Wikipedia:Sockpuppet investigations/Isla Riordan/Archive

25 February 2016

 * Suspected sockpuppets






 * User compare report Auto-generated every hour.
 * Editor interaction utility

This report has been opened after a suggestion at WP:ANI. All of these newly registered accounts and anonymous editors are adding similar links that ultimately lead to watch.movietv.biz. This site includes its own url shortener to make it easy to create different urls and therefore make it difficult to track the urls being added. All of the accounts that I've identified, and there are probably a lot more, have very low edit counts (1-10 edits) and add urls to the beginning of articles. watch.movietv.biz was being added, but some editors have added links to viewhd.me and populartoday.biz. It's fairly obvious that these are all the same editor. As the accounts are all thrown away after a very low number of edits, I have no doubt that there are many more lurking in the wings, or will have been created by the time this report is actioned.  Aussie Legend  ( ✉ ) 20:14, 25 February 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' Added a bunch from the following spam reports:
 * m:User:COIBot/LinkReports/populartoday.biz
 * m:User:COIBot/LinkReports/tvhd.online
 * m:User:COIBot/LinkReports/movietv.biz
 * m:User:COIBot/LinkReports/watchtvshownow.ml
 * m:User:COIBot/LinkReports/touchhere.ml
 * m:User:COIBot/LinkReports/viewhd.me
 * m:User:COIBot/LinkReports/trendstoday.biz
 * m:User:COIBot/LinkReports/hdfree.online
 * m:User:COIBot/LinkReports/streamhd.cf

Also added another batch of accounts that have spam blacklist hits (admins only) for the above domains and v.ht, which is a URL shortener used to redirect to the above domains. This case involves cross-wiki abuse. MER-C 03:55, 26 February 2016 (UTC)
 * Added more users found through the reports MER-C helpfully linked to above. Altamel (talk) 04:15, 26 February 2016 (UTC)
 * Added three domains and another pile of accounts. MER-C 06:57, 26 February 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Please, compare those accounts.  Vanjagenije  (talk)  00:22, 26 February 2016 (UTC)
 * All my blocks between 10:57 UTC and 11:09 UTC today are related to this case. It's around 50 accounts, so forgive me for not listing them all out, but all are ✅. Courcelles (talk) 11:12, 26 February 2016 (UTC)


 * I checked a few more accounts and blocked them as well. Please note that the following accounts are not registered locally:


 * The following accounts have zero edits and have not been blocked:
 * Mike V • Talk 00:41, 28 February 2016 (UTC)
 * Mike V • Talk 00:41, 28 February 2016 (UTC)
 * Mike V • Talk 00:41, 28 February 2016 (UTC)
 * Mike V • Talk 00:41, 28 February 2016 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 00:41, 28 February 2016 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 00:41, 28 February 2016 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 00:41, 28 February 2016 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 00:41, 28 February 2016 (UTC)

22 April 2016

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Accounts were created within three minutes of one another (Logs: 1, 2), and both are adding the same spam URL (jabong.ga/tv/) to television-related articles (Diffs: 1, 2). This is an ongoing sock puppet, as I've reverted and reported many in the past (I don't know who the "master master" is).  ~Oshwah~  (talk) (contribs)   05:00, 22 April 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ✅:
 * I've blocked the unblocked accounts. I'd appreciate it if a clerk would move this case to the oldest account and then tag.--Bbb23 (talk) 14:03, 23 April 2016 (UTC)
 * Moved to Jasper Walkera. Tagged and closing. Kevin ( aka L235 ·&#32; t ·&#32; c) 21:24, 23 April 2016 (UTC)
 * I've blocked the unblocked accounts. I'd appreciate it if a clerk would move this case to the oldest account and then tag.--Bbb23 (talk) 14:03, 23 April 2016 (UTC)
 * Moved to Jasper Walkera. Tagged and closing. Kevin ( aka L235 ·&#32; t ·&#32; c) 21:24, 23 April 2016 (UTC)
 * I've blocked the unblocked accounts. I'd appreciate it if a clerk would move this case to the oldest account and then tag.--Bbb23 (talk) 14:03, 23 April 2016 (UTC)
 * Moved to Jasper Walkera. Tagged and closing. Kevin ( aka L235 ·&#32; t ·&#32; c) 21:24, 23 April 2016 (UTC)
 * I've blocked the unblocked accounts. I'd appreciate it if a clerk would move this case to the oldest account and then tag.--Bbb23 (talk) 14:03, 23 April 2016 (UTC)
 * Moved to Jasper Walkera. Tagged and closing. Kevin ( aka L235 ·&#32; t ·&#32; c) 21:24, 23 April 2016 (UTC)
 * I've blocked the unblocked accounts. I'd appreciate it if a clerk would move this case to the oldest account and then tag.--Bbb23 (talk) 14:03, 23 April 2016 (UTC)
 * Moved to Jasper Walkera. Tagged and closing. Kevin ( aka L235 ·&#32; t ·&#32; c) 21:24, 23 April 2016 (UTC)
 * I've blocked the unblocked accounts. I'd appreciate it if a clerk would move this case to the oldest account and then tag.--Bbb23 (talk) 14:03, 23 April 2016 (UTC)
 * Moved to Jasper Walkera. Tagged and closing. Kevin ( aka L235 ·&#32; t ·&#32; c) 21:24, 23 April 2016 (UTC)
 * I've blocked the unblocked accounts. I'd appreciate it if a clerk would move this case to the oldest account and then tag.--Bbb23 (talk) 14:03, 23 April 2016 (UTC)
 * Moved to Jasper Walkera. Tagged and closing. Kevin ( aka L235 ·&#32; t ·&#32; c) 21:24, 23 April 2016 (UTC)

08 March 2016

 * Suspected sockpuppets






 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)
 * (already blocked)


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Continued spamming, see m:User:COIBot/LinkReports/g.ua, m:User:COIBot/LinkReports/netflixhd.cf, m:User:COIBot/XWiki/surl.im, m:User:COIBot/LinkReports/ontheair.biz, m:User:COIBot/LinkReports/media-tvseries.com, m:User:COIBot/LinkReports/stromtv.me. Any possibility of webhost and/or range blocks? The accounts in the previous SPI that weren't blocked and accounts with no edits here have spam blacklist hits for the domains mentioned. MER-C 13:13, 8 March 2016 (UTC)
 * Another domain, another pile of socks. MER-C 23:56, 9 March 2016 (UTC)
 * Added another domain. MER-C 07:51, 20 March 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

In the past week I've seen numerous IP edits reverted by other editors because they were similar to posts made by the above list of editors. However, the edits I've seen were not to the same websites as previously, so I didn't bother list the IPs. I'll post something about this at WT:TV. -- Aussie Legend  ( ✉ ) 16:31, 8 March 2016 (UTC)
 * I've come across these edits as well. I just added one user to the end of the list. Will continue to add any that Aussie may have missed, before this closes. - Favre1fan93 (talk) 17:29, 8 March 2016 (UTC)
 * I've also added some of the IP addresses that were in the COIBot reports. - Favre1fan93 (talk) 17:41, 8 March 2016 (UTC)
 * The IP 103.27.230.202 is now using Facebook spam links. See here. - Favre1fan93 (talk) 17:44, 8 March 2016 (UTC)
 * Added two more users. - Favre1fan93 (talk) 04:41, 9 March 2016 (UTC)
 * And one more from me. -- Aussie Legend  ( ✉ ) 17:23, 10 March 2016 (UTC)
 * Added another.  Eve rgr een Fir  (talk) Please &#123;&#123;re&#125;&#125; 19:47, 13 March 2016 (UTC)
 * unrelated comment - This is the msot extensive i have seen for an SPI. Winterysteppe (talk) 15:13, 13 April 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * : This case involves cross-wiki abuse. - Mailer Diablo 15:54, 8 March 2016 (UTC)
 * I took a brief look. It's going to be more complicated, and most likely only a sleeper check. Ranges seem to dart all over. -- Amanda  (aka DQ) 08:29, 9 March 2016 (UTC)
 * - /me whistles. This is a biggie.  DQ under-states the complexity of this one.  I'm working on it, but it'll take a bit.  -Philippe  (talk) 00:56, 13 March 2016 (UTC)
 * Yeah, this one's going to take a while. If you add any new accounts to the SPI, please put it BELOW the ones that are currently there - yes, under the IP addresses and everything - so we don't miss them. Thank you.  Risker (talk) 03:20, 16 March 2016 (UTC)
 * Thank you, . We're about 75% checked by account, still need to do some range checks and fancy stuff.  Risker (talk) 03:40, 17 March 2016 (UTC)
 * No problem . I hope that br I added was okay and in a helpful place to differentiate. And I'm sure you're aware, but don't forget the COIBot Link reports MER-C added below the list of users and IPs for any additional offenders we didn't add. Thank you for taking the time to sort through this, along with anyone else who is working on this too. - Favre1fan93 (talk) 03:52, 17 March 2016 (UTC)
 * Thanks, Favre1fan93. They're on the list to check.  Also, a public thank you to, whose support here has been invaluable.  Truth be told, because of a situation that came up in my life, Risker's done the lion's share of the work so far, but I feel quite confident that she will be certain that I carry my share of the load here as well. :P  I'm going to start doing some clean-up tonight, and have some interesting analysis on this one too, I think.  -Philippe  (talk) 08:09, 18 March 2016 (UTC)
 * Okay, let's get some data on the page here. Some key points: all of these accounts are throw-aways (none were used for more than one editing session). They include only the accounts listed on this page; the ones on the COI logs aren't done yet (so clerks, please leave this open). All accounts are blocked, but only one (Amber Francis) is tagged; if someone wants to tag them, be my guest. The IPs are all dynamic, so there is not much point in blocking for more than a few hours. Once an IP is blocked, they move on to another IP.  Philippe is continuing to work on the IP data, but it does not look like there are any ranges to block at this point; as noted, they're dynamic, and there are other good editors on at least some of those ranges. Without further ado, these accounts have all been blocked as socks of Isla Riordan:

There is one account,, which I have not blocked. It has some technical variations from the remainder of the accounts, so I will leave it to others to examine whether the edits are sufficiently in line with the other accounts to block. Risker (talk) 00:04, 21 March 2016 (UTC)


 * Thank you for all the hard work so far. I found two additional domains among the confirmed accounts (now blacklisted): m:User:COIBot/LinkReports/thestreammovie.cf and m:User:COIBot/LinkReports/bestfreestreaming.ga and another 18 accounts who added links to those domains. I also found one more domain via other means. Ericcalpman added links to a spam blog for tv-seriesworld.com, which I'm not convinced yet is part of this. MER-C 13:03, 21 March 2016 (UTC)
 * Another domain, thankfully with only one account. MER-C 07:02, 23 March 2016 (UTC)
 * Bad news: I've just found out that domains under the TLDs .ga, .ml, .cf and .gq are all free, which would explain why they're popping up in large numbers above. We need to try something more drastic... MER-C 13:40, 8 April 2016 (UTC)

Are you or other admins still working on this since your March 21 post? Should we still be adding new accounts to this date of the SPI? - Favre1fan93 (talk) 17:04, 20 April 2016 (UTC)
 * I can only speak for myself, but yes, i'm still looking - although more slowly than I would like, and honestly, this one is a long hard slog. PS - I know that Risker has asked for some help from others on this as well, though I'm not sure how many have jumped in.  -Philippe  (talk) 04:29, 22 April 2016 (UTC)
 * Great. I was just asking because we hadn't heard from any admins on this for a bit, so I wanted to make sure it was still being investigated / if new IPs, domains or users were found, they were being noticed. - Favre1fan93 (talk) 04:36, 22 April 2016 (UTC)
 * Noting that I've seen this comment. I have indeed asked for others to pitch in, because right now I'm pretty tied up with my commitment to the Funds Dissemination Committee (which will continue until mid-May), and I'll not have any significant time to focus on this until after that is complete. Risker (talk) 05:06, 22 April 2016 (UTC)
 * This is certainly the same as Sockpuppet investigations/Jasper Walkera (ping Bbb23, who handled it). Another long list of accounts at WikiProject Spam/LinkReports/jabong.ga.  Mostly interested in how much collateral damage there'll be in the underlying ips. —Cryptic 05:18, 28 April 2016 (UTC)
 * Definitely has to be some connection, because we've added Jasper plus two other accounts from that SPI here to be checked, so I wouldn't be surprised if the two investigations needed to be melded together. - Favre1fan93 (talk) 05:22, 28 April 2016 (UTC)
 * There are a lot of CheckUsers already involved here, but I'm responding to 's ping. I've done just a bit of spot-checking because it would take a while for me to go through all the accounts on the suspected list, not to mention the accounts found confirmed. Overall, I'd say the accounts in this case and the Jasper Walkera case are related. Just looking, for example, at the Isla Riordan account, the IP range is the same, the OS is the same, and it's the same browser but different versions, and the reverse of what you'd expect, meaning Isla Riordan is using a newer version on an earlier date. In some cases, that can muck things up; in this case, I doubt it. At the same time, Amani Maly, also confirmed by Risker, and Jasper Walkera are ✅. There are several other accounts that were the same as Amani Maly that Risker added to her confirmed list. If it were my call, I'd merge the Jasper Walkera case into this one (Isla Riordan is a couple of months older), although these spam link cases that  brings are often so large and the accounts so short-lived, the main thing that matters is the blacklist and that we catch them, no matter which master they're assigned to. As an aside, Aaliya Nicholson is an unregistered account.--Bbb23 (talk) 13:12, 28 April 2016 (UTC)
 * Looking at the lists above, should be  (missing the "h"). -- Aussie Legend  ( ✉ ) 14:08, 28 April 2016 (UTC)
 * Any connection with prolific sockpuppeteer User:Kim Cardassian? They created multiple name accounts, some of them having Indonesian names like eg. User:Wirosableng. Most of their edits were to entertainment articles (music, arts, film) too btw. 118.97.165.164 (talk) 07:56, 2 May 2016 (UTC)


 * I don't think this case is "in progress". I don't think any CheckUser is currently checking or even about to check in the short term. I know I'm not. I've therefore put it in a CU requested status. Perhaps it'll get some attention that way.--Bbb23 (talk) 14:39, 18 May 2016 (UTC)
 * I merged Sockpuppet investigations/Jasper Walkera here and re-tagged.  Vanjagenije  (talk)  09:50, 1 June 2016 (UTC)
 * - Please, check those newly added accounts.  Vanjagenije  (talk)  09:49, 1 June 2016 (UTC)


 * I'll take a look. It might take a while, so bear with me. <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 21:17, 1 June 2016 (UTC)

The following accounts are ✅ (and blocked):


 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }
 * }


 * I would advise against blocking Ericcalpman, as that appears to be unrelated based upon the behavior of the other accounts. <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 23:27, 1 June 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Adding illegal streaming sites for recent TV episodes, as Isla and various IPs of this sock have done. - Favre1fan93 (talk) 03:34, 29 November 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. Closing.  Vanjagenije  (talk)  08:29, 29 November 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same MO; adding spam links to illegal streaming sites for TV episodes. There are probably sleepers as well beyond what I've added here. - Favre1fan93 (talk) 18:59, 30 November 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅, no sleepers, and rangeblocks in place as appropriate. Closing. Katietalk 12:14, 1 December 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Found others. Spam links again for TV series. The IP is only blocked for a short while, but should be changed to indef and tagged as a sock. - Favre1fan93 (talk) 17:11, 1 December 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅, no sleepers on this range. They're using webhosts, which I can block and rangeblock long-term, but they're finding new ones all the time. It'll be whack-a-mole for a while. Katietalk 18:59, 1 December 2016 (UTC)
 * Understood. That's the frustrating part. Thanks ! Most likely I'll probably have more to add tonight. - Favre1fan93 (talk) 19:06, 1 December 2016 (UTC)


 * Case closed.  Vanjagenije  (talk)  19:21, 1 December 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Similar editing in which user would add spam/illegal streaming links to television related articles. Favre1fan93 (talk) 05:12, 15 February 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * IP made two edits and hasn't edited since. Closing. GABgab 14:52, 15 February 2017 (UTC)