Elen of the Roads ( talk) 23:10, 12 April 2012 (UTC) <--this arbitrator cannot spell, parse or use the Mediawiki interface :) reply

I've blocked the Jdc wms and Rantorr socks indef, and blocked the IMS91319 account temp as the master. Two of the accounts were used to stack votes at Wikipedia:Articles for deletion/Cuba at a Cross Roads - that was an iffy close and needs to be re-listed at some point sans sockfest. Kuru (talk) 23:53, 12 April 2012 (UTC) reply

If I've counted correctly, three (vs two) of the above editors !voted in that AFD. I've opened WP:Articles for deletion/Cuba at a Cross Roads (2nd nomination). Dori ☾ Talk ⁘ Contribs☽ 03:24, 13 April 2012 (UTC) reply

• All seems to be done here. -- DQ (ʞlɐʇ) 21:42, 16 April 2012 (UTC) reply

12 April 2012

Suspected sockpuppets

• A1sauce415 ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)

• User compare report Auto-generated every hour.

user's only contribution was Первое Национальное Инновационное Биржевое Агентство (First National Innovation Brokers - FNIB) , a repost (in Russian??!) of the article First National Innovation Brokers which was posted by Adotrde, had refs added by Jdc wms, and was deleted at Wikipedia:Articles for deletion/First National Innovation Brokers. JohnCD ( talk) 08:47, 12 April 2012 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

User is apparently editing on a dial up out of Ukraine and unconnected with the others. He has a sock though

Fnib.marketing ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)

I can't work out what the connection between this group is - we've got this dude, one editing from northern europe, Germany and Turkey (think those two are reroutes, although he could travel for work), one from Rumania, and one from the good ole USofA. Do they all hang out at some bulletin board, do we think?

Think I'll follow the advice of Arnaud Amalric here. Elen of the Roads ( talk) 11:23, 12 April 2012 (UTC) reply

Good advice (I always thought that was St Dominic?). Anyway, I have blocked Fnib.marketing as a role account and A1sauce415 as his sock. JohnCD ( talk) 15:15, 12 April 2012 (UTC) reply

Incidentally, if anyone is interested, here's the Wikistalker output for all the sock accounts Elen of the Roads ( talk) 11:36, 12 April 2012 (UTC) reply

I think link between the groups was laid out plausibly at the ANI report; one person paying editors to add promotional articles for clients, then coordinate when the articles are threatened. I had actually suspected that there were actually a dozen or so paid editors; I'm a little surprised to find out there's only four of them. Frankly, I was pretty open to paid editing before (with transparency), but this event has completely changed my mind. Kuru (talk) 00:02, 13 April 2012 (UTC) reply

link to ANI report for reference Elen of the Roads ( talk) 18:02, 13 April 2012 (UTC) reply

In going over the evidence at the request of Deed89, I have found two more socks of Adotdre

• Ace Evanso ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• VJWhyte ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)

Although it makes absolutely no sense to me, and he denies socking, all the technical evidence is that Deed89 is the sockmaster for Adotdre, Ace Evanso and V J Whyte. Deed89 even gave me an IP that he used outside of the 90 days, that turned out to be the other IP that Ace Evanso uses. If it wasn't that Adotdre was a pain in the arse creating articles with fake references, it wouldn't be a problem. As it is, I'd still be grateful if another checkuser could take a look and confirm that I'm not missing something. It seems bizarre that someone would edit Wikipedia productively from 2010 and then suddenly a month ago decide to create three socks and start producing phony articles. Elen of the Roads ( talk) 21:40, 13 April 2012 (UTC) reply

Blocked Ace; will avoid tagging until your analysis is resolved. I can't find an account at "V J Whyte" can you double check that? Kuru (talk) 02:15, 14 April 2012 (UTC) reply

Looking again, I believe Ace Evanso and VJWhyte are false positives, a result of too many scraps of paper with notes on flying around. I have unblocked Ace Evanso.

I propose to shorted Deeds block to something like 3 months. Its not usual to block a sockmaster indefinitely the first time, unless the socking is really bad. Opinions? Elen of the Roads ( talk) 01:14, 15 April 2012 (UTC) reply

Seems fine; will be happy to monitor when the block expires. Kuru (talk) 23:58, 15 April 2012 (UTC) reply

• Closing up if there are no more issues. -- DQ (ʞlɐʇ) 21:42, 16 April 2012 (UTC) reply

26 October 2012

Suspected sockpuppets

• Celtechm ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)

• User compare report Auto-generated every hour.

There is strong evidence that Celtechm is a paid editor operating on eLance. I can't post the evidence without outing his real-sounding name which is his account name there. Celtechm advocated "Keep" at an AfD [1] for an article created by the paid editing sockmaster Yaratam, surrounding this keep with several uncontroversial votes at other mundane AfDs. I know this is circumstantial, but it's a hell of a coincidence otherwise. Gigs ( talk) 01:28, 26 October 2012 (UTC) reply

• He also voted keep on [2], which was apparently a paid article created by User:PrezMittens, who was a sock of User:Morning277, a paid editor. Maybe they are all the same person. Logical Cowboy ( talk) 03:53, 26 October 2012 (UTC) reply
  • I agree, it's either one big sock network, or there's been some meatpuppet coordination between paid editors. Good catch. Gigs ( talk) 14:43, 26 October 2012 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Elen, do you mean he's logging into the account from 40 IPs, or that he's editing as an IP from 40? Or both? Sorry if I'm assuming more magic pixie dust than CU actually provides. Gigs ( talk) 07:41, 29 October 2012 (UTC) reply

He's logging into the account from 40 IPs and editing only logged in except on (I think) two occasions when he edits as an IP. No-one else is editing on that set of IPs. -- Elen of the Roads ( talk) 13:05, 29 October 2012 (UTC) reply

I've invited Celtechm to comment. Gigs ( talk) 16:28, 29 October 2012 (UTC) reply

• Hi Elen. So does that mean you're about to put a big red X here and confirm that I'm unrelated to these sockpuppets like I've been telling Gigs? While I think the evidence speaks for itself, I was encouraged to comment here. So, a word about the 40 ip addys... I edit from a flaky internet connection and each time the modem crashes (multiple times per day), it re-acquires from an IP pool provided by the ISP. You mentioned 2 ip edits in my history, which is one more than I recall. I only intentionally edit as a logged in user, so I'm sure these are cases where I thought I was logged in but was not (one happened just the other day, and this was the case). In fact, I was concerned enough by the suggestion that I was socking that I immediately logged in, reverted the edit as a logged-in user and re-did it from my account, noting the error in the edit summary. Celtechm ( talk) 17:53, 29 October 2012 (UTC) reply
  • Elen, are all the addresses in the same subnet, or are they geolocating all over the world? Gigs ( talk) 19:09, 29 October 2012 (UTC) reply

• I find it unlikely that Celtechm is a sock of Morning277 - there was some crossover between a number of editors working through Elance and Freelancer who weren't socks of each other, and I had placed Celtechm in that group. However, I have Celtechm flagged as potentially using User:Jdc wms, User:Rantorr and User:IMS91319. All three came up in a previous Yaratam SPI, and were found to related to each other, but they were also unrelated to Yaratam. I'll need to check my notes to see why I flagged those accounts as related. - Bilby ( talk) 00:13, 31 October 2012 (UTC) reply

Clerk, CheckUser, and/or patrolling admin comments

Remarkably, Celtechm is editing on over 40 IPs and no-one else is editing on any of them. Make of that what you will Elen of the Roads ( talk) 22:22, 28 October 2012 (UTC) reply

There doesn't appear to be an overlap with the Morning277 crew, but there was a lot of proxy use in that group. Elen of the Roads ( talk) 22:25, 28 October 2012 (UTC) reply

• Closing as not enough evidence for a block against this sockmaster. -- DQ (ʞlɐʇ) 23:56, 13 November 2012 (UTC) reply