Wikipedia:Sockpuppet investigations/SethMacfarlaneGypsy/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Pinging as blocking admin. Adding the same paragraph as all the other socks. d.g. L3X1 (distænt write)   )evidence(  14:31, 26 June 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  16:09, 11 July 2017 (UTC)
 * Both accounts blocked. Closing. Bbb23 (talk) 15:21, 26 June 2017 (UTC)
 * Post-move, post archive note: (case originally filed under this name, CU results reflect this account was confirmed to Mathhewbooms.

Non-stale accounts

 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)
 * (found from block statement at Special:Contributions/MediaBitsNBytes, did not show up in report)


 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * Please see this AN thread.
 * Of the 58 accounts listed above, I checked deleted contribs for all accounts and there aren't any.
 * I checked most of the accounts for cross-wiki abuse and did not see any.

All are throwaway accounts making the same duck edits as the accounts listed in the archive. That is, they make hoax refspam which is patently false but it allows them to advertise and promote the same book. From the archive one of the sock edits which compares to one of the socks above making this edit. They all make these fake refspams just like that.


 * Two accounts appear coincidental and not part of the group as noted below:


 * This looks like an established editor that restored the link from where an IP had removed it. I think his restoration was done in good faith and I do not think he is related to this group but mentioning this for completeness since he was listed in the SQL report.
 * This looks like an established editor that restored the link from where an IP had removed it. I think his restoration was done in good faith and I do not think he is related to this group but mentioning this for completeness since he was listed in the SQL report.


 * This editor appears to have tried to revert the link back but unlikely to have been a spammer. Their general MO is to obsess with Olsen twins and Star Trek and they are just combative in general but not likely part of this group. Coincidental revert. Here's a revert that looks to be replacing a well-known LTA edit (Best Known For)...once again, this looks to be coincidental although the way they act, they could be related in real life. SPI case archive. This user included to make sure that we haven't overlooked any accounts from the SQL report.
 * This editor appears to have tried to revert the link back but unlikely to have been a spammer. Their general MO is to obsess with Olsen twins and Star Trek and they are just combative in general but not likely part of this group. Coincidental revert. Here's a revert that looks to be replacing a well-known LTA edit (Best Known For)...once again, this looks to be coincidental although the way they act, they could be related in real life. SPI case archive. This user included to make sure that we haven't overlooked any accounts from the SQL report.

— Berean Hunter   (talk)  22:35, 10 July 2017 (UTC)
 * Need checkusers to determine the situation. Do we have meats across the globe or one or two very determined spammers? Please confirm socks, route out any others that we may have missed and block IPs or ranges as necessary so that we may deter them.

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  22:47, 10 July 2017 (UTC)
 * per the evidence listed above.
 * - It's going to take me a while to work through this, probably most of today and maybe into tomorrow, but I'll plug away at it. Katietalk 14:28, 11 July 2017 (UTC)
 * Decided to take this in chunks. These accounts are ✅ to each other:


 * So far LeeSongXi is the oldest account, but I still need to check a bunch more. All but one were already blocked. Stay tuned. Katietalk 14:46, 11 July 2017 (UTC)


 * Second group, both ✅ to each other and the first group:
 * - Katietalk 14:53, 11 July 2017 (UTC)
 * - Katietalk 14:53, 11 July 2017 (UTC)


 * And still more:
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)
 * - Katietalk 15:11, 11 July 2017 (UTC)

— Berean Hunter   (talk)  15:48, 11 July 2017 (UTC) — Berean Hunter   (talk)  16:36, 11 July 2017 (UTC) — Berean Hunter   (talk)  17:16, 11 July 2017 (UTC)
 * Pretty sure that's all; not as difficult as I anticipated. I put one rangeblock down, but the second one will have more collateral and I'd rather hold off until/unless it's necessary.  Ramesh chotu is the oldest account but it's a sleeper with no edits, so I think LiFulming will be the oldest account. Please verify, move the SPI and tag accordingly.  Katietalk 15:20, 11 July 2017 (UTC)
 * Okay, I moved the casename to the oldest account which is SethMacfarlaneGypsy created May 26, 2016. I haven't tagged yet because I'm a little confused. Katie, I see that you have CU blocked the two accounts that I didn't think belonged to the others, 1 & 2. Does this mean that they are confirmed to the others? If so, then I will need to move again as Ibrahim was created in 2013.
 * Ack - they were in the middle of that long list and I missed unchecking the boxes. I've unblocked/reblocked both accounts. Katietalk 15:54, 11 July 2017 (UTC)
 * Case closed.  Vanjagenije  (talk)  16:29, 11 July 2017 (UTC)
 * Case placed on hold. I've just applied blocks and tags and still checking things...I hadn't finished with the case. Dirk has reports that are still being generated and the length of this case requires more time to check over.
 * At the risk of spilling some beans, I'm wanting to look through this list where there are shy of 300 articles that are linked. I didn't know if had already tried that strategy or not. I've begun but now breaking for lunch.

— Berean Hunter   (talk)  19:02, 11 July 2017 (UTC)
 * Blunt weapon (likely needs to be implemented next to blacklisting): I've placed this on XLinkBot's revertlist, setting it to maximum overrule (it basically reverts everyone who does not have 'given rights' who add this link, and reports that user without warning to AIV. That may have some collateral damage in that a 'not-too-regular regular' may revert the link back in after a removal, and that editor will then be reverted and reported to AIV.
 * Don't hold your breath in waiting for the backlog to resolve. It will very likely show more editors, but the backlog is so big (/me mutters something bad about excessively high-speed bots on WikiData) that it will take a long time to be parsed (weeks, at best). --Dirk Beetstra T C 17:18, 11 July 2017 (UTC)
 * Also blacklisted per log. --Dirk Beetstra T  C 17:37, 11 July 2017 (UTC)
 * Excellent, we seem to have our security well-implemented in layers. We can file subsequent SPI reports for follow-up when other accounts are found but for now we seem to have everything in order so I'll go ahead and close this. Thank you, everyone.

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Return of "The Last Seance" spammer. Exact same wording, different link (the original link was blacklisted, I think). Old diff, and recent diff for comparison. There are probably other accounts, but I haven't seen any other edits besides those three. --Bongwarrior (talk) 08:42, 16 September 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  02:31, 17 September 2017 (UTC)
 * - As per history of socking and sleepers. Thanks, GABgab 15:29, 16 September 2017 (UTC)
 * Yep, I was able to find the unblocked accounts:, and . All three are now blocked. Courcelles (talk) 01:10, 17 September 2017 (UTC)
 * Tagging and closing.