Wikipedia:Sockpuppet investigations/JustineRufino/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

raised the issue at m:talk:spam blacklist (m:special:permalink/21158688) of an issue with a series of domains and users through time. The primary noted user edited at Pililla and the other users all added similar content around the same time with each set of text having been reverted. It is duck stuff that they are related, though I suspect that we will have similar edits from other users on other articles. Big concern will be that it will be busy ranges, though there may be something evident to checkusers of a broader range of accounts and their conflict of interest / paid editing.

Putting aside the issue of domains, and the additions at Commons, and the requested blacklisting of the domains, as they are quite gentle with their pushing of their conflict of interest into articles, and that needs to be managed separately and may show up better if there are decent checkuser hits. Noting that the behaviour at Commons is the addition of photographs, not usually with domains, though often when editing articles here. Thanks. — billinghurst  sDrewth  06:21, 27 February 2021 (UTC)


 * Addendum. The usernames raised in the meta spam blacklist discussion includes old accounts, that demonstrate that this behaviour has been happening for years, and many of those won't be CU'able. I didn't check the ages of all those mentioned accounts, so unaware if any, or how many, of those are current. — billinghurst  sDrewth  06:24, 27 February 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * There were quite a few that were current with edits as recent as last month—if it makes the CUing easier I can compile a list of those. Also cc as the sysop I had been talking about this ring with. Perryprog (talk) 14:34, 27 February 2021 (UTC)
 * Oh, also CC as the now-clerk(!) I was talking about this with. Perryprog (talk) 15:43, 27 February 2021 (UTC)
 * Thanks for the ping Perry – I think it makes sense to compile a full list of accounts, both for record-keeping purposes and to get a bigger data pool for CU. Blablubbs | talk 15:51, 27 February 2021 (UTC)
 * Per off-wiki conversation with perryprog, adding the list of remaining accounts below.
 * Not stale:
 * Probably stale:
 * --Blablubbs | talk 17:41, 27 February 2021 (UTC)
 * Probably stale:
 * --Blablubbs | talk 17:41, 27 February 2021 (UTC)
 * Probably stale:
 * --Blablubbs | talk 17:41, 27 February 2021 (UTC)
 * Probably stale:
 * --Blablubbs | talk 17:41, 27 February 2021 (UTC)
 * Probably stale:
 * --Blablubbs | talk 17:41, 27 February 2021 (UTC)
 * --Blablubbs | talk 17:41, 27 February 2021 (UTC)
 * --Blablubbs | talk 17:41, 27 February 2021 (UTC)
 * --Blablubbs | talk 17:41, 27 February 2021 (UTC)
 * --Blablubbs | talk 17:41, 27 February 2021 (UTC)
 * --Blablubbs | talk 17:41, 27 February 2021 (UTC)
 * --Blablubbs | talk 17:41, 27 February 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
is an admin asking for this check. — billinghurst  sDrewth  06:21, 27 February 2021 (UTC)


 * I checked the lot and I don't think I can do much for you. They are hitting many different IPs with some IP ranges block and don't show enough consistency to be able to tell them apart without behavoir. -- Amanda  (aka DQ) 21:35, 27 February 2021 (UTC)
 * Thanks. It smells like an editing factory. WFH! — billinghurst  sDrewth  22:20, 27 February 2021 (UTC)

Suspected sockpuppets

 * ( original case name)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Promotional sock farm for a site called Camella Manors. Suspected sock recently reverted removals of additions made by suspected sockmaster, who is already blocked for such spam. Requesting CheckUser for connection as well as for sleeper accounts. Jalen Folf  (talk)  17:48, 29 March 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * The sock farm's SPI can be found here. From what I understand, this is a Filipino spam ring, and the ISP IP ranges there aren't too conducive to good checkuser results. In my opinion it's equally likely this is just a WFH UPE ring, and there isn't too much of a need for a checkuser connection between this ring's accounts. See also my WikiProject Spam reports here and here. Perryprog (talk) 15:44, 30 March 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * . Same geolocation, wide range, and common user agent.  ~Oshwah~  (talk) (contribs)   18:03, 29 March 2021 (UTC)


 * Moved under the JustineRufino banner,, closing. GeneralNotability (talk) 03:13, 17 April 2021 (UTC)