Cannabis Ruderalis

thcscience_admin

Note: This page was recently mentioned on Boing Boing,[1] the Daily Dot,[2] and the Wikipedia Signpost.[3] --Guy Macon (talk) 14:36, 10 October 2013 (UTC) ...And Vice —Justin (koavf)❤T☮C☺M☯ 18:39, 19 October 2013 (UTC)[reply]

Contents



Morning277

Morning277 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Older archives were moved to an archive of the archive because of the page size and are listed below:

14 August 2012[edit]
Suspected sockpuppets

User:SimonKnowsAll indicated previous block(s) [4] blamed on "idiots at my school". His contribs are 12 WP:AfD !votes, then 3 promotional articles on 7, 9 and 10 Aug. CyberSafe was created by SimonKnowsAll on 10 Aug and quickly AfD. Only significant contribs by User:Bioengineer+attorney [5] and User:Unhmba [6] are "Keep" !votes in that AfD. User:Engineer+Attorney inadvertently created by User:Bioengineer+attorney?[7]; it hasn't been used. Looks like ip:108.18.223.201 [8] was failure to log back into a user account. User:Limemine was inactive for almost two years, then first activity was a "Keep" !vote on the AfD[9] and then 4 WP:AfD !votes; User:SimonKnowsAll userpage says his favorite activity is WP:AfD editing.[10] Doctree (talk) 14:04, 13 August 2012 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Quite a warm welcome to a new Wikipedian! How about these facts. I am an atty. I am a BSE in engineering. How about you? In a court this is called a preponderance of the evidence in favor of defendant. All I've learned is that (1) new users are unwelcome, and (2) the protocol is to attack if someone disagrees. Noted. I don't want to wear out the welcome mat!Bioengineer+attorney (talk) 02:51, 14 August 2012 (UTC)[reply]

  • Odd, I worked in the field, and in a civil case the burden of demonstrating a preponderance is upon the plaintiff, whereas in a criminal case (the proper analogy) the threshold is entirely different. Very odd choice of phrasing, coming from a lawyer. Dennis Brown - 2¢ © Join WER 11:40, 14 August 2012 (UTC)[reply]
  • Is it possible to check for some more +attorney accounts? I feel like I saw one the other day but can't find it now. Ryan Vesey 04:36, 15 August 2012 (UTC)[reply]
  • I have checked just about everything and were just waiting to post the final socklist once the evidence is agreed apon. I haven't seen any other +attorney accounts anywhere while running the checks. -- DQ (ʞlɐʇ) 14:28, 15 August 2012 (UTC)[reply]
Clerk, CheckUser, and/or patrolling admin comments[edit]
  • CheckUser requested - Self-endorsed by clerk for checkuser attention - Looks pretty ducky, complete with sleepers, enough to easily justify a CU, with a search for more sleepers please. Dennis Brown - 2¢ © Join WER 01:01, 14 August 2012 (UTC)[reply]
  • Note, the oldest account is actually User:Limemine, but will wait for CU before a decision to rename case. Dennis Brown - 2¢ © Join WER 01:08, 14 August 2012 (UTC)[reply]

The following are  Confirmed with SimonKnowsAll (talk · contribs):

Note that Engineer+Attorney does not actually exist as an account: Bioengineer+attorney just created a page in the user space. Based on the large attempt to slant consensus and spread scrutiny, and the considerable amount of PR guff, I don't think it's unreasonable to speculate that we have have a paid COI editor here. WilliamH (talk) 14:02, 14 August 2012 (UTC)[reply]

Marking this as  In progress, as there's more checking to be done. WilliamH (talk) 14:17, 14 August 2012 (UTC)[reply]
Found a couple more accounts:
In terms of an established member of the community as opposed to the oldest account, the CheckUser- Confirmed master is unambiguously Morning277 (talk · contribs), who I am told has been soliciting work via freelancing websites, such as Elance.com. Another batch of accounts is to follow. WilliamH (talk) 15:00, 14 August 2012 (UTC)[reply]
  • WilliamH has asked me to take a second look and I have already found a few more accounts, I'll be continuing this for a good while but may have to step out, so it could take a bit. -- DQ (ʞlɐʇ) 15:43, 14 August 2012 (UTC)[reply]
  •  On hold -- DQ (ʞlɐʇ) 19:55, 14 August 2012 (UTC)[reply]
Thanks DQ. One more  Confirmed account: DrewWhoAZ (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). WilliamH (talk) 20:08, 14 August 2012 (UTC)[reply]
  • Ok, so i've finished talking to a few other functionaries on this, though please take what I say with a grain of salt and note that CU is not always conclusive, and doesn't tell the whole story.
  • Woodcrester (talk · contribs) & Glassoftamarindo (talk · contribs) are  Confirmed
  • Hathatehat (talk · contribs) stared editing two hours before Glassoftamarindo, and is  technically indistinguishable, but the IP /could/ be a webhost, making the connection less than clear.
  • Furthermore Uh847 (talk · contribs), Mark211 (talk · contribs), MalcomMarcomb11376 (talk · contribs), and International1211 (talk · contribs) are  Confirmed to William's group above.
  • Since there is a lot of webhost/paid proxy abuse, behavior should be your number one factor in determining socks in this investigation.
  • I have blocked several ranges related to this case, all proxy/webhost related. -- DQ (ʞlɐʇ) 01:10, 20 August 2012 (UTC)[reply]
  •  Clerk note: I am currently filtering through this rather large list of names to determine the proper action for each. I've already moved the master to the recommended master per WilliamH. Dennis Brown - 2¢ © Join WER 15:21, 20 August 2012 (UTC)[reply]
  • Add possible Steve.sc90 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Add possible Yasir.Ab2 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Note: An-Apple-A-NY-Day (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) keeps coming up as a common link in my searching. Dennis Brown - 2¢ © Join WER 15:58, 20 August 2012 (UTC)[reply]
  • I have to step out for a few hours, but I am checking. -- DQ (ʞlɐʇ) 17:55, 20 August 2012 (UTC)[reply]
  • CU isn't conclusive, because of webhost/proxy use, but Yasir.Ab2 is using similar proxies as before. Both Useragents do match. Steve.sc90 and DrewWhoAZ are on the same webhost with exact same useragents. An-Apple-A-NY-Day has also been seen on this range, different Useragent though. -- DQ (ʞlɐʇ) 03:55, 21 August 2012 (UTC)[reply]
  • Guackid121is not blocked yet and the nature of their edits raises questions, so I would suggest monitoring. The two sleepers without edits are blocked as suspected socks. The rest have been linked behaviorally, in addition to CU, which is why this took so long to prepare. There is still a strong cross over with User:An-Apple-A-NY-Day, and perhaps I will put a note in that archive pointing here. The IP is linked as well, but seems to be a cellphone IP, so blocking would be useless, thus not done. Due to the extreme nature of socking, I have chosen to indef block the sock master, User:Morning277. I will leave a review up to another admin if the editor requests one, and defer to their wisdom. All blocked editors are tagged and have block notices. Dennis Brown - 2¢ © Join WER 15:30, 21 August 2012 (UTC)[reply]
  • Add Vohn.Ludwig (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) who ties into Prezmittens sandbox, now deleted and now blocked. More to come.... Dennis Brown - 2¢ © Join WER 00:32, 22 August 2012 (UTC)[reply]

Dennis Brown - 2¢ © Join WER 15:58, 22 August 2012 (UTC)[reply]

  •  Confirmed the following are the same and connects the dots to a previously used webhost provider by the users in previous results:
  • There are 4 other accounts on this range (two appear to be related, but not abusing multiple accounts) appearing not related to anyone. The accounts I have not mentioned will be under a hardblock, so they will have to find a new range, and I'll be keeping an eye on them.
  •  Confirmed the following are the same, but not using a webhost, and not showing technical relation to any other users:


22 August 2012[edit]
Suspected sockpuppets


Chiliconwiki is a newly created account that is following the same pattern of adding content related to Shazi Visram, which is a recreation of material found on User:PrezMittens/sandbox/HFF, an already blocked sockpuppet account. MikeWazowski (talk) 23:34, 22 August 2012 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

Well that's not pretty.  Confirmed the same are:

Sleepers:

The account Chiliconwiki (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) that spawned this has significant overlap, taking Mike's findings into account I would also call it confirmed.

I also reverted Cogent Fibre just now. The latest edits are related, but the previous editors seems unrelated -- although he may also be a paid editor, I find it suspicious that they both worked on it at more or less the same time, and Baby on the Move is also very suspicious (apparent owners of the company edited it a few days after creation). This warrants a follow-up and probably cleanup effort, but I don't know where. Amalthea 10:50, 24 August 2012 (UTC)[reply]

  •  Clerk note: I've blocked this latest group, including Guackid121, who I hand't previous but the double-linking with the others makes it quite plausible that what we have here is not one person with lots of socks, but a small nest of COI, a company that is socking for profit, so a combination of meatpuppetry/sockpuppetry. I don't advertise for them, but I will be happy to email any CU their web address. For our purposes, they are acting as one, so they will be treated as one. Unfortunately, I have some more names that I'm working on, so we are STILL not done. Dennis Brown - 2¢ © Join WER 11:09, 24 August 2012 (UTC)[reply]
    • If you have figured out official contact information for them you can try sending it to Jimbo with a pointer to this AfD -- he started it after all, maybe he is interested in following up on it. If anyone can create some pressure there it's him. Amalthea 13:11, 24 August 2012 (UTC)[reply]
      • I'm not sure what that would accomplish, however, as they make a living socking on Wikipedia and I'm not sure what Jimmy can do to persuade them otherwise. Dennis Brown - 2¢ © Join WER 16:04, 24 August 2012 (UTC)[reply]
      • As an update, I'm still working on this. It looks like it may be more than one person, doing very similar work, and I'm trying to separate them, which isn't a minor task. Dennis Brown - 2¢ © Join WER 14:22, 27 August 2012 (UTC)[reply]
  • There is a great deal of sorting to be done, and very likely, this is more than one person, so a combination of meat and sock puppeting, working as a group, but the use of proxies and webhosts are muddying up the waters. Closing for now, may have to clean up in the archives later. Dennis Brown - 2¢ © Join WER 11:24, 1 September 2012 (UTC)[reply]
17 September 2012[edit]
Suspected sockpuppets

Brand new editor posts polished article that was previously worked on by recently blocked sockmaster. See also User:Morning277/sandbox/BUSA. Logical Cowboy (talk) 19:57, 17 September 2012 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I'm a little late to this party, but I've got another suspicious account.

DownRightMighty (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

New editor inserting a logo uploaded by Morning277 which was otherwise only used in the sockmaster's sandbox: User:Morning277/sandbox/MM, which DownRightMighty also used as a base for their own (now deleted) sandbox build of the article. They are also involved in what certainly appears at first glance to be significant whitewashing of Mercy Ministries. VernoWhitney (talk) 22:29, 12 October 2012 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

Örks. Who knows. Yet another range, this time from another country entirely, no obvious proxying. In addition to yours, I actually have more accounts that are suspicious and could be Morning277. In total:

Group 1
Group 2
Group 3
Group 4
Group 5

The accounts in the groups are very likely controlled by the same person, respectively. There is some indication that they are all the same. But the IPs are from all over the place, some are obvious hosting companies whose ranges are blocked by now but of course disguise all direct connections, so I have no chance of making a direct connection.

We can't stop him from editing (unless possibly someone finds out who is behind this/where the editing jobs are sold and we get Jimbo to pressure them to make it stop through official channels). While this is going on, two options I see:

  1. We take the articles and do our best to minimize damage: Aggressively remove POV (which still leaves us in danger to have an extremely unbalanced article), AfD if page doesn't appear to pass notability guidelines.
  2. Try to disincentivize his editing by aggressively G5ing his pages, and possibly recreating them as stubs.

Amalthea 21:05, 17 September 2012 (UTC)[reply]

Comment: HappyTwoBEE is an SPA pushing Bianca Jade, who appeared after the previous version of that article was deleted with fairly scathing comments at WP:Articles for deletion/Bianca Jade (2nd nomination). That previous version was the work of two other SPAs, ShanaScala (talk · contribs) and Nbon91 (talk · contribs). It would be worth checking them for relationship with this cluster. JohnCD (talk) 16:51, 19 September 2012 (UTC)[reply]
  • All blocked. I've tagged them all as discrete groups rather than all as Morning277 socks, except for the accounts which Amalthea noted as most probably being operated by M277. Archiving, AGK [•] 19:07, 13 October 2012 (UTC)[reply]
17 October 2012[edit]
Suspected sockpuppets


TouchdownJimmy is a new editor who has continued Morning277's work at Kevan Barlow and started another new fairly promotional bio along the same lines as Morning277's other work.

DownRightMighty is another new editor inserting a logo uploaded by Morning277 which was otherwise only used in the sockmaster's sandbox: User:Morning277/sandbox/MM, which DownRightMighty also used as a base for their own (now deleted) sandbox build of the article. They are also involved in what certainly appears at first glance to be significant whitewashing of Mercy Ministries. This one is rather less quackish than the other sock, but still concerning. VernoWhitney (talk) 20:20, 17 October 2012 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]
22 December 2012[edit]
Suspected sockpuppets

This is a sock of Morning277, who was blocked for massive sockpuppetry--had about 50 socks. This sock created an article, One Hour Translation that was commissioned to Morning277 on a paid external website. I have links to establish all of this--please contact me and I will email. Logical Cowboy (talk) 01:54, 22 December 2012 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims. Logical Cowboy previously emailed me the links, and I think they prove without a doubt that this is another sock, and so checkuser is only needed to identify any other socks there may be. I would recommend against publicly sharing the information for various reasons. VernoWhitney (talk) 04:05, 22 December 2012 (UTC)[reply]

Just to follow this up, I'd also agree that there is strong evidence connecting Morning277 to PlainProofBrief - but it might constitute outing to reveal it on-wiki. There is also good evidence to suggest User:RaisedRotten may be connected, but I assume that Logical Cowboy would be on top of that. - Bilby (talk) 11:22, 22 December 2012 (UTC)[reply]
Clerk, CheckUser, and/or patrolling admin comments[edit]

It would be better if you posted those links on this case. However, you may email them to me if you wish. --(ʞɿɐʇ) ɐuɐʞsǝp 03:39, 22 December 2012 (UTC)[reply]

  •  Clerk endorsed - Endorsing for CU. Going on VernoWhitney's comment that there is socking at play here, I'm endorsing for confirmation, as well as a sleeper check for a prolific sockpuppetter. (X! · talk)  · @506  ·  11:07, 22 December 2012 (UTC)[reply]
  • I have blocked and deleted a number of accounts, and deleted and some contributions which I am absolutely convinced of and have good reason to believe that they are of a banned editor. Bilby, I would welcome the e-mail from you. WilliamH (talk) 12:13, 22 December 2012 (UTC)[reply]
  • From a purely technical point of view, I would say it is  Possible bordering on  Likely that the two listed accounts above are related. WilliamH, since you have also run a check, would you concur with this assessment? --(ʞɿɐʇ) ɐuɐʞsǝp 17:32, 22 December 2012 (UTC)[reply]
  • WilliamH has "commented" by blocking the account, so I think we can consider this matter resolved. --(ʞɿɐʇ) ɐuɐʞsǝp 01:35, 23 December 2012 (UTC)[reply]
10 July 2013[edit]
Suspected sockpuppets
All blocked.

I happened upon User:Sublimeharmony/sandbox11 and noticed a pattern: Sublimeharmony would put a draft of an article into that sandbox, then blank the page, then put another article into the same sandbox. These same articles would later appear in main space, but they weren't being created there by Sublimeharmony. Instead, each article was being put into the main space from a unique account, from which only a few minor edits had been done (enough to become autoconfirmed, and maybe a few more). I looked at some of the talk pages of the accounts involved, but didn't see any discussion about their work on these articles. I don't know that these accounts are all under common control; if they are not, they are at least editing in a way that obscures their collaboration. From the nature of the articles, I surmise that this is paid editing, which is allowed. The attempt to obscure authorship seems unnecessary.

all the diffs
The following discussion has been closed. Please do not modify it.

Kaysweet On June 24 at 21:04, Sublimeharmony puts an article about MarketLive into User:Sublimeharmony/sandbox11: [13]. The page is blanked by Sublimeharmony a few seconds later, also with a timestamp of June 24 at 21:04: [14]. On June 26 the article is created [15] in the main space as the [16] first edit by Khaysweet. I compared the article as it appeared in Sublimeharmony's user space with the way it looked when Khaysweet put it in main space. The only difference is the sandbox template and the addition of a space.

Brfiandt On June 17th at 19:28, Sublimeharmony replaces [17] the contents of User:Sublimeharmony/sandbox11 with an article [18] about Tom Kemp. A few minutes later, at 19:42, Sublimeharmony blanks the page[19]. On June 24th, Brfiandt creates [20] an article in main space about Tom Kemp, with basically the same text that had appeared in User:Sublimeharmony/sandbox11. It was Brfiandt's 12th edit [21].

Rocksdocksz On June 17th at 16:40, Sublimeharmony puts an article [22] about 4Cabling into User:Sublimeharmony/sandbox11. The draft gets a few edits and remains there until 19:28 on 17 June when it is replaced by the article about Tom Kemp mentioned above. At 18:50 on 20 June [23], Rocksdocksz creates an article in main space about 4Cabling, containing text the same as, or very similar to, what had appeared in User:Sublimeharmony/sandbox11. It is the 13th edit by Rocksdocksz [24].

For the remaining accounts I'm providing:

  1. a revision of User:Sublimeharmony/sandbox11
  2. a revision of an article in main space, in most cases the first revision, in which text is added that closely resembles the text which was in User:Sublimeharmony/sandbox11
  3. contributions of the account that did the main-space edit, in most cases showing only a few edits before or after and no other articles "created"

Crocyyks

LAHealthVol

Videditor

BankofRyan1

567rems

HenryW795

Deaunagibbs

Tahshimu

Qeskridge7

Idreesakhtar

Leonieabilay

Bokyqwer

Jhaneez_B

25cassandra

Poem07

Umeedalam

A1Abigail

John mikol

Lchabana

Dorothygaylevalencia

Echis1985

Fiddlenuggs

Sharmin rasid

Namfields

Floresstanton39

SDeneault

Cheerypenelope

Finstab0by

Mamun070

Happitasnor

Lennyjones32

Db_jackal

Jellupoddn

Freakjojo06

Jlbrownaz

Nooninupto

Bonnie2512

Sunlit1

Johnatos7

Supermansmrs

Jennifermelburn

Yhtak2013

Agnesatelance

Below are additions made on 11 July.

Clestcruz

Plasmapeleng

L.E.Evans

Alexalt42

Gulnaz_N

Emwrei

Pedroswish

Masumbinalam

Menglish2

Uhmelrek

Rakib87

Acciobook

Mightyman1978 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Nivedita 222 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Arifhasan23 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Phullar (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

MOmarFarooq (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Kristalmarch (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Ostwarez (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Kumcheong (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Yen-hai-nguyen (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

MSLewisWrites (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Hildred (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

CuirassierX (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Henriette.Kilo (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

My evidence against this one is weaker. I've lost track of the revision, but User:Sublimeharmony/sandbox11 contained a draft article about one of the principals of NeighborCity. It was not about NeighborCity itself. However, the editing pattern of Henriette.Kilo resembles that of the other accounts: minor edits, then creation of an unrelated article, then a few edits to that, and nothing more.

—rybec

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]
  • CheckUser requested - Self-endorsed by clerk for checkuser attention - This qualifies as the longest "concise" report I've seen, very solid evidence. A CU is unquestionably needed here. After pouring through the first dozen (one had a bad link but was easy to get around) it is obvious that we have sock puppetry afoot. How deep this goes can only be determined using the CU tools. Dennis Brown | 2¢ | WER 13:05, 11 July 2013 (UTC)[reply]
  • Add Pedroswish (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) [25] vs [26] Dennis Brown | 2¢ | WER 13:13, 11 July 2013 (UTC)[reply]
  • Note to CU, this spi report has had vandalized by
174.236.66.87 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
174.226.128.154 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
Dennis Brown | 2¢ | WER 16:13, 11 July 2013 (UTC)[reply]
  •  In progress. Compliments for the clear report... I think. Oh boy... WilliamH (talk) 22:49, 11 July 2013 (UTC)[reply]
Obviously due to the fact that socks keep being filed, it's rather a work in progress, so Rybec (talk · contribs), if you could let me know when you're done listing accounts, or perhaps more importantly, when you think you are, then let me know and I'll get right back on this. WilliamH (talk) 23:26, 11 July 2013 (UTC)[reply]
      • I'm in the middle of verifying each to the real sock master. Henriette.Kilo doesn't need any more links, there are behavioral aspects that are plenty to connect him. Dennis Brown | 2¢ | WER 00:10, 12 July 2013 (UTC)[reply]
Overview[edit]

It's a combination of behavioural and technical factors, but once again, this is the MooshiePorkFace (talk · contribs)/Morning277 (talk · contribs) sock farm, who both work in tandem as part of a Wikipedia editing business. At this stage (12:27, 12 July 2013 (UTC)) none of the below accounts have been checked directly.[reply]

Batch 1[edit]
All blocked.
Batch 2[edit]
All blocked.
Not sure, suspicious not instantly obvious
Some of these may become more obvious with crossover edits once all the socks are blocked and just need closer review. All are possible even this early on. -db
Batch 3[edit]
All blocked.

WilliamH (talk) 12:27, 12 July 2013 (UTC)[reply]

Not sure, suspicious not instantly obvious
  • Note to CU - I've looked at these three, and they are possible but inconclusive without further CU confirmation of at least "Likely". In particular, Chicago has a lot of edits.

Dennis Brown | 2¢ | WER 00:53, 14 July 2013 (UTC)[reply]

  • Holy cow. I will be spending the day moving, verifying, blocking and nuking this list, so consider this  In progress Dennis Brown | 2¢ | WER 12:47, 12 July 2013 (UTC)[reply]
One more: Wetzig. WilliamH (talk) 13:10, 12 July 2013 (UTC)[reply]
Comment from WMF Legal

We're aware of this situation and watching with interest. We're also evaluating options to enforce the Terms of Use. I hope to be back in touch with you on this at some point soon. Philippe Beaudette, Wikimedia Foundation (talk) 21:12, 17 July 2013 (UTC)[reply]

12 July 2013[edit]
Suspected sockpuppets

After my initial report, I used Special:Export to get a dump of all revisions of User:Sublimeharmony/sandbox11, then passed it through

grep ^\'\'\' sublimeharmony-sandbox11-export-20130712024828.xml | cut -f4 -d\'|sort -u

to get a list of bolded terms that appeared at the beginning of a line. Here's the list (some of these, such as "Argentina," were not the subjects of the drafts):

list of terms
  • 4Cabling
  • Aasted
  • Alsbridge, Inc.
  • American Writers and Artists Inc. (AWAI)
  • Argentina
  • Brendan Wallace
  • Bunndle
  • CALNET
  • CHMB
  • Campus Apartments
  • Certified Disaster Recovery Engineer (CDRE)
  • Certified Penetration Testing Consultant \xe2\x80\x93 C)PTC
  • ClassDojo
  • Cleeng
  • Confio Software
  • CrowdOptic
  • DDC Advocacy (DDCA)
  • DPT Laboratories, Ltd.
  • David Kiger
  • David Schwedel
  • Digital Prospectors Corporation (DPC)
  • Dominique Molina
  • Echopass
  • Ethan Bearman
  • FindTheBest
  • Fundology
  • Game Cooks
  • GatherSpace
  • Genius Inside
  • Global Met Coal Corporation
  • Go Try It On
  • GroundWork, Inc.
  • HALO Maritime Defense Systems (HMDS)
  • Heel That Pain
  • Heliospectra
  • ITelagen
  • Inflection
  • Inigral
  • John Uustal
  • Jonathan Cardella
  • Junk It!
  • Kosovo
  • Legitmix
  • Loyaltyworks
  • MarketLive
  • Maximilien de Hoop Cartier
  • MediCortex
  • Mike Macadaan
  • Misty Lown
  • Muzak Holdings LLC
  • Neal Creighton, Sr.
  • Network Capital Funding Corporation
  • NewYorkStay.com
  • ONEHOPE
  • Oren Laurent
  • PCN Technology
  • PeopleSmart.com
  • Pneuron
  • PressPadApp
  • Reputation Advocate
  • ResumeBear
  • Rev. Fr. Emmanuel Lemelson
  • ReviewBoost
  • Reza Ghorbani
  • Rich Schefren
  • SJ (born Scott Jablonski)
  • Security Innovation
  • Shimao Property Holdings Ltd.
  • SocialSoft
  • Sollensys Corporation
  • Steven M. Neil
  • Sweet Couch
  • Switzerland
  • TableTopics
  • Tee Ashira
  • Telly
  • The American University of Iraq, Sulaimani,
  • The Hand and Wrist Institute
  • Tom Dyson
  • Tom Hoban
  • Tom Kemp
  • Tsebo Outsourcing Group
  • ViSalus
  • Virool
  • Waterfield Group
  • Zipwhip
  • Zorpia

Here are accounts that I missed before and which weren't mentioned by the other people working on this. Articles about subjects in the list above were inserted from these accounts.

I will probably want to add a few more; I hope this new section is appropriate.One of the drafts in the sandbox11 file was about ReviewBoost. There was a ReviewBoost article in main space; it was mentioned in the MooshiePorkFace SPI and deleted. —rybec

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

Entirely appropriate, thanks - perhaps if there's any more of them, consider adding them to the talk page. The three batches of accounts I added are a combination of behaviour and technical, as I was sifting through everything I could find, articles and all. There is so much to go on that it is going to be impossible to tie every account to every other account technically - it is the behaviour which is the defining factor, as usual. I have however provided a clearly segregated list of accounts I found on the talk page from 3 main ranges - these are behaviourally indicative and only from those 3 ranges. WilliamH (talk) 14:14, 12 July 2013 (UTC)[reply]

I will also note that I simply do not have the time to accommodate a case of this size, so I am withdrawing myself from it at this stage. WilliamH (talk) 14:18, 12 July 2013 (UTC)[reply]
  • This is going to have to be done in batches to get it right. I've blocked the first, very obvious socks so far, a total of 75. It might take a day or two to block/tag/nuke all this. Dennis Brown | 2¢ | WER 14:36, 12 July 2013 (UTC)[reply]
  • Reviewed, verified and blocked another 60 accounts from Group 1. Still working... Dennis Brown | 2¢ | WER 16:32, 12 July 2013 (UTC)[reply]
Don't know why I ended up here in a recent changes patrol, and I've never commented here before, nor do I really know what I'm doing, but I thought I should point out that the modus operandi of Renzoy16 from batch 2 is quite unlike all the others in the list. Established editing history. Fleshed out user page, instead of single, plain-text sentence. Don't know if that is helpful or not. 78.26 (I'm no IP, talk to me!) 16:55, 12 July 2013 (UTC)[reply]
It is, thank you. False positive removed immediately. WilliamH (talk) 17:15, 12 July 2013 (UTC)[reply]
Actually, on second thoughts, while I won't be reinstating Renzoy16 (talk · contribs) to the main list, I still think he should be presented for scrutiny. This behaviour is highly indicative. WilliamH (talk) 17:24, 12 July 2013 (UTC)[reply]
(Non-checkuser comment)The subject matter of Justin Hartfield and Giggem is very much in the same vein as the articles inserted from the accounts I had nominated. Renzoy16's use of ProveIt, HotCat and Twinkle is something I didn't see with the others. —rybec 18:17, 12 July 2013 (UTC)[reply]
  • I'm working on this around the clock, but I keep finding new socks and have to document them offline, which is slowing me down but it is needed. This truly is turning into a clown car of a sock puppet investigation. Dennis Brown | 2¢ | WER 22:07, 12 July 2013 (UTC)[reply]
  • Blocked and tagged another 64, which brings the running total at 199 for those keeping score at home. That is 12 hours today, I will pick it up tomorrow. I have notes for every one of these if a CU needs it. Dennis Brown | 2¢ | WER 23:35, 12 July 2013 (UTC)[reply]
  • Blocked 20 more in Group 2 (219 total to date), moved 14 to the "maybe" file. Those are slightly less obvious, but after all the blocks are done, it will be easier to connect dots and separate any innocent parties out. We can hat my notes later, it just helps me stay organized. This is a beast. Dennis Brown | 2¢ | WER 14:42, 13 July 2013 (UTC)[reply]
  • Blocked 22 more in Group 3, will cleanup below and start the second sweep. Have also compiled a new group of possible candidates, will put below later. 241 total so far. Dennis Brown | 2¢ | WER 16:38, 13 July 2013 (UTC)[reply]
  • Blocked 10 more, these are taking some creativity to investigate due to so few edits. Will resume tomorrow. Others should review the unblocked to see if I'm missing something. ~251 running total now. Dennis Brown | 2¢ | WER 21:30, 13 July 2013 (UTC)[reply]
  • Another 9 this morning, 260 total. Attempting to work with CU to review the remaining and new accounts. Dennis Brown | 2¢ | WER 12:52, 14 July 2013 (UTC)[reply]


14 July 2013[edit]
Suspected sockpuppets

Entertainedkitten11, an account about which Dennis Brown expressed suspicion, added the photo to the Emad Rahim article. That article was created in Jaleel487's 12th edit, after minor unrelated edits. The pattern looks familiar to me.

[31] vs. [32] —rybec 02:28, 14 July 2013 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]
  •  Clerk note: Blocked by Dennis, so closing this part of the case. Reaper Eternal (talk) 02:15, 16 July 2013 (UTC)[reply]
16 July 2013[edit]

Please see Ztwriter vs Reginac7. See also Reginac7 vs Rudro911. Reaper Eternal (talk) 01:34, 16 July 2013 (UTC)[reply]

Appeared quickly at Campus Special and my talk page after I tagged the now confirmed User:Laurien10's work as too promotional. I had the impression of a supervisor stepping in to defend his charges. Kilopi (talk) 07:01, 16 July 2013 (UTC)[reply]
Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • Comment Not sure if this is relevant or important, and I can't really reveal specifics, but there is a ticket (ticket:2013071510010601 for those with access) in OTRS from a person who wrote complaining about his article having been deleted and how much they charged him. The article was G5ed yesterday along with all the other ones. In the email, this person CCed whom I assume is his contact or rep at the company that may be behind all this. I'll let a more experienced admin with OTRS access figure out what to do with this, but I figured it was worth a heads up. §FreeRangeFrogcroak 00:16, 16 July 2013 (UTC)[reply]
@FreeRangeFrog: I see 86.134.173.133 did another edit to Anthony Lolli (entrepreneur) and one to Rapid Realty NYClater correction, two more edits to the Lolli article. I'm assuming FreeRangeFrog is commenting about some other article, since neither of those has been tagged for G5 deletion (no confirmed sock-puppet activity), nor has either been deleted. The Lolli article had a G11 tag, which the IP editor has removed twice. —rybec 01:05, 16 July 2013 (UTC)[reply]
@Rybec: Yes, it's another article. §FreeRangeFrogcroak 05:08, 16 July 2013 (UTC)[reply]
There's nothing to do with this administratively, but I can confirm that the email is specifically related to a paid-for article and the findings in this case. Keegan (talk) 01:23, 17 July 2013 (UTC)[reply]
Clerk, CheckUser, and/or patrolling admin comments[edit]
  • Self-endorsed by clerk for checkuser attention See my evidence. Reaper Eternal (talk) 02:01, 16 July 2013 (UTC)[reply]
  • Ztwriter and Rudro911 are stale, Reginac7 and MHK7Sr are  Inconclusive, but  Likely by behavior. I'm deleting their articles. Keegan (talk) 18:12, 17 July 2013 (UTC)[reply]
16 July 2013[edit]
Suspected sockpuppets

The deletion log for Omar_Todd_(actor) says:

23:24, 5 April 2013 Robertprowser72 moved page Omar Todd (actor) to Omar Todd (politician) [...] 01:04, 7 February 2013 Reginac7 moved page Omar Todd (actor) to Omar Todd (producer) (To assign proper vocation to subject.) —rybec 01:53, 16 July 2013 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]
  • The account is stale. WP:DUCK. Keegan (talk) 18:36, 17 July 2013 (UTC)[reply]
  •  Clerk assistance requested: Will a clerk please go through and archive the sections that no longer require attention? I would greatly appreciate it. Tiptoety talk 21:20, 17 July 2013 (UTC)[reply]
18 July 2013[edit]

Clearly these guys have got new orders to fill, as well as previously expunged orders to salvage. I'm releasing the ranges used by these accounts as reviewing IP edits within these ranges may yield more undiscovered articles. All accounts range from recently created, to lining up enough edits for autoconfirmed, then creating their target article.

184.169.0.0/16

54.215.0.0/16

54.251.0.0/16

54.241.0.0/16

Clerk, CheckUser, and/or patrolling admin comments[edit]

All accounts blocked. The following hosting ranges have been hardblocked for a year:

WilliamH (talk) 00:20, 18 July 2013 (UTC)[reply]

  •  Clerk note: While it would be highly unusual and perhaps a bit controversial, should SALTing be discussed for the couple hundred articles affected, as well as future articles by future socks? The scale of this is so large that salting with special instructions to contact SPI might be the only way to not get buried in the avalanche. We can't stop all the socks, but we can stop the articles, thus the payoff. Unusual circumstances call for unusual solutions. Dennis Brown | 2¢ | WER 12:21, 18 July 2013 (UTC)[reply]
  • But being salted would allow instant salting of the copies, and make it obvious the recreator is a sock. It isn't the solution, but I think we need to consider it as part of the solution. Dennis Brown | 2¢ | WER 18:05, 18 July 2013 (UTC)[reply]
  • It may make these pages more difficult to find, and previous similar pages being salted has no bearing on whether other pages can be salted. --Rschen7754 20:45, 18 July 2013 (UTC)[reply]
  • Maybe I'm misreading you, but I think you are incorrect. If MyBand (band) is salted and someone creates MyBand(band) as a way to get around the salting (ie same general content, slightly different name), it is automatically salted for the same rationale as the first one, whatever that rationale was. That is pretty standard procedure and not controversial. On your other point, if the article is salted, it has zero difference in finding it once it is deleted. It comes up the same as any other previously deleted article. Zero difference. If someone wants to recreate a legitimate article and it passes GNG, then of course it should be unsalted. So salting would make it easier to control, to a degree. I'm open to any other ideas, but again, I've been aware of this "problem" for over a year, there is no silver bullet solution. Dennis Brown | 2¢ | WER 20:52, 18 July 2013 (UTC)[reply]
I agree it can be speedily deleted, but not in the same automatic way that salting protects agains re-creation under the same name. You are suggesting using salting as a symbol -- I suppose we could do it--before I saw this I deleted one such as attempt to circumvent salting, thinking of it as in some sense a G3 to protect the encyclopedia against an attempt to subvert its purpose, but without giving it any speedy criterion number. But if you think admins will understand this, I'll do it. Do we need to modify WP:CSD ? DGG ( talk ) 08:57, 7 August 2013 (UTC)[reply]
20 July 2013[edit]
Suspected sockpuppets

Editing pattern similar to many already blocked users. Recommend G5 for Tungsten Branding, created today. Kilopi (talk) 02:32, 20 July 2013 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

 Confirmed

WilliamH (talk) 03:12, 21 July 2013 (UTC)[reply]

appsFreedom and Micreos deleted. WilliamH (talk) 03:15, 21 July 2013 (UTC)[reply]
Closing. --Rschen7754 03:17, 21 July 2013 (UTC)[reply]
21 July 2013[edit]
Suspected sockpuppets

Edited Unique Squared, which had previously been edited only by confirmed sock Santashelper25 (talk · contribs). Article is essentially orphaned [33]. —rybec 02:40, 21 July 2013 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]
  • Stale IP, come back if it starts up again. --Rschen7754 06:30, 25 July 2013 (UTC)[reply]
22 July 2013[edit]
Suspected sockpuppets

IP address belonging to Amazon Web Services (Ireland), only edited SouthWest Energy Ltd, which was created and edited by confirmed socks. First edit was to remove the text

4/28: add the following information to Southwest Energy's page in a neutral and encylopedic way. Darius will bill for an additional $500 for this update.

Activity was previously confirmed from 54.215.0.0/16, 54.251.0.0/16 and 54.241.0.0/16, which also belong to Amazon. —rybec 22:02, 22 July 2013 (UTC)[reply]

Blueangelzzz (talk · contribs) only edited Jason Kanner and Soul Artist Management. Article about Jason Kanner says he founded Soul Artist Management. JeanineHamans (talk · contribs) contributed the original Soul Artist Management article. Confirmed sock Techyy (talk · contribs) contributed the original Jason Kanner article, and it was edited by confirmed sock IP 54.241.63.134. Soul Artist Management was edited by confirmed sock IR-Articles (talk · contribs). —rybec 22:59, 22 July 2013 (UTC)[reply]

Only edited user page and 24Hr HomeCare, an article which was created by confirmed sock 12Feltozi (talk · contribs) and was edited by confirmed socks 54.251.8.252, 54.215.63.130, 54.215.95.8 and Ftsmhtr (talk · contribs). —rybec 23:19, 22 July 2013 (UTC)[reply]

I requested speedy deletion of QuoteWizard, Timo_Weiland and Transportmarketplace, all of which were added to Wikipedia by Morning277 sock accounts. Soon after, 65.122.15.184 removed the tags from all three articles: [34] [35]]. Several other articles which are in AfD or were tagged for speedy deletion were also edited.

From the address in the whois record, it looks like this may be a wireless hot-spot at an airport:

OrgName: CITY OF PHOENIX OrgId: CITYO-71 Address: 3400 E SKY HARBOR BLVD Address: TERMINAL 3 City: PHOENIX StateProv: AZ —rybec 00:26, 23 July 2013 (UTC)[reply]

Here's an annotated list of the articles edited by 65.122.15.184 today. Several of them were previously edited by known Morning277 sock-puppets. The others may cpntain previously undiscovered Morning277 material.

articles edited by 65.122.15.184
article notes
QuoteWizard removed G5 tag from sock-placed article
Kristall (singer) removed CSD A7 tag (article is very short, doesn't look like Morning277's work--red herring?)
Timo Weiland removed G5 tag from sock-placed article
Transportmarketplace removed G5 tag from sock-placed article
Thomas Joyce drastically shortened from 1,549 to 348 B article that had G12 tag
SOTI Inc. about software vendor, was in AfD
Advice Interactive Group article about SEO firm, was in AfD
Brand.com about PR/SEO firm; previous edits by socks User:1UPRep and 54.251.16.156
Banc De Binary removed COI tag from sock-placed article
Gary Streiner was in AfD
Fooling Ewe was in AfD
Hydroxycut red herring?
Robert L. Johnson twice restored edits by socks (related article The RLJ Companies was sock-placed)
RhodeCode uncertain about this one due to browser crash and article's deletion

—rybec 02:09, 23 July 2013 (UTC)[reply]


Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

Accounts blocked:

QuoteWizard, Soul Artist Management, Jason Kanner deleted. WilliamH (talk) 08:15, 23 July 2013 (UTC)[reply]

  • 46.137.194.87 blocked as a webhost. --Rschen7754 08:17, 23 July 2013 (UTC)[reply]
  • 65 IP blocked 31 hours. Closing. --Rschen7754 08:20, 23 July 2013 (UTC)[reply]
  •  Clerk assistance requested: Can another clerk please archive the completed ones? Thanks. --Rschen7754 19:39, 24 July 2013 (UTC)[reply]
24 July 2013[edit]
Suspected sockpuppets

Confirmed Morning277 sock Bradenwakr (talk · contribs) edited the articles Deepak Bansal and Clearpath Technology (according to those articles, Bansal founded Clearpath, an SEO company in Delhi). Bradenwakr also uploaded File:Deepak-bansal-photo.JPG, used in Deepak Bansal (note, OTRS ticket ticket:2013040310001854).

Martha.rema (talk · contribs) contributed [36] the Deepak Bansal article after 17 minor edits to Bangladesh- and India-related articles.

Johnemoag6 (talk · contribs) contributed [37] the Clearpath Technology article after a series of minor edits.

There was also an edit [38] by 115.112.117.149 (115.112.117.149.static-delhi.vsnl.net.in) to the Deepak Bansal article, 56 hours after Bradenwakr edited it. —rybec 15:01, 24 July 2013 (UTC)[reply]

Someone at 42.109.155.194 (42-109-155-194.live.vodafone.in) edited [39] the Clearpath article. —rybec 15:13, 24 July 2013 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]
  • Stale so CU is not much use here. Blocked both accounts, closing. --Rschen7754 22:35, 25 July 2013 (UTC)[reply]
23 July 2013[edit]
Suspected sockpuppets

A draft of the article Hand and Wrist Institute was in User:Sublimeharmony/sandbox11 [40] and was placed in the main article space by by User:LAHealthVol, a Morning277 sock. The article John T. Knight, about the founder of the Hand and Wrist Institute, was contributed [41] by Ttc1964, who also contributed:

The subject matter is reminiscent of the Morning277-related articles. —rybec 21:45, 23 July 2013 (UTC)[reply]

Farbod Sadeghian was edited by Morning277 sock 65fhorgh (talk · contribs). The article was originally contributed [42] by Ramaczlatimir (talk · contribs) and was most recently edited by Enigma15071987 (talk · contribs). I noticed that Ramaczlatimir and Enigma15071987 both made slight changes to population figures articles about places in Serbia: [43] [44] [45] [46] [47] (many more from Enigma15071987). —rybec 22:30, 23 July 2013 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]
26 July 2013[edit]
Suspected sockpuppets


Resolves to pool-108-7-146-15.bstnma.east.verizon.net, seeming to imply it's in the Boston area. Made two consecutive edits to Robert L. Johnson and no other edits. Gave "grammar edits" and "more grammar" as edit summaries. Fixed one typo in photo caption, but main effect [48] was to reintroduce material previously added by Morning277 socks; compare to previously-reported edit from Phoenix airport (65.122.15.184) [49]. —rybec 06:04, 26 July 2013 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]
  • Nothing to report or do, marking as closed. WilliamH (talk) 12:54, 28 July 2013 (UTC)[reply]
26 July 2013[edit]
Suspected sockpuppets


An editor at 31-221-87-84.cust-31.exponential-e.net (London) removed [50] the {{notability}} tag from Rich Schefren, without providing any sources, just giving an edit summary saying "This fellow is a notorious and notable author and speaker in the U.K." The Rich Schefren article appeared [51] in User:Sublimeharmony/sandbox11 and was [52] gotten into article space (through AfC) by Kat martinez (talk · contribs), an account I reported on 14 July which has not been blocked. —rybec 18:36, 26 July 2013 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]


27 July 2013[edit]
Suspected sockpuppets

New batch. Rschen7754 19:07, 27 July 2013 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]
  •  Clerk endorsed Self-endorsed by clerk for checkuser attention for confirmation for unblocked accounts. --Rschen7754 19:29, 27 July 2013 (UTC)[reply]
  • Asuttle (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) is a sleeper of Acsuttle.
  • TylerCorelitz, Metalnu, and Plapointe have not been checked at this stage. Their articles look nothing the kind produced by the PR firm in question.
  • The following accounts are  Confirmed with each other:
  • Evidence is now available that the responsible PR firm is soliciting other individuals, i.e., external contractors, to upload their articles onto Wikipedia in the hope that their fresh IP data will evade scrutiny. Accordingly, technical evidence should be given the weight it deserves, unless otherwise indicated. WilliamH (talk) 12:50, 28 July 2013 (UTC)[reply]
    •  Clerk note: I've blocked these three as clearly passing the criteria for this master (CU wasn't needed) and I have G5'ed their edits. If I have time later I will look at more, but I think it is time to recruit more help and start G5ing all these socks edits with extreme prejudice, to remove the financial incentive. My understanding is that the company's first check happens if they keep the article live for 30 days, btw. There are a number of other "services" they provide as well. Dennis Brown | 2¢ | WER 13:37, 28 July 2013 (UTC)[reply]
    • Add Mstuffs (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) which is really old but these socks have a way of coming back, so even stale ones may have to be blocked. G5'ed as well. Dennis Brown | 2¢ | WER 13:43, 28 July 2013 (UTC)[reply]
20 July 2013[edit]
Suspected sockpuppets

Melissa2508 (talk · contribs), already confirmed as a Morning277 sock, placed the articles Frank Cohen (entrepreneur)‎, Kevin Surace and PushToTest.

One IP address resolves to c-24-130-59-129.hsd1.ca.comcast.net. The editor using it has contributed to Kevin Surace and PushToTest along with their associated AfDs Wikipedia:Articles for deletion/Kevin Surace and Wikipedia:Articles for deletion/PushToTest. Edits from 24.130.59.129 to other articles [53] [54] were related to Kevin Surace.

The other IP address resolves to 173-164-217-162-SFBA.hfc.comcastbusiness.net. The editor using it has contributed to Frank Cohen (entrepreneur)‎ (the article says Cohen founded PushToTest), Wikipedia:Articles for deletion/Kevin Surace and Wikipedia:Articles for deletion/PushToTest.

There's an article about Marc Porat which says Porat works at one of Surace's companies, and which was edited [55] by Ksurace (talk · contribs). Marc Porat (talk · contribs) has an account, only used to edit his biography years ago.

Here's the interaction chart (I added 67.180.128.45, named yesterday). —rybec 02:06, 20 July 2013 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]
  •  Clerk note: Closing. For this particular sockmaster, stale IPs are pretty useless. Melissa was already blocked by be a week ago, the other two don't fit the criteria at this time. Dennis Brown | 2¢ | WER 14:21, 28 July 2013 (UTC)[reply]
source: https://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/Morning277/Archive/2

Leave a Reply