Wikipedia:Sockpuppet investigations/Lilianarice/Archive

(originally filed at Wikipedia:Sockpuppet investigations/Xingzuin)

• {{checkuser|1=Raaajjj}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Xingzuin User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Spamming the same ref[https://en.wikipedia.org/w/index.php?title=Traffic_collision&type=revision&diff=793050916&oldid=791009748][https://en.wikipedia.org/w/index.php?title=List_of_American_Trial_Lawyer_Associations&diff=prev&oldid=792555991]. Not sure if socks are just responding to the same job post. Doc James (talk · contribs · email) 17:11, 30 July 2017 (UTC)

;Spam links

• {{spamlink|marylandaccident.com}}
• {{spamlink|offshoredesk.com}}
• {{spamlink|broadcastseo.com.au}}
• {{spamlink|www.ahealthblog.com}}
• {{spamlink|forexrobot.com}}
• {{spamlink|bestadvisor.com}}
• {{spamlink|fasttreeremovalatlanta.com}}
• {{spamlink|clashgraphics.com}}
• {{spamlink|uudet-nettikasinot.fi}}
• {{spamlink|alfonseo.de}}
• {{spamlink|myqualitydentist.com}}
• {{spamlink|yourfootpalace.com}}
• {{spamlink|schwartzlawncare.com}}

;Another possible sock

• {{checkuser|1=Larddwe}}
• {{checkuser|1=Jayyayhuz}}

Doc James (talk · contribs · email) 22:45, 2 August 2017 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Both are already blocked. Closing. GAB^gab 22:33, 30 July 2017 (UTC)

::User:GeneralizationsAre the question is are there any more that are socks. Doc James (talk · contribs · email) 23:31, 30 July 2017 (UTC)

:::{{re|Doc James}} Ah, I see. {{selfendorse}}. Thanks very much, GAB^gab 00:09, 31 July 2017 (UTC)

• {{inconclusive}} and {{Nosleepers}} Salvio ^{Let's talk about it!} 11:10, 31 July 2017 (UTC)

{{user:Sro23/ClerkAtWork}}

• Tagged master and sock as suspected, closing. Sro23 (talk) 18:37, 31 July 2017 (UTC)
• {{clerknote}} I have [https://en.wikipedia.org/w/index.php?title=User:COIBot/Poke&diff=793491982&oldid=793083947 requested a report] to see if there are other accounts and placing on hold in the meantime.
   — Berean Hunter (talk) 02:38, 2 August 2017 (UTC)

::Yes, there is. Based on [https://en.wikipedia.org/w/index.php?title=Rear-end_collision&diff=prev&oldid=792381208 this edit], {{checkuser|1=Robrobinno}} should be a DUCK. Salvio is this a confirmed account?
 — Berean Hunter (talk) 02:42, 2 August 2017 (UTC)

• {{checkuser|1=Robrobinno}} and {{checkuser|1=Xingzuin}} are {{confirmed}}. Raaajjj is still technically {{unrelated}}. And now for a whole lot of socks, the following accounts are also, technically speaking, {{confirmed}}, but, just to be on the safe side, {{behav}}
• {{checkuser|1=Dotcommastermind}} Account being used to barry spam from other accounts
• {{checkuser|1=Robrobinno}} Spamming same link. Blocked.
• {{checkuser|1=Mrxjoobaa}} Spamming. Blocked.
• {{checkuser|1=Jessiemozak}}
• {{checkuser|1=Nikkofuze}}
• {{checkuser|1=Joeemorales}}
• {{checkuser|1=Genafaymin}}
• {{checkuser|1=Jessehee}}
• {{checkuser|1=Mikejohnas}}
• {{checkuser|1=Josemuniqu}}
• {{checkuser|1=Jefftoxu}}
• {{checkuser|1=Zillokinu}}
• {{checkuser|1=Zookieman}}
• {{checkuser|1=Weiwungxu}}
• {{checkuser|1=Joroelss}} Spamming and then hid by Dotcommastermind
• {{checkuser|1=Nikonifyu}}
• {{checkuser|1=Leenaxius}}
• {{checkuser|1=Joziejoo}}
• {{checkuser|1=Ramtadxso}}
• {{checkuser|1=Jorishandez}}
• {{checkuser|1=Simonlios}}
• {{checkuser|1=Kudinshua}}
• {{checkuser|1=Elsiefunny}}
• {{checkuser|1=Fuzzbummo}}
• {{checkuser|1=Joshmozak}}
• {{checkuser|1=Buisonxol}}
• {{checkuser|1=Jyssiengo}}
• {{checkuser|1=Manugussy}}
• {{checkuser|1=Lolaspecturia}}
• {{checkuser|1=Diondodds}} Salvio ^{Let's talk about it!} 10:21, 2 August 2017 (UTC)

:::User:Salvio giuliano checking and blocking. The pattern is that one account adds a spam link and then the second account quickly makes a minor edit to throw off the bots that deal with spamming. Appears to work. Likely all the links these accounts are adding need to be added to the blacklist. I must sleep but unless someone beats me to it will continue later. Doc James (talk · contribs · email) 15:36, 2 August 2017 (UTC)

::::{{bnt}} All the accounts and removed the spam. Listed a few affected articles at COIN. SmartSE (talk) 19:58, 2 August 2017 (UTC)

::::[https://en.wikipedia.org/w/index.php?title=MediaWiki:Spam-blacklist&diff=prev&oldid=793604917 Blacklisted] link local, no cross-wiki that I can see. Still looking at this...
 — Berean Hunter (talk) 20:41, 2 August 2017 (UTC)

:::::User:Berean Hunter they are adding a variety of spam links. Will go through and create a list of the rest. Doc James (talk · contribs · email) 21:17, 2 August 2017 (UTC)

{{od}}

{{clerknote}} The current status, all of the above are indeffed except:

• User:Mikejohnas (not blocked)
• User:Elsiefunny (not blocked)
• User:Manugussy (not blocked)
• User:Diondodds (not blocked, oldest account)

• User:Zillokinu (blocked 24 hours for edit warring, no tag)
• User:Zookieman (blocked 24 hours for edit warring, no tag)

...so I'm confused by SmartSE's all blocked and tagged comment above. This is important because the casename would be moved to the oldest account as the master and it is not currently blocked. Salvio did confirm the accounts. Looking for clarification.
 — Berean Hunter (talk) 21:07, 2 August 2017 (UTC)

:::All accounts now blocked indef and tagged. Checking spam links added by other accounts. Doc James (talk · contribs · email) 22:50, 2 August 2017 (UTC)

::::Woops. I definitely checked all the contribs... just must have missed some blocks and evidently the easyblock script was playing up on the last two as I definitely only clicked on confirmed socks. Thanks Berean Hunter for checking and User:Doc James for fixing it! SmartSE (talk) 12:10, 3 August 2017 (UTC)

New account created adding the same link aswell just before it was added to the blacklist.

• {{checkuser|1=Wulago}}
• {{checkuser|1=Hilmomanui}} This one missed, not sure why?

They are still creating accounts and spamming. Gr Doc James (talk · contribs · email) 22:53, 2 August 2017 (UTC)

• User:Berean_Hunter can you add the rest of the spam links to the blacklist? Else I can try to figure out how. Doc James (talk · contribs · email) 22:59, 2 August 2017 (UTC)
• I've [https://en.wikipedia.org/w/index.php?title=MediaWiki%3ASpam-blacklist&diff=793644177&oldid=793604917 added the 12 domains above]. MER-C 02:18, 3 August 2017 (UTC)

More accounts from the database:

• {{checkuser|Loganhustler}}
• {{checkuser|Loganhustler89}}
• {{checkuser|Richardcoxs}}
• {{checkuser|Gunnsr42}}
• {{checkuser|Koundal18}}

Stale:

• {{checkuser|Goldcoastseo}}
• {{checkuser|Raybrighton2016}}
• {{checkuser|Wendi7620}}
• {{checkuser|Sage1982}}
• {{checkuser|Jayyayhuz}}
• {{checkuser|Fasniomu}}
• {{checkuser|Spetyosli}}

MER-C 03:05, 3 August 2017 (UTC)

• After another round of checks:
• {{StaleIP}}
• {{checkuser|1=Jayyayhuz}}
• {{confirmed}}, but fell through the cracks when I was copying and pasting accounts earlier (sorry)
• {{checkuser|1=Hilmomanui}}
• Apparently {{unrelated}}
• {{checkuser|1=Wulago}}
• Can't connect them to our main sockfarm, but they're related to each other
• {{checkuser|1=Syricko}}
• {{checkuser|1=Doomsatn}}
• {{checkuser|1=FeaturedLime}}
• {{checkuser|1=Larddwe}}
• {{checkuser|1=Tartser}}
• {{checkuser|1=Hasswielan}}
• Can't connect them to any other sockfarm, but they're related to each other
• {{checkuser|1=Mhmdunis}}
• {{checkuser|1=Loganhustler89}}
• Apparently, technically {{unrelated}} to any other and to each other, but CU is of limited use, here, since the IPs used (even by the confirmed socks) are all over the place
• {{checkuser|Loganhustler}}
• {{checkuser|Richardcoxs}}
• {{checkuser|Gunnsr42}}
• {{checkuser|Koundal18}}
• For now, it's all. Salvio ^{Let's talk about it!} 10:22, 3 August 2017 (UTC)
• {{clerknote}} {{re|Salvio giuliano|Doc James|Berean Hunter|MER-C}} For the Syricko group, see Wikipedia:Sockpuppet investigations/Anatha Gulati. GAB^gab 14:25, 3 August 2017 (UTC)
• Closing as is. I'm not sure that anything would be gained by moving the account to the oldest here or tagging.
   — Berean Hunter (talk) 22:11, 23 August 2017 (UTC)

----

{{small|(originally filed at Wikipedia:Sockpuppet investigations/Mrgrayzon)}}

• {{checkuser|1=Oliganobo}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Mrgrayzon User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

See filter logs: [https://en.wikipedia.org/w/index.php?title=Special:AbuseLog&wpSearchUser=Oliganobo Oliganobo] and [https://en.wikipedia.org/wiki/Special:AbuseLog?wpSearchUser=Mrgrayzon&wpSearchTitle=&wpSearchFilter= Mrgrayzon] both created the same article on a software product perfectly on the first edit as brand new accounts.

Oliganobo additionally created it by a different name to avoid being tagged by the bot as an old AfD.

This has all the hallmarks of socking to include a commissioned article in the encyclopedia. Requesting CU to see if there are any other accounts out there. TonyBallioni (talk) 20:12, 24 August 2017 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Oliganobo is {{likely}} to Mrgrayzon. Master blocked one week, sock indef blocked. Closing. Callanecc (talk • contribs • logs) 08:11, 26 August 2017 (UTC)

----

(originally filed at Wikipedia:Sockpuppet investigations/Michakellies)

• {{checkuser|1=Leannjoyce}}
• {{checkuser|1=Marriehudson}}
• {{checkuser|1=Buckyloonion}}
• {{checkuser|1=Karenswiss}}
• {{checkuser|1=Pittdenloas}}
• {{checkuser|1=Janicediscko}}
• {{checkuser|1=Kellyhunggino}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Leannjoyce User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

These users seem to be a cluster of spam accounts working to a pattern.

1. Two word names which are run together without spacing or capitals,
2. Undertake 12-ish inconsequential edits on articles sharing the same initial letter, Leannjoyce - N, Marriehudson - K, and Buckyloonion - J,
3. Go to sleep until autoconfirmed kicks in,
4. Create spam.

It seems to be a repeated pattern to game their way past ACTRIAL. The gaps in the initial letters used suggest there's an L spammer & an M spammer at the least, more likely more, and sleepers which have not yet been used for spam. Cabayi (talk) 15:19, 16 October 2017 (UTC)

Bucky & Leanne's spam overlap at BedJet (company) & BedJet.

Looking through [https://en.wikipedia.org/wiki/Special:AbuseLog?wpSearchUser=Pittdenloas&wpSearchTitle=&wpSearchFilter=867 the output from EF 867] found Pittdenloas on the letter U with spam at Major Food Group. Cabayi (talk) 15:52, 16 October 2017 (UTC)

Janicediscko on the letter W, spam at MySugr.

Kellyhunggino on the letter Q, spam at O’Keefe Reinhard & Paul. Cabayi (talk) 16:28, 16 October 2017 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I've added Karenswiss to the SPI. Similar MO: adding Wikilinks to random articles to get autoconfirmed [https://en.wikipedia.org/w/index.php?title=Balakrishna_Hari_Kolhatkar&diff=prev&oldid=801519993] [https://en.wikipedia.org/w/index.php?title=2011_UEMOA_Tournament_squads&diff=prev&oldid=801521416] and then creating an article perfectly in [https://en.wikipedia.org/w/index.php?title=Special:AbuseLog&wpSearchUser=Karenswiss one edit]. The naming pattern is also the same here for all the accounts: one full name with no spaces and where the last name is kept lowercase. TonyBallioni (talk) 15:44, 16 October 2017 (UTC)

• Also, for whomever the CU or clerk is processing this, can we get a check for sleepers/other accounts. This looks pretty large scale, and given the similar username patterns, I'm leaning that this is a connected ring rather than just a bunch of independent actors following the same methods. TonyBallioni (talk) 16:32, 16 October 2017 (UTC)
• {{ping|GeneralizationsAreBad}} no real need for COIN here IMO. I've tagged the four articles created by this farm for G5 working on the reasonable assumption that this ring has been blocked before. They were trying to build up a bunch of accounts to get around ACTRIAL and we were lucky that we were able to catch them early. TonyBallioni (talk) 18:37, 16 October 2017 (UTC)

{{User:Sir Sputnik/ClerkAtWork}}

• {{Endorse}} - There's a fairly clear pattern here. Given the number of accounts involved, and the fact that they're trying to game the limitations placed on new accounts, I have to agree with TonyBallioni. The existence of additional socks seems likely. Please check to confirm socking, and identify potential sleepers. Sir Sputnik (talk) 16:45, 16 October 2017 (UTC)
• {{confirmed}}:
• {{Checkuser|Biggielonna}}
• {{Checkuser|Briannaenlok}}
• {{Checkuser|Buckyloonio}}
• {{Checkuser|Janicediscko}}
• {{Checkuser|Judymclien}}
• {{Checkuser|Kellyhunggino}}
• {{Checkuser|Leannjoyce}}
• {{Checkuser|Leenayoshin}}
• {{Checkuser|Lioneljunga}}
• {{Checkuser|Lougrisl}}
• {{Checkuser|Luissoboo}}
• {{Checkuser|Marcorobbies}}
• {{Checkuser|Marggieroy}}
• {{Checkuser|Marriehudson}}
• {{Checkuser|Mcgarriso}}
• {{Checkuser|Michakellies}}
• {{Checkuser|Millienewton}}
• {{Checkuser|Milojameson}}
• {{Checkuser|Moseschuahi}}
• {{Checkuser|Nolanbusho}}
• {{Checkuser|Pittdenloas}}
• {{Checkuser|Rainiewongs}}

:​—DoRD (talk)​ 17:40, 16 October 2017 (UTC)

• {{clerknote}} Wow. I've moved the case and {{bnt}} everyone. {{re|TonyBallioni}} I recommend you take this to COIN. Thanks, GAB^gab 18:35, 16 October 2017 (UTC)
• {{clerknote}} {{re|TonyBallioni}} OK, you're the expert :) See also MySugr, O’Keefe Reinhard & Paul. GAB^gab 18:39, 16 October 2017 (UTC)
• Looks like there's nothing left to do here. Closing. Sir Sputnik (talk) 19:32, 16 October 2017 (UTC)

----

(originally filed at Wikipedia:Sockpuppet investigations/Michakellies)

• {{checkuser|1=Leenationggga}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Michakellies User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Creation of Jū-Ni (restaurant), which master/sock uploaded and crossover with {{u|Leannjoyce}} [https://en.wikipedia.org/w/index.php?title=Naeem_Sabir&diff=803809222&oldid=802551944 here], [https://en.wikipedia.org/w/index.php?title=Nach_to_the_Groove&diff=802551611&oldid=800060091 here] and [https://en.wikipedia.org/w/index.php?title=Naeem_Sabir&diff=802551944&oldid=741023872] also follows same naming pattern. CHRISSYMAD ❯❯❯¯\_(ツ)_/¯ 15:47, 24 October 2017 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

{{User:Sir Sputnik/ClerkAtWork}}

• {{duck}} the page created is an exact replica of Ju-Ni (Japanese restaurant), which was created by {{checkuser|Moseschuahi}}, a CU confirmed sock of this group, so its either the same person or they are different people who have a shared drive and it would be WP:PROXYING. The sock in this report is {{Sblock}}. I'm not closing, because I think it'd be worth a clerk assessing whether CU was needed for sleepers given the number found on the last check. TonyBallioni (talk) 16:04, 24 October 2017 (UTC)
• {{Requestandendorse}} - Given the sheer number of accounts found in the last case, a check for sleepers is probably a good idea. Sir Sputnik (talk) 16:34, 24 October 2017 (UTC)
• {{confirmed}} plus {{checkuser|Marieannaenox}}. {{checkuser|Maccygondo}} is {{tallyho}} (see [https://en.wikipedia.org/w/index.php?title=Avaza_Software_(company) this deleted article] as well). ​—DoRD (talk)​ 17:10, 24 October 2017 (UTC)
• All accounts {{Sblock}} The deleted article for Macygondo is similar enough in format and has other signs of a commissioned work as well. TonyBallioni (talk) 17:20, 24 October 2017 (UTC)
• Tagging and closing. Sir Sputnik (talk) 17:20, 24 October 2017 (UTC)

----

{{small|(originally filed at Wikipedia:Sockpuppet investigations/Mrgrayzon)}}

• {{checkuser|1=Lilianarice}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Mrgrayzon User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Lilianarice {{diff2|633667116|has disclosed}} that they are "managing" WP editing projects. Although activity on this account halted after November 2014, off-wiki evidence exists that as of today, they are still offering paid WP article editing. This account Oliganobo has recently attempted to recreate one of Lilianrice's deleted articles, Avaza (software) as Avaza Software. Realizing that CU data is out of scope, consider this a request for procedural WP:DUCK linkage of the accounts based on the off-wiki stuff. {{U|Doc James}} and WMF Legal are aware of the contents of the off-wiki info. ☆ Bri (talk) 17:27, 25 October 2017 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

{{User:Sir Sputnik/ClerkAtWork}}

• {{u|Bri}}, just as a procedural comment not being aware of the off-wiki stuff, that article is linked to {{checkuser|Maccygondo}} which DoRD found yesterday to be technically indistinguishable from the group at Wikipedia:Sockpuppet investigations/Michakellies. It also appears behaviorally linked to the accounts in that archive by username format. TonyBallioni (talk) 17:32, 25 October 2017 (UTC)
• One question is are their any obvious sleeper accounts. Doc James (talk · contribs · email) 23:59, 25 October 2017 (UTC)
• DoRD did two sleeper checks and found a total of around 27(?) accounts. I'm sure there are probably stale ones if you go through the various deleted articles. TonyBallioni (talk) 00:00, 26 October 2017 (UTC)
• {{Requestandendorse}} - Please compare this case and Wikipedia:Sockpuppet investigations/Michakellies. Thanks, GAB^gab 23:51, 27 October 2017 (UTC)
• This one's a pain-in-the-ass. Between the master here and Wikipedia:Sockpuppet investigations/Michakellies, {{Inconclusive}} due to proxy usage. Having said that, the master here is {{tallyho}} to {{U|Msvickno}}, which appears to be spamming a link in a vaguely promotional manner, and also to {{U|Lizziehnazo}}, who created the promotional OverTheTop (company). {{U|Manugussy}} previously created OverTheTop, and is currently linked to Wikipedia:Sockpuppet investigations/Xingzuin, which is known for – you guessed it – link spam. I recognize this particular webhost because I've been dealing with an absurd number of accounts that have been link spamming from different ranges owned by the same company recently, and I just blocked about a dozen more on this range. I would recommend throwing the master in with Xingzuin based on these technical links. Everything mentioned above is {{bwt}} except {{U|Lilianarice}} which is so old that it's not worth doing anything about. ~ Rob₁₃^Talk 19:23, 28 October 2017 (UTC)
• [https://en.wikipedia.org/w/index.php?title=Special:Log&dir=prev&offset=20171028180421&limit=16&type=block&user=BU+Rob13&page=&tagfilter=&hide_thanks_log=1&hide_patrol_log=1&hide_tag_log=1&hide_review_log=1 These] are all the accounts I blocked in connection with this, just for the record. None are tagged, nor do I think worrying about tagging them will be particularly productive. ~ Rob₁₃^Talk 19:28, 28 October 2017 (UTC)
• {{Clerk request}} I've encountered additional crossover between promotional articles and the link spamming from Xingzuin. At this point, I think a merge is appropriate. ~ Rob₁₃^Talk 10:20, 30 October 2017 (UTC)
• This is related to Wikipedia:Sockpuppet investigations/Michakellies as well, so where to merge I'll leave up to the clerks. {{U|Ivanvector}} can come up with something, perhaps. ~ Rob₁₃^Talk 12:10, 30 October 2017 (UTC)
• {{onhold}} - merging these cases will be straightforward but will take me some time. Ivanvector (^Talk/_Edits) 14:37, 30 October 2017 (UTC)

::{{done}} - I have merged all three cases and moved to the name of the oldest account which I'm considering proven based on behaviour, however per Rob's note above I have not blocked the master account. I've re-tagged all of the accounts that had been tagged previously, as well as re-tagged the former masters, but have not blocked or tagged any other accounts. I'm leaving this as "checked" in case I missed anything, but don't hold on my account. Ivanvector (^Talk/_Edits) 15:15, 30 October 2017 (UTC)

:::{{re|Ivanvector}} You can definitely block the master. I just wasn't interested myself in looking at the behavioral links because of how old the account was. If you've already done so, no point leaving it unblocked. ~ Rob₁₃^Talk 16:22, 30 October 2017 (UTC)

• Looks like there's nothing left to do here. Closing Sir Sputnik (talk) 17:49, 12 November 2017 (UTC)
• {{re|Sir Sputnik|Ivanvector}} Another editor pointed out to me that the master is still unblocked here. Can you evaluate whether the master is behaviorally tied and block if so? Thanks. ~ Rob₁₃^Talk 03:29, 15 November 2017 (UTC)
• {{re|BU Rob13}} yes, I'm convinced to the point of certainty that Lilianarice is the master (I tagged with "checkuser evidence confirms") but I thought we all agreed that there's no good reason to block an account that hasn't edited in three years. Did I misread the discussion? Ivanvector (^Talk/_Edits) 13:43, 15 November 2017 (UTC)
• {{re|Ivanvector}} See my last comment in the chain above; if we're sure they're the same person, they should be blocked. I had originally deferred on looking into the account at all with the opinion that the time spent evaluating behavior could be better spent elsewhere, given the long inactivity. If you've already looked at it, though, it's worth blocking. ~ Rob₁₃^Talk 14:00, 15 November 2017 (UTC)
• Alright, the master is blocked. Since I don't expect a time-limited block to be of any use on an inactive account, the master's block is indefinite. Ivanvector (^Talk/_Edits) 14:05, 15 November 2017 (UTC)

----

• {{checkuser|1=Linamchu}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Lilianarice User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Recreation of Richard’s Foodporium, one of many variations of Richard’s Foodporium (food retailer) etc... plus follows same naming convention. CHRISSYMAD ❯❯❯¯\_(ツ)_/¯ 13:25, 9 November 2017 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

{{User:Sir Sputnik/ClerkAtWork}}

• {{adminnote}} the account is blocked as a duck: identical recreation. Requesting CU for a sleeper check given how massive previous incarnations of this have been. Not tagging yet since I've requested CU. TonyBallioni (talk) 13:41, 9 November 2017 (UTC)
• {{Endorse}} - Given the number of accounts used in the past, please check to identify potential sleepers. Sir Sputnik (talk) 17:49, 12 November 2017 (UTC)
• Linamchu is {{possible}} to {{checkuser|1=Bilonbios}} as they are on the same IP which is a proxy. Different UA but the spammy looking addition makes one wonder. Neither of the UAs match the other socks in this case however.
   — Berean Hunter (talk) 18:23, 14 November 2017 (UTC)
• Given the subject matter of the one edit, and the fact that the link is now broken, I'm inclined to think the proxy is being used by someone else now. Closing. Sir Sputnik (talk) 18:35, 14 November 2017 (UTC)

----

• {{checkuser|1=Rob Jaron}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Lilianarice User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Behaviour very reminiscent of Wikipedia:Sockpuppet investigations/Lilianarice/Archive#16 October 2017, multiple inconsequential edits on articles with same initial letter to acquire autoconfirmed, followed by spamming. Request CU because of use of multiple socks & sleepers previously. Cabayi (talk) 13:54, 4 December 2017 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• I'm not sure that Rob Jaron's behaviour links them to this case, but I am sure that a brand new account making exactly 10 edits before writing an article on a jewelry retailer that's been deleted before (as James Allen Jewelers) is the behaviour of a hired editor. {{endorse}} to see if this is the same user or some other, or if we need to make a new case. Also note that the original creation from a year ago was created by {{user|FeldBum}}, who has been a semi-active editor for 12 years, and the two articles are only somewhat similar. Ivanvector (^Talk/_Edits) 14:30, 4 December 2017 (UTC)
• {{re|Ivanvector}} Nothing obvious found. {{Inconclusive}} to the non-stale socks because they were editing from proxies (this account is not). As a side note, the 10 edits look a lot like link spam. ~ Rob₁₃^Talk 17:21, 4 December 2017 (UTC)
• Closing with no action. This could perhaps use a look from WP:COIN to evaluate whether this is paid editing, but I don't see enough to say these two editors are the same person. Pinging {{U|Smartse}} so he can determine if a thread there is a good idea. ~ Rob₁₃^Talk 17:16, 10 December 2017 (UTC)
• {{re|BU Rob13}} I concur that some of the edits look like spam, but others seem ok. The jewellery article is obviously UPE though so I think it is safe to assume they are a sock of somebody. With no remaining problems a COIN thread would be superfluous and I highly doubt that they will return, so I am not sure whether a block is warranted at the moment. SmartSE (talk) 16:57, 11 December 2017 (UTC)

----

• {{checkuser|1=Maryanneberwick}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Lilianarice User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Autoconfirmed gaming to upload images using similar methods to this sock farm. Initial [https://en.wikipedia.org/w/index.php?title=Draft:LawnGuru_(company)&oldid=822137804 creation] is perfectly formatted and includes maintenance banners, suggesting that it has been created as an article before. Also, note the company name in parenthesis and the formatting choices, which are methods used by UPE farms to throw off Special:Undelete (to the point I can't find the original source). These are methods used by this farm in the past. Additionally, the username format is almost identical to this farm's name of choice.

Asking for CU mainly for a sleeper check given how large this farm is: there might be some non-stale confirmeds, but unsure. The account is probably DUCKable on its own. TonyBallioni (talk) 23:36, 25 January 2018 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{inprogress}} reasonable request given some of the sleeper check results in the archive - TNT^❤ 23:38, 25 January 2018 (UTC)
• {{Nosleepers}}, nothing useful to go off in regards to confirming. Therefore, {{behav}} - TNT^❤ 23:41, 25 January 2018 (UTC)
• Duck blocked with tags per above. Clear UPE and the behavior aligns most closely with this farm. Closing. TonyBallioni (talk) 23:45, 25 January 2018 (UTC)

----

• {{checkuser|1=Alvisnoels}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Lilianarice User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Recreation of Jū-Ni (Japanese restaurant), which is a clear sign of this farm, along with the similarities of autoconfirmed gaming. Requesting CU for sleepers. I've duck blocked, and think the behavioral evidence is strong enough regardless of the CU findings, but CU would be helpful to see what else is out there. TonyBallioni (talk) 15:50, 11 March 2018 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Technically unrelated from what I have seen.
   — Berean Hunter (talk) 18:30, 11 March 2018 (UTC)
• Closing. As noted, I’ve blocked behaviorally given that this is next to identical to the previously deleted articles. TonyBallioni (talk) 18:50, 11 March 2018 (UTC)

----

• {{checkuser|1=Mariavisa}}
• {{checkuser|1=Leonakarlis}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Lilianarice User compare report] Auto-generated every hour.

Created Avaza (company) (one of the clients of this farm). Other behavioral similarities to this farm that makes it a proven sock. Already blocked by {{u|Smartse}} for spamming. Asking for CU for sleepers. TonyBallioni (talk) 13:48, 22 June 2018 (UTC)

Also added Leonakarlis for creating Richard's Foodporium, one this firms other clients. Blocked and also likely stale, but adding for the record. TonyBallioni (talk) 13:55, 22 June 2018 (UTC)

• {{u|Bbb23}}: Mariavisa just edited today. It is definitely one of the socks. I was asking for a CU to look for other account. If that’s not possible, it’s okay, I’m just confused by the stale finding. TonyBallioni (talk) 15:10, 22 June 2018 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

This case is {{IPstale}}. Closing.--Bbb23 (talk) 14:41, 22 June 2018 (UTC)

:{{re|TonyBallioni}} I don't run a check to look for other accounts based on only one account.--Bbb23 (talk) 15:28, 22 June 2018 (UTC)

----