OPP/New Baba sock, now quacking in Spanish!. Also the irony of username 'Fiverr92' is not lost...perhaps this is the source after all. Chrissymad❯❯❯¯\_(ツ)_/¯16:05, 3 March 2017 (UTC)[reply]
A bunch of single purpose accounts writing promotion around Tres Watson.
Brilbluterin created a fully formed advert for Watson [1] over a redirect they'd created 2 days earlier.
Karuenmelan created a fully formed advert for The Gadget Guys [2] over a redirect they'd created a day earlier. The Gadget Guys was founded by Watson.
After the article was on Watson was redirected, reverted by Watson, then proded a new SPA Rogercosts appeared to remove the prod and make changes.
There is overlapping behavioral and technical evidence for two masters: OfficialPankajPatidar(talk·contribs·count) and Orangemoody(talk·contribs·count). It is also possible there is a third master. I'm convinced that many of the socks belong to OfficialPankajPatidar. At the same time, it is unlikely that is the only master. To sort this out will require extensive behavioral analysis from editors familiar with the two masters. It doesn't help that there are 163 socks. One way in which it is important is deleting articles per G5. If the sock who created the article is operated by a known master, the article can be deleted. If the sock is operated by a new master, it cannot. Clerk assistance requested: If you are not familiar with either master, please ping the appropriate editors. To do that, the easiest thing would be to review the two cases.--Bbb23 (talk) 23:05, 5 January 2017 (UTC)[reply]
Some semi-automated observations:
Gerubloan, Hunaelmar, Hurnimkalu, Anreliopan, Ducalburl21, Deiskolk, Omaelitob, Nerinkalun, Mergathil, Kurtilepan, Karmainelat, Kaliropas, Kahamnf are all engaged in the same pixabay.com stock image import spam that I've seen before, but can't remember exactly where. Checking Special:LinkSearch/https://*.pixabay.com, I get some more accounts:
Kagishjun, Themtideser confirmed to OfficialPankajPatidar
Firsttakepr confirmed to DrankJetter.
Deiskolk, Gerubloan, Gipsyloo, Hunaelmar, Jaiuwulk, Kaliropas, Karmainelat, Karuenmelan, Kruntiksha, Nerinkalun, Varunbaisya all have dummy userpages.
Asipulako, Astha willim, Hurnimkalu, Nerinkalun look like Orangemoody patrolling socks. Gerubloan, Karuenmelan, Tweakben also did patrolling, but not as much. (Asipulako, Karuenmelan and Tweakben don't appear in the patrol logs much because of the new NPP permission taking effect in mid-November).
Thertho Bose has been here for over 1.5 years, with ~2500 edits.
There wasn't much happening in draft space. There are no moves from Draft/User to main among all accounts.
Deleted pages: Naked Tan (3x deleted), WMoption, Outsource Ohio, Infobrandz, Amy Cooper Hakim, Limit lock, Torque Limiting Washer, Classic Towing, IContact (deleted 3x), Gene Clash (deleted 2x, prior creation by blocked undisclosed paid advocate User:Umais Bin Sajjad), University Wafer, Gopackup, SmashFund crowdfunding, Arttra Grass, Natureal, GigRev, Draft:Maxtalent Global Sports (G7: mainspace article exists at Maxtalent Global Sports written by Berinlocata), User:Bteifanai/sandbox (article: Presskr), Md P Nazim (compare Draft:Mohammed P Nazim), Draft:Allen Associates (G7: mainspace article Allen Associates was written by Gustoak), Flawless Beauty, Physical Gold (recreated at PhysicalGold) by Soothaxia), Shankar Chakraborty (Junior), Tommy Griffith (businessman).
I don't think the distinction between the different masters matters that much; I think we're seeing multiple people working from variants of the same script. What matters is that the spam sees our flamethrowers at the end of the day, via IAR if need be. MER-C08:16, 6 January 2017 (UTC)[reply]
Other behavioral ticks I notice from some of the accounts: Often one of their first few edits will include the creation of a talk page with ((talkpage)).[3][4][5][6][7][8][9] (Most of these examples came from the large list atop the page.) Many/most of the Eggedbursa batch have taken to creating redirects from their User pages to their talk pages in their first few edits and in some cases waking up their talk pages too with ((user talk header)).[10][11][12][13][14][15] This is almost certainly done to circumvent the redlinks, which I guess they think will trick experienced users. (It doesn't!) Cyphoidbomb (talk) 20:22, 12 January 2017 (UTC)[reply]
@Smartse: I'm not sure what you're asking me. Which accounts aren't stale? Are the puppets at HemantDas34 related to the puppets here? You want to inject yet another layer of complexity in the game of which socks belong to which master? From a technical standpoint, there's often at least some connection. However, I don't usually say they are the same unless it's compelling technically and behaviorally. Although sometimes cross-editing is an indication of a behavioral connection, I find frequently it's not. Frankly, there are too many socks from that part of the world.--Bbb23 (talk) 14:05, 2 February 2017 (UTC)[reply]
@Bbb23: Yes sorry for wanting to make it more complicated! I was meaning that the HemantDas34 socks aren't stale but not knowing entirely how CU works, I'm not sure whether or not you would have picked up a link to them automatically, or whether further checks could link them. The more classical spam combined with creating articles is fairly unusual IMO and both HemantDas34 and this group did it. There is other behavioural evidence linking HemantDas and OPP like creating talk pages with only two spaces: e.g. [16][17]. I'm just concious that we should try to link SPIs together wherever possible, even if we can't be 100% certain whether they are meats or socks. SmartSE (talk) 18:29, 2 February 2017 (UTC)[reply]
Two additional socks identified on repeat check, both directly linked to Eggedbursa, and are already blocked:
My conclusion was that he was the client, hence the lack of mention when filing the initial SPI. He, unlike these socks, IMO is not a shill, he has been open and honest. The speed at which was aware of the Watson article and then editing it is matched by the same on the Gadget Guys article. Seems clear that he was informed that the job was done. Add to the self identifying you mention is self identifying by name elsewhere [18][19]. It would be very helpful if User:Xyxyboy could tell us how this sock farm came to create those two page. duffbeerforme (talk) 11:45, 13 January 2017 (UTC)[reply]
I have a google alert, as well as some other Internet monitoring programs mostly for Press Mentions set to many things that interest me, and when the Internet mentions Tres Watson, Canvass for a Cause, or The Gadget Guys I get an email about it. When I see something written about me, I set it to a watchlist so as to ensure accuracy, believe it or not there are people out there that have a negative opinion and have vandalized on Wikipedia before with unsourced allegations of things that although untrue would be very embarrassing so I'm careful to keep close tabs on the accuracy of anything put out online, and quickly at that.Xyxyboy (talk) 13:52, 13 January 2017 (UTC)[reply]
@Risker: You mentioned the account was blocked, but it is not. Could you clarify whether you intended to make a CheckUser block or whether another admin can act on this? Thanks. ~ Rob13Talk07:36, 24 February 2017 (UTC)[reply]
Made one edit in April 2016, then suddenly became active again within weeks of the blocking of a large group of Brilbluterin socks.
Overlap with known sock on AlliedCrowds (which was created by blocked sock Cardpock) where Boxer4215 proceeds to remove a PROD. (diff)
AlliedCrowds is closely related to Lars Kroijer, a page created by Boxer4215 in April 2016 (creation) and edited twice by them this month. (1, 2) Lars Kroijer is pretty blatantly promotional. Here, too, Boxer4215 proceeds to remove a PROD. (see '2') The page has, between creation and Boxer's resurfacing, been edited by two known-and-blocked Brilbluterin socks: User:Hrupolata (here, here) and User:Ducalburl21 (one diff among four).
A redirect for Paul Guerra (actor) (edit | talk | history | protect | delete | links | watch | logs | views) (at Paul Guerra) was created by another of those socks. Even if there is no technical evidence, this makes it very likely that the master account of these socks was already blocked before. SmartSE (talk) 22:22, 29 January 2017 (UTC)[reply]
Mirraw (edit | talk | history | protect | delete | links | watch | logs | views) (Indian e-commerce bla bla bla) was created by one of the CU confirmed socks [22]. This Jacobboxn2 was just created after it was PRODded, and on their first edit [23] did some stuff to the article.
What's going on here? This user has been accused, but per the below it does not seem to have been CU confirmed. This user is adamantly denying involvement - of course, this could just be a ploy - but we could also be accidentally accusing a new user of being something they aren't. Am I missing crucial info to this case? I just want to ensure this isn't another casualty due to good faith not being assumed. Please correct me if I'm wrong. Garchy (talk) 20:05, 22 February 2017 (UTC)[reply]
Okay, this is getting very complicated. It looks like the feedback from some commenters here is on the money, because these accounts sure look like crossovers from OfficialPankajPatidar. They are editing Brilbluterin articles but are more technically related to OfficialPankajPatidar. Please note that Helium Hasrur (talk+·tag·contribs·deleted contribs·logs·filter log·block user·spi block·block log·CA·CheckUser(log) ·investigate·cuwiki) is {[staleIP)) and so blocks should be based on behaviour; No comment with respect to IP address(es) on the IP address except to say that it is not technically related to either of the sockmasters and is unlikely to be part of the editing ring.
The following are Likely to be socks of Brilbluterin and are technically related to OfficialPankajPatidar as well.
I'm actually not sure if this is OPP again or not, or a similarly-minded person, because their one article (of an American-specific company, LiquidHub, is far too questionable for a casual visitor) especially considering every single section highly suggests COI. In any case, a precautionary CU is good. SwisterTwistertalk05:44, 22 March 2017 (UTC)[reply]
The evidence presented has no connection to the master and is thin in any event. I'm tempted to close with no action, but I'll leave that to a clerk for the moment. CU declined.--Bbb23 (talk) 13:59, 24 March 2017 (UTC)[reply]
Clearly a throw away account for a promotional sock farm. Other than token edits elsewhere has only edited about Roman Molino Dunn [25]. Dunn is known as Electropoint. Electropoint has been deleted three times this year [26] as a speedy G5, always Created by a banned or blocked user (User:OfficialPankajPatidar) in violation of ban or block.
Likely based on behavior and some technical data. Note that most of the CU data here is stale, but there's enough for me to block. Katietalk21:39, 12 May 2017 (UTC)[reply]
Awaiting administrative action - Please block the accounts (and delete the pages as per G5, if possible). Thanks, GABgab23:46, 24 May 2017 (UTC)[reply]
concur. I recall the stilted and clumsy phrase "registered member of the European Space Agency and NASA" from the first time around. Also, genuinely new editors don't start by applying obscure templates as their first and second edits[29][30], and creating 5k articles in a single edit (er, paste) [31] as the third. - Bri (talk) 00:51, 10 June 2017 (UTC)[reply]
Requesting CheckUser: The IP is too stale to block. As for the named account, it does look like username impersonation of SwisterTwister, and a block would be justifiable on that basis alone. In addition to the article recreation, the recent edits to Abro (TV serial) are also similar to edits made by a previous sock (adding links to the recreated page): compare [32] and [33]. What gives me slight pause, however, is that the command of English of SwisTwis feels weaker than that of previous sockpuppets of OfficialPankajPatidar (which was already weak to begin with). Compare the talk page statement by SwisTwis to previous socks: [34] and [35]. The talk page statement by SwisTwis is less composed than those of the previous sockpuppets and is riddled with spelling errors. Compare also the state of the Eshal Fayyaz article by SwisTwis and by previous socks. This recent iteration has much more broken English than earlier iterations: e.g. "Eshal started he career as a model and was most liked for her face and got many fame on her model" and "She is popular for portraying role of Abro" and "The drama got very hit for drama's different story and was most watched serial". This recent iteration also lists the date of birth as October rather than September.The behavior of this new account feels subtly different, but on the other hand, the quality of English of past accounts wasn't that much better. Maybe I'm being too charitable. I'd be interested to see whether CheckUser can shed any light here that would help determine whether this account is related to past socks. Best, Mz7 (talk) 06:03, 8 July 2017 (UTC)[reply]
Administrator note Thanks Bbb23. Given the behavioral dissimilarities I noted above, and given the result of the technical investigation, I do not believe this account is related to this master. I have placed a soft block on the SwisTwis account since the username is too similar to that of an established user – the user will be free to create a new account with a different username and continue editing, or request an unblock to file a username change request. Such a new account should not be considered a sock puppet. Respectfully, Mz7 (talk) 19:52, 8 July 2017 (UTC)[reply]
Newly created account, recreated the salted page Sedat Sönmez under a different title [36] (Sedat Sönmez (Businessman)). It was then moved to the original title by VQuakr[37]. – Joe (talk) 12:14, 10 July 2017 (UTC)[reply]
Recreating Electropoint by a very obvious cut and paste , presumably from one of the many versions of those previously deleted. Identical editing pattern to sock master VelellaVelella Talk 20:33, 23 July 2017 (UTC)[reply]
This case is being reviewed by Sro23 as part of the clerk training process. Please allow them to process the entire case without interference, and pose any questions or concerns either on their Talk page or on this page if more appropriate.
Sumpsus reposted Helen Child at H. Child. Note the creation of a redirect prior to page creation in both cases [38][39]. This technique is also being used by other users that I will post in a moment. SmartSE (talk) 22:31, 30 July 2017 (UTC)[reply]
These accounts are Technically indistinguishable from each other. They actually fit the pattern of Wikipedia:Sockpuppet investigations/BusInCordoba in that they create the user page, then the talk page, then make promo edits:
Sumpsus is Likely to this group. There are webhosts involved and it's murky, but there's a UPE ring here. Blocked pending tags. @Berean Hunter: Take a look at the SPI I referenced and see if you agree. Katietalk15:57, 4 August 2017 (UTC)[reply]
Eep - missed some, including some sleepers. That happens when you have 20 tabs open. Also confirmed to the group are:
I can't confirm it to the last group of OPP socks I ran, plus there's another VPN involved, but there are no sleepers. Behavioural evidence needs evaluation. Katietalk20:29, 11 September 2017 (UTC)[reply]
Electropoint (Roman Molino Dunn) is back. Electropoint has been deleted may time as a G5 speedy deletion. Recreations by OPP socks. It's now back at Electropoint (music producer), typical of paid sock farms at a new title to bypass salt. duffbeerforme (talk) 13:57, 5 November 2017 (UTC)[reply]
CheckUser requested and endorsed by clerk - These articles are not very similar, but the promotional intent is clear. Please check for connections to other UPE accounts/sleepers. Thanks, GABgab20:28, 15 August 2018 (UTC)[reply]
Another recreaction of Electropoint, this one at Roman Molino Dunn again jus like a previous sock. See also their talk page, "Happy to re-start editors task ...its been year's". [43]duffbeerforme (talk) 03:49, 11 December 2019 (UTC)[reply]
This case is being reviewed by 1997kB as part of the clerk training process. Please allow him to process the entire case without interference, and pose any questions or concerns either on his Talk page or on this page if more appropriate.
CheckUser requested and endorsed by clerk - Looks same user on behavior evaluation. Case have extensive sleeper history, so please check if there're more account relating to Subsidefest. ‐‐1997kB (talk) 11:05, 23 December 2019 (UTC)[reply]
Tripped 871 and reported to WP:EF/FP. The match is over a few passing mentions of the same person (ninth alternative in the filter's regex), which caused me to initially think this was innocent. However, a Google search for that person's name and "orion experience" returns only five results, none of them meaningful, which means that this is at best overstated participation, and at worst hoaxing. Comparing the writing style in Special:AbuseLog/31474107 to past edits and filter hits, there's the same excessive boldface, blank lines between bullet points, and use of curly quotes that we see in Special:AbuseLog/18223083. This would be a lot of effort (+15kB) for just a few passing mentions of someone, but my understanding is that that's not entirely inconsistent with this master's MO, and they've shown in the past that they like writing long list-y sections of music articles. -- Tamzin[cetacean needed] (she/they)04:40, 10 December 2021 (UTC)[reply]
I came across this EFFP. Imagined CU data would be stale; I was going to drop a note to @Bbb23 and KrakatoaKatie as most recent admins dealing with this SPI in archives, but even that was quite some time ago. Forgot to get around to leaving that note, though. ProcrastinatingReader (talk) 15:45, 10 December 2021 (UTC)[reply]
Self-endorsed by clerk for checkuser attention against logged data. I know it's been a few years so there probably won't be a way to confirm this, but it would be helpful to know if they're at least in the same general vicinity, before deciding what to do here. -- Tamzin[cetacean needed] (she/they)04:40, 10 December 2021 (UTC)[reply]
Sorry, CU isn't going to be of any help here. I checked the logs for a bunch of confirmed socks in the archives and didn't see anything. Nothing in cuwiki either. -- RoySmith(talk)15:37, 10 December 2021 (UTC)[reply]
So, I feel like a bit of an idiot on one aspect of this: I made a typo in my Google search; the subject of the filter hit has indeed verifiably worked with this band. However, the aforementioned writing similarities, and the long history of trying to spam that person's names across various articles (including at least some that they have actually been involved with), makes me think that this is more-likely-than-not OPP or one of the related sockfarms documented in the archives. But I don't think I can get to a high enough confidence level to justify a block on that basis. A straightforward block or only-warning for promotional edits and possible UPE may be the easier way to handle this. @Discospinster: You've already reverted this user's edits once as promotional. Thoughts? -- Tamzin[cetacean needed] (she/they)20:45, 10 December 2021 (UTC)[reply]
Yes I did revert one edit that was excessively promotional but I don't see any relationship between this editor and the one they are accused of being a sockpuppet of. Unless I'm missing something? ...discospinstertalk01:36, 11 December 2021 (UTC)[reply]
I don't think this is actionable at this time. Since the person in question did work with the band, it doesn't seem especially suspicious to mention them on the band's article. The writing style similarities aren't unique enough to be confident that this is the same person, and while Kelbrindle's edits are promotional, it's entirely possible that they're someone else with a COI or just an enthusiastic fan. It seems noteworthy that their edits are completely unsourced, which is something I'd expect from a newbie moreso than a long-term UPE. Kelbrindle has already been warned about COI, so I'm closing this case without further action. Thanks, Spicy (talk) 14:17, 16 December 2021 (UTC)[reply]