Wikipedia:Sockpuppet investigations/Moonrivers/Archive

Suspected sockpuppets
The sockmaster was blocked on the English Wikipedia in 2019 for copyright violations, and has not been unblocked since. Most recently, they appear to have been involved with, which was closed without the user being unblocked.

The majority of the sockmaster's activity on Wikimedia projects since then has been on Wikimedia Commons. There, the user has taken up the task of creating svgs of logos. I was patrolling on Commons when I noticed that some of the logos had copyright problems, and I was a bit surprised when I saw that so many of the logos had been added to articles on EnWiki even though their creator was blocked.

Lo and behold, I encountered the apparent sock account, who seems to also have an interest in corporate logos. The account's most recent 500 undeleted contributions on the English Wikipedia (i.e. all of their undeleted contributions) seem to be very larely focused on adding images/logos to articles. I've taken a sample of ten out of their most recent 50 edits to EnWiki, and all of them involved doing so.

But, not only does it involve adding just any images to Wikipedia, but all of those images appear to have been created/edited by Moonrivers right before they were placed by the sockpuppet on EnWiki:
 * 1) This edit adds File:Haus Labs logo.svg to an article a mere two minutes after the image's creation.
 * 2) This edit adds File:Encyclopaedia Brittanica Inc logo.svg to an article a mere 5 minutes after the image's creation
 * 3) This edit adds File:TCB%26TL_wordmark.svg a mere four minutes after the image's creation.
 * 4) This edit adds the (now-deleted) File:Chuck-E-Cheese_new_logo.svg to an article a mere 8 minutes after the logo was created.
 * 5) This edit adds File:Swarovski new logo.svg to an article a mere three minutes after the logo was created.
 * 6) This edit adds File:PDEA seal.svg to an article less than ten minutes after the seal was posted to Commons.
 * 7) This edit adds File:National Economic and Development Authority (NEDA).svg to an article a mere 12 minutes after that image had been edited by the sockmaster.
 * 8) This edit adds File:Avatar franchise logo.svg to an article a mere five minutes after the vector file was uploaded to Commons by Moonrivers.
 * 9) This edit adds File:Seeker new logo.svg a mere three minutes after the vector was uploaded to Commons.
 * 10) This edit adds File:BoysTown logo.svg to an article within ten minutes of the final version being uploaded to Commons by the sockmaster.

This appears to be way more overlap than would be expected for mere coincidence. Indeed, this appears to be a pretty convincing behavioral case that we've got some sort of coordination between the two accounts: the EnWiki-blocked master appears to be creating the images, and the sock appears to be placing the images on the English Wikipedia. Because the master account is blocked for copyright violations, and several edits by the sock have inserted copyright-violating images into the English Wikipedia, this looks like a clear-cut case of block evasion. I am not requesting checkuser on EnWiki, because the master would appear to be stale here. However, I will be creating a request for checkuser on Commons, since there appears to be some disruption/abuse of multiple accounts there as well, and neither the master nor this sock are stale there.

There may be more accounts/IPs involved here, though I don't have time to do a writeup on them at the moment—I'm going to have to do a more thorough audit of the master's uploads for that—but I'll try to update this as I find evidence of more stuff (and with Commons CU results, should request that be granted). — Red-tailed hawk  (nest) 20:15, 14 September 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ -- Amanda (she/her)  05:25, 15 September 2023 (UTC)
 * Noting that Amanda did indef. Archiving. Courcelles (talk) 17:28, 18 September 2023 (UTC)

Suspected sockpuppets
Much like the above sock account, this IP has been active in adding images that were uploaded by Moonrivers to Commons. This activity on EnWiki began on or about 18 September, when they added File:EastWest Bank 2011 h-pos logo.svg (created by Moonrivers) to EastWest Bank, and has continued in basically all of their edits through their edit to Blinkist yesterday. The IP's contributions on Wikidata indicates a longer-term trend of doing much of the same thing. Some other IPs and evidence are listed at Commons:Requests for checkuser/Case/Moonrivers, but I don't know if any of them are still actively accessed by this user, so I'm just posting this one here.

I'm not requesting CU, because this is an IP, and CUs can't publicly connect them. But, I think the behavioral evidence is strong enough to block, so I'm leaving it here for an administrator to take care of. — Red-tailed hawk  (nest) 02:53, 21 September 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Yep, that's pretty clear-cut. Blocked for a month; closing. Extraordinary Writ (talk) 07:05, 26 September 2023 (UTC)