Wikipedia:Sockpuppet investigations/Kickingback77/Archive

;Suspected sockpuppets

• {{checkuser|1=Seeknikkihi}}
• {{checkuser|1=Lairzoqs}}
• {{checkuser|1=Swoopover}}
• {{checkuser|1=Groinelves}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Seeknikkihi User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Please look at :File:EvidenceForSignPost2015.jpg. Each of the four accounts created one of these pages. Plus, diffs like [https://en.wikipedia.org/w/index.php?oldid=618797079] and [https://en.wikipedia.org/w/index.php?title=Ecwid&oldid=619069758], the first edits by Swoopover and Groinelves respectively, are definitely not those of first-time editors; this isn't someone just claiming the work of a few innocent new editors. I've checked the source website, but the string "english wikipedia administrator" doesn't appear on any page; apparently the ad's been taken down. Nyttend (talk) 00:57, 8 February 2015 (UTC) Nyttend (talk) 00:57, 8 February 2015 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

The following link does not identify the person by name, only by pseudonym, but it may be of use in this matter: https://www.elance.com/j/simple-wikipedia-request-keep-an-article-from-deletion/71799917/# Or maybe not; I am unsure. BeenAroundAWhile (talk) 06:57, 22 April 2015 (UTC)

• Seeknikkihi and Groinelves are {{StaleIP}}. There other two are {{possible}} however it looks like webproxies or open proxies have been used. Lairzoqs for example hasn't editing from the same range twice in the time we've got CU data. Callanecc (talk • contribs • logs) 02:30, 12 February 2015 (UTC)
• I've blocked the accounts based upon the behavioral evidence and the suspicious use of proxies to evade a connection. Mike V • Talk 01:30, 14 February 2015 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=Moverjacked}}
• {{checkuser|1=Kickingback77}}
• {{checkuser|1=Dicesgeld}}
• {{checkuser|1=Vialbacks66}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Seeknikkihi User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

The contributions are similar including the same style of moving pages to mainspace.They are all from the same paid account of a same person in a external site. Pharaoh of the Wizards (talk) 05:32, 5 April 2015 (UTC)

• All these advertisements link to the same person .I can provide evidence of this offline.

:*[https://www.elance.com/j/wikipedia-article-on-founder-of-charity-new-york-times-bestseller/66976853/ this] to create Brian F. Martin (created by {{u|Kickingback77}}),

:*[https://www.elance.com/j/start-wikipedia-page-about-famous-us-person/67714029/ this] to create Webster Stone (created by {{u|Moverjacked}}),

:*[https://www.elance.com/j/add-some-info-wikipedia/63579009/ this] to add a external link to the Thermal weapon sight (added by {{U| Dicesgeld}}),

:* and also [https://www.elance.com/j/wikipedia-page-editor-monitor/62639833/ this] to create Carter Hargrave (created by {{u|Thatcabmaster}}). Pharaoh of the Wizards (talk) 10:33, 6 April 2015 (UTC)

• The User appears to be long term user but prefers to do this work through socking here in the feedback for Carter Hargrave [https://www.elance.com/j/wikipedia-page-editor-monitor/62639833/ one needs to login to see it ]Glad this contract has ended. While the editor knows the ins and outs of Wiki land Project was 33 percent completed when she was finished. When I asked for corections they were completed not from her account but anonymously .

:*[https://www.elance.com/j/setup-company-wikipedia-page/59472571/ this] to create Kapronasia and Zennon Kapron (created by {{u|Vialbacks66}}). Pharaoh of the Wizards (talk) 06:47, 7 April 2015 (UTC)‎

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Yes very likely all the same person. Most paid editors use one account per one or two jobs. Than move onto the next account. As CU does not go back very far often we are just left to nominating these articles for deletion do to none notability or spammy ness. One however can ask Elance and Fivverr to take down accounts there that infringe upon our terms of use and they will. Doc James (talk · contribs · email) 12:46, 7 April 2015 (UTC)

• {{clerknote}} {{ping|Pharaoh of the Wizards}} Please, provide diffs to illustrate similarities in editing. Vanjagenije (talk) 09:46, 5 April 2015 (UTC)

:*Well, this is a case of undisclosed paid editing (see also Wikipedia:Conflict_of_interest/Noticeboard/Archive_79#Bert_Martinez). {{u|Kickingback77}}, {{u|Moverjacked}}, {{U| Dicesgeld}} and {{U|Thatcabmaster}} are obviously the same person, as we can see from that external web site. They should be blocked, but that would not help a lot, since those are SPAs, already abandoned. {{ping|Pharaoh of the Wizards}} I slightly expanded your comment to make it easier to understand. What about Seeknikkihi? How is he linked? By the way, {{U|Kickingback77}} is by far the oldest of these accounts (possible master). Vanjagenije (talk) 12:42, 6 April 2015 (UTC)

• I've blocked Moverjacked, Kickingback77, Thatcabmaster, and Vialbacks66 based upon the behavioral evidence. The accounts are linked to Seeknikkihi based upon deleted contributions that link it to this elance profile. However, I'm not so sure about Dicesgeld. The elance job shows that it was assigned on October 17, 2014 and completed on October 18, 2014. The account above added an external link on October 29, 2014. As such, I'm not sure that it's the correct account. Mike V • Talk 14:39, 15 April 2015 (UTC)

----

• {{checkuser|1=Jason Mathew}}
• {{checkuser|1=Philip Louis}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Kickingback77 User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

The now deleted pages Josiah Humphrey and Mark McDonald (entrepreneur), plus the still existing Appster absolutely reek of paid editing, and were created by the now blocked {{noping|Alesacress}}, who was found to be a sock of {{noping|Kickingback77}}. The history of Josiah Humphrey includes two recent edits by {{noping|Jason Mathew}}, who created the article Gaurav Munjal, which now redirects to Unacademy, which is tagged for undisclosed paid editing. My suspicion is that Jason Mathew is a reincarnation of Kickingback77, who is (undisclosed) editing for pay. And came back to a previously created article to edit it, after making the Unacademy article under the new account Philip Louis (below). Checkuser data will be stale, but I think it is enough to link the two, which would make unacademy deleatable under "recreation by blocked user". Also adding {{noping|Philip Louis}}, as blocked as part of a UPE farm who created Unacademy. Pinging {{u| Zzuuzz}}, as the blocking checkuser, who may be able to link Philip Louis to Jason Mathew (I think that checkuser data may be available for another week). kelapstick^(bainuu) 16:38, 23 February 2018 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

{{ping|zzuuzz}} Before I noticed this, I created an SPI Wikipedia:Sockpuppet investigations/DongLee with some accounts that have editing patterns very similar to the ones you have blocked. Rentier (talk) 22:33, 23 February 2018 (UTC)

{{Ping|zzuuzz}} I found one of Masterknighted's articles [https://en.wikipedia.org/w/index.php?title=Hashmat_Karzai&diff=802918674&oldid=795392389 edited] by one of the socks that turned up here. ☆ Bri (talk) 04:10, 26 February 2018 (UTC)

I also noted a European city pagemove a la Highstakes00 at {{la|Michael James Tamondong}} performed by {{U|Berrnte Kenpel}} in this sockfarm. ☆ Bri (talk) 04:56, 26 February 2018 (UTC)

:I think you can probably discount Berrnte Kenpel in relation to this farm. I note also that Chpeory was blocked as a sock of Highstakes00. As I said elsewhere these spammers tend to use similar privacy services (assuming it's not one big farm), so they tend to surface at the same time. Behaviourally, I think all the others share similarities, including Jason Mathew and Philip Louis. And not wanting to confuse this any more, I should also mention that I see some similarities with {{user|Stephen Shih}} (who in turn is without question part of a farm). Let's ping {{ping|Smartse}} for any insight. -- zzuuzz ^(talk) 08:18, 26 February 2018 (UTC)

::The following do seem to be a logical group due to certain behavior including editing habits and subjects. "And added reference" is the catchphrase. Possibly even one individual. Possibly a UK based firm like London Biography.

• {{userlinks|ThomasFrancis83}} oldest – 11 September 2017 – UK business bios
• {{userlinks|HarryLouis8}} – UK business bios
• {{userlinks|AlwinMathew}} – startups
• {{userlinks|Ebenezer Ebi}} – startups and medical biz

::And the following appears to be another subgroup. "mentioned about" is the catchphrase. ☆ Bri (talk) 00:36, 27 February 2018 (UTC)

• {{userlinks|WatsonKeith}} – online learnimg
• {{userlinks|Philip Louis}} ditto
• {{userlinks|Kelvin Peterson}} – clothing brands

{{Ping|Smartse}} when you get to this please note that {{user|ChristopherWilliams}} fits behavior of the clothing brands editor immediately above (topics, "added about"), and was created less than a week later. ☆ Bri (talk) 00:46, 27 February 2018 (UTC)

There's anonymising proxy usage going on, and I don't think it's practical to tie in a sockmaster without any external evidence. I had suspicions at the time it might have been {{user|Highstakes00}}, though there's some differences in style. Let me just add some accounts, which though not necessarily directly connected were found through checkuser, and are what I would technically class as 'well dodgy' and are probably connected:

• {{checkuser|Chpeory}}
• {{checkuser|Kelvin Peterson}}
• {{checkuser|Peter D Souza}}
• {{checkuser|Philip Louis}}
• {{checkuser|HarryLouis8}}
• {{checkuser|FEcaety Beht}}
• {{checkuser|Pslitennewh}}
• {{checkuser|ThomasFrancis83}}
• {{checkuser|AlwinMathew}}
• {{checkuser|Ebenezer Ebi}}
• {{checkuser|WatsonKeith}}
• {{checkuser|Berrnte Kenpel}}
• {{checkuser|JustinSilva94}}
• {{checkuser|Scolen Tszet}}
• {{checkuser|Ketu Nema}}
• {{checkuser|ChrisMatthew21}}

To sum this up, no direct connections to other accounts found for Jason Mathew, but CU shows a possibility that Chpeory is connected. These UPE farms tend to meld into each other because they use similar privacy services, or possibly it's all just one big farm. I see a few connections between the behaviour of these accounts. -- zzuuzz ^(talk) 20:37, 23 February 2018 (UTC)

• {{clerknote}} the only unblocked account hasn't edited in a few months and I'm disinclined to block now. The rest are {{bwt}}. Ivanvector (^Talk/_Edits) 22:24, 27 February 2018 (UTC)

----

• {{checkuser|1=DongLee}}
• {{checkuser|1=ChristopherWilliams}}
• {{checkuser|1=Philip Louis}}
• {{checkuser|1=Kim Marcos89}}
• {{checkuser|1=ChristianFernandes12}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=DongLee User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Typical UPE SPAs that cease all activity after creating a single article about a company. Similar edit descriptions, for example [https://en.wikipedia.org/w/index.php?title=Snapask&diff=prev&oldid=803548356] [https://en.wikipedia.org/w/index.php?title=Viberate&diff=prev&oldid=810246241] [https://en.wikipedia.org/w/index.php?title=Entersekt&diff=prev&oldid=803739257] [https://en.wikipedia.org/w/index.php?title=Fastbrick_Robotics&diff=prev&oldid=802290980] or [https://en.wikipedia.org/w/index.php?title=BEST_Robotics&diff=prev&oldid=801542531] [https://en.wikipedia.org/w/index.php?title=Songs_Music_Publishing&diff=prev&oldid=809625157] [https://en.wikipedia.org/w/index.php?title=Grovo&diff=prev&oldid=804474767] [https://en.wikipedia.org/w/index.php?title=Edcon&diff=prev&oldid=805880190]. Rentier (talk) 22:24, 23 February 2018 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

See Wikipedia:Sockpuppet investigations/Kickingback77.--Bbb23 (talk) 23:22, 23 February 2018 (UTC)

• I refer readers to that SPI, where I suggest this is merged for the time being. Both Kim Marcos89 and ChristianFernandes12 are {{staleIP}}. ChristopherWilliams, Philip Louis, and DongLee can't be directly confirmed to each other due to anonymising proxy usage. There's a lot of similarities to how these anonymisers and accounts are being used, and I recommend they all get DUCK blocked, not just for UPE but also for deliberately evading scrutiny and suspicious behaviour. {{nosleepers}}. {{IPblocked}}. Again, it's possible that this is the farm known as {{user|Highstakes00}}, IMO, so feel free to eventually merge there. -- zzuuzz ^(talk) 08:40, 24 February 2018 (UTC)

:*{{re|Zzuuzz}} I think it unlikely, behaviorally and technically, that this is Highstakes, and I'd rather it not be merged to that case.--Bbb23 (talk) 19:41, 24 February 2018 (UTC)

• All accounts {{bwt}} on account of anonymizing proxies being used to evade detection, and it being unlikely there's any good reason for it. I'm going to merge this into Kickingback77, where a bunch more of these "obviously evading detection" UPE socks have been reported. Ivanvector (^Talk/_Edits) 16:01, 29 April 2018 (UTC)

----