Wikipedia:Sockpuppet investigations/Imsess/Archive

18 June 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

These spam-only accounts, identified by Mean as custard at Sockpuppet investigations/Craytonconstanceb, all identify the same behaviour of creating their user page with a nationality template, posting something on their talk page, and then replacing a citation needed tag with a spam link. Will go ahead and block the accounts, requesting CU to find other accounts. Will also look into creating an edit filter. Sam Walton (talk) 10:32, 18 June 2015 (UTC)
 * Something I meant to mention: Imsess isn't necessarily the sockmaster, just the first account I saw from this bunch. Sam Walton (talk) 11:48, 18 June 2015 (UTC)
 * Added another. edit filter log shows a couple of other possibilities who haven't yet made a spam edit. Sam Walton (talk) 16:24, 18 June 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Accounts blocked. Sam Walton (talk) 10:48, 18 June 2015 (UTC)
 * 13 domains blacklisted and four accounts added. MER-C 12:47, 18 June 2015 (UTC)


 * Group 1 ✅:




 * Group 2 ✅:


 * Group 3 ✅:


 * Group 4 ✅:


 * Group 5 is to each other, if not certainly meatpuppetry:


 * Each group is to each other, as there is some overlap amongst the accounts.


 * George.Aparicio seems to be more likely related the accounts I found in the Craytonconstanceb case. Mike V • Talk 19:25, 18 June 2015 (UTC)
 * All spam reverted. Some additional blacklisting might be in order. Sam Walton (talk) 19:36, 18 June 2015 (UTC)

Three more accounts and an IP address found: 10 domains blacklisted, all above accounts blocked. The last group in the checkuser results are likely engaging in undisclosed paid advocacy, so I have opened Conflict of interest/Noticeboard and Wikipedia:Miscellany for deletion/User:JanetNestin/sandbox to take care of the pages they have created. MER-C 12:30, 19 June 2015 (UTC)
 * It continues:
 * Three domains blacklisted. MER-C 02:25, 20 June 2015 (UTC)
 * Three domains blacklisted. MER-C 02:25, 20 June 2015 (UTC)
 * Three domains blacklisted. MER-C 02:25, 20 June 2015 (UTC)
 * Three domains blacklisted. MER-C 02:25, 20 June 2015 (UTC)

More socks ✅ to each other:

Another group ✅ to each other:

As well as this ✅ group:


 * Mike V • Talk 16:57, 21 June 2015 (UTC)


 * Are those three groups connected?  Vanjagenije  (talk)  19:21, 21 June 2015 (UTC)  Vanjagenije   (talk)  19:21, 21 June 2015 (UTC)
 * Given their nature, I would say it's fairly likely. Mike V • Talk 19:35, 21 June 2015 (UTC)
 * Likely technically or likely behaviorally? I only ask because the last three are a bit different. Sam Walton (talk) 19:48, 21 June 2015 (UTC)
 * The confirmed accounts are confirmed technically. As for the groups, it's more so based upon the behavior. However, it wouldn't be surprising if it's a different spammer, as sadly we're not short of them. Personally, when it comes to spam accounts it's more important to block them than trying to identify which account belongs to which spammer. As such, it's not terribly important to worry about the tags for this case. Mike V • Talk 21:27, 21 June 2015 (UTC)

24 June 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

All show the same behaviour as this group of socks, and were all detected from the edit filter. Requesting Checkuser to catch any accounts missed by the filter. All accounts have been blocked for spamming already. Sam Walton (talk) 23:25, 24 June 2015 (UTC)
 * Added seventeen accounts, most of which didn't trigger the filter but either triggered the blacklist or added links to the sites involved. I have blacklisted all domains. Sockpuppet investigations/Tontitobebe shows the same behaviour and have significant domain overlap (e.g. ). MER-C 12:02, 25 June 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * Two more accounts exhibiting the same behaviour added to checkuser list. . . Mean as custard (talk) 17:33, 27 June 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Checking the ranges from the accounts above, I was able to find these accounts:
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:48, 27 June 2015 (UTC)

08 July 2015

 * Suspected sockpuppets
 * -- 4 spam blacklist hits for domains spammed by this sockfarm
 * -- 4 spam blacklist hits for domains spammed by this sockfarm
 * -- 4 spam blacklist hits for domains spammed by this sockfarm
 * -- 4 spam blacklist hits for domains spammed by this sockfarm
 * -- 4 spam blacklist hits for domains spammed by this sockfarm
 * -- 4 spam blacklist hits for domains spammed by this sockfarm
 * -- 4 spam blacklist hits for domains spammed by this sockfarm
 * -- 4 spam blacklist hits for domains spammed by this sockfarm

Some older accounts:


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same MO: creating minimal-content user page and talk page with some geographical information, and then adding a spam reference ; the company pixelfury.org is the same as pixel-fury.com, which was spammed by previous socks, e.g.. bonadea contributions talk 12:37, 8 July 2015 (UTC)
 * Added accounts from my block log over the past week or so. It looks like the spam is drying up, but I fear these guys have found a new way to spam. MER-C 13:21, 8 July 2015 (UTC)
 * Added two accounts (Francis.McNair, JohnPorter21). MER-C 12:37, 13 July 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Found some extras:
 * CheckUser isn't very helpful with this master as almost every sock had a different range (I'd be looking at MEAT as well). Callanecc (talk • contribs • logs) 12:37, 13 July 2015 (UTC)
 * CheckUser isn't very helpful with this master as almost every sock had a different range (I'd be looking at MEAT as well). Callanecc (talk • contribs • logs) 12:37, 13 July 2015 (UTC)
 * CheckUser isn't very helpful with this master as almost every sock had a different range (I'd be looking at MEAT as well). Callanecc (talk • contribs • logs) 12:37, 13 July 2015 (UTC)
 * CheckUser isn't very helpful with this master as almost every sock had a different range (I'd be looking at MEAT as well). Callanecc (talk • contribs • logs) 12:37, 13 July 2015 (UTC)
 * CheckUser isn't very helpful with this master as almost every sock had a different range (I'd be looking at MEAT as well). Callanecc (talk • contribs • logs) 12:37, 13 July 2015 (UTC)
 * CheckUser isn't very helpful with this master as almost every sock had a different range (I'd be looking at MEAT as well). Callanecc (talk • contribs • logs) 12:37, 13 July 2015 (UTC)
 * CheckUser isn't very helpful with this master as almost every sock had a different range (I'd be looking at MEAT as well). Callanecc (talk • contribs • logs) 12:37, 13 July 2015 (UTC)
 * CheckUser isn't very helpful with this master as almost every sock had a different range (I'd be looking at MEAT as well). Callanecc (talk • contribs • logs) 12:37, 13 July 2015 (UTC)
 * CheckUser isn't very helpful with this master as almost every sock had a different range (I'd be looking at MEAT as well). Callanecc (talk • contribs • logs) 12:37, 13 July 2015 (UTC)
 * CheckUser isn't very helpful with this master as almost every sock had a different range (I'd be looking at MEAT as well). Callanecc (talk • contribs • logs) 12:37, 13 July 2015 (UTC)

24 December 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

As before, all four accounts have identical edit patterns: creation of userpage with some location information, creation of the talk page with "hello", "." or some variant and the replacement of [citation needed] tags with spam. These four domains have been blacklisted.

Master is stale and they're probably using a different VPN by now, but a check would be appreciated in order to help find and blacklist other spammmed domains. MER-C 08:02, 24 December 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Considering the history of this case, and since it appears that no checks have been run in some time, it's probably worth a run through the known ranges. ​—DoRD (talk)​ 13:53, 24 December 2015 (UTC)
 * Block them all + . Most of them are confirmed to each other and using the same range as before. Any discrepancy in the technical side of things is made up in behavior. -- Amanda  (aka DQ) 13:31, 25 December 2015 (UTC)
 * Done. MER-C 14:27, 25 December 2015 (UTC)
 * Nothing left to do here, closing case. Mark Arsten (talk) 23:25, 25 December 2015 (UTC)