Wikipedia:Sockpuppet investigations/Yoodaba/Archive

Suspected sockpuppets

 * Originally filed under this user
 * Originally filed under this user


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Likely case of sock/meat puppetry. Two editors - User:Legendraid and User:Chibaakiba - both joined the project in late September 2019, and quickly adopted a very similar editing pattern; both editors log on, make a series of 3-5 edits (always maintenance edits, like tagging articles or incorrectly removing dead/redlinks), then cease activity for a few days. For example, on 19 December Legendraid logged in, made a series of three edits, and then logged out, only for Chibaakiba to begin editing <10 mins later, make three edits, and then cease - both editors remained inactive until 26 December, when as before one editor logged in, made three edits before ceasing, only for the other party to repeat the same pattern. Similar instances can be seen if one looks at both editor's contribution history side-by-side. Both editors also leave the same edit summaries when conducting maintenance, despite the fact neither use an editing tool like Twinkle.

In addition to the above, the largest indication of coordination is the fact that - while both editors have edited a seemingly random collection of articles - both editors have only edited one draft, that being Draft:Richard F. Chambers. This is a red flag, as the draft has had a history of SPA activity surrounding it. As can be seen in their contributions, Legendraid has made several contributions to this obscure draft, and Chibaakiba has attempted to remove COI templates from the draft before—I cant think of a logical reason two new editors only concerned with editing random articles in the mainspace would both be able to find their way to a draft. Both editors have also declined to answer COI inquests on their respective talk pages. Checkuser has been requested to flush out any sleeper accounts. SamHolt6 (talk) 23:18, 16 January 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
✅, blocked, tagged, closing.--Bbb23 (talk) 00:41, 17 January 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Another editor may be tied to this sockfarm. The editor (User:Texatexan) edits with the same MO as the previous sock, logging in every few days to make a few edits to random articles before going offline. The dates of these edits align with the previous socks - this can be seen by looking at each editor's respective contributions side by side. For example, on 15 October User:Legendraid (sockmaster) edited at 11:15, Chibaa (a sock) edited at 11:33, and Texa edited at 11:52; similar patterns can be seen all throughout Texa's edit history. User:Texatexan uses the same edit summaries as the previous socks, makes the same mistakes (incorrectly removing dead links and red links), and - just like the previous socks - all of their edits are done manually and are classified as visual edits. Finally (again, just like the previous socks), Texa only diverged from their maintenance edits once, when they edited Draft:Ari Rastegar, an obscure draft with a previous history of COI editing. Checkuser requested. SamHolt6 (talk) 02:13, 15 February 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - While I could spend half an hour looking for the diffs you speak of in your statement, I'd prefer if you could tighten up your statement by backing the claims up with diffs. I'm not sure how the current ones are supposed to relate other than time wise. -- Amanda  (aka DQ) 04:51, 16 February 2020 (UTC)
 * Nothing provided. -- Amanda  (aka DQ) 19:37, 12 March 2020 (UTC)

Law Cluster

 * Xtools
 * Times: 0900-1100 UTC


 * Xtools
 * Times: Main cluster 1600-2000 UTC (outliers)


 * Xtools
 * Times: 0900-1100 UTC


 * Xtools
 * Times: too broad to discern, main clusters 0800-1100, 1500-1800 UTC


 * Xtools
 * Recent interest in law, previous contributions would also fit finance
 * Times: Lacking data/broad, main clusters 0800-1200 UTC, 1500-1800 UTC

Retail Cluster

 * Xtools
 * Times: 0600-1900 UTC (many outliers)


 * Xtools.
 * Times: Too broad to discern -- needs reexamination.


 * Xtools
 * Times: 0200-1600 UTC (many outliers)


 * Xtools
 * Times: 0700-1500 UTC (many outliers)


 * Xtools
 * Times: Main clusters 0600-1100 and 1300-1700 UTC


 * Xtools
 * Times: 0700-1500 UTC


 * Xtools
 * No clear focus, but many substantial additions to clothing-related articles.
 * Times: Clusters at 0300-1000 UTC and 1400-1800 UTC


 * Xtools
 * Times: Too broad to discern. Needs re-examination.

BLP cluster

 * Xtools
 * Times: Broad, main cluster 1200-1600 UTC


 * Xtools
 * Times: 0600-1600 UTC


 * Xtools
 * Times: Main cluster 0400-1400 UTC


 * Xtools
 * Times: Lacking data/broad, main cluster seems to be 0700-1300 UTC

Tech Cluster

 * Xtools
 * Times: Very broad, 1500-0000 UTC (many outliers)


 * Xtools
 * Times: Broad. Clusters 0500-0700 and 1100-1600 UTC


 * Xtools
 * Times: Broad, c. 0100-1500 UTC


 * Xtools
 * Times: 0800-1900 UTC


 * Xtools
 * Focused on Gaia, Inc.
 * Times: Broad/lacking data, mainly 0600-1700 UTC


 * Xtools
 * Times: Broad, main cluster 1200-1800 UTC


 * Xtools


 * Xtools
 * Times: 1300-0300 UTC


 * Xtools
 * Times: 0900-1800 UTC


 * Xtools
 * Times: 0000-1800 UTC (few outliers)


 * Xtools
 * Times: Very broad (EXPAND ME)


 * Xtools
 * Lots of draft work.
 * Times: Main Cluster 0600-1000 UTC


 * Xtools
 * Seems to be focused on [[Gaia, Inc.]
 * Times: 0000-1300 UTC (outliers)


 * Xtools
 * Times: Very broad, ~0500-1500 UTC


 * Xtools
 * Focused on Xilinx
 * Times: 0500-1700 UTC (outliers)


 * Xtools
 * Substantial edits to Capterra
 * Times: 0800-1700 UTC

Finance, Insurance, Consulting Cluster

 * Xtools
 * Times: Very broad, main clusters 0100-0700 and 1400-1700 UTC


 * Xtools
 * Times: 0900-1200 UTC


 * Xtools (Consulting/Communications)
 * Times: Main clusters 0100-0600 UTC and 1300-1600 UTC


 * Xtools
 * Times: Broad. 0300-0900 and 1400-1600 UTC


 * Xtools


 * Xtools
 * Times: Broad, clusters 0200-0900 and 1300-1900 UTC


 * Xtools
 * Times: 0800-1300 UTC


 * Xtools
 * Edits insurance, potential relationship with Meloncoco


 * Xtools
 * Lots of edits to Clear Channel Outdoor, an advertising firm


 * Xtools
 * Times: Very broad. Clusters at 2200-0500 and 1000-1800 UTC


 * Xtools
 * Times: Main cluster 0500-1000 UTC


 * Xtools
 * Times: 0700-1400 UTC


 * Xtools
 * Times: Broad, main cluster 0700-1200 UTC

Health Cluster

 * Xtools
 * Times: 0500-1000 UTC


 * Xtools Prior SPI exists.
 * Times: Very broad, main cluster 1300-1800 UTC


 * Xtools


 * Xtools
 * Most substantial addition is to Hillrom
 * Times: 0700-1400 UTC

UBX usage

 * Xtools
 * No clear focus.
 * Times: Lacks data, main cluster around 1900 UTC


 * Xtools
 * Times: 0900-1600 UTC
 * Drafts


 * Xtools
 * Times: Lacking data, mostly 0900-1200 UTC


 * Xtools
 * No clear focus.
 * Times: Very broad, ~0500-1500 UTC

"helping out"

 * Xtools
 * Times: Lacking data/broad, main cluster 0800-1500 UTC, second range 2200-0200 UTC


 * Xtools
 * No clear focus. Draft work.
 * Times: 0600-1600 UTC


 * Xtools
 * Edits culture (theatre and film).
 * Times: Clusters at 0200-0900 UTC and 1300-1900 UTC


 * Xtools
 * No clear focus. Lots of drafts.
 * Times: Mainly 0300-0900 UTC, second cluster around 1400 UTC

New and learning/willing to contribute

 * Xtools
 * 
 * Times: 0700-1800 UTC


 * Xtools
 * No clear focus.
 * Times: 0600-1500 UTC (outliers)


 * Xtools
 * No clear focus.
 * Times: 0400-1400 UTC


 * Xtools
 * No clear focus.
 * Times: 0800-1700 UTC


 * Xtools
 * No clear focus.
 * Times: Lacking data/broad, mainly 1000-1400 UTC


 * Xtools
 * No clear focus.
 * Times: 0600-1600 UTC

Community and happiness

 * Xtools
 * Times: Lacking data/broad, 0300-1300 UTC
 * No clear focus. Does draft work


 * Xtools
 * Drafts
 * Times: Main cluster 0200-0700 UTC, second cluster 1200-1700 UTC


 * Xtools
 * No clear focus.
 * Times: 0700-1500 UTC (many outliers)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

This case is related to an existing discussion at WP:COIN. The following is a copy of my statement there.

I am opening this thread to discuss a group of around 60 accounts that are engaged in what appears to be paid editing without disclosure. Almost all of them were found and sent to me by a user on discord who prefers to remain anonymous. All of these accounts exhibit highly similar behavioural patterns (detailed below) and some are definitely associated with each other. Our assumption is that at least some of these accounts are run by the same individuals and that at least some of those individuals are affiliated with each other. It is unclear, however, whether they are all run by the same marketing operation. It is a distinct possibility that the common behaviours are linked to individuals reading the same manual on covert marketing.

A checkuser investigation seems appropriate to
 * 1) Potentially associate accounts with one another
 * 2) Investigate whether private proxies are being run for editing and block them if that is possible without collateral damage
 * 3) Check for sleeper accounts
 * 4) Check for associations with potentially related prior sockfarms (see below)

If this is indeed a case of one or more large UPE operations, it is unlikely that blocking these accounts – even though such blocks would seem appropriate – would stop the disruption in the long run; however, documenting and investigating the behavioural patterns alone might provide beneficial in tracking down similar accounts in the future.

Behavioural patterns

 * Edits are almost exclusively to pages about businesses, occasionally BLPs
 * Specific industries include:
 * Software and technology
 * Video games, see
 * Clothes
 * Other retail
 * Entertainment
 * Remarkably similar edit summaries
 * Almost never marked as "minor"
 * No personal commentary, just stating the facts; "good" edit summaries
 * Regular use of the word "request" (e.g. "requested citations")
 * Mainly small edits (punctuation, CN tags), interspersed with large additions that hint at potential COIs
 * Accounts rarely make multiple edits to a single page in a row.
 * Single accounts edit a large number of pages – not the typical SPA behaviour seen with more primitive UPEs.
 * Some target only specific industries, others have more variety
 * Potential targeting of competitors by use of cleanup and CN tags?
 * Occasional AfD votes, but almost no communications with other editors; mainspace participation well above 90% is the norm
 * Lots of "information maintenance" edits, e.g. noting that companies have been purchased by other firms
 * All involved accounts edit only on weekdays with very few exceptions; however, the editing times vary significantly
 * Userpages are either a single sentence or a single sentence and a few userboxes below
 * Adding the userpage is often the first edit they make
 * Often show up after less sophisticated (mostly SPA) COI/UPE editors have already edited an article. — Blablubbs (talk • contribs) 16:09, 6 September 2020 (UTC)

Addendum: There are multiple sockfarms that were investigated prior and may have links to this one, namely — Blablubbs (talk • contribs) 16:45, 6 September 2020 (UTC)
 * Richcitii
 * Mememento
 * Legendraid
 * Jannhall

Group 2
Since the opening of this investigation, we've found around 20 more users; they are listed below. — Blablubbs (talk • contribs) 14:18, 8 September 2020 (UTC)


 * Xtools
 * Focus: Non-profits, legal
 * Times: Very broad
 * Userpage: Edit 1, Q+2UBX
 * Created: 2020-02-17 11:10


 * Xtools
 * Focus: Non-profits, especially Direct Relief
 * Times: C. 0700-1700 UTC
 * Userpage: Edit 7, Def
 * Created: 2018-11-30 15:35
 * Ties to mememento, see here
 * Diffs:


 * Xtools
 * Focus: Non-profits, including political
 * Times: Mainly 1600-2300 UTC
 * Userpage: Edit 4, B+6UBX
 * Created: 2020-04-04 00:48
 * Diffs:


 * Xtools
 * Focus: Non-profits
 * Times: 0600-1700 UTC
 * Userpage: Edit 1, B+I
 * Created: 2019-10-08 10:55
 * Diffs:


 * Xtools
 * Focus: Non-profits, medical
 * Times: 0100-0600, 1400-2000 UTC (Some edits on weekends)
 * Userpage: Edit 1, B+P
 * Created: 2020-03-04 15:31
 * Diffs:


 * Xtools
 * Focus: BLPs
 * Times: 0100-0800 and 1100-1900 UTC
 * Userpage: Edit 2, P
 * Created: 2020-04-30 12:45
 * Diffs:


 * Xtools
 * Focus: Non-profits, medical
 * Times: Broad, main cluster 0700-1700 UTC
 * Userpage: Edit 11, B
 * Created: 2019-11-27 11:08
 * Diffs:


 * Xtools
 * Focus: Non-profits
 * Times: Broad, 0600-1000 and 1400-2200 UTC
 * Userpage: Edit 3, B+Def
 * Created: 2019-10-08 10:54
 * Diffs:


 * Xtools
 * Focus: Non-profits, medical
 * Times: 0400-0900 and 1300-1800 UTC
 * Userpage: Edit 2, Q?+I
 * Created: 2019-12-05 20:09
 * Diffs:


 * Xtools
 * Focus: BLPs
 * Times: 0200-1000, minor cluster 1500-2100 UTC
 * Userpage: Edit 8, B
 * Created: 2020-02-18 07:29
 * See


 * Xtools
 * Focus: BLPs, China-related
 * Times: Main cluster 1200-1700 UTC
 * Userpage: Edit 2, Q
 * Created: 2020-01-07 09:15
 * Note AfD participation and use of "‎Citation request". Diffs:


 * Xtools
 * Focus: Finance and real-estate
 * Times: Very broad, 0200-0900 and 1400-1900 UTC
 * Userpage: Edit 1, I
 * Created: 2019-12-10 23:23
 * Note use of "Citation request".
 * Diffs:


 * Xtools
 * Focus: Finance and real-estate
 * Times: Very broad, 0200-1000 and 1300-1700
 * Userpage: More than twenty edits in, P
 * Created: 2019-10-24 07:10
 * Strong link to Toedelokea, see
 * Shared AfD vote with Lightningbumbumb
 * Diffs:


 * Xtools
 * Focus: Not clearly discernible. Finance, software, manufacturing...
 * Times: Very broad, 0500-1700 UTC
 * Userpage: Edit 9, I
 * Created: 2019-05-10 18:49
 * Shared AfD vote with KittyKatey
 * Diffs:


 * Xtools
 * Focus: BLPs
 * Times: 0200-0900, 1400-1700 UTC
 * Userpage: None.
 * Created: 2019-11-05 02:30
 * Diffs:


 * Xtools
 * Focus: Too broad to discern. BLPs, manufacturing, advertising agencies...
 * Times: Main range 0700-1200 UTC, second group 1600-1900 UTC
 * Userpage: Edit 9, B
 * Created: 2019-09-24 10:52
 * Diffs:


 * Xtools
 * Focus: Tech companies, created Synamedia Ltd.
 * Times: 0500-0900 UTC, 1300-1800 UTC
 * Userpage: Edit 2, Q
 * Created: 2020-02-25 18:22
 * Links to Legendraid, Thinktrain and Cruxstylus


 * Xtools
 * Focus: Broad. Tech, universities, BLPs
 * Times: More than 20 edits in, 0500-1600 UTC
 * Userpage: Com+I+2UBX, userpage template
 * Created: 2020-01-20 11:10
 * Diffs:


 * Xtools
 * Focus: Mostly BLPs
 * Times: Too broad to discern
 * Userpage: Edit 5, P
 * Created: 2019-04-19 15:46
 * Links with other accounts;
 * Diffs:


 * Xtools
 * Focus: Broad. Clothing, retail, BLPs...
 * Times: Broad. Main cluster 0600-1200/1600 UTC
 * Userpage: More than 40 edits in, B+Com+I
 * Created: 2019-06-25 00:28
 * Links to Investedpersonas and other accounts, cf.
 * Diffs:


 * Xtools
 * Focus: BLPs
 * Times: 0000-0400, 0700-1100, 1300-1800 UTC
 * Userpage: Edit 9, P+2UBX
 * Created: 2019-06-10 13:37
 * Large additions to Miguel McKelvey. Note that WeWork and related individuals seem to be a common target for our sockfarm.


 * Xtools
 * Focus: Society for Human Resource Management and its founder, Johnny C. Taylor Jr., various BLPs.
 * Times: 0700-1300 UTC
 * Userpage: Q+3UBX
 * Created: 2020-04-03 07:31
 * 


 * Xtools
 * Focus: Broad. Multiple substantial additions to AK Steel Holding
 * Times: Main cluster 0800-1100 UTC
 * Userpage: More than 20 edits in. B+I
 * Created: 2019-09-10 00:12
 * 
 * Links to other accounts here

Userpage coding:
 * UBX: Userboxes
 * Q: Quote
 * I: Hint at interaction
 * B: Bland
 * Def: Definition of own username
 * Loc: References to geographical location
 * P: Personal
 * J: Joke
 * Com: References to Community

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * I contributed a bit to this as it evolved on WP:COIN (I am not the discord user referred to by the opener). If I see new evidence for CU team, I will add it here. ☆ Bri (talk) 18:06, 6 September 2020 (UTC)
 * partial cu results are consistent with Mememento SPI in which noted "many, highly disparate ranges ... 80 distinct IPs in about 70 big ranges" ☆ Bri (talk) 16:17, 7 September 2020 (UTC)
 * I came here because one of these users was on my watchlist User:SoBeeIt, I came across them whilst looking at some of the edits of User:Sam Perkins who I originally suspected of having a COI in certain areas and saw some "fishy stuff" from SoBeeIt on a page they had edited. I wanted to know if it is appropriate to undo all the edits by these blocked socks and notably SoBeeIt as probable UPE? Cheers. --Dom from Paris (talk) 11:56, 9 September 2020 (UTC)
 * , if one of these editors has made significant changes to a page, then I believe it is fair game to either undo those changes or tag the page as UPE. GeneralNotability (talk) 15:31, 9 September 2020 (UTC)
 * Thanks for the second round of blocks. Re: Indigobones, They have substantial overlap with KotaN05 here and can be seen with KotaN05 and Sakhmix here. — Blablubbs (talk • contribs) 14:34, 9 September 2020 (UTC)
 * Morose to add to the complexity of this SPI, but if User:Texatexan was blocked then Sockpuppet investigations/Legendraid/Archive may need to be merged into this investigation. SamHolt6 (talk) 15:06, 9 September 2020 (UTC)
 * , I agree. I've encountered multiple links to the Legendraid farm and the behaviour of the accounts blocked in that SPI is generally consistent with what we've seen here. — Blablubbs (talk • contribs) 15:13, 9 September 2020 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Based on Blablubbs's comment, CU was intended, and I endorse regardless. I've been helping Blablubbs as they investigated this case, and while there is a lot here, I believe there is enough behavioral similarity that this isn't a fishing expedition - something suspicious (I almost said "fishy") is going on here. Further, based on the behavior I think this is some kind of UPE farm. The big question is going to be "are there multiple groups at work here" - it could be one sock farm or it could be multiple working off of the same playbook. Endorse, and if a reviewing CU thinks this looks too much like fishing, please talk to me first before you decline - I strongly believe that this is a justified case. GeneralNotability (talk) 16:38, 6 September 2020 (UTC)
 * I've done the retail and law clusters, and they're all technically ❌. I think that's what you're going to find throughout, but it was worth the look IMO. With two exceptions, they all geolocate to the same country. I don't have time to do the rest so I'll leave the status as-is, so I or someone else can finish it (or decide it's not worth the trouble and close it). Behavior is another matter; I suspect that blocking one or more of them might force the issue. Katietalk 14:53, 7 September 2020 (UTC)
 * , could you please clarify what you mean by "blocking...might force the issue"? GeneralNotability (talk) 00:23, 8 September 2020 (UTC)
 * To see what happens when or if they appeal. A lot of times, these UPE farms will just abandon the accounts once they're blocked. Block them all for behavior and look at if/how they make the unblock requests. There's something fishy here. Katietalk 01:37, 8 September 2020 (UTC)
 * , roger that. First thing tomorrow I'll block the lot of them...trying to decide whether UPE block or sock block is more appropriate here. GeneralNotability (talk) 01:49, 8 September 2020 (UTC)
 * That's similar to what's going on here. Each one of these is in a discrete location, doesn't move, uses broadband and wireless, not always the same UA but usually Chrome even though the OS may be different. They're not using proxies or trying to disguise anything. Katietalk 01:41, 8 September 2020 (UTC)
 * Thank you,, for making me go through sixty-odd users to verify their behavior before blocking. I have everyone as suspected, and anything that the blocked socks have created or significantly edited should be considered UPE. I note for future clerks that based on KrakatoaKatie's findings, I think this is a large network of work-from-home UPE, and it is possible that there are multiple farms here (or, in fact, that some of these editors are doing their own thing without being part of a farm). Future SPIs should consider the aggregate behavior of these socks rather than trying to match to individual users. GeneralNotability (talk) 14:10, 8 September 2020 (UTC)
 * Also, leaving open for now in case Blablubbs and co come up with more socks. GeneralNotability (talk) 14:11, 8 September 2020 (UTC)


 * I have handled group 2. Specific comments:
 * I blocked Kingofthenorf and KittyKatey despite their protests at COIN (their behaviors are a strong match to this group)
 * I am leaving Indigobones for now - their behavior seems a little different to me for some reason that I can't put my finger on. I could be persuaded otherwise, but am erring on the side of caution.
 * Also, an interesting note - Pharrbinders and Lriverb both made at least one citation to books.google.com.ph (ManKind Initiative and Gooderham and Worts respectively), which may be a hint as to where some of these folks are operating from. GeneralNotability (talk) 14:16, 9 September 2020 (UTC)
 * Blocked Indigobones based on the diffs above. Per the partial CU findings, I don't think there is much value in keeping this in the CU state, and everyone is blocked. Closing. I am also going to merge Legendraid into this case, since I agree that all of those accounts seem to follow the same pattern as these. GeneralNotability (talk) 21:45, 10 September 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Both fit the established pattern; early user page creation, lots of gnoming and the occasional major addition. Snappytimez was focused on Qlik, see. — Blablubbs (talk • contribs) 00:26, 22 September 2020 (UTC)
 * Update: Added more socks. — Blablubbs (talk • contribs) 14:18, 22 September 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * All of these fit the pattern of past socks (though again - there may be multiple groups in play here). . GeneralNotability (talk) 15:13, 22 September 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

We examined LaylaAccord early on but removed the account because it seemed to be stale. Re-adding now that it has become active again. LaylaAccord has strong overlap with the now-blocked Jingjag, see. Columboiz is behaviourally very similar to the sockfarm and overlaps with Rainchecker here as well as Yoodaba here, I'm sure there are more links for both. — Blablubbs (talk • contribs) 22:40, 24 September 2020 (UTC)

could you elaborate on the links you see for the two accounts you listed? At a quick glance, I don't see the telltale signs of the Yoodaba sockfarm (namely the "robotic" edit summary usage and the gnomish edits). The account listed strikes me as more likely to be related, though the edit summaries seem to be somewhat more verbose than what I'm used to seeing and there is a lack of gnome-ish edits. Also pinging who might be able to give additional input. Best, — Blablubbs (talk • contribs) 21:18, 29 September 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - also adding:
 * Good wej is a new-ish account (Jan 2020). Drt1245 has been around for a while with minimal activity, suddenly came alive in March 2020.  All of these have extensive overlap on department store articles. -- RoySmith (talk) 15:13, 28 September 2020 (UTC)
 * Good wej is a new-ish account (Jan 2020). Drt1245 has been around for a while with minimal activity, suddenly came alive in March 2020.  All of these have extensive overlap on department store articles. -- RoySmith (talk) 15:13, 28 September 2020 (UTC)
 * Good wej is a new-ish account (Jan 2020). Drt1245 has been around for a while with minimal activity, suddenly came alive in March 2020.  All of these have extensive overlap on department store articles. -- RoySmith (talk) 15:13, 28 September 2020 (UTC)


 * A fairly new account, showing preliminary signs of being in this sockfarm. MER-C 17:43, 29 September 2020 (UTC)
 * LaylaAccord and Columboiz look like this group, CarlVisage I'm not so sure (rarely see them engage on talk pages), Good wej looks more like one of our normal mall-obsessed editors, Drt also doesn't look related. Not sure how much good CU will do based on our past findings. GeneralNotability (talk) 00:28, 30 September 2020 (UTC)
 * LaylaAccord and Columboiz look like this group, CarlVisage I'm not so sure (rarely see them engage on talk pages), Good wej looks more like one of our normal mall-obsessed editors, Drt also doesn't look related. Not sure how much good CU will do based on our past findings. GeneralNotability (talk) 00:28, 30 September 2020 (UTC)

. RoySmith, could you give some evidence, preferably in the form of diffs, showing the abusive sock puppetry? Accounts merely editing in the same area is not sufficient evidence, or we'd be checking a ridiculous number of accounts. Thanks! Reaper Eternal (talk) 21:05, 1 October 2020 (UTC)
 * , The extensive overlap shown in the interaction report linked above and the timing of the account creation/reactivation seemed like enough when I looked at this originally, but if others do not agree, I'm fine with withdrawing my CU request for them. -- RoySmith (talk) 21:22, 1 October 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Recent account which has gone almost solely to attempt to remove a speedy tag from another of the sockmaster's puppet's. See this.  Onel 5969  TT me 21:30, 7 November 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * These two accounts are ❌ to each other. Closing. Callanecc (talk • contribs • logs) 05:09, 8 November 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

I always smell something when a new editor starts creating articles which have been deleted because they were created by a banned editor trying to evade a block, such as this article.  Onel 5969  TT me 01:35, 18 November 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Their version of Clint Stinchcomb is fairly different from the deleted version. I don't see anything obviously tying this editor to Yoodaba. My gut instinct here is that RyeCedar is some sort of UPE (especially since I seem to remember Eclair (company) from some other SPI) but I can't prove it and so I am not blocking. Closing without action. GeneralNotability (talk) 20:43, 21 November 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Follows the classic pattern; red link removal, robotic edit summaries. Note overlap with Lriverb here, VFHVader here, Cryptoking here etc. Blablubbs | talk 22:53, 9 December 2020 (UTC)
 * I wouldn't be surprised was a sock too. MER-C 12:08, 12 December 2020 (UTC)

Update: Adding Korra doesn't have any substantial overlap as far as I can tell, but is behaviourally highly consistent, while Zahraa overlaps with Dayagone on a bunch of pages; see Objectime, International Road Dynamics, Tucows, OpenText. Blablubbs | talk 11:55, 22 December 2020 (UTC)
 * and

I would add with substantial overlap with Kosheraurora, Snappytimez, Sedgedorrit and ESofmind. --MarioGom (talk) 20:27, 29 December 2020 (UTC)


 * Regarding here's what I have:
 * Overlaps articles with 82 accounts from the VentureKit/Yoodaba cohorts. From those 82 accounts, these have more than 5 overlapped articles: Fusionvarve (32), (28),  (12),  (11),  (11),  (10),  (10),  (9),  (9),  (9),  (8),  (7),  (7),  (7) and  (6).
 * Some recent overlaps that are particularly interesting: Qualcomm Atheros (overlaps with in a 7 hours timefrime, overlaps with  within the year), Inq Mobile (overlaps with, ,  and )
 * A few accounts overlap in comment style (all lowercase) with recurrent substance, e.g. remove dead link. I identified, at least, and  from the top list, but also others like . --MarioGom (talk) 11:28, 31 December 2020 (UTC)
 * Thanks and . Regarding Korra99Tenzin, I did some edit summary comparison to a few socks that I randomly picked from the archives. There is no one sock that shows identical behaviour across the board here (there could be, I didn't have time to go through all 80+ accounts again), but that is unsurprising given that this is likely a meatfarm. Nonetheless, I think it should show that this is at the very least the same playbook.
 * "Removed broken links"
 * Korra:
 * Others:
 * Edit summaries à la "acquisition of [XYZ]" or "award from [XYZ]"
 * Korra:
 * Others:
 * Adding company infoboxes with the summary "Added infobox company"
 * Korra:
 * Others:
 * In addition, they share the more general behaviour patterns of the farm; edits are overwhelmingly gnomish and sometimes useless – adding references, categorising, creating infoboxes, indiscriminately removing redlinks. Content additions are rare by comparison and often read like re-hashed press-releases or outright promotion (compare e.g. Korra's edit here and these by KittyKatey: ). Best, Blablubbs | talk 13:43, 31 December 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Haven't looked too closely, but reminder - CU isn't effective here since this is probably a distributed meatfarm. Behavior-only here. GeneralNotability (talk) 18:19, 12 December 2020 (UTC)
 * I've blocked and tagged Saviprinz, ZahraaF1999 and AshMo90 based on the behavioural crossover. I'm not as sure on Korra99Tenzin and Harley.M.X and some additional evidence is needed for those two accounts. Callanecc (talk • contribs • logs) 04:27, 31 December 2020 (UTC)
 * Thank you and . I've blocked and tagged Harley.M.X and Korra99Tenzin as suspected socks per evidence presented. Closing. Callanecc (talk • contribs • logs) 00:42, 1 January 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.


 * Apparently same playbook: gnoming companies mostly in an overlapping set with the rest of the sockfarm, editing only on weekdays, removing red links (Greenpainter147, Raptortilla), adding insubstantial links, adding routine biz references...
 * Article overlaps (includes socks from VentureKit SPI, which are apparently different operators but close set of articles of interest):
 * Raptortilla with Vaulruper, Boothit11, Harley.M.X, QuibbleCod, ItsSonic1, Palauwan, Accountmetric, Richcitii, KittyKatey, Shlop0s, SoBeeIt, ThinkTrainBM.
 * Greenpainter147 with KittyKatey, Toedelokea, Harley.M.X, Dayagone, Billhazy.
 * CheckUser might be useful against some recent accounts such as Raptortilla<->Korra99Tenzin (because of very quick change from one to another in time). MarioGom (talk) 10:34, 7 January 2021 (UTC)

Added 62icecreammachine. Same cues as last batch. While this is believed to be a meatfarm, I'm requesting CheckUser because 62icecreammachine, Raptortilla, Greenpainter147, Korra99Tenzin and ZahraaF1999 might actually have the same human operator, given the edit cadence (each of them start and end editing in contiguous time slots). I guess they probably use proxies, but given that in some cases they seem to switch from one account to the next one very quickly, they might have committed some error at some point reusing the same proxy or IP for multiple accounts. --MarioGom (talk) 18:48, 16 January 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * This CU result seems to be consistent with the initial CU run, which stated that the socks were technically unrelated, but mostly in the same country (my and 's operating theory being that this is a meatfarm), though I don't know if the countries are consistent. Behaviourally, I think it's relatively clear based on edit summaries that Raportilla is Yoodaba; for the other two, I'd call it pretty likely, but I'm not as certain. Blablubbs | talk 12:36, 20 January 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * As far as technical evidence goes, these are . They're in the same country, but very different areas.  ~Oshwah~  (talk) (contribs)   23:08, 19 January 2021 (UTC)


 * Same country? Good enough for me! In all seriousness, this looks like the Yoodaba playbook. Some of their editing patterns (beans beans beans) differ a fair amount from past Yoodaba socks, but there is enough evidence here that I am willing to connect them to Yoodaba/consider them UPEs. all as suspected, normal disclaimer that these are probably meatpuppets and could even be multiple farms. GeneralNotability (talk) 00:56, 21 January 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.


 * Both have the usual Monday to Friday activity. Same editing style as with previous reports.
 * Vapetrain01 has an overall overlap of 8 pages with JoshuaClifford, Humblephi, Skikneedeep, Frostedcoffee, Investedpersonas, Khmerlent, Roaychin, Berryfrost and Hampersole (interaction report).
 * UberDriver247 has an overall overlap of 11 articles with Harley.M.X, Frostedcoffee, Stingerd, Fusionvarve, Skikneedeep, Bellasmoon, Kamotefries, Adangrey, Rizalnona, Chanandlerfriendz and Woodidoo (interaction report). Activity on Orrick, Herrington & Sutcliffe is particularly suspicious. MarioGom (talk) 20:09, 15 February 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked, tagged, closing. MER-C 20:09, 17 February 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Registered the day after the last block round in January. Exhibits the usual behavior hints. Large relative overlap with previous socks (interaction report), including some articles with low edit volume. MarioGom (talk) 20:31, 17 February 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
On hold for clerk training. TonyBallioni (talk) 23:38, 18 February 2021 (UTC)


 * This is an interesting one in that it isn't quite as ducky as many previous socks. It's most certainly undisclosed paid editing – exclusive focus on companies and edits in a comparatively narrow time on weekdays. The "I did X" edit summary pattern is new though, and there's a weird grammatical quirk I haven't seen before. However, we have long treated Yoodaba as a playbook/distributed meatfarm, and much of this behaviour looks like a conscious effort to not look like a stereotypical Yoodaba sock (we've seen this evasion pattern with other socks before, some of them now blocked "quietly" to avoid BEANSing it by filing at SPI). Edits like and  are quite clearly (poor) attempts at not looking like a paid editor. While they don't do the redlink removal that previous socks have engaged in (and instead add links and do minor copyedits), the hallmark Yoodaba phrase "request (for) X" shows up a couple times . Their only substantial content edit so far is also very much Yoodaba-like: Noting/referencing acquisitions and mergers as Heartland did at  is a favourite pastime of the farm. As noted by the filer, there is also substantial overlap on low-traffic pages  which is highly unlikely to be spurious.Given the overlap, the fact that the timecard is broadly consistent with Yoodaba, the edit summaries, registration date and the general behaviour, I'm convinced enough. While this may be a new human operator (or a known one trying to switch their MO), they are certainly strongly linked to Yoodaba.: Please block the sock indef. I can do the tagging. Thanks, Blablubbs | talk 12:49, 22 February 2021 (UTC)
 * Banhammer duly swung. MER-C 13:37, 22 February 2021 (UTC)
 * Thanks ., closing. Blablubbs | talk 13:39, 22 February 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Obvious sock of AshMo90 (previously reported here). See File:Anaplan at NYSE.jpg and File:AnaplanNYSEpic.jpg. Let me know if other bits of evidence are less clear. There are some additional hints I'd like to avoid posting here per BEANS, as I'm now pretty sure the company operating this sockfarm is watching the SPI and has some degree of adaptation. MarioGom (talk) 18:03, 16 March 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I've spoken to GeneralNotability, who has confirmed that the two images are identical. That recreation, plus the general behaviour (inserting citations, "updating" pages, specifically regarding mergers and acquisitions) plus the edit summaries leaves little doubt that this is a) UPE and b) Yoodaba. – please block the sock indefinitely. Thanks,  Blablubbs&#124;talk 14:33, 29 March 2021 (UTC)
 * Blocked. I'll leave it to  to apply whatever tags are appropriate and close. -- RoySmith (talk) 17:21, 29 March 2021 (UTC)
 * Thanks., closing. Blablubbs&#124;talk 17:41, 29 March 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Interaction report with selected socks for interesting overlaps. Jenkie125 and MLJackson26 are very likely the same operator forcing themselves into using different edit summary patterns. Note the forward slash as separator in edit summaries, which is also present in previous socks. Please, contact me privately (email or Discord) for a more extensive comparison of edit summaries. MarioGom (talk) 21:57, 1 April 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Full discosure: I've talked about this to Mario off-site (including discussion of the edit summary quirks), and I concur. At this point, discussing Yoodaba habits in detail is probably a bad idea, given that recent behaviour (including extensive IPsocking) indicates that they're watching this SPI rather closely, but I'm confident these three accounts are part of this group. – please indef the lot. Thanks and best,  Blablubbs&#124;talk 22:14, 1 April 2021 (UTC)
 * Cabayi (talk) 11:36, 2 April 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.


 * JeanSplicing
 * Article overlap
 * Dharmacon (Harley.M.X, ThinkTrainBM, Headstoppa, Kamotefries)
 * InDevR (Richcitii)
 * Pegatron (Flobotty)
 * Edit summaries
 * [...] opening graf (62icecreammachine)
 * [...] needs to be provided with source (Mottshmikes)
 * MaxAMillion101
 * Article overlap
 * Ria Money Transfer (Heartland79, WFHvader)
 * FXDD (Hydeandshiek, WFHvader, Billhazy, AntonNexa)
 * Wise (company) (WFHvader)
 * Edit summaries
 * this page is unreferenced (Investedpersonas)
 * [...] a couple of commas [...] (Heartland79, Cherryleeks)

The edit summary patterns above are just some significant examples, hopefully enough. For both accounts there are a few more telltales. MarioGom (talk) 21:05, 14 April 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Good filing, thank you. I see it, and I do see other similarities as well, but BEANS. There are also some continued bad attempts at evasion here. – please block both indefinitely. Thanks and best, Blablubbs&#124;talk 15:42, 15 April 2021 (UTC)
 * Blocked, tagged, closing. MER-C 17:55, 15 April 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Duck. Exact same MO (adding and gnoming refs, acquisitions etc, maintenance tagging, trivial "updates" ), overlap with Sakhmix and KotaN05 here, Bellasmoon here. There are some very ducky edit summary similarities with various members of this farm, including some perennial favourites. I can privately provide details on request if this is not enough, but the intensifying recent attempts at evading detection make me not want to say much publicly. Blablubbs&#124;talk 12:37, 16 April 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * – please block the sock indefinitely. Thanks and best, Blablubbs&#124;talk 12:38, 16 April 2021 (UTC)
 * Added Afiwee, whose edit summaries are extremely ducky; again, happy to provide details privately, but comparing to e.g. Saviprinz' and LaylaAccord's edit summaries should make it clear. Please block that one as well. Blablubbs&#124;talk 13:29, 16 April 2021 (UTC)
 * . GeneralNotability (talk) 20:26, 16 April 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Still a duck despite continued attempts at evasion.
 * Ample overlap with one cluster of socks on very low-traffic pages:
 * Userpage somewhat related to the ("quietly") blocked :
 * Not many exact matches, but lots of highly reminiscent edit summaries and an additional indicative quirk. Please contact me via e-mail, IRC or Discord if it's unclear. Blablubbs&#124;talk 11:11, 20 April 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * – please block the sock indefinitely. Thanks and best, Blablubbs&#124;talk 11:12, 20 April 2021 (UTC)
 * Done, closing. KevinL ( aka L235 · t · c) 21:27, 21 April 2021 (UTC)
 * After a surface-level sleeper check, the following are (at least) :
 * KevinL ( aka L235 · t · c) 21:35, 21 April 2021 (UTC)
 * Thank you! This is interesting because we know that parts of Yoodaba are meat (see initial filing) and that other parts are on proxy – might make sense to endorse CU from this point onwards for those parts of the farm that are actually confirmable. Behavioural evaluation for the unblocked ones to follow shortly. Best, Blablubbs&#124;talk 21:45, 21 April 2021 (UTC)
 * I went through it, and based on edit summaries alone, this is far more than a technical match. – please block the lot. Also noting that based on what non-public information we have about this farm and its operators by now, this result is pleasantly surprising, but not inconsistent with what we believe the operating principle to be., you mentioned this was a surface-level check – does it make sense to keep this open for another CU run (and potentially technical examination of the non-stale socks in the archives)? Best, Blablubbs&#124;talk 22:39, 21 April 2021 (UTC)
 * ✅.  ~Oshwah~  (talk) (contribs)   22:58, 21 April 2021 (UTC)
 * Thanks! Tweaking the tags to make the CU trail clear, since I suspect this may become relevant in the future. Also putting this on hold pending a reply from Kevin. Blablubbs&#124;talk 23:03, 21 April 2021 (UTC)
 * My hunch is that a re-check might, but likely won't, reveal more accounts. If you want to relist for such a check, please feel free. I don't have the capacity to do so myself, though. I've recorded my findings at cuwiki. Best, KevinL ( aka L235 · t · c) 18:51, 24 April 2021 (UTC)
 * Thanks. Given how successful this was and that we haven't checked most of the socks in the archive, I'd like to make sure. – If a CU has too much time in their hands and would be willing to run a deeper check and ideally check some of the unchecked sock in the archives, that would be wonderful. That will likely be a time-consuming endeavour, and please feel free to just close this if it's too much to ask. Thanks and best,  Blablubbs&#124;talk 10:40, 25 April 2021 (UTC)
 * The following accounts ✅ to belong to the same person:
 * (connects with the above chain).
 * All now blocked. - Mailer Diablo 08:27, 26 April 2021 (UTC)
 * Whew, that's a lot of socks. Thanks for looking. (Re-)tagged everyone, closing. Blablubbs&#124;talk 09:10, 26 April 2021 (UTC)
 * (for the record that group is also confirmed to the already-blocked ) KevinL ( aka L235 · t · c) 19:17, 26 April 2021 (UTC)
 * KevinL ( aka L235 · t · c) 21:35, 21 April 2021 (UTC)
 * Thank you! This is interesting because we know that parts of Yoodaba are meat (see initial filing) and that other parts are on proxy – might make sense to endorse CU from this point onwards for those parts of the farm that are actually confirmable. Behavioural evaluation for the unblocked ones to follow shortly. Best, Blablubbs&#124;talk 21:45, 21 April 2021 (UTC)
 * I went through it, and based on edit summaries alone, this is far more than a technical match. – please block the lot. Also noting that based on what non-public information we have about this farm and its operators by now, this result is pleasantly surprising, but not inconsistent with what we believe the operating principle to be., you mentioned this was a surface-level check – does it make sense to keep this open for another CU run (and potentially technical examination of the non-stale socks in the archives)? Best, Blablubbs&#124;talk 22:39, 21 April 2021 (UTC)
 * ✅.  ~Oshwah~  (talk) (contribs)   22:58, 21 April 2021 (UTC)
 * Thanks! Tweaking the tags to make the CU trail clear, since I suspect this may become relevant in the future. Also putting this on hold pending a reply from Kevin. Blablubbs&#124;talk 23:03, 21 April 2021 (UTC)
 * My hunch is that a re-check might, but likely won't, reveal more accounts. If you want to relist for such a check, please feel free. I don't have the capacity to do so myself, though. I've recorded my findings at cuwiki. Best, KevinL ( aka L235 · t · c) 18:51, 24 April 2021 (UTC)
 * Thanks. Given how successful this was and that we haven't checked most of the socks in the archive, I'd like to make sure. – If a CU has too much time in their hands and would be willing to run a deeper check and ideally check some of the unchecked sock in the archives, that would be wonderful. That will likely be a time-consuming endeavour, and please feel free to just close this if it's too much to ask. Thanks and best,  Blablubbs&#124;talk 10:40, 25 April 2021 (UTC)
 * The following accounts ✅ to belong to the same person:
 * (connects with the above chain).
 * All now blocked. - Mailer Diablo 08:27, 26 April 2021 (UTC)
 * Whew, that's a lot of socks. Thanks for looking. (Re-)tagged everyone, closing. Blablubbs&#124;talk 09:10, 26 April 2021 (UTC)
 * (for the record that group is also confirmed to the already-blocked ) KevinL ( aka L235 · t · c) 19:17, 26 April 2021 (UTC)
 * (connects with the above chain).
 * All now blocked. - Mailer Diablo 08:27, 26 April 2021 (UTC)
 * Whew, that's a lot of socks. Thanks for looking. (Re-)tagged everyone, closing. Blablubbs&#124;talk 09:10, 26 April 2021 (UTC)
 * (for the record that group is also confirmed to the already-blocked ) KevinL ( aka L235 · t · c) 19:17, 26 April 2021 (UTC)
 * (connects with the above chain).
 * All now blocked. - Mailer Diablo 08:27, 26 April 2021 (UTC)
 * Whew, that's a lot of socks. Thanks for looking. (Re-)tagged everyone, closing. Blablubbs&#124;talk 09:10, 26 April 2021 (UTC)
 * (for the record that group is also confirmed to the already-blocked ) KevinL ( aka L235 · t · c) 19:17, 26 April 2021 (UTC)
 * (connects with the above chain).
 * All now blocked. - Mailer Diablo 08:27, 26 April 2021 (UTC)
 * Whew, that's a lot of socks. Thanks for looking. (Re-)tagged everyone, closing. Blablubbs&#124;talk 09:10, 26 April 2021 (UTC)
 * (for the record that group is also confirmed to the already-blocked ) KevinL ( aka L235 · t · c) 19:17, 26 April 2021 (UTC)
 * (connects with the above chain).
 * All now blocked. - Mailer Diablo 08:27, 26 April 2021 (UTC)
 * Whew, that's a lot of socks. Thanks for looking. (Re-)tagged everyone, closing. Blablubbs&#124;talk 09:10, 26 April 2021 (UTC)
 * (for the record that group is also confirmed to the already-blocked ) KevinL ( aka L235 · t · c) 19:17, 26 April 2021 (UTC)
 * (connects with the above chain).
 * All now blocked. - Mailer Diablo 08:27, 26 April 2021 (UTC)
 * Whew, that's a lot of socks. Thanks for looking. (Re-)tagged everyone, closing. Blablubbs&#124;talk 09:10, 26 April 2021 (UTC)
 * (for the record that group is also confirmed to the already-blocked ) KevinL ( aka L235 · t · c) 19:17, 26 April 2021 (UTC)
 * (for the record that group is also confirmed to the already-blocked ) KevinL ( aka L235 · t · c) 19:17, 26 April 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

The usual edit summary telltales, with many common patterns with the original group. Additionally, many patterns in common with Saviprinz. Given that CheckUser was successful for the previous report, I'm requesting it again for these two. Please, if possible, compare at least: Postsute, XFreecss, Saviprinz, RobertoCA126, Raptortilla and Afiwee. MarioGom (talk) 15:43, 22 April 2021 (UTC)
 * Postsute
 * BAFTA [...] award [...] (XFreecss)
 * [...]added reference to the request (Saviprinz)
 * removed [...] that doesn't exist (Saviprinz)
 * paraphrase and[...]reference (Saviprinz)
 * XFreecss
 * BAFTA [...] award [...] (Postsute)
 * vague time period (Saviprinz)
 * [Company] acquisition reference (Raptortilla, Afiwee)
 * Overlap with RobertoCA126 on Westfield Health

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * /❌.  ~Oshwah~  (talk) (contribs)   15:58, 22 April 2021 (UTC)


 * , can you say which accounts you compared to for future reference? In any case: This might be one from the "meat" category, but I'm convinced by overlap and summaries. – please block the sock indefinitely. Thanks and best,  Blablubbs&#124;talk 19:22, 23 April 2021 (UTC)
 * Based on new technical evidence I find these all highly . . Closing. KevinL ( aka L235 · t · c) 18:21, 30 April 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Both accounts exhibit the usual traits of Yoodaba and look particularly linked to Greenpainter147. As usual, feel free to reach out for additional juicy BEANS. JerseyGrrrl87 is already blocked but filing it anyway for record-keeping.


 * JerseyGrrrl87
 * Created Draft:Mehran Assadi, CEO of National Life Group. The company is clearly a Yoodaba client.
 * Edit summary style similar to Greenpainter147: addt'l [...], [...] ext. link[...], [...]param.[...].
 * OakkRaider
 * Overlaps with JerseyGrrrl87 on Draft:Mehran Assadi.
 * Signed up a few days after Greenpainter147 block.
 * Many edit summary patterns in common. A small sample: source added to support claims (Shadygulf, Sedgedorrit, Lriverb), Updating dead links[.] (Mottshmikes), inserting word [...] (MLJackson26)
 * Signed up a few days after Greenpainter147 block.
 * Many edit summary patterns in common. A small sample: source added to support claims (Shadygulf, Sedgedorrit, Lriverb), Updating dead links[.] (Mottshmikes), inserting word [...] (MLJackson26)

-- MarioGom (talk) 14:44, 27 April 2021 (UTC)

Extending report with 3 more. The usual telltales, plus the following:
 * Roxburytimes:, Added[...] wikilink to[...] page[.] (SharpingShuns), ...] the punctuation mark [...] (Hunter1n1990)
 * SharpingShuns:, Added[...] wikilink to[...] page[.] (Roxburytimes), [Cc]orrecting the spelling (Hunter1n1990)
 * Hunter1n1990:, [...] the punctuation mark [...] (Roxburytimes), [Cc]orrecting the spelling (SharpingShuns)

--MarioGom (talk) 17:13, 28 April 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * based on distinctive technical evidence. . Closing. KevinL ( aka L235 · t · c) 18:22, 30 April 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Sleepers from 2019 reactivated after recent block rounds and exposure of their IP socking. Edits in 2021 present The Classics (timing, edit summaries, editing style). Additionally, the first edit by after reactivation by Lonk11 (Special:Diff/1020180727) is to Ticketmaster, which is a Yoodaba client. MarioGom (talk) 21:59, 6 May 2021 (UTC)


 * Added Stronger2geth. MarioGom (talk) 07:56, 7 May 2021 (UTC)
 * Added Gr88scott. MarioGom (talk) 14:29, 8 May 2021 (UTC)
 * Added Motownmann, Slorpent, Spongged, Electricsity, Zezetiger. MarioGom (talk) 14:51, 8 May 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * All the listed users share the characteristic Yoodaba technical fingerprint (at least on the scale). The behavior makes it a slam dunk., closing. KevinL ( aka L235 · t · c) 22:18, 9 May 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Note to CheckUser: whatever the technical fingerprint is, note that part of it may have changed after 23-28 April. Feel free to ping me for more info.

These socks have some of the usual telltales, plus a new tactic which they didn't use so much before: going around cleaning up UPE articles as part of their cover up activity. Th34VengersHere has overdone it so much, but leaving a few traces leading back to old socks, as well as others in this group.

Here's the overlap, except for Tigerwarfair (no overlap there), but it's not the most significant part as usual:


 * Th34VengersHere:
 * 50bottlesIO:
 * KissingYou7676:
 * SyrOrange88:
 * ExpertExplorr:
 * MaddyHGO1:
 * P0pCzar:
 * Tigerwarfair: No overlap.

I'm sorry for the vague report, but they are trying harder to evade behavioral checks so I wouldn't want them to stop doing the few things that still connect them to previous socks. As usual, I have more extensive private notes that I can share. MarioGom (talk) 18:56, 12 May 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
All the listed users share the characteristic Yoodaba technical fingerprint (at least on the scale). More info on cuwiki. , closing. KevinL ( aka L235 · t · c) 07:30, 26 May 2021 (UTC)
 * - looks like them to me, MarioGom was kind enough to show me his notes., I believe this is one of your specialty areas. GeneralNotability (talk) 23:21, 17 May 2021 (UTC)
 * I'm going to need those notes emailed to me in order to run checks in this case. Best, KevinL ( aka L235 · t · c) 06:55, 18 May 2021 (UTC)
 * Emailed. --Blablubbs&#124;talk 07:01, 18 May 2021 (UTC)
 * - for Kevin to review the evidence. --Blablubbs&#124;talk 01:08, 19 May 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Detailed evidence available on request. Already shared with some of the usual suspects. MarioGom (talk) 17:38, 30 May 2021 (UTC)


 * Added Malikoon, a sleeper that did its first edit the same day and hour as the Yoodaba user. . Some further BEANS available. MarioGom (talk) 21:02, 10 June 2021 (UTC)
 * Added Basktimrobbins, . MarioGom (talk) 14:31, 18 June 2021 (UTC)
 * Added GVGotham75, . MarioGom (talk) 17:15, 24 June 2021 (UTC)
 * There are at least 10-15 additional active accounts. A sleeper check could be as effective as last time. MarioGom (talk) 23:16, 24 June 2021 (UTC)
 * Added MaeSheen and VDHmax. MarioGom (talk) 18:22, 26 June 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * to the main group: Raspyerries, Apollogone, Illrunwithyou, Basktimrobbins, GVGotham75, VDHmax. All blocked.
 * ✅ to each other: Basktimrobbins and GVGotham75
 * to the main group: Malikoon
 * Not yet checked: MaeSheen KevinL ( aka L235 · t · c) 19:56, 29 June 2021 (UTC)
 * Added tags to all blocked accounts. Behaviourally, Malikoon is consistent with recent Yoodaba socks. -- Blablubbs&#124;talk 20:01, 29 June 2021 (UTC)
 * Blocked. KevinL ( aka L235 · t · c) 20:07, 29 June 2021 (UTC)
 * MaeSheen is . Blocked. KevinL ( aka L235 · t · c) 20:09, 29 June 2021 (UTC)
 * Thanks. those two as well, closing. Blablubbs&#124;talk 20:10, 29 June 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same deal as with previous reports. MarioGom (talk) 16:11, 2 July 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Plo0ough is . KevinL ( aka L235 · t · c) 19:25, 3 July 2021 (UTC)
 * X70Tons is but blockable given the behavior. KevinL ( aka L235 · t · c) 19:31, 3 July 2021 (UTC)
 * Nears8ted is . KevinL ( aka L235 · t · c) 19:35, 3 July 2021 (UTC)
 * Applejacksbowl is . KevinL ( aka L235 · t · c) 19:41, 3 July 2021 (UTC)
 * Bridgerton96 is technically ❌ (with a whiff of ) to the Yoodaba technical footprint but is ✅ to:
 * KevinL ( aka L235 · t · c) 19:51, 3 July 2021 (UTC)
 * KevinL ( aka L235 · t · c) 20:08, 3 July 2021 (UTC)
 * Ashenlord is . KevinL ( aka L235 · t · c) 19:54, 3 July 2021 (UTC)
 * Elouqentish is /. Elouqentish's technical profile clearly points to socking and it's highly plausible that it's Yoodaba – my guess is that it is Yoodaba, trying to mix up their technical profile a little bit. More details on cuwiki. Certainly should be blocked, but I'll leave tagging to the discretion of SPI clerks. KevinL ( aka L235 · t · c) 20:02, 3 July 2021 (UTC)
 * I'll upgrade this to . KevinL ( aka L235 · t · c) 20:04, 3 July 2021 (UTC)
 * FudgeeChoco is to the Yoodaba group and ✅ to:
 * HeythereitsBella, independent of its relationship with FudgeeChoco, is to the Yoodaba group.
 * HeythereitsBella is also directly (same IP) to, a previously-blocked Yoodaba sock.
 * Razorfanz, independent of its relationship with FudgeeChoco, is to the Yoodaba group. KevinL ( aka L235 · t · c) 20:20, 3 July 2021 (UTC)
 * ChewedUp is . KevinL ( aka L235 · t · c) 20:24, 3 July 2021 (UTC)
 * FreljordSylas is . KevinL ( aka L235 · t · c) 20:25, 3 July 2021 (UTC)
 * XBraumX is . KevinL ( aka L235 · t · c) 20:27, 3 July 2021 (UTC)
 * Squishycat9089 is for now. KevinL ( aka L235 · t · c) 20:29, 3 July 2021 (UTC)
 * - The Bridgerton96 group seems likely to be a different sockmaster. Can you take a look at the behavior, and if necessary, copy the applicable CU results into a pro forma case under the name of the oldest account in that group (CharmenderDeol, I believe)? KevinL ( aka L235 · t · c) 20:32, 3 July 2021 (UTC)
 * Blocking accounts as appropriate; would a clerk evaluate and tag as appropriate? KevinL ( aka L235 · t · c) 20:35, 3 July 2021 (UTC)
 * Thanks for the check and the ping. Some quick thoughts from my side:
 * I don't think the Charmender group is Yoodaba – I'm on mobile right now, but I can do the split tomorrow.
 * I think Squishycat9089 is probably Yoodaba, the broken link/dead link summaries are giveaways (I think that's one of the summary patterns we documented fairly well in the archive).
 * Elouqentish is pretty likely behaviourally; my inclination would be to tag as suspected.
 * I'm not sure about Nears8ted yet, I'll have a quick look at my notes tomorrow. Blablubbs (talk) 00:05, 4 July 2021 (UTC)
 * Squishycat9089 is ❌ to Yoodaba but ✅ to (no overlap in editing, no socking policy violation). No action needed wrt this user. KevinL ( aka L235 · t · c) 05:21, 4 July 2021 (UTC)
 * Tagged everyone as proven, split the rest to Sockpuppet investigations/CharmenderDeol. I'm suspicious with regard to Nears8ted, but there's some signs that this is a coordinating group but not Yoodaba directly. Closing. Blablubbs (talk) 12:38, 4 July 2021 (UTC)
 * - The Bridgerton96 group seems likely to be a different sockmaster. Can you take a look at the behavior, and if necessary, copy the applicable CU results into a pro forma case under the name of the oldest account in that group (CharmenderDeol, I believe)? KevinL ( aka L235 · t · c) 20:32, 3 July 2021 (UTC)
 * Blocking accounts as appropriate; would a clerk evaluate and tag as appropriate? KevinL ( aka L235 · t · c) 20:35, 3 July 2021 (UTC)
 * Thanks for the check and the ping. Some quick thoughts from my side:
 * I don't think the Charmender group is Yoodaba – I'm on mobile right now, but I can do the split tomorrow.
 * I think Squishycat9089 is probably Yoodaba, the broken link/dead link summaries are giveaways (I think that's one of the summary patterns we documented fairly well in the archive).
 * Elouqentish is pretty likely behaviourally; my inclination would be to tag as suspected.
 * I'm not sure about Nears8ted yet, I'll have a quick look at my notes tomorrow. Blablubbs (talk) 00:05, 4 July 2021 (UTC)
 * Squishycat9089 is ❌ to Yoodaba but ✅ to (no overlap in editing, no socking policy violation). No action needed wrt this user. KevinL ( aka L235 · t · c) 05:21, 4 July 2021 (UTC)
 * Tagged everyone as proven, split the rest to Sockpuppet investigations/CharmenderDeol. I'm suspicious with regard to Nears8ted, but there's some signs that this is a coordinating group but not Yoodaba directly. Closing. Blablubbs (talk) 12:38, 4 July 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Dawnbringer Soraka (sign up 18 May 2021) username is related to League of Legends, just like (sign up 13 May 2021). All the classic Yoodaba telltales (timecard, edit summaries, etc). Ping me if you need further beansy notes. MarioGom (talk) 22:07, 20 July 2021 (UTC)


 * Added Bull-pei, MsiB450m, and NannoKitty. MarioGom (talk) 22:52, 20 July 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - it's them. Please block the lot; I can forward extensive notes to you if it's not immediately obvious. --Blablubbs (talk) 14:33, 28 July 2021 (UTC)
 * All four listed accounts to Yoodaba.
 * Additionally, NannoKitty is ✅ to the following (and the following are also individually to Yoodaba):
 * All of the above accounts are.
 * Additionally, NannoKitty is ✅ to (a no-edit account, possibly a sleeper). Noting for the record, but no need for a block at this time. KevinL ( aka L235 · t · c) 17:26, 28 July 2021 (UTC)
 * All of the above accounts are.
 * Additionally, NannoKitty is ✅ to (a no-edit account, possibly a sleeper). Noting for the record, but no need for a block at this time. KevinL ( aka L235 · t · c) 17:26, 28 July 2021 (UTC)
 * Additionally, NannoKitty is ✅ to (a no-edit account, possibly a sleeper). Noting for the record, but no need for a block at this time. KevinL ( aka L235 · t · c) 17:26, 28 July 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

As usual, feel free to ping me for further notes. MarioGom (talk) 19:20, 24 August 2021 (UTC)
 * HotTomatoe exhibits the classic behavior.
 * Oht8MTo is an SPA that edited a previous target (Xilinx), note that the account name is kind of an anagram of HotTom8(to).
 * KickfliptoNollie is focused on previous Yoodaba target (Codexis) with some of the usual cover up gnoming. There's some behavioral differences here which I attribute to their usual evasion attempts. User page strongly implies it is a sock.
 * The rest of the accounts show some of the usual the usual behavior and are strongly connected to each other, very likely the same person at the keyboard.


 * If someone does a CU run, please, also compare to, which is the most recent Yoodaba block. MarioGom (talk) 19:22, 24 August 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * HotTomatoe . KevinL ( aka L235 · t · c) 19:45, 24 August 2021 (UTC)
 * KickfliptoNollie . KevinL ( aka L235 · t · c) 19:47, 24 August 2021 (UTC)
 * The following users are each to Yoodaba and ✅ to each other:
 * AllieAlvado
 * Daniellim01
 * NickChioso
 * JaceSakamoto
 * CarleneMiller
 * AveryYoung KevinL ( aka L235 · t · c) 19:57, 24 August 2021 (UTC)
 * Oht8MTo is Yoodaba. KevinL ( aka L235 · t · c) 19:59, 24 August 2021 (UTC)
 * Blocked all the "likely" accounts without tags for now. KevinL ( aka L235 · t · c) 20:00, 24 August 2021 (UTC)
 * On the basis of the overlap, the username, and the possilikely result, also blocking Oht8MTo now. KevinL ( aka L235 · t · c) 20:05, 24 August 2021 (UTC)
 * , do you want these to stay untagged, or do you want someone else to review and tag? GeneralNotability (talk) 13:25, 27 August 2021 (UTC)
 * Please tag, thanks! KevinL ( aka L235 · t · c) 02:30, 28 August 2021 (UTC)
 * Tagged. Closing. GeneralNotability (talk) 03:01, 28 August 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

New cohort after the last round of blocks. Quite similar to the last batch. Let me know if anything is not immediately obvious. Note that they have introduced mobile editing in their routine. MarioGom (talk) 20:30, 16 September 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Do you have time to take a look?  --Blablubbs (talk) 10:56, 18 September 2021 (UTC)
 * All to Yoodaba., closing.  KevinL ( aka L235 · t · c) 16:52, 18 September 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

See below. --Blablubbs (talk) 17:11, 28 October 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Both follow the classic pattern; . Filing for the record and for a sleeper check; the case is messy, so I'll page two people familiar with it directly. Do either of you have time to take a look?  --Blablubbs (talk) 17:13, 28 October 2021 (UTC)
 * I'll also note for posterity that I have added tags to the following previously untagged socks:
 * --Blablubbs (talk) 17:17, 28 October 2021 (UTC)
 * Added five more thanks to an off-wiki pointer from . Blocked those too. Some exhibit a new pattern that may prove to be interesting from a CU perspective. --Blablubbs (talk) 17:37, 28 October 2021 (UTC)
 * GeneralNotability (talk) 18:16, 28 October 2021 (UTC)
 * All non-stale accounts are, with the exception of $uperClean and Lesserwoof1964 (possilikely at best to the other accounts, likely to each other, but the age of the data may affect how likely they are to the other accounts). ElsieLambert and MikaPotterx are ✅ to each other and to several accounts from the archive (such as JaceSakamoto and NickChioso) GeneralNotability (talk) 18:28, 28 October 2021 (UTC)
 * Thanks, GN., closing. --Blablubbs (talk) 18:40, 28 October 2021 (UTC)
 * --Blablubbs (talk) 17:17, 28 October 2021 (UTC)
 * Added five more thanks to an off-wiki pointer from . Blocked those too. Some exhibit a new pattern that may prove to be interesting from a CU perspective. --Blablubbs (talk) 17:37, 28 October 2021 (UTC)
 * GeneralNotability (talk) 18:16, 28 October 2021 (UTC)
 * All non-stale accounts are, with the exception of $uperClean and Lesserwoof1964 (possilikely at best to the other accounts, likely to each other, but the age of the data may affect how likely they are to the other accounts). ElsieLambert and MikaPotterx are ✅ to each other and to several accounts from the archive (such as JaceSakamoto and NickChioso) GeneralNotability (talk) 18:28, 28 October 2021 (UTC)
 * Thanks, GN., closing. --Blablubbs (talk) 18:40, 28 October 2021 (UTC)
 * GeneralNotability (talk) 18:16, 28 October 2021 (UTC)
 * All non-stale accounts are, with the exception of $uperClean and Lesserwoof1964 (possilikely at best to the other accounts, likely to each other, but the age of the data may affect how likely they are to the other accounts). ElsieLambert and MikaPotterx are ✅ to each other and to several accounts from the archive (such as JaceSakamoto and NickChioso) GeneralNotability (talk) 18:28, 28 October 2021 (UTC)
 * Thanks, GN., closing. --Blablubbs (talk) 18:40, 28 October 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same boring and sharp behavioral fingerprint as the last few batches: user names, timecards, edit summaries, etc. MarioGom (talk) 21:37, 17 November 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Most likely them. Mind taking a look? --Blablubbs (talk) 10:09, 18 November 2021 (UTC)
 * GeneralNotability (talk) 01:43, 23 November 2021 (UTC)
 * Everyone listed here is very - shares the same technical fingerprint as past Yoodaba socks. . . GeneralNotability (talk) 02:18, 23 November 2021 (UTC)
 * Added some missing tags. --Blablubbs (talk) 02:26, 23 November 2021 (UTC)

Suspected sockpuppets
Pretty much the same as most accounts reported since 24 August 2021. All signed up between 24 and 26 November 2021, after the last round of blocks on 23 November 2021 (except RoganCardenas, who signed up on 4 November 2021). Same naming pattern, same editing style, same timings, etc. MarioGom (talk) 22:50, 6 March 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - -- RoySmith (talk) 23:08, 6 March 2022 (UTC)
 * All accounts ✅ -- RoySmith (talk) 23:16, 6 March 2022 (UTC)

Suspected sockpuppets
Typical undisclosed PAID and covert advertising. Create plenty of stubs about towns, newspapers, bus/metro stations to pretend to be normal users. Sometimes, they also create a decent user page, such as the case of zh:User:Fanxingtuan (possibly copied from other's). The first four edits Ding_Lei_(businessman,_born_1963) and Ding Lei（Founder of Human Horizons）, or Human_Horizons of which the CEO is Ding. Fanxingtuan and Doors of light (already glocked) both edited Jackson Wang. There must be tons of sockpuppets to be found out.

AFAIK, the pattern is typically Sockpuppet_investigations/123Aristotle. But I find few credible relations. I am not familiar with Yoodaba. Is is possible Yoodaba == 123Aristotle?

The 5th "詹姆斯008" has no activities on enwiki. It does have some intersections with the 3th Fanxingtuan on zhwiki.

There are some activity intersections (Jackson Wang/zh:王嘉爾, Dong Chengpeng/zh:董成鹏) between this group and the other SRCU check raised by me on zhwiki recently: meta:Special:Diff/23271704. If possible, please check them at the same time. 虹易 (talk) 04:51, 11 May 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * It is highly unlikely that Yoodaba == 123Aristotle. Yoodaba sockpuppets tend to do gnoming on a high number of articles so they overlap with almost every other big sockfarm. MarioGom (talk) 18:04, 11 May 2022 (UTC)
 * Thanks for this info. By reviewing their activities, now I suppose {Toedelokea, Noenpikger, Bruceblanc, Doors of light} is Yoodaba; {Fanxingtuan, 詹姆斯008} is 123Aristotle. --虹易 (talk) 02:29, 12 May 2022 (UTC)
 * Should I open a new case for the latter two under WP:SPI/123Aristotle? --虹易 (talk) 02:31, 12 May 2022 (UTC)
 * Don't worry. A clerk can handle case merging/splitting if needed. MarioGom (talk) 13:14, 12 May 2022 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - I'll work this and 22 May 2022 together. -- RoySmith (talk) 16:42, 22 May 2022 (UTC)
 * PS, 22 May was subsequently split out to Sockpuppet investigations/Benny-T5252 -- RoySmith (talk) 21:38, 22 May 2022 (UTC)
 * CU can't help much here. Most of the accounts are stale.  The ones that aren't stale appear to be ❌ but  due to proxy use also fits. -- RoySmith (talk) 17:07, 22 May 2022 (UTC)
 * This is a bit of a messy case. The only account that isn't stale or already blocked is Fanxingtuan. I would not be surprised if Fangxintuan is a UPE, but they don't match either Yoodaba or 123Aristotle behaviourally. Concerns about UPE can be followed up at WP:COIN, but I don't think there's anything to do here from a SPI perspective. Closing. Thanks, Spicy (talk) 17:01, 28 May 2022 (UTC)

Suspected sockpuppets
Came across them through suspiciously similar mis-gnoming on moth species articles (adding 1 redundant + 1 flat out wrong category):
 * Ptrlc;
 * M.S.McNab;
 * DanicaFolger.

At least one blocked Yoodaba sock has made an extremely similar edit: AnoushkaWatson.

Additionally:


 * All three accounts created in late March of this year (19-22 March) and haven't edited since mid-late July (19-20 July);
 * Similar activity patterns (with some rather suspicious timing between Ptrlc and DanicaFolger on April 19th, May 18th, May 24th and May 31st);
 * Typical wide-range Yoobada gnoming w. typical Yoobada edit summaries (incl. visual editor) AddWitty  NameHere  03:59, 10 September 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - -- RoySmith (talk) 04:07, 10 September 2022 (UTC)
 * All three are on the CU data.  With the behavioral similarities already reported, blocking them all as suspected. -- RoySmith (talk) 04:21, 10 September 2022 (UTC)

Suspected sockpuppets
The usual gnoming, edit summary, and timing pattern of Yoodaba. Including one of my favorites by BethanySo. MarioGom (talk) 10:24, 10 September 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Yep, behavioural links clear enough for me. Congrats on the trainee clerkship too,, well deserved!  firefly  ( t · c ) 11:48, 10 September 2022 (UTC)