- Markshazel (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Suspected sockpuppets
[edit]This is a longtime unpaid editor, whose disclosures on their talk page barely scratch the surface. I shall be adding to this as I go along. Most of the accounts I found so far come from two ranges, one of which is already blocked by AmandaNP. Pinging MER-C as well, for having blocked a bunch of the socks already. Drmies (talk) 02:15, 15 June 2021 (UTC)[reply]
- @Drmies, unpaid? -- RoySmith (talk) 20:27, 20 June 2021 (UTC)[reply]
- Haha, RoySmith, a failed portmanteau of "undeclared paid". BTW I saw Excel's comment: I'm not going to run all of this all over again, but maybe someone else wants to. Even behaviorally this is already hard to believe. Drmies (talk) 21:35, 20 June 2021 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
- To further add: I'm sorry everyone for my actions leading to this whole mess. The only account that is actually mine is Blurz which I never really used and RBTW is not my account but I know who it is because we coordinated with editing Wikipedia articles but in that definition its still a sockpuppet and for that I am sorry and will take responsibility for that. I showed him how Wikipedia works and how to edit. I was told by him that he was paid to make articles and he even had some articles listed on his profile showing which ones he was paid for. It seems (in my opinion) he either made sockpuppet accounts or just recruited other people to make articles. Since I have been on Wikipedia for 10 years with so much work put into it I actually have much to lose which is why I just wanted to go ahead and confess. I started the whole "sockpuppet" thing last year (Blurz is mine, RBTW is not me but I know who it is and then I got involved with him) without realizing the consequences. I actually never heard of the term sockpuppet until this happened. None of those other accounts listed as sockpuppets are mine and I have no idea who they are and so are therefore not associated with me. I hope my apology and my transparency helps the situation.--Excel23 (talk) 01:42, 20 June 2021 (UTC)[reply]
- I'm not buying this since you are also involved in creating promotional articles. MER-C 09:49, 20 June 2021 (UTC)[reply]
- You are entitled to your opinion but the truth is that only one account is actually mine (Blurz) and none of those other accounts are mine nor do I know who they are. I suspect RBTW made those sockpuppet accounts and I did not know he was doing that. His edit history reflects that and it seems all those other accounts were made this year to further what he wanted to do. I know this is the Internet and people will lie on the Internet but I like my account and all my work I put into Wikipedia and because of that I truly do not want to be suspended, blocked or associated with all of those sock puppets and the truth of the matter is I honestly do not know those people except for RBTW (btw I hate his username because of the long random letters and numbers) the one that seems to have started it all and I have become accused for his mess.—Excel23 — Preceding unsigned comment added by Excel23 (talk • contribs) 17:00, 20 June 2021 (UTC)[reply]
- If I am reblocked then I won’t object. I can’t say I don’t deserve it but I am sorry for how all of this transpired. Again, only Blurz is me and RTBW is most likely the one that made the sock puppets which I did not know he would do but yet I helped him to show how Wikipedia works because he was new at it. If this is my last hurrah (which I greatly hope is not) then it was a good run.—Excel23 — Preceding unsigned comment added by Excel23 (talk • contribs) 00:10, 21 June 2021 (UTC)[reply]
- Draft:Tom Ralston was recently re-created by 96.241.202.160 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) but then rejected. I wonder whether the person using the IP address is the same blocked user. --George Ho (talk) 19:45, 24 June 2021 (UTC)[reply]
- Oh, here's the fun part: RBTW is a CU match with Excel23. And look at their pattern, of creating drafts and moving them when "I have added enough references for notability". The next CU editor who compares these two accounts will see something interesting pertaining to the geolocation as well, which is relevant to the user pages of both editors--and all the other accounts are no ranges that are shared with RBTW but not with Excel. User:Blurz is CU-confirmed with Excel, and it seems that there is a common interest in people with the last name "Nicholas". Drmies (talk) 03:06, 15 June 2021 (UTC)[reply]
- Convenience links:
- --Blablubbs|talk 13:47, 15 June 2021 (UTC)[reply]
- GeneralNotability, I saw this and breathed a sigh of relief: I'm not the only one to have dived into it. OK, where do we go next? (I'm not going to look for that SPI yet--I still have dozens of screens to look at, and then I'm signing off.) Drmies (talk) 03:31, 15 June 2021 (UTC)[reply]
- Drmies, are you saying Pealnotch is CU-related to this group? Because if so, that's going to be very interesting...I can't remember if there's a proper SPI for them, but the "Camella spam group" is a group of accounts pushing a bunch of Philippine real estate companies (creating articles for them and adding "such-and-such company built a 200-house development" sort of details to various city articles), I always figured that it was just company employees doing that. See the history of Vista_Land for a nice sampling of them. SubjectiveNotability a GN franchise (talk to the boss) 14:32, 15 June 2021 (UTC)[reply]
- GeneralNotability, one of the reasons I want another CU to look at this is that it was a TON of screens and accounts, always with one thing leading to another. Pealnotch is connected via Draft:Lessandra, and they are a match with Niftymom2021 and Azilmark89 (I hadn't CU-blocked that one because I must not have followed that particular IP, but Bbb blocked them for promotional editing). It is worth noting that Azilmark was still getting the hang of it. I won't say too much given BEANS but their MO has been the same over the years in terms of how they create, and what they do besides that. Pealnotch is also a match with Hexedoafs, which I didn't see yesterday, and look at their edits starting with Connie Achurra. So I have no doubt that Adrian Forte, for instance, was paid for. Vista Land is interesting and I did a quick check; Nonameph is maybe possible but not strong enough for me to block.
So yes, I'd love for someone else to lay out all these accounts and the connections; that's not a thing I'm good at when it's that much, and to check Excel, since that is a pretty old account. Does this answer some of your questions? I'm sorry, I'm just not really good at clearly laying out all the accounts and all their connections, but it got out of hand so quickly, and there were other things going on IRL. Thanks, Drmies (talk) 15:40, 15 June 2021 (UTC)[reply]
Tagged as confirmed to RBTWI for now so people are pointed here in case someone has noticed anything else about this group; this will need to be moved to Excel23 and retagged if they end up blocked as well. Also setting this to endorsed since Drmies' comment above implies that he would like a second CU to have a look. --Blablubbs|talk 13:45, 15 June 2021 (UTC)[reply]
- Behaviorally similar accounts from my block log:
- CU blocked, but not listed above:
- More convenience links:
- I have seen something like this pop up occasionally on Suspicious Articles but didn't find any more in the latest batch. MER-C 18:39, 15 June 2021 (UTC)[reply]
- Just picking up on one of those: Againmills27 (talk · contribs) is a match with Lensavisnot (talk · contribs) and with Niftymom21 (talk · contribs); with DynamicBob (talk · contribs) and Dot.dot.dot (talk · contribs) (but that latter one is not our spammer, I think); with Dougecoin (talk · contribs), Hexedoafs (talk · contribs), Wikidota (talk · contribs), Elizabethhope89 (talk · contribs), Markshazel (talk · contribs), Lovingdad21 (talk · contribs), Repaypolk (talk · contribs), and Boyboylangsakalam (talk · contribs); and with Johnmarc2021 (talk · contribs). Interestingly, that last editor worked on Draft:Katio Landi, which was created by User:Anuarsalhi, and we might have a 2020 iteration of our puppet master. MER-C, Nonameph might be a match in some ways, but the geolocation is ... well, it's a big archipelago, it's not the same ranges as the others, and there's no socks or alternate accounts.
One more: Hexedoafs (talk · contribs) is a match with Legendgreat31 (talk · contribs), Highlightreal12 (talk · contribs), Niftymom2021 (talk · contribs), Bidenhaydn (talk · contribs), Bryanbaldecanas (talk · contribs), Boyboylangsakalam (talk · contribs), Lovingdad21 (talk · contribs), RBTWI19-620827 (talk · contribs), Wikidota (talk · contribs), DaveSkylar (talk · contribs), Repaypolk (talk · contribs), Luojieben (talk · contribs), and Pealnotch (talk · contribs)--User:GeneralNotability, this one surely nails it. Drmies (talk) 22:01, 15 June 2021 (UTC)[reply]
- Had to go back and pull some notes for this. Relevant discussion and COIBot reports, along with a crapload of possible socks (pardon my Tagalog) can be found at m:Special:Permalink/21197168#Camella_Manors_Spam_Websites, Wikipedia_talk:WikiProject_Spam/2021_Archive_Mar_12#Camella_Manors_Spam_Websites, and Wikipedia_talk:WikiProject_Spam/2021_Archive_Mar_12#More_Camella_Manors_links. Blablubbs is correct that Wikipedia:Sockpuppet_investigations/JustineRufino/Archive may be related to this group. Hypothesis: there are at least two separate farms involved in the Camella spam; Pealnotch's behavior is inconsistent with the majority of the JustineRufino group. Compare their edits to, say, Special:Contributions/AACeleste, who is fairly typical of the group. Perhaps Camella hired a UPE/farm? On that note, while I feel quite certain that Nonameph is a sock(given their interest in Vista Land), behaviorally they're somewhat different from the members of the RBTW group; I'd feel reasonably confident lumping them in with JustineRufino instead. Note that AmandaNP apparently CU'd that group a few months ago and didn't come up with any solid conclusions.
- As a side note, Special:CentralAuth/Kwame-57 might be related as well (no enwiki account attached, but they uploaded an "own work" (blatantly professional) picture that one of this group used). GeneralNotability (talk) 02:01, 16 June 2021 (UTC)[reply]
- Drmies, are SyboticJoe (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), JuiceGrind (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), or MiamiArris (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) related to this farm? Different MO, but weird overlaps...at least one of the confirmed accounts used not-own-work uploaded to commons by SybioticJoe, and MiamiArris requested a REFUND on FileHold Systems at Special:Diff/1026827927, a now-speedied draft created by RBTW. (if SybioticJoe and MiamiArris aren't related to each other, I'll eat my clerk fez). I'm seeing a lot of American IPs on the articles using SybioticJoe images, so could be a different farm (longshot: Wikipedia:Sockpuppet investigations/IntermezzoMan?). GeneralNotability (talk) 02:25, 16 June 2021 (UTC)[reply]
- aaand I just went down an hour-long rabbit hole there - those three accounts and a bunch of others were textbook IntermezzoMan and have been blocked and G5'd as such. I think we can assume there are multiple separate UPE farms in play. GeneralNotability (talk) 03:07, 16 June 2021 (UTC)[reply]
- It looks like Drmies has blocked nearly all of the accounts listed and as a ((checkuserblock-account)). Can we update the status to say that a check was completed, or do we still need to run a check on all of these? For now, I'm going to mark this as 'completed', as Drmies has undoubtedly run a check. If this status change is not correct, please feel free to change it back. Just let me know that you've done so any why. :-) ~Oshwah~(talk) (contribs) 02:56, 16 June 2021 (UTC)[reply]
- @Oshwah: Drmies had indicated that he would like a second CU to have a look, see here. Endorse was probably a suboptimal status, I'll set to relisted this time. --Blablubbs|talk 09:32, 16 June 2021 (UTC)[reply]
- Sure, I'll be happy to take a look. ~Oshwah~(talk) (contribs) 10:14, 16 June 2021 (UTC)[reply]
- Pinging Drmies, since he asked for another CU to take a look. ~Oshwah~(talk) (contribs) 11:16, 16 June 2021 (UTC)[reply]
- Thanks. I say block and tag them all except for BalticBowser. Drmies (talk) 12:12, 17 June 2021 (UTC)[reply]
- I've moved to Excel23 and will retag.
Awaiting administrative action - per Drmies, please block Campazzo7 (talk · contribs), Teamsgeed (talk · contribs), Helsinski2019 (talk · contribs), Blurz (talk · contribs) and JazzvsClippers (talk · contribs) indefinitely. Thanks. --Blablubbs|talk 15:20, 17 June 2021 (UTC)[reply]
- Blablubbs, if you're going to be like that, Ima throw in Ranaaditya (talk · contribs), Themetunleashed (talk · contribs), Septiana Sulistiawati (talk · contribs), Alexander Vaca Rivas (talk · contribs), Sunardipratama (talk · contribs), and Sumreent (talk · contribs). Drmies (talk) 22:27, 17 June 2021 (UTC)[reply]
- "Block a UPE, get one free" sounds like a decent deal to me. Tagged the lot; if there's nothing left to do from the CU side, I'll set this to open for visibility for a bit, clerks can feel free to close at their discretion. --Blablubbs|talk 23:15, 17 June 2021 (UTC)[reply]
- Oshwah, check your CU mail, haha. Drmies (talk) 22:40, 17 June 2021 (UTC)[reply]
- Drmies - Oh, lovely.... ~Oshwah~(talk) (contribs) 23:23, 17 June 2021 (UTC)[reply]
- Drmies - I've unblocked the accounts listed here. ~Oshwah~(talk) (contribs) 00:46, 18 June 2021 (UTC)[reply]
On hold pending further review by CUs. In the meantime, do not act on the CU results presented so far unless they are reaffirmed. — JJMC89 (T·C) 00:05, 18 June 2021 (UTC)[reply]
- Oshwah: please put the Pealnotch block back; prior to this SPI I blocked them for behavior, no CU results involved. GeneralNotability (talk) 13:18, 18 June 2021 (UTC)[reply]
- This seems to be the case for at least two others too: [1][2]. CC @Oshwah. --Blablubbs|talk 13:19, 18 June 2021 (UTC)[reply]
- More: [3][4][5][6][7][8][9][10]. --Blablubbs|talk 13:24, 18 June 2021 (UTC)[reply]
- Blablubbs - Okay, I believe I've reinstated the original blocks that had nothing to do with this SPI. Let me know if I missed any. ~Oshwah~(talk) (contribs) 14:58, 18 June 2021 (UTC)[reply]
Clerk note: Excel23, Blurz, and RBTWI19-620827 are connected per Excel23's admission. Considering the private discussion, relisting for a CU to investigate if there is a technical connection for the other accounts, which may be unrelated to Excel23. — JJMC89 (T·C) 23:30, 19 June 2021 (UTC)[reply]
- I'd like to reblock Excel23 now that the technical situation has been sorted. Oshwah, JJMC89, any objections? GeneralNotability (talk) 22:59, 20 June 2021 (UTC)[reply]
- No objections from me. — JJMC89 (T·C) 23:58, 20 June 2021 (UTC)[reply]
- Go for it! :-) ~Oshwah~(talk) (contribs) 01:49, 22 June 2021 (UTC)[reply]
- I've caught AMCorsa (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) in today's batch of suspicious articles. I'm not sure if this is related, but behaviorally it seems plausible. MER-C 14:59, 26 June 2021 (UTC)[reply]
- I see that the status of this SPI report is currently set to 'relisted'. What exactly needs to be run again? The list of suspected sock puppets? This SPI has become a mess; I'm confused as to where we're at with this. ~Oshwah~(talk) (contribs) 03:43, 8 July 2021 (UTC)[reply]
- @Oshwah: I understand there was a bug that made some accounts seem related that has now been fixed (the previous results are under the "invalid" collapse). The request is to repeat the check as originally performed with the fix in place. MER-C 11:57, 8 July 2021 (UTC)[reply]
- MER-C - What I need to verify is if the fix that was released also fixed the CU results that would appear if I ran the check. My initial thought is that it wouldn't. The logs have already been written to the Wikimedia servers. I think that the fix simply applied to events that were logged in the future; I think that the CU logs that we'd pull would still show the invalid information. Again, I'll need to check but this is what I think is likely. Is someone able to confirm this? ~Oshwah~(talk) (contribs) 14:56, 8 July 2021 (UTC)[reply]
- The issue has not been fixed to my knowledge. Even if it were, it cannot correct the already collected data. — JJMC89 (T·C) 23:18, 11 July 2021 (UTC)[reply]
- JJMC89 - That is my understanding as well. ~Oshwah~(talk) (contribs) 07:37, 14 July 2021 (UTC)[reply]
- @Oshwah: See my comment dated 23:30, 19 June 2021 (UTC). We need to know if there is any technical connection for any of listed accounts when excluding the invalid CU data. — JJMC89 (T·C) 23:18, 11 July 2021 (UTC)[reply]
- Blocked Rickywang311 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) for recreating HungryPanda as Hungry Panda. The original creator was NapaValley2021. MER-C 14:17, 10 July 2021 (UTC)[reply]
In progress. Mz7 (talk) 00:04, 16 August 2021 (UTC)[reply]
- This SPI case was delayed because of a technical issue with the CU tool that made the initial results appear to show that many unrelated users were confirmed to each other (for CheckUsers, there is a thread on checkuser-l that sheds some light on the issue—just search for "Excel23" in your inbox). Since that time, many of the accounts that were initially listed in this SPI have lapsed into staleness. I can deliver the following results based on currently available data. The following accounts are
Confirmed to each other (Group 1):
- The following accounts are
Confirmed to each other (Group 2):
- Group 1 and Group 2 are
Possilikely (a mix between possible and likely) to each other. Group 1 and Group 2 are both
Unrelated to Excel23, who is
Confirmed only to Blurz (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) (RBTWI19-620827, the other admitted sock, is
Stale). I am positive that there are more accounts in this farm—however, given the age of this SPI case and the fact that many of these accounts have not edited in several months, I am disinclined to continue down the CU rabbit hole. If there are any currently active accounts that you think may be related to this group, please file a new SPI case.
Clerk assistance requested: I would move this case to something like Wikipedia:Sockpuppet investigations/Markshazel, since Markshazel is the oldest of the accounts I have confirmed here. I will be blocking and (re)tagging the Group 1 and Group 2 accounts as sockpuppets of Markshazel. After we move the case, hopefully then we can finally close this case. Mz7 (talk) 00:48, 16 August 2021 (UTC)[reply]
Clerk note: Moved from Excel23 to Markshazel — JJMC89 (T·C) 04:10, 16 August 2021 (UTC)[reply]
- G5 date is 1 May 2021. MER-C 08:05, 16 August 2021 (UTC)[reply]
Suspected sockpuppets
[edit]
Io33 2020 is a two edit account. First in Feb 2020 was reverted by GSS with the summary "Rv undisclosed paid and sock edits". In September 2021 they may their second edit in which they reinstated the edit of confirmed sock Wikidota (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). CU requested given the findings in the previous report in which CU uncovered quite a bit. Eostrix (🦉 hoot hoot🦉) 08:45, 12 September 2021 (UTC)[reply]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.