Wikipedia:Sockpuppet investigations/Morning277/Archive/2

Note: This page was recently mentioned on Boing Boing, the Daily Dot, and the Wikipedia Signpost. --Guy Macon (talk) 14:36, 10 October 2013 (UTC) ...And Vice —Justin ( koavf ) ❤T☮C☺M☯ 18:39, 19 October 2013 (UTC)

14 August 2012

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

User:SimonKnowsAll indicated previous block(s) blamed on "idiots at my school". His contribs are 12 WP:AfD !votes, then 3 promotional articles on 7, 9 and 10 Aug. CyberSafe was created by SimonKnowsAll on 10 Aug and quickly AfD. Only significant contribs by User:Bioengineer+attorney and User:Unhmba  are "Keep" !votes in that AfD. User:Engineer+Attorney inadvertently created by User:Bioengineer%2Battorney?; it hasn't been used. Looks like ip:108.18.223.201 was failure to log back into a user account. User:Limemine was inactive for almost two years, then first activity was a "Keep" !vote on the AfD and then 4 WP:AfD !votes; User:SimonKnowsAll userpage says his favorite activity is WP:AfD editing. Doctree (talk) 14:04, 13 August 2012 (UTC)
 * User:MalcomMarcomb11376 should be added to probables. User page is similar to User:SimonKnowsAll.  It was created in the same timeframe as User:Bioengineer+attorney and User:Unhmba. He voted a Keep in the CyberSafe AfD.  Sorry about not checking his contribs until now but activity is similar, mostly AfD votes. DocTree (talk) 01:06, 16 August 2012 (UTC)
 * User:Wenkai31 shows same pattern of activity with long inactive period, then created a series of promotional articles in March. The confirmed master named below is trying to influence a Keep in an [|AfD] bu this editor. DocTree (ʞlɐʇ) (cont) Join WER 15:29, 20 August 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Quite a warm welcome to a new Wikipedian! How about these facts. I am an atty. I am a BSE in engineering. How about you? In a court this is called a preponderance of the evidence in favor of defendant. All I've learned is that (1) new users are unwelcome, and (2) the protocol is to attack if someone disagrees. Noted. I don't want to wear out the welcome mat!Bioengineer+attorney (talk) 02:51, 14 August 2012 (UTC)
 * Odd, I worked in the field, and in a civil case the burden of demonstrating a preponderance is upon the plaintiff, whereas in a criminal case (the proper analogy) the threshold is entirely different. Very odd choice of phrasing, coming from a lawyer.   Dennis Brown -  2&cent;    &copy;   Join WER 11:40, 14 August 2012 (UTC)


 * Is it possible to check for some more +attorney accounts? I feel like I saw one the other day but can't find it now. Ryan Vesey 04:36, 15 August 2012 (UTC)
 * I have checked just about everything and were just waiting to post the final socklist once the evidence is agreed apon. I haven't seen any other +attorney accounts anywhere while running the checks. -- DQ  (ʞlɐʇ)  14:28, 15 August 2012 (UTC)


 * Please check User:BankingJunkie123 as well, due to overlapping edits with User: Limemine. Logical Cowboy (talk) 14:02, 16 August 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
The following are ✅ with : Note that Engineer+Attorney does not actually exist as an account: Bioengineer+attorney just created a page in the user space. Based on the large attempt to slant consensus and spread scrutiny, and the considerable amount of PR guff, I don't think it's unreasonable to speculate that we have have a paid COI editor here. WilliamH (talk) 14:02, 14 August 2012 (UTC)
 * - - Looks pretty ducky, complete with sleepers, enough to easily justify a CU, with a search for more sleepers please. Dennis Brown -  2&cent;    &copy;   Join WER 01:01, 14 August 2012 (UTC)
 * Note, the oldest account is actually User:Limemine, but will wait for CU before a decision to rename case. Dennis Brown -  2&cent;    &copy;   Join WER 01:08, 14 August 2012 (UTC)
 * Marking this as, as there's more checking to be done. WilliamH (talk) 14:17, 14 August 2012 (UTC)
 * Found a couple more accounts:


 * In terms of an established member of the community as opposed to the oldest account, the CheckUser-✅ master is unambiguously, who I am told has been soliciting work via freelancing websites, such as Elance.com. Another batch of accounts is to follow. WilliamH (talk) 15:00, 14 August 2012 (UTC)
 * In terms of an established member of the community as opposed to the oldest account, the CheckUser-✅ master is unambiguously, who I am told has been soliciting work via freelancing websites, such as Elance.com. Another batch of accounts is to follow. WilliamH (talk) 15:00, 14 August 2012 (UTC)
 * In terms of an established member of the community as opposed to the oldest account, the CheckUser-✅ master is unambiguously, who I am told has been soliciting work via freelancing websites, such as Elance.com. Another batch of accounts is to follow. WilliamH (talk) 15:00, 14 August 2012 (UTC)


 * WilliamH has asked me to take a second look and I have already found a few more accounts, I'll be continuing this for a good while but may have to step out, so it could take a bit. -- DQ  (ʞlɐʇ)  15:43, 14 August 2012 (UTC)
 * -- DQ  (ʞlɐʇ)  19:55, 14 August 2012 (UTC)
 * Thanks DQ. One more ✅ account: . WilliamH (talk) 20:08, 14 August 2012 (UTC)
 * I've removed Engineer+Attorney since that was not an actual user. Dennis Brown -  2&cent;    &copy;   Join WER 14:30, 15 August 2012 (UTC)


 * Ok, so i've finished talking to a few other functionaries on this, though please take what I say with a grain of salt and note that CU is not always conclusive, and doesn't tell the whole story.
 * & are ✅
 * stared editing two hours before Glassoftamarindo, and is ✅, but the IP /could/ be a webhost, making the connection less than clear.
 * Furthermore, , , and are ✅ to William's group above.
 * Since there is a lot of webhost/paid proxy abuse, behavior should be your number one factor in determining socks in this investigation.


 * I have blocked several ranges related to this case, all proxy/webhost related. -- DQ  (ʞlɐʇ)  01:10, 20 August 2012 (UTC)
 * I am currently filtering through this rather large list of names to determine the proper action for each. I've already moved the master to the recommended master per WilliamH. Dennis Brown -  2&cent;    &copy;   Join WER 15:21, 20 August 2012 (UTC)
 * Add possible
 * Add possible
 * Note: keeps coming up as a common link in my searching. Dennis Brown -  2&cent;    &copy;   Join WER 15:58, 20 August 2012 (UTC)
 * I have to step out for a few hours, but I am checking. -- DQ  (ʞlɐʇ)  17:55, 20 August 2012 (UTC)
 * CU isn't conclusive, because of webhost/proxy use, but Yasir.Ab2 is using similar proxies as before. Both Useragents do match. Steve.sc90 and DrewWhoAZ are on the same webhost with exact same useragents. An-Apple-A-NY-Day has also been seen on this range, different Useragent though. -- DQ  (ʞlɐʇ)  03:55, 21 August 2012 (UTC)
 * Guackid121is not blocked yet and the nature of their edits raises questions, so I would suggest monitoring. The two sleepers without edits are blocked as suspected socks. The rest have been linked behaviorally, in addition to CU, which is why this took so long to prepare.  There is still a strong cross over with User:An-Apple-A-NY-Day, and perhaps I will put a note in that archive pointing here.  The IP is linked as well, but seems to be a cellphone IP, so blocking would be useless, thus not done.  Due to the extreme nature of socking, I have chosen to indef block the sock master, User:Morning277.  I will leave a review up to another admin if the editor requests one, and defer to their wisdom.  All blocked editors are tagged and have block notices. Dennis Brown -  2&cent;    &copy;   Join WER 15:30, 21 August 2012 (UTC)
 * Add who ties into Prezmittens sandbox, now deleted and now blocked.  More to come....  Dennis Brown -  2&cent;    &copy;   Join WER 00:32, 22 August 2012 (UTC)

Dennis Brown - 2&cent;    &copy;   Join WER 15:58, 22 August 2012 (UTC)
 * Adding 5 6 more, need a CU for these plus the one I duck blocked, Vohn.Ludwig. Can provide email to CU with linkage if needed, but a little searching will provide it.  Pretty sure these will turn up some new ones as well.
 * ✅ the following are the same and connects the dots to a previously used webhost provider by the users in previous results:


 * There are 4 other accounts on this range (two appear to be related, but not abusing multiple accounts) appearing not related to anyone. The accounts I have not mentioned will be under a hardblock, so they will have to find a new range, and I'll be keeping an eye on them.
 * ✅ the following are the same, but not using a webhost, and not showing technical relation to any other users:
 * is, a suspected direct behavioral relation
 * is, a suspected direct behavioral relation
 * is, a suspected direct behavioral relation


 * is to call anything on this.
 * Jetijonez not checked yet per DennisBrown's request. -- DQ  (ʞlɐʇ)  20:44, 22 August 2012 (UTC)
 * I'm still compiling data from several sources, please leave open a couple more days so we can see what else we can shake from the tree. Dennis Brown - 2&cent;    &copy;   Join WER 22:05, 22 August 2012 (UTC)

22 August 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Chiliconwiki is a newly created account that is following the same pattern of adding content related to Shazi Visram, which is a recreation of material found on User:PrezMittens/sandbox/HFF, an already blocked sockpuppet account. MikeWazowski (talk) 23:34, 22 August 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Well that's not pretty. ✅ the same are:

Sleepers:

The account that spawned this has significant overlap, taking Mike's findings into account I would also call it confirmed.

I also reverted Cogent Fibre just now. The latest edits are related, but the previous editors seems unrelated -- although he may also be a paid editor, I find it suspicious that they both worked on it at more or less the same time, and Baby on the Move is also very suspicious (apparent owners of the company edited it a few days after creation). This warrants a follow-up and probably cleanup effort, but I don't know where. Amalthea 10:50, 24 August 2012 (UTC)


 * I've blocked this latest group, including Guackid121, who I hand't previous but the double-linking with the others makes it quite plausible that what we have here is not one person with lots of socks, but a small nest of COI, a company that is socking for profit, so a combination of meatpuppetry/sockpuppetry. I don't advertise for them, but I will be happy to email any CU their web address.  For our purposes, they are acting as one, so they will be treated as one.  Unfortunately, I have some more names that I'm working on, so we are STILL not done.  Dennis Brown -  2&cent;    &copy;   Join WER 11:09, 24 August 2012 (UTC)
 * If you have figured out official contact information for them you can try sending it to Jimbo with a pointer to this AfD -- he started it after all, maybe he is interested in following up on it. If anyone can create some pressure there it's him. Amalthea  13:11, 24 August 2012 (UTC)
 * I'm not sure what that would accomplish, however, as they make a living socking on Wikipedia and I'm not sure what Jimmy can do to persuade them otherwise. Dennis Brown -  2&cent;    &copy;   Join WER 16:04, 24 August 2012 (UTC)
 * As an update, I'm still working on this. It looks like it may be more than one person, doing very similar work, and I'm trying to separate them, which isn't a minor task.  Dennis Brown -  2&cent;    &copy;   Join WER 14:22, 27 August 2012 (UTC)
 * There is a great deal of sorting to be done, and very likely, this is more than one person, so a combination of meat and sock puppeting, working as a group, but the use of proxies and webhosts are muddying up the waters. Closing for now, may have to clean up in the archives later. Dennis Brown -  2&cent;    &copy;   Join WER 11:24, 1 September 2012 (UTC)

17 September 2012

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

Brand new editor posts polished article that was previously worked on by recently blocked sockmaster. See also User:Morning277/sandbox/BUSA. Logical Cowboy (talk) 19:57, 17 September 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I'm a little late to this party, but I've got another suspicious account.

New editor inserting a logo uploaded by Morning277 which was otherwise only used in the sockmaster's sandbox: User:Morning277/sandbox/MM, which DownRightMighty also used as a base for their own (now deleted) sandbox build of the article. They are also involved in what certainly appears at first glance to be significant whitewashing of Mercy Ministries. VernoWhitney (talk) 22:29, 12 October 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Örks. Who knows. Yet another range, this time from another country entirely, no obvious proxying. In addition to yours, I actually have more accounts that are suspicious and could be Morning277. In total:


 * Group 1
 * I'm quite certain with that one. Amalthea  19:33, 19 September 2012 (UTC)


 * Group 2


 * Group 3


 * Group 4


 * Group 5
 * I'm quite certain with that one. Amalthea  19:33, 19 September 2012 (UTC)

The accounts in the groups are very likely controlled by the same person, respectively. There is some indication that they are all the same. But the IPs are from all over the place, some are obvious hosting companies whose ranges are blocked by now but of course disguise all direct connections, so I have no chance of making a direct connection.

We can't stop him from editing (unless possibly someone finds out who is behind this/where the editing jobs are sold and we get Jimbo to pressure them to make it stop through official channels). While this is going on, two options I see: Amalthea 21:05, 17 September 2012 (UTC)
 * 1) We take the articles and do our best to minimize damage: Aggressively remove POV (which still leaves us in danger to have an extremely unbalanced article), AfD if page doesn't appear to pass notability guidelines.
 * 2) Try to disincentivize his editing by aggressively G5ing his pages, and possibly recreating them as stubs.
 * Comment: HappyTwoBEE is an SPA pushing Bianca Jade, who appeared after the previous version of that article was deleted with fairly scathing comments at WP:Articles for deletion/Bianca Jade (2nd nomination). That previous version was the work of two other SPAs, and . It would be worth checking them for relationship with this cluster. JohnCD (talk) 16:51, 19 September 2012 (UTC)


 * All blocked. I've tagged them all as discrete groups rather than all as Morning277 socks, except for the accounts which Amalthea noted as most probably being operated by M277. Archiving, AGK  [•] 19:07, 13 October 2012 (UTC)

17 October 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

TouchdownJimmy is a new editor who has continued Morning277's work at Kevan Barlow and started another new fairly promotional bio along the same lines as Morning277's other work.

DownRightMighty is another new editor inserting a logo uploaded by Morning277 which was otherwise only used in the sockmaster's sandbox: User:Morning277/sandbox/MM, which DownRightMighty also used as a base for their own (now deleted) sandbox build of the article. They are also involved in what certainly appears at first glance to be significant whitewashing of Mercy Ministries. This one is rather less quackish than the other sock, but still concerning. VernoWhitney (talk) 20:20, 17 October 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Same sockfarm. Blocked named users and a couple of proxies Elen of the Roads (talk) 23:34, 20 October 2012 (UTC)
 * Note: Elen expanded on this explanation here. ~Amatulić (talk) 21:59, 23 October 2012 (UTC)

22 December 2012

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

This is a sock of Morning277, who was blocked for massive sockpuppetry--had about 50 socks. This sock created an article, One Hour Translation that was commissioned to Morning277 on a paid external website. I have links to establish all of this--please contact me and I will email. Logical Cowboy (talk) 01:54, 22 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' Logical Cowboy previously emailed me the links, and I think they prove without a doubt that this is another sock, and so checkuser is only needed to identify any other socks there may be. I would recommend against publicly sharing the information for various reasons. VernoWhitney (talk) 04:05, 22 December 2012 (UTC)
 * Just to follow this up, I'd also agree that there is strong evidence connecting Morning277 to PlainProofBrief - but it might constitute outing to reveal it on-wiki. There is also good evidence to suggest User:RaisedRotten may be connected, but I assume that Logical Cowboy would be on top of that. - Bilby (talk) 11:22, 22 December 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
It would be better if you posted those links on this case. However, you may email them to me if you wish. --(ʞɿɐʇ) ɐuɐʞsǝp 03:39, 22 December 2012 (UTC)
 * - Endorsing for CU. Going on VernoWhitney's comment that there is socking at play here, I'm endorsing for confirmation, as well as a sleeper check for a prolific sockpuppetter. ( X!  ·  talk )  · @506  · 11:07, 22 December 2012 (UTC)
 * I have blocked and deleted a number of accounts, and deleted and some contributions which I am absolutely convinced of and have good reason to believe that they are of a banned editor. Bilby, I would welcome the e-mail from you. WilliamH (talk) 12:13, 22 December 2012 (UTC)
 * From a purely technical point of view, I would say it is bordering on  that the two listed accounts above are related. WilliamH, since you have also run a check, would you concur with this assessment? --(ʞɿɐʇ)  ɐuɐʞsǝp 17:32, 22 December 2012 (UTC)
 * WilliamH has "commented" by blocking the account, so I think we can consider this matter resolved. --(ʞɿɐʇ) ɐuɐʞsǝp 01:35, 23 December 2012 (UTC)

10 July 2013

 * Suspected sockpuppets






 * User compare report Auto-generated every hour.
 * Editor interaction utility

I happened upon User:Sublimeharmony/sandbox11 and noticed a pattern: Sublimeharmony would put a draft of an article into that sandbox, then blank the page, then put another article into the same sandbox. These same articles would later appear in main space, but they weren't being created there by Sublimeharmony. Instead, each article was being put into the main space from a unique account, from which only a few minor edits had been done (enough to become autoconfirmed, and maybe a few more). I looked at some of the talk pages of the accounts involved, but didn't see any discussion about their work on these articles. I don't know that these accounts are all under common control; if they are not, they are at least editing in a way that obscures their collaboration. From the nature of the articles, I surmise that this is paid editing, which is allowed. The attempt to obscure authorship seems unnecessary.

Kaysweet On June 24 at 21:04, Sublimeharmony puts an article about MarketLive into User:Sublimeharmony/sandbox11: [//en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=561416612]. The page is blanked by Sublimeharmony a few seconds later, also with a timestamp of June 24 at 21:04: [//en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=561416670]. On June 26 the article is created [//en.wikipedia.org/w/index.php?title=MarketLive&oldid=561599440] in the main space as the [//en.wikipedia.org/wiki/Special:Contributions/Khaysweet] first edit by Khaysweet. I compared the article as it appeared in Sublimeharmony's user space with the way it looked when Khaysweet put it in main space. The only difference is the sandbox template and the addition of a space.

Brfiandt On June 17th at 19:28, Sublimeharmony replaces [//en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&diff=prev&oldid=560339483] the contents of User:Sublimeharmony/sandbox11 with an article about Tom Kemp. A few minutes later, at 19:42, Sublimeharmony blanks the page[//en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&diff=prev&oldid=560341256]. On June 24th, Brfiandt creates [//en.wikipedia.org/w/index.php?title=Tom_Kemp_%28entrepreneur%29&oldid=561401248] an article in main space about Tom Kemp, with basically the same text that had appeared in User:Sublimeharmony/sandbox11. It was Brfiandt's 12th edit [//en.wikipedia.org/wiki/Special:Contributions/Brfiandt].

Rocksdocksz On June 17th at 16:40, Sublimeharmony puts an article [//en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=560324118] about 4Cabling into User:Sublimeharmony/sandbox11. The draft gets a few edits and remains there until 19:28 on 17 June when it is replaced by the article about Tom Kemp mentioned above. At 18:50 on 20 June [//en.wikipedia.org/w/index.php?title=4Cabling&oldid=560787440], Rocksdocksz creates an article in main space about 4Cabling, containing text the same as, or very similar to, what had appeared in User:Sublimeharmony/sandbox11. It is the 13th edit by Rocksdocksz [//en.wikipedia.org/wiki/Special:Contributions/Rocksdocksz|].

For the remaining accounts I'm providing:
 * 1) a revision of User:Sublimeharmony/sandbox11
 * 2) a revision of an article in main space, in most cases the first revision, in which text is added that closely resembles the text which was in User:Sublimeharmony/sandbox11
 * 3) contributions of the account that did the main-space edit, in most cases showing only a few edits before or after and no other articles "created"

Crocyyks
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=560316718
 * https://en.wikipedia.org/w/index.php?title=Emmanuel_Gregory_Lemelson&oldid=560982400
 * https://en.wikipedia.org/wiki/Special:Contributions/Crocyyks

LAHealthVol
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sndbox11&oldid=559737073
 * https://en.wikipedia.org/w/index.php?title=Hand_and_Wrist_Institute&oldid=560663397
 * https://en.wikipedia.org/wiki/Special:Contributions/LAHealthVol

Videditor
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=559732615
 * https://en.wikipedia.org/w/index.php?title=Virool&oldid=560664511
 * https://en.wikipedia.org/wiki/Special:Contributions/Videditor

BankofRyan1
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=559716794
 * https://en.wikipedia.org/w/index.php?title=Waterfield_Group&oldid=560814774
 * https://en.wikipedia.org/wiki/Special:Contributions/BankofRyan1

567rems
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=559585311
 * https://en.wikipedia.org/w/index.php?title=Sweetcouch&oldid=560794440
 * https://en.wikipedia.org/wiki/Special:Contributions/567rems

HenryW795
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=558759577
 * https://en.wikipedia.org/w/index.php?title=Legitmix&oldid=560310888
 * https://en.wikipedia.org/wiki/Special:Contributions/HenryW795

Deaunagibbs
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=558677621
 * https://en.wikipedia.org/w/index.php?title=NewYorkStay&oldid=559551810
 * https://en.wikipedia.org/wiki/Special:Contributions/Deaunagibbs

Tahshimu
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=558453628
 * https://en.wikipedia.org/w/index.php?title=Oren_Laurent&oldid=559426443
 * https://en.wikipedia.org/wiki/Special:Contributions/Tahshimu

Qeskridge7
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=558329480
 * https://en.wikipedia.org/w/index.php?title=Misty_Lown&oldid=559514916
 * https://en.wikipedia.org/wiki/Special:Contributions/Qeskridge7

Idreesakhtar
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=558311013
 * https://en.wikipedia.org/w/index.php?title=Genius_Inside&oldid=559391852
 * https://en.wikipedia.org/wiki/Special:Contributions/Idreesakhtar

Leonieabilay
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=558292990
 * https://en.wikipedia.org/w/index.php?title=Brosix_%28Company%29&oldid=559670318
 * https://en.wikipedia.org/wiki/Special:Contributions/Leonieabilay

Bokyqwer
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=557968014
 * https://en.wikipedia.org/w/index.php?title=ModelManagement.com&oldid=558406168
 * https://en.wikipedia.org/wiki/Special:Contributions/Bokyqwer

Jhaneez_B
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=557888137
 * https://en.wikipedia.org/w/index.php?title=Shimao_Property&oldid=558319084 (replaced a stub article)
 * https://en.wikipedia.org/wiki/Special:Contributions/Jhaneez_B

25cassandra
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=557261491
 * https://en.wikipedia.org/w/index.php?title=Global_Met_Coal_Corporation&oldid=557678047
 * https://en.wikipedia.org/wiki/Special:Contributions/25cassandra

Poem07
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=557253341
 * https://en.wikipedia.org/w/index.php?title=PressPad&oldid=557321003
 * https://en.wikipedia.org/wiki/Special:Contributions/Poem07

Umeedalam
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=557244965
 * https://en.wikipedia.org/w/index.php?title=Dominique_Molina&oldid=557325290
 * https://en.wikipedia.org/wiki/Special:Contributions/Umeedalam

A1Abigail


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=556195910
 * https://en.wikipedia.org/w/index.php?title=FindTheBest&oldid=556514555 (replaced earlier article)
 * https://en.wikipedia.org/wiki/Special:Contributions/A1Abigail

John mikol
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=556189750
 * https://en.wikipedia.org/w/index.php?title=Steven_M._Neil&oldid=556696348
 * https://en.wikipedia.org/wiki/Special:Contributions/John_mikol

Lchabana
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=556182850
 * https://en.wikipedia.org/w/index.php?title=Brendan_Wallace&oldid=556561553
 * https://en.wikipedia.org/wiki/Special:Contributions/Lchabana

Dorothygaylevalencia
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=556119063
 * https://en.wikipedia.org/w/index.php?title=ClassDojo&oldid=556385501
 * https://en.wikipedia.org/wiki/Special:Contributions/Dorothygaylevalencia

Echis1985
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=556033038
 * https://en.wikipedia.org/w/index.php?title=MediCortex&oldid=556618728
 * https://en.wikipedia.org/wiki/Special:Contributions/Echis1985

Fiddlenuggs
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=556028449
 * https://en.wikipedia.org/w/index.php?title=Loyaltyworks_(company)&oldid=557416775
 * https://en.wikipedia.org/wiki/Special:Contributions/Fiddlenuggs

Sharmin rasid
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=555222030
 * https://en.wikipedia.org/w/index.php?title=John_Uustal&oldid=556155137
 * https://en.wikipedia.org/wiki/Special:Contributions/Sharmin_rasid

Namfields
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=554743037
 * https://en.wikipedia.org/w/index.php?title=Muzak_Holdings&oldid=556527411 (major changes to existing article)
 * https://en.wikipedia.org/wiki/Special:Contributions/Namfields

Floresstanton39
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=554438611
 * https://en.wikipedia.org/w/index.php?title=Ethan_Bearman&oldid=554782283
 * https://en.wikipedia.org/wiki/Special:Contributions/Floresstanton39

SDeneault
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=554198017
 * https://en.wikipedia.org/w/index.php?title=Tom_Hoban_(entrepreneur)&oldid=555138151
 * https://en.wikipedia.org/wiki/Special:Contributions/SDeneault

Cheerypenelope
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=554160759
 * https://en.wikipedia.org/w/index.php?title=DDC_Advocacy&oldid=555429394
 * https://en.wikipedia.org/wiki/Special:Contributions/Cheerypenelope

Finstab0by
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=553769061
 * https://en.wikipedia.org/w/index.php?title=Inigral&oldid=554081982
 * https://en.wikipedia.org/wiki/Special:Contributions/Finstab0by

Mamun070
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=553490755
 * https://en.wikipedia.org/w/index.php?title=Tom_Dyson&oldid=554405178
 * https://en.wikipedia.org/wiki/Special:Contributions/Mamun070

Happitasnor
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=553358786
 * https://en.wikipedia.org/w/index.php?title=David_Schwedel_(entrepreneur)&oldid=554681077
 * https://en.wikipedia.org/wiki/Special:Contributions/Happitasnor

Lennyjones32
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=553350534
 * https://en.wikipedia.org/w/index.php?title=Security_Innovation&oldid=554083552
 * https://en.wikipedia.org/wiki/Special:Contributions/Lennyjones32

Db_jackal
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=553188882
 * https://en.wikipedia.org/w/index.php?title=Inflection_(company)&oldid=553811367
 * https://en.wikipedia.org/wiki/Special:Contributions/Db_jackal

Jellupoddn
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=553188775
 * https://en.wikipedia.org/w/index.php?title=PeopleSmart&oldid=553807756
 * https://en.wikipedia.org/wiki/Special:Contributions/Jellupoddn

Freakjojo06
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=552875527
 * https://en.wikipedia.org/w/index.php?title=PCN_Technology_(company)&oldid=553151972
 * https://en.wikipedia.org/wiki/Special:Contributions/Freakjojo06

Jlbrownaz
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=552799496
 * https://en.wikipedia.org/w/index.php?title=Aasted&oldid=553150309
 * https://en.wikipedia.org/wiki/Special:Contributions/Jlbrownaz

Nooninupto
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=552792682
 * https://en.wikipedia.org/w/index.php?title=ResumeBear&oldid=553907721
 * https://en.wikipedia.org/wiki/Special:Contributions/Nooninupto

Bonnie2512
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=552279983
 * https://en.wikipedia.org/w/index.php?title=Go_Try_It_On&oldid=552430871
 * https://en.wikipedia.org/wiki/Special:Contributions/Bonnie2512

Sunlit1
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=552185339
 * https://en.wikipedia.org/w/index.php?title=Tee_Ashira&oldid=552342229
 * https://en.wikipedia.org/wiki/Special:Contributions/Sunlit1 (did 21 edits before "creating" the article)

Johnatos7
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=552154078
 * https://en.wikipedia.org/w/index.php?title=Echopass&oldid=552488094
 * https://en.wikipedia.org/wiki/Special:Contributions/Johnatos7

Supermansmrs
 * https://en.wikipedia.org/wiki/Special:Contributions/Supermansmrs
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=551871634
 * https://en.wikipedia.org/w/index.php?title=David_Kiger&oldid=552346677
 * https://en.wikipedia.org/wiki/Special:Contributions/Supermansmrs

Jennifermelburn
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=551802168
 * https://en.wikipedia.org/w/index.php?title=CrowdOptic&oldid=552035095
 * https://en.wikipedia.org/wiki/Special:Contributions/Jennifermelburn

Yhtak2013
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=551197790
 * https://en.wikipedia.org/w/index.php?title=GatherSpace_(company)&oldid=551680900
 * https://en.wikipedia.org/w/index.php?title=Special:Contributions/Yhtak2013&offset=&limit=500&target=Yhtak2013

Agnesatelance
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=551149656
 * https://en.wikipedia.org/w/index.php?title=The_American_University_of_Iraq_%E2%80%93_Sulaimani&diff=552100489&oldid=551335982 (extensive changes to existing article)
 * https://en.wikipedia.org/wiki/Special:Contributions/Agnesatelance


 * Below are additions made on 11 July.

Clestcruz
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=541901096
 * https://en.wikipedia.org/w/index.php?title=Digital_Prospectors_Corporation&oldid=542014680
 * https://en.wikipedia.org/wiki/Special:Contributions/Clestcruz

Plasmapeleng
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=prev&oldid=542071746
 * https://en.wikipedia.org/w/index.php?title=Review_Boost_%28company%29&oldid=543522436
 * https://en.wikipedia.org/wiki/Special:Contributions/Plasmapeleng

L.E.Evans
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=prev&oldid=542425193
 * https://en.wikipedia.org/w/index.php?title=Zipwhip&oldid=543470381
 * https://en.wikipedia.org/wiki/Special:Contributions/L.E.Evans

Alexalt42
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=542425193
 * https://en.wikipedia.org/w/index.php?title=ONEHOPE&oldid=552332366
 * https://en.wikipedia.org/wiki/Special:Contributions/Alexalt42

Gulnaz_N
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=542474880
 * https://en.wikipedia.org/w/index.php?title=Neal_Creighton,_Sr&oldid=546278647
 * https://en.wikipedia.org/wiki/Special:Contributions/Gulnaz_N

Emwrei
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=542589064
 * https://en.wikipedia.org/w/index.php?title=Network_Capital&oldid=543948302
 * https://en.wikipedia.org/wiki/Special:Contributions/Emwrei

Pedroswish
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=563601112
 * https://en.wikipedia.org/w/index.php?title=Bizible&oldid=563706424
 * https://en.wikipedia.org/wiki/Special:Contributions/Pedroswish

Masumbinalam
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=542698513
 * https://en.wikipedia.org/w/index.php?title=Campus_Apartments&oldid=546194497
 * https://en.wikipedia.org/wiki/Special:Contributions/Masumbinalam

Menglish2
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=543038243
 * https://en.wikipedia.org/w/index.php?title=Fundology&oldid=547733862
 * https://en.wikipedia.org/wiki/Special:Contributions/Menglish2 (note that Menglish2 had not yet made an account on 9 March, when the Fundology article was deleted from Sublimeharmony's sandbox)

Uhmelrek
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=543515043
 * https://en.wikipedia.org/w/index.php?title=Alsbridge_(company)&oldid=553220369
 * https://en.wikipedia.org/wiki/Special:Contributions/Uhmelrek

Rakib87
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=prev&oldid=543830640
 * https://en.wikipedia.org/w/index.php?title=Game_Cooks&diff=544325692&oldid=543021353
 * https://en.wikipedia.org/wiki/Special:Contributions/Rakib87

Acciobook
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=543883672
 * https://en.wikipedia.org/w/index.php?title=GroundWork&oldid=546988554
 * https://en.wikipedia.org/wiki/Special:Contributions/Acciobook


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=544059964
 * https://en.wikipedia.org/w/index.php?title=Mike_Macadaan&oldid=544222463


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=prev&oldid=544706295
 * https://en.wikipedia.org/w/index.php?title=CALNET&oldid=546584926


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=544714054
 * https://en.wikipedia.org/w/index.php?title=Certified_Penetration_Testing_Consultant&oldid=546880038


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=544740425
 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=546037740 (TableTopics appeared in Sublimeharmony's sandbox twice, with other drafts in between)
 * https://en.wikipedia.org/w/index.php?title=TableTopics&oldid=547383253


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=545211538
 * https://en.wikipedia.org/w/index.php?title=Certified_Disaster_Recovery_Engineer&oldid=547158019


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=545240150
 * https://en.wikipedia.org/w/index.php?title=SJ_%28musician%29&oldid=546548566


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=prev&oldid=548360493
 * https://en.wikipedia.org/w/index.php?title=Confio&oldid=547744085


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=548372558
 * https://en.wikipedia.org/w/index.php?title=SocialSoft&diff=549149629&oldid=549149497 (initial revision, also by Kumcheong, was an article about someone called Omar Todd, with no apparent connection to SocialSoft)


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=prev&oldid=549411491
 * https://en.wikipedia.org/w/index.php?title=Heliospectra&oldid=549797380


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=next&oldid=549412750
 * https://en.wikipedia.org/w/index.php?title=CHMB_%28company%29&oldid=549703918


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=prev&oldid=550003941
 * https://en.wikipedia.org/w/index.php?title=Zorpia&diff=549776910&oldid=545380682 (extensive changes to existing article, including removal of footnoted accusation of spamming)


 * https://en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&direction=prev&oldid=550027882
 * https://en.wikipedia.org/w/index.php?title=ITelagen&oldid=550172929

My evidence against this one is weaker. I've lost track of the revision, but User:Sublimeharmony/sandbox11 contained a draft article about one of the principals of NeighborCity. It was not about NeighborCity itself. However, the editing pattern of Henriette.Kilo resembles that of the other accounts: minor edits, then creation of an unrelated article, then a few edits to that, and nothing more.
 * https://en.wikipedia.org/w/index.php?title=NeighborCity&oldid=539374634

— rybec

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - - This qualifies as the longest "concise" report I've seen, very solid evidence.  A CU is unquestionably needed here.  After pouring through the first dozen (one had a bad link but was easy to get around) it is obvious that we have sock puppetry afoot.  How deep this goes can only be determined using the CU tools. Dennis Brown &#124; 2¢ &#124;  WER  13:05, 11 July 2013 (UTC)
 * Add  vs  Dennis Brown &#124; 2¢ &#124;  WER  13:13, 11 July 2013 (UTC)
 * Note to CU, this spi report has had vandalized by
 * Dennis Brown &#124; 2¢ &#124; WER  16:13, 11 July 2013 (UTC)
 * Dennis Brown &#124; 2¢ &#124; WER  16:13, 11 July 2013 (UTC)
 * Dennis Brown &#124; 2¢ &#124; WER  16:13, 11 July 2013 (UTC)


 * . Compliments for the clear report... I think. Oh boy... WilliamH (talk) 22:49, 11 July 2013 (UTC)
 * Obviously due to the fact that socks keep being filed, it's rather a work in progress, so, if you could let me know when you're done listing accounts, or perhaps more importantly, when you think you are, then let me know and I'll get right back on this. WilliamH (talk) 23:26, 11 July 2013 (UTC)


 * I'm in the middle of verifying each to the real sock master. Henriette.Kilo doesn't need any more links, there are behavioral aspects that are plenty to connect him. Dennis Brown &#124; 2¢ &#124;  WER  00:10, 12 July 2013 (UTC)

Overview
It's a combination of behavioural and technical factors, but once again, this is the / sock farm, who both work in tandem as part of a Wikipedia editing business. At this stage (12:27, 12 July 2013 (UTC)) none of the below accounts have been checked directly.

Batch 2



 * Not sure, suspicious not instantly obvious
 * Some of these may become more obvious with crossover edits once all the socks are blocked and just need closer review. All are possible even this early on. -db


 * (no contribs, name consistent, depends on technical)
 * ? compromised?
 * ? compromised?
 * ? compromised?
 * ? compromised?

Batch 3


WilliamH (talk) 12:27, 12 July 2013 (UTC)


 * Not sure, suspicious not instantly obvious
 * Note to CU - I've looked at these three, and they are possible but inconclusive without further CU confirmation of at least "Likely". In particular, Chicago has a lot of edits.


 * few edits
 * (lots of other edits, not sure)
 * (lots of other edits, not sure)

Dennis Brown &#124; 2¢ &#124; WER  00:53, 14 July 2013 (UTC)


 * Holy cow. I will be spending the day moving, verifying, blocking and nuking this list, so consider this  Dennis Brown &#124; 2¢ &#124;  WER  12:47, 12 July 2013 (UTC)
 * One more: Wetzig. WilliamH (talk) 13:10, 12 July 2013 (UTC)

We're aware of this situation and watching with interest. We're also evaluating options to enforce the Terms of Use. I hope to be back in touch with you on this at some point soon. Philippe Beaudette, Wikimedia Foundation (talk) 21:12, 17 July 2013 (UTC)
 * Comment from WMF Legal

12 July 2013

 * Suspected sockpuppets

After my initial report, I used Special:Export to get a dump of all revisions of User:Sublimeharmony/sandbox11, then passed it through

grep ^\'\'\' sublimeharmony-sandbox11-export-20130712024828.xml | cut -f4 -d\'|sort -u

to get a list of bolded terms that appeared at the beginning of a line. Here's the list (some of these, such as "Argentina," were not the subjects of the drafts):


 * 4Cabling
 * Aasted
 * Alsbridge, Inc.
 * American Writers and Artists Inc. (AWAI)
 * Argentina
 * Brendan Wallace
 * Bunndle
 * CALNET
 * CHMB
 * Campus Apartments
 * Certified Disaster Recovery Engineer (CDRE)
 * Certified Penetration Testing Consultant \xe2\x80\x93 C)PTC
 * ClassDojo
 * Cleeng
 * Confio Software
 * CrowdOptic
 * DDC Advocacy (DDCA)
 * DPT Laboratories, Ltd.
 * David Kiger
 * David Schwedel
 * Digital Prospectors Corporation (DPC)
 * Dominique Molina
 * Echopass
 * Ethan Bearman
 * FindTheBest
 * Fundology
 * Game Cooks
 * GatherSpace
 * Genius Inside
 * Global Met Coal Corporation
 * Go Try It On
 * GroundWork, Inc.
 * HALO Maritime Defense Systems (HMDS)
 * Heel That Pain
 * Heliospectra
 * ITelagen
 * Inflection
 * Inigral
 * John Uustal
 * Jonathan Cardella
 * Junk It!
 * Kosovo
 * Legitmix
 * Loyaltyworks
 * MarketLive
 * Maximilien de Hoop Cartier
 * MediCortex
 * Mike Macadaan
 * Misty Lown
 * Muzak Holdings LLC
 * Neal Creighton, Sr.
 * Network Capital Funding Corporation
 * NewYorkStay.com
 * ONEHOPE
 * Oren Laurent
 * PCN Technology
 * PeopleSmart.com
 * Pneuron
 * PressPadApp
 * Reputation Advocate
 * ResumeBear
 * Rev. Fr. Emmanuel Lemelson
 * ReviewBoost
 * Reza Ghorbani
 * Rich Schefren
 * SJ (born Scott Jablonski)
 * Security Innovation
 * Shimao Property Holdings Ltd.
 * SocialSoft
 * Sollensys Corporation
 * Steven M. Neil
 * Sweet Couch
 * Switzerland
 * TableTopics
 * Tee Ashira
 * Telly
 * The American University of Iraq, Sulaimani,
 * The Hand and Wrist Institute
 * Tom Dyson
 * Tom Hoban
 * Tom Kemp
 * Tsebo Outsourcing Group
 * ViSalus
 * Virool
 * Waterfield Group
 * Zipwhip
 * Zorpia

Here are accounts that I missed before and which weren't mentioned by the other people working on this. Articles about subjects in the list above were inserted from these accounts.


 * 
 * 
 * 
 * 

I will probably want to add a few more; I hope this new section is appropriate.One of the drafts in the sandbox11 file was about ReviewBoost. There was a ReviewBoost article in main space; it was mentioned in the MooshiePorkFace SPI and deleted. — rybec

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Entirely appropriate, thanks - perhaps if there's any more of them, consider adding them to the talk page. The three batches of accounts I added are a combination of behaviour and technical, as I was sifting through everything I could find, articles and all. There is so much to go on that it is going to be impossible to tie every account to every other account technically - it is the behaviour which is the defining factor, as usual. I have however provided a clearly segregated list of accounts I found on the talk page from 3 main ranges - these are behaviourally indicative and only from those 3 ranges. WilliamH (talk) 14:14, 12 July 2013 (UTC)


 * I will also note that I simply do not have the time to accommodate a case of this size, so I am withdrawing myself from it at this stage. WilliamH (talk) 14:18, 12 July 2013 (UTC)


 * This is going to have to be done in batches to get it right. I've blocked the first, very obvious socks so far, a total of 75.  It might take a day or two to block/tag/nuke all this. Dennis Brown &#124; 2¢ &#124;  WER  14:36, 12 July 2013 (UTC)
 * Reviewed, verified and blocked another 60 accounts from Group 1. Still working... Dennis Brown &#124; 2¢ &#124; WER  16:32, 12 July 2013 (UTC)
 * Don't know why I ended up here in a recent changes patrol, and I've never commented here before, nor do I really know what I'm doing, but I thought I should point out that the modus operandi of Renzoy16 from batch 2 is quite unlike all the others in the list. Established editing history.  Fleshed out user page, instead of single, plain-text sentence.  Don't know if that is helpful or not.    78.26   (I'm no IP, talk to me!) 16:55, 12 July 2013 (UTC)
 * It is, thank you. False positive removed immediately. WilliamH (talk) 17:15, 12 July 2013 (UTC)
 * Actually, on second thoughts, while I won't be reinstating to the main list, I still think he should be presented for scrutiny. This behaviour is highly indicative. WilliamH (talk) 17:24, 12 July 2013 (UTC)
 * The subject matter of Justin Hartfield and Giggem is very much in the same vein as the articles inserted from the accounts I had nominated. Renzoy16's use of ProveIt, HotCat and Twinkle is something I didn't see with the others. — rybec   18:17, 12 July 2013 (UTC)


 * I'm working on this around the clock, but I keep finding new socks and have to document them offline, which is slowing me down but it is needed. This truly is turning into a clown car of a sock puppet investigation.  Dennis Brown &#124; 2¢ &#124;  WER  22:07, 12 July 2013 (UTC)
 * Blocked and tagged another 64, which brings the running total at 199 for those keeping score at home. That is 12 hours today, I will pick it up tomorrow.  I have notes for every one of these if a CU needs it.  Dennis Brown &#124; 2¢ &#124;  WER  23:35, 12 July 2013 (UTC)
 * Blocked 20 more in Group 2 (219 total to date), moved 14 to the "maybe" file. Those are slightly less obvious, but after all the blocks are done, it will be easier to connect dots and separate any innocent parties out.  We can hat my notes later, it just helps me stay organized.  This is a beast. Dennis Brown &#124; 2¢ &#124;  WER  14:42, 13 July 2013 (UTC)
 * Blocked 22 more in Group 3, will cleanup below and start the second sweep. Have also compiled a new group of possible candidates, will put below later. 241 total so far. Dennis Brown &#124; 2¢ &#124;  WER  16:38, 13 July 2013 (UTC)
 * Blocked 10 more, these are taking some creativity to investigate due to so few edits. Will resume tomorrow.  Others should review the unblocked to see if I'm missing something.  ~251 running total now.  Dennis Brown &#124; 2¢ &#124;  WER  21:30, 13 July 2013 (UTC)
 * Another 9 this morning, 260 total. Attempting to work with CU to review the remaining and new accounts.  Dennis Brown &#124; 2¢ &#124;  WER  12:52, 14 July 2013 (UTC)

14 July 2013

 * Suspected sockpuppets



Entertainedkitten11, an account about which Dennis Brown expressed suspicion, added the photo to the Emad Rahim article. That article was created in Jaleel487's 12th edit, after minor unrelated edits. The pattern looks familiar to me.



[//en.wikipedia.org/w/index.php?title=Junk_It!&oldid=542147287] vs. [//en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=542054880] — rybec   02:28, 14 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ Dennis Brown &#124; 2¢ &#124; WER  12:23, 14 July 2013 (UTC)
 * Blocked by Dennis, so closing this part of the case. Reaper Eternal (talk) 02:15, 16 July 2013 (UTC)

16 July 2013


Please see Ztwriter vs Reginac7. See also Reginac7 vs Rudro911. Reaper Eternal (talk) 01:34, 16 July 2013 (UTC)


 * Appeared quickly at Campus Special and my talk page after I tagged the now confirmed User:Laurien10's work as too promotional. I had the impression of a supervisor stepping in to defend his charges. Kilopi (talk) 07:01, 16 July 2013 (UTC)
 * Appeared quickly at Campus Special and my talk page after I tagged the now confirmed User:Laurien10's work as too promotional. I had the impression of a supervisor stepping in to defend his charges. Kilopi (talk) 07:01, 16 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Comment Not sure if this is relevant or important, and I can't really reveal specifics, but there is a ticket (2013071510010601 for those with access) in OTRS from a person who wrote complaining about his article having been deleted and how much they charged him. The article was G5ed yesterday along with all the other ones. In the email, this person CCed whom I assume is his contact or rep at the company that may be behind all this. I'll let a more experienced admin with OTRS access figure out what to do with this, but I figured it was worth a heads up. § FreeRangeFrog croak 00:16, 16 July 2013 (UTC)
 * I see 86.134.173.133 did another edit to Anthony Lolli (entrepreneur) and one to Rapid Realty NYC later correction, two more edits to the Lolli article. I'm assuming FreeRangeFrog is commenting about some other article, since neither of those has been tagged for G5 deletion (no confirmed sock-puppet activity), nor has either been deleted. The Lolli article had a G11 tag, which the IP editor has removed twice. —  rybec   01:05, 16 July 2013 (UTC)
 * Yes, it's another article. § FreeRangeFrog croak 05:08, 16 July 2013 (UTC)
 * There's nothing to do with this administratively, but I can confirm that the email is specifically related to a paid-for article and the findings in this case. Keegan (talk) 01:23, 17 July 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * See my evidence. Reaper Eternal (talk) 02:01, 16 July 2013 (UTC)
 * Ztwriter and Rudro911 are stale, Reginac7 and MHK7Sr are, but by behavior.  I'm deleting their articles.  Keegan (talk) 18:12, 17 July 2013 (UTC)
 * I did not delete Khulna University, for the record. Keegan (talk) 18:33, 17 July 2013 (UTC)

16 July 2013

 * Suspected sockpuppets

The deletion log for Omar_Todd_(actor) says:

23:24, 5 April 2013 Robertprowser72 moved page Omar Todd (actor) to Omar Todd (politician) [...] 01:04, 7 February 2013 Reginac7 moved page Omar Todd (actor) to Omar Todd (producer) (To assign proper vocation to subject.) — rybec   01:53, 16 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The account is stale. WP:DUCK. Keegan (talk) 18:36, 17 July 2013 (UTC)
 * Will a clerk please go through and archive the sections that no longer require attention? I would greatly appreciate it. Tiptoety  talk 21:20, 17 July 2013 (UTC)

18 July 2013
Clearly these guys have got new orders to fill, as well as previously expunged orders to salvage. I'm releasing the ranges used by these accounts as reviewing IP edits within these ranges may yield more undiscovered articles. All accounts range from recently created, to lining up enough edits for autoconfirmed, then creating their target article.

184.169.0.0/16

54.215.0.0/16



54.251.0.0/16

54.241.0.0/16

Clerk, CheckUser, and/or patrolling admin comments
All accounts blocked. The following hosting ranges have been hardblocked for a year: WilliamH (talk) 00:20, 18 July 2013 (UTC)


 * While it would be highly unusual and perhaps a bit controversial, should SALTing be discussed for the couple hundred articles affected, as well as future articles by future socks? The scale of this is so large that salting with special instructions to contact SPI might be the only way to not get buried in the avalanche.  We can't stop all the socks, but we can stop the articles, thus the payoff.  Unusual circumstances call for unusual solutions.  Dennis Brown &#124; 2¢ &#124;  WER  12:21, 18 July 2013 (UTC)
 * ReviewBoost was restored as Review Boost (company) ;Maximilien de Hoop Cartier reincarnated at Max Cartier, and Brosix came back as Brosix (Company) (note capitalization). — rybec   15:54, 18 July 2013 (UTC)
 * But being salted would allow instant salting of the copies, and make it obvious the recreator is a sock. It isn't the solution, but I think we need to consider it as part of the solution. Dennis Brown &#124; 2¢ &#124;  WER  18:05, 18 July 2013 (UTC)
 * It may make these pages more difficult to find, and previous similar pages being salted has no bearing on whether other pages can be salted. --Rschen7754 20:45, 18 July 2013 (UTC)
 * Maybe I'm misreading you, but I think you are incorrect. If MyBand (band) is salted and someone creates MyBand(band) as a way to get around the salting (ie same general content, slightly different name), it is automatically salted for the same rationale as the first one, whatever that rationale was.  That is pretty standard procedure and not controversial.  On your other point, if the article is salted, it has zero difference in finding it once it is deleted.  It comes up the same as any other previously deleted article.  Zero difference.  If someone wants to recreate a legitimate article and it passes GNG, then of course it should be unsalted. So salting would make it easier to control, to a degree. I'm open to any other ideas, but again, I've been aware of this "problem" for over a year, there is no silver bullet solution.  Dennis Brown &#124; 2¢ &#124;  WER  20:52, 18 July 2013 (UTC)
 * I agree it can be speedily deleted, but not in the same automatic way that salting protects agains re-creation under the same name. You are suggesting using salting as a symbol -- I suppose we could do it--before I saw this I deleted one such as attempt to circumvent salting, thinking of it as in some sense a G3 to protect the encyclopedia against an attempt to subvert its purpose,  but without giving it any speedy criterion number. But if you think admins will understand this, I'll do it. Do we need to modify WP:CSD ?   DGG ( talk ) 08:57, 7 August 2013 (UTC)

20 July 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Editing pattern similar to many already blocked users. Recommend G5 for Tungsten Branding, created today. Kilopi (talk) 02:32, 20 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
✅ WilliamH (talk) 03:12, 21 July 2013 (UTC)
 * appsFreedom and Micreos deleted. WilliamH (talk) 03:15, 21 July 2013 (UTC)
 * Closing. --Rschen7754 03:17, 21 July 2013 (UTC)

21 July 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Edited Unique Squared, which had previously been edited only by confirmed sock. Article is essentially orphaned [//en.wikipedia.org/wiki/Special:WhatLinksHere/Unique_Squared]. — rybec   02:40, 21 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Stale IP, come back if it starts up again. --Rschen7754 06:30, 25 July 2013 (UTC)

22 July 2013

 * Suspected sockpuppets
 * {{checkip|1=65.122.15.184}
 * {{checkip|1=65.122.15.184}
 * {{checkip|1=65.122.15.184}
 * {{checkip|1=65.122.15.184}
 * {{checkip|1=65.122.15.184}


 * User compare report Auto-generated every hour.
 * Editor interaction utility

IP address belonging to Amazon Web Services (Ireland), only edited SouthWest Energy Ltd, which was created and edited by confirmed socks. First edit was to remove the text "4/28: add the following information to Southwest Energy's page in a neutral and encylopedic way. Darius will bill for an additional $500 for this update."

Activity was previously confirmed from 54.215.0.0/16, 54.251.0.0/16 and 54.241.0.0/16, which also belong to Amazon. — rybec   22:02, 22 July 2013 (UTC)



only edited Jason Kanner and Soul Artist Management. Article about Jason Kanner says he founded Soul Artist Management. contributed the original Soul Artist Management article. Confirmed sock contributed the original Jason Kanner article, and it was edited by confirmed sock IP 54.241.63.134. Soul Artist Management was edited by confirmed sock. — rybec   22:59, 22 July 2013 (UTC)

Only edited user page and 24Hr HomeCare, an article which was created by confirmed sock and was edited by confirmed socks 54.251.8.252, 54.215.63.130, 54.215.95.8 and. — rybec   23:19, 22 July 2013 (UTC)



I requested speedy deletion of QuoteWizard, Timo_Weiland and Transportmarketplace, all of which were added to Wikipedia by Morning277 sock accounts. Soon after, 65.122.15.184 removed the tags from all three articles: [//en.wikipedia.org/w/index.php?title=Timo_Weiland&diff=565401617&oldid=565393207] [//en.wikipedia.org/w/index.php?title=QuoteWizard&diff=565400648&oldid=565394318]]. Several other articles which are in AfD or were tagged for speedy deletion were also edited.

From the address in the whois record, it looks like this may be a wireless hot-spot at an airport:

OrgName:      CITY OF PHOENIX OrgId:         CITYO-71 Address:       3400 E SKY HARBOR BLVD Address:       TERMINAL 3 City:          PHOENIX StateProv:     AZ —  rybec   00:26, 23 July 2013 (UTC)

Here's an annotated list of the articles edited by 65.122.15.184 today. Several of them were previously edited by known Morning277 sock-puppets. The others may cpntain previously undiscovered Morning277 material.

— rybec   02:09, 23 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Accounts blocked: QuoteWizard, Soul Artist Management, Jason Kanner deleted. WilliamH (talk) 08:15, 23 July 2013 (UTC)
 * 46.137.194.87 blocked as a webhost. --Rschen7754 08:17, 23 July 2013 (UTC)
 * 65 IP blocked 31 hours. Closing. --Rschen7754 08:20, 23 July 2013 (UTC)


 * Can another clerk please archive the completed ones? Thanks. --Rschen7754 19:39, 24 July 2013 (UTC)

24 July 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Confirmed Morning277 sock edited the articles Deepak Bansal and Clearpath Technology (according to those articles, Bansal founded Clearpath, an SEO company in Delhi). Bradenwakr also uploaded File:Deepak-bansal-photo.JPG, used in Deepak Bansal (note, OTRS ticket 2013040310001854).

contributed [//en.wikipedia.org/w/index.php?title=Deepak_Bansal&oldid=549273595] the Deepak Bansal article after 17 minor edits to Bangladesh- and India-related articles.

contributed [//en.wikipedia.org/w/index.php?title=Clearpath_Technology&oldid=548948394] the Clearpath Technology article after a series of minor edits.

There was also an edit [//en.wikipedia.org/w/index.php?title=Deepak_Bansal&oldid=554563988] by 115.112.117.149 (115.112.117.149.static-delhi.vsnl.net.in) to the Deepak Bansal article, 56 hours after Bradenwakr edited it. — rybec   15:01, 24 July 2013 (UTC)

Someone at 42.109.155.194 (42-109-155-194.live.vodafone.in) edited [//en.wikipedia.org/w/index.php?title=Clearpath_Technology&diff=558906342&oldid=554225914] the Clearpath article. — rybec   15:13, 24 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Stale so CU is not much use here. Blocked both accounts, closing. --Rschen7754 22:35, 25 July 2013 (UTC)

23 July 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

A draft of the article Hand and Wrist Institute was in User:Sublimeharmony/sandbox11 [//en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=559737073] and was placed in the main article space by by User:LAHealthVol, a Morning277 sock. The article John T. Knight, about the founder of the Hand and Wrist Institute, was contributed [//en.wikipedia.org/w/index.php?title=John_T._Knight&oldid=534398363] by Ttc1964, who also contributed: The subject matter is reminiscent of the Morning277-related articles. — rybec   21:45, 23 July 2013 (UTC)
 * Point Inside, about a software company
 * CloudVelocity, another software company
 * Matthew Karatz, a business person, journalist and politician
 * CoupFlip, an online shopping site

Farbod Sadeghian was edited by Morning277 sock. The article was originally contributed [//en.wikipedia.org/w/index.php?title=Farbod_Sadeghian&oldid=556727926] by and was most recently edited by. I noticed that Ramaczlatimir and Enigma15071987 both made slight changes to population figures articles about places in Serbia: [//en.wikipedia.org/w/index.php?title=Ruski_Krstur&diff=prev&oldid=556425711] [//en.wikipedia.org/w/index.php?title=Ruski_Krstur&diff=prev&oldid=556425761] [//en.wikipedia.org/w/index.php?title=Lalić&diff=prev&oldid=555565587] [//en.wikipedia.org/w/index.php?title=Ratkovo_(Od%C5%BEaci)&diff=prev&oldid=565530038] [//en.wikipedia.org/w/index.php?title=Bajmok&diff=prev&oldid=565529966] (many more from Enigma15071987). — rybec   22:30, 23 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ Dennis Brown &#124; 2¢ &#124; WER  13:54, 28 July 2013 (UTC)

26 July 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Resolves to pool-108-7-146-15.bstnma.east.verizon.net, seeming to imply it's in the Boston area. Made two consecutive edits to Robert L. Johnson and no other edits. Gave "grammar edits" and "more grammar" as edit summaries. Fixed one typo in photo caption, but main effect [//en.wikipedia.org/w/index.php?title=Robert_L._Johnson&diff=565829754&oldid=565526937] was to reintroduce material previously added by Morning277 socks; compare to previously-reported edit from Phoenix airport (65.122.15.184) [//en.wikipedia.org/w/index.php?title=Robert_L._Johnson&diff=565408013&oldid=565407208]. — rybec   06:04, 26 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Nothing to report or do, marking as closed. WilliamH (talk) 12:54, 28 July 2013 (UTC)

26 July 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

An editor at 31-221-87-84.cust-31.exponential-e.net (London) removed [//en.wikipedia.org/w/index.php?title=Rich_Schefren&diff=564518109&oldid=564278734] the notability tag from Rich Schefren, without providing any sources, just giving an edit summary saying "This fellow is a notorious and notable author and speaker in the U.K." The Rich Schefren article appeared [//en.wikipedia.org/w/index.php?title=User:Sublimeharmony/sandbox11&oldid=563837440] in User:Sublimeharmony/sandbox11 and was [//en.wikipedia.org/w/index.php?title=Rich_Schefren&oldid=564041175] gotten into article space (through AfC) by, an account I reported on 14 July which has not been blocked. — rybec   18:36, 26 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * No comment on that given IP address, but during the course of other checks, I found that is pretty much ✅ with . Rich Schefren G5d. WilliamH (talk) 07:26, 27 July 2013 (UTC)

27 July 2013

 * Suspected sockpuppets
 * - Tribrio (company)
 * - ViSalus (Chinese) where ViSalus was created by Morning277 himself
 * - Robert K. Phillips (new target)
 * - Eumeria (new target)
 * - LucFosther Diop (new target)
 * - Vida Vacations (new target) and another article in User:Shoreditch Lib/sandbox


 * User compare report Auto-generated every hour.
 * Editor interaction utility

New batch. Rschen7754 19:07, 27 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * for confirmation for unblocked accounts. --Rschen7754 19:29, 27 July 2013 (UTC)
 * is a sleeper of Acsuttle.
 * TylerCorelitz, Metalnu, and Plapointe have not been checked at this stage. Their articles look nothing the kind produced by the PR firm in question.
 * The following accounts are ✅ with each other:
 * Evidence is now available that the responsible PR firm is soliciting other individuals, i.e., external contractors, to upload their articles onto Wikipedia in the hope that their fresh IP data will evade scrutiny. Accordingly, technical evidence should be given the weight it deserves, unless otherwise indicated. WilliamH (talk) 12:50, 28 July 2013 (UTC)
 * I've blocked these three as clearly passing the criteria for this master (CU wasn't needed) and I have G5'ed their edits. If I have time later I will look at more, but I think it is time to recruit more help and start G5ing all these socks edits with extreme prejudice, to remove the financial incentive. My understanding is that the company's first check happens if they keep the article live for 30 days, btw.  There are a number of other "services" they provide as well. Dennis Brown &#124; 2¢ &#124;  WER  13:37, 28 July 2013 (UTC)
 * Add which is really old but these socks have a way of coming back, so even stale ones may have to be blocked.  G5'ed as well.  Dennis Brown &#124; 2¢ &#124;  WER  13:43, 28 July 2013 (UTC)
 * Evidence is now available that the responsible PR firm is soliciting other individuals, i.e., external contractors, to upload their articles onto Wikipedia in the hope that their fresh IP data will evade scrutiny. Accordingly, technical evidence should be given the weight it deserves, unless otherwise indicated. WilliamH (talk) 12:50, 28 July 2013 (UTC)
 * I've blocked these three as clearly passing the criteria for this master (CU wasn't needed) and I have G5'ed their edits. If I have time later I will look at more, but I think it is time to recruit more help and start G5ing all these socks edits with extreme prejudice, to remove the financial incentive. My understanding is that the company's first check happens if they keep the article live for 30 days, btw.  There are a number of other "services" they provide as well. Dennis Brown &#124; 2¢ &#124;  WER  13:37, 28 July 2013 (UTC)
 * Add which is really old but these socks have a way of coming back, so even stale ones may have to be blocked.  G5'ed as well.  Dennis Brown &#124; 2¢ &#124;  WER  13:43, 28 July 2013 (UTC)

20 July 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

, already confirmed as a Morning277 sock, placed the articles Frank Cohen (entrepreneur)‎, Kevin Surace and PushToTest.

One IP address resolves to c-24-130-59-129.hsd1.ca.comcast.net. The editor using it has contributed to Kevin Surace and PushToTest along with their associated AfDs Articles for deletion/Kevin Surace and Articles for deletion/PushToTest. Edits from 24.130.59.129 to other articles [//en.wikipedia.org/w/index.php?title=List_of_Rochester_Institute_of_Technology_alumni&diff=prev&oldid=530205313] [//en.wikipedia.org/w/index.php?title=QuietRock&diff=prev&oldid=538411746] were related to Kevin Surace.

The other IP address resolves to 173-164-217-162-SFBA.hfc.comcastbusiness.net. The editor using it has contributed to Frank Cohen (entrepreneur)‎ (the article says Cohen founded PushToTest), Articles for deletion/Kevin Surace and Articles for deletion/PushToTest.

There's an article about Marc Porat which says Porat works at one of Surace's companies, and which was edited [//en.wikipedia.org/w/index.php?title=Marc_Porat&diff=532905430&oldid=526885888] by. has an account, only used to edit his biography years ago.

Here's the interaction chart (I added 67.180.128.45, named yesterday). — rybec   02:06, 20 July 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Closing. For this particular sockmaster, stale IPs are pretty useless.  Melissa was already blocked by be a week ago, the other two don't fit the criteria at this time.  Dennis Brown &#124; 2¢ &#124;  WER  14:21, 28 July 2013 (UTC)