Wikipedia:Sockpuppet investigations/Michakellies/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

These users seem to be a cluster of spam accounts working to a pattern.
 * 1) Two word names which are run together without spacing or capitals,
 * 2) Undertake 12-ish inconsequential edits on articles sharing the same initial letter, Leannjoyce - N, Marriehudson - K, and Buckyloonion - J,
 * 3) Go to sleep until autoconfirmed kicks in,
 * 4) Create spam.

It seems to be a repeated pattern to game their way past ACTRIAL. The gaps in the initial letters used suggest there's an L spammer & an M spammer at the least, more likely more, and sleepers which have not yet been used for spam. Cabayi (talk) 15:19, 16 October 2017 (UTC)

Bucky & Leanne's spam overlap at BedJet (company) & BedJet.

Looking through the output from EF 867 found Pittdenloas on the letter U with spam at Major Food Group. Cabayi (talk) 15:52, 16 October 2017 (UTC)

Janicediscko on the letter W, spam at MySugr. Kellyhunggino on the letter Q, spam at O’Keefe Reinhard & Paul. Cabayi (talk) 16:28, 16 October 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I've added Karenswiss to the SPI. Similar MO: adding Wikilinks to random articles to get autoconfirmed  and then creating an article perfectly in one edit. The naming pattern is also the same here for all the accounts: one full name with no spaces and where the last name is kept lowercase. TonyBallioni (talk) 15:44, 16 October 2017 (UTC)
 * Also, for whomever the CU or clerk is processing this, can we get a check for sleepers/other accounts. This looks pretty large scale, and given the similar username patterns, I'm leaning that this is a connected ring rather than just a bunch of independent actors following the same methods. TonyBallioni (talk) 16:32, 16 October 2017 (UTC)
 * no real need for COIN here IMO. I've tagged the four articles created by this farm for G5 working on the reasonable assumption that this ring has been blocked before. They were trying to build up a bunch of accounts to get around ACTRIAL and we were lucky that we were able to catch them early. TonyBallioni (talk) 18:37, 16 October 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - There's a fairly clear pattern here. Given the number of accounts involved, and the fact that they're trying to game the limitations placed on new accounts, I have to agree with TonyBallioni. The existence of additional socks seems likely. Please check to confirm socking, and identify potential sleepers. Sir Sputnik (talk) 16:45, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)
 * ​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)


 * Wow. I've moved the case and everyone.  I recommend you take this to COIN. Thanks,  GABgab 18:35, 16 October 2017 (UTC)
 * OK, you're the expert :) See also MySugr, O’Keefe Reinhard & Paul. GABgab 18:39, 16 October 2017 (UTC)
 * Looks like there's nothing left to do here. Closing. Sir Sputnik (talk) 19:32, 16 October 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Creation of Jū-Ni (restaurant), which master/sock uploaded and crossover with  here, here and  also follows same naming pattern. CHRISSY MAD ❯❯❯  ¯\_(ツ)_/¯  15:47, 24 October 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * the page created is an exact replica of Ju-Ni (Japanese restaurant), which was created by, a CU confirmed sock of this group, so its either the same person or they are different people who have a shared drive and it would be WP:PROXYING. The sock in this report is . I'm not closing, because I think it'd be worth a clerk assessing whether CU was needed for sleepers given the number found on the last check. TonyBallioni (talk) 16:04, 24 October 2017 (UTC)
 * - Given the sheer number of accounts found in the last case, a check for sleepers is probably a good idea. Sir Sputnik (talk) 16:34, 24 October 2017 (UTC)
 * ✅ plus . is ✅ (see this deleted article as well). ​—DoRD (talk)​ 17:10, 24 October 2017 (UTC)
 * All accounts The deleted article for Macygondo is similar enough in format and has other signs of a commissioned work as well. TonyBallioni (talk) 17:20, 24 October 2017 (UTC)
 * Tagging and closing. Sir Sputnik (talk) 17:20, 24 October 2017 (UTC)