Wikipedia:Sockpuppet investigations/Lilianarice/Archive

30 July 2017
(originally filed at Sockpuppet investigations/Xingzuin)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Spamming the same ref. Not sure if socks are just responding to the same job post. Doc James (talk · contribs · email) 17:11, 30 July 2017 (UTC)


 * Spam links

Doc James (talk · contribs · email) 22:45, 2 August 2017 (UTC)
 * Another possible sock

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Both are already blocked. Closing. GABgab 22:33, 30 July 2017 (UTC)
 * User:GeneralizationsAre the question is are there any more that are socks. Doc James  (talk · contribs · email) 23:31, 30 July 2017 (UTC)
 * Ah, I see. . Thanks very much, GABgab 00:09, 31 July 2017 (UTC)


 * and  Salvio Let's talk about it! 11:10, 31 July 2017 (UTC)

— Berean Hunter   (talk)  02:38, 2 August 2017 (UTC) — Berean Hunter   (talk)  02:42, 2 August 2017 (UTC)
 * Tagged master and sock as suspected, closing. Sro23 (talk) 18:37, 31 July 2017 (UTC)
 * I have requested a report to see if there are other accounts and placing on hold in the meantime.
 * Yes, there is. Based on this edit, should be a DUCK. Salvio is this a confirmed account?

— Berean Hunter   (talk)  20:41, 2 August 2017 (UTC)
 * and are ✅. Raaajjj is still technically ❌. And now for a whole lot of socks, the following accounts are also, technically speaking, ✅, but, just to be on the safe side,
 * Account being used to barry spam from other accounts
 * Spamming same link. Blocked.
 * Spamming. Blocked.
 * Spamming and then hid by Dotcommastermind
 * Salvio Let's talk about it! 10:21, 2 August 2017 (UTC)
 * User:Salvio giuliano checking and blocking. The pattern is that one account adds a spam link and then the second account quickly makes a minor edit to throw off the bots that deal with spamming. Appears to work. Likely all the links these accounts are adding need to be added to the blacklist. I must sleep but unless someone beats me to it will continue later. Doc James  (talk · contribs · email) 15:36, 2 August 2017 (UTC)
 * All the accounts and removed the spam. Listed a few affected articles at COIN. SmartSE (talk) 19:58, 2 August 2017 (UTC)
 * Blacklisted link local, no cross-wiki that I can see. Still looking at this...
 * Spamming and then hid by Dotcommastermind
 * Salvio Let's talk about it! 10:21, 2 August 2017 (UTC)
 * User:Salvio giuliano checking and blocking. The pattern is that one account adds a spam link and then the second account quickly makes a minor edit to throw off the bots that deal with spamming. Appears to work. Likely all the links these accounts are adding need to be added to the blacklist. I must sleep but unless someone beats me to it will continue later. Doc James  (talk · contribs · email) 15:36, 2 August 2017 (UTC)
 * All the accounts and removed the spam. Listed a few affected articles at COIN. SmartSE (talk) 19:58, 2 August 2017 (UTC)
 * Blacklisted link local, no cross-wiki that I can see. Still looking at this...
 * Spamming and then hid by Dotcommastermind
 * Salvio Let's talk about it! 10:21, 2 August 2017 (UTC)
 * User:Salvio giuliano checking and blocking. The pattern is that one account adds a spam link and then the second account quickly makes a minor edit to throw off the bots that deal with spamming. Appears to work. Likely all the links these accounts are adding need to be added to the blacklist. I must sleep but unless someone beats me to it will continue later. Doc James  (talk · contribs · email) 15:36, 2 August 2017 (UTC)
 * All the accounts and removed the spam. Listed a few affected articles at COIN. SmartSE (talk) 19:58, 2 August 2017 (UTC)
 * Blacklisted link local, no cross-wiki that I can see. Still looking at this...
 * Salvio Let's talk about it! 10:21, 2 August 2017 (UTC)
 * User:Salvio giuliano checking and blocking. The pattern is that one account adds a spam link and then the second account quickly makes a minor edit to throw off the bots that deal with spamming. Appears to work. Likely all the links these accounts are adding need to be added to the blacklist. I must sleep but unless someone beats me to it will continue later. Doc James  (talk · contribs · email) 15:36, 2 August 2017 (UTC)
 * All the accounts and removed the spam. Listed a few affected articles at COIN. SmartSE (talk) 19:58, 2 August 2017 (UTC)
 * Blacklisted link local, no cross-wiki that I can see. Still looking at this...
 * Salvio Let's talk about it! 10:21, 2 August 2017 (UTC)
 * User:Salvio giuliano checking and blocking. The pattern is that one account adds a spam link and then the second account quickly makes a minor edit to throw off the bots that deal with spamming. Appears to work. Likely all the links these accounts are adding need to be added to the blacklist. I must sleep but unless someone beats me to it will continue later. Doc James  (talk · contribs · email) 15:36, 2 August 2017 (UTC)
 * All the accounts and removed the spam. Listed a few affected articles at COIN. SmartSE (talk) 19:58, 2 August 2017 (UTC)
 * Blacklisted link local, no cross-wiki that I can see. Still looking at this...
 * Salvio Let's talk about it! 10:21, 2 August 2017 (UTC)
 * User:Salvio giuliano checking and blocking. The pattern is that one account adds a spam link and then the second account quickly makes a minor edit to throw off the bots that deal with spamming. Appears to work. Likely all the links these accounts are adding need to be added to the blacklist. I must sleep but unless someone beats me to it will continue later. Doc James  (talk · contribs · email) 15:36, 2 August 2017 (UTC)
 * All the accounts and removed the spam. Listed a few affected articles at COIN. SmartSE (talk) 19:58, 2 August 2017 (UTC)
 * Blacklisted link local, no cross-wiki that I can see. Still looking at this...
 * User:Salvio giuliano checking and blocking. The pattern is that one account adds a spam link and then the second account quickly makes a minor edit to throw off the bots that deal with spamming. Appears to work. Likely all the links these accounts are adding need to be added to the blacklist. I must sleep but unless someone beats me to it will continue later. Doc James  (talk · contribs · email) 15:36, 2 August 2017 (UTC)
 * All the accounts and removed the spam. Listed a few affected articles at COIN. SmartSE (talk) 19:58, 2 August 2017 (UTC)
 * Blacklisted link local, no cross-wiki that I can see. Still looking at this...
 * User:Berean Hunter they are adding a variety of spam links. Will go through and create a list of the rest. Doc James  (talk · contribs · email) 21:17, 2 August 2017 (UTC)

The current status, all of the above are indeffed except:


 * User:Mikejohnas (not blocked)
 * User:Elsiefunny (not blocked)
 * User:Manugussy (not blocked)
 * User:Diondodds (not blocked, oldest account)


 * User:Zillokinu (blocked 24 hours for edit warring, no tag)
 * User:Zookieman (blocked 24 hours for edit warring, no tag)

...so I'm confused by SmartSE's all blocked and tagged comment above. This is important because the casename would be moved to the oldest account as the master and it is not currently blocked. Salvio did confirm the accounts. Looking for clarification. — Berean Hunter   (talk)  21:07, 2 August 2017 (UTC)
 * All accounts now blocked indef and tagged. Checking spam links added by other accounts. Doc James  (talk · contribs · email) 22:50, 2 August 2017 (UTC)
 * Woops. I definitely checked all the contribs... just must have missed some blocks and evidently the easyblock script was playing up on the last two as I definitely only clicked on confirmed socks. Thanks Berean Hunter for checking and User:Doc James for fixing it! SmartSE (talk) 12:10, 3 August 2017 (UTC)

New account created adding the same link aswell just before it was added to the blacklist. They are still creating accounts and spamming. Gr Doc James  (talk · contribs · email) 22:53, 2 August 2017 (UTC) More accounts from the database:
 * This one missed, not sure why?
 * This one missed, not sure why?
 * User:Berean_Hunter can you add the rest of the spam links to the blacklist? Else I can try to figure out how. Doc James  (talk · contribs · email) 22:59, 2 August 2017 (UTC)
 * I've added the 12 domains above. MER-C 02:18, 3 August 2017 (UTC)

Stale:

MER-C 03:05, 3 August 2017 (UTC)

— Berean Hunter   (talk)  22:11, 23 August 2017 (UTC)
 * After another round of checks:
 * ✅, but fell through the cracks when I was copying and pasting accounts earlier (sorry)
 * Apparently ❌
 * Can't connect them to our main sockfarm, but they're related to each other
 * Can't connect them to any other sockfarm, but they're related to each other
 * Apparently, technically ❌ to any other and to each other, but CU is of limited use, here, since the IPs used (even by the confirmed socks) are all over the place
 * For now, it's all. Salvio Let's talk about it! 10:22, 3 August 2017 (UTC)
 * For the Syricko group, see Sockpuppet investigations/Anatha Gulati. GABgab 14:25, 3 August 2017 (UTC)
 * Closing as is. I'm not sure that anything would be gained by moving the account to the oldest here or tagging.
 * Can't connect them to any other sockfarm, but they're related to each other
 * Apparently, technically ❌ to any other and to each other, but CU is of limited use, here, since the IPs used (even by the confirmed socks) are all over the place
 * For now, it's all. Salvio Let's talk about it! 10:22, 3 August 2017 (UTC)
 * For the Syricko group, see Sockpuppet investigations/Anatha Gulati. GABgab 14:25, 3 August 2017 (UTC)
 * Closing as is. I'm not sure that anything would be gained by moving the account to the oldest here or tagging.
 * Can't connect them to any other sockfarm, but they're related to each other
 * Apparently, technically ❌ to any other and to each other, but CU is of limited use, here, since the IPs used (even by the confirmed socks) are all over the place
 * For now, it's all. Salvio Let's talk about it! 10:22, 3 August 2017 (UTC)
 * For the Syricko group, see Sockpuppet investigations/Anatha Gulati. GABgab 14:25, 3 August 2017 (UTC)
 * Closing as is. I'm not sure that anything would be gained by moving the account to the oldest here or tagging.
 * For now, it's all. Salvio Let's talk about it! 10:22, 3 August 2017 (UTC)
 * For the Syricko group, see Sockpuppet investigations/Anatha Gulati. GABgab 14:25, 3 August 2017 (UTC)
 * Closing as is. I'm not sure that anything would be gained by moving the account to the oldest here or tagging.
 * For now, it's all. Salvio Let's talk about it! 10:22, 3 August 2017 (UTC)
 * For the Syricko group, see Sockpuppet investigations/Anatha Gulati. GABgab 14:25, 3 August 2017 (UTC)
 * Closing as is. I'm not sure that anything would be gained by moving the account to the oldest here or tagging.

24 August 2017
(originally filed at Sockpuppet investigations/Mrgrayzon)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

See filter logs: Oliganobo and Mrgrayzon both created the same article on a software product perfectly on the first edit as brand new accounts.

Oliganobo additionally created it by a different name to avoid being tagged by the bot as an old AfD.

This has all the hallmarks of socking to include a commissioned article in the encyclopedia. Requesting CU to see if there are any other accounts out there. TonyBallioni (talk) 20:12, 24 August 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Oliganobo is to Mrgrayzon. Master blocked one week, sock indef blocked. Closing. Callanecc (talk • contribs • logs) 08:11, 26 August 2017 (UTC)

16 October 2017
(originally filed at Sockpuppet investigations/Michakellies)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

These users seem to be a cluster of spam accounts working to a pattern.
 * 1) Two word names which are run together without spacing or capitals,
 * 2) Undertake 12-ish inconsequential edits on articles sharing the same initial letter, Leannjoyce - N, Marriehudson - K, and Buckyloonion - J,
 * 3) Go to sleep until autoconfirmed kicks in,
 * 4) Create spam.

It seems to be a repeated pattern to game their way past ACTRIAL. The gaps in the initial letters used suggest there's an L spammer & an M spammer at the least, more likely more, and sleepers which have not yet been used for spam. Cabayi (talk) 15:19, 16 October 2017 (UTC)

Bucky & Leanne's spam overlap at BedJet (company) & BedJet.

Looking through the output from EF 867 found Pittdenloas on the letter U with spam at Major Food Group. Cabayi (talk) 15:52, 16 October 2017 (UTC)

Janicediscko on the letter W, spam at MySugr. Kellyhunggino on the letter Q, spam at O’Keefe Reinhard & Paul. Cabayi (talk) 16:28, 16 October 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I've added Karenswiss to the SPI. Similar MO: adding Wikilinks to random articles to get autoconfirmed  and then creating an article perfectly in one edit. The naming pattern is also the same here for all the accounts: one full name with no spaces and where the last name is kept lowercase. TonyBallioni (talk) 15:44, 16 October 2017 (UTC)
 * Also, for whomever the CU or clerk is processing this, can we get a check for sleepers/other accounts. This looks pretty large scale, and given the similar username patterns, I'm leaning that this is a connected ring rather than just a bunch of independent actors following the same methods. TonyBallioni (talk) 16:32, 16 October 2017 (UTC)
 * no real need for COIN here IMO. I've tagged the four articles created by this farm for G5 working on the reasonable assumption that this ring has been blocked before. They were trying to build up a bunch of accounts to get around ACTRIAL and we were lucky that we were able to catch them early. TonyBallioni (talk) 18:37, 16 October 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - There's a fairly clear pattern here. Given the number of accounts involved, and the fact that they're trying to game the limitations placed on new accounts, I have to agree with TonyBallioni. The existence of additional socks seems likely. Please check to confirm socking, and identify potential sleepers. Sir Sputnik (talk) 16:45, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)


 * Wow. I've moved the case and everyone.  I recommend you take this to COIN. Thanks,  GABgab 18:35, 16 October 2017 (UTC)
 * OK, you're the expert :) See also MySugr, O’Keefe Reinhard & Paul. GABgab 18:39, 16 October 2017 (UTC)
 * Looks like there's nothing left to do here. Closing. Sir Sputnik (talk) 19:32, 16 October 2017 (UTC)

24 October 2017
(originally filed at Sockpuppet investigations/Michakellies)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Creation of Jū-Ni (restaurant), which master/sock uploaded and crossover with  here, here and  also follows same naming pattern. CHRISSY MAD ❯❯❯  ¯\_(ツ)_/¯  15:47, 24 October 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * the page created is an exact replica of Ju-Ni (Japanese restaurant), which was created by, a CU confirmed sock of this group, so its either the same person or they are different people who have a shared drive and it would be WP:PROXYING. The sock in this report is . I'm not closing, because I think it'd be worth a clerk assessing whether CU was needed for sleepers given the number found on the last check. TonyBallioni (talk) 16:04, 24 October 2017 (UTC)
 * - Given the sheer number of accounts found in the last case, a check for sleepers is probably a good idea. Sir Sputnik (talk) 16:34, 24 October 2017 (UTC)
 * ✅ plus . is ✅ (see this deleted article as well). ​—DoRD (talk)​ 17:10, 24 October 2017 (UTC)
 * All accounts The deleted article for Macygondo is similar enough in format and has other signs of a commissioned work as well. TonyBallioni (talk) 17:20, 24 October 2017 (UTC)
 * Tagging and closing. Sir Sputnik (talk) 17:20, 24 October 2017 (UTC)

25 October 2017
(originally filed at Sockpuppet investigations/Mrgrayzon)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Lilianarice that they are "managing" WP editing projects. Although activity on this account halted after November 2014, off-wiki evidence exists that as of today, they are still offering paid WP article editing. This account Oliganobo has recently attempted to recreate one of Lilianrice's deleted articles, Avaza (software) as Avaza Software. Realizing that CU data is out of scope, consider this a request for procedural WP:DUCK linkage of the accounts based on the off-wiki stuff. and WMF Legal are aware of the contents of the off-wiki info. ☆ Bri (talk) 17:27, 25 October 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * , just as a procedural comment not being aware of the off-wiki stuff, that article is linked to which DoRD found yesterday to be technically indistinguishable from the group at Sockpuppet investigations/Michakellies. It also appears behaviorally linked to the accounts in that archive by username format. TonyBallioni (talk) 17:32, 25 October 2017 (UTC)
 * One question is are their any obvious sleeper accounts. Doc James  (talk · contribs · email) 23:59, 25 October 2017 (UTC)
 * DoRD did two sleeper checks and found a total of around 27(?) accounts. I'm sure there are probably stale ones if you go through the various deleted articles. TonyBallioni (talk) 00:00, 26 October 2017 (UTC)
 * - Please compare this case and Sockpuppet investigations/Michakellies. Thanks, GABgab 23:51, 27 October 2017 (UTC)
 * This one's a pain-in-the-ass. Between the master here and Sockpuppet investigations/Michakellies, due to proxy usage. Having said that, the master here is ✅ to, which appears to be spamming a link in a vaguely promotional manner, and also to , who created the promotional OverTheTop (company).  previously created OverTheTop, and is currently linked to Sockpuppet investigations/Xingzuin, which is known for – you guessed it – link spam. I recognize this particular webhost because I've been dealing with an absurd number of accounts that have been link spamming from different ranges owned by the same company recently, and I just blocked about a dozen more on this range. I would recommend throwing the master in with Xingzuin based on these technical links. Everything mentioned above is  except  which is so old that it's not worth doing anything about. ~ Rob 13 Talk 19:23, 28 October 2017 (UTC)
 * These are all the accounts I blocked in connection with this, just for the record. None are tagged, nor do I think worrying about tagging them will be particularly productive. ~ Rob 13 Talk 19:28, 28 October 2017 (UTC)
 * I've encountered additional crossover between promotional articles and the link spamming from Xingzuin. At this point, I think a merge is appropriate. ~ Rob 13 Talk 10:20, 30 October 2017 (UTC)
 * This is related to Sockpuppet investigations/Michakellies as well, so where to merge I'll leave up to the clerks. can come up with something, perhaps. ~ Rob 13 Talk 12:10, 30 October 2017 (UTC)
 * - merging these cases will be straightforward but will take me some time. Ivanvector (Talk/Edits) 14:37, 30 October 2017 (UTC)
 * ✅ - I have merged all three cases and moved to the name of the oldest account which I'm considering proven based on behaviour, however per Rob's note above I have not blocked the master account. I've re-tagged all of the accounts that had been tagged previously, as well as re-tagged the former masters, but have not blocked or tagged any other accounts. I'm leaving this as "checked" in case I missed anything, but don't hold on my account. Ivanvector (Talk/Edits) 15:15, 30 October 2017 (UTC)
 * You can definitely block the master. I just wasn't interested myself in looking at the behavioral links because of how old the account was. If you've already done so, no point leaving it unblocked. ~ Rob 13 Talk 16:22, 30 October 2017 (UTC)


 * Looks like there's nothing left to do here. Closing Sir Sputnik (talk) 17:49, 12 November 2017 (UTC)
 * Another editor pointed out to me that the master is still unblocked here. Can you evaluate whether the master is behaviorally tied and block if so? Thanks. ~ Rob 13 Talk 03:29, 15 November 2017 (UTC)
 * yes, I'm convinced to the point of certainty that Lilianarice is the master (I tagged with "checkuser evidence confirms") but I thought we all agreed that there's no good reason to block an account that hasn't edited in three years. Did I misread the discussion? Ivanvector (Talk/Edits) 13:43, 15 November 2017 (UTC)
 * See my last comment in the chain above; if we're sure they're the same person, they should be blocked. I had originally deferred on looking into the account at all with the opinion that the time spent evaluating behavior could be better spent elsewhere, given the long inactivity. If you've already looked at it, though, it's worth blocking. ~ Rob 13 Talk 14:00, 15 November 2017 (UTC)
 * Alright, the master is blocked. Since I don't expect a time-limited block to be of any use on an inactive account, the master's block is indefinite. Ivanvector (Talk/Edits) 14:05, 15 November 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Recreation of Richard’s Foodporium, one of many variations of Richard’s Foodporium (food retailer) etc... plus follows same naming convention. CHRISSY MAD ❯❯❯  ¯\_(ツ)_/¯  13:25, 9 November 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  18:23, 14 November 2017 (UTC)
 * the account is blocked as a duck: identical recreation. Requesting CU for a sleeper check given how massive previous incarnations of this have been. Not tagging yet since I've requested CU. TonyBallioni (talk) 13:41, 9 November 2017 (UTC)
 * - Given the number of accounts used in the past, please check to identify potential sleepers. Sir Sputnik (talk) 17:49, 12 November 2017 (UTC)
 * Linamchu is to  as they are on the same IP which is a proxy. Different UA but the spammy looking addition makes one wonder. Neither of the UAs match the other socks in this case however.
 * Given the subject matter of the one edit, and the fact that the link is now broken, I'm inclined to think the proxy is being used by someone else now. Closing. Sir Sputnik (talk) 18:35, 14 November 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Behaviour very reminiscent of Sockpuppet investigations/Lilianarice/Archive, multiple inconsequential edits on articles with same initial letter to acquire autoconfirmed, followed by spamming. Request CU because of use of multiple socks & sleepers previously. Cabayi (talk) 13:54, 4 December 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I'm not sure that Rob Jaron's behaviour links them to this case, but I am sure that a brand new account making exactly 10 edits before writing an article on a jewelry retailer that's been deleted before (as James Allen Jewelers) is the behaviour of a hired editor. to see if this is the same user or some other, or if we need to make a new case. Also note that the original creation from a year ago was created by, who has been a semi-active editor for 12 years, and the two articles are only somewhat similar. Ivanvector (Talk/Edits) 14:30, 4 December 2017 (UTC)
 * Nothing obvious found. to the non-stale socks because they were editing from proxies (this account is not). As a side note, the 10 edits look a lot like link spam. ~ Rob 13 Talk 17:21, 4 December 2017 (UTC)
 * Closing with no action. This could perhaps use a look from WP:COIN to evaluate whether this is paid editing, but I don't see enough to say these two editors are the same person. Pinging so he can determine if a thread there is a good idea. ~ Rob 13 Talk 17:16, 10 December 2017 (UTC)
 * I concur that some of the edits look like spam, but others seem ok. The jewellery article is obviously UPE though so I think it is safe to assume they are a sock of somebody. With no remaining problems a COIN thread would be superfluous and I highly doubt that they will return, so I am not sure whether a block is warranted at the moment. SmartSE (talk) 16:57, 11 December 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Autoconfirmed gaming to upload images using similar methods to this sock farm. Initial creation is perfectly formatted and includes maintenance banners, suggesting that it has been created as an article before. Also, note the company name in parenthesis and the formatting choices, which are methods used by UPE farms to throw off Special:Undelete (to the point I can't find the original source). These are methods used by this farm in the past. Additionally, the username format is almost identical to this farm's name of choice.

Asking for CU mainly for a sleeper check given how large this farm is: there might be some non-stale confirmeds, but unsure. The account is probably DUCKable on its own. TonyBallioni (talk) 23:36, 25 January 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * reasonable request given some of the sleeper check results in the archive - TNT❤ 23:38, 25 January 2018 (UTC)
 * , nothing useful to go off in regards to confirming. Therefore, - TNT❤ 23:41, 25 January 2018 (UTC)
 * Duck blocked with tags per above. Clear UPE and the behavior aligns most closely with this farm. Closing. TonyBallioni (talk) 23:45, 25 January 2018 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Recreation of Jū-Ni (Japanese restaurant), which is a clear sign of this farm, along with the similarities of autoconfirmed gaming. Requesting CU for sleepers. I've duck blocked, and think the behavioral evidence is strong enough regardless of the CU findings, but CU would be helpful to see what else is out there. TonyBallioni (talk) 15:50, 11 March 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  18:30, 11 March 2018 (UTC)
 * Technically unrelated from what I have seen.
 * Closing. As noted, I’ve blocked behaviorally given that this is next to identical to the previously deleted articles. TonyBallioni (talk) 18:50, 11 March 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Created Avaza (company) (one of the clients of this farm). Other behavioral similarities to this farm that makes it a proven sock. Already blocked by for spamming. Asking for CU for sleepers. TonyBallioni (talk) 13:48, 22 June 2018 (UTC)

Also added Leonakarlis for creating Richard's Foodporium, one this firms other clients. Blocked and also likely stale, but adding for the record. TonyBallioni (talk) 13:55, 22 June 2018 (UTC)
 * Mariavisa just edited today. It is definitely one of the socks. I was asking for a CU to look for other account. If that’s not possible, it’s okay, I’m just confused by the stale finding. TonyBallioni (talk) 15:10, 22 June 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
This case is. Closing.--Bbb23 (talk) 14:41, 22 June 2018 (UTC)
 * I don't run a check to look for other accounts based on only one account.--Bbb23 (talk) 15:28, 22 June 2018 (UTC)