Wikipedia:Sockpuppet investigations/Morning277/Archive/1

28 July 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Contributions by Anonymity32 begin with a series of 13 edits, marked as minor, to a variety of articles (consistent with known Morning277 socks). Then the editor's user page is created, with a one-sentence biography (also consistent). Then there are no edits for almost six days; the account would now be autoconfirmed. A draft of an article on Gerald Imber is placed in a sandbox [//en.wikipedia.org/w/index.php?title=Gerald_Imber&oldid=514431536]. At the bottom of the list of references are some citations that have not been incorporated into the article. They are identified by abbreviations enclosed in parentheses: (RR), (NYT), (HC) and the like. These parenthesised abbreviations appear in User:Sublimeharmony/sandbox11. For example, the draft about Sollensys has them peppered throughout the body [//en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=541555283] (not in the References section).

I had turned my attention to Anonymity32 because Worldwide Express was recreated by Anonymity32. David Kiger, about the CEO of Worldwide Express, was inserted by a Morning277 sock, and another Morning277 sock, Enigma15071987 was preparing a draft [//en.wikipedia.org/w/index.php?title=User:Enigma15071987/sandbox&oldid=566036116] about David Kiger. — rybec   17:42, 28 July 2013 (UTC) —  rybec   17:42, 28 July 2013 (UTC)

The abbreviation "NYT" for the New York Times is of course a common one, but I don't recall seeing "HC" for Harper-Collins before. This [//en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=542425193]Sublimeharmony draft about ONEHOPE uses the abbreviation "HC" (I'm slightly uncertain that it refers here to Harper-Collins, as it did in Anonymity32's draft) for the Houston Chronicle [//en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=542428923]. The practice of giving short names to citations is common, but enclosing them in round brackets seems uncommon. — rybec   18:57, 28 July 2013 (UTC)

I notice that the last 6 of the 11 edits from 24.131.56.202 (c-24-131-56-202.hsd1.ga.comcast.net, in the American state of Georgia) were to articles also edited by Anonymity32, and happened within 9 days of Anonymity32's changes to those articles, including an edit [//en.wikipedia.org/w/index.php?title=Robert_Jon_Rosenthal&diff=prev&oldid=515580478] to Robert Jon Rosenthal while it was still in user-space and an extensive change [//en.wikipedia.org/w/index.php?title=MokaFive&diff=519366186&oldid=519359448] to MokaFive within an hour of Anonymity32's change [//en.wikipedia.org/w/index.php?title=MokaFive&diff=519370511&oldid=519366186]. The 5 unrelated edits were all in 2007.

Of the four edits from 108.55.199.202 (static-108-55-199-202.nycmny.east.verizon.net, presumably in New York City), three were to two articles also edited by Anonymity32, GasBuddy.com and Worldwide Express, and those three edits took place over a span of 17 minutes. The unrelated edit [//en.wikipedia.org/w/index.php?title=Natural_language_processing&diff=prev&oldid=564833783] was made months later.

The interaction chart shows no overlap in the articles edited from both IP addresses. It looks as though Anonymity32 edited from those addresses while logged out. If so, Anonymity32 had access to an IP address in New York City and (six weeks later) one in the Atlanta area. — rybec   20:14, 28 July 2013 (UTC)

Here's a revision of Anonymity32's sandbox [//en.wikipedia.org/w/index.php?title=KellerINK&oldid=516898285] where the parenthetical abbreviations exist both throughout the body and throughout the References section.

Unlike many of the known Morning277 socks, has done numerous minor edits to existing articles after contributing several new articles. also followed a similar pattern, although the account was blocked while the second article was still in a sandbox. Anonymity32 also contributed Video optimization which isn't obviously an advertisement. — rybec   23:54, 29 July 2013 (UTC)

There is a cluster of articles related to Keller Williams Realty: Mark W. Willis, Jay Papasan, KellerINK, Gary W. Keller, and Dave Jenks. Most of these were made in 2008 by but  created [//en.wikipedia.org/w/index.php?title=KellerINK&oldid=515883258] the KellerINK article, and uploaded to Commons [//commons.wikimedia.org/wiki/Commons:Deletion_requests/Files_uploaded_by_Anonymity32] "KellerWilliamsRealty KellerINK.JPG" and "KellerINK Gary Keller Jay Papasan.jpg" probably for use in that article. edited Jay Papasan and was named [//en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Morning277&diff=564442708&oldid=564440544] as a suspected Morning277 sock by Reaper Eternal, but has not been blocked. — rybec   21:41, 30 July 2013 (UTC)

Another edit by Reginac7 [//en.wikipedia.org/w/index.php?title=User:Reginac7/sandbox&oldid=536781789] has the summary "(Reginac7 moved page User:Reginac7/sandbox to Omar Todd (actor): Finished creating the article in my sandbox.)" — rybec   04:36, 31 July 2013 (UTC)

The article was placed by Anonymity32. On the Simple English Wikipedia, contributed dozens of articles, many of which were about known Morning277 subjects. An article about Gerald Imber was among them. It is very similar to Anonymity32's version. — rybec   09:29, 27 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Comment: I note there may be some collateral damage to these blocks, or maybe a sock slipped by who is claiming innocence.

See this conversation, in which says that his prior account  was blocked in a recent Morning277 sweep. The user's understanding of the block seems to have something to do with being on the same LAN as a sockpuppet, so he went ahead and created a new account, with the next number in sequence. ~Amatulić (talk) 18:52, 31 July 2013 (UTC)
 * He says he "was unaware to the rule":
 * unblock request by Ap2296 [//en.wikipedia.org/w/index.php?title=User_talk:Ap2296&diff=prev&oldid=566446448]
 * second comment by Ap2297 [//en.wikipedia.org/w/index.php?title=Wikipedia:Requests_for_undeletion&diff=prev&oldid=566417579] — rybec   22:01, 31 July 2013 (UTC)

@DGG I can't provide my evidence on-wiki without violating outing right and left, but I can confirm that the group behind morning277 is actively trying to come up with new tactics that have a higher chance of working, and I would definitely favor #1 of your options. Kevin Gorman (talk) 17:54, 8 August 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * As I've said elsewhere (and this one is in the archive), there are some fundamental differences. I've done a great deal of digging on this one, and unquestionably, this is a paid editor, but there are more reasons to think they are independent of Morning277 than to think they are related.  Closing.  Dennis Brown &#124; 2¢ &#124;  WER  17:49, 28 July 2013 (UTC)
 * Unclosing to review a little closer. Dennis Brown &#124; 2¢ &#124;  WER  18:09, 28 July 2013 (UTC)
 * I've been following these, and they are probably different. Very similar, but different. There are several non-exclusive  hypotheses: 1/ That the same group learns what didn't work, & tries different tactics 2,/ that various separate people or groups or paid promotional editors  learn from each other.     3/that the same methods occur quite independently to many people who want to go in for this new industry  4/Many good faith editors  writing about an organization add what looks like promotionalism, both because that's what they see in the RW, or 5/ Worst of all - that there is so much promotional writing already in WP that people think that's what they ought to do here.  DGG ( talk ) 06:13, 7 August 2013 (UTC)


 * Added Rudro911 to the list just now, as having identical sandbox contributions to Reginac7, and blocked both. Clearly those two are socks although unsure of relation to Morning277. ~Amatulić (talk) 22:13, 23 August 2013 (UTC)

With the simplewiki evidence, blocked Anonymity32. --Rschen7754 09:33, 27 August 2013 (UTC)

IPs are stale, so closing. --Rschen7754 01:33, 30 August 2013 (UTC)

05 August 2013 (11)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

stereotypical editing habits; Tim Grayem has two-letter capitalized names for citations

Canon Recruiting Group is about Grayem's company, and was contributed by, named earlier in this SPI. — rybec   03:35, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I don't have any data on Aredmorgan, but the editing matches a standard paid editing throwaway account pattern (which covers a few people, including Morning277). However, Renzoy16 isn't a Morning277 sock (I have a lot of data on Renzoy16), so I'd be wary of connecting Aredmorgan to Morning277 via the Tim Grayem article. My guess would be that both Renzoy16 and Aredmorgan were hired by the same client, explaining the connection between them. - Bilby (talk) 11:39, 6 August 2013 (UTC)
 * I tend to think you're right about Renzoy16, but thought this possible connection to Morning277 was worth mentioning. The account was named by Dennis Brown as (if I recall) "unlikely but possible" and there was a little discussion of it. That's in the archive. — rybec   14:54, 6 August 2013 (UTC)
 * I'm assuming you meant "wary of connecting Renzoy16." I just noticed which implies Renzoy16 made an article about Maximilien de Hoop Cartier, a Sublimeharmony topic. —  rybec   12:51, 31 August 2013 (UTC)
 * The Sublimeharmony version appears to have been created after Renzoy16 wrote the initial article. While it is possible Renzoy16 was subcontracted by Morning277 to post an article, it may be that Renzoy16 was hired independently of Morning277, and possibly that Morning277 was hired after Renzoy16's version was deleted at AFD. - Bilby (talk) 02:27, 1 September 2013 (UTC)
 * Yes, those are possibilities. I'm unable to view Renzoy16's deleted article about Cartier. If I could see it, I would look for similarities to the Morning277 one. Another thing I notice is that the Sublimeharmony draft cites stories that appeared after the original article was deleted (I'm taking the dates at face value). I hope it wasn't inappropriate for me to note that Renzoy16 wrote about those two Morning277-related topics. — rybec   03:52, 1 September 2013 (UTC)

Just to clear this up, I was a paid editor, and I'm horribly embarrassed that I didn't pay enough attention to what I was adding -- no more of that. I thought I'd read up as much as I could, but obviously I hadn't. I meant to come back and continue editing, but life got in the way of that. So, as I understand it, I am not a sock puppet, and I apologize for posting questionable material. - Aredmorgan (talk) 15:03, 29 October 2013 (UTC)
 * It would be helpful if you disclosed who hired you. Thanks. ~Amatulić (talk) 15:25, 29 October 2013 (UTC)

05 August 2013 (12)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

stereotypical editing habits; Dr. David Stewart has three-letter capitalized names for citations — rybec   04:59, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

05 August 2013 (14)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Editing habits of CathrineL are stereotypical of Morning277; Tiger Fitness has two- and three-letter capitalized names for citations. — rybec   05:27, 5 August 2013 (UTC)

Bravinswedy's only contribution was to add mention of a dubious award to the Tiger Fitness article. — rybec   14:02, 5 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' The editing pattern does look similar, I agree. Hope a checkuser can confirm. ~Amatulić (talk) 21:04, 7 August 2013 (UTC)
 * NativeForeigner Talk 23:23, 31 August 2013 (UTC)

05 August 2013 (18)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

WP:QUACK. Morning277 affiliation should be apparent from use of certain sources as detailed at WP:Long-term_abuse/Morning277, or from recreation of a previous Morning277 article. Articles placed:


 * Bulb America
 * Global Fitness
 * IOffice Corp
 * SafeMart
 * Rivalus
 * BillFloat
 * User:Madi125/sandbox about Manhattan Fruitier
 * Pay Per Cloud and User:Pay Per Cloud
 * Viva-Lite and User:Sharminbd/sandbox
 * User:Mtpoonam/sandbox about Fine Designs, Inc.
 * User:Sunnysgreat2008/sandbox about The National Academy of Future Physicians and Medical Scientists (NAFP)
 * L’tecia Tee Ashira
 * User:Yameanoda/sandbox about 1-800-Oncologist
 * User:Nancyus/sandbox about PennyGrab
 * User:Sangoku09/sandbox about Manhattan Fruitier
 * Tom Dyson (author), recreation of Tom Dyson
 * HiringThing
 * Centrify (Tom Kemp (entrepreneur) is CEO)
 * SubmitExpress
 * User:Jvn mht/sandbox about QuoteWizard
 * User:Calvarez24/sandbox, a [//en.wikipedia.org/w/index.php?title=User:Calvarez24/sandbox&oldid=567850582] draft to replace IOffice Corp
 * 3dcart
 * Wikipedia talk:Articles for creation/Emma Watson about Viva-Lite
 * User:Jyrrej/sandbox about Airomo
 * WorkZone (company)
 * Sales OverDrive, Oogwave and Sefaira
 * AskGamblers.com
 * Enigma NMS
 * User:Inspector27/sandbox about One Source Talent
 * Kaleem Shah (businessman) (principal of CALNET)
 * User:DiCR44/sandbox about Stacy Blackman Consulting
 * User:Spankaj9852/sandbox about Gary Guion
 * User:Gabrielle&Charlie/sandbox about Abbas Hashmi, principal of Green Card Capital

— rybec

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

06 August 2013 (2)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Oh man, I hate to even start compiling this post, it's going to take me a while. I'm not disclosing the exact string of things that makes these obvious morning277 socks in case they're watching this page, but if you take a close look at the pages these users have created, it should be pretty obvious. I have no idea how many of these users are likely to have relevant checkuser data, but since some creations are recent, hopefully at least some will. If the reasons why these are all quacking like hell aren't obvious, I can establish them via email so as to not tip the duck off. Kevin Gorman (talk) 05:34, 6 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

In a span of 25 minutes, there were edits from 5 different AT&T DSL hosts, of which 2 have "sndg" in their names, implying they are in San Diego; and one has "Bellsouth" in the name, likely meaning it's in the southeastern United States.

05:28 71.128.201.201 ppp-71-128-201-201.dsl.sndg02.pacbell.net https://en.wikipedia.org/w/index.php?title=Newsfilter.org&diff=prev&oldid=567359716

05:34 99.23.190.12 adsl-99-23-190-12.dsl.pltn13.sbcglobal.net https://en.wikipedia.org/w/index.php?title=Orion_Systems_Integrators&diff=prev&oldid=567360075

05:38 70.230.197.63 adsl-70-230-197-63.dsl.sndg02.sbcglobal.net https://en.wikipedia.org/w/index.php?title=DailyRx&diff=prev&oldid=567360347

05:44 2013 184.33.55.155 adsl-184-33-55-155.mia.bellsouth.net https://en.wikipedia.org/w/index.php?title=GingerBread_Lane&diff=prev&oldid=567360801

05:53 99.30.227.54 adsl-99-30-227-54.dsl.pltn13.sbcglobal.net https://en.wikipedia.org/w/index.php?title=TheOfficialBoard&diff=prev&oldid=567361418

— rybec   13:03, 6 August 2013 (UTC)

At 16:18 on 6 August, which resolves to ppp-71-128-202-228.dsl.sndg02.pacbell.net removed the PROD tag from Tiger Fitness [//en.wikipedia.org/w/index.php?title=Tiger_Fitness&diff=567417023&oldid=567357639] with the comment "Common sense benefit to have this page for safety, options for Wikipedia readership"--another San Diego IP address. — rybec   18:14, 7 August 2013 (UTC)

doesn't look like Morning277 to me, although I do suspect the same contributor may be editing from while logged out. They edit the same two articles. The IP address resolves to wsip-70-167-71-150.tu.ok.cox.net (Tulsa, Oklahoma) and the subject of the articles is in Oklahoma. — rybec   22:21, 9 August 2013 (UTC)

06 August 2013 (4)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

"contested" a PROD of TestCountry and added the sentence "The company admits that its products could be susceptible to drug testing fraud." with that sentence as the edit summary, at 05:58, 6 August
 * resolves to ppp-71-128-202-143.dsl.sndg02.pacbell.net
 * AT&T DSL in San Diego, again — rybec   22:45, 6 August 2013 (UTC)



"contested" a PROD of Pay Per Cloud and removed a paragraph from the article at 06:01, 6 August 2013 with the edit summary "Needs some editing. Corpdepth requirement already met"
 * resolves to adsl-184-33-58-58.mia.bellsouth.net
 * AT&T DSL in Miami — rybec   00:54, 7 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I think this one might be a bit of a stretch - the IP made one edit, adding an unsourced negative claim to an article. Morning277 didn't add criticism, and generally he sourced additions. - Bilby (talk) 23:13, 6 August 2013 (UTC)
 * Deletion tags were removed from other Morning277 articles via several AT&T DSL IP addresses, including at least two addresses in San Diego--"three times is enemy action." Please see my comment of 13:03, 6 August in Kevin Gorman's report. There were two further removals of the G5 tag from GingerBread Lane but my browser got wedged before I got around to reporting them. Others among these IP addresses were used for only a single edit each, for example. The misleading edit summary is typical. —  rybec   00:44, 7 August 2013 (UTC)
 * That's all great, but my concern was in regard to 71.128.202.143, which was the only IP listed here when I commented. There may well be a case against other IPs, but the one edit by 71.128.202.143 isn't sufficient to indicate a pattern, and doesn't match typical Morning277 behaviour. 184.33.58.58 at least removed a prod tag, so I guess there's some chance that there is a connection there. - Bilby (talk) 01:27, 7 August 2013 (UTC)
 * A large number of prod and G5 tags were removed by different IP's from articles probably or definitely created by morning socks last night in the period of an hour or so. Many of these removals involved removing a tag at the same time that they inserted one negative unsourced fact about the article subject, presumably to make them look less quacky.  Take a look at the contribs of some of the IPs in my report above. (The G5'ed articles by confirmed morning socks were later deleted, but followed the same pattern.)  If that many IP's with no connection to morning277 all suddenly came across morning277 orphans with prod/csd tags in the course of an hour and decided to remove them while adding one negative fact, I will eat my shoe. Kevin Gorman (talk) 01:34, 7 August 2013 (UTC)
 * I missed 71.128.202.143's removal of the prod. In this case, I suspect it is also possible that they are connected with the company rather than Morning277, given that the company and the IP are in the same general area, but it may be connected with Morning277. My concern is that we're got at least one signigficant false positive from this process, and I've seen a few claims on questionable evidence which I know to be unrelated, so I think we need to be cautious. - Bilby (talk) 01:37, 7 August 2013 (UTC)
 * I had failed to scroll down, and missed the other additions of unsourced negative material; is one. A block of huge swaths of AT&T DSL addresses isn't going to happen--and if it were to happen, I have little doubt that Morning277 would quickly change over to Verizon. I just thought this burst of activity was a clear indication of IP-hopping that doesn't involve physical travel. The abuse from the Phoenix airport and from Row44 addresses suggested travel as the reason for the changing IP addresses. Who is the false positive you speak of? Some accounts have been mentioned that are obviously not abusers, but I'm not aware that anyone has gotten blocked here without good reason. —  rybec   02:47, 7 August 2013 (UTC)
 * I was thinking of Arifhasan23 as the main false positive. I'm not sure if there were others - there have been a lot of Morning277 blocks, so it is hard to tell. I should probably compare my records against blocked accounts to make sure that we're ok, but luck holding there will be none. - Bilby (talk) 03:33, 7 August 2013 (UTC)
 * I'm guessing you reached that conclusion about Arifhasan23 only because his account was unblocked. The evidence I presented is now deleted, but his request for unblocking may still be read, as may the block log. — rybec   06:03, 7 August 2013 (UTC)
 * No, I reached that conclusion because I have notes about Arifhasan23, and I have previously identified him. While he is a paid editor, he's not Morning277. The problem, in part, is the sorts of behaviour that are being used to identify some accounts are common to other paid editors and SPAs. There aren't a lot of errors, but behavioural evidence isn't always going to provide a clear enough distinction. - Bilby (talk) 06:16, 7 August 2013 (UTC)
 * The checkuser who unblocked him said that he did so on the basis of conversations with him on IRC, saying that he had admitted the improper editor, but didn't realize it was wrong, and has agreed to stop creating new articles, and in fact that account has not edited since. Assuming the checkuser's judgement was correct, I do not consider that a false positive of an non-promotional editor, but a successful stop of promotional editing.  DGG ( talk ) 06:59, 7 August 2013 (UTC)
 * Bilby, Arifhasan23 put an article into main space that closely followed (or was identical to) text that had appeared in User:Sublimeharmony/sandbox11. He said that someone had asked him to post the article. There was no error. — rybec   07:11, 7 August 2013 (UTC)
 * Just to be clear, I have details about Arifhasan23 which make it very unlikely that they are Morning277, but sharing them would involve outing. Arifhasan23 is a paid editor, but my concern is that Arifhasan23 was blocked as a Morning277 sock, not as a promotional account. There are at least four other accounts (not blocked) named as Morning277 who I also know are not him. I think the problem is that the basic pattern being looked for matches a lot of paid editing.
 * Anyway, this is probably not the right place for the discussion. I'll keep an eye out for Morning277 socks, and if my records match anyone named here I'll try and help out as I can. - Bilby (talk) 07:28, 7 August 2013 (UTC)
 * Like I said before, this report is about what looks like not one writer with multiple accounts, but multiple hired writers. The basic pattern with Arifhasan23 was one of copy-pasting identical text that had appeared in Sublimeharmony's sandbox. Details are in my report of 10 July. — rybec   07:39, 7 August 2013 (UTC)
 * Yes, I am aware of that. I am very aware of how Morning277 works. - Bilby (talk) 07:42, 7 August 2013 (UTC)

Morning evolves with time. This IP removed a prod at the same time that at least seven other IP's removed prods from morning's articles, including at least two that repeatedly removed CSD tags from articles created by confirmed blocked morning socks, mostly by removing the prod while adding one negative fact to it. I would be shocked if the IP in question were not a morning sock. It's not the biggest deal since it's just one IP that will likely never be used again, but if an IP removing a prod in a similar pattern at the same time that six other IPs do so isn't a duck quacking as hard as it can, I'm not sure what would be. Kevin Gorman (talk) 22:54, 8 August 2013 (UTC)
 * I agree about the IPs. When I first looked I missed the removal of the prod tag, and only saw the addition of content. Probably because I was brain dead. I also agree that Morning277 changes his model, but the difficulty is that there is a risk that the profile used to identify Morning277 will become too broad and incorporate non-Morning277 sockpuppets/meatpuppets by being based on behaviour that is common to many paid editors and/or SPAs. That said, I stuffed up by missing the removal of the prod in this case, so while it isn't necessarily Morning277, it could well be. - Bilby (talk) 04:16, 11 August 2013 (UTC)

07 August 2013 (4)

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Bunch of minor edits, followed with a dump into a sandbox and a move to mainspace with the rather odd reason "Editing is complete and ready for production environment". An article on the company's CEO, David Gorodyansky, was created by another sock (User:Sanjeevsingh144). Thearighter created Hotspot Shield, an article about software developed by said company via the same method. MER-C 12:04, 7 August 2013 (UTC)

Addition: Jimrichard1024 follows a similar pattern. Small edits to get autoconfirm status, then a move from user sandbox to the article Apartment Bank (which I have deleted under A7 and G11). ~Amatulić (talk) 22:29, 7 August 2013 (UTC)

Another addition: Shamim apee, same pattern. I just deleted Global Fitness under A7 and G11. ~Amatulić (talk) 23:29, 7 August 2013 (UTC)
 * I agree about Jimrichard1024 and Shamim apee. They were already named.


 * Hotspot Shield was edited by Morning277 sock . — rybec   01:03, 8 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

08 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User page [//en.wikipedia.org/w/index.php?title=User:Hafiz.07ku&oldid=567518720] says he is in the Khulna district of Bangladesh. Is drafting an article about [//en.wikipedia.org/w/index.php?title=User:Hafiz.07ku/sandbox&oldid=567600523] a company called Storage Plus in New York City. Draft contains a reference to a story about Bulb America. Bulb America article was reported in 05 August 2013 (18) section. — rybec   08:27, 8 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' I figured I'd try to compile the more recent (last 24ish hours) reports here for you so it's all in one report.
 * Special:Contributions/Educationalpanda0965 shows they are making (marked as) minor edits to John Locke (author) which was also edited by who is blocked as a sock of Morning277.
 * Solely based on the fact they made quite a few minor-ish edits to John Locke (author). Special:Contributions/Cbjackson shows no other contributions
 * Special:Contributions/IrfanSha similar page moves and early creation with quite a knowledge of code.
 * Mark_A_Fischer uses the Morning277 standard citation names - 2-4 letter acronyms.
 * Special:Contributions/Smyahyaijaz minor edits to one or two articles until autoconfirmed then creates an article all at once in his sandbox
 * Was created all at once from precopied code (as can be seen from the visualeditor snafu they ran into)
 * User:Smyahyaijaz/sandbox has refnames that are acronyms
 * 1-800-Therapist was targeted and/or created by other Morning277 socks from before, some in the below endorse by Someguy.
 * Special:Contributions/Smyahyaijaz minor edits to one or two articles until autoconfirmed then creates an article all at once in his sandbox
 * Was created all at once from precopied code (as can be seen from the visualeditor snafu they ran into)
 * User:Smyahyaijaz/sandbox has refnames that are acronyms
 * 1-800-Therapist was targeted and/or created by other Morning277 socks from before, some in the below endorse by Someguy.

If User:Someguy1221 or another clerk could review these new ones and add them if fit that'd be great :) ~ Charmlet -talk- 16:51, 8 August 2013 (UTC)
 * Additional evidence that was in the earlier reports: has a similar name to confirmed Morning277 account . Cbjackson was named by, who said the account needed further checking but he had notes he could e-mail. Mark A. Fischer was created by Morning277—now recreated at Mark A Fischer. —  rybec   17:23, 8 August 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
This one stinks like a Morning277 sock. And while you're at it checkusers, please check the following. I have poured through these for many hours, and convinced myself that they are probably all Morning277 socks. For evidence, refer to User:Someguy1221/SPI ( was a huge help in this). I chose not to transpose all the evidence here as this page is convoluted enough already. In general, these all fit the pattern of creating a spammy article in their sandbox, waiting to become autoconfirmed, and then moving it to mainspace and (typically) abandoning the account. The IPs show up later to make small edits and remove speedy deletion and prod tags with misleading edit summaries. Someguy1221 (talk) 09:38, 8 August 2013 (UTC)
 * I haven't looked over all the socks you've linked, but a number are ones I linked a few sections up. I can say pretty incontrovertibly that every sock in my section is in fact a morning277, so the ones you relinked here definitely are. I feel extra-confident saying that, since I'm pretty sure you used a different search pattern than I did. Kevin Gorman (talk) 17:51, 8 August 2013 (UTC)
 * VirtualCatNZ doesn't seem to fit the pattern, though, with real attempts to communicate with the community in the contribution history. ~Amatulić (talk) 22:00, 8 August 2013 (UTC)
 * Kevin Gorman just withdrew his nomination of . The user page looks uncharacteristic of Morning277. — rybec   01:23, 12 August 2013 (UTC)

08 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Account name is similar to ; please check deleted contributions too. — rybec   10:30, 8 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Deleted contribs are empty, so unfortunately nothing to go on. --Rschen7754 01:35, 30 August 2013 (UTC)

08 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

just noting IP addresses from which was edited:

16:56, 8 August 2013‎ 98.77.186.170 (2,271 bytes) (-64)‎ (Take it to afd. Fischer is notable as a pioneer of intellectual property contracts, including those that Wikipedia uses, and of the biobricks agreement. Read up.) (Tag: speedy deletion template removed) 10:03, 8 August 2013‎ Rybec (2,335 bytes) (+64)‎ (Requesting speedy deletion (CSD G4). (TW) 18:16, 2 August 2013‎ 99.133.162.53 (2,271 bytes) (+5)‎ 17:36, 2 August 2013‎ 71.128.207.107 (2,266 bytes) (+428)‎

adsl-98-77-186-170.mia.bellsouth.net - Miami adsl-99-133-162-53.dsl.pltn13.sbcglobal.net - Pleasanton, California? ppp-71-128-207-107.dsl.sndg02.pacbell.net - San Diego

Edits to other articles from AT&T DSL addresses in those same cities was reported earlier. — rybec   17:59, 8 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

08 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

This single-purpose account contributed Unified interoperability, a subtle advertisement for Pneuron, an apparent Morning277 client. Unified interoperability was later edited by Morning277 writers, 54.251.74.125 and 54.215.108.36. The initial revision [//en.wikipedia.org/w/index.php?title=Unified_interoperability&oldid=546614028] already mentioned Pneuron.

[//en.wikipedia.org/w/index.php?title=Unified_interoperability&oldid=546614028] — rybec   21:58, 8 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

08 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Removed prod from Rivalus, a morning277 article. Added two pieces of minor negative information, one sourced, one unsourced. Geolocs to areas near where morning277 is centered. I'm guessing they get paid depending on how long they manage to keep articles up, not if they are 100% positive contentwise. Last set of morning socks added in one single unsourced negative tidbit and removed a prod, I'm guessing they're now hoping adding one minor sourced negative bit while get people to assume it's not them. Normally wouldn't bother posting this IP, but it looks like it might be staticish, and I'm guessing it might belong either to their offices or to the home of one of their employees, so it might be worth a block. If nothing else, it'd be good to have this ip in the records somewhere. Kevin Gorman (talk) 23:12, 8 August 2013 (UTC) Kevin Gorman (talk) 23:12, 8 August 2013 (UTC)


 * The way I understand the arrangement works, the paid editor gets paid if the page survives for X weeks. The company probably makes money regardless of what happens, likely charging the client a nonrefundable fee up front to create the article and then more billing when the article is shown to have lasting power, and further billing for maintenance edits. They probably pay their contract editors only if the article stays up, shifting the risk to their hired editors. At least, that's the logical way I'd be running the business if it were mine and I wanted to minimize any incentive to stop. ~Amatulić (talk) 00:40, 9 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

A short while ago I made a dump of the still-extant articles in Kevin Gorman's Twinkle logs, and parsed the dump for all IP contributors. These made recent suspicious-looking edits:

adsl-184-33-54-38.mia.bellsouth.net adsl-70-230-206-157.dsl.sndg02.sbcglobal.net ppp-71-128-202-228.dsl.sndg02.pacbell.net adsl-99-151-252-29.dsl.pltn13.sbcglobal.net adsl-99-151-255-121.dsl.pltn13.sbcglobal.net adsl-99-187-236-37.dsl.pltn13.sbcglobal.net no DNS record? adsl-99-30-227-54.dsl.pltn13.sbcglobal.net — rybec   05:04, 9 August 2013 (UTC)
 * speedy deletion template removed
 * speedy deletion template removed
 * PROD removed
 * speedy deletion template removed
 * speedy deletion template removed 3 times, chat with KG
 * tweaks to Tom Dyson (author)
 * contested PROD and added disparaging statements
 * contested PROD and added disparaging statement

09 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

The IP's have all removed CSD or prod tags from morning277 articles in a very morning277ish fashion; many match up with previous ranges.

Of the named accounts, I'm pretty positive about all but Kasad001, and I suspect he's one of their accounts, but an early one. As in earlier section, dont want to give away exact search strat for the named account, but it should be pretty obvious. Kevin Gorman (talk) 06:07, 9 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

09 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

They only edit PointCross, contributed by. IP address resolves to c-76-31-178-123.hsd1.tx.comcast.net. — rybec   19:38, 9 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

09 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

The only contribution of 96.250.187.200 is a defensive rant about Morning277 editors, suggesting the possibility that the IP is one of those editors. The IP address may correspond to some of the accounts named previously. ~Amatulić (talk) 19:59, 9 August 2013 (UTC)



Further comments were made to Vejvančický's talk page by 96.250.189.105, which resolves to pool-96-250-189-105.nycmny.east.verizon.net [//en.wikipedia.org/w/index.php?title=User_talk:Vejvan%C4%8Dick%C3%BD&diff=prev&oldid=567868160] then by 75.15.218.124, registered to AT&T Internet Services [//en.wikipedia.org/w/index.php?title=User_talk:Vejvan%C4%8Dick%C3%BD&diff=567865581&oldid=567861055]. — rybec   00:49, 10 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Verizon in New York City again: it resolves to pool-96-250-187-200.nycmny.east.verizon.net. — rybec   20:30, 9 August 2013 (UTC)

09 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

article in User:Sunnysgreat2008/sandbox about The National Academy of Future Physicians and Medical Scientists (NAFP). Extensive edit before move to main space [//en.wikipedia.org/w/index.php?title=User:Sunnysgreat2008/sandbox&diff=prev&oldid=567847777] by 184.33.53.221, which resolves to adsl-184-33-53-221.mia.bellsouth.net. (thought I already reported the named account, but cannot find it in the SPI) — rybec   20:59, 9 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

09 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Resolves to adsl-99-187-238-239.dsl.pltn13.sbcglobal.net (Pleasanton, California again). Removed sourced material from Banc_De_Binary:. — rybec   21:54, 9 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

10 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

There was a previous SPI, Sockpuppet_investigations/The_Librarian_at_Terminus/Archive, after which this writer was allowed to continue contributing. I notice similarities to Morning277 which I don't want to post here, but which I can e-mail to the administrator investigating this (my e-mail is not working but I can send a one-way message from the Wikipedia Web form). — rybec   04:38, 10 August 2013 (UTC)

Now that I've added to the long-term abuse page a list of Morning277's preferred sources, please note how cites Business2Community.com, California Business Journal, Investment Underground, Vatalyst, and Yahoo Voices twice. — rybec   21:16, 17 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I can say with certainty in this case that The Librarian at Terminus is not a Morning277 sock. The Librarian at Terminus is a paid editor, but not the same paid editor. :) Her socks were previously blocked, and I don't see a problem with WilliamH's request not to block the master. - Bilby (talk) 04:45, 10 August 2013 (UTC)

10 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

was already named. This IP address resolves to adsl-76-254-53-104.dsl.pltn13.sbcglobal.net (Pleasanton again). The only edit was to User:Sangoku09/sandbox [//en.wikipedia.org/w/index.php?title=User:Sangoku09/sandbox&diff=567736751&oldid=567713771]. — rybec   04:55, 10 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

10 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

preparing to replace article on Ethan Bearman; please compare 10 May User:Sublimeharmony/sandbox11 draft and note "Retrieved May 10, 2013" in citations in new draft. — rybec   23:38, 10 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

12 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

recreated. See also.

— rybec   00:13, 12 August 2013 (UTC)
 * User:Sublimeharmony/sandbox11 draft:

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

12 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Sourcing and behavioral similarities. Kevin Gorman (talk) 01:03, 12 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Bhaishattra recreated as  and edited. — rybec   01:33, 12 August 2013 (UTC)

12 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Resolves to adsl-99-187-238-166.dsl.pltn13.sbcglobal.net. Edited User:Saadahmad/sandbox, about RepairClinic.com. — rybec   15:05, 12 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

12 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

extensive changes to

resolves to adsl-70-230-205-47.dsl.sndg02.sbcglobal.net (AT&T in San Diego, yet again) — rybec   16:57, 12 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

12 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

removed section from. Resolves to adsl-70-230-193-18.dsl.sndg02.sbcglobal.net. — rybec   18:11, 12 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

12 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Laurieds does minor edits until autoconfirmed, then makes sandbox article about Hosting.com. It gets touch-ups from AT&T DSL addresses in California while still a sandbox [//en.wikipedia.org/w/index.php?title=User:Laurieds/sandbox&action=history]. IP addresses resolve to:


 * adsl-70-230-196-154.dsl.sndg02.sbcglobal.net (San Diego)
 * adsl-76-246-61-114.dsl.scrm01.sbcglobal.net (Sacramento)
 * adsl-99-17-205-181.dsl.pltn13.sbcglobal.net (Pleasanton) — rybec   20:33, 12 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

12 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

had been editing since 2006, often on New Zealand-related topics, then this February contributed SmartFile (company) which looks like Morning277's work. — rybec   22:35, 12 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

13 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Resolves to ppp-71-128-194-180.dsl.sndg02.pacbell.net (AT&T in San Diego again). Commented about this SPI (and my behaviour) at User_talk:Vejvančický. — rybec   03:12, 13 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

13 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:Cecilia.firstencoding/sandbox is a draft about SweetCouch, was edited by IP editor before move to main space.

IP address resolves to pool-72-89-118-220.nycmny.east.verizon.net (Verizon in New York City again).

User:Sublimeharmony/sandbox11 draft:

Please note that the access date in the citations in Cecilia.firstencoding's draft matches the creation date of the Sublimeharmony draft. — rybec   06:10, 13 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

13 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

working on User:Lmpay1/sandbox, a draft about Resortsandlodges.com

IP address resolves to pool-108-7-144-126.bstnma.east.verizon.net (Verizon in Boston). IP edited out sandbox template.

Another Verizon address in Boston restored Morning277's preferred image to Michael_Johns_(policy_analyst): —  rybec   06:38, 13 August 2013 (UTC)


 * Wikipedia talk:Articles for creation/ResortsandLodges.com, very similar to Lmpay1's draft
 * Wikipedia talk:Articles for creation/ResortsandLodges.com, very similar to Lmpay1's draft

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

13 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

recreating Mile2 in User:Sonia.dutta/sandbox.

DNS name is adsl-68-126-183-90.dsl.pltn13.pacbell.net (Pleasanton again) — rybec   14:43, 13 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

The 116.203 IP address is in Kolkata. — rybec   04:43, 16 August 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
edited her user page once. NativeForeigner Talk 22:58, 14 August 2013 (UTC)

13 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * User:Alucian1/sandbox about Morning277 topic Genius Inside was edited by 99.23.80.172 while still a sandbox; compare to . IP address has no DNS name but is registered to AT&T. — rybec   20:06, 13 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

14 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

All following the typical Morning277 pattern. All blocked, but would love to see what CU turns up. NawlinWiki (talk) 15:19, 14 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

recreated as. Sublimeharmony link:.

recreated as. Sublimeharmony link:.

Shamim apee had been named in an earlier report (still open above).

recreated Sublimeharmony topic as. — rybec   17:34, 14 August 2013 (UTC)

— rybec


 * The article created by User:Merchntm (which, sadly, might have been valid if not created by a sockpuppet), had a mistakenly leftover link to the homepage for Faye Snyder, another Morning277 sock page. NawlinWiki (talk) 19:22, 14 August 2013 (UTC)

recreated as.

recreated as. NawlinWiki (talk) 20:57, 14 August 2013 (UTC)

14 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Ssaadich recreated Sublimeharmony topic Echopass as Echopass (company).

Then along comes Sykestown, whose only edit is to remove the vatalyst.com and dividendkings.com citations from the article.

— rybec   21:03, 14 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

14 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Maximilien Cartier, previously at Maximilien de Hoop Cartier and Max Cartier


 * IP resolves to adsl-98-77-75-159.mia.bellsouth.net (Miami again)


 * Sublimeharmony topic — rybec   23:14, 14 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

14 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * edited out vatalyst citation from User:Imran771/sandbox


 * resolves to adsl-99-151-254-103.dsl.pltn13.sbcglobal.net (Pleasanton again) — rybec   23:52, 14 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

15 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * User:India.deepakjindal/sandbox about new topic AllWomenStalk


 * single-edit IP removes vatalyst.com, voices.yahoo.com, iwatch.cnn.com citations, inserts new citations including one without URL to Examiner dot com cite (has been blacklisted already)


 * note, no initial minor edits by India.deepakjindal—immediately drops article into sandbox


 * note naming of citations: exam754927, crazy923847a9s8fd7 and a123b41n — rybec   00:59, 15 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

15 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

new topic My Home (company)


 * sandbox template deleted prior to move by IP editor


 * IP address registered to Cable and Wireless in Kingston, Jamaica


 * citations to Vatalyst, CNN Ireport twice, Yahoo Voices — rybec   01:34, 15 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

15 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:Twhite113/sandbox about new topic Krinos Foods Canada Ltd


 * sourced from California Business Journal (twice), Business 2 Community, Yahoo Voices, Examiner, Vatalyst — rybec   01:38, 15 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

15 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * draft about old topic in User:Daria425/sandbox


 * cites California Business Journal


 * previous article was created by sock —  rybec   01:50, 15 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 01:41, 30 August 2013 (UTC)

15 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * Samim4fatema's user page says "I AM Md.Shamim Mian from Bangladesh. I Very Simple person. I love reading books."
 * Samim4fatema's talk page says "Thanks for review my topic"
 * User:Samim4fatema/sandbox is about someone from Pittsburgh (Dr. A. Wayne Tamarelli—new subject) and is written in fluent English
 * while article is in sandbox, along comes MarkAndersenphd, an account that made no prior edits, and removes a cabusinessjournal.org citation with "copyediting and spacing cleanup, removing unreliable source." as the edit summary
 * while article is in sandbox, Kishanvkc20 makes white space changes to it —  rybec   02:48, 15 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

16 August 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Starting with minor edits, following a pattern that is fairly easy to spot (I don't want to be too explicit about it since I'm sure the socks monitor this page, but will be happy to provide diffs in email). Created promotional pages in sandbox and on user page. bonadea contributions talk 07:59, 16 August 2013 (UTC)
 * I'm not seeing a Morning277 pattern here. The deleted sandbox was self-promotional, the user page looked like a fan page, and both were unsourced. ~Amatulić (talk) 15:26, 16 August 2013 (UTC)
 * I can't see the deleted contributions, but in what remains, the only thing I notice that smells slightly of Morning277 is edits to a few finance-related articles. I looked at some of the AfD comments and they don't look at all like what Morning277 previously said in AfDs. What were the subjects of the promo pieces—were they previous Morning277 topics, and were they sourced to any of the first four sites under Habitual behavior on the LTA page? While the article was a sandbox, did other editors with new accounts come along and edit it? — rybec   17:06, 16 August 2013 (UTC)
 * It looks more like it belongs with Sockpuppet investigations/Misconceptions2, which may be worth looking at for comparisons with Morning277. --I am One of Many (talk) 17:25, 16 August 2013 (UTC)
 * In Articles for deletion/List of attendance figures at anime conventions (2nd nomination), Mediator ram recommended keeping Misconceptions2's article. — rybec   19:29, 16 August 2013 (UTC)
 * @I am One of Many: I have had personal correspondence with Misconceptions2. He is not related to Morning277 (unless he recently decided to hook up with them, which seems unlikely). It's more likely that Mediator ram is a sock of Misconceptions2 due to the AFD support. By the way I've supported Misconceptions2 in a past AFD myself, but that wouldn't make me a sock. He does know how to write good articles. ~Amatulić (talk) 21:05, 16 August 2013 (UTC)
 * I didn't mean to imply that it has anything to do with how anyone voted in the 2 AFDs. It's rather the pattern of multiple new users behaving in the same way.  I also don't think Micconceptions2 is related to Morning277, but they do use some similar strategies. I am One of Many (talk) 21:15, 16 August 2013 (UTC)

Right, I am probably barking up the wrong tree entirely. I thought it was the Morning277 socks who did this to Wikilinks, but it seems that it isn't. I'm sorry, I really should have taken more time to check my facts first. --bonadea contributions talk 09:23, 17 August 2013 (UTC)



I'm adding this name to the list. I'm worried that this editor is a sock of User:Morning277, as they created an article for something that he attempted to create several times. The article in question was GingerBread Lane (product), which had been repeatedly re-created at GingerBread Lane before it was finally salted. It could be that this is a completely new and uninvolved editor, but I'm a little suspicious of this since Morning277 has a very bad habit of creating all new socks and trying to evade his ban. The editing history is pretty similar to other confirmed sockpuppets such as Annyongad, small minor edits before attempting to re-add a page. Tokyogirl79 (｡◕‿◕｡)   08:59, 16 August 2013 (UTC)
 * That new article, however, doesn't have the polish of the one Morning277 created. It might be new and uninvolved. This seems like a case where a checkuser might shed some light comparing to other confirmed socks. ~Amatulić (talk) 15:26, 16 August 2013 (UTC)
 * The new articles are abbreviated but are based on the earlier versions. Instead of dumping articles fully-formed, they've changed to making stubs at first so it looks more natural. Compare to the earlier article; I think you'll find they contain identical passages and matching access dates on the references. I reported Imran771 already, as well as which edited out one of the telltale sites. The socking should be obvious here. I nominated this for G11 deletion only because G5 wasn't available, since this SPI is so bogged-down. —  rybec   17:06, 16 August 2013 (UTC)
 * OK, thanks. I'm blocking that one as a sock. ~Amatulić (talk) 21:23, 16 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

16 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Pleasanton, California AT&T DSL IP adsl-99-101-143-235.dsl.pltn13.sbcglobal.net and new single-purpose account Financeguy39 both edited out the same section  of Gary Crittenden. — rybec   22:52, 16 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

17 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * noticed by I am One of Many
 * stubby replacement for 1-800-Therapist at 1-800-Therapist (company)
 * unnecessary disambiguation in article title
 * before move to main space, IP editor removed vatalyst.com citation, leaving only ProfitsHunter.com and crunchbase.com
 * adsl-99-33-92-1.dsl.pltn13.sbcglobal.net (Pleasanton yet again) — rybec   06:02, 17 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

17 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * User:Alcedine/sandbox is a draft about Casino.org, which has been advertised before but was not known to be connected to Morning277
 * besides pameladeter's blog, all sources are sites I listed on the LTA page: Dividend Kings,Yahoo! Voices, Vatalyst, and an Andrew Moran piece in Digital Journal
 * IP resolves to adsl-108-198-156-137.dsl.renocs.sbcglobal.net (Reno) — rybec   17:59, 17 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

21 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * new article Repair Clinic (company) about prior Morning277 topic RepairClinic.com (no draft on this topic in Sublimeharmony sandbox)
 * unnecessary disambiguation in article title
 * IPs resolve to pool-108-7-147-32.bstnma.east.verizon.net and adsl-99-187-238-166.dsl.pltn13.sbcglobal.net (Boston and Pleasanton)
 * Pleasanton IP restored article to sandbox after blanking by Saadahmad
 * Boston IP removed Investment Underground citation, changed stereotypical refnames to longer ones (e.g. "TR" became "Morgan Smith article"), and changed access dates on citations (new dates are 10 August, 1 August and 29 July whereas edit was done on 14 August) —  rybec   04:58, 21 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

22 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

New modus operandi discovered by NawlinWiki: two registered accounts participated in the placement of. Only the account which moved the sandbox became autoconfirmed. The giveaway that this is Morning277 is that while the article was a sandbox, someone using an AT&T DSL address in Pleasanton, California removed an entire section from the draft with no explanation. The ostensible creator of the article had nothing to say about the change, as evidenced by the IP editor's talk page and the article's history. The 76.246.55.40 IP address is AT&T DSL in Sacramento, California.

HappyGO^un^luckEE's user page says "Henry is an unemployed bus driver from southern Illnois"; interest in South Asian topics KSRM College of Engineering (India) and Dhaka Medical College and Hospital (Bangladesh) resembles other Morning277 subcontractors.

After moving the article to the main space, the mover left a talk page message saying "Hi Kking2013. I went ahead and moved your sandbox which had an article on IMA World Health. I thought the subject to be notable and have moved it here." — rybec   03:19, 22 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked and IPs are stale. --Rschen7754 01:40, 30 August 2013 (UTC)

22 August 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

New modus operandi discovered by NawlinWiki: two registered accounts participated in the placement of but only the account which moved the sandbox became autoconfirmed. This is similar to the way was published.

Here you can see that the article was pasted into VisualEditor, with two- and three-letter capitalised refnames.

User:Trialanderror450 says "Hi, my name is Stacy and I graduated from University of Colorado." and User talk:Trialanderror450 says "Hi, my name is Stacy and I enjoy working on Wikipedia" but the account's minor edits are mainly to articles related to India.

The subject's work at San Diego State University is also a weak indication: Morning277 edits have been seen from IP addresses in San Diego.

After moving the article to the main space, the mover left a talk page message saying "Hi Naqash.ali00. I took the liberty of moving your sandbox page on Thom Reilly. Thom easily meets the notability guidelines and this page is looking good. Thank you for your contributions! Here is the new page: Thom Reilly". — rybec   03:22, 22 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. --Rschen7754 01:38, 30 August 2013 (UTC)

22 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * vs.
 * adsl-99-139-48-253.dsl.pltn13.sbcglobal.net is another Pleasanton IP

— rybec   11:43, 22 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

23 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

vs.

This article has been rewritten more than most, but similarities are apparent:


 * the ordering of the names of the company's founders is the same (there are 24 ways to order the 4 names)
 * the "External Link" (note the capital "L") section with a link to "Official Company website" (note the capitals)
 * the "See Also" section with a capital "A", linking to Jon Fisher despite his being mentioned in the body
 * "gather, analyze, and interpret" vs. "gathers and analyzes"

The article was edited while still a sandbox by the IP editor from Boston, pool-108-7-149-162.bstnma.east.verizon.net. — rybec   22:26, 23 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

23 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

draft in User:Heartstrings294/sandbox about Sublimeharmony topic Zipwhip


 * edited while a sandbox by adsl-70-230-196-117.dsl.sndg02.sbcglobal.net (San Diego) and another AT&T address — rybec   22:40, 23 August 2013 (UTC)


 * draft was later moved to User:ZipWhip (no account exists) —  rybec   00:56, 30 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

23 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

vs. —  rybec   22:44, 23 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

23 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

vs. —  rybec   23:09, 23 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

24 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

At 20:14 on 13 August, moved TravelShark to Travel Shark. At 23:40 on 13 August I requested speedy deletion of. At 23:58, Bostonbarrister1 posted a message to User talk:Y asking that the speedy deletion tag be removed. — rybec   00:05, 24 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

24 August 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Pasted a copy of Cleeng in their sandbox and tried to convince Y to create it. I am One of Many (talk) 00:22, 24 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I was not trying to convince anybody of anything, I was only looking for advice and I was verbally abused for it by user Y who seems to have a tendency towards this behavior.

--unsigned comment by, 13:37, 25 August 2013


 * Sublimeharmony draft about Cleeng — rybec   16:37, 26 August 2013 (UTC)

24 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

vs.


 * Pleasanton IP adsl-76-254-54-220.dsl.pltn13.sbcglobal.net edited before move to main space — rybec   00:40, 24 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

24 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:Sytten/sandbox about Pneuron vs. —  rybec   00:47, 24 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

24 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

vs. —  rybec   17:53, 24 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

24 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Sublimeharmony draft about Inflection
 * new article by Rama3748 resembles Sublimeharmony draft
 * new article by Wadud.rashadul is about Inflection service and uses short, capitalised refnames
 * User:Jddave1999/sandbox about Inflection resembles Sublimeharmony draft — rybec   18:36, 24 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

24 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * resolves to adsl-98-77-184-252.mia.bellsouth.net (AT&T DSL in Miami)
 * edited User:K.zoya/sandbox, changing short, capitalised refnames to longer, lower-case ones (MAG and HYPE became mag65298lok201 and hype10075)
 * changed access dates from 6 June so they would not match the Sublimeharmony draft — rybec   22:19, 24 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

25 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:Sonjaydewing/sandbox is a draft about Legitmix with similarities to the Sublimeharmony draft


 * "key people" and "products" fields in infoboxes are identical
 * both use the words "monetize" and "platform"
 * "directs them to iTunes" is similar to "directs to iTunes" — rybec   04:16, 25 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

25 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:Data manager123/sandbox vs. Sublimeharmony draft about Legitmix — rybec   04:37, 25 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

27 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

vs.


 * San Diego IP adsl-70-230-194-249.dsl.sndg02.sbcglobal.net expanded refnames and changed access dates after move to man name-space — rybec   01:31, 27 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

27 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * vs. simple:ServiceMax contributed by
 * based in Pleasanton, California — rybec   11:36, 27 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

28 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:Pkharisma/sandbox is about Innoz, of which Deepak Ravindran is one of the principals.
 * capitalised refnames
 * minor edits to miscellaneous articles, then creates article in sandbox
 * further evidence available by e-mail — rybec   21:36, 28 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

30 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

vs.

According to the article, Alex Mehr is a principal of. Morning277 sock contributed  and edited the Zoosk article. Alex Mehr was turned into a redirect to Zoosk after an AfD discussion; M. yamamoto recreated it under a disambiguated title. — rybec   00:22, 30 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

30 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

contributed, about co-founder (with ) of


 * giveaway refnames changed by IP
 * IP resolves to pool-108-7-152-82.bstnma.east.verizon.net (Boston)
 * Sublimeharmony draft about Brendan Wallace
 * Identified (company) was contributed by who has been reported in this SPI but is in good standing —  rybec   01:23, 30 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * User:Brendan Wallace appears to have never edited. - Bilby (talk) 01:12, 1 September 2013 (UTC)
 * I didn't intend to report "Brendan Wallace" as an account. It's corrected. — rybec   04:18, 1 September 2013 (UTC)

30 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

contributed after  was deleted
 * unnecessary disambiguation to avoid restoring article under same title
 * cites publicly-editable CrunchBase which appears 150 times in User:Sublimeharmony/sandbox11
 * two-letter capitalised refnames
 * subject is a small, financial company
 * English fluency on user page differs greatly from article
 * further evidence is available by e-mail — rybec   02:10, 30 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

30 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:Bhasinnitish/sandbox about known Morning277 topic
 * IP editor changed giveaway refnames while draft was still a sandbox
 * cites CrunchBase
 * Pleasanton IP adsl-99-146-99-85.dsl.pltn13.sbcglobal.net
 * HairyWombat's help was requested —  rybec   02:36, 30 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

31 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

vs. and Wikipedia talk:Articles for creation/User:Manikandansivabarathi/sandbox


 * for all three, access dates on citations all say 19 December 2012 — rybec   12:21, 31 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

31 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

about Max Cartier vs. —  rybec   12:43, 31 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I've noticed you make a new SPI every time you spot new ones. Can't you just merge new ones into the first SPI of the day? MM (Report findings)  (Past espionage) 13:29, 31 August 2013 (UTC)
 * On 5 August I made a report about numerous accounts, some of which I added on later dates. It's still open. Kevin Gorman reported numerous accounts on 6 August and that report is also languishing. I think the smaller sections are easier to understand. Charmlet also asked for larger sections. Rschen7754 has been the most active SPI clerk and administrator lately; if he wants these consolidated I'll comply. — rybec   00:23, 1 September 2013 (UTC)

31 August 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

vs. about TableTopics —  rybec   13:20, 31 August 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. Reaper Eternal (talk) 14:54, 31 August 2013 (UTC)

01 September 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * contributed
 * telltale refnames changed by adsl-98-77-186-132.mia.bellsouth.net (Miami again) while draft still in sandbox —  rybec   01:24, 1 September 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

01 September 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * new article about Morning277 topic


 * stereotypical choice of different title with unnecessary disambiguation — rybec   05:09, 1 September 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

02 September 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * User:Kasunkapuwatta/sandbox about Morning277 topic Hannah Bronfman


 * access dates changed from 19 June to various later dates (with no other changes) by Pleasanton IP adsl-99-30-227-253.dsl.pltn13.sbcglobal.net after movement to article space —  rybec   01:41, 2 September 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

02 September 2013

 * Suspected sockpuppets






 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * about Morning277 topic
 * unnecessary disambiguation in title
 * San Diego IP ppp-71-128-195-103.dsl.sndg02.pacbell.net changed telltale refnames during sandbox phase


 * short, upper-case refnames — rybec   02:10, 2 September 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

02 September 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * User:Lukabri/sandbox3 about Morning277 topic ReviverSoft
 * short, upper-case refnames — rybec   03:35, 2 September 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

02 September 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * contributed about Morning277 topic Jason Kanner
 * unnecessary disambiguation in title
 * short, upper case refnames — rybec   04:57, 2 September 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

02 September 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

This user's contribution follows a classic Morning277-sockpuppet pattern: create account, edit a few pages, wait for the account to become autoconfirmed, create several pages about non-notable individuals and companies, and then abandon account after getting paid by same. I have already nominated several of these other pages for deletion, and I do not expect this individual will contest any of them. KDS 4444 Talk   17:53, 2 September 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''