Wikipedia:Sockpuppet investigations/Service kompor gas/Archive

16 February 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

DUCK. User is a spammer. I suspect there are, but am not sure how to search the user creation log for them. Wildcards don't seem to work in the search strings.  Eve rgr een Fir  (talk) Please &#123;&#123;re&#125;&#125; 23:09, 16 February 2015 (UTC)

Any chance you can move that SPI here? This one has the oldest account as master.  Eve rgr een Fir  (talk) Please &#123;&#123;re&#125;&#125; 01:07, 17 February 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Aside from the similar username, there are similar edits:

diff diff

Raising this SPI just for reference in case the user creates more accounts. 5 albert square (talk) 23:19, 16 February 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
there is another case open at Sockpuppet investigations/SERVICE KOMPOR GAS MODENA. It does look like all the other accounts have either been blocked or globally locked. Elockid  ( Talk ) 01:00, 17 February 2015 (UTC)

Case merged from SERVICE KOMPOR GAS MODENA. Elockid  ( Talk ) 01:13, 17 February 2015 (UTC)
 * merged. Elockid  ( Talk ) 01:13, 17 February 2015 (UTC)


 * Everything seems to be in order, closing. Mike V • Talk 03:09, 17 February 2015 (UTC)

17 February 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User is spamming "SPECIALIS SERVICE KOMPOR GAS" like the blocked accounts did. See user page and this edit for an example. I think a check user may be in order to find any possible sleeper accounts. APK whisper in my ear  06:44, 17 February 2015 (UTC) APK  whisper in my ear  06:44, 17 February 2015 (UTC)
 * In addition to the accounts mentioned in the previous case, there are many more including:

APK whisper in my ear  07:15, 17 February 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * There is no need to look up on this, the username has been blacklisted and all the 35 accounts created by this spambot has been "Locked" by 2 stewards.-- Stemoc 11:46, 17 February 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * This is probably the same as the above, but there the collateral is pretty big so a block isn't going to to be possible. Revert and block (just report to AIV rather than here) is probably going to be the best idea. Callanecc (talk • contribs • logs) 11:17, 17 February 2015 (UTC)
 * Why is one sock account not blocked (User:Service Kompor Gas ARISTON MODENA DAN SEMUA MERK hub089636568012)?  Vanjagenije  (talk)  11:37, 17 February 2015 (UTC)
 * It seams that the oldest of all those accounts (sockmaster) is User:Service kompor gas. The investigation should be moved to new title.  Vanjagenije  (talk)  11:41, 17 February 2015 (UTC)


 * The account hasn't been blocked because the account is already globally locked, which means the user can't even sign in to the account. Normally with spambot accounts, it's not worth the effort to tag and move it to the oldest account as there's not much to gain from it. (Though I moved the case since it only took 10 seconds.) <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 18:20, 18 February 2015 (UTC)

25 February 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

near identical user names using user pages for promotional purposes Deunanknute (talk) 02:17, 25 February 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
All blocked as spammers and sockpuppets. Also blocked User:SERVICE-KOMPOR GAS (CALL CENTER) and User:SERVICE-KOMPOR GAS ARISTON,TECNOGAS,MODENA HUB : 0878-0824-2095 as obvious socks. All hardblocked, hopefully the autoblock will stop more socks. Since it's probable that a single, probably static IP is responsible, checkuser action would be helpful.  Acroterion   (talk)   03:08, 25 February 2015 (UTC)
 * Please merge this to Sockpuppet investigations/Service kompor gas.
 * I looked at these accounts and would rather not block the range at this time. If more appear, we can make a decision then. ​—DoRD (talk)​ 03:28, 25 February 2015 (UTC)
 * Admin-clerk is needed to merge the case with Sockpuppet investigations/Service kompor gas.  Vanjagenije  (talk)  12:08, 25 February 2015 (UTC)
 * Case moved from "SPI/(SERVICE ARISTON KOMPOR GAS)" to "SPI/Service kompor gas"


 * All accounts blocked without tags (as is usual for spambots), case moved under correct title for archival. ☺ ·  Salvidrim!   ·  &#9993;  18:43, 25 February 2015 (UTC)
 * I'll notify of these "new" accounts since the user seems to be liberally bypassing the global blacklist entry put in place, which probably needs to be tweaked. ☺ ·   Salvidrim!   ·  &#9993;  18:45, 25 February 2015 (UTC)

03 March 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same name pattern and spam on user page. Requesting CU as this user is known to make a huge number of accounts  Eve rgr een Fir  (talk) Please &#123;&#123;re&#125;&#125; 04:34, 3 March 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Pinging in case they are not aware of this SPI as they seem to be patrolling new accounts as well and this sockmaster is actively making socks.  Eve rgr een Fir  (talk) Please &#123;&#123;re&#125;&#125; 05:02, 3 March 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - All three above accounts are globally locked, but I'm endorsing for CU since last time DoRD mentioned a possible rangeblock if abuse continue. Note also that Billinghurst tried a global blacklist entry but it doesn't seem to have had the desired efffect. ☺ ·  Salvidrim!   ·  &#9993;  05:12, 3 March 2015 (UTC)
 * Rangeblock is far from feasible right now. Add to your socklist of non-locked accounts:
 * -- DQ   (ʞlɐʇ)  05:41, 3 March 2015 (UTC)
 * -- DQ   (ʞlɐʇ)  05:41, 3 March 2015 (UTC)
 * -- DQ   (ʞlɐʇ)  05:41, 3 March 2015 (UTC)
 * -- DQ   (ʞlɐʇ)  05:41, 3 March 2015 (UTC)
 * -- DQ   (ʞlɐʇ)  05:41, 3 March 2015 (UTC)


 * Comment. I have added some more to the meta title blacklist, and I think that a spam filter would have some effect here. — billinghurst  sDrewth  09:24, 3 March 2015 (UTC)


 * All are blocked. No need to tag them. Global blacklist updated. Closing the case.  Vanjagenije  (talk)  09:32, 3 March 2015 (UTC)
 * started a tagging filter Special:AbuseFilter/669 which we should track and update as required. Please knock on my user talk if you need me to do more. — billinghurst  sDrewth  09:36, 3 March 2015 (UTC)
 * Will it also detect cases when a hyphen is used (like "KOMPOR-GAS" ans "SEVICE-KOMPOR")? We had several of those.  Vanjagenije  (talk)  09:42, 3 March 2015 (UTC)
 * Updated filter to capture terms. It can be improved as a filter, it is just a quick and dirty. If they start to undertake filter ducking, then we should look to use regex. — billinghurst  sDrewth  01:55, 6 March 2015 (UTC)


 * Thanks, hopefully the hurdle will be helpful is slowing down this abuse. ☺ ·  Salvidrim!   ·  &#9993;  03:53, 6 March 2015 (UTC)