Morning277

Morning277 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Older archives were moved to an archive of the archive because of the page size and are listed below:

28 July 2013
Suspected sockpuppets


Contributions by Anonymity32 begin with a series of 13 edits, marked as minor, to a variety of articles (consistent with known Morning277 socks). Then the editor's user page is created, with a one-sentence biography (also consistent). Then there are no edits for almost six days; the account would now be autoconfirmed. A draft of an article on Gerald Imber is placed in a sandbox [1]. At the bottom of the list of references are some citations that have not been incorporated into the article. They are identified by abbreviations enclosed in parentheses: (RR), (NYT), (HC) and the like. These parenthesised abbreviations appear in User:Sublimeharmony/sandbox11. For example, the draft about Sollensys has them peppered throughout the body [2] (not in the References section).

I had turned my attention to Anonymity32 because Worldwide Express was recreated by Anonymity32. David Kiger, about the CEO of Worldwide Express, was inserted by a Morning277 sock, and another Morning277 sock, Enigma15071987 was preparing a draft [3] about David Kiger. —rybec 17:42, 28 July 2013 (UTC) —rybec 17:42, 28 July 2013 (UTC)[reply]

The abbreviation "NYT" for the New York Times is of course a common one, but I don't recall seeing "HC" for Harper-Collins before. This [4]Sublimeharmony draft about ONEHOPE uses the abbreviation "HC" (I'm slightly uncertain that it refers here to Harper-Collins, as it did in Anonymity32's draft) for the Houston Chronicle [5]. The practice of giving short names to citations is common, but enclosing them in round brackets seems uncommon. —rybec 18:57, 28 July 2013 (UTC)[reply]

I notice that the last 6 of the 11 edits from 24.131.56.202 (c-24-131-56-202.hsd1.ga.comcast.net, in the American state of Georgia) were to articles also edited by Anonymity32, and happened within 9 days of Anonymity32's changes to those articles, including an edit [6] to Robert Jon Rosenthal while it was still in user-space and an extensive change [7] to MokaFive within an hour of Anonymity32's change [8]. The 5 unrelated edits were all in 2007.

Of the four edits from 108.55.199.202 (static-108-55-199-202.nycmny.east.verizon.net, presumably in New York City), three were to two articles also edited by Anonymity32, GasBuddy.com and Worldwide Express, and those three edits took place over a span of 17 minutes. The unrelated edit [9] was made months later.

The interaction chart shows no overlap in the articles edited from both IP addresses. It looks as though Anonymity32 edited from those addresses while logged out. If so, Anonymity32 had access to an IP address in New York City and (six weeks later) one in the Atlanta area. —rybec 20:14, 28 July 2013 (UTC)[reply]

Here's a revision of Anonymity32's sandbox [10] where the parenthetical abbreviations exist both throughout the body and throughout the References section.

Unlike many of the known Morning277 socks, Anonymity32 (talk · contribs) has done numerous minor edits to existing articles after contributing several new articles. Enigma15071987 (talk · contribs) also followed a similar pattern, although the account was blocked while the second article was still in a sandbox. Anonymity32 also contributed Video optimization which isn't obviously an advertisement. —rybec 23:54, 29 July 2013 (UTC)[reply]

There is a cluster of articles related to Keller Williams Realty: Mark W. Willis, Jay Papasan, KellerINK, Gary W. Keller, and Dave Jenks. Most of these were made in 2008 by Dansenyard (talk · contribs) but Anonymity32 (talk · contribs) created [11] the KellerINK article, and uploaded to Commons [12] "KellerWilliamsRealty KellerINK.JPG" and "KellerINK Gary Keller Jay Papasan.jpg" probably for use in that article. Reginac7 (talk · contribs) edited Jay Papasan and was named [13] as a suspected Morning277 sock by Reaper Eternal, but has not been blocked. —rybec 21:41, 30 July 2013 (UTC)[reply]

Another edit by Reginac7 [14] has the summary "(Reginac7 moved page User:Reginac7/sandbox to Omar Todd (actor): Finished creating the article in my sandbox.)" —rybec 04:36, 31 July 2013 (UTC)[reply]

The Gerald Imber (edit | talk | history | protect | delete | links | watch | logs | views) article was placed by Anonymity32. On the Simple English Wikipedia, Fatjesus564 (talk · contribs) contributed dozens of articles, many of which were about known Morning277 subjects. An article about Gerald Imber was among them. It is very similar to Anonymity32's version. —rybec 09:29, 27 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Comment: I note there may be some collateral damage to these blocks, or maybe a sock slipped by who is claiming innocence.

See this conversation, in which ap2297 (talk · contribs) says that his prior account ap2296 (talk · contribs) was blocked in a recent Morning277 sweep. The user's understanding of the block seems to have something to do with being on the same LAN as a sockpuppet, so he went ahead and created a new account, with the next number in sequence. ~Amatulić (talk) 18:52, 31 July 2013 (UTC)[reply]

He says he "was unaware to the rule":
  • unblock request by Ap2296 [15]
  • second comment by Ap2297 [16] —rybec 22:01, 31 July 2013 (UTC)[reply]

@DGG I can't provide my evidence on-wiki without violating outing right and left, but I can confirm that the group behind morning277 is actively trying to come up with new tactics that have a higher chance of working, and I would definitely favor #1 of your options. Kevin Gorman (talk) 17:54, 8 August 2013 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments
I've been following these, and they are probably different. Very similar, but different. There are several non-exclusive hypotheses: 1/ That the same group learns what didn't work, & tries different tactics 2,/ that various separate people or groups or paid promotional editors learn from each other. 3/that the same methods occur quite independently to many people who want to go in for this new industry 4/Many good faith editors writing about an organization add what looks like promotionalism, both because that's what they see in the RW, or 5/ Worst of all - that there is so much promotional writing already in WP that people think that's what they ought to do here. DGG ( talk ) 06:13, 7 August 2013 (UTC)[reply]

With the simplewiki evidence, blocked Anonymity32. --Rschen7754 09:33, 27 August 2013 (UTC)[reply]

IPs are stale, so closing. --Rschen7754 01:33, 30 August 2013 (UTC)[reply]

05 August 2013 (11)
Suspected sockpuppets


stereotypical editing habits; Tim Grayem has two-letter capitalized names for citations

Canon Recruiting Group is about Grayem's company, and was contributed by Renzoy16 (talk · contribs), named earlier in this SPI. —rybec 03:35, 5 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I don't have any data on Aredmorgan, but the editing matches a standard paid editing throwaway account pattern (which covers a few people, including Morning277). However, Renzoy16 isn't a Morning277 sock (I have a lot of data on Renzoy16), so I'd be wary of connecting Aredmorgan to Morning277 via the Tim Grayem article. My guess would be that both Renzoy16 and Aredmorgan were hired by the same client, explaining the connection between them. - Bilby (talk) 11:39, 6 August 2013 (UTC)[reply]

I tend to think you're right about Renzoy16, but thought this possible connection to Morning277 was worth mentioning. The account was named by Dennis Brown as (if I recall) "unlikely but possible" and there was a little discussion of it. That's in the archive. —rybec 14:54, 6 August 2013 (UTC)[reply]
I'm assuming you meant "wary of connecting Renzoy16." I just noticed [17] which implies Renzoy16 made an article about Maximilien de Hoop Cartier, a Sublimeharmony topic. —rybec 12:51, 31 August 2013 (UTC)[reply]
The Sublimeharmony version appears to have been created after Renzoy16 wrote the initial article. While it is possible Renzoy16 was subcontracted by Morning277 to post an article, it may be that Renzoy16 was hired independently of Morning277, and possibly that Morning277 was hired after Renzoy16's version was deleted at AFD. - Bilby (talk) 02:27, 1 September 2013 (UTC)[reply]
Yes, those are possibilities. I'm unable to view Renzoy16's deleted article about Cartier. If I could see it, I would look for similarities to the Morning277 one. Another thing I notice is that the Sublimeharmony draft cites stories that appeared after the original article was deleted (I'm taking the dates at face value). I hope it wasn't inappropriate for me to note that Renzoy16 wrote about those two Morning277-related topics. —rybec 03:52, 1 September 2013 (UTC)[reply]

Just to clear this up, I was a paid editor, and I'm horribly embarrassed that I didn't pay enough attention to what I was adding -- no more of that. I thought I'd read up as much as I could, but obviously I hadn't. I meant to come back and continue editing, but life got in the way of that. So, as I understand it, I am not a sock puppet, and I apologize for posting questionable material. - Aredmorgan (talk) 15:03, 29 October 2013 (UTC)[reply]

It would be helpful if you disclosed who hired you. Thanks. ~Amatulić (talk) 15:25, 29 October 2013 (UTC)[reply]
Clerk, CheckUser, and/or patrolling admin comments
05 August 2013 (12)
Suspected sockpuppets


stereotypical editing habits; Dr. David Stewart has three-letter capitalized names for citations —rybec 04:59, 5 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
05 August 2013 (14)
Suspected sockpuppets

Editing habits of CathrineL are stereotypical of Morning277; Tiger Fitness has two- and three-letter capitalized names for citations. —rybec 05:27, 5 August 2013 (UTC)[reply]

Bravinswedy's only contribution was to add mention of a dubious award to the Tiger Fitness article. —rybec 14:02, 5 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims. The editing pattern does look similar, I agree. Hope a checkuser can confirm. ~Amatulić (talk) 21:04, 7 August 2013 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments
05 August 2013 (18)
Suspected sockpuppets

WP:QUACK. Morning277 affiliation should be apparent from use of certain sources as detailed at WP:Long-term_abuse/Morning277, or from recreation of a previous Morning277 article. Articles placed:

—rybec

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
06 August 2013 (2)
Suspected sockpuppets

Oh man, I hate to even start compiling this post, it's going to take me a while. I'm not disclosing the exact string of things that makes these obvious morning277 socks in case they're watching this page, but if you take a close look at the pages these users have created, it should be pretty obvious. I have no idea how many of these users are likely to have relevant checkuser data, but since some creations are recent, hopefully at least some will. If the reasons why these are all quacking like hell aren't obvious, I can establish them via email so as to not tip the duck off. Kevin Gorman (talk) 05:34, 6 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

In a span of 25 minutes, there were edits from 5 different AT&T DSL hosts, of which 2 have "sndg" in their names, implying they are in San Diego; and one has "Bellsouth" in the name, likely meaning it's in the southeastern United States.

05:28 71.128.201.201 ppp-71-128-201-201.dsl.sndg02.pacbell.net https://en.wikipedia.org/w/index.php?title=Newsfilter.org&diff=prev&oldid=567359716

05:34 99.23.190.12 adsl-99-23-190-12.dsl.pltn13.sbcglobal.net https://en.wikipedia.org/w/index.php?title=Orion_Systems_Integrators&diff=prev&oldid=567360075

05:38 70.230.197.63 adsl-70-230-197-63.dsl.sndg02.sbcglobal.net https://en.wikipedia.org/w/index.php?title=DailyRx&diff=prev&oldid=567360347

05:44 2013 184.33.55.155 adsl-184-33-55-155.mia.bellsouth.net https://en.wikipedia.org/w/index.php?title=GingerBread_Lane&diff=prev&oldid=567360801

05:53 99.30.227.54 adsl-99-30-227-54.dsl.pltn13.sbcglobal.net https://en.wikipedia.org/w/index.php?title=TheOfficialBoard&diff=prev&oldid=567361418

—rybec 13:03, 6 August 2013 (UTC)[reply]

At 16:18 on 6 August, 71.128.202.228 (talk · contribs) which resolves to ppp-71-128-202-228.dsl.sndg02.pacbell.net removed the PROD tag from Tiger Fitness [19] with the comment "Common sense benefit to have this page for safety, options for Wikipedia readership"--another San Diego IP address. —rybec 18:14, 7 August 2013 (UTC)[reply]

Gwsauls (talk · contribs) doesn't look like Morning277 to me, although I do suspect the same contributor may be editing from 70.167.71.150 (talk · contribs) while logged out. They edit the same two articles. The IP address resolves to wsip-70-167-71-150.tu.ok.cox.net (Tulsa, Oklahoma) and the subject of the articles is in Oklahoma. —rybec 22:21, 9 August 2013 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments
06 August 2013 (4)
Suspected sockpuppets

71.128.202.143 (talk · contribs) "contested" a PROD of TestCountry and added the sentence "The company admits that its products could be susceptible to drug testing fraud." with that sentence as the edit summary, at 05:58, 6 August [20]

184.33.58.58 (talk · contribs) "contested" a PROD of Pay Per Cloud and removed a paragraph from the article at 06:01, 6 August 2013 with the edit summary "Needs some editing. Corpdepth requirement already met" [21]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I think this one might be a bit of a stretch - the IP made one edit, adding an unsourced negative claim to an article. Morning277 didn't add criticism, and generally he sourced additions. - Bilby (talk) 23:13, 6 August 2013 (UTC)[reply]

Deletion tags were removed from other Morning277 articles via several AT&T DSL IP addresses, including at least two addresses in San Diego--"three times is enemy action." Please see my comment of 13:03, 6 August in Kevin Gorman's report. There were two further removals of the G5 tag from GingerBread Lane but my browser got wedged before I got around to reporting them. Others among these IP addresses were used for only a single edit each, [22] for example. The misleading edit summary is typical. —rybec 00:44, 7 August 2013 (UTC)[reply]
That's all great, but my concern was in regard to 71.128.202.143, which was the only IP listed here when I commented. There may well be a case against other IPs, but the one edit by 71.128.202.143 isn't sufficient to indicate a pattern, and doesn't match typical Morning277 behaviour. 184.33.58.58 at least removed a prod tag, so I guess there's some chance that there is a connection there. - Bilby (talk) 01:27, 7 August 2013 (UTC)[reply]
A large number of prod and G5 tags were removed by different IP's from articles probably or definitely created by morning socks last night in the period of an hour or so. Many of these removals involved removing a tag at the same time that they inserted one negative unsourced fact about the article subject, presumably to make them look less quacky. Take a look at the contribs of some of the IPs in my report above. (The G5'ed articles by confirmed morning socks were later deleted, but followed the same pattern.) If that many IP's with no connection to morning277 all suddenly came across morning277 orphans with prod/csd tags in the course of an hour and decided to remove them while adding one negative fact, I will eat my shoe. Kevin Gorman (talk) 01:34, 7 August 2013 (UTC)[reply]
I missed 71.128.202.143's removal of the prod. In this case, I suspect it is also possible that they are connected with the company rather than Morning277, given that the company and the IP are in the same general area, but it may be connected with Morning277. My concern is that we're got at least one signigficant false positive from this process, and I've seen a few claims on questionable evidence which I know to be unrelated, so I think we need to be cautious. - Bilby (talk) 01:37, 7 August 2013 (UTC)[reply]
I had failed to scroll down, and missed the other additions of unsourced negative material; [23] is one. A block of huge swaths of AT&T DSL addresses isn't going to happen--and if it were to happen, I have little doubt that Morning277 would quickly change over to Verizon. I just thought this burst of activity was a clear indication of IP-hopping that doesn't involve physical travel. The abuse from the Phoenix airport and from Row44 addresses suggested travel as the reason for the changing IP addresses. Who is the false positive you speak of? Some accounts have been mentioned that are obviously not abusers, but I'm not aware that anyone has gotten blocked here without good reason. —rybec 02:47, 7 August 2013 (UTC)[reply]
I was thinking of Arifhasan23 as the main false positive. I'm not sure if there were others - there have been a lot of Morning277 blocks, so it is hard to tell. I should probably compare my records against blocked accounts to make sure that we're ok, but luck holding there will be none. - Bilby (talk) 03:33, 7 August 2013 (UTC)[reply]
I'm guessing you reached that conclusion about Arifhasan23 only because his account was unblocked. The evidence I presented is now deleted, but his request for unblocking may still be read, as may the block log. —rybec 06:03, 7 August 2013 (UTC)[reply]
No, I reached that conclusion because I have notes about Arifhasan23, and I have previously identified him. While he is a paid editor, he's not Morning277. The problem, in part, is the sorts of behaviour that are being used to identify some accounts are common to other paid editors and SPAs. There aren't a lot of errors, but behavioural evidence isn't always going to provide a clear enough distinction. - Bilby (talk) 06:16, 7 August 2013 (UTC)[reply]
The checkuser who unblocked him said that he did so on the basis of conversations with him on IRC, saying that he had admitted the improper editor, but didn't realize it was wrong, and has agreed to stop creating new articles, and in fact that account has not edited since. Assuming the checkuser's judgement was correct, I do not consider that a false positive of an non-promotional editor, but a successful stop of promotional editing. DGG ( talk ) 06:59, 7 August 2013 (UTC)[reply]
Bilby, Arifhasan23 put an article into main space that closely followed (or was identical to) text that had appeared in User:Sublimeharmony/sandbox11. He said that someone had asked him to post the article. There was no error. —rybec 07:11, 7 August 2013 (UTC)[reply]
Just to be clear, I have details about Arifhasan23 which make it very unlikely that they are Morning277, but sharing them would involve outing. Arifhasan23 is a paid editor, but my concern is that Arifhasan23 was blocked as a Morning277 sock, not as a promotional account. There are at least four other accounts (not blocked) named as Morning277 who I also know are not him. I think the problem is that the basic pattern being looked for matches a lot of paid editing.
Anyway, this is probably not the right place for the discussion. I'll keep an eye out for Morning277 socks, and if my records match anyone named here I'll try and help out as I can. - Bilby (talk) 07:28, 7 August 2013 (UTC)[reply]
Like I said before, this report is about what looks like not one writer with multiple accounts, but multiple hired writers. The basic pattern with Arifhasan23 was one of copy-pasting identical text that had appeared in Sublimeharmony's sandbox. Details are in my report of 10 July. —rybec 07:39, 7 August 2013 (UTC)[reply]
Yes, I am aware of that. I am very aware of how Morning277 works. - Bilby (talk) 07:42, 7 August 2013 (UTC)[reply]

Morning evolves with time. This IP removed a prod at the same time that at least seven other IP's removed prods from morning's articles, including at least two that repeatedly removed CSD tags from articles created by confirmed blocked morning socks, mostly by removing the prod while adding one negative fact to it. I would be shocked if the IP in question were not a morning sock. It's not the biggest deal since it's just one IP that will likely never be used again, but if an IP removing a prod in a similar pattern at the same time that six other IPs do so isn't a duck quacking as hard as it can, I'm not sure what would be. Kevin Gorman (talk) 22:54, 8 August 2013 (UTC)[reply]

I agree about the IPs. When I first looked I missed the removal of the prod tag, and only saw the addition of content. Probably because I was brain dead. I also agree that Morning277 changes his model, but the difficulty is that there is a risk that the profile used to identify Morning277 will become too broad and incorporate non-Morning277 sockpuppets/meatpuppets by being based on behaviour that is common to many paid editors and/or SPAs. That said, I stuffed up by missing the removal of the prod in this case, so while it isn't necessarily Morning277, it could well be. - Bilby (talk) 04:16, 11 August 2013 (UTC)[reply]
Clerk, CheckUser, and/or patrolling admin comments


07 August 2013 (4)
Suspected sockpuppets

Bunch of minor edits, followed with a dump into a sandbox and a move to mainspace with the rather odd reason "Editing is complete and ready for production environment". An article on the company's CEO, David Gorodyansky, was created by another sock (User:Sanjeevsingh144). Thearighter created Hotspot Shield, an article about software developed by said company via the same method. MER-C 12:04, 7 August 2013 (UTC)[reply]

Addition: Jimrichard1024 follows a similar pattern. Small edits to get autoconfirm status, then a move from user sandbox to the article Apartment Bank (which I have deleted under A7 and G11). ~Amatulić (talk) 22:29, 7 August 2013 (UTC)[reply]

Another addition: Shamim apee, same pattern. I just deleted Global Fitness under A7 and G11. ~Amatulić (talk) 23:29, 7 August 2013 (UTC)[reply]

I agree about Jimrichard1024 and Shamim apee. They were already named.
Hotspot Shield was edited by Morning277 sock Spacejammer (talk · contribs). —rybec 01:03, 8 August 2013 (UTC)[reply]
Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
08 August 2013
Suspected sockpuppets


User page [24] says he is in the Khulna district of Bangladesh. Is drafting an article about [25] a company called Storage Plus in New York City. Draft contains a reference to a story about Bulb America. Bulb America article was reported in 05 August 2013 (18) section. —rybec 08:27, 8 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims. I figured I'd try to compile the more recent (last 24ish hours) reports here for you so it's all in one report.

Educationalpanda0965 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Cbjackson (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
IrfanSha (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Smyahyaijaz (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Special:Contributions/Smyahyaijaz minor edits to one or two articles until autoconfirmed then creates an article all at once in his sandbox
  • Was created all at once from precopied code (as can be seen from the visualeditor snafu they ran into)
  • User:Smyahyaijaz/sandbox has refnames that are acronyms
  • 1-800-Therapist was targeted and/or created by other Morning277 socks from before, some in the below endorse by Someguy.

If User:Someguy1221 or another clerk could review these new ones and add them if fit that'd be great :) ~Charmlet -talk- 16:51, 8 August 2013 (UTC)[reply]

Additional evidence that was in the earlier reports: Educationalpanda0965 (talk · contribs) has a similar name to confirmed Morning277 account Internationalpanda36 (talk · contribs). Cbjackson was named by Dennis Brown (talk · contribs), who said the account needed further checking but he had notes he could e-mail. Mark A. Fischer was created by Morning277—now recreated at Mark A Fischer. —rybec 17:23, 8 August 2013 (UTC)[reply]
Clerk, CheckUser, and/or patrolling admin comments

This one stinks like a Morning277 sock. And while you're at it checkusers, please check the following. I have poured through these for many hours, and convinced myself that they are probably all Morning277 socks. For evidence, refer to User:Someguy1221/SPI (Charmlet (talk · contribs) was a huge help in this). I chose not to transpose all the evidence here as this page is convoluted enough already. In general, these all fit the pattern of creating a spammy article in their sandbox, waiting to become autoconfirmed, and then moving it to mainspace and (typically) abandoning the account. The IPs show up later to make small edits and remove speedy deletion and prod tags with misleading edit summaries.

Someguy1221 (talk) 09:38, 8 August 2013 (UTC)[reply]

  • Kevin Gorman just withdrew his nomination of VirtualCatNZ (talk · contribs). The user page looks uncharacteristic of Morning277. —rybec 01:23, 12 August 2013 (UTC)[reply]
08 August 2013
Suspected sockpuppets


Account name is similar to Internationalpanda36 (talk · contribs); please check deleted contributions too. —rybec 10:30, 8 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
08 August 2013
Suspected sockpuppets


just noting IP addresses from which Mark A Fischer (edit | talk | history | protect | delete | links | watch | logs | views) was edited:

16:56, 8 August 2013‎ 98.77.186.170 (2,271 bytes) (-64)‎ (Take it to afd. Fischer is notable as a pioneer of intellectual property contracts, including those that Wikipedia uses, and of the biobricks agreement. Read up.) (Tag: speedy deletion template removed)
10:03, 8 August 2013‎ Rybec (2,335 bytes) (+64)‎ (Requesting speedy deletion (CSD G4). (TW)
18:16, 2 August 2013‎ 99.133.162.53 (2,271 bytes) (+5)‎
17:36, 2 August 2013‎ 71.128.207.107 (2,266 bytes) (+428)‎

adsl-98-77-186-170.mia.bellsouth.net - Miami adsl-99-133-162-53.dsl.pltn13.sbcglobal.net - Pleasanton, California? ppp-71-128-207-107.dsl.sndg02.pacbell.net - San Diego

Edits to other articles from AT&T DSL addresses in those same cities was reported earlier. —rybec 17:59, 8 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


08 August 2013
Suspected sockpuppets


This single-purpose account contributed Unified interoperability, a subtle advertisement for Pneuron, an apparent Morning277 client. Unified interoperability was later edited by Morning277 writers Scubadoofeck (talk · contribs), 54.251.74.125 and 54.215.108.36. The initial revision [26] already mentioned Pneuron.

[27] —rybec 21:58, 8 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


08 August 2013
Suspected sockpuppets


Removed prod from Rivalus, a morning277 article. Added two pieces of minor negative information, one sourced, one unsourced. Geolocs to areas near where morning277 is centered. I'm guessing they get paid depending on how long they manage to keep articles up, not if they are 100% positive contentwise. Last set of morning socks added in one single unsourced negative tidbit and removed a prod, I'm guessing they're now hoping adding one minor sourced negative bit while get people to assume it's not them. Normally wouldn't bother posting this IP, but it looks like it might be staticish, and I'm guessing it might belong either to their offices or to the home of one of their employees, so it might be worth a block. If nothing else, it'd be good to have this ip in the records somewhere. Kevin Gorman (talk) 23:12, 8 August 2013 (UTC) Kevin Gorman (talk) 23:12, 8 August 2013 (UTC)[reply]

The way I understand the arrangement works, the paid editor gets paid if the page survives for X weeks. The company probably makes money regardless of what happens, likely charging the client a nonrefundable fee up front to create the article and then more billing when the article is shown to have lasting power, and further billing for maintenance edits. They probably pay their contract editors only if the article stays up, shifting the risk to their hired editors. At least, that's the logical way I'd be running the business if it were mine and I wanted to minimize any incentive to stop. ~Amatulić (talk) 00:40, 9 August 2013 (UTC)[reply]
Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

A short while ago I made a dump of the still-extant articles in Kevin Gorman's Twinkle logs, and parsed the dump for all IP contributors. These made recent suspicious-looking edits:

adsl-184-33-54-38.mia.bellsouth.net

adsl-70-230-206-157.dsl.sndg02.sbcglobal.net

ppp-71-128-202-228.dsl.sndg02.pacbell.net

adsl-99-151-252-29.dsl.pltn13.sbcglobal.net

adsl-99-151-255-121.dsl.pltn13.sbcglobal.net

adsl-99-187-236-37.dsl.pltn13.sbcglobal.net

no DNS record?

adsl-99-30-227-54.dsl.pltn13.sbcglobal.net —rybec 05:04, 9 August 2013 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments


09 August 2013
Suspected sockpuppets

The IP's have all removed CSD or prod tags from morning277 articles in a very morning277ish fashion; many match up with previous ranges.

Of the named accounts, I'm pretty positive about all but Kasad001, and I suspect he's one of their accounts, but an early one. As in earlier section, dont want to give away exact search strat for the named account, but it should be pretty obvious. Kevin Gorman (talk) 06:07, 9 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


09 August 2013
Suspected sockpuppets

They only edit PointCross, contributed by Floralfs (talk · contribs). IP address resolves to c-76-31-178-123.hsd1.tx.comcast.net. —rybec 19:38, 9 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
09 August 2013
Suspected sockpuppets

The only contribution of 96.250.187.200 is a defensive rant about Morning277 editors, suggesting the possibility that the IP is one of those editors. The IP address may correspond to some of the accounts named previously. ~Amatulić (talk) 19:59, 9 August 2013 (UTC)[reply]

Further comments were made to Vejvančický's talk page by 96.250.189.105, which resolves to pool-96-250-189-105.nycmny.east.verizon.net [28] then by 75.15.218.124, registered to AT&T Internet Services [29]. —rybec 00:49, 10 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Verizon in New York City again: it resolves to pool-96-250-187-200.nycmny.east.verizon.net . —rybec 20:30, 9 August 2013 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments
09 August 2013
Suspected sockpuppets


article in User:Sunnysgreat2008/sandbox about The National Academy of Future Physicians and Medical Scientists (NAFP). Extensive edit before move to main space [30] by 184.33.53.221, which resolves to adsl-184-33-53-221.mia.bellsouth.net . (thought I already reported the named account, but cannot find it in the SPI) —rybec 20:59, 9 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


09 August 2013
Suspected sockpuppets


Resolves to adsl-99-187-238-239.dsl.pltn13.sbcglobal.net (Pleasanton, California again). Removed sourced material from Banc_De_Binary: [31]. —rybec 21:54, 9 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


10 August 2013
Suspected sockpuppets


There was a previous SPI, Wikipedia:Sockpuppet_investigations/The_Librarian_at_Terminus/Archive, after which this writer was allowed to continue contributing. I notice similarities to Morning277 which I don't want to post here, but which I can e-mail to the administrator investigating this (my e-mail is not working but I can send a one-way message from the Wikipedia Web form). —rybec 04:38, 10 August 2013 (UTC)[reply]

Now that I've added to the long-term abuse page a list of Morning277's preferred sources, please note how [32] cites Business2Community.com, California Business Journal, Investment Underground, Vatalyst, and Yahoo Voices twice. —rybec 21:16, 17 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I can say with certainty in this case that The Librarian at Terminus is not a Morning277 sock. The Librarian at Terminus is a paid editor, but not the same paid editor. :) Her socks were previously blocked, and I don't see a problem with WilliamH's request not to block the master. - Bilby (talk) 04:45, 10 August 2013 (UTC)[reply]
Clerk, CheckUser, and/or patrolling admin comments
10 August 2013
Suspected sockpuppets


Sangoku09 (talk · contribs) was already named. This IP address resolves to adsl-76-254-53-104.dsl.pltn13.sbcglobal.net (Pleasanton again). The only edit was to User:Sangoku09/sandbox [33]. —rybec 04:55, 10 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


10 August 2013
Suspected sockpuppets

preparing to replace [34] article on Ethan Bearman; please compare 10 May User:Sublimeharmony/sandbox11 draft [35] and note "Retrieved May 10, 2013" in citations in new draft. —rybec 23:38, 10 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
12 August 2013
Suspected sockpuppets


recreated Brosix (company) (edit | talk | history | protect | delete | links | watch | logs | views). See also Brosix (edit | talk | history | protect | delete | links | watch | logs | views).

[36] —rybec 00:13, 12 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
12 August 2013
Suspected sockpuppets


Sourcing and behavioral similarities. Kevin Gorman (talk) 01:03, 12 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Bhaishattra recreated TapouT XT (edit | talk | history | protect | delete | links | watch | logs | views) as TapouT XT (food) (edit | talk | history | protect | delete | links | watch | logs | views) and edited User:TapouT_XT (edit | [[Talk:User:TapouT_XT|talk]] | history | protect | delete | links | watch | logs | views). —rybec 01:33, 12 August 2013 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments


12 August 2013
Suspected sockpuppets


Resolves to adsl-99-187-238-166.dsl.pltn13.sbcglobal.net. Edited User:Saadahmad/sandbox, about RepairClinic.com. —rybec 15:05, 12 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


12 August 2013
Suspected sockpuppets

extensive changes to Bob Dorf (edit | talk | history | protect | delete | links | watch | logs | views)

resolves to adsl-70-230-205-47.dsl.sndg02.sbcglobal.net (AT&T in San Diego, yet again) —rybec 16:57, 12 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
12 August 2013
Suspected sockpuppets

removed section from Robert L. Johnson (edit | talk | history | protect | delete | links | watch | logs | views). Resolves to adsl-70-230-193-18.dsl.sndg02.sbcglobal.net. —rybec 18:11, 12 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
12 August 2013
Suspected sockpuppets

Laurieds does minor edits until autoconfirmed, then makes sandbox article about Hosting.com. It gets touch-ups from AT&T DSL addresses in California while still a sandbox [37]. IP addresses resolve to:

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


12 August 2013
Suspected sockpuppets

had been editing since 2006, often on New Zealand-related topics, then this February contributed SmartFile (company) which looks like Morning277's work. —rybec 22:35, 12 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments
13 August 2013
Suspected sockpuppets

Resolves to ppp-71-128-194-180.dsl.sndg02.pacbell.net (AT&T in San Diego again). Commented about this SPI (and my behaviour) at User_talk:Vejvančický#declined_speedy_deletion_of_24Hr_HomeCare. —rybec 03:12, 13 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


13 August 2013
Suspected sockpuppets

User:Cecilia.firstencoding/sandbox is a draft about SweetCouch, was edited by IP editor before move to main space.

IP address resolves to pool-72-89-118-220.nycmny.east.verizon.net (Verizon in New York City again).

User:Sublimeharmony/sandbox11 draft: [38]

Please note that the access date in the citations in Cecilia.firstencoding's draft matches the creation date of the Sublimeharmony draft. —rybec 06:10, 13 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


13 August 2013
Suspected sockpuppets

working on User:Lmpay1/sandbox, a draft about Resortsandlodges.com

IP address resolves to pool-108-7-144-126.bstnma.east.verizon.net (Verizon in Boston). IP edited out sandbox template.

Another Verizon address in Boston restored Morning277's preferred image to Michael_Johns_(policy_analyst): [39] —rybec 06:38, 13 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
13 August 2013
Suspected sockpuppets

recreating Mile2 in User:Sonia.dutta/sandbox.

DNS name is adsl-68-126-183-90.dsl.pltn13.pacbell.net (Pleasanton again) —rybec 14:43, 13 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

The 116.203 IP address is in Kolkata. —rybec 04:43, 16 August 2013 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

116.203.218.177 (talk · contribs · WHOIS) edited her user page once. NativeForeigner Talk 22:58, 14 August 2013 (UTC)[reply]

13 August 2013
Suspected sockpuppets
Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


14 August 2013
Suspected sockpuppets


All following the typical Morning277 pattern. All blocked, but would love to see what CU turns up. NawlinWiki (talk) 15:19, 14 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Pradip283 (talk · contribs) recreated Reza Ghorbani (edit | talk | history | protect | delete | links | watch | logs | views) as Reza Ghorbani MD (edit | talk | history | protect | delete | links | watch | logs | views). Sublimeharmony link: [41].

Danieln1992 (talk · contribs) recreated TableTopics (edit | talk | history | protect | delete | links | watch | logs | views) as Table Topics (edit | talk | history | protect | delete | links | watch | logs | views). Sublimeharmony link: [42].

Shamim apee had been named in an earlier report (still open above).

Archana3011 (talk · contribs) recreated Sublimeharmony topic GroundWork (edit | talk | history | protect | delete | links | watch | logs | views)as GroundWork, Inc. (edit | talk | history | protect | delete | links | watch | logs | views). —rybec 17:34, 14 August 2013 (UTC)[reply]

—rybec

RHosain20 (talk · contribs) recreated InCrowd (edit | talk | history | protect | delete | links | watch | logs | views) as InCrowd, Inc. (edit | talk | history | protect | delete | links | watch | logs | views).

Karl Mernagh (talk · contribs) recreated Oren Laurent (edit | talk | history | protect | delete | links | watch | logs | views) as Oren Laurent (business executive) (edit | talk | history | protect | delete | links | watch | logs | views). NawlinWiki (talk) 20:57, 14 August 2013 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments
14 August 2013
Suspected sockpuppets


Ssaadich recreated Sublimeharmony topic Echopass as [43] Echopass (company).

Then along comes Sykestown, whose only edit is to remove [44] the vatalyst.com and dividendkings.com citations from the article.

[45] —rybec 21:03, 14 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
14 August 2013
Suspected sockpuppets

Maximilien Cartier, previously at Maximilien de Hoop Cartier and Max Cartier

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
14 August 2013
Suspected sockpuppets


Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


15 August 2013
Suspected sockpuppets
Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


15 August 2013
Suspected sockpuppets

new topic My Home (company)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


15 August 2013
Suspected sockpuppets


User:Twhite113/sandbox about new topic Krinos Foods Canada Ltd

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


15 August 2013
Suspected sockpuppets


Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
15 August 2013
Suspected sockpuppets


Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


16 August 2013
Suspected sockpuppets

Starting with minor edits, following a pattern that is fairly easy to spot (I don't want to be too explicit about it since I'm sure the socks monitor this page, but will be happy to provide diffs in email). Created promotional pages in sandbox and on user page. bonadea contributions talk 07:59, 16 August 2013 (UTC)[reply]

I'm not seeing a Morning277 pattern here. The deleted sandbox was self-promotional, the user page looked like a fan page, and both were unsourced. ~Amatulić (talk) 15:26, 16 August 2013 (UTC)[reply]
I can't see the deleted contributions, but in what remains, the only thing I notice that smells slightly of Morning277 is edits to a few finance-related articles. I looked at some of the AfD comments and they don't look at all like what Morning277 previously said in AfDs. What were the subjects of the promo pieces—were they previous Morning277 topics, and were they sourced to any of the first four sites under Habitual behavior on the LTA page? While the article was a sandbox, did other editors with new accounts come along and edit it? —rybec 17:06, 16 August 2013 (UTC)[reply]
It looks more like it belongs with Wikipedia:Sockpuppet investigations/Misconceptions2, which may be worth looking at for comparisons with Morning277. --I am One of Many (talk) 17:25, 16 August 2013 (UTC)[reply]
In Wikipedia:Articles for deletion/List of attendance figures at anime conventions (2nd nomination), Mediator ram recommended keeping Misconceptions2's article. —rybec 19:29, 16 August 2013 (UTC)[reply]
@I am One of Many: I have had personal correspondence with Misconceptions2. He is not related to Morning277 (unless he recently decided to hook up with them, which seems unlikely). It's more likely that Mediator ram is a sock of Misconceptions2 due to the AFD support. By the way I've supported Misconceptions2 in a past AFD myself, but that wouldn't make me a sock. He does know how to write good articles. ~Amatulić (talk) 21:05, 16 August 2013 (UTC)[reply]
I didn't mean to imply that it has anything to do with how anyone voted in the 2 AFDs. It's rather the pattern of multiple new users behaving in the same way. I also don't think Micconceptions2 is related to Morning277, but they do use some similar strategies. I am One of Many (talk) 21:15, 16 August 2013 (UTC)[reply]

Right, I am probably barking up the wrong tree entirely. I thought it was the Morning277 socks who did this to Wikilinks, but it seems that it isn't. I'm sorry, I really should have taken more time to check my facts first. --bonadea contributions talk 09:23, 17 August 2013 (UTC)[reply]

I'm adding this name to the list. I'm worried that this editor is a sock of User:Morning277, as they created an article for something that he attempted to create several times. The article in question was GingerBread Lane (product), which had been repeatedly re-created at GingerBread Lane before it was finally salted. It could be that this is a completely new and uninvolved editor, but I'm a little suspicious of this since Morning277 has a very bad habit of creating all new socks and trying to evade his ban. The editing history is pretty similar to other confirmed sockpuppets such as Annyongad, small minor edits before attempting to re-add a page. Tokyogirl79 (｡◕‿◕｡) 08:59, 16 August 2013 (UTC)[reply]

That new article, however, doesn't have the polish of the one Morning277 created. It might be new and uninvolved. This seems like a case where a checkuser might shed some light comparing to other confirmed socks. ~Amatulić (talk) 15:26, 16 August 2013 (UTC)[reply]
The new articles are abbreviated but are based on the earlier versions. Instead of dumping articles fully-formed, they've changed to making stubs at first so it looks more natural. Compare to the earlier article; I think you'll find they contain identical passages and matching access dates on the references. I reported Imran771 already, as well as 99.151.254.103 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) which edited out one of the telltale sites. The socking should be obvious here. I nominated this for G11 deletion only because G5 wasn't available, since this SPI is so bogged-down. —rybec 17:06, 16 August 2013 (UTC)[reply]
OK, thanks. I'm blocking that one as a sock. ~Amatulić (talk) 21:23, 16 August 2013 (UTC)[reply]
Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
16 August 2013
Suspected sockpuppets

Pleasanton, California AT&T DSL IP adsl-99-101-143-235.dsl.pltn13.sbcglobal.net and new single-purpose account Financeguy39 both edited out the same section [53] [54] of Gary Crittenden. —rybec 22:52, 16 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


17 August 2013
Suspected sockpuppets
Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


17 August 2013
Suspected sockpuppets
Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


21 August 2013
Suspected sockpuppets
Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
22 August 2013
Suspected sockpuppets

New modus operandi discovered by NawlinWiki: two registered accounts participated in the placement of IMA World Health (edit | talk | history | protect | delete | links | watch | logs | views). Only the account which moved the sandbox became autoconfirmed. The giveaway that this is Morning277 is that while the article was a sandbox, someone using an AT&T DSL address in Pleasanton, California removed an entire section [56] from the draft with no explanation. The ostensible creator of the article had nothing to say about the change, as evidenced by the IP editor's talk page [57] and the article's history. The 76.246.55.40 IP address is AT&T DSL in Sacramento, California.

HappyGO^un^luckEE's user page says "Henry is an unemployed bus driver from southern Illnois"; interest in South Asian topics KSRM College of Engineering (India) and Dhaka Medical College and Hospital (Bangladesh) resembles other Morning277 subcontractors.

After moving the article to the main space, the mover left a talk page message saying "Hi Kking2013. I went ahead and moved your sandbox which had an article on IMA World Health. I thought the subject to be notable and have moved it here." —rybec 03:19, 22 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
22 August 2013
Suspected sockpuppets



New modus operandi discovered by NawlinWiki: two registered accounts participated in the placement of Thom Reilly (edit | talk | history | protect | delete | links | watch | logs | views) but only the account which moved the sandbox became autoconfirmed. This is similar to the way IMA World Health (edit | talk | history | protect | delete | links | watch | logs | views) was published.

Here you can see that the article was pasted into VisualEditor, with two- and three-letter capitalised refnames.

User:Trialanderror450 says "Hi, my name is Stacy and I graduated from University of Colorado." and User talk:Trialanderror450 says "Hi, my name is Stacy and I enjoy working on Wikipedia" but the account's minor edits are mainly to articles related to India.

The subject's work at San Diego State University is also a weak indication: Morning277 edits have been seen from IP addresses in San Diego.

After moving the article to the main space, the mover left a talk page message saying "Hi Naqash.ali00. I took the liberty of moving your sandbox page on Thom Reilly. Thom easily meets the notability guidelines and this page is looking good. Thank you for your contributions! Here is the new page: Thom Reilly". —rybec 03:22, 22 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
22 August 2013
Suspected sockpuppets

[59] —rybec 11:43, 22 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


23 August 2013
Suspected sockpuppets

CrowdOptic, Inc. (edit | talk | history | protect | delete | links | watch | logs | views) vs. [60]

This article has been rewritten more than most, but similarities are apparent:

The article was edited while still a sandbox by the IP editor from Boston, pool-108-7-149-162.bstnma.east.verizon.net. —rybec 22:26, 23 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


23 August 2013
Suspected sockpuppets

draft in User:Heartstrings294/sandbox about Sublimeharmony topic Zipwhip

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
23 August 2013
Suspected sockpuppets


Virool (company) (edit | talk | history | protect | delete | links | watch | logs | views) vs. [61] —rybec 22:44, 23 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


23 August 2013
Suspected sockpuppets


[62] vs. Inigral (company) (edit | talk | history | protect | delete | links | watch | logs | views) —rybec 23:09, 23 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


24 August 2013
Suspected sockpuppets


At 20:14 on 13 August, Rael.kristine (talk · contribs) moved TravelShark to Travel Shark. At 23:40 on 13 August I requested speedy deletion of Travel Shark (edit | talk | history | protect | delete | links | watch | logs | views). At 23:58, Bostonbarrister1 posted a message [63] to User talk:Y asking that the speedy deletion tag be removed. —rybec 00:05, 24 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


24 August 2013
Suspected sockpuppets

Pasted a copy of Cleeng in their sandbox and tried to convince Y to create it [64]. I am One of Many (talk) 00:22, 24 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I was not trying to convince anybody of anything, I was only looking for advice and I was verbally abused for it by user Y who seems to have a tendency towards this behavior.

--unsigned comment by Ryanalanmorris (talk · contribs), 13:37, 25 August 2013

Clerk, CheckUser, and/or patrolling admin comments
24 August 2013
Suspected sockpuppets


PressPad (software) (edit | talk | history | protect | delete | links | watch | logs | views) vs. [65]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


24 August 2013
Suspected sockpuppets


User:Sytten/sandbox about Pneuron vs. [66] —rybec 00:47, 24 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
24 August 2013
Suspected sockpuppets


OneHope Wine (edit | talk | history | protect | delete | links | watch | logs | views) vs. [67] —rybec 17:53, 24 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


24 August 2013
Suspected sockpuppets


Sublimeharmony draft about Inflection

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


24 August 2013
Suspected sockpuppets


Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


25 August 2013
Suspected sockpuppets


User:Sonjaydewing/sandbox is a draft about Legitmix with similarities to the Sublimeharmony draft

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


25 August 2013
Suspected sockpuppets


User:Data manager123/sandbox vs. Sublimeharmony draft about Legitmix —rybec 04:37, 25 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


27 August 2013
Suspected sockpuppets

Tsebo (company) (edit | talk | history | protect | delete | links | watch | logs | views) vs. [69]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


27 August 2013
Suspected sockpuppets


Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


28 August 2013
Suspected sockpuppets


User:Pkharisma/sandbox is about Innoz, of which Deepak Ravindran is one of the principals.

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


30 August 2013
Suspected sockpuppets


[70] vs. [71]

According to the article, Alex Mehr is a principal of Zoosk (edit | talk | history | protect | delete | links | watch | logs | views). Morning277 sock Melissa2508 (talk · contribs) contributed Alex Mehr (edit | talk | history | protect | delete | links | watch | logs | views) and edited the Zoosk article. Alex Mehr was turned into a redirect to Zoosk after an AfD discussion; M. yamamoto recreated it under a disambiguated title. —rybec 00:22, 30 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
30 August 2013
Suspected sockpuppets

contributed Adeyemi Ajao (edit | talk | history | protect | delete | links | watch | logs | views), about co-founder (with Brendan Wallace (edit | talk | history | protect | delete | links | watch | logs | views)) of Identified (company) (edit | talk | history | protect | delete | links | watch | logs | views)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
User:Brendan Wallace appears to have never edited. - Bilby (talk) 01:12, 1 September 2013 (UTC)[reply]
I didn't intend to report "Brendan Wallace" as an account. It's corrected. —rybec 04:18, 1 September 2013 (UTC)[reply]


30 August 2013
Suspected sockpuppets


contributed Evestment (company) (edit | talk | history | protect | delete | links | watch | logs | views) after Evestment (edit | talk | history | protect | delete | links | watch | logs | views) was deleted

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


30 August 2013
Suspected sockpuppets


User:Bhasinnitish/sandbox about known Morning277 topic Moovweb (edit | talk | history | protect | delete | links | watch | logs | views)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


31 August 2013
Suspected sockpuppets


[75] vs. [76] and Wikipedia talk:Articles for creation/User:Manikandansivabarathi/sandbox

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


31 August 2013
Suspected sockpuppets


[77] about Max Cartier vs. [78] —rybec 12:43, 31 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I've noticed you make a new SPI every time you spot new ones. Can't you just merge new ones into the first SPI of the day? MM (Report findings) (Past espionage) 13:29, 31 August 2013 (UTC)[reply]

On 5 August I made a report about numerous accounts, some of which I added on later dates. It's still open. Kevin Gorman reported numerous accounts on 6 August and that report is also languishing. I think the smaller sections are easier to understand. Charmlet also asked for larger sections. Rschen7754 has been the most active SPI clerk and administrator lately; if he wants these consolidated I'll comply. —rybec 00:23, 1 September 2013 (UTC)[reply]
Clerk, CheckUser, and/or patrolling admin comments


31 August 2013
Suspected sockpuppets


[79] vs. [80] about TableTopics —rybec 13:20, 31 August 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


01 September 2013
Suspected sockpuppets
Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


01 September 2013
Suspected sockpuppets


Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


02 September 2013
Suspected sockpuppets
Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
02 September 2013
Suspected sockpuppets
Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


02 September 2013
Suspected sockpuppets


Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


02 September 2013
Suspected sockpuppets


Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


02 September 2013
Suspected sockpuppets

This user's contribution follows a classic Morning277-sockpuppet pattern: create account, edit a few pages, wait for the account to become autoconfirmed, create several pages about non-notable individuals and companies, and then abandon account after getting paid by same. I have already nominated several of these other pages for deletion, and I do not expect this individual will contest any of them. KDS4444Talk 17:53, 2 September 2013 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments
More