Wikipedia:Sockpuppet investigations/Nickicastro/Archive

02 September 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

These editor are spamming links to an overlapping set of websites:
 * Nickicastro, Nickicastro69, Gilbert11matthew, Ribelpot23, and Ahamcell are spamming perfectphysiquezone.com
 * Nickicastro, Melodyfrinder, Robinahelson, and 118.137.106.219 are spamming zyro.com
 * Robinahelson, Natashapiloma, Queenieglove, and Franceeladderman are spamming myreptilehub.com

I've only starting investigating, so I suspect that there are others which could be turned up using checkuser. Deli nk (talk) 14:02, 2 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Nickicastro, Nickicastro69, Gilbert11matthew, Ribelpot23, and Ahamcell . . Mkdw talk 15:15, 2 September 2015 (UTC)
 * Robinahelson, Natashapiloma, Queenieglove, and Franceeladderman also under WP:DUCK. Still recommend a CU to tie all the accounts together. 118.137.106.219 and Melodyfrinder are older and appear stale.  Mkdw talk 15:23, 2 September 2015 (UTC)
 * None of the named accounts is stale, including Melodyfrinder. The IP is irrelevant from a CU perspective as we don't publicly connect an IP to a named account anyway.--Bbb23 (talk) 15:48, 2 September 2015 (UTC)

I had a look through the User:COIBot link addition database. Domains blacklisted:

Domains not blacklisted (it's a free web host):

Additional accounts:

MER-C 12:34, 6 September 2015 (UTC)
 * - Spamming .  Vanjagenije  (talk)  23:19, 14 September 2015 (UTC)


 * Following accounts are ✅, group 1:
 * Following accounts are ✅, group 2:
 * The connection between groups 1 and 2 is, I can't go higher than that as they are both using web hosts.
 * Following are :
 * Callanecc (talk • contribs • logs) 11:14, 15 September 2015 (UTC)
 * All accounts tagged following CU. Mkdw talk 23:36, 21 September 2015 (UTC)
 * Following accounts are ✅, group 2:
 * The connection between groups 1 and 2 is, I can't go higher than that as they are both using web hosts.
 * Following are :
 * Callanecc (talk • contribs • logs) 11:14, 15 September 2015 (UTC)
 * All accounts tagged following CU. Mkdw talk 23:36, 21 September 2015 (UTC)
 * Following are :
 * Callanecc (talk • contribs • logs) 11:14, 15 September 2015 (UTC)
 * All accounts tagged following CU. Mkdw talk 23:36, 21 September 2015 (UTC)
 * Callanecc (talk • contribs • logs) 11:14, 15 September 2015 (UTC)
 * All accounts tagged following CU. Mkdw talk 23:36, 21 September 2015 (UTC)

17 October 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Tripped the spam blacklist for myreptilehub.com (admins only), a domain spammed in the previous report. Additionally, user is engaged in similar drive-by spamming:. Sleeper check please. MER-C 19:17, 17 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Technically, is between  and . Most of the confirmed previous accounts have edited from webhosts, colocators, and open proxies.  To the extent any of the previous puppets have edited from a "real" location.  Ijaskb is editing from a different one.  The other technical data is also not a match.  Based on that data, one could say it's, but that data is relatively common, making possible a bit of a stretch. Future data may shed more light on this, but at this point you'll have to rely on behavior. There are no obvious sleepers connected to this account. A deeper probe is tough because of the amount of traffic on these IPs.--Bbb23 (talk) 13:59, 18 October 2015 (UTC)
 * Thank you for looking. The behavior isn't exactly the same; meatpuppetry is a more likely explanation. I blocked the account and blacklisted the links prior to filing as the edits were obviously spam regardless, so this report can be closed. MER-C 14:20, 19 October 2015 (UTC)


 * Already blocked. Closing.  Vanjagenije  (talk)  22:17, 20 October 2015 (UTC)