Wikipedia:Sockpuppet investigations/LaurelWest/Archive

LaurelWest (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

20 July 2020

Suspected sockpuppets

• Riley Turner (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Berthold Hawkeye (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Cecilia Turner (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Kaira Ethan (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Zoey West (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Finley Hawkins (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Violet Theo Finch (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

These appear to be a ton of UPE accounts, with a lot of similarities beyond username. I will gladly email any funct more evidence but I'd like to avoid tipping them off. There's a bunch of overlap at the questionably notable James West (sculptor) and Draft:Rohit Mehta, not to mention the nearly identical userpages. Praxidicae (talk) 14:24, 20 July 2020 (UTC)[reply]

I suspect this is a UPE firm. Pinging @MER-C: who was involved with socks from DoshNomad. Berthold has recreated Hardayal Singh Gill as Hardayal "Harry" Singh Gill here, while LaurelWest created on simple, which was created here by ElricFullMetal. They also created Fresh Pawz on Simple, created here by AshleyBell208. Praxidicae (talk) 14:44, 20 July 2020 (UTC)[reply]

Finley Hawkins created the dubious Dinah Lilia Mourise here, while Laurel created and EricFullMetal, a DoshNomad sock did so here. Praxidicae (talk) 14:49, 20 July 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• This group of accounts has also been a problem on the Simple English Wikipedia, where I made a check. SEngSalSoft is also sock of LaurelWest; They were blocked here on June 12, and I'm not sure what accounts were connected to them then, but this is likely a long-running UPE firm. There's also RudeMilky, no edits here, but registered, confirmed to LaurelWest. Regarding the connection between group 3a and 3b, I've added info on CUwiki (see my recent edits) that would be helpful, cc Ivanvector. Best, Vermont (talk) 21:40, 22 July 2020 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

• LaurelWest, Zoey West, and Riley Turner are  Confirmed to each other. I'll wait for a second opinion on the others. – bradv🍁 14:35, 20 July 2020 (UTC)[reply]
• I concur with Bradv's result, let's call that group 1.
• Group 2 are  Likely to each other and to group 1:
  • NotJuggerNot (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) - see note below
  • AliAJafri (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) - see note below
  • Berthold Hawkeye (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Finley Hawkins (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Liza Sedlock (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • New Revelation Technologies LLC (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
•  Behavioural evidence needs evaluation for the first two. I see them on the same IPs and using the same devices as Berthold Hawkeye and Zoey West at several different times, but their style is quite different.
• Group 3a are  Confirmed) to each other, and technically  Unrelated to group 1.
  • ElricFullMetal (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • EdJaUno (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Liza Peterson (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Dimpsitter (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • SolidCheek (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • PatLiv (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Roostafar (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Cecilia Turner (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Violet Theo Finch (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Group 3b are very  Likely to group 3a. In both groups 3, some accounts are being operated by one person, while others appear to be different individuals, but all are alone on one small corporate network or hosting provider.  Behavioural evidence needs evaluation for this group; contribs on simple may be an indicator.
  • Haleyfritz (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Becca Ray (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • ElseenaH (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • USBMHBAB (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Aurora Willows (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Kaira Ethan (talk · contribs) is  Inconclusive due to proxy use, but is technically similar to group 3.
• I believe that groups 1 and 2 represent a separate case from the two groups 3. I have not tagged any accounts. Ivanvector (^Talk/_Edits) 16:58, 22 July 2020 (UTC)[reply]

  Ivanvector, I'll take a stab at the behavioral eval later. Do you want group 3 split into its own case? And do you want tags applied once behavioral is done, or do you want these untagged? GeneralNotability (talk) 18:38, 22 July 2020 (UTC)[reply]

  @GeneralNotability: please create a separate case. These may be interconnected operations but the group 3 accounts are editing from a different continent consistently from the other two groups. Ivanvector (^Talk/_Edits) 19:25, 22 July 2020 (UTC)[reply]

• It's probably worth noting that several accounts created a bunch of content that MNB9911 did previously here (like Woni Spotts) on Simple. I've come across at least 3 recreations xwiki by accounts here that were also created by MNB socks on enwiki. Quick run down: SolidCheek created simple:MadeinAmerica which was created as MadeInAmerica.com/Draft:Draft:Don Buckner created/edited by Hamirapiratra and DoshNomad here. Praxidicae (talk) 19:30, 22 July 2020 (UTC)[reply]
• @Ivanvector:, @Bradv:, @GeneralNotability: see User:Praxidicae/upefarm. Praxidicae (talk) 19:53, 22 July 2020 (UTC)[reply]
• I don't see any clear behavioral connection between NotJuggerNot and AliAJafri and the other socks in the farm and there's no obvious UPE activity from either one. However, since we seem to be dealing with a UPE farm here, I'm not ready to write them off as "unrelated" if (as Ivanvector says) they're using the same devices and same IP range as two confirmed/likely socks. GeneralNotability (talk) 21:07, 22 July 2020 (UTC)[reply]
• Found the connection of NotJuggerNot. See this SPI. I believe a CU had said elsewhere that one of these accounts (West named) matched NawJee and there is definitely subject matter overlap. Praxidicae (talk) 15:16, 23 July 2020 (UTC)[reply]
• Based on Praxidicae's tracking page I ran some more checks. I also edit-conflicted with the edit above.
  • Based on logs of past checks it appears groups 1 and 2 are  Possible to Wikipedia:Sockpuppet investigations/MNB9911, however because of the networks in use this is a very weak result. Unless there's a strong behavioural connection between the two groups (moreso than just generic UPE) this case should be kept separate, IMO.
  • I see that NotJuggerNot has also come up at Wikipedia:Sockpuppet investigations/NawJee, though a CU found them unrelated to that case.
  • Based on Vermont's info on cuwiki, my own rudimentary behavioural analysis, and that ST47 has already blocked some of the accounts, I think it's safe to say that group 3b is at least part of the same UPE operation as group 3a, if not all one person. Furthermore they are  Likely to Wikipedia:Sockpuppet investigations/DoshNomad based on past checks on the same small corporate network; please file with that case.
  • A number of the other accounts listed on Praxidicae's log are  Confirmed to Wikipedia:Sockpuppet investigations/Timlaieditor, but as all the accounts I found are already locked and properly tagged I'm not going to list them all here. Havechin (talk · contribs) and Blackmold (talk · contribs) are both Timlaieditor socks, for example.
  • I also found this small group 4 who are  Confirmed to each other and  Possible to Timlaieditor:
    • Mani.baseer (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
    • Sarakhan90 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• That's as far as I'm going to dig on this. I'll leave it to the clerks to investigate the possible link to MNB9911, and just what we think about NotJuggerNot. Ivanvector (^Talk/_Edits) 15:56, 23 July 2020 (UTC)[reply]
•  Clerk note: Based on known overlaps from Prax's list and some nice folks who pullled deleted simplewiki articles for me, I'm going to say that groups 1 and 2 probably aren't MNB (or at least there isn't enough behavioral evidence available to prove that they're anything more than two UPE groups who were given the same topics and lists of sources). GeneralNotability (talk) 22:29, 24 July 2020 (UTC)[reply]
•  Relisted - Based on an email from Spicy, I took a second look at NotJuggerNot. I'm increasingly convinced that they are related to this farm in some way. I can pass the email along to anyone who wants to see the detailed evidence, but the short version is that they have a decent amount of overlap with known LaurelWest topics of interest. Combined with the "likely" CU finding documented above, I'm feeling pretty good that NotJuggerNot is part of the farm (though a different person behind the keyboard) - maybe a "good-hand" type sock used to build up credibility? GeneralNotability (talk) 12:48, 26 July 2020 (UTC)[reply]
• I'm only going to speak to the CU side as this is a relist. From that CU only standpoint, I agree that the behavioral evidence eval is necessary. I dug deeper and found there is sketchy behavior on that range that makes a lot look related, but likely is not and they offer webhosting type services. So please consider behavior carefully on those two users. -- Amanda (aka DQ) 08:29, 29 July 2020 (UTC)[reply]
• Per Amanda's comment above, these accounts appear to be editing from a colo/shared host of some sort, so CU isn't the best. Looking at the totality of the evidence, though, I think that NotJuggerNot is somehow connected to this group - there are just too many little UPE-like edits and overlaps with this sockfarm's topics of interest. As such I have blocked NJN as "suspected" on behavior alone. I am leaving AliAJafri alone, there is not enough evidence there to prove socking or UPE. GeneralNotability (talk) 13:29, 29 July 2020 (UTC)[reply]

29 July 2020

Suspected sockpuppets

• FZR2020 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

• Also based on that email [noted above], I'm suspicious that FZR2020 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) may be related to this farm. Relisting - CUs, please have a look at FZR2020. GeneralNotability (talk) 12:48, 26 July 2020 (UTC)[reply]

• Resectioned and quote modified for context -- Amanda (aka DQ) 07:56, 29 July 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

• Checked more on the basis of someone's sock than this sock. It's appearing  Unrelated to anything in the above SPI. -- Amanda (aka DQ) 08:34, 29 July 2020 (UTC)[reply]
• Per Amanda's findings, closing. GeneralNotability (talk) 13:33, 29 July 2020 (UTC)[reply]

22 November 2020

Suspected sockpuppets

• Rabyca (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Repost of Special:Undelete/Draft:Vesna Vrankovic in mainspace, subsequently quarantined at Draft:Vesna Vrankovic. There were initially no material changes to the deleted content, although the article has subsequently been reworked. This spammer is a profligate user of sockpuppets so CU requested to find others. MER-C 11:16, 22 November 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

•  Unrelated as far as technical evidence goes. ~Oshwah~^{(talk) (contribs)} 22:51, 22 November 2020 (UTC)[reply]

  They've been blocked for spamming, probably a new freelancer. Closed. MER-C 17:46, 23 November 2020 (UTC)[reply]