Wikipedia:Sockpuppet investigations/Morning277/Archive

13 July 2013

 * Suspected sockpuppets


 * http://en.wikipedia.org/w/index.php?title=User:Patrickkaned&diff=prev&oldid=564000025
 * http://en.wikipedia.org/w/index.php?title=User:Patrickkaned&diff=prev&oldid=564000025

Here is another one for your unbelievably long list that I came across.--I am One of Many (talk) 00:25, 13 July 2013 (UTC)



I reported Crocyyks, who inserted the article on Emmanuel Gregory Lemelson. That article mentions Amvona several times, saying that Lemelson founded Amvona. The Amvona article was inserted by Obthedesigner. When I looked at Obthedesigner's contributions, they fit the pattern: enough minor edits to become autoconfirmed (in this case, exactly ten), then insertion of an article unrelated to the topics of the minor edits, then edits to that article, then stoppage. I noticed that in the span of less than an hour there were several edits to these articles from Amazon EC2 hosts, followed 11 minutes later by an edit by Crocyyks. — rybec   01:34, 13 July 2013 (UTC)


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=542066439
 * https://en.wikipedia.org/w/index.php?title=HALO_Maritime_Defense_Systems&action=history
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=542066439
 * https://en.wikipedia.org/w/index.php?title=HALO_Maritime_Defense_Systems&action=history

MooshiePorkFace was mentioned when this article was deleted in February; it appeared on 4 March in User:Sublimeharmony/sandbox11 and on 6 March was recreated in main space by Sumit kwiki. It was deleted again after an AfD. Navynuclear appears to have created an account in order to participate in the AfD (opposing deletion, of course). — rybec   03:17, 13 July 2013 (UTC)


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=559569359
 * https://en.wikipedia.org/w/index.php?title=File:Dr_Reza_Ghorbhani.jpg&oldid=560319972
 * Articles_for_deletion/Reza_Ghorbani
 * https://en.wikipedia.org/w/index.php?title=File:Dr_Reza_Ghorbhani.jpg&oldid=560319972
 * Articles_for_deletion/Reza_Ghorbani

File:Dr_Reza_Ghorbhani.jpg has an OTRS ticket. The Internationalpanda36 account appears to have been created in order to comment in the AfD. LAHealthVol, named in my initial report, also participated in this AfD. — rybec   16:18, 13 July 2013 (UTC)

and — rybec   17:26, 13 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Comment User:Arifhasan23 came to #wikipedia-en-help today, asking about why he was blocked, and how to be unblocked. I can't, of course, post a 'log' of the discussion here, but I would like to note that his explanation of his reposting of the content that was previously in User:Sublimeharmony's sandbox was that "one of my very well known person provided me the content", and that he was "used". I don't know if this is 'useful' information, but thought I'd mention it here. Revent (talk) 05:16, 13 July 2013 (UTC)
 * Arifhasan23 has made a request for unblocking on his talk page:
 * https://en.wikipedia.org/w/index.php?title=User_talk:Arifhasan23&diff=prev&oldid=564066248 .— rybec   05:33, 13 July 2013 (UTC)
 * I've declined it. I don't even know how to parse "one of my very well known person provided me the content".  He's going to need to be much more specific, and the discussion will need to occur here, not on IRC.  Kuru   (talk)  13:10, 13 July 2013 (UTC)
 * Arifhasan23 was among the accounts I initially reported, but isn't in the three groups WilliamH provided from checkuser data. — rybec   16:25, 13 July 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Those first 75 blocks fell under the category of "blindingly obvious". As to "he told me to put this in article space", it sounds remarkably like "The dog ate my homework", and just as credible. Dennis Brown &#124; 2¢ &#124; WER  18:29, 13 July 2013 (UTC)

Evidence is not presented via WP:BEANS but can be emailed to any CU. I prefer another set of eyes to look at these. Some might be stale, sorry, I'm swimming in evidence here. These are based on coincidences I noticed when investigating the above.
 * Other accounts that need review
 * Blocked (contribs)


 * UnBlocked - needs CU confirmation to see if within the ranges in groups 1-3 above, or possibly a new range since we know many more exist.
 * (weaker)
 * (weaker)
 * (stale/weak)
 * (For other reasons)
 * (maintenance acct?)
 * (maintenance acct?)
 * (per email)
 * (per email)
 * (per email)
 * Dennis Brown &#124; 2¢ &#124; WER  17:19, 13 July 2013 (UTC)
 * (maintenance acct?)
 * (maintenance acct?)
 * (per email)
 * (per email)
 * (per email)
 * Dennis Brown &#124; 2¢ &#124; WER  17:19, 13 July 2013 (UTC)


 * Unlikely but possible
 * (from Will above)
 * My gut is telling me "no" for this one, but will allow others to review. Dennis Brown &#124; 2¢ &#124;  WER  17:48, 13 July 2013 (UTC)


 * Closing this section with plausible but not proven socks, leave it for the archive. Dennis Brown &#124; 2¢ &#124;  WER  14:28, 28 July 2013 (UTC)

14 July 2013

 * Suspected sockpuppets

"Ton acia moved page User:Ton acia/sandbox to Sollensys: Client request" [//en.wikipedia.org/w/index.php?diff=&oldid=547303241]

[//en.wikipedia.org/w/index.php?title=Sollensys_Corporation&oldid=545252290 Sollensys Corporation] vs. [//en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=541555283]



[//en.wikipedia.org/w/index.php?title=Rich_Schefren&oldid=564041175 Rich Schefren] vs. [//en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=563837440]

Here is an annotated list of article subjects found in User:Sublimeharmony/sandbox11, linked to the corresponding articles (piped when the article name differed), along with accounts that inserted or edited those articles. By "inserted" I mean added to the Wikipedia article space.

— rybec   17:23, 14 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

This is another sock for sure!--Iniciativass (talk) 19:40, 14 July 2013 (UTC)
 * AbanteCart does ring a bell. I agree. Wiki-nmservices had [//en.wikipedia.org/w/index.php?title=User:Wiki-nmservices/sandbox&oldid=562683856 a draft about AbanteCart] on 3 July, then Sublimeharmy inserted [//en.wikipedia.org/w/index.php?title=AbanteCart_%28software%29&oldid=562996625 an article] on 5 July. — rybec   20:32, 14 July 2013 (UTC)
 * Yes, and i also suspect User:Imiharrima because of this which was created by User:Imiharrima --Iniciativass (talk) 20:28, 14 July 2013 (UTC)



CrowdOptic was edited [//en.wikipedia.org/w/index.php?title=CrowdOptic&oldid=558138029] [//en.wikipedia.org/w/index.php?title=CrowdOptic&oldid=560042595] from these Amazon Web Services IP addresses.



A little more than an hour after I requested deletion of CrowdOptic, the tag was [//en.wikipedia.org/w/index.php?title=CrowdOptic&diff=564261207&oldid=564252126 removed] by an editor using this ATT WiFi Services IP address. — rybec   19:44, 14 July 2013 (UTC)

Royale.heart is another sock. Kindly check.--Iniciativass (talk) 21:03, 14 July 2013 (UTC)
 * Editing habits and writing style differ. Why do you suspect this one? — rybec   21:24, 14 July 2013 (UTC)
 * I suspect him for the article Ely Sakhai where several editors were hired to delete the page and i found fiverr.com/reviews_amazon/edit-your-wikipedia-page--2 this. Also, before this SPI case i made a list of paid editors which include: User:Royale.heart, User:MNdude11, User:DC_Malleus, User:Sublimeharmony, User:Brfiandt, User:Crocyyks, User:567rems, User:Bhargavi RC, User:EntertaimentEditor. Maybe they are from different groups.--Iniciativass (talk) 08:55, 15 July 2013 (UTC)

In the list of suspected socks posted by WilliamH on the talk page, I saw Bloghog23 (not yet blocked). Bloghog23 was a major contributor to Rapid Realty NYC; the apparent creator and other major contributor was Gypcywoman, whose edits (which go back to 2007) at first show an interest in astrology and Hinduism, then starting with her 11th edit shift exclusively to Rapid Reality NYC, then cease. Her first 10 edits are more lengthy than those of the accounts I initially reported.



Saminazahid2002 created Anthony Lolli (entrepreneur) then Bloghog23 [//en.wikipedia.org/w/index.php?title=Anthony_Lolli_%28entrepreneur%29&diff=562417691&oldid=558327575 added a "Philanthropy" section to it]. It reminds me of the "Philanthropy" section added to DPT Laboratories by another suspected sock-puppet.

— rybec   00:13, 15 July 2013 (UTC)

Wiki-nmservices was confirmed by Keegan, tagging. --Rschen7754 00:50, 17 July 2013 (UTC)
 * Specifically, Wiki-nmservices is ✅ to be a sock, not a meatpuppet, of User:Sublimeharmony. Keegan (talk) 01:20, 17 July 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * This section is done. Someguy1221 (talk) 09:56, 8 August 2013 (UTC)

15 July 2013

 * Suspected sockpuppets



Coldsmokepk and Chicago2011 were identified by WilliamH as possible socks (listed on talk page). I notice that both edited UnboundID.— rybec

Internationalpanda36 and Educationalpanda0965 (mentioned above) have similar account names. — rybec   00:50, 15 July 2013 (UTC)



Both are new users creating for-pay articles. After raising them with Dennis (unaware of this SPI) he suggested they might be connected. Cheers, Stalwart 111  11:08, 15 July 2013 (UTC)
 * Both show the pattern of teeny edits to existing articles, followed soon after by creation of a fully-developed article in a single edit. Both edited GarbleCard and KAIZEN Realty. Yanis ahmed's early edits were on a topic related to Bangladesh, similar to those of the contributors of the Mile2 articles (see my earlier comment below with time-stamp 20:20); User:Eragon.raju says he's in Bangladesh. — rybec   21:52, 15 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

[//en.wikipedia.org/w/index.php?title=Special:Log/block&page=User%3AArifhasan23 Arifhasan23] has been unblocked. — rybec
 * That should not have happened. The behavioral evidence is obvious--a failure of checkuser does not disprove meatpuppettry. The checkuser who unblocked does not seem to understand the problem here.  &#39;DGG (at NYPL) (talk) 17:42, 15 July 2013 (UTC)
 * I replied about this on my talk page. Keegan (talk) 19:04, 15 July 2013 (UTC)
 * Chicago2011 is unlikely to be related to Morning277. Eragon.raju and Yanis ahmed also seem unlikely to be related to Morning277, but both are more interesting. I've got Yanis ahmed and Eragon.raju as operating separate accounts off wiki, and bidding on the same jobs as separate people. However, Yanis ahmed is down as winning the GarbleCard contract that Eragon.raju created. So there is a bit of unusual crossover. I'd be inclined to say that one is the sock of the other, or that they are working together on contracts, but both bidding for the same work is a little odd if that is the case. - Bilby (talk) 08:29, 5 August 2013 (UTC)
 * I wouldn't be surprised if they are truly distinct people and/or companies, but that doesn't mean it's incorrect to include them in this SPI. This report is about what looks like not one writer with multiple accounts, but multiple hired writers, including at least one who travels by air. It's to be hoped that these writers also use multiple accounts per person. It may be that the collaboration is loose enough that these writers even compete against each other, or appear to. I noticed the use of IP addresses in the United States and south Asia, and a difference in fluency of English between the articles posted and the unblock requests made [//en.wikipedia.org/w/index.php?title=User_talk:Seektheinfinite&diff=565198305&oldid=565041387] [//en.wikipedia.org/w/index.php?title=User_talk:Arifhasan23&diff=prev&oldid=564066248].
 * Chicago2011, whose editing pattern does differ from most of the accounts named in this SPI, was identified through check-user and has contributed or edited articles for clients connected to the Morning277 writers. Eragon.raju and Yanis ahmed were identified through their editing habits. —  rybec   15:21, 5 August 2013 (UTC)
 * I don't know what was found with the CU for Chicago2011. But to clarify, my notes attach that account to a particular person who isn't Morning277. I could have stuffed up there, but the correlation is very high, starting from a job in 2011 that was won by the Elance account and completed in full by Chicago2011, and it seems very unlikely that they are the same person. Occasionally some of the paid editors would both be hired by the same client, or would seem to collaborate, which is what I suspect gives the correlation. It may also be possible that Chicago2011 subcontracted for Morning277.
 * I don't see significant editing similarities between Morning277 and Eragon.raju/Yanis ahmed. I do know, without any doubt in this case, that Eragon.raju and Yanis ahmed have separate accounts on Elance and that they compete for jobs. I think there is a high level of collaboration between the two, and perhaps it amounts to meatpuppetry, but I don't think that they have anything to do with Morning277. My feeling was that they are independent paid editors, rather than subcontracting for Morning277. - Bilby (talk) 16:03, 5 August 2013 (UTC)
 * Thank you for this information; could you please correct the typo "Chicago277"? — rybec   16:26, 5 August 2013 (UTC)
 * Thanks. :) Too many numbers in the usernames. - Bilby (talk) 17:06, 5 August 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Closing. I agree that the three users here who are not yet blocked are unlikely to be Morning277 socks/meats. Someguy1221 (talk) 10:00, 8 August 2013 (UTC)

05 August 2013 (2)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Gallagher Sweeney is drafting an article about a company called Network Capital Funding [//en.wikipedia.org/w/index.php?title=User:Gallagher_Sweeney/sandbox&oldid=565943097]; User:Sublimeharmony/sandbox11 contained a draft about the company [//en.wikipedia.org/w/index.php?oldid=542584521].

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. Reaper Eternal (talk) 13:27, 6 August 2013 (UTC)

05 August 2013 (7)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing to restore article on American Writers and Artists Inc., [//en.wikipedia.org/w/index.php?title=User:Khaleel26h/sandbox&oldid=566649927] vs. [//en.wikipedia.org/w/index.php?oldid=562613748] — rybec   03:07, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. Reaper Eternal (talk) 13:18, 6 August 2013 (UTC)

05 August 2013 (8)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing to restore article on Global Met Coal Corporation, [//en.wikipedia.org/w/index.php?title=User:Kayeane/sandbox&oldid=566662800] vs. [//en.wikipedia.org/w/index.php?oldid=557255144] — rybec   03:12, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. Reaper Eternal (talk) 13:22, 6 August 2013 (UTC)

07 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

is working on a draft about Mile2 certification Certified Penetration Testing Engineer, using image File:Cptelogo.png uploaded to Commons by Morning277 sock. Previously deleted articles were posted by Morning277 socks. — rybec   07:29, 7 August 2013 (UTC) —  rybec   07:29, 7 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. Reaper Eternal (talk) 12:15, 7 August 2013 (UTC)

07 August 2013 (2)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing to restore ITelagen —  rybec   07:34, 7 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. Reaper Eternal (talk) 12:07, 7 August 2013 (UTC)

07 August 2013 (3)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing to restore [//en.wikipedia.org/w/index.php?title=User:Greenathome13/Sandbox&oldid=566334078] InfoRelay — rybec   07:51, 7 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. Reaper Eternal (talk) 12:10, 7 August 2013 (UTC)

15 July 2013 (2)

 * Suspected sockpuppets



[//en.wikipedia.org/w/index.php?title=User:Ztwriter/sandbox&oldid=536278533] vs. —  rybec   14:51, 15 July 2013 (UTC)



Sunilkumarlore does 11 minor edits, then creates the [//en.wikipedia.org/w/index.php?title=Certified_Network_Forensics_Engineer&oldid=552255323 Certified Network Forensics Engineer] article.

Carer1256 only edits Certified Network Forensics Engineer, Certified Penetration Testing Consultant, Certified Information Systems Security Officer and Mile2 (the last is the company that sells these certifications).

Securitybot (already blocked) edited a similar group of Mile2-related articles:
 * Certified Penetration Testing Engineer
 * Certified Secure Web Application Engineer and
 * Mile2

LoveSujeiry only did one edit, adding the name of the CEO to the Mile2 article [//en.wikipedia.org/w/index.php?title=Mile2&diff=prev&oldid=536930912].

There were three edits from 108.81.229.91 (registered to AT&T Internet Services), two of which were to Mile2. The other was a minor edit.

Alonejobel does 33 edits to articles about Bangladeshi and Indian topics, then inserts the article Certified Information Systems Security Officer (which mentions Mile2, of course).

As mentioned earlier, drafts about Certified Disaster Recovery Engineer and Certified Penetration Testing Consultant (both sold by Mile2) were found in User:Sublimeharmony/sandbox11, and were placed into article space by MOmarFarooq and Arifhasan23. — rybec   20:20, 15 July 2013 (UTC)



Oforokeke does 11 little edits to articles on Nigerian topics, then boom, inserts the article 1-800-Therapist. When the article is brought to AfD, along comes confirmed Morning277 sock User:Abomination13 to defend it. — rybec   21:16, 15 July 2013 (UTC)



At 17:35 today, DGG tagged Anthony Lolli (entrepreneur) db-spam, then at 22:50 along comes an editor on the British Telecom network to remove the speedy deletion tag and make extensive edits to this article about an obscure American businessman. — rybec   23:15, 15 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
LoveSujeiry only made one minor edit, so it's hard to tell. Afrihans23 is different from the remainder of the socks, but still suspicious. Will wait for CU on that in one of the lower sections. Other accounts are blocked. Closing. Someguy1221 (talk) 19:54, 8 August 2013 (UTC)

19 July 2013

 * Suspected sockpuppets

[//en.wikipedia.org/w/index.php?title=Soul_Artist_Management&oldid=556066524] created Soul_Artist_Management, later edited by confirmed sock IR-Articles.

Morning277 and confirmed sock contributed to Vergi Rodriguez (including adding  File:ComeDanceWithMeVergiLuv.jpg. The article was created by.

only edited FindTheBest, an article with contributions from confirmed socks, and.

Confirmed sock submitted Wikipedia_talk:Articles_for_creation/GatherSpace and made a redirect from GatherSpace (company)) [//en.wikipedia.org/w/index.php?title=User:Yhtak2013/sandbox&oldid=552460564].  inserted a link to the company's blog [//en.wikipedia.org/w/index.php?title=Software_product_management&diff=prev&oldid=514263852] into an article, as did 75.22.75.219 [//en.wikipedia.org/w/index.php?title=Functional_specification&diff=436285054&oldid=424963620]. For each, these were their only edit.  added GatherSpace material in three of seven edits: [//en.wikipedia.org/w/index.php?title=Software_requirements&diff=prev&oldid=554211187] [//en.wikipedia.org/w/index.php?title=Requirements_traceability&diff=prev&oldid=557760583] [//en.wikipedia.org/w/index.php?title=Software_requirements_specification&diff=prev&oldid=559467297].

2013062610014599 OTRS ticket for File:Kryoman_The_Robot.jpg and File:Kryoman_DJ.jpg, uploaded by confirmed sock

was already named but has not been blocked. 2013070110006982 OTRS ticket for File:Dr_Reza_Ghorbhani.jpg, uploaded by suspected sock presumably for use in deleted article Reza Ghorbani. along with confirmed socks and  said in Articles for deletion/Reza Ghorbani article should be kept.



Both made multiple edits to Smashburger which is linked from sock-contributed article Rick E. Schaden. only edited the Smashburger article.



Confirmed sock added the logo [//en.wikipedia.org/w/index.php?title=Touchfire&diff=563532149&oldid=563516321] to Touchfire, an article placed by.



The RLJ Companies was placed by confirmed sock and edited by 54.241.212.203, also confirmed as used by the Morning277 outfit. I tagged it for G5 deletion, then 34 minutes later, 173.247.203.34 removed [//en.wikipedia.org/w/index.php?title=The_RLJ_Companies&diff=564845729&oldid=564842511] the tag. I looked at www.webpass.net and they don't offer service near Los Angeles ("select city").

Rick E. Schaden was placed by confirmed sock. I tagged it for G5 deletion, then 3 hours 15 minutes later, someone editing from an address belonging to hosting company corespace.com came along to remove [//en.wikipedia.org/w/index.php?title=Rick_E._Schaden&diff=prev&oldid=564822906] the deletion tag (and the orphan tag). — rybec   00:23, 19 July 2013 (UTC)

edited Vungle (company), placed by confirmed sock ; edited Bob Dorf, placed by confirmed sock and edited by confirmed sock 54.251.21.249. Also edited various Bangladesh-related articles, similarly to other accounts named earlier. — rybec   00:44, 19 July 2013 (UTC)

Just adding another one for CU purposes. Already blocked and tagged. Someguy1221 (talk) 01:44, 19 July 2013 (UTC)



IP editor removed PROD and orphan tags from Alsbridge (company) with comment "Very well known co in New York"; according to the article the company is in Texas. Article was in User:Sublimeharmony/sandbox11; recreated after deletion of Alsbridge. Hostname 207-237-83-8.c3-0.nyw-ubr1.nyr-nyw.ny.cable.rcn.com does imply editor is connecting from New York City.



Heycheri was already reported, but was not blocked. [//en.wikipedia.org/w/index.php?title=Identified_(company)&oldid=479157695 Created] Identified_(company), later edited by confirmed sock IP Special:Contributions/54.251.205.252. — rybec   02:57, 19 July 2013 (UTC)

The following were ✅ to and some earlier socks by  on IRC: Someguy1221 (talk) 03:49, 19 July 2013 (UTC)



EG Innovations was created [//en.wikipedia.org/w/index.php?title=Eg_Innovations&oldid=560927895] by confirmed sock and edited once by confirmed sock 54.241.200.213. added File:Logo_eG_Innovations.jpg; Special:Contributions/122.165.7.23 did many edits to the article (and only that article). — rybec   04:14, 19 July 2013 (UTC)



Chicago2011 was identified by WilliamH as a possible sock, but was not blocked. User:PrezMittens/sandbox/BOI is a draft about BofI Holding, Inc.; has been confirmed as a Morning377 sock. Bank_of_Internet_USA was [//en.wikipedia.org/w/index.php?title=Bank_of_Internet_USA&oldid=508081898 created] by. BofI_Federal_Bank_(company) was created by, a confirmed Morning377 sock. BofI_Holding_Inc was created by, a confirmed Morning377 sock. — rybec   05:35, 19 July 2013 (UTC)



The Oren Laurent article and the latest Banc De Binary article (replacing one that was deleted after an AfD) were posted by Morning277 socks (the latter article was edited by confirmed socks Thecandymaker and 54.241.52.228). According to the Banc De Binary article, Oren Laurent founded Banc De Binary. After its deletion, the old Banc De Binary article was userfied to User:Hobbes_Goodyear/Banc_de_Binary. Recordwriter's contributions consist entirely of AfD comments attempting to save Banc De Binary and Oren Laurent, and edits to User:Hobbes_Goodyear/Banc_de_Binary to put the company in a more favorable light, [//en.wikipedia.org/w/index.php?title=User:Hobbes_Goodyear/Banc_de_Binary&diff=prev&oldid=533509562 this edit] being the most egregious. — rybec   18:28, 19 July 2013 (UTC)



Does minor edits to existing articles, then contributes PLS Financial Services about a Chicago finance company, which seems at odds with autobiography on user page:

"My names are Beatrice Muthoni from Africa Kenya, am the first born in a family of five. I was born and educated in Nairobi. My hobbies are tapestry making,swimming,reading inspirational books and gemstone collecting."

PLS Financial Services was later edited by confirmed socks 54.215.68.152, 54.241.83.117, 54.215.98.205, 54.215.115.41 and (the latter added the logo and a photo with OTRS ticket 2013050410006097). — rybec   18:49, 19 July 2013 (UTC)



WEP2013's user page says it's an alternate account of WhoElsePoems. They edit the same pages as, appearing to work for Banc De Binary and its founder Oren Laurent. [//en.wikipedia.org/w/index.php?title=Wikipedia:Articles_for_deletion/Banc_de_Binary&diff=prev&oldid=534669752 In the Banc de Binary AfD], WEP2013 wrote, "I created this article as well as improving the article about the founder of the company." — rybec   20:10, 19 July 2013 (UTC)



was contributed by Phrenology. Subsequently it was edited by confirmed Morning277 socks 54.241.41.227, 54.241.46.42, 54.215.78.180, 54.215.58.143, 54.215.61.209, NaturalScholar, Thecandymaker, A1Abigail, Josiah2013 and 54.241.89.228. — rybec   21:48, 19 July 2013 (UTC) Phrenology also edited [//en.wikipedia.org/w/index.php?title=ViSalus&diff=prev&oldid=544849246 ViSalus], which was [//en.wikipedia.org/w/index.php?title=ViSalus&oldid=491210956 created by Morning277] and [//en.wikipedia.org/w/index.php?title=Hydroxycut&diff=prev&oldid=545967659 Hydroxycut] which received a Morning277-related edit [//en.wikipedia.org/w/index.php?title=Hydroxycut&diff=565405682&oldid=561540486]. — rybec   03:24, 4 August 2013 (UTC)



Made recent edits to and, both of which were contributed by confirmed sock. No other recent edits from this IP address. — rybec   23:47, 19 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * Banc de Binary has been tagged with G4, EG Innovations has been AFDed based on lack of notability. § FreeRangeFrog croak 19:05, 19 July 2013 (UTC)
 * Dealt with, can go to AFD in future if need be. WilliamH (talk) 15:17, 28 July 2013 (UTC)
 * In my notes I've identified Chicago2011 as another paid editor, but not as Morning277. I can identify who it is, but as that would require outing, I can't make the identification here. I don't believe that Chicago2011 is a sock of Morning277, although he is certainly a paid editor. - Bilby (talk) 07:48, 5 August 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
- The previous rangeblocks appear to have not even slowed him down, let's do another check. Some of the new IPs listed in today's filing appear to be new webhosts. At least one of the IPs looks like a normal internet connection, so maybe a meatpuppet. Someguy1221 (talk) 03:54, 19 July 2013 (UTC) All of the accounts listed here, and their articles, have been dealt with on a case-by-case basis as felt was reasonable. Some accounts were blocked, some articles deleted, some accounts were sent to a CU request far below, and some were ignored. Someguy1221 (talk) 01:02, 9 August 2013 (UTC)
 * @Someguy1221: The reason why this has probably been sitting for so long is how scattered the request and the evidence is. If you can make a list of checkable accounts, checkable IPs (ONLY if absolutely needed), and a brief statement of the general behavioral pattern, I can look into this. -- DQ   (ʞlɐʇ)  20:17, 30 July 2013 (UTC)

07 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

is working on a draft about Mile2 certification Certified Penetration Testing Engineer, using image File:Cptelogo.png uploaded to Commons by Morning277 sock. Previously deleted articles were posted by Morning277 socks. — rybec   07:29, 7 August 2013 (UTC) —  rybec   07:29, 7 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. Reaper Eternal (talk) 12:15, 7 August 2013 (UTC)

07 August 2013 (2)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing to restore ITelagen —  rybec   07:34, 7 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. Reaper Eternal (talk) 12:07, 7 August 2013 (UTC)

07 August 2013 (3)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing to restore [//en.wikipedia.org/w/index.php?title=User:Greenathome13/Sandbox&oldid=566334078] InfoRelay — rybec   07:51, 7 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. Reaper Eternal (talk) 12:10, 7 August 2013 (UTC)

15 July 2013 (2)

 * Suspected sockpuppets



[//en.wikipedia.org/w/index.php?title=User:Ztwriter/sandbox&oldid=536278533] vs. —  rybec   14:51, 15 July 2013 (UTC)



Sunilkumarlore does 11 minor edits, then creates the [//en.wikipedia.org/w/index.php?title=Certified_Network_Forensics_Engineer&oldid=552255323 Certified Network Forensics Engineer] article.

Carer1256 only edits Certified Network Forensics Engineer, Certified Penetration Testing Consultant, Certified Information Systems Security Officer and Mile2 (the last is the company that sells these certifications).

Securitybot (already blocked) edited a similar group of Mile2-related articles:
 * Certified Penetration Testing Engineer
 * Certified Secure Web Application Engineer and
 * Mile2

LoveSujeiry only did one edit, adding the name of the CEO to the Mile2 article [//en.wikipedia.org/w/index.php?title=Mile2&diff=prev&oldid=536930912].

There were three edits from 108.81.229.91 (registered to AT&T Internet Services), two of which were to Mile2. The other was a minor edit.

Alonejobel does 33 edits to articles about Bangladeshi and Indian topics, then inserts the article Certified Information Systems Security Officer (which mentions Mile2, of course).

As mentioned earlier, drafts about Certified Disaster Recovery Engineer and Certified Penetration Testing Consultant (both sold by Mile2) were found in User:Sublimeharmony/sandbox11, and were placed into article space by MOmarFarooq and Arifhasan23. — rybec   20:20, 15 July 2013 (UTC)



Oforokeke does 11 little edits to articles on Nigerian topics, then boom, inserts the article 1-800-Therapist. When the article is brought to AfD, along comes confirmed Morning277 sock User:Abomination13 to defend it. — rybec   21:16, 15 July 2013 (UTC)



At 17:35 today, DGG tagged Anthony Lolli (entrepreneur) db-spam, then at 22:50 along comes an editor on the British Telecom network to remove the speedy deletion tag and make extensive edits to this article about an obscure American businessman. — rybec   23:15, 15 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
LoveSujeiry only made one minor edit, so it's hard to tell. Afrihans23 is different from the remainder of the socks, but still suspicious. Will wait for CU on that in one of the lower sections. Other accounts are blocked. Closing. Someguy1221 (talk) 19:54, 8 August 2013 (UTC)

19 July 2013

 * Suspected sockpuppets

[//en.wikipedia.org/w/index.php?title=Soul_Artist_Management&oldid=556066524] created Soul_Artist_Management, later edited by confirmed sock IR-Articles.

Morning277 and confirmed sock contributed to Vergi Rodriguez (including adding  File:ComeDanceWithMeVergiLuv.jpg. The article was created by.

only edited FindTheBest, an article with contributions from confirmed socks, and.

Confirmed sock submitted Wikipedia_talk:Articles_for_creation/GatherSpace and made a redirect from GatherSpace (company)) [//en.wikipedia.org/w/index.php?title=User:Yhtak2013/sandbox&oldid=552460564].  inserted a link to the company's blog [//en.wikipedia.org/w/index.php?title=Software_product_management&diff=prev&oldid=514263852] into an article, as did 75.22.75.219 [//en.wikipedia.org/w/index.php?title=Functional_specification&diff=436285054&oldid=424963620]. For each, these were their only edit.  added GatherSpace material in three of seven edits: [//en.wikipedia.org/w/index.php?title=Software_requirements&diff=prev&oldid=554211187] [//en.wikipedia.org/w/index.php?title=Requirements_traceability&diff=prev&oldid=557760583] [//en.wikipedia.org/w/index.php?title=Software_requirements_specification&diff=prev&oldid=559467297].

2013062610014599 OTRS ticket for File:Kryoman_The_Robot.jpg and File:Kryoman_DJ.jpg, uploaded by confirmed sock

was already named but has not been blocked. 2013070110006982 OTRS ticket for File:Dr_Reza_Ghorbhani.jpg, uploaded by suspected sock presumably for use in deleted article Reza Ghorbani. along with confirmed socks and  said in Articles for deletion/Reza Ghorbani article should be kept.



Both made multiple edits to Smashburger which is linked from sock-contributed article Rick E. Schaden. only edited the Smashburger article.



Confirmed sock added the logo [//en.wikipedia.org/w/index.php?title=Touchfire&diff=563532149&oldid=563516321] to Touchfire, an article placed by.



The RLJ Companies was placed by confirmed sock and edited by 54.241.212.203, also confirmed as used by the Morning277 outfit. I tagged it for G5 deletion, then 34 minutes later, 173.247.203.34 removed [//en.wikipedia.org/w/index.php?title=The_RLJ_Companies&diff=564845729&oldid=564842511] the tag. I looked at www.webpass.net and they don't offer service near Los Angeles ("select city").

Rick E. Schaden was placed by confirmed sock. I tagged it for G5 deletion, then 3 hours 15 minutes later, someone editing from an address belonging to hosting company corespace.com came along to remove [//en.wikipedia.org/w/index.php?title=Rick_E._Schaden&diff=prev&oldid=564822906] the deletion tag (and the orphan tag). — rybec   00:23, 19 July 2013 (UTC)

edited Vungle (company), placed by confirmed sock ; edited Bob Dorf, placed by confirmed sock and edited by confirmed sock 54.251.21.249. Also edited various Bangladesh-related articles, similarly to other accounts named earlier. — rybec   00:44, 19 July 2013 (UTC)

Just adding another one for CU purposes. Already blocked and tagged. Someguy1221 (talk) 01:44, 19 July 2013 (UTC)



IP editor removed PROD and orphan tags from Alsbridge (company) with comment "Very well known co in New York"; according to the article the company is in Texas. Article was in User:Sublimeharmony/sandbox11; recreated after deletion of Alsbridge. Hostname 207-237-83-8.c3-0.nyw-ubr1.nyr-nyw.ny.cable.rcn.com does imply editor is connecting from New York City.



Heycheri was already reported, but was not blocked. [//en.wikipedia.org/w/index.php?title=Identified_(company)&oldid=479157695 Created] Identified_(company), later edited by confirmed sock IP Special:Contributions/54.251.205.252. — rybec   02:57, 19 July 2013 (UTC)

The following were ✅ to and some earlier socks by  on IRC: Someguy1221 (talk) 03:49, 19 July 2013 (UTC)



EG Innovations was created [//en.wikipedia.org/w/index.php?title=Eg_Innovations&oldid=560927895] by confirmed sock and edited once by confirmed sock 54.241.200.213. added File:Logo_eG_Innovations.jpg; Special:Contributions/122.165.7.23 did many edits to the article (and only that article). — rybec   04:14, 19 July 2013 (UTC)



Chicago2011 was identified by WilliamH as a possible sock, but was not blocked. User:PrezMittens/sandbox/BOI is a draft about BofI Holding, Inc.; has been confirmed as a Morning377 sock. Bank_of_Internet_USA was [//en.wikipedia.org/w/index.php?title=Bank_of_Internet_USA&oldid=508081898 created] by. BofI_Federal_Bank_(company) was created by, a confirmed Morning377 sock. BofI_Holding_Inc was created by, a confirmed Morning377 sock. — rybec   05:35, 19 July 2013 (UTC)



The Oren Laurent article and the latest Banc De Binary article (replacing one that was deleted after an AfD) were posted by Morning277 socks (the latter article was edited by confirmed socks Thecandymaker and 54.241.52.228). According to the Banc De Binary article, Oren Laurent founded Banc De Binary. After its deletion, the old Banc De Binary article was userfied to User:Hobbes_Goodyear/Banc_de_Binary. Recordwriter's contributions consist entirely of AfD comments attempting to save Banc De Binary and Oren Laurent, and edits to User:Hobbes_Goodyear/Banc_de_Binary to put the company in a more favorable light, [//en.wikipedia.org/w/index.php?title=User:Hobbes_Goodyear/Banc_de_Binary&diff=prev&oldid=533509562 this edit] being the most egregious. — rybec   18:28, 19 July 2013 (UTC)



Does minor edits to existing articles, then contributes PLS Financial Services about a Chicago finance company, which seems at odds with autobiography on user page:

"My names are Beatrice Muthoni from Africa Kenya, am the first born in a family of five. I was born and educated in Nairobi. My hobbies are tapestry making,swimming,reading inspirational books and gemstone collecting."

PLS Financial Services was later edited by confirmed socks 54.215.68.152, 54.241.83.117, 54.215.98.205, 54.215.115.41 and (the latter added the logo and a photo with OTRS ticket 2013050410006097). — rybec   18:49, 19 July 2013 (UTC)



WEP2013's user page says it's an alternate account of WhoElsePoems. They edit the same pages as, appearing to work for Banc De Binary and its founder Oren Laurent. [//en.wikipedia.org/w/index.php?title=Wikipedia:Articles_for_deletion/Banc_de_Binary&diff=prev&oldid=534669752 In the Banc de Binary AfD], WEP2013 wrote, "I created this article as well as improving the article about the founder of the company." — rybec   20:10, 19 July 2013 (UTC)



was contributed by Phrenology. Subsequently it was edited by confirmed Morning277 socks 54.241.41.227, 54.241.46.42, 54.215.78.180, 54.215.58.143, 54.215.61.209, NaturalScholar, Thecandymaker, A1Abigail, Josiah2013 and 54.241.89.228. — rybec   21:48, 19 July 2013 (UTC) Phrenology also edited [//en.wikipedia.org/w/index.php?title=ViSalus&diff=prev&oldid=544849246 ViSalus], which was [//en.wikipedia.org/w/index.php?title=ViSalus&oldid=491210956 created by Morning277] and [//en.wikipedia.org/w/index.php?title=Hydroxycut&diff=prev&oldid=545967659 Hydroxycut] which received a Morning277-related edit [//en.wikipedia.org/w/index.php?title=Hydroxycut&diff=565405682&oldid=561540486]. — rybec   03:24, 4 August 2013 (UTC)



Made recent edits to and, both of which were contributed by confirmed sock. No other recent edits from this IP address. — rybec   23:47, 19 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * Banc de Binary has been tagged with G4, EG Innovations has been AFDed based on lack of notability. § FreeRangeFrog croak 19:05, 19 July 2013 (UTC)
 * Dealt with, can go to AFD in future if need be. WilliamH (talk) 15:17, 28 July 2013 (UTC)
 * In my notes I've identified Chicago2011 as another paid editor, but not as Morning277. I can identify who it is, but as that would require outing, I can't make the identification here. I don't believe that Chicago2011 is a sock of Morning277, although he is certainly a paid editor. - Bilby (talk) 07:48, 5 August 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
- The previous rangeblocks appear to have not even slowed him down, let's do another check. Some of the new IPs listed in today's filing appear to be new webhosts. At least one of the IPs looks like a normal internet connection, so maybe a meatpuppet. Someguy1221 (talk) 03:54, 19 July 2013 (UTC) All of the accounts listed here, and their articles, have been dealt with on a case-by-case basis as felt was reasonable. Some accounts were blocked, some articles deleted, some accounts were sent to a CU request far below, and some were ignored. Someguy1221 (talk) 01:02, 9 August 2013 (UTC)
 * @Someguy1221: The reason why this has probably been sitting for so long is how scattered the request and the evidence is. If you can make a list of checkable accounts, checkable IPs (ONLY if absolutely needed), and a brief statement of the general behavioral pattern, I can look into this. -- DQ   (ʞlɐʇ)  20:17, 30 July 2013 (UTC)

04 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Resolves to ip173c237.banglalionwimax.com. Whois indicates Dhaka, Bangladesh. Edited Bob Dorf, started by Morning277 sock Mikagrlo. May be associated with suspected sock. — rybec   20:27, 4 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
IP is long stale now, but good to keep here for the record. Mikagrlo and Arojit are now blocked, and Bob Dorf is at AFD. Someguy1221 (talk) 22:43, 8 August 2013 (UTC)

04 August 2013 (2)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Olympus Worldwide Chauffeured Services was deleted, but not salted. In the AfD discussion, said that the article was written by Morning277. A new article, Olympus Worldwide Chauffeured Services (company) was placed by Loricarey03 [//en.wikipedia.org/w/index.php?title=Olympus_Worldwide_Chauffeured_Services_(company)&oldid=557765664]. Recreating deleted articles with " (company)" appended to their titles is typical of Morning277. Citations are named with two-letter, capitalized abbreviations, for example VY for voices.yahoo.com. A series of minor edits to existing articles, followed by the dropping of a spam article, then abandonment of the account is characteristic of Morning277. — rybec   04:05, 4 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I've deleted the new article as obvious puppetry, and salted both. I would suggest all articles from this group of editors be salted, but unfortunately I have seen re-creations under various additions to the name. I do not think we have the ability to salt titles beginning with a phrase, so I can only suggest careful attention be paid to any title qualified with an unnecessary or redundant  term.  DGG ( talk ) 07:16, 7 August 2013 (UTC)
 * Articles deleted by DGG, and the account is now blocked. I've also including this account in the large CU request further down. Someguy1221 (talk) 22:51, 8 August 2013 (UTC)

04 August 2013 (3)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Created Apartment Bank which links to the article about its parent company BofI Federal Bank (company). The latter was created by a confirmed Morning277 sock. Editing habits of Jimrichard1024 are stereotypical. — rybec   04:31, 4 August 2013 (UTC) —  rybec   04:31, 4 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
The person described on Jimrichard1024's userpage appears to actually be a real person and freelance writer. Presumably another contractor for Morning277. He is now blocked. Someguy1221 (talk) 23:01, 8 August 2013 (UTC)

04 August 2013 (4)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Edits own user page until autoconfirmed, then places Orion Systems Integrators. Uses two-letter names for citations. — rybec   04:39, 4 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Sock blocked and article was already deleted. In investigating Gitsumo, I also found, who is also now blocked. Someguy1221 (talk) 23:16, 8 August 2013 (UTC)

05 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

[//en.wikipedia.org/w/index.php?title=User:Smallbizorlando/sandbox&oldid=563708105] vs. [//en.wikipedia.org/w/index.php?title=Search_Engine_People&oldid=564960194]

Smallbizorlando was blocked as a spammer on 10 July. SunTanPrincess started editing 19 July, inserting content with identical sections to Smallbizorlando's article. Editing habits of Smallbizorlando are stereotypical of Morning277; SunTanPrincess' habits are not. — rybec   01:30, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Smallbizorlando is already blocked. SunTanPrincess has been placed in a request for CU further down. I'll wait for CU comments on her before deciding what to do, but otherwise this section is closed. Someguy1221 (talk) 23:18, 8 August 2013 (UTC)

05 August 2013 (4)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing new article about Echopass, [//en.wikipedia.org/w/index.php?title=User:Tc.guho/sandbox&oldid=566528996] vs. [//en.wikipedia.org/w/index.php?oldid=552149605] — rybec   02:41, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Blocked and tagged. --Rschen7754 05:56, 6 August 2013 (UTC)

05 August 2013 (5)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing to restore article on Ethan Bearman, vs. [//en.wikipedia.org/w/index.php?oldid=554435091] —  rybec   02:53, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked and tagged. --Rschen7754 05:59, 6 August 2013 (UTC)

05 August 2013 (6)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing to restore article on Heel That Pain, [//en.wikipedia.org/w/index.php?title=User:Chvp12/sandbox&oldid=566608564] vs. [//en.wikipedia.org/w/index.php?oldid=540648119] — rybec   03:03, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked and tagged. --Rschen7754 06:04, 6 August 2013 (UTC)

05 August 2013 (13)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

stereotypical editing habits; preparing to reinsert RxWiki; draft has two- and three-letter capitalized names for citations — rybec   05:11, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked and tagged. --Rschen7754 06:15, 6 August 2013 (UTC)

05 August 2013 (19)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

These IP addresses are in a range belonging to Amazon EC2 that has not yet been blocked. Edited, contributed by a Morning277 sock, and existing article. Other edits that look related to Morning277:


 * Keenan (company)
 * Gary_Crittenden [//en.wikipedia.org/w/index.php?title=Gary_Crittenden&diff=prev&oldid=562025779]
 * Michael_Johns_(policy_analyst) [//en.wikipedia.org/w/index.php?title=Michael_Johns_%28policy_analyst%29&diff=prev&oldid=561999462]
 * Olympus_Worldwide_Chauffeured_Services_(company) [//en.wikipedia.org/w/index.php?title=Olympus_Worldwide_Chauffeured_Services_%28company%29&diff=prev&oldid=561736158]
 * Robert_L._Johnson [//en.wikipedia.org/w/index.php?title=Robert_L._Johnson&diff=prev&oldid=561573158]
 * Black_Entertainment_Television (Robert L. Johnson's company) [//en.wikipedia.org/w/index.php?title=Black_Entertainment_Television&diff=prev&oldid=561412415]
 * Martin_Bayne [//en.wikipedia.org/w/index.php?title=Martin_Bayne&diff=prev&oldid=561425114]
 * 24Hr_HomeCare [//en.wikipedia.org/w/index.php?title=24Hr_HomeCare&diff=prev&oldid=561012436]
 * Dasein Executive Search [//en.wikipedia.org/w/index.php?title=Dasein_Executive_Search&diff=564660791&oldid=564407517] and [//en.wikipedia.org/w/index.php?title=Dasein_Executive_Search&diff=564407517&oldid=561548045]

Amazon EC2/AWS was used before by Morning277 writers, leading to blocks of 54.241.0.0/16, 54.251.0.0/16, and 54.215.0.0/16 (see WP:Database_reports/Range_blocks).

Whois record says: Requesting check-user and block, if feasible.

range contribs — rybec   22:57, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Range blocked, please advise if anything else is needed for this report. --Rschen7754 06:09, 6 August 2013 (UTC)
 * Thank you; I had asked for check-user so that the effect on non-abusers could be checked for. The range script showed some edits that did not look like abuse, especially from before mid-July when the other EC2/AWS ranges were blocked. — rybec   12:30, 6 August 2013 (UTC)
 * We do generally block webhosts anyway, since they're too easily abused for creating spambots en masse. --Rschen7754 15:05, 6 August 2013 (UTC)

06 August 2013 (3)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing to replace Exosite (company)/Exosite (organization) — rybec   05:40, 6 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked and tagged. --Rschen7754 06:18, 6 August 2013 (UTC)

08 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Is preparing [//en.wikipedia.org/w/index.php?title=User:Smyahyaijaz/sandbox&oldid=567596611] to replace 1-800-Therapist. A Morning277 editor participated in Articles_for_deletion/1-800-Therapist. — rybec   09:36, 8 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Blocked and sandbox deleted. I've informed the checkusers about this account through IRC. Someguy1221 (talk) 00:30, 9 August 2013 (UTC)

08 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

recreated Mark A. Fischer, previously contributed by a Morning277 writer, as Mark A Fischer

Addresses resolve to ppp-71-128-207-107.dsl.sndg02.pacbell.net and adsl-99-133-162-53.dsl.pltn13.sbcglobal.net, possibly in San Diego and Pleasanton, California. — rybec   09:59, 8 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked the account; unsure about the IPs. Anyway, he/they hop IPs to fast. Reaper Eternal (talk) 17:39, 8 August 2013 (UTC)

05 August 2013 (3)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing new article on CHMB, [//en.wikipedia.org/w/index.php?title=User:Cbrillaz/sandbox&oldid=566574397] vs. [//en.wikipedia.org/w/index.php?oldid=549411491] — rybec   02:35, 5 August 2013 (UTC) —  rybec   02:35, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 16:39, 17 August 2013 (UTC)

05 August 2013 (9)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing to restore article on CALNET, [//en.wikipedia.org/w/index.php?title=User:Thegypsywrites/sandbox&oldid=566726006] vs. [//en.wikipedia.org/w/index.php?oldid=544688244] — rybec   03:20, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked and tagged. --Rschen7754 16:37, 17 August 2013 (UTC)

05 August 2013 (10)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

stereotypical editing habits; Copier Supply Store has two-letter capitalized names for citations [//en.wikipedia.org/w/index.php?title=Copier_Supply_Store&oldid=551637337] — rybec   03:24, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 16:41, 17 August 2013 (UTC)

05 August 2013 (16)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Editing habits of Shiril85 are stereotypical of Morning277; recreated deleted article Macroaxis as Macroaxis (company) in stereotypical manner. New article has two-letter capitalized names for citations. — rybec   19:56, 5 August 2013 (UTC) —  rybec   19:56, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 16:43, 17 August 2013 (UTC)

05 August 2013 (17)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

After placing article X4 Labs, made a change [//en.wikipedia.org/w/index.php?title=Penis_enlargement&diff=prev&oldid=539142244] to Penis enlargement. First reference in X4 Labs is named with a single letter. Initial edits are to Indonesian topics. Otherwise typical. — rybec   22:00, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 16:44, 17 August 2013 (UTC)

10 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Introduced material about Sirion Biotech to Gene knockdown:,. — rybec   05:30, 10 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. -Rschen7754 16:46, 17 August 2013 (UTC)

10 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

latest version of User:Deepasoft/sandbox3 is a draft about Mile2. Contributed CIVISION Technologies, VFiles, CypherWorx and AppAddictive. — rybec   05:58, 10 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 16:56, 17 August 2013 (UTC)

10 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing draft to replace Network Capital Funding Corporation; please compare Sublimeharmony draft  especially March 7 date in citations. — rybec   23:51, 10 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 16:55, 17 August 2013 (UTC)

11 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing draft to replace Loyaltyworks; please compare Sublimeharmony draft  especially 20 May access date in citations. — rybec   00:22, 11 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 16:58, 17 August 2013 (UTC)

11 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * User:Sinclaip/sandbox

preparing to replace Exosite (company)/Exosite (organization) — rybec   00:09, 11 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * For what it's worth, Sinclaip turned up in IRC and claimed to have been hired via oDesk by a certain Darius Fisher of wiki-PR; compare Help_desk/Archives/2012_December_12 for their modus operandi. If that's true (and I don't see a reason to doubt them) they're technically not sockpuppets but arguably meatpuppets. Huon (talk) 01:30, 13 August 2013 (UTC)
 * The company running morning277 has at least 15 full time employees, so most of the accounts on this page are more meatpuppets than sockpuppets. Kevin Gorman (talk) 01:42, 13 August 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 16:57, 17 August 2013 (UTC)

11 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing draft in User:Smartmooon/sandbox about SafeMart — rybec   23:58, 11 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked and tagged, closing. --Rschen7754 20:19, 14 August 2013 (UTC)

12 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

recreation of GingerBread Lane in User:Imran771/sandbox — rybec   14:02, 12 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 16:59, 17 August 2013 (UTC)

13 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

recreated as   —  rybec   08:35, 13 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 17:00, 17 August 2013 (UTC)

13 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

is a draft to replace.

The access date of citations in the new draft matches the date of the User:Sublimeharmony/sandbox11 draft. — rybec   15:44, 13 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 17:01, 17 August 2013 (UTC)

13 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:Umeshkrojha/sandbox is a template for spammy articles, based upon US Federal Contractor Registration. The same template exists at User:Xylum/sandbox. — rybec   16:28, 13 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 17:02, 17 August 2013 (UTC)

13 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:JAYRAJ123/Emmanuel Lemelson is a draft about Morning277 topic Emmanuel Lemelson. Also had another draft that was moved to Emmanuel Lemelson.

Sublimeharmony version:

— rybec   16:48, 13 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked and tagged. --Rschen7754 18:21, 14 August 2013 (UTC)

13 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

inserted TravelShark —  rybec   23:51, 13 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Is this one of the SublimeHarmony sandbox articles? - Bilby (talk) 01:26, 14 August 2013 (UTC)
 * No. It cited one or more of the "strongly indicative sites" I've listed at Long-term_abuse/Morning277. Apologies for requesting its deletion so soon. — rybec   04:41, 14 August 2013 (UTC)
 * Fair enough, although in that case I don't feel that having sites in common as references is enough to warrant blocking, given that the formatting style is different, it isn't a known Morning277 topic, and the user's details seem to check out. We'll probably need more points of intersection between the editing of the two. - Bilby (talk) 06:23, 14 August 2013 (UTC)
 * Morning277 has stopped using the short, capitalized refnames since I wrote the LTA report. The Travel Shark article was posted very recently. I'm not sure I've mentioned it, but I saw edits where, in edits from AT&T DSL addresses, the refnames in older articles were changed to longer, lower case or mixed case (don't remember which) ones, as though to evade recognition. Was that what you meant by the formatting? I didn't save a copy of the TravelShark article; if you feel like undeleting it or e-mailing it to me I'd be happy to discuss it in more detail. The Sublimeharmony sandbox contains just under 110 instances each of vatalyst.com and investmentunderground.com. I provided search links in the LTA; please feel free to point out articles that use those sites but which you don't think are Morning277's work. What do you mean by "the user's details seem to check out"? — rybec   16:57, 14 August 2013 (UTC)
 * The editor has been blocked as a sock of a different master, so all is good. But in general, I don't deny that the use of those references may be an indicator of a Morning277 sock/meatpuppet. It is just we can't regard the use of particular sites as sufficient evidence that a user is connected to Morning277. If other evidence isn't available, for whatever reason, then it is going to be difficult to justify a block. - Bilby (talk) 23:13, 14 August 2013 (UTC)
 * If recreation of an article found in User:Sublimeharmony/sandbox11 is enough evidence for you to be comfortable, I've added the list of topics from User:Sublimeharmony/sandbox11 to the LTA report, and I've reported quite a few recreations of articles on those topics. For those, I can provide the specific revision of User:Sublimeharmony/sandbox11 if it's needed. — rybec   01:13, 15 August 2013 (UTC)

05 August 2013 (15)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

This is a single-purpose account, which only edited Deal Angel (company) which saw extensive Morning277-related editing. Username ending in "87" is reminiscent of, , and. — rybec   17:03, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. --Rschen7754 21:12, 23 August 2013 (UTC)

06 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Edited Newsfilter.org, changing names of references from short, capitalized names to longer, lower-case names. Removed db-g5 and orphan tags from article.



removed PROD from Bulb America [//en.wikipedia.org/w/index.php?title=Bulb_America&diff=prev&oldid=567328808] — rybec

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Long stale. --Rschen7754 21:14, 23 August 2013 (UTC)

10 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Latest promotional SPA for Oren Laurent (now Oren Laurent (entrepreneur)) and Banc de Binary (now Banc De Binary), favorite stomping grounds of this socker. softens/removes criticism, adds peacock terms, trying to keep CSD G4 tags off his recreated articles. MrOllie (talk) 20:18, 10 August 2013 (UTC)

I reported =HT=Chief in Sockpuppet investigations/Longlane2012. recreated (deleted after AfD) as. Oren Laurent runs ; Banc De Binary article was created by in May. — rybec   20:46, 10 August 2013 (UTC)

A draft about Oren Laurent was in User:Sublimeharmony/sandbox11 [//en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=558366818]. — rybec   21:20, 10 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

==HT=Chief (now renamed HTChief) wrote this on User_talk:HTChief: "Someone is attempting to remove factual information which I posted about Banc De Binary and Oren Laurent, and wrongly accusing me of being associated with an abusive account. If you review the history of the articles which I posted, they were not only factual and unbiased, but also reviewed by other Wikipedia users for keeping within standard wikipedia guidelines." — rybec   21:02, 11 August 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 03:19, 20 August 2013 (UTC)

13 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing to recreated as  ; see User:Vijay stephen/sandbox —  rybec   06:19, 13 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked and tagged. --Rschen7754 21:24, 23 August 2013 (UTC)

14 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:Adeeeel.ahmed/sandbox is a recreation of Sublimeharmony topic MediCortex.

link to Sublimeharmony draft: —  rybec   21:28, 14 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 03:29, 20 August 2013 (UTC)

14 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Afeerah recreates Samir Becic as. One-edit account Hedgeeg helpfully removes cabusinessjournal.org citation. Heads up! New M.O. — rybec   21:36, 14 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 21:30, 23 August 2013 (UTC)

14 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Bunndle, Inc., recreation of Bunndle (Sublimeharmony topic) — rybec   23:04, 14 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 21:21, 23 August 2013 (UTC)

15 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Bdaljev recreated BillFloat at BillFloat (company), moving it into main space at 15:57. Between 19:34 and 20:33, the other editors worked on the citations. The other accounts edited no other articles. — rybec   02:16, 15 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * All blocked already. --Rschen7754 21:28, 23 August 2013 (UTC)

15 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * draft in User:Md. Shariful Huq/sandbox about old topic NewYorkStay
 * cites California Business Journal
 * posted prior article — rybec   02:23, 15 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 21:27, 23 August 2013 (UTC)

15 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * minor edits until autoconfirmed
 * created article in sandbox
 * contributed CardsChat, sourced to a Digital Journal piece by Andrew Moran — rybec   17:27, 15 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 21:19, 23 August 2013 (UTC)

16 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * Airoli/sandbox/Alex Haditaghi (entrepreneur), likely to be placed at Alex Haditaghi (entrepreneur), is a draft about previously-spammed topic Alex Haditaghi
 * unnecessary disambiguation to avoid recreation filter
 * cites California Business Journal — rybec   18:19, 16 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 21:18, 23 August 2013 (UTC)

17 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * noticed by I am One of Many
 * placed new Micreos article at original location (previous article was deleted as a Morning277 creation)
 * short refnames (two capitalized letters and a number) — rybec   06:16, 17 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked and tagged. --Rschen7754 16:48, 17 August 2013 (UTC)

17 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

— rybec   06:23, 17 August 2013 (UTC)
 * noticed by I am One of Many
 * restored John Uustal at John J. Uustal
 * Sublimeharmony draft
 * references section has URL http://www.bizjournals.com/southflorida/stories/2006/10/02/story8.html?page=all

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked already. --Rschen7754 21:17, 23 August 2013 (UTC)

17 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * discovered by I am One of Many
 * replaced Morning277 article Kuvva with new articles at User:Kuvva (company) and User:Melissajan0/Kuvva
 * citations to CrunchBase, The Next Web and Lifehacker — rybec   06:33, 17 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked and tagged. --Rschen7754 06:35, 19 August 2013 (UTC)

22 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

vs. —  rybec   10:33, 22 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 21:25, 23 August 2013 (UTC)

22 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

vs. —  rybec   10:55, 22 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 21:15, 23 August 2013 (UTC)

23 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

vs. and. — rybec   21:29, 23 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked and tagged. --Rschen7754 21:32, 23 August 2013 (UTC)

25 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

David_Schwedel_(investor) vs. Sublimeharmony draft — rybec   04:28, 25 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. --Rschen7754 07:43, 27 August 2013 (UTC)

26 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:Nizam655/sandbox about CrowdOptic vs. Sublimeharmony draft — rybec   17:45, 26 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already done. --Rschen7754 20:26, 28 August 2013 (UTC)

26 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Please see simple:Special:PermanentLink/4543805 Osiris (talk) 17:53, 26 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Of the 26 articles listed by Osiris, 15 are on familiar topics that I think are Morning277 creations. I've copy-pasted the list below, so the articles on this wiki can be compared.

— rybec   02:16, 27 August 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked due to evidence on simplewiki. --Rschen7754 07:38, 27 August 2013 (UTC)

04 September 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

User account follows classic Morning277 pattern: account created, meaningless userpage created, then a few edits followed by the creation of a single article about a (likely) non-notable company (Hailo) in the usual Morning277 format (way too many citations, dubious sources, etc.), then no more edits. KDS 4444 Talk   07:37, 4 September 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * It's possible, but it might also be someone else. Not enough evidence to block. Reaper Eternal (talk) 12:36, 4 September 2013 (UTC)

04 September 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Classic Morning 277 account: sole purpose was the creation of the article David Stewart (alternative medicine) consisting of discredited sources (vatalyst, CNN iReport, etc.) and nothing else. KDS 4444 Talk   08:18, 4 September 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I actually tried checking this account, given the suspicious behavior and account creation timing. Of course, nothing showed up, so I can't tell if this is or isn't Morning277. Closing, then. Reaper Eternal (talk) 12:38, 4 September 2013 (UTC)

04 September 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

See user contributions. One article created ("W Atheltic", soon to be deleted), nothing meaningful before or since. I hope he was paid well. KDS 4444 Talk   08:34, 4 September 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Insufficient evidence that this is Morning277. Closed. Reaper Eternal (talk) 12:24, 4 September 2013 (UTC)

04 September 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

User created one article in classic Morning277 pattern. Nothing meaningful before, certainly none since. KDS 4444 Talk   08:46, 4 September 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Insufficient evidence that this is Morning277; also a stale account. Closed. Reaper Eternal (talk) 12:23, 4 September 2013 (UTC)

04 September 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Has created User:Colossus235/sandbox, a recreation of Confio which was deleted per G5 as a Morning277-sock creation. The customer, Confio, has asked on my talk page about the article, and I doubt it is a coincidence that a new user has popped up now to re-create it. Contributions show classic Morning277 pattern of a few neutral edits, a pause, and then creation of a sandbox article. JohnCD (talk) 22:11, 4 September 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are to be the same person.


 * is, but behavior is suspiciously like that of a sockpuppet or meatpuppet.
 * There's a half-dozen more on the range that are ✅, but without a behavioral connection, I'm not going to list them. Reaper Eternal (talk) 02:17, 5 September 2013 (UTC)
 * Blocked all named accounts. Legoktm (talk) 07:27, 5 September 2013 (UTC)

19 September 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User admits that he is a hired contractor "posting articles according to someone else's instructions". His contributions were Scott Cullather, previously created by Morning277 sock, and InVNT, Cullather's company. JohnCD (talk) 22:07, 19 September 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Blocked and tagged per WP:DUCK as a meatpuppet; it might be worth considering CU for any sleepers, since Morning277 is evidently still recruiting. JohnCD (talk) 22:07, 19 September 2013 (UTC)
 * Checked, but as it turns out to draw any conclusions. NativeForeigner Talk 22:27, 19 September 2013 (UTC)

21 November 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

one edit per account was made to Network Capital Funding Corporation

Sublimeharmony draft &mdash; rybec   07:53, 21 November 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Appropriate legal parties have been notified. These accounts are confirmed. NativeForeigner Talk 08:11, 21 November 2013 (UTC)

21 November 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

--     L o g     X    18:10, 21 November 2013 (UTC)

This page was created by a sock of the user Morning277. And the puppet has edited the page. That's why i think it might be a sock of the master. --     L o g     X    18:29, 21 November 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Heiserville's main contribution so far has been to create a new article, Drew Bartkiewicz, about the CEO of Lettrs. I think I recognise the writing style. &mdash; rybec   05:06, 22 November 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Do you have anything that would indicate this is a sock of this particular user, as opposed to a promotional editor in general? NativeForeigner Talk 18:23, 21 November 2013 (UTC)
 * Closing due to lack of evidence and not being within the established guideline for cases being filled. -- DQ   (ʞlɐʇ)  19:38, 12 December 2013 (UTC)

22 November 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

These editors, who appear to be experienced, are reposting or revising articles previously associated with Morning277. They have not edited other articles.

Brightones contributed a new version of TravelShark, making no other edits except one to User:Brightones. The article existed before under this name, and as Travel Shark.

Compasa contributed a new version of Repair Clinic, making no other edits so far. The article existed before as RepairClinic.com.

Berkgrad421 made extensive changes to Legitmix, making no other edits so far. . Here is a Sublimeharmony draft about Legitmix.

Braylush TAN removed citations to Yahoo Voices, Investment Underground and Vatalyst from Zorpia, making no other edits so far. Here is a Sublimeharmony draft about Zorpia.

New york technode removed citations to Caliornia Business Journal and Investment Underground from Linode, making no other edits so far.

Danieln23 contributed a new version of Aasted, making three edits related to the article and no other edits as yet. Here is a Sublimeharmony draft about Aasted. &mdash; rybec   03:00, 22 November 2013 (UTC)



HealthyAltas contributed a new version of CHMB (company) at CHMB Solutions. Here is a Sublimeharmony draft on the topic. &mdash; rybec   07:04, 29 November 2013 (UTC)



Social_Mike_Ferlita contributed a new version of Pheed; an article on the topic had previously been contributed by. &mdash; rybec   18:38, 30 November 2013 (UTC)



posted a new article about Cleeng.com; former article was at Cleeng; note unnecessary disambiguation

Sublimeharmony draft &mdash; rybec   18:48, 30 November 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked what I could. --Rschen7754 02:49, 18 December 2013 (UTC)

26 December 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

This looks like the same pattern as for other recently reported accounts: in a single edit, created an article about a topic previously linked to Morning277, with account abandoned soon after; the difference here is that one wiki-link was created in another article, so the new article was not an orphan. Previous drafts on the same topic,, existed at and  &mdash;  rybec   20:19, 26 December 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked, closing. King of &hearts;   &diams;   &clubs;  &spades; 18:51, 3 January 2014 (UTC)

27 January 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Linked by articles recreated by User:CitizenNeutral, blocked for being a Wiki-PR sock. Most of their article edits look promotional, some of them are the obvious "mark everything as minor", "10 edits on random articles to get autoconfirmed first", "create article with one edit in sandbox and move to mainspace", etc. Sorry about lack of diffs, I really really need to go to sleep again. Ansh666 08:29, 27 January 2014 (UTC)



Made only a single edit, in November to the AEgis Technologies article reposted by CitizenNeutral. Demonstrates high proficiency with Wikipedia. CU requested if it's not too late. &mdash; rybec   09:49, 27 January 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * We'll need additional evidence, beyond having edited an article in common. Some of these seem very unlikely. - Bilby (talk) 08:56, 27 January 2014 (UTC)
 * I'll finish it up tomorrow (PST), but by then a lot of articles will have been deleted, so I may not be able to see it anymore. It's pretty late here, so if my judgment is a bit lacking right now, sorry to anyone who I've named who isn't a part of this mess. Ansh666 08:59, 27 January 2014 (UTC)
 * I think that you'll need to provide diffs and more direct evidence - just looking at the first three, I can see nothing to suggest that they are working with CitizenNeutral, and in the case of Enterprise man, good reason to believe the opposite. Some of these might be valid, but it isn't clear which ones. - Bilby (talk) 09:52, 27 January 2014 (UTC)
 * I agree with Bilby about Enterprise man: Centrify was one of the companies being promoted by the "Morning277" group. However looks very likely: does exactly ten minor edits on South Asian topics, waits a few days, then splat!, creates an article on Samsung Knox with a section promoting Centrify. &mdash;  rybec   10:02, 27 January 2014 (UTC)


 * Rfawal looks unlikely. The Wiki-PR article about Democracy Data & Communications was created at DDC Advocacy, then DDCA, then by CitizenNeutral at DDC Advocacy again. The separate article at Democracy Data & Communications was edited by Rfawal in 2007, whereas Wiki-PR's operations are believed to have started in 2010. The style of Rfawal's sandbox doesn't resemble their work.


 * I had been wondering about 172.162.11.195. The talk page comment asking for help with referencing reminds me of posts by other editors I've mentioned before:, , , . Then ~20 minutes later the next edit shows full proficiency with inline references. The misspellings and use of AOL are uncharacteristic, but may have been done for evasion.


 * Patapsco913 edited just four days after CitizenNeutral restarted it . They both edited, albeit 114 days apart.


 * Patapsco913 has created what look like vanity articles, e.g., and  but I don't recognise the Wiki-PR writing style in them.


 * Buchaboy gizmo is now blocked.


 * PetarrPoznic looks very likely, having started Soul Artist Management (company) about a "Morning277" topic with the typical unnecessary disambiguation in the title. The series of minor edits followed by creation of an article in one edit are stereotypical.


 * Art knievel only made a single edit, but it shows high proficiency with Wikipedia and it was to the Soul Artist Management (company) article. &mdash; rybec   11:27, 27 January 2014 (UTC)
 * I'd rather not reach a point where we block people on the basis of one edit. - Bilby (talk) 11:31, 27 January 2014 (UTC)
 * Sometimes one person may hold more than one account. The accounts, , and  were blocked after just one edit per account. It isn't necessary to do ten edits before creating an article. &mdash;  rybec   12:06, 27 January 2014 (UTC)
 * But Art knievel didn't create an article. I'm very happy to see Morning277 and Wiki-PR accounts blocked. I just don't want to see us lose all sense of AGF in the process, or see us engaged in using SPI for fishing expeditions. - Bilby (talk) 12:11, 27 January 2014 (UTC)

Djj518's changes to Samsung_Knox don't obviously promote Centrify. I don't see any sign that this one is working with Wiki-PR. &mdash; rybec   11:46, 27 January 2014 (UTC)
 * A single article (now deleted) had received edits from three of the one-edit accounts I listed. AGF shouldn't be a carte blanche. Do you disagree that the one edit by Art knievel looks like the work of an experienced editor? When someone somehow gains experience, creates an account and does only one edit before abandoning the account, that looks to me like a probable attempt to evade scrutiny. The person could have gotten his experience on wikia.com, somehow noticed that Wikipedia had an article on his favourite topic, made the account, did the edit, and decided Wikipedia wasn't for him, but I find that rather less likely. What's your AGF scenario? Do you see justification for looking into any of these accounts or IP addresses? &mdash; rybec   13:49, 27 January 2014 (UTC)
 * A number of these accounts are worth looking into, although an SPI is as likely to be as useless as it normally is, given that we've established that Wiki-PR tends to rely more on hiring editors than using socks. In regard to Art knievel, it is possible that this is another Wiki-PR account. But the edits were innocuous, could have been made with the assistance of the exiting editing tools (which help with referencing), weren't particularly experienced, and there was no need for CitizenNeutral to have used an alternative account to make those edits, given that the account wasn't blocked or under suspicion. My understanding was that we can't rely just on edits to suspect pages alone. I think that Art knievel might be connected with the company, but there's not much to judge if Art knievel is a Wiki-PR account. - Bilby (talk) 14:09, 27 January 2014 (UTC)

Rybec's done a good analysis here. Several editors (Art knievel for one) had two edits when I listed them here; the articles have since been deleted, so he couldn't see them (though Bilby can). I was concerned about those defending articles/removing promotional material because that was how CN started out - not obviously promotional or not promotional at all. It could be a new strategy on Wiki-PR's part, taking some time to actually seem like real editors before going rogue, but it's probably just ABF by now, or at least I hope. Ansh666 18:03, 27 January 2014 (UTC)


 * User:Tolsonbeerd, User:Mark Ledere the bean, User:Peladosilva/186IP (both Brazilian; both unlikely to be Morning277 or Wiki-PR), and User:Art knievel have few or no remaining undeleted edits, so an admin is going to have to look at them. User:Djj518 seems unlikely to be related now; User:Patapsco913 also seems unlikely to be related to either Wiki-PR or Morning277, but does look like a promotional/paid-editing account of some sort - nothing to be done here. User:Dominicd'bella has only two edits, both of which are attempting to revert an IP removal of some sections on the Samsung Knox article that included material involving Centrify, which seems to be a client of one of the paid editing companies here. Ansh666 18:41, 31 January 2014 (UTC)


 * Anyone want to check up on Michaelbecks and Emaze? Looks like a classic paid editing pattern. I spot these occasionally at NPP but I'm not sure if they should be reported here or what. § FreeRangeFrog croak 19:13, 31 January 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
These have already been blocked as Morning socks:

I've blocked per the evidence above:

Per comments above, these users aren't very likely:

Currently stale:

I'd have to see additional evidence about the other seven five before making a determination. Mark Arsten (talk) 17:28, 31 January 2014 (UTC)
 * Closing without further action towards the others per lack of evidence. Mark Arsten (talk) 19:37, 3 February 2014 (UTC)

04 October 2014

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Changed this page of Jason kanner to the same one the other user did. Wgolf (talk) 04:17, 4 October 2014 (UTC)


 * Just G5'ed that one. The original casing is Jason Kanner. § FreeRangeFrog croak 06:17, 4 October 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Editor has been blocked and article speedily deleted by . Closing.-- Jezebel's Ponyo bons mots 20:13, 8 October 2014 (UTC)