, 26 January 2017 (UTC)

Thank you Psychonaut - I have no problem with my change being removed, just wanted to avoid getting flagged. — Preceding unsigned comment added by Szoke (talk • contribs) 13:43, 27 January 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * I'm closing this for the lack of evidence. It't obvious that those are all employees of the same company, but it's hard to prove they are the same person or that they even know each other.  Vanjagenije  (talk)  10:28, 11 February 2017 (UTC)