Wikipedia:Sockpuppet investigations/Lyfeiza1/Archive

13 May 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Virtually identical user pages, all introductions to a new user with the first name Aaron. No other edits other than user page creation, but it just doesn't smell right. &#124; Uncle Milty  &#124;  talk  &#124;  22:54, 13 May 2013 (UTC)

Just found two others not named Aaron, yet with identical user page formats: Don't know if they are related, or performing some class project. -- &#124;  Uncle Milty  &#124;  talk  &#124;  23:00, 13 May 2013 (UTC)

More 'Aaron' accounts created in the last few hours:



-- &#124;  Uncle Milty  &#124;  talk  &#124;  01:02, 15 May 2013 (UTC)

And some more:



































Still more: *

RolandR (talk) 12:31, 17 May 2013 (UTC)


 * I struck AaronTheDean as this user's page doesn't match the pattern, and the account is from 2010. -- &#124;  Uncle Milty  &#124;  talk  &#124;  18:44, 18 May 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

You might want to take a look at the contributions of User:Doreply, a vandal that was stopped and blocked two days ago (15 May,2013). The attack was a quite a bit more sophisticated than most vandal attacks, trying to introduce code and hidden external links, code that because of the volume of text and short time between each edit must have been prepared in advance, possibly in a class or group project of some sort (which is why there might be a connection to all of these mysterious Aarons...). I noticed the attack because Nupedia, the first page to be attacked, is on my watchlist, and managed to revert all of the user's edits until he/she was blocked. Thomas.W (talk) 20:25, 17 May 2013 (UTC)
 * Definitely a huge stretch, but will keep an eye on, thanks. King of &hearts;   &diams;   &clubs;  &spades; 00:40, 18 May 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * I redirected Sockpuppet investigations/Tx2003guy here. King of &hearts;   &diams;   &clubs;  &spades; 00:30, 14 May 2013 (UTC)
 * Definitely identical edits, but I'm not seeing any abuse here. None of these accounts have edited anything except their own user page. Jafeluv (talk) 10:33, 14 May 2013 (UTC)
 * - highly to be either one user or a closely orchestrated effort, but not 100%. As pointed out above, nothing abusive has been done. Yet. But the one-person, one-account rule should be mentioned to this crew of accounts.  Frank  &#124;  talk  12:34, 14 May 2013 (UTC)
 * I sent a message to each and every one. Leaving open for a day or so in case any of them wants to reply. I direct them here to reply. Dennis Brown - 2¢  - © - @ - Join WER 23:37, 14 May 2013 (UTC)
 * I'm starting to think they didn't read my love letters. This is either a very uninformed teacher/professor, or the start of a COI/spam sockfarm.  I'm reinstating the CU request and have  it, as I'm not sure if we need a rangeblock or what here.  Dennis Brown - 2¢  - © - @ - Join WER 01:59, 15 May 2013 (UTC)
 * I made an edit filter to log all such accounts. -- King of &hearts;   &diams;   &clubs;  &spades; 02:28, 15 May 2013 (UTC)
 * There is very little, almost no technical correlation between these users. A few do match each other, but it's obvious this is a coordinated attack/spam of some sort, and I recommend playing whack-a-mole. -- DQ   (ʞlɐʇ)  04:03, 17 May 2013 (UTC)
 * If no one minds, I would prefer to leave this open for now, mallet in hand, waiting for the little heads to start popping through the holes. Dennis Brown - 2¢  - © - @ - Join WER 12:45, 17 May 2013 (UTC)
 * - I'm going to put this on hold just so it's a little more "sorted" when going through cases. NativeForeigner Talk 02:02, 20 May 2013 (UTC)
 * It's been nine days, marking for close. NativeForeigner Talk 12:15, 26 May 2013 (UTC)