Wikipedia:Sockpuppet investigations/Lila Cheney 336/Archive

Evidence submitted by Biker Biker
All these editors vandalise using the exact same pattern - changing a couple of letters around in the opening paragraph of articles relating to major brands - Porsche, BMW, Mercedes-Benz, Louis Vuitton etc. I suspect that if there are three (in my initial report) then there may well be others. --Biker Biker (talk) 21:42, 19 February 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
ducks, would like to have a check run for sleepers though, thanks SpitfireTally-ho! 21:46, 19 February 2010 (UTC)
 * All accounts already blocked. . Dominic·t 11:35, 22 February 2010 (UTC)

Evidence submitted by Gogo Dodo
Brand new accounts making their first edits by changing the URLs of well known companies to a different well known company. Very similar account name conventions and all created around the same time. I blocked all of the accounts, but I suspect that there are additional sleeper accounts lurking. -- Gogo Dodo (talk) 23:39, 27 February 2010 (UTC)


 * Flyguy649 pointed out that vandal has had previous SPI case. Can a clerk please merge this SPI case to Sockpuppet investigations/Lila Cheney 336? -- Gogo Dodo (talk) 04:00, 28 February 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Comments by other users
I had a Checkuser look into Wikipedia:Sockpuppet investigations/Lila Cheney 336 ones which is probably why they were all already blocked. I'm convinced the above users and the Lila Cheney group are the same as they hit the same targets, hit usually 2 targets then move to another account, and mark all edits as minor. Also they name the accounts similarly: one or two words plus number. See this page for a list of all the targets for the vandals. -- Flyguy649 talk 04:14, 28 February 2010 (UTC)

Clerk, patrolling admin and checkuser comments
Requested by Gogo Dodo (talk) 23:39, 27 February 2010 (UTC)

to check for any sleepers, regards, SpitfireTally-ho! 23:40, 27 February 2010 (UTC)


 * And any socks not listed below
 * And any socks not listed below

There are other blocked sockpuppets on the range which I did not list. -- Avi (talk) 06:20, 28 February 2010 (UTC)

case moved from Sockpuppet investigations/Dust 362 to /Lila Cheney 336, SpitfireTally-ho! 05:31, 1 March 2010 (UTC)

Evidence submitted by Excirial
Quite an interesting mode of vandalism, which i haven't encountered so far. Both users swapped the official corporate website between two article's. Both editors seem to have stopped after two edits, have the same mode operandi and are registered within a minute of each other. I haven't seen more of these, but i will report as soon as i find them. Excirial ( Contact me, Contribs ) 22:25, 18 March 2010 (UTC)


 * Actually it has been done almost identically before. It might even be the same person behind it. Look at the pattern of edits, look at the similar name+digits username - Sockpuppet investigations/Lila Cheney 336/Archive --Biker Biker (talk) 15:47, 19 March 2010 (UTC)


 * Indeed, I suspect this is the same user, CU will be able to confirm either way, and if it is then this case can be moved there. Kind regards, SpitfireTally-ho! 15:50, 19 March 2010 (UTC)

Evidence submitted by Biker Biker
Rather silly vandalism, all following the exact same patters - user changes the official URL of two articles then next user picks up from one of the articles and changes another two, then the next user another two and so on. Follow the chain of URLs to articles and you'll probably see more users who are a sock of this idiot. --Biker Biker (talk) 22:29, 18 March 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments

 * Appears to be connected to WP:Sockpuppet investigations/Hellion 468. These two cases should be merged, but I'm not sure how to go about doing so. TN X Man  15:30, 19 March 2010 (UTC)

case from Sockpuppet investigations/Hellion 468 merged to this one, SpitfireTally-ho! 15:35, 19 March 2010 (UTC)

self-endorsed for sleepers and an IP block, if feasible. Thanks SpitfireTally-ho! 15:35, 19 March 2010 (UTC)


 * ✅ - the following accounts as being the same editor;




 * ... plus another bunch of socks, all blocked previously by another checkuser. Too numerous to write up here. These are clearly bot generated accounts and edits, BTW. Account creations are actually in alphabetical order! The accounts are moving from page to page, going to 'External links' and copying the first URL it finds and pasting in the one from the previous article edited. Example here and here, amongst many many others. This might be a good abuse filter candidate if someone can work the algorithm.


 * BTW - for those who don't get the names, they're all characters from the Marvel Comics series (go check!) so the bot may have got them from a category here, like this one. That's actually kinda innovative.


 * Also - a few of them -  A l is o n  ❤ 03:14, 20 March 2010 (UTC)
 * Merged from Sockpuppet investigations/Lifeguard 284. Tim Song (talk) 03:25, 20 March 2010 (UTC)


 * Let's not close this one too soon either. I reckon we need to examine this case carefully and come up with some technical solution to prevent this from recurring, which it may do as each account only really does a small few edits. The abuse filter may be able to deal with this & I recommend asking someone like Jéské take a look into it? - A l is o n  ❤ 03:28, 20 March 2010 (UTC)
 * I knew how to make the Hawkins filter because it was relatively simple for me to suss. Something like this is a bit too complicated for my (admittedly very limited) coding skills and I'd need large amounts of help. —Jeremy (v^_^v Dittobori) 09:26, 22 March 2010 (UTC)
 * At the request of User:Tim Song I went ahead and created a filter that seems to match this pattern. I will be keeping my eye on it for a while for possible improvements, etc., and to make sure it's catching everything. It's currently running log-only. Filter ID is 309. -- Sh i r ik ( Questions or Comments? ) 19:55, 23 March 2010 (UTC)
 * Thanks Shirik, going to archive this case now, SpitfireTally-ho! 20:06, 23 March 2010 (UTC)

Evidence submitted by Flyguy649
Based on the contributions of these users, these are obvious User:Lila Cheney 336 socks, per WP:DUCK and vandalized the same target articles. The question is whether there are other socks hidden in drawers anywhere. Previous SPIs have found sock farms. -- Flyguy649 talk 02:17, 29 March 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
Requested by -- Flyguy649 talk 02:17, 29 March 2010 (UTC)

to check for any sleepers as Lila seems to have a habit of making many accounts.  E lockid  ( Talk ) 02:24, 29 March 2010 (UTC)
 * All ✅, all already blocked, no new sleepers detected. --jpgordon:==( o ) 16:31, 29 March 2010 (UTC)
 * tagged SpitfireTally-ho! 16:35, 29 March 2010 (UTC)

Suspected sockpuppets
All of these have been indef blocked already:
 * (Blocked by -- Flyguy649 talk)
 * added by -- Flyguy649 talk 00:05, 2 April 2010 (UTC)
 * added -- Flyguy649 talk 20:11, 3 April 2010 (UTC)
 * added -- Flyguy649 talk 15:00, 4 April 2010 (UTC)
 * added -- Flyguy649 talk 20:11, 3 April 2010 (UTC)
 * added -- Flyguy649 talk 15:00, 4 April 2010 (UTC)

Evidence submitted by Flyguy649
Definite Lila Cheney sock per WP:DUCK. Looking to see if there are more socks hidden. See Wikipedia:Sockpuppet investigations/Lila Cheney 336/Archive -- Flyguy649 talk 16:19, 1 April 2010 (UTC)
 * Note: 14 socks have shown up since I filed this for Mastermind 147. -- Flyguy649 talk 02:16, 5 April 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
Requested by -- Flyguy649 talk 16:19, 1 April 2010 (UTC)

, considering the results of the previous CU results. –MuZemike 16:32, 1 April 2010 (UTC)

Found two. --Deskana (talk) 02:20, 5 April 2010 (UTC)

Suspected sockpuppets
I've blocked all these per WP:DUCK:
 * ( blocked April 8 by NawlinWiki)
 * ( blocked April 8 by NawlinWiki)
 * ( blocked April 8 by NawlinWiki)
 * ( blocked April 8 by NawlinWiki)
 * ( blocked April 8 by NawlinWiki)
 * ( blocked April 8 by NawlinWiki)
 * ( blocked April 8 by NawlinWiki)
 * ( blocked April 8 by NawlinWiki)
 * ( blocked April 8 by NawlinWiki)
 * ( blocked April 8 by NawlinWiki)
 * ( blocked April 8 by NawlinWiki)

Evidence submitted by Flyguy649
These are obvious socks per WP:DUCK: minor, nuisance changes to the same corporate pages. Editor makes one or two edits per account, then moves on to the next one. This SPI is to see if there any other socks hidden. Most of the previous cases found other socks. -- Flyguy649 talk 23:46, 15 April 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
Requested by -- Flyguy649 talk 23:46, 15 April 2010 (UTC)

for a sleeper check please, and to confirm the link. I've also dropped a memo regarding the edit filter. SpitfireTally-ho! 00:26, 16 April 2010 (UTC)
 * This filter is particularly problematic. First, I created 309 which caught the URLs but also had a high false positive rate making it quite ineffective simply due to the need to manually sort through a large number of edits. 312 was made later but was even more problematic with false positives. As a result, both of these have since been disabled. 316 caught a few of these but it is insufficient to catch them all. I will make another pass at this but it may be something we're just going to have to do whack-a-mole on. However, I do have some interesting ideas that I hope will show some progress. I will update status as I can. -- Sh i r ik ( Questions or Comments? ) 00:46, 16 April 2010 (UTC)

I found one sleeper. Blocck away. --Deskana (talk) 23:57, 16 April 2010 (UTC)
 * I deleted all the userpages of the sockpuppets; no real reason to catalog these ones. A bit of WP:DENY too. NW ( Talk ) 00:05, 17 April 2010 (UTC)

Evidence submitted by Dbratland
Other socks already blocked: --Dbratland (talk) 19:51, 11 May 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Comments by other users
Obvious sock of User:Lila Cheney 336. I suggest looking for sleepers as some of the previous SPIs have found some. -- Flyguy649 talk 05:56, 12 May 2010 (UTC)
 * Moving case to Lila Cheney 336. -- B s a d o w s k i 1   06:13, 12 May 2010 (UTC)

Clerk, patrolling admin and checkuser comments
To check for any sleepers and a possible rangeblock. -- B s a d o w s k i 1   06:24, 12 May 2010 (UTC)

All ✅. He has some variation in his ranges, but not much, so I hardblocked the IPs he uses most often. Can't guarantee he doesn't have more, and I'm reluctant to rangeblock him, since that would cover a lot of ground... J.delanoy gabs adds 03:13, 13 May 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
all blocked by, no need to tag. SpitfireTally-ho! 17:34, 22 May 2010 (UTC)

Evidence submitted by Dbratland
Adding "Blue is a cool color!" to articles with new user accounts, as per usual.--Dbratland (talk) 19:23, 22 May 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
Both blocked. No tagging necessary.  E lockid  ( Talk ) 21:36, 22 May 2010 (UTC)

Evidence submitted by Dbratland
The usual 'Blue is a cool color' added to articles about companies. --Dbratland (talk) 20:01, 26 May 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
both have been blocked, no need to tag. SpitfireTally-ho! 14:27, 27 May 2010 (UTC)