Wikipedia:Sockpuppet investigations/Orangemoody/Archive/1

08 July 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

No evidence submitted Risker (talk) 04:09, 8 July 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Checkuser note: This is a placeholder for an ongoing investigation. Please leave as is. Risker (talk) 04:15, 8 July 2015 (UTC)
 * Can you explain what is going on here?  Vanjagenije  (talk)  22:39, 9 July 2015 (UTC)
 * A checkuser found some extremely suspicious accounts coincidentally when carrying out an unrelated task. The checkuser team is now working on it to determine the extent of the problem and the number of accounts involved. On discussion, we created this SPI as a placeholder, both to keep it on our own radar, and to have a place where we're agreed we're going to post the results. This may take a while (weeks, not days). Risker (talk) 22:42, 9 July 2015 (UTC)
 * This account came up on a CU I've been working for a couple of days at Sockpuppet investigations/Dasbinays. I already have two very large groups of accounts. Orangemoody would fall into a third group that I haven't fully explored yet. I ran out of energy today and decided to defer it until tomorrow. Not sure I'll even be done tomorrow. I don't want to conflict with what you're doing, but I'm not sure how to proceed based on your comments. By the way, the three groups themselves may be related.--Bbb23 (talk) 04:32, 12 July 2015 (UTC)
 * let's see if we can put our heads together tomorrow. Maybe ping me on IRC? I have run into the same issue, I have a huge group, and it would be better to manage this all at once. I also have some additional suspicions about what is going on, which we may need to discuss amongst other CUs.  Risker (talk) 04:38, 12 July 2015 (UTC)
 * I don't use IRC, even though I can see the advantages in this instance because it would allow an interactive conversation. I do have notes of my CU. They might be a bit hard to follow because they're intended for me so I can keep track of what I'm doing. However, I can e-mail them to you if you wish. I can also try to use IRC, although it's been ages since I've done it, and I'll probably screw it up. Let me know. I'm going to bed very shortly as I'm exhausted, but I'll be on-wiki tomorrow morning (U.S. Pacific time).--Bbb23 (talk) 04:47, 12 July 2015 (UTC)
 * Thanks, Bbb23. We'll work out something, even if it's just a gchat; no need to reactivate that IRC cloak! Risker (talk) 04:49, 12 July 2015 (UTC)
 * Ok. I'm putting this case, no need to have it in the "open" list.  Vanjagenije  (talk)  23:12, 9 July 2015 (UTC)

10 July 2015

 * Original suspected master
 * Suspected sockpuppets
 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

A group of accounts which have been spamming the same domains in a very similar manner. All of them have made some constructive edits, incliuding placing maintenance tags on articles, and some additions of spam, usually refspam in the form of commercial links that are unrelated to the articles in question (e.g. a wedding photographer website added to a mention of the movie ’’The Wedding Video’’)

Spammed domains include


 * visionone.co.uk


 * Kaiyaiva6:
 * Dasbinays:
 * Tamikobo:
 * Botanharu:
 * Tahasinio4:


 * ysdmedia.co.uk


 * Kaiyaiva6:
 * Tahasinio4:
 * Gendes40:


 * casinofantasia.com


 * Kaiyaiva6:
 * Tahasinio4:
 * Gendes40:


 * impoundedcarinsurance.com


 * Dasbinays:
 * Tamikobo:
 * Goslingjames


 * dsign.co.uk


 * Gendes40:
 * Nathannoha7:
 * Jamesally87:


 * comparefuneralplans.co.uk


 * Botanharu:
 * Kaiyaiva6:
 * Nathannoha7:
 * Roninrio:
 * Jerome855:
 * Rnixonned:
 * Dennismil558:
 * Sadafkar04:
 * Gendeslok:
 * Sohlinkum:
 * Ethihas76:
 * Hiemnson:
 * Jerminahsok:
 * Yokoanti5:


 * prepaidfuneralplansuk.co.uk


 * Yokoanti5:
 * Aitanaelis:
 * Delmoro23:


 * bmihealthcare.co.uk


 * NationSantra:
 * Droivillas:
 * Mourismm:
 * Nakshirobben:
 * Norikodi:
 * Humaidader:
 * Jamalisobhai:

—bonadea contributions talk 22:16, 10 July 2015 (UTC) bonadea contributions talk 22:16, 10 July 2015 (UTC)

Argh. When I had submitted the above I found another account, which is older than Dasbinays, namely Canverdiano who should have been named sockmaster... That account has spammed ysdmedia.co.uk and impoundedcarinsurance.com. --bonadea contributions talk 22:21, 10 July 2015 (UTC)

Adding another bunch of accounts, from Nathannoha7 to Delmoro23 in the list at the top. Same MO as previous accounts, with some constructive edits and some additions of refspam. Finding these has been a lot like pulling a loose thread and watching it unravel more and more: tracking down a domain, looking at other edits made by the account that added it, finding other domains added by that account, finding other accounts adding those domains, etc - I'm sure this is not the entire sock drawer, but I'm going to have to stop here for now. Additional evidence added above. I've tried not to go overboard with the diffs. --bonadea contributions talk 16:15, 18 July 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I've found a few other accounts that seem to be related - would there be any point to adding those to this SPI, or should I just wait for the outcome of the CU? (I understand that it's taking some time and I'm not worried about that, I just don't know whether having more accounts at this point might make the CU easier or not.) --bonadea contributions talk 15:55, 17 July 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
To anyone looking at this SPI, but particularly the filer and any other checkuser or clerk. The CU is taking significantly longer than I had expected and I'm not even close to done, so my findings will not be posted soon. If I had to guess, tomorrow.--Bbb23 (talk) 03:02, 11 July 2015 (UTC)
 * I've put this case on hold because I'm coordinating with another checkuser on a related SPI. Don't expect any findings soon. Thanks for your patience.--Bbb23 (talk) 17:20, 12 July 2015 (UTC)
 * Feel free to add more puppets (and evidence). Just add them to the list itself at the top, not in a separate section, and please note that you are adding them in a comment. That way they won't get "lost". Thanks.--Bbb23 (talk) 20:52, 17 July 2015 (UTC)
 * Do you want admins to block the identified accounts above or hold for the time being? Cas Liber (talk · contribs) 05:57, 22 July 2015 (UTC)
 * In the meantime, I have blacklisted the eight domains above. MER-C 10:49, 22 July 2015 (UTC)
 * , please do not block any of the accounts. Thanks.--Bbb23 (talk) 22:17, 22 July 2015 (UTC)


 * Is something going to happen here?  Vanjagenije  (talk)  23:45, 16 August 2015 (UTC)
 * Eventually, but not now.--Bbb23 (talk) 00:04, 17 August 2015 (UTC)


 * Merged into Orangemoody case. NativeForeigner Talk 23:26, 31 August 2015 (UTC)
 * As a note all related to the LTA and what Risker posted at NativeForeigner Talk 23:30, 31 August 2015 (UTC)

01 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Similar behaviour on Emma Swift - appeared to recreate similar article to previous socks Mdann52 (talk) 09:31, 1 September 2015 (UTC)

Brand-new account whose only edits (1, 2) are requesting undeletion of George Oliveira, an Orangemoody article. JohnCD (talk) 11:38, 1 September 2015 (UTC)

Clintric has been agitating at WP:REFUND for undeletion of AJ Joshi (1) and Emma Swift (2), both Orangemoody articles. On my talk page Clintric is accused by User:Ivetliviya9, an Orangemoody account, of being a paid editor. Clintricsew has been editing Draft:Emma Swift and is a DUCK for Clintric. JohnCD (talk) 12:16, 1 September 2015 (UTC)

Creating same article with a different title "A.J.Joshi". Kiranjitdas (talk) 13:13, 1 September 2015 (UTC) This account recently showed up which is vandalizing userpages. Kiranjitdas (talk) 13:39, 1 September 2015 (UTC)
 * NickAangWiki declares on his user page that he is a paid editor, as required by the TOU (good) and that he has some socks (not good). However he objected on its talk page to deletion of the re-created Orangemoody article A.J.Joshi, which ties him in with them. JohnCD (talk) 14:42, 1 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Per the very recent investigation with large involvement from CUs I will err on the side of caution and endorse this request. I'd also like guidance as to how future reports should be handled, should we always defer to CUs, should articles be auto-deleted, and such. ☺ ·   Salvidrim!   ·  &#9993;  13:19, 1 September 2015 (UTC)
 * I'm not going to change the workflow status of this, but I've found and blocked SwiftEmma, NickAangWiki, and ChutiyaNick. Courcelles (talk) 00:24, 2 September 2015 (UTC)
 * Checkuser comments: There does not appear to be a direct connection between Orangemoody and any of these accounts.  On the other hand, the following are ✅ socks of each other:
 * - this is possibly an impersonator account.
 * - this is possibly an impersonator account.
 * - this is possibly an impersonator account.
 * - this is possibly an impersonator account.

As for the others, User:Olijojo appears to be a good faith editor, and the and  accounts are  socks on technical data. Risker (talk) 05:26, 3 September 2015 (UTC)
 * I've blocked Clintricsew. No further action seems to be needed here. Mike V • Talk 01:29, 19 September 2015 (UTC)

02 September 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

I have blocked Simprule as a WP:DUCK per recreation and edits on The House Shop, which was reinstating exactly what was previously deleted under the LTA. KTC (talk) 10:55, 2 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Closing the case.  Vanjagenije  (talk)  18:47, 2 September 2015 (UTC)

02 September 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Look at this diff made by RocketMaster on User:Orangemoody. Possible sock.  RMS52  Talk to me  18:25, 2 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Hold on a sec. This user has been around since 2005, and their edits consisted mostly of reverting vandalism, not the Orangemoody pattern of overlinking, useless italicization, and adding suggestions to expand an article using its counterpart on foreign Wikipedias. Yes, they were trolling us by claiming to be Orangemoody, but I think we should take a second look. Altamel (talk) 02:31, 3 September 2015 (UTC)

RocketMaster may possibily know information about Orangemoody socks, I suggest you ask him. Also, out of the blue RocketMaster started editing and has now stopped  RMS52  Talk to me  15:06, 3 September 2015 (UTC)
 * Yes, it was just a joke. And, i don't know about this Orangemoody guy, i've only read about it on Naked Security. I'm sorry if i caused problems. RocketMaster (talk) 15:11, 7 September 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * I have blocked them based on their confession. -- GB fan
 * Closing the case.  Vanjagenije  (talk)  18:46, 2 September 2015 (UTC)
 * Unblocking the editor. Not related to Orangemoody, despite the bad joke. Risker (talk) 03:10, 3 September 2015 (UTC)

03 September 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Creates a redirect, which is turned into an article two weeks later by a known Orangemoody sock. Also exhibits the same pattern of gnoming edits to get autoconfirmed, compare overlinking by Hertizseldon and superfluous italicization  with italicization by blocked Orangemoody sock Razamerswar. Altamel (talk) 02:17, 3 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Checkuser comment: ✅ as an Orangemoody sock.  Blocked indefinitely.  Risker (talk) 03:13, 3 September 2015 (UTC)
 * Closing the case.  Vanjagenije  (talk)  15:21, 3 September 2015 (UTC)

03 September 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Administrators%27_noticeboard/Archive273 listed 16 accounts with similar editing patterns now known to be shared by Orangemoody socks. 11 of the accounts mentioned there have been blocked, the other five are listed above. They show the same pattern of adding excessive bluelinks, especially on taxonomy articles, removing redlinks, and adding italics all over the place. Diffs: Samuelliam: overlinking and italicizing a page title. Emmaava17: overlinking and italicizing a page title. Zoeemily: overlinking and removing redlinks. Ethanliam69: overlinking and italicizing a page title. Masonadam25: overlinking and adding "External Link" headers. Altamel (talk) 20:31, 3 September 2015 (UTC)

Self-admitting.  Vanjagenije  (talk)  20:40, 3 September 2015 (UTC)

Pointless additions of blanks and empty lines in a wide range of unrelated topics. Clearly someone preparing a new AC throwaway account - report filed considering the ongoing Orangemoody campaign. GermanJoe (talk) 12:44, 4 September 2015 (UTC)

Added AlariciaWiki. Supdiop ( Talk / Contribs ) 15:42, 4 September 2015 (UTC)
 * "I have several account here on WikiPedia to stay safe from getting banned for misusing their services.". MER-C 02:15, 5 September 2015 (UTC)

The deleted article Hunt Monitor was originally a declined AfC submission, taken over and posted to mainspace by, a known Orangemoody sock. However, the article was then edited by David John Crawford, a new SPA, who made a dozen minor edits in a short time. This suggests that he may be a "helper" sock getting himself autoconfirmed. JohnCD (talk) 22:28, 4 September 2015 (UTC)
 * I have struck David John Crawford - I'm told he is the brother of the original author of the declined AfC draft, before it was adopted by Orangemoody, and the fact that the CU didn't find him confirms this. JohnCD (talk) 15:36, 7 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

The name starts with chutiya which is a derogatory term. And the username such as "ChutiyaNick" or "ChutiyaAlaricia" must be created to harass someone named Nick or Alaricia. --112.79.38.141 (talk) 14:26, 4 September 2015 (UTC)
 * Yes there is a User named ChutiyaNick but this edit was not mine--112.79.35.117 (talk) 06:27, 6 September 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Just a note that I'll look at these requests some time tomorrow. Risker (talk) 03:27, 5 September 2015 (UTC)


 * I've blocked the following accounts as Orangemoody socks:
 * Mike V • Talk 15:25, 7 September 2015 (UTC)
 * Mike V • Talk 15:25, 7 September 2015 (UTC)
 * Mike V • Talk 15:25, 7 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 15:25, 7 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 15:25, 7 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 15:25, 7 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 15:25, 7 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 15:25, 7 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 15:25, 7 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 15:25, 7 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 15:25, 7 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 15:25, 7 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 15:25, 7 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 15:25, 7 September 2015 (UTC)
 * <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 15:25, 7 September 2015 (UTC)


 * Another possibility, unless its coincidence from a different paid editor: User:BiH, see evidence on my user talk page DGG ( talk ) 04:37, 12 September 2015 (UTC)

07 September 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same pattern down to the last detail: Starts off with a misplaced italic title and two edits to a species page, one saying what its class is and one saying what its order is, with the same incorrect apostrophe as on all the other Orangemoody species edits; then moves on to incorrectly demote a heading on a page, create a blank talk page, do some nothing edits on a minor maths article, add some wikilinks to other articles and format a ref on a suspiciously promotional page of an artist and create a blank user page. Then adds a spam link to an article of the kind beloved by SEO artists, removes a redlink from some random page, adds the same spamlink, formatted as a citation, to another page, and tries to obfuscate it by italicising some quoted text and adding a "citation needed" and finally does a null edit removing a newline and finishes off by wikilinking two football clubs in some godforsaken article about a 1950s football league. Same pattern that I've seen over and over while patrolling Orangemoody accounts. --Slashme (talk) 18:45, 10 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I've blocked the account based upon the behavioral similarities. <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 00:39, 24 September 2015 (UTC)

20 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Bringing this here based on circumstances for evaluation. I came across Draft:Purohit - Blaivas Staging System while checking WP:SCV, where this article was tagged as a copyvio. Turns out the copyright source was a mirror of a previously deleted article here: Purohit-Blaivas Staging System which was deleted as an OM sock. Since the content is a direct match, admins MER-C and Panyd suggested bringing it here for evaluation.

IF the draft is not deleted for whatever reason, it would need a histmerge with the prior article to close out the SCV case. Crow <sup style="color:black;"> Caw 17:48, 20 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Technically speaking, I think the account is related to other Orangemoody accounts. I've blocked the account. No sleepers found here. <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 00:39, 24 September 2015 (UTC)

27 September 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

10 trivial edits to start, re-creation (with the same typos) of a clearly non-notable, CSD-deleted Orangemoody article, claims of "new citations" are false (just like the newspaper articles, where the sock "forgot" to add the active source URLs), see The Man Van and the account's contribution history. GermanJoe (talk) 11:01, 27 September 2015 (UTC)
 * Legopio following a similar sock pattern, to recreate non-notable and CSDed RoofingHub article, see contribution history. GermanJoe (talk) 12:28, 27 September 2015 (UTC)
 * Stomerio following a similar sock pattern, to create non-notable Buy1 Get1, over an initial redirect, with fake offline sources. GermanJoe (talk) 13:21, 27 September 2015 (UTC)
 * Added Larsmui, Pesetgio2, Randilnio, Nacrelio0, Lehandg, Montik26, Hensipal and Jerrynion - same pattern (see contributions). GermanJoe (talk) 13:46, 27 September 2015 (UTC)
 * Added Neinge89, similar pattern (see contribs), + promotional EL spamming (see and talkpage). GermanJoe (talk) 14:15, 27 September 2015 (UTC)

Added Kiranjitdas as possible helper account. See their page curation log. Especially recent entries like United Consulting Group, created 7:09 with (with several possibly fake offline sources), reviewed at 7:11, 2 minutes later. RoofingHub (with several possibly fake offline sources) finished at 7:13, reviewed immediately at 7:13 (RoofingHub edits were reviewed 3 times from the same account in the past, hardly a coincidence). The Man Van (with several possibly fake offline sources) created 8:06, "reviewed" immediately at 8:06. The reviewing account has started in April 2015 with the typical pseudo edits, since then contributions show a strange obsession with trivial CSDs, Twinkle article tagging and 1 borderline-notable article James Allen (company). This article page was initially created as redirect, and later filled up with content, see history (another typical sock tactic of course). GermanJoe (talk) 12:57, 27 September 2015 (UTC)

Note - almost all checked article creations reviewed by Kiranjitdas show the same pattern: new account with 10-12 trivial edits -> creation of a fully developed business article -> reviewed. I looked at c. 10 articles, but all remaining articles in should be checked for sock activity and notability. GermanJoe (talk) 14:23, 27 September 2015 (UTC)

Note 2 - checked all articles in the review list. I have skipped a few borderline cases of semi-notable topics, and only listed obvious sock accounts. I am done checking for now. GermanJoe (talk) 15:19, 27 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

It would be a strange turn if Kiranjitdas is confirmed, as he's named several accounts as Orangemoody socks himself: [//en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Orangemoody&diff=prev&oldid=678924437], [//en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Orangemoody&diff=prev&oldid=678927350], [//en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Orangemoody&diff=prev&oldid=678928875] — Brianhe (talk) 23:03, 27 September 2015 (UTC)


 * Was aware of that, and I agree with you about the "strange" part, but the connection between Kiranjitdas' review log and the closely timed sock/SPA creations in almost all of their reviewed articles is quite strong for a mere conincidence. Also, the SPI check from 1 September could not verify that the 3 accused accounts were actual Orangemoody socks. It just showed that they were socks of a known paid editor. An interesting quote by JohnCD from 1 September: "On my talk page Clintric is accused by User:Ivetliviya9, an Orangemoody account, of being a paid editor." - this sounds like 2 groups, not necessarily 1. Maybe the CU can shed some light here. GermanJoe (talk) 00:30, 28 September 2015 (UTC)
 * One other socking editor I know of who went after other COI operators was . I mentioned this [//en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/BiH&diff=681507265&oldid=681495474 here]. Arr4 was also named in Orangemoody/Accounts, and an admin has hinted at some extra-special stuff going on with him. Following 's observation about this case, Arr4 was also active with AfD/CSD noms (11 December 2014 [//en.wikipedia.org/w/index.php?title=Special:Contributions&offset=20141212082732&limit=100&tagfilter=&contribs=user&target=Arr4&namespace= edit history] for example) and Twinkle article tagging. — Brianhe (talk) 01:34, 28 September 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
. Just to let everyone watching this SPI know that the CU will not be quickly completed. Like most OM investigations, there is a powerful mushroom effect, meaning I have to follow numerous strands leading in many directions to be as thorough as possible.--Bbb23 (talk) 09:53, 28 September 2015 (UTC)
 * Bbb23, just found three on the range I emailed you. Callanecc (talk • contribs • logs) 14:37, 29 September 2015 (UTC)


 * The following accounts are ✅ (a small number are confirmed only to each other and to the master):
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * I will block, tag, and close after I post the results.--Bbb23 (talk) 15:47, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)
 * Closing. Bbb23 (talk) 16:58, 29 September 2015 (UTC)

03 October 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Roger Connors is a promotional bio created in one edit by this SPA [//en.wikipedia.org/w/index.php?title=Roger_Connors&oldid=635430267] after 10-12 injections of trivial Wikilinks elsewhere. The account was then abandoned. I believe this is precisely the Orangemoody modus operandi.

Article later visited by a confirmed sock [//en.wikipedia.org/w/index.php?title=Roger_Connors&diff=663040720&oldid=653117654] which further raises suspicion. Brianhe (talk) 14:03, 3 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I'll leave this open for a clerk to address, but I see no point to going back to an account that hasn't been used since November 2014 to label it an OM sock based purely on behavior.--Bbb23 (talk) 15:26, 3 October 2015 (UTC)
 * The account referred to by the filer,, that "visited" the Roger Connors article is a confirmed sock of another master, and the behavior and edit summaries of DWTSFan2015 are remarkably similar to SunnyGershwin. Unless there's some strong connection between the other master and OM, this should be declined, and I may do so without waiting for a clerk.--Bbb23 (talk) 15:33, 3 October 2015 (UTC)


 * . See my comments above. Closing.--Bbb23 (talk) 17:45, 3 October 2015 (UTC)

04 October 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

I came across this user via the article Epom Ad Server. The article had previously been created earlier this year by Bennycrown, a confirmed OrangeMoody sockpuppet. During its earlier 2015 creation it was also edited upon by Hellenwho, who only edited this article. Because of that, I'm listing her as well.

Now the reason I'm nominating this is because the article was recently recreated by YeonJKim and is largely identical to the version created by Bennycrown, enough to where I erred on the side of caution and speedied it. Its nominator, Davidwr, requested that if it was speedied, that we take its creator to SPI. You can see the Bennycrown version here with edits by Hellenwho and here is the version by YeonJKim. YeonJKim did participate in the Bennycrown version of the article prior to its deletion in August.

Whether or not this is a sockpuppet or not, I'm unsure since I'm not as overly familiar with OrangeMoody as I am with others, so I'm not sure if this is a case of another sock or if this is just someone who very, very unwisely created an article using material from a known sockpuppet. What is very, very problematic here is that YeonJKim had requested for the article to be restored on September 1 on Timotheus Canens's talk page. It was declined with an explanation and YeonJKim was pinged, so there's no reason why he shouldn't have known the issues with the page, as this was done prior to him recreating the article with the same content. Other than that, it'd be best for someone familiar with OrangeMoody's edit patterns examined YeonJKim's edit history since that was the only thing that really stood out to me. Tokyogirl79 (｡◕‿◕｡)  06:34, 4 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I meant to ask for an SPI if the deleted version and the re-created version were almost identical. The re-created version's first edit had an edit summary saying it was translated from the :uk version, which in turn was a translation from the Orangemoody-created :en version. An innocent-editor's translation-of-a-translation should vary significantly from the original. See Wikipedia talk:Long-term abuse/Orangemoody/Accounts for details. davidwr/  (talk)/(contribs)  06:46, 4 October 2015 (UTC)
 * It was pretty substantially similar. Here are the different versions:

Epom Ad Server is an software as a service ad serving and ad management platform for display, video, and in-app online advertising. Since its launch in 2010 Epom Ad Server has become a part of MMA, DMA, and IAB. After receiving a $7m investment during their second venture round in 2014, Epom added real-time bidding functionality to their platform, enabling the ad server’s clients to integrate with their own partner DSPs as well as partners of Epom Ad Server, such as Index Exchange, Creafi, MdotM, etc.

As of 2015, Epom Ad Server is a partner of businesses and organizations such as Media Trust, Via.com, Wooga, and Better Business Bureau.

Launched in 2011, Epom Market is Epom Ltd’s own ad network which uses Epom Ad Server as its platform. Epom Market is a network which works with desktop, mobile, in-app, and video advertising.

As of July 2015, Epom holds the 7th place among Ukrainian IT companies with a staff of under 80 employees.

Epom Ad Server — is a Software as a Service, ad serving and ad management platform for display, video, in-app, and mobile web advertising. Since its launch in 2010 Epom Ad Server has become a part of MMA, DMA, as well as IAB. In 2014 Epom received a $7m investment during its second venture round. The same year they added real-time bidding functionality to their platform, allowing their clients to integrate with their own partner DSPs, as well as partners of Epom Ad Server, such as Index Exchange, Creafi, MdotM, etc.

As of 2015, Epom Ad Server is a partner of businesses and organizations such as Media Trust, Via.com, Wooga, and Better Business Bureau.

In 2011 Epom Ltd launched Epom Market, an ad network which uses Epom Ad Server as its platform. Epom Market is a network which works with desktop, mobile, in-app, and video advertising.

As of September 2015, Epom is 3rd in the rating of Ukrainian IT companies with a staff of under 200 people.


 * They were identical enough that I did speedy them. The differences in text are pretty minor, a change in phrase here and there. Tokyogirl79 (｡◕‿◕｡)  07:09, 4 October 2015 (UTC)
 * The version I posted for the sock was taken from the last edit by Helen, prior to YeonJKim's edits. Tokyogirl79 (｡◕‿◕｡)  07:10, 4 October 2015 (UTC)
 * I didn't think it'd be fair to compare the edits if I counted in the last few edits to the sock version that were done by YeonJKim. In any case, davidwr, do you want to continue on with the SPI? Tokyogirl79 (｡◕‿◕｡)  07:15, 4 October 2015 (UTC)
 * Did you say that YeonJKim made some edits to the original version? If so, he might have kept a local archive or knew where to find an online mirror, which would explain the similarity (if I were a strongly-loyal COI editor I would make it my business to keep local archives or at least know where to find an online mirror).  The fact that he re-created the article "as it was" and remembered that the :en came from :uk OR that he was aware that the :uk version existed and labeled the "first" version as a translation is a bit suspicious of "bad faith editing" but it's not, by itself, suspicion of being an OrangeMoody sock.  If he did edit the "old" version, the only basis for continuing the SPI for YeonJKim is the editor's overall behavior including deleted edits (which I can't see).  I would recommend either striking his name from this SPI or introducing any additional evidence you can see (including deleted edits I can't see).  Only proceed with a checkuser if there is enough evidence to proceed.  Again, if he edited the "old/OM" version, re-creating it almost exactly like it was is not, by itself, sufficient evidence to continue this investigation.
 * As for User:Hellenwho, I have no input as I can't see any of her edits.
 * There is also a small copyright issue to deal with: Please paste in the edit histories of the two versions above or plan on removing them entirely when this discussion ends.  davidwr/  (talk)/(contribs)  08:06, 4 October 2015 (UTC)


 * Hi, I just thought I'd put a few words in too. I am working on several edits to ad-serving related pages, and it just happens that Epom Ad Server was one of the pages that caught my attention when the OrangeMoody investigation happened. I recreated the page based on online mirror archives of the page, and I used the translation function because I found that to be more convenient than working with Wiki markup for references. So, I was aware of the page's relation to the OrangeMoody investigation, but as per User:Timotheus_Canens's recommendation I recreated the page as (in my opinion) it meets the notability guidelines, and I tried my best to ensure there weren't any plagiarism issues in my edits (which Timotheus_Canes said was one of the reasons many OrangeMoody posts would not be restored as-is). I'm sorry for all the confusion that ensued. YeonJKim (talk) 08:28, 7 October 2015 (UTC)
 * YeonJKim, Timotheus Canens stated that you could create a new article - he did not endorse you using the material from the deleted article and he explicitly stated that the reason for the article's deletion in the past was because of copyright issues. The version you posted was almost completely identical and the gist of him saying you could create a new article was him saying that he wanted you to draft a new article in your own words. Tokyogirl79 (｡◕‿◕｡)  10:00, 7 October 2015 (UTC)
 * Tokyogirl79, There's only so many ways one can rephrase the available sources about Epom Ad Server in a coherent matter. From the research I conducted the largest (and as far as I was able to gather, also the only) copyright concern within the original article was the use of the Epom Ad Server logo. As far as the content of the page goes, all the writing was completely unique. I have contacted the company's PR team for a licensed logo upload to Wikimedia Commons to get the copyright issue resolved, but from what they told me I understand that they haven't placed a request via OTRS yet. I'm fairly certain that the text itself does not violate any copyright issues or contain any plagiarized content. If you have any tips on how to better create a copyright-violation-free text for the article I will be glad to re-draft a copy, if that is even necessary. I'm relatively new to this, but I am eager to improve. YeonJKim (talk) 11:59, 7 October 2015 (UTC)


 * YeonJKim I'd recommend re-drafting it because otherwise you run the risk of more comparisons to OrangeMoody if you're using his material. This means that someone could look at the page, see that it's practically identical to OM's version, and still question if you have ties to him via other methods - or whether or not you're a paid advocate for the company itself. Trust me, you do NOT want people to associate you with OrangeMoody or with paid advocacy. It's always, always better to re-write the content in your own words than it is to use something written by a very notorious sockpuppet that had issues with promotion and copyvios, as it makes it more of a target than it otherwise would be. Heck, if someone even suspects that it's still copyvio or material taken from a company's official material you'll have people coming after a page. I had this happen with a bio for an architect/artist. His official bio was licensed as fair use and the content on Wikipedia wasn't overly promotional, yet people kept coming after it and eventually the entire article had to be re-written because a lot of us got tired of having to argue against the copyvio and promotional tags. I'm aware that rephrasing things isn't easy, but it really is in your best interests to do this. If you want, I can help you with a draftspace copy. However I do have to ask: do you have a conflict of interest with this company? I'm concerned by Bbb23's statement that some of your first edits were to promote the company, if I'm reading his phrasing correctly.  Tokyogirl79 (｡◕‿◕｡)  14:05, 7 October 2015 (UTC)
 * You can still edit with a conflict of interest, but you do need to disclose this per WP:COI. Tokyogirl79 (｡◕‿◕｡)  14:06, 7 October 2015 (UTC)
 * There is also the issue of attribution: if a page is deleted, and page that relies on the deleted page for attribution - such as a translation to a different-language wiki - now has a "broken" attitribution chain and as a result may be violating the license of the contributors to the deleted article. If you come along and knowingly use such a page as a source knowing that its attribution chain is broken, then people could legitimately claim that you are knowingly not respecting copyrights.  If this were a less sensitive case, the solition would be to un-delete the deleted English version then turn it into a stub and revision-delete all previous versions, then edit out any copyright-tainted content from the non-English versions, then translate from that "copyvio-clean" version.  This way the attribution history would be restored.  But given the history, the Orangemoody version and any article largely based on it in any language should be considered toxic.  Unless the non-Englsh Wikipedia's rules don't allow for it, the non-English version should be deleted as well.  davidwr/  (talk)/(contribs)  15:35, 7 October 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * The two accounts appear to be ❌ to each other. YeonJKim edits from Korea, which is a bit odd given the focus on Ukrainian material. They've also been promoting Epom Ad Server from their very first edits here. Hellenwho, more understandably, edits from the Ukraine. They have very few contributions, all to the Epom Ad Server. In my view, YeonJKim's contributions don't fit the behavioral patterns of OM socks. Harder to say about Hellenwho beause there are some OM socks who get in, make a handful of edits, and then stop using the account. At the same time, they don't fit the behaviors listed at Long-term abuse/Orangemoody/Accounts. I'm not closing this for the moment in case anyone else wants to comment.--Bbb23 (talk) 08:29, 4 October 2015 (UTC)
 * It's been a while. Closing.--Bbb23 (talk) 19:11, 11 October 2015 (UTC)

05 October 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

These editors all added "nuvorainc.com" as refspam (unreliable medical source per WP:MEDRS). No other account activity. Suspect there is a COI here. These are the ones I know about from the articles I watch, there may be others.
 * adds link to Salivary gland hypoplasia
 * adds link to Mouth breathing (the link does not support the content)
 * adds link to xerostomia (account created same day as McMatedngs)
 * adds link to Xerostomia Matthew Ferguson (talk) 06:05, 5 October 2015 (UTC)


 * Another


 * 

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  17:24, 8 October 2015 (UTC)
 * - per provided diffs.  Vanjagenije  (talk)  16:11, 5 October 2015 (UTC)
 * The following accounts are ✅ to each other:
 * Although some of the accounts did not add nuvorainc.com to articles, all of them share one trait. They all added refspam.  My conclusion is they are therefore technically and behaviorally related.  The behavior is just broader than at first thought.  This isn't the first time we've seen this kind of behavior (adding spammy external links) in other SPIs, and it's usually tied to paid editing.
 * The following accounts are ✅ to and ❌ to Xenoradixde:
 * SudhanshuSharma754 follows a similar editing pattern to other TejaswaChaudhary socks, whereas, at least thus far, DrSianBr does not. I can't explain the behavioral crossover with Xenoradixde, but DrSianBr is ✅ from TejaswaChaudhary’s socks.  Indeed, he used an IP address that has been used exclusively and extensively by TejaswaChaudhary’s socks.
 * is ❌ to any other account, even though behaviorally it's the same as Xenoradixde.
 * With the exception of RooterTrooper, I’ve blocked and tagged all the accounts based on the two masters. The clerk is free to block RooterTrooper based on behavior.--Bbb23 (talk) 22:47, 5 October 2015 (UTC)
 * Indeffing RooterTrooper and closing.
 * Although some of the accounts did not add nuvorainc.com to articles, all of them share one trait. They all added refspam.  My conclusion is they are therefore technically and behaviorally related.  The behavior is just broader than at first thought.  This isn't the first time we've seen this kind of behavior (adding spammy external links) in other SPIs, and it's usually tied to paid editing.
 * The following accounts are ✅ to and ❌ to Xenoradixde:
 * SudhanshuSharma754 follows a similar editing pattern to other TejaswaChaudhary socks, whereas, at least thus far, DrSianBr does not. I can't explain the behavioral crossover with Xenoradixde, but DrSianBr is ✅ from TejaswaChaudhary’s socks.  Indeed, he used an IP address that has been used exclusively and extensively by TejaswaChaudhary’s socks.
 * is ❌ to any other account, even though behaviorally it's the same as Xenoradixde.
 * With the exception of RooterTrooper, I’ve blocked and tagged all the accounts based on the two masters. The clerk is free to block RooterTrooper based on behavior.--Bbb23 (talk) 22:47, 5 October 2015 (UTC)
 * Indeffing RooterTrooper and closing.
 * is ❌ to any other account, even though behaviorally it's the same as Xenoradixde.
 * With the exception of RooterTrooper, I’ve blocked and tagged all the accounts based on the two masters. The clerk is free to block RooterTrooper based on behavior.--Bbb23 (talk) 22:47, 5 October 2015 (UTC)
 * Indeffing RooterTrooper and closing.

11 October 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Typical M.O. (see contribs), a few minor edits, followed by the creation of a fully developed article about a non-notable topic. Both article pages have been prepared as implausible redirects by Orangemoody socks in the past (see deletion log). Articles are All Car Leasing and Solution Inn. Note - it's also possible, that the accounts belong to the second unrelated group of socks in the same article area (see next-to-last Orangemoody case for some details about conflicting sock edits). GermanJoe (talk) 18:51, 11 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
. I will not be posting findings today. As frequently occurs, when I run a CU related to OM socks, it becomes complicated. The two listed puppets are relatively easy. It's what comes out in the wash that is tough.--Bbb23 (talk) 23:36, 11 October 2015 (UTC)
 * All of the accounts listed below use the same IP addresses.
 * Group 1 – The following accounts are ✅ to each other and exhibit OM behavior:
 * Group 2 – The following accounts are ✅ to each other and exhibit less clear OM behavior:
 * Group 3 – The following account is ✅ to previous OM socks and exhibits OM behavior:
 * Group 4 – The following account is ✅ to previous OM socks and behaviorally is more similar to Group 2:
 * Group 5 – The following account is technically ❌ to any of the accounts in Groups 1-4 or to a previous OM sock (that I’m aware of) but exhibits OM behavior:
 * I’ve blocked the accounts in Groups 1 and 3. I await comments as to the other three groups. Any accounts blocked as OM socks should be copied to the cleanup list, please.--Bbb23 (talk) 15:55, 12 October 2015 (UTC)
 * All accounts have the usual short histories, so only few details available: Rendydano, Koleksed and Fryon48 have each added a blatant spam link (edits > 100 bytes), between otherwise mostly pointless edits. Amlandebroy's article creation seems to be about a legit law firm, but exhibits all features of a paid article for a non-notable topic (puffery of trivial directory listings and self-written profiles, no independent in-depth sources - but needs AfD for a closer look). Pinedli has clearly just prepared an account for later usage. All of the listed accounts seem to be WP:NOTHERE one way or the other, with some consistent behaviorial evidence for paid socking. GermanJoe (talk) 18:36, 12 October 2015 (UTC)
 * Thanks for taking the time to review the behavior. I agree with everything you've just said, and I'm prepared to block most if not all of the unblocked accounts. The more narrow question is not whether they are involved in paid editing or are of no benefit to the encyclopedia, but are they OM socks, i.e., do they exhibit OM behavior?--Bbb23 (talk) 18:54, 12 October 2015 (UTC)
 * Really hard to say, of course they share some behaviour with Orangemoody socks (pointless Wiki-linking, mixing a spam-link between other harmless edits, minor formatting changes to raise the edit count), but such tactics are probably used by a large amount of other paid socks as well. There is just not enough available data to see a clear pattern or connection to OM or other groups. Without more information, I'd treat them as "possibly connected" just like you did in the original listing. (The last OM case, that I filed, was based on a central helper account and a lot easier to see in context). GermanJoe (talk) 19:25, 12 October 2015 (UTC)
 * Group 4 – The following account is ✅ to previous OM socks and behaviorally is more similar to Group 2:
 * Group 5 – The following account is technically ❌ to any of the accounts in Groups 1-4 or to a previous OM sock (that I’m aware of) but exhibits OM behavior:
 * I’ve blocked the accounts in Groups 1 and 3. I await comments as to the other three groups. Any accounts blocked as OM socks should be copied to the cleanup list, please.--Bbb23 (talk) 15:55, 12 October 2015 (UTC)
 * All accounts have the usual short histories, so only few details available: Rendydano, Koleksed and Fryon48 have each added a blatant spam link (edits > 100 bytes), between otherwise mostly pointless edits. Amlandebroy's article creation seems to be about a legit law firm, but exhibits all features of a paid article for a non-notable topic (puffery of trivial directory listings and self-written profiles, no independent in-depth sources - but needs AfD for a closer look). Pinedli has clearly just prepared an account for later usage. All of the listed accounts seem to be WP:NOTHERE one way or the other, with some consistent behaviorial evidence for paid socking. GermanJoe (talk) 18:36, 12 October 2015 (UTC)
 * Thanks for taking the time to review the behavior. I agree with everything you've just said, and I'm prepared to block most if not all of the unblocked accounts. The more narrow question is not whether they are involved in paid editing or are of no benefit to the encyclopedia, but are they OM socks, i.e., do they exhibit OM behavior?--Bbb23 (talk) 18:54, 12 October 2015 (UTC)
 * Really hard to say, of course they share some behaviour with Orangemoody socks (pointless Wiki-linking, mixing a spam-link between other harmless edits, minor formatting changes to raise the edit count), but such tactics are probably used by a large amount of other paid socks as well. There is just not enough available data to see a clear pattern or connection to OM or other groups. Without more information, I'd treat them as "possibly connected" just like you did in the original listing. (The last OM case, that I filed, was based on a central helper account and a lot easier to see in context). GermanJoe (talk) 19:25, 12 October 2015 (UTC)
 * All accounts have the usual short histories, so only few details available: Rendydano, Koleksed and Fryon48 have each added a blatant spam link (edits > 100 bytes), between otherwise mostly pointless edits. Amlandebroy's article creation seems to be about a legit law firm, but exhibits all features of a paid article for a non-notable topic (puffery of trivial directory listings and self-written profiles, no independent in-depth sources - but needs AfD for a closer look). Pinedli has clearly just prepared an account for later usage. All of the listed accounts seem to be WP:NOTHERE one way or the other, with some consistent behaviorial evidence for paid socking. GermanJoe (talk) 18:36, 12 October 2015 (UTC)
 * Thanks for taking the time to review the behavior. I agree with everything you've just said, and I'm prepared to block most if not all of the unblocked accounts. The more narrow question is not whether they are involved in paid editing or are of no benefit to the encyclopedia, but are they OM socks, i.e., do they exhibit OM behavior?--Bbb23 (talk) 18:54, 12 October 2015 (UTC)
 * Really hard to say, of course they share some behaviour with Orangemoody socks (pointless Wiki-linking, mixing a spam-link between other harmless edits, minor formatting changes to raise the edit count), but such tactics are probably used by a large amount of other paid socks as well. There is just not enough available data to see a clear pattern or connection to OM or other groups. Without more information, I'd treat them as "possibly connected" just like you did in the original listing. (The last OM case, that I filed, was based on a central helper account and a lot easier to see in context). GermanJoe (talk) 19:25, 12 October 2015 (UTC)


 * It doesn't look like we're going to get any more input (thanks again, ). I blocked the accounts in Groups 2 and 4 but without reference to this SPI. I left the account in Group 5 alone. Closing.--Bbb23 (talk) 22:30, 15 October 2015 (UTC)

14 October 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

RooterTroopers 3 and 4 are obviously connected to previously blocked sock RooterTrooper; both of them, and Ramesh4278, have added spam links with similarly misleading and overly capped edit summaries. The spammed links are not the same, but the behaviour is identical. bonadea contributions talk 15:03, 14 October 2015 (UTC)

Addition to the above: the link added by RooterTrooper3 (charlotteseofirm.com) and that added by Ramesh4278 (cohesivewebdesigns.com) are two different websites for the same SEO firm. --bonadea contributions talk 15:10, 14 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ✅ and as to the master:
 * Blocked, tagged, close.--Bbb23 (talk) 17:14, 14 October 2015 (UTC)
 * Blocked, tagged, close.--Bbb23 (talk) 17:14, 14 October 2015 (UTC)
 * Blocked, tagged, close.--Bbb23 (talk) 17:14, 14 October 2015 (UTC)
 * Blocked, tagged, close.--Bbb23 (talk) 17:14, 14 October 2015 (UTC)
 * Blocked, tagged, close.--Bbb23 (talk) 17:14, 14 October 2015 (UTC)

01 November 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Created Eurocar Group with content that is identical to All Car Leasing, which was created by one of the confirmed OM socks in the last SPI. MER-C 11:59, 1 November 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. Closing.  Vanjagenije  (talk)  13:16, 1 November 2015 (UTC)

10 November 2015

 * Suspected sockpuppets


 * note: added after case endorsed
 * note: added after case endorsed
 * note: added after case endorsed
 * note: added after case endorsed


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Checkuser confirmed OM actor Matt from Western Union added storefound.org to Western Union on October 3: [//en.wikipedia.org/w/index.php?title=Western_Union&diff=next&oldid=680944292]

Sock #3 added link to same domain a few hours after: [//en.wikipedia.org/w/index.php?title=Western_Union&diff=next&oldid=683899970].

Sock #1 added domain link to MetroPCS on September 2: [//en.wikipedia.org/w/index.php?title=MetroPCS&diff=next&oldid=678386957]

Sock #2 added domain link to OpenCable Application Platform on September 3: [//en.wikipedia.org/w/index.php?title=OpenCable_Application_Platform&diff=679239241&oldid=646850275] Brianhe (talk) 22:07, 10 November 2015 (UTC)


 * note: new evidence added after case endorsed

Another account appears to be connected to a checkuser-confirmed sock, :
 * Itinfocubeus adds SEO link to domain piltochart.com[//en.wikipedia.org/w/index.php?title=SuperMedia&diff=prev&oldid=677578007]
 * Swrded adds SEO link to domain thetexasseocompany.com [//en.wikipedia.org/w/index.php?title=SuperMedia&diff=next&oldid=677578007]
 * Swrded moves but retains other user's misplaced SEO link [//en.wikipedia.org/w/index.php?title=SuperMedia&diff=next&oldid=687262211]

New evidence added. Brianhe (talk) 01:12, 11 November 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Perhaps you should check Sockpuppet investigations/Xenoradixde (ongoing case). Another CheckUser - User:Elockid - recently confirmed a lot of accounts to be Orangemoody socks there. --Vachovec1 (talk) 01:18, 11 November 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - per provided diffs.  Vanjagenije  (talk)  22:14, 10 November 2015 (UTC)
 * Accounts are blocked as OM socks based on technical evidence supported by behavior. You can technically match one or more accounts, which means they may be socking, but it doesn't necessarily mean they are OM socks. The behaviors are articulated at Long-term abuse/Orangemoody/Accounts. With respect to the accounts listed here that are adding spam external links, the only behavior that comes closest to OM states: "Helper socks will usually complete a series of useless edits in order to be autoconfirmed. They then continue making gnoming-type edits that will periodically include the addition of spammy external links. Some of these socks also participate in Page Curation, and they will mark reviewed articles created by the other socks." The accounts listed at this SPI that have been adding spam external links do not match that behavior. They are making one or two edits and then stopping. Their edits are not part of a broader picture. There may, of course, be anomalies, and I'll get to one in my findings below, but we shouldn't label an account as an OM sock just because we can demonstrate technically that they are related to each other.
 * Group 1 – The following accounts are ❌ to each other:
 * Group 2 – The following accounts are to each other, principally because Tietjen906 is using a webhost and their location is therefore inconclusive:
 * Group 3 – The following accounts are ✅ to each other:
 * Group 4 – is ❌ to Groups 1, 2 and 3.  However, the account's technical characteristics are clearly that of OM socks blocked before August 31. The account is also ✅ from other accounts blocked by  as socks of OM. This is the anomaly I spoke of earlier. However, those other socks do exhibit OM behavior. For example,  has made many edits typical of a main or helper OM sock.
 * Group 5 – The following accounts are ✅ to each other and are OM socks. With one exception (Bosschib), they are all already blocked, mostly by one CheckUser and without tags:
 * (blocked by me)
 * I've blocked Forggialando, Bosschib, Georgiewaldo, and Mariancacek. No tagging.--Bbb23 (talk) 21:46, 11 November 2015 (UTC)
 * But, how were you able to check ? His last edit was more than 7 years ago.  Vanjagenije  (talk)  22:23, 11 November 2015 (UTC)  Vanjagenije   (talk)  22:23, 11 November 2015 (UTC)
 * Because I misspelled it here (now corrected).--Bbb23 (talk) 22:38, 11 November 2015 (UTC)
 * Group 4 – is ❌ to Groups 1, 2 and 3.  However, the account's technical characteristics are clearly that of OM socks blocked before August 31. The account is also ✅ from other accounts blocked by  as socks of OM. This is the anomaly I spoke of earlier. However, those other socks do exhibit OM behavior. For example,  has made many edits typical of a main or helper OM sock.
 * Group 5 – The following accounts are ✅ to each other and are OM socks. With one exception (Bosschib), they are all already blocked, mostly by one CheckUser and without tags:
 * (blocked by me)
 * I've blocked Forggialando, Bosschib, Georgiewaldo, and Mariancacek. No tagging.--Bbb23 (talk) 21:46, 11 November 2015 (UTC)
 * But, how were you able to check ? His last edit was more than 7 years ago.  Vanjagenije  (talk)  22:23, 11 November 2015 (UTC)  Vanjagenije   (talk)  22:23, 11 November 2015 (UTC)
 * Because I misspelled it here (now corrected).--Bbb23 (talk) 22:38, 11 November 2015 (UTC)
 * (blocked by me)
 * I've blocked Forggialando, Bosschib, Georgiewaldo, and Mariancacek. No tagging.--Bbb23 (talk) 21:46, 11 November 2015 (UTC)
 * But, how were you able to check ? His last edit was more than 7 years ago.  Vanjagenije  (talk)  22:23, 11 November 2015 (UTC)  Vanjagenije   (talk)  22:23, 11 November 2015 (UTC)
 * Because I misspelled it here (now corrected).--Bbb23 (talk) 22:38, 11 November 2015 (UTC)
 * I've blocked Forggialando, Bosschib, Georgiewaldo, and Mariancacek. No tagging.--Bbb23 (talk) 21:46, 11 November 2015 (UTC)
 * But, how were you able to check ? His last edit was more than 7 years ago.  Vanjagenije  (talk)  22:23, 11 November 2015 (UTC)  Vanjagenije   (talk)  22:23, 11 November 2015 (UTC)
 * Because I misspelled it here (now corrected).--Bbb23 (talk) 22:38, 11 November 2015 (UTC)
 * I've blocked Forggialando, Bosschib, Georgiewaldo, and Mariancacek. No tagging.--Bbb23 (talk) 21:46, 11 November 2015 (UTC)
 * But, how were you able to check ? His last edit was more than 7 years ago.  Vanjagenije  (talk)  22:23, 11 November 2015 (UTC)  Vanjagenije   (talk)  22:23, 11 November 2015 (UTC)
 * Because I misspelled it here (now corrected).--Bbb23 (talk) 22:38, 11 November 2015 (UTC)


 * Dear investigators: I work mainly at AfC, and I am one of the editors who has been impersonated by those requesting money for editing.  I have completed about 200 history merges of copy-pastes from AfC to mainspace. Four of these have been deleted by the OrangeMoody project here.  Would it help if I provided a list of the others, and if so, what time frame should I include?&mdash;Anne Delong (talk) 23:49, 12 November 2015 (UTC)
 * I didn't understand you at all. What kind of list? What was deleted?  Vanjagenije  (talk)  19:19, 13 November 2015 (UTC)
 * , I'm sorry that I wasn't clear. I was reading the description of the characteristics to watch for in the Orangemoody sockpuppets. I was particularly interested because it finally explained the weird messages I received a few months ago, in which editors were thanking me for offering to improving their pages, when I hadn't made any offers.  One of the activities of the sockpuppets was apparently finding declined AfC submissions and pasting them into mainspace.  As part of my work at AfC, I have history merged about 200 submissions like this, and it occurred to me that some of the pasting may have been done by the sockpuppet editors you are looking for. What called this to my attention is that four of the resulting articles have been deleted as a result of this investigation. (I am not complaining about this.)  Since I have a list of these merges (HERE), it occurred to me that the investigators may want to look at it, in case there are more sockpuppet edits hidden in these former copy-pastes.  I don't like the idea that I have been inadvertently helping these people. If this isn't useful, just say so and I will go back to work.&mdash;Anne Delong (talk) 23:42, 13 November 2015 (UTC)
 * PS - Is this the type of thing that is I should report: Draft:Lab Made was copied to the sandbox of a brand new user, and who then copied it to mainspace at Lab Made after six edits.  It was then tagged as an advertisement. Doesn't an editor have to be autoconfirmed to move a page?&mdash;Anne Delong (talk) 17:13, 14 November 2015 (UTC)
 * Yes, he does. But that page was not moved, but copied, as you said.  Vanjagenije  (talk)  10:39, 15 November 2015 (UTC)


 * By the way, I reviewed (some of) those pages you history-merged. It is possible that some of those users who copy-pasted are Orangemoody, but all those accounts were abandoned long time ago and are now. So, it is impossible to investigate anything. For that reason, I'm closing this.  Vanjagenije   (talk)  10:47, 15 November 2015 (UTC)

07 November 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Spamming for
 * lawncaresucks.com: ShawnSaverPardonJacoker Pranjoker RogerBates78 Vekulova Patrickswep (blocked in previous SPI)Albozian
 * sumax.de: ShawnSaver Utronjakerob PaltuoDrussel Prasanth5555 Behenhedr
 * cohesivewebdesigns.com (spammed in previous report): Prasanth5555

I've got a feeling there are more of these... MER-C 11:09, 7 November 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  18:53, 7 November 2015 (UTC)
 * - to confirm socking and flush possible sleepers as a prima facie case has been made. I note that Albozian is the oldest account from what is listed above.
 * With exception to Group 6, each account listed for each group are ✅ matches to each other:
 * Group 1: ❌ to any group


 * Group 2: ❌ to any group




 * Group 3: ❌ to any group, ✅ to be Xenoradixde. Based on some accounts such as,, and , there could be some relation to Orangemoody.


 * Group 4: Technically speaking, to any group (some apparent proxying going on here),  relation to Group 1.


 * Group 5: Appears to be technically ❌ to any group


 * Group 6: Please double check these, they're technically related to Group 3:
 * now ✅
 * now ✅
 * now ✅
 * now ✅
 * now ✅
 * now ✅
 * now ✅
 * now ✅
 * now ✅


 * and appear to be ❌ to any account listed.  Elockid  Message me 22:05, 7 November 2015 (UTC)


 * I believe I may have missed some accounts. I won't be able to do another concise check until Tuesday. Will relist for now and if there are no takers, I will perform another check on Tuesday. Elockid  Message me 22:08, 7 November 2015 (UTC)
 * Could I invite the checkuser to check over this spam report, which I believe is related. -- zzuuzz (talk) 11:03, 8 November 2015 (UTC)

Domains added by Groups 1 through 5 not mentioned above:
 * lwaccounting.ca: Hariimjacob
 * dreamhomeresource.com: OprkrtRator
 * hippressurecooking.com: OprkrtRator
 * tvsmash.com: Weosld
 * nukleusorganicwear.com.au: Derdbfed
 * uwpgroup.co.uk: Lokenied
 * bestriflescopereview.com: Defcoseil
 * portable-airconditioner.co.za: Kilnedrois5
 * acomservicing.sg: Diknesro
 * findfloridadentist.com: Sedikilo
 * inflationzone.com: Renhikol
 * theshoebarn.net: Jilander
 * petraequipment.com.au: Julianedispol
 * thetexasseocompany.com: Swrded
 * dynamikk.ca: Kajelandi
 * coffeelounge.net: Kimaliredn
 * imagebydesignmd.com: Mattkegel55
 * mustywig.net: Hldutted
 * kpopsurgery.com: Fededngd
 * aramendia.com: Lugan445
 * ccmanga.com: Lierdes
 * medievaldays.com: Dibinruts

Additional domains spammed in report dated 5 October 2015:


 * nuvorainc.com: (as reported)
 * projektting.de: Amroon45

Additional domains spammed in report dated 14 October 2015:

Blacklisted, blocked Groups 1 through 5 and tagged Group 3. This list was generated by automatic diff parsing, so some stuff may be missed. MER-C 16:31, 8 November 2015 (UTC)
 * charlotteseofirm.com: RooterTrooper3
 * kabtechusa.com: RooterTrooper4
 * It continues:
 * thunderingsound.com, spam blacklist hits for portable-airconditioner.co.za
 * MER-C 18:03, 8 November 2015 (UTC)
 * MER-C 18:03, 8 November 2015 (UTC)

Dshedik is ✅ to Xenoradixde plus the following accounts. I can now say that all the accounts below and for Group 3 are now ✅ to be :

Elockid Message me 20:51, 9 November 2015 (UTC)

More ✅ socks of Xenordide/Orangemoody:

Elockid Message me 21:07, 9 November 2015 (UTC)


 * There's still quite a number of ranges an IPs I haven't checked yet. But due to the sheer size of the number of accounts, it will take some time to list them all.
 * , I've started to look at the report. So far, not much going on. Elockid  Message me 21:49, 9 November 2015 (UTC)
 * Some confirmed crossover with OrangeMoody per User:Denheforal listed above. -- zzuuzz (talk) 06:52, 10 November 2015 (UTC)
 * Another large sockfarm. It's very tedious to list, so I just blocked and tagged em.
 * Accounts from Range 1:
 * Accounts from Range 2:
 * Accounts from Range 2:
 * Accounts from Range 2:

Elockid Message me 22:21, 9 November 2015 (UTC)
 * Blocked and tagged the two large batches above as Orangemoody and deleted all articles created (I think). MER-C 19:45, 10 November 2015 (UTC)


 * Why is Dshedik not blocked?  Vanjagenije  (talk)  22:28, 11 November 2015 (UTC)
 * That was part of the batch of socks I was listing before I started blocking them myself. I've blocked it now. Elockid  Message me 22:33, 11 November 2015 (UTC)
 * Just as a status update. I'm still looking at the case. So far not much other results for now. Elockid  Message me 22:35, 11 November 2015 (UTC)
 * I haven't found much other activity. I've already taken some action since my last post and will continue to monitor. Marking for close for now. Elockid  Message me 18:15, 14 November 2015 (UTC)


 * Shouldn't this be history-merged into the Orangemoody investigation?  Vanjagenije  (talk)  18:30, 14 November 2015 (UTC)
 * Oh yes, forgot about that. Elockid  Message me 18:45, 14 November 2015 (UTC)


 * ✅ and closing.  Vanjagenije  (talk)  17:52, 15 November 2015 (UTC)

18 December 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Obviously these accounts are stale; all six users stopped editing in May/June 2015. However, the behavioural evidence is very strong and I was advised by DGG to file an SPI because the information will add to the net of socks, and might help identify others. All eight articles below (with one exception) were/are on non-notable company-related topics. All eight were started by the editor making a series of random minor edits to become autoconfirmed, creating a (usually implausible) redirect and returning a few days later to turn it into an article. The articles, despite being from allegedly new editors, spring fully formed with multiple perfectly formatted spurious/misleading references, and a perfectly formatted infobox. The first four articles were about firms connected to two articles by known Orangemoody socks—three to 20Collective and one to Armchair Committee. All eight articles were marked as reviewed by confirmed Orangemoody socks. Below are the six users and their articles. Note that most of these have now been deleted, so only admins will be able to see the diffs.

Created by Jiaulinoisk
 * Sam Gibson Weddings: creation diff review log AfD

Created by Armvecciol
 * Neil Palmer Photography: creation diff review log AfD
 * Wasaphone: creation diff review log AfD

Created by Fedrickson43
 * York Place Studios: creation diff review log AfD
 * Oliver Preston: creation diff review log (not at AfD, a notable subject) However, note that Draft:Oliver Preston created by was rejected by AfC on 7 April 2015 and he appears not to have edited it any further. On 23 April 2015, Fedrickson43 created it as a redirect and two days later turned it into an article, fully formed and professionally formatted, with no credit to any previous drafts. Garrigan's draft was deleted last month as an abandoned AfC submission.

Created by Jilanioski (note username similarity to Jiaulinoisk above)
 * Paperstone: creation diff review log AfD PROD removed today by a newly created SPA who is obviously related in some way to the Paperstone company.

Created by Droinglipse
 * Neumarkets: creation diff review log AfD Two users have identified themselves as being employees/founders of Neumarkets: and . They registered their accounts in 2014 but have made no edits apart from their user pages and may have been the clients of Droinglipse/Orangemoody. In June 2015, shortly after the article was created, 69.159.30.63 updated Evanrwhite's user page . Yesterday, an IP from the same range (which resolves to the city where the company is located) removed the PROD from Neumarkets.

'''Created by Jackiinson45
 * creation diff review log (I have re-redirected this to Reality Changers, but don't know how long this will last.)

Voceditenore (talk) 07:21, 18 December 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Endorsing for CU attention strictly because CUs have asked to be handed Orangemoody-related cases directly. ☺ ·  Salvidrim!   ·  &#9993;  17:56, 21 December 2015 (UTC)
 * Yes, pretty much all of the accounts are . Looking at the behavior of the accounts and reviewing them against those of the orangemoody case, I don't think these accounts are related. There are some hallmarks missing. I also reviewed the technical data of and it seems  to be related. (New account editing Paperstone article.) There might be some paid editing involved, but I doubt it's related here. I'll leave it to the closing admin to decide the merit of any blocks. <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 23:55, 21 December 2015 (UTC)
 * Closing with no action taken.  Vanjagenije  (talk)  00:14, 22 December 2015 (UTC)

29 December 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Four spam-only accounts (where at least one of the accounts has hidden refspam with less spammy refs in the manner of Orangemoody et al - see this) linked by some of the spam links added. The sockmaster has been blocked for spamming, but the other three accounts were created well before the block. I suspect there may be others, because there often are with this kind of spammer.

Diffs linking Ninzax99 and Hazmsilop: and  (adding refspam to bostonexecutivelimoservice.com)

Diffs linking Ninzax99 and Bladhark: and  (adding refspam to cittadiniditwitter.com - also note that Bladhark, who added several spam links to that domain to the Microblogging article, removed Ninzax99' link here).

Diffs linking Ninzax99 and WANIA44: and  (adding refspam to papillonevents.co.uk - see also  and ) bonadea contributions talk 14:29, 29 December 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ❌:
 * The following accounts are ✅:
 * I blocked the confirmed accounts without tags.
 * This SPI should be merged to Sockpuppet investigations/Orangemoody. The accounts' technical characteristics, which are distinctive, match many OM socks, and the OM behavioral characteristics are also present. Many of these accounts do more than just add refspam.--Bbb23 (talk) 20:28, 29 December 2015 (UTC)
 * ✅, merged and tagged. Closing.  Vanjagenije  (talk)  22:29, 29 December 2015 (UTC)
 * The following accounts are ✅:
 * I blocked the confirmed accounts without tags.
 * This SPI should be merged to Sockpuppet investigations/Orangemoody. The accounts' technical characteristics, which are distinctive, match many OM socks, and the OM behavioral characteristics are also present. Many of these accounts do more than just add refspam.--Bbb23 (talk) 20:28, 29 December 2015 (UTC)
 * ✅, merged and tagged. Closing.  Vanjagenije  (talk)  22:29, 29 December 2015 (UTC)
 * I blocked the confirmed accounts without tags.
 * This SPI should be merged to Sockpuppet investigations/Orangemoody. The accounts' technical characteristics, which are distinctive, match many OM socks, and the OM behavioral characteristics are also present. Many of these accounts do more than just add refspam.--Bbb23 (talk) 20:28, 29 December 2015 (UTC)
 * ✅, merged and tagged. Closing.  Vanjagenije  (talk)  22:29, 29 December 2015 (UTC)
 * I blocked the confirmed accounts without tags.
 * This SPI should be merged to Sockpuppet investigations/Orangemoody. The accounts' technical characteristics, which are distinctive, match many OM socks, and the OM behavioral characteristics are also present. Many of these accounts do more than just add refspam.--Bbb23 (talk) 20:28, 29 December 2015 (UTC)
 * ✅, merged and tagged. Closing.  Vanjagenije  (talk)  22:29, 29 December 2015 (UTC)
 * I blocked the confirmed accounts without tags.
 * This SPI should be merged to Sockpuppet investigations/Orangemoody. The accounts' technical characteristics, which are distinctive, match many OM socks, and the OM behavioral characteristics are also present. Many of these accounts do more than just add refspam.--Bbb23 (talk) 20:28, 29 December 2015 (UTC)
 * ✅, merged and tagged. Closing.  Vanjagenije  (talk)  22:29, 29 December 2015 (UTC)
 * I blocked the confirmed accounts without tags.
 * This SPI should be merged to Sockpuppet investigations/Orangemoody. The accounts' technical characteristics, which are distinctive, match many OM socks, and the OM behavioral characteristics are also present. Many of these accounts do more than just add refspam.--Bbb23 (talk) 20:28, 29 December 2015 (UTC)
 * ✅, merged and tagged. Closing.  Vanjagenije  (talk)  22:29, 29 December 2015 (UTC)
 * This SPI should be merged to Sockpuppet investigations/Orangemoody. The accounts' technical characteristics, which are distinctive, match many OM socks, and the OM behavioral characteristics are also present. Many of these accounts do more than just add refspam.--Bbb23 (talk) 20:28, 29 December 2015 (UTC)
 * ✅, merged and tagged. Closing.  Vanjagenije  (talk)  22:29, 29 December 2015 (UTC)