Wikipedia

Wikipedia:Sockpuppet investigations/Japanelemu/Archive

< Wikipedia:Sockpuppet investigations‎ | Japanelemu


Japanelemu

Japanelemu (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

04 October 2017 edit

Suspected sockpuppets edit

Japanelemu recreated Arshdeep Bhardwaj (Entrepreneur) in August to try and get around previous deletions. Previously they had an interest in Timothy_Parker_(puzzle_designer) which is where Polanji has been edit warring recently to keep Japanelemu's version live. Polanji has made other edits that are highly indicative of paid editing: [1] [2]. SmartSE (talk) 21:33, 4 October 2017 (UTC)[reply]

There is crossover with other   Stale accounts that are already blocked e.g. Zeeshan Ramzan (talk · contribs · deleted contribs · logs · filter log · block user · block log) created Freddy Behin (see link 1 above) and Arshlabbu (talk · contribs · deleted contribs · logs · filter log · block user · block log) was involved at Arshdeep Bhardwaj. SmartSE (talk) 21:42, 4 October 2017 (UTC)[reply]

Comments by other users edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments edit

This case is being reviewed by Sir Sputnik as part of the clerk training process. Please allow them to process the entire case without interference, and pose any questions or concerns either on their Talk page or on this page if more appropriate.

08 May 2019 edit

Suspected sockpuppets edit

Stale for CU:

First, WP:DUCK evidence for Slovnimbom/Mozambinwa

  • username follows prior naming convention (10 character username starting with country name)
  • promotional articles about attention-seeking entities or persons

Second, editing follows prior habits

Third, suspicious history of Martin_Eastwood

  • promotional bio created by suspected sock Mozambinwa
  • MartinEastwood300 uploaded on Commons promotional headshot of subject
  • Special:Diff/895922933 : less than 30 minutes later, Bahantikem, another 10-character username, then adds infobox image to bio infobox

Submitted ☆ Bri (talk) 03:31, 8 May 2019 (UTC)[reply]

Hungarimuna per DUCK username and promotional editing into. Additional info coming directly to checkuser. ☆ Bri (talk) 23:38, 9 May 2019 (UTC)[reply]

There's a similar naming convention and similar promotional edits evident at Wikipedia:Sockpuppet investigations/Musbaunow/Archive. Also other evidence linking, shared with Smartse ☆ Bri (talk) 14:21, 10 May 2019 (UTC)[reply]

Comments by other users edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Thanks Bri. Note that I also started an SPI on Commons: c:Commons:Requests_for_checkuser/Case/PeteDavidson200. SmartSE (talk) 12:40, 8 May 2019 (UTC)[reply]
I have added more users and emailed @Berean Hunter, BU Rob13, and TonyBallioni: other evidence linking them. SmartSE (talk) 23:59, 9 May 2019 (UTC)[reply]
@MER-C and Bbb23: Per Bri's note, the connection with the Musbaunow socks seems very likely e.g. Special:DeletedContributions/Austbristolu and this recreation by Cotekaivoram and in the early edits here. SmartSE (talk) 14:32, 10 May 2019 (UTC)[reply]
I've added a bunch from Musbaunow sockpuppet Mgbo120's AFC acceptances that fit the username pattern. Maybes: Indy10andy, Cursdekns, Calxaverian. MER-C 17:43, 10 May 2019 (UTC)[reply]

There were a bunch of similarly named sockpuppet accounts in Wikipedia:Sockpuppet_investigations/Boskit190/Archive#11_March_2019. I also dug through my block log and found another two stale accounts. MER-C 12:00, 11 May 2019 (UTC)[reply]

Setting to request CU to move this along - the connections between the country usernames should be obvious. MER-C 09:33, 18 May 2019 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments edit

  • This case is being reviewed by Cabayi as part of the clerk training process. Please allow Cabayi to process the entire case without interference, and pose any questions or concerns either on Cabayi's Talk page or on this page if more appropriate. Cabayi (talk) 10:58, 18 May 2019 (UTC)[reply]
  •   Clerk endorsed - Please confirm & check for sleepers.
  • Smartse, could you send a copy of your email to the CU list, checkuser-en-wp@wikipedia.org unless you have a good reason that only one of the three named CUs should handle the case. Thanks. Cabayi (talk) 11:04, 18 May 2019 (UTC)[reply]
  Done SmartSE (talk) 12:15, 18 May 2019 (UTC)[reply]
  •   In progress - TonyBallioni (talk) 14:03, 18 May 2019 (UTC)[reply]
    • Zzuuzz, I just noticed that you are also in the process of checking this. I don't want to conflict on reporting with you, so I'm fine letting you handle it if that is what you prefer. TonyBallioni (talk) 14:12, 18 May 2019 (UTC)[reply]
      • And I'm fine with you continuing :) I'll probably be slower and you may have a bit more info than me. What I did observe from what I checked is a set of open proxies (the non-obvious type) that I've seen before in other contexts (but none related that I can think of). -- zzuuzz (talk) 14:18, 18 May 2019 (UTC)[reply]
        • My conclusions on what I've seen so far (which are about the same as you. I think you ran another account that I haven't and I ran a range you hadn't) was that it's likely open proxies/compromised hosts. I'll keep running it then. TonyBallioni (talk) 14:21, 18 May 2019 (UTC)[reply]
  • I'm going to go ahead and call this   Inconclusive from a purely technical angle, noting that I stopped checking accounts once a pattern in the data emerged that convinced me there was unlikely to be overlap. The accounts are using different proxies and different devices, and while some of the ISPs look legitimate, there is a pattern that taken in context of all of these accounts highly suggests that they are using proxies that will not overlap. A fairly clear pattern in the technical data emerged after several accounts, and because of this, I do not think CU will be useful for this case. @Smartse and MER-C: use your judgement on behaviour here as to if this is a connected operation. TonyBallioni (talk) 14:45, 18 May 2019 (UTC)[reply]
    • I'm blocking all of the country usernames as sockpuppets; it is highly likely that a single actor is behind them. As noted above, this pattern goes back two years and from the findings, the spammer(s) has learned to evade CU. MER-C 14:55, 18 May 2019 (UTC)[reply]
      • I think that is a fair conclusion that would be in line with my theory on the results. I can't really say much more. TonyBallioni (talk) 15:01, 18 May 2019 (UTC)[reply]
  • Looks like we’re done here. Closing, TonyBallioni (talk) 18:01, 18 May 2019 (UTC)[reply]

24 May 2019 edit

Suspected sockpuppets edit

Socks following the country naming convention (blocked, all articles found, cross-wiki aspect including locking needs dealing with):

Context. No action needed.

Wikipedia:Sockpuppet investigations/Fatima 77 socks (note country theme naming again):

Wikipedia:Sockpuppet investigations/KorNadya socks:

Wikipedia:Sockpuppet investigations/Boskit190 socks (note comment above which mentions country usernames popping up in March 2019 SPI):

Wikipedia:Sockpuppet investigations/OtelCana socks:

Romani101 socks:

Wikipedia:Sockpuppet investigations/Luxembompamu socks (again, note naming convention):

Wikipedia:Sockpuppet investigations/Essex PR socks (already checked):

Wikipedia:Sockpuppet investigations/Sharonhenderson12 socks:

Umm, we have a problem here. This spam is cross-wiki in a non-trivial way. Found via fr:Special:Contributions/MonsieurJohannes. Wikidata items for spam deleted so far:

No current cross-wiki presence (these can be safely nuked if possible under G5):

Maybe not relevant:

Many of these foreign language articles were created by multilingual SPAs and edited by clear Japanelemu socks. I have deleted SnatchBot software and Draft:Thierry Charles Dubois. I'm not deleting any more to keep the evidence live for now because it makes dealing with Wikidata a little easier.

Previously deleted but not listed above: Primary Source Verification, Simon Arias, Andrew D. Ousley, Vassil Bojkov Collection, LaLaLa Festival, Shan Wu, Dream Vacations Franchise, Niko Kotoulas, Henlius Biotech, Ahmad Jubbawey, Performance Lifestyle, Draft:Enerwhere, Proviz, HigherVisibility, Logan Lucky Ford, Evan B. Francen, Spoonful of Comfort, FRSecure, Oussama El Omari, Erica Eckman, Vic Kamara, Draft:S.M Nazim Uddin Payel, PrettyLitter, C. R Venkatesh, Amra Beganovich, Silicone Sex World, MyCheck. Does anyone know how to look these up on Wikidata (I tried the search bar and my contributions over there).

I also believe we should reclassify under Boskit or some other sockpuppeteer to push the G5 date even further back. MER-C 09:51, 24 May 2019 (UTC)[reply]

I think I've got them all. Leaving this open to coordinate the cross-wiki cleanup of the mess. MER-C 10:12, 26 May 2019 (UTC)[reply]

Comments by other users edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

G5 eligibility should pertain back at least as far as 21 September 2016, the date of creation of user account Uruguymma, I think? ☆ Bri (talk) 18:30, 25 May 2019 (UTC)[reply]

The G5 date is the day on which a country username was blocked for the first time. Wikipedia:Sockpuppet investigations/Luxembompamu pushes it back from 1 November 2017 to 5 July 2017. Unfortunately no more spam was eligible for deletion. MER-C 20:22, 25 May 2019 (UTC)[reply]
@MER-C, just doing patrolling and came across Draft:Now Entertainment and saw you blocked the creator, now Marcus478ga arrives on the talk page shortly after creating an account [3], are they related? Agent00x (talk) 22:46, 25 May 2019 (UTC)[reply]
Doesn't fit the naming convention. Definitely interesting, though - I had a brand new account protest on my talk page about the deletion of Somdip Dey who turned out to be a sockpuppet of Essex PR. MER-C 08:41, 26 May 2019 (UTC)[reply]
MER-C, thanks, of course that's right, I had forgotten the protocol. ☆ Bri (talk) 23:58, 25 May 2019 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments edit

Just an initial observation about गुरु92: The following accounts are confirmed to Wikipedia:Sockpuppet investigations/Essex PR, clear as day:

This obviously matches the cross-wiki behaviour of MonsieurJohannes but technically differs from other socks I've seen (though that's not saying much). MonsieurJohannes is stale for CU (locally). -- zzuuzz (talk) 13:04, 24 May 2019 (UTC)[reply]

Would it be reasonable to conclude that we're dealing with a company who hires multiple freelancers across the world to post the spam? Are there any signs of the accounts being shared? For instance, I find it difficult to believe that Ljulka has written competency in 15 different languages (stale, I know, but asked for rhetorical purposes). It looks like the PR department at the University of Essex have subcontracted out to the sophisticated spamming operation. Oh, and just deleted Draft:Kalina Bontcheva (d:Q50281620) and Draft:Rob Aspin (d:Q59693635) because there's Wikidata for them, not deleted yet: Draft:Klaus McDonald-Maier and Draft:Somenath Biswas. No more articles to find cross-wiki for this batch. MER-C 17:27, 24 May 2019 (UTC)[reply]
I suspect there are multiple contracts somewhere. For the record from a technical perspective, it's difficult to pin this precisely on the university or the firm called Essex PR - and difficult to distinguish it from one or more enthusiastic students (or former students) working together. But otherwise they are clearly confirmed if you know what I mean, with one common factor with the others that I can see - MonsieurJohannes. The country-username farm is all over the place, due to using proxies, but I have a loose suspicion of a different country they might be based in. And involved in this I suspect I've seen some signs of what you might call Digital nomads. Do you remember that sock farm who hijacked articles about Polish villages then moved them to a new title? This reminds me a bit of them. But I get this thing where some of these farms just tend to eternally meld together. -- zzuuzz (talk) 18:41, 24 May 2019 (UTC)[reply]
@MER-C: I'm confused how you linked the first set of accounts to this group. Drop me an email if you like. As to who they might be, looking through Wikipedia:PAIDLIST and given the relative sophistication of them, it must be one of the big players like Get Wikified or Legalmorning. We may want to consider getting in touch with some article subjects, but it is fairly academic. I agree that it looks as if after the Essex PR case, whoever is behind those has then contracted this master to repost the articles. SmartSE (talk) 21:21, 29 May 2019 (UTC)[reply]
  •   Clerk note: Hanging around if there's anything to do — I cannot see any deleted contribs which seems to be kind of a necessity in this one but here anyway. I archived the case on top since Tony said it was done for. --qedk (t 桜 c) 19:18, 24 May 2019 (UTC)[reply]
    • Take a look at the interwiki links on Wikidata for the batch that starts with "SnatchBot software" and ends with "Barbara Liskov". List any SPA creators and suspicious users in each foreign language page history (there are seemingly minor edits like this that are also part of the sockfarm - note the editor also created pl:Registrar Corp). Check the contributions of the suspected sockpuppet for more articles in any language. List the articles here, then check Wikidata for them to see if they were created in a different language. Repeat until exhaustion. MER-C 19:42, 24 May 2019 (UTC)[reply]
  • There doesn't seem to be any reason to keep this open, SPI is not WP:COIN. Ivanvector (Talk/Edits) 15:09, 1 July 2019 (UTC)[reply]

27 May 2019 edit

Suspected sockpuppets edit

First, both users have unusual skills for brand-new editors: P's first edit was adding a template to their userpage [4], one minute later started with an error-free infobox template in sandbox, then within 10 minutes a fully-formed article [5]. M's first edit was creating an error-free infobox template; followed in about three minutes with a fully-formed article [6].

Second, both match the country-username convention of the sockfarm.

Third, both are fond of PR style writing and topics: financial websites [7], actor/personal trainer [8], a copyvio actor's image [9], a record producer (created error-free in one edit).

Also, few editors return from a nearly two-year hiatus and create another new full-formed article with a single edit.

☆ Bri (talk) 18:14, 27 May 2019 (UTC)[reply]

Note there may be more cross-wiki stuff going on here. Meximmanu's creation BestChange is a translation from ru.wiki and in a deletion debate, other editors noted the creator on ru.wiki is a prolific creator of apparently paid stuff. They were blocked for socking subsequent to ru.wiki sockpuppet investigation. ☆ Bri (talk) 02:36, 28 May 2019 (UTC)[reply]

Comments by other users edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Hello. I have just added Rsa1jia1 who has re-created Somdip Dey as Draft:Somdip Dey (scientist). Could stand for Republic of South Africa also. Thanks and regards, Biwom (talk) 10:33, 14 June 2019 (UTC)[reply]

Thanks Biwom I've blocked that account as a DUCK. SmartSE (talk) 11:02, 14 June 2019 (UTC)[reply]
Hello. In case this was not mentioned before, there is a clearly disclosed paid User:Naadobea1776 who has re-created Christian J. Young as Draft:Chris J. Young, Mindgenius as Draft:Mindgenius, and Alexa Curtis (blogger) as Draft:Alexa Curtis. Thanks and regards, Biwom (talk) 03:01, 15 June 2019 (UTC)[reply]
I've added them above. Considering the short time elapsed and them reproducing articles created by this sockfarm it is fairly likely they are related somehow. SmartSE (talk) 18:57, 15 June 2019 (UTC)[reply]
Hello, I feel like I should mention that I took on these clients with the understanding that their pages were deleted previously in some way. I advised them the proper way forward was to submit through AFC, and that the content they provided would need to be updated so it wouldn't be "spam" as an exact copy of something previously created. In this way, I updated the drafts, added citations, and also posted about this on the talk pages for the articles for full transparency. I am in the process of interacting with AFC reviewers to further revise these pages. From what I've read, this is a positive contribution. I'm commenting here in order to help explain what relationship may exist between the pages, and that this is not a sock account. Thanks--Naadobea1776 (talk) 20:25, 15 June 2019 (UTC)[reply]
Who is M Kropf? How were you introduced to your clients? Have you declared all accounts on freelancing websites where you accepted this work, as required by policy? In the cases of the four drafts, did your clients previously contract someone to edit Wikipedia?
I've updated that COI template with "Michelle Kropf". I do not advertise or list paid editing services for Wikipedia on any platforms. The client contact occurred when they listed project work on Upwork, for which I applied. I have added that statement regarding affiliation with Upwork and also links to more relevant guidelines to help others on my talk page for disclosure. I also added the link to the talk page COI disclosure for the instances of Template:Connected contributor (paid) to clarify the affiliation, following examples of its usage. I'm not aware of the provenance of the drafts, which is why I edited all of the drafts. Hopefully that helps with the context. Thanks for pointing out the additional guidelines to be aware of and implement.Naadobea1776 (talk) 20:21, 16 June 2019 (UTC)[reply]
For reference, the commissioning parties were: M Kropf (Draft:Alexa Curtis, Draft:Chris J. Young), McArthur SEO & Design (grantmcarthur.co.uk, Draft:Mindgenius), euronique+communications (euronique.org, Draft:Byron Nicolaides), BizHive (biz-hive.com, Bob McDonald (businessman)), Weber Shandwick (TracFone Wireless), Victor Vescovo (Victor Vescovo). There was nothing suspicious cross-wiki. MER-C 11:15, 16 June 2019 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments edit

Wikidata items: d:Q27062987 (not spam?), d:Q64010512. MER-C 12:50, 1 June 2019 (UTC)[reply]
because of Draft:Dion Todd (Musician) and
because of Special:Undelete/Kaan Gunay. Note File:Dr Costi.png and fr:Utilisateur:Seyfigo/Brouillon (Simay Kocaoğlan Soylu). MER-C 14:24, 1 June 2019 (UTC)[reply]
It turns out Rexchuq and friends are sockpuppets of Stanleytux (Wikipedia:Sockpuppet investigations/Stanleytux). Tip by Bri. MER-C 18:59, 1 June 2019 (UTC)[reply]
for recreating Draft:Somdip Dey in mainspace. Not a Japanelemu sockpuppet, but being caught by a webhost block is a big red flag. MER-C 10:03, 23 June 2019 (UTC)[reply]
who spammed Somdip Dey on Wikiquote. MER-C 20:30, 24 June 2019 (UTC)[reply]

22 January 2020 edit

Suspected sockpuppets edit

The account was created in May 2019 when most of their sock accounts were blocked. No edits outside Draft:Now Entertainment and actively promoting the company on Wikidata please see wikidata:Special:Contributions/Marcus478ga. GSS 💬 16:21, 22 January 2020 (UTC)[reply]

Comments by other users edit

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments edit

  • All previous accounts are   Stale, unfortunately. No CU evidence of socking on the current account - Alison ❤ 07:29, 31 January 2020 (UTC)[reply]
  • Procedural close - user has not edited in over a month and the CU data is stale. – bradv🍁 21:05, 17 March 2020 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Japanelemu/Archive&oldid=1037781887"