Wikipedia:Sockpuppet investigations/JohMorris/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

All of these accounts are single-purpose accounts, with the goal of updating either Grams (search) or with links to possible spam/phishing websites. I'm hoping CheckUser can shed additional light into this, as there are a few anomalies. For example, in the revision history of Helix Light, we see Wikibypeople and Gramshelix edit warring over the link. I've included a list of users and the link that they add below. Given the differences, I'm inclined to think that Uni net443 and Gramshelix may be unrelated, but I've included them here for reference, since they are also single-purpose accounts.

Accounts that have added "grams.link":
 * GramsTeam (diff: ) – I've actually gone ahead and blocked this account for its username violation. Mz7 (talk) 04:34, 26 May 2017 (UTC)
 * ArgyrisGianis (diff: )
 * Wikibypeople (diff: )
 * Delu-shrub (diff: ) - This account is already blocked for its username violation. Mz7 (talk) 04:34, 26 May 2017 (UTC)
 * BangTheSound (diff: )
 * Ronnie78 (diff: )
 * ContentManager2008 (diff: - actually adds a different, though similar link)
 * Nacreshims (diff: )

Accounts/IPs that have added "grams.site":
 * Uni net443 (diff: )
 * (diff: ) (I know that CheckUser cannot publicly connect accounts to IPs, but noting this for the record.)
 * (diff: )

Accounts that have added "gramshelix.org":
 * Gramshelix (diff: ) This account is already blocked for its username violation. Mz7 (talk) 04:34, 26 May 2017 (UTC)

Mz7 (talk) 04:17, 26 May 2017 (UTC)


 * Update: The CheckUser findings (thanks as always, Bbb23!) are pretty consistent with what I was thinking above. Given the technical data and the behavioral evidence above (namely, the edit warring between Wikibypeople and Gramshelix in the revision history of Helix Light), I agree that Uni net443 and Gramshelix are both unrelated to the group of sockpuppets identified and unrelated to each other (since they added different links). There may be other issues associated with these accounts, but that would be beyond the scope of SPI. Since Uni net443 hasn't edited for several weeks, and since Gramshelix is already blocked for a username violation, I recommend that this be closed with no further action. Mz7 (talk) 00:25, 27 May 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ✅:
 * ContentManager2008 is.
 * The following accounts are ❌/:
 * Blocked and tagged all the related accounts.--Bbb23 (talk) 14:50, 26 May 2017 (UTC)
 * Closing per Mz7. Bbb23 (talk) 00:32, 27 May 2017 (UTC)
 * ContentManager2008 is.
 * The following accounts are ❌/:
 * Blocked and tagged all the related accounts.--Bbb23 (talk) 14:50, 26 May 2017 (UTC)
 * Closing per Mz7. Bbb23 (talk) 00:32, 27 May 2017 (UTC)
 * ContentManager2008 is.
 * The following accounts are ❌/:
 * Blocked and tagged all the related accounts.--Bbb23 (talk) 14:50, 26 May 2017 (UTC)
 * Closing per Mz7. Bbb23 (talk) 00:32, 27 May 2017 (UTC)
 * Blocked and tagged all the related accounts.--Bbb23 (talk) 14:50, 26 May 2017 (UTC)
 * Closing per Mz7. Bbb23 (talk) 00:32, 27 May 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

same as the others &mdash;  Rhododendrites talk  \\ 23:47, 7 June 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Mz7 (talk) 16:51, 8 June 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Also adding the "grams.link" URL as other accounts have:. Mz7 (talk) 23:10, 24 August 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * . Mz7 (talk) 23:10, 24 August 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

The following users all added an (almost assuredly) phishing site to the Bitcoin Fog article: foggedddxlunnaaa.onion (certainly not the real address) or bìtcoinfog.com (note sly unicode in second char: i to ì), both sites associated with twitter account @bltcoinfog (note typo: i to l). I've remarked on the likely correct address and twitter account, on Talk:Bitcoin_Fog..

I am adding this under JohMorris as that was the first user to make the change to foggedddxlunnaaa.onion, implying a very likely connection.

101.51.128.253 https://en.wikipedia.org/w/index.php?title=Bitcoin_Fog&diff=796934087&oldid=796830715

Eric martin https://en.wikipedia.org/w/index.php?title=Bitcoin_Fog&diff=prev&oldid=796248472

JafarMambiddo https://en.wikipedia.org/w/index.php?title=Bitcoin_Fog&diff=796209114&oldid=794413295

171.60.210.166 https://en.wikipedia.org/w/index.php?title=Bitcoin_Fog&diff=794410975&oldid=794366719

Matsumi chan https://en.wikipedia.org/w/index.php?title=Bitcoin_Fog&diff=790685329&oldid=790383227

BradleyDavid https://en.wikipedia.org/w/index.php?title=Bitcoin_Fog&diff=783319071&oldid=782373486

JohMorris https://en.wikipedia.org/w/index.php?title=Bitcoin_Fog&diff=777131730&oldid=776988703 Nanite (talk) 00:38, 25 August 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Good eye. All of the named accounts are connected by the foggedddxlunnaaa.onion URL, and BradleyDavid also added "grams.link" characteristic of JohMorris (diff: ). The bìtcoinfog.com URL is related to foggedddxlunnaaa.onion based on this edit, which adds both. Based on this, I've blocked and tagged all of the named accounts. The two IP addresses geolocate to different regions, but the behavioral evidence is compelling. I haven't blocked either of them, but I would watch them closely. Like Grams (search), pending changes is now in place on Bitcoin Fog. Mz7 (talk) 01:49, 25 August 2017 (UTC)