Wikipedia:Sockpuppet investigations/Signature editing group/Archive

Suspected sockpuppets
This appears to be a somewhat sophisticated but small cross-wiki socking/UPE ring that uses a number of accounts across different wikis in order to attempt to evade detection. Fortunately (for us), they've been a bit sloppy, and have thereby revealed their connections.

The master (under which I'm filing this) was initially softer-blocked for having a group username. The master had uploaded c:File:Frontier communications logo 2022.png to Commons at 15:07 on 8 May 2022, but was blocked at 15:04 on 8 May 2022 after making this edit to the article on JCPenney. At 15:10 on 8 May 2022, the sock made the exact same edit to the article and proceded to add the image the master had uploaded to the article Frontier Communications.

The sockpuppet has edited almost exclusively about corporations (with one exception among its dozens of edits). Some of its edits, such as this one, added images to the articles in order to update corporate logos. However, upon closer inspection, some of these were handled a bit oddly; in this edit, which was made at 15:49 on 17 May 2023, added a logo that had been uploaded at 15:48 on 17 May 2023 by a wholly separate account (Signature Editor Wiki143033) that was not registered on the English Wikipedia. It would be quite hard to independently add an image to an article a mere one minute after it is uploaded, and the account names were quire similar, so it appears that is related to that Commons account.

The activity of the Commons user "Signature Editor Wiki143033" has exclusively been to upload corporate logos: including deleted revisions, it has uploaded thirteen logos for separate companies. Given the previous behavior, I had expected that these would have been added to various Wikipedia articles by the same "Signature editing" account. However, looking at who actually did that, I found the results to be surprising: another editor appeared to have been adding the various images uploaded by "Signature Editor Wiki143033" to EnWiki articles. These include (but are not limited to) the (added to EnWiki one minute after upload), the  (added to EnWiki two minutes after upload), the  (added to EnWiki four minutes after upload), and the  ( the same minute as upload). These interactions are clearly more than a coincidence; it would be nigh impossible for two accounts to independently do this so many times across a period spanning over one year.

For these reasons, it appears that the Commons account "Signature Editor Wiki143033" is connected both to and. Since is clearly connected to the master, so too must be.

Given the naming pattern here with some of the accounts, I looked for other similarly named accounts on Commons that have a like relationship with EnWiki accounts. I turned up "Signature Editor wiki 12". As it turns out, that account uploaded File:First student logo 2022.png at 20:43 on 3 September 2022, which was then placed in a Wikipedia article by a mere three minutes later. I also noticed that the account had uploaded a (now-deleted) file at c:File:Marqeta logo.png; had created a draft about a company bearing that name. That company had also previously attempted to pay an editor to create an article about it: disclosed that they were paid marketing staff of Marqueta and had created a draft in 2021. (I don't suspect that Onelittlesong is part of this ring per se, but I include this as evidence that at least some of the companies whose articles/drafts were involved have had a history of paying people to make edits related to them).

The use of all of these accounts (at minimum) appears to be an attempt to evade scrutiny on any individual account and to obscure the connections between them. I'm frankly not able to explain the use of a Commons account to obscure the uploading of images, and then the excessive corporate focus, without the possibility of UPE coming into the front of my mind. As WP:SOCK notes that Using alternative accounts that are not fully and openly disclosed to split your editing history means that other editors may not be able to detect patterns in your contributions... it is a violation of this policy to create alternative accounts to confuse or deceive editors who may have a legitimate interest in reviewing your contributions, and that sort of use of multiple accounts on EnWiki to confuse people giving scrutiny to contributions has gone one here, this is a clear a violation of our sockpuppetry policies.

I cannot rule out that I have missed an account on EnWiki, but these behaviorally look very suspicious together. The accounts are probably all stale on EnWiki (except for the first listed sock), so a CU probably won't be fruitful. — Red-tailed hawk  (nest) 05:00, 10 September 2023 (UTC)


 * In addition to the above, the first non-deleted edits by were made to Toys "R" Us, a page to which  has also contributed. —  Red-tailed hawk  (nest) 05:31, 10 September 2023 (UTC)
 * Also, for posterity sake, I'm going to note that there's some evidence that some (global) sleepers may exist based off of naming pattern:
 * Based off of naming pattern, even though there are apparent (global) sleepers here, many are either not registered on EnWiki, have no global contributions, or are stale. — Red-tailed hawk  (nest) 05:31, 10 September 2023 (UTC)
 * Based off of naming pattern, even though there are apparent (global) sleepers here, many are either not registered on EnWiki, have no global contributions, or are stale. — Red-tailed hawk  (nest) 05:31, 10 September 2023 (UTC)
 * Based off of naming pattern, even though there are apparent (global) sleepers here, many are either not registered on EnWiki, have no global contributions, or are stale. — Red-tailed hawk  (nest) 05:31, 10 September 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * I doubt it's actually related, but has the same curious username spelling. — Preceding unsigned comment added by RoySmith (talk • contribs) 13:44, 30 September 2023 (UTC)
 * - The relation between all the "Signature editing" accounts is obvious. RandomEtidor adding several logos minutes after other accounts uploaded to Commons also makes it fairly clear. Also see . While the "Signature editing" accounts seem to be all stale, I am requesting a check for sleepers. MarioGom (talk) 07:39, 8 October 2023 (UTC)
 * In terms of an enwp CU investigation, the only non-stale thing I can tell you is that RandomEtidor is confirmed to . And that's not much help.  Sorry. Courcelles (talk) 16:48, 10 October 2023 (UTC)
 * Actually,, that is a good deal of help, because the deleted editing history makes the connection of Wikipedianlmao2 to the "Signature editing" accounts clear, and your CU information then connects that to RandomEtidor, in my opinion beyond all reasonable doubt. I shall therefore block all the accounts that are not already blocked. (Etidor, however, seems to be totally irrelevant.) JBW (talk) 20:19, 12 October 2023 (UTC)
 * OK, the accounts "Signature Editor wiki 12", "Signature Editor Wiki", "Signature Editor wiki 11345", and "Signature Editor 123098" don't exist on English Wikipedia (though they do on other projects) so there's nothing to be done about them. The others are all now blocked, and I shall add tags. JBW (talk) 20:29, 12 October 2023 (UTC)