Wikipedia:Sockpuppet investigations/Yoodaba: Difference between revisions
→Comments by other users: I am not the discord user |
→06 September 2020: partial CU result |
||
| Line 300: | Line 300: | ||
*{{Requestandendorse}} - Based on Blablubbs's comment, CU was intended, and I endorse regardless. I've been helping Blablubbs as they investigated this case, and while there is a lot here, I believe there is enough behavioral similarity that this isn't a fishing expedition - something suspicious (I almost said "fishy") is going on here. Further, based on the behavior I think this is some kind of UPE farm. The big question is going to be "are there multiple groups at work here" - it could be one sock farm or it could be multiple working off of the same playbook. Endorse, and if a reviewing CU thinks this looks too much like fishing, please talk to me first before you decline - I strongly believe that this is a justified case. [[User:GeneralNotability|GeneralNotability]] ([[User talk:GeneralNotability|talk]]) 16:38, 6 September 2020 (UTC) |
*{{Requestandendorse}} - Based on Blablubbs's comment, CU was intended, and I endorse regardless. I've been helping Blablubbs as they investigated this case, and while there is a lot here, I believe there is enough behavioral similarity that this isn't a fishing expedition - something suspicious (I almost said "fishy") is going on here. Further, based on the behavior I think this is some kind of UPE farm. The big question is going to be "are there multiple groups at work here" - it could be one sock farm or it could be multiple working off of the same playbook. Endorse, and if a reviewing CU thinks this looks too much like fishing, please talk to me first before you decline - I strongly believe that this is a justified case. [[User:GeneralNotability|GeneralNotability]] ([[User talk:GeneralNotability|talk]]) 16:38, 6 September 2020 (UTC) |
||
* I've done the retail and law clusters, and they're all technically {{unrelated}}. I think that's what you're going to find throughout, but it was worth the look IMO. With two exceptions, they all geolocate to the same country. I don't have time to do the rest so I'll leave the status as-is, so I or someone else can finish it (or decide it's not worth the trouble and close it). Behavior is another matter; I suspect that blocking one or more of them might force the issue. <span style="color: #9932CC">[[:User:KrakatoaKatie|Katie]]<sup>[[User talk:KrakatoaKatie|talk]]</sup></span> 14:53, 7 September 2020 (UTC) |
|||
----<!--- All comments go ABOVE this line, please. --> |
----<!--- All comments go ABOVE this line, please. --> |
||
Revision as of 14:53, 7 September 2020
Yoodaba
- Yoodaba (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
06 September 2020
– An SPI clerk has endorsed a request for CheckUser. A checkuser will shortly review the case.
Suspected sockpuppets
- Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.
This case is related to an existing discussion at WP:COIN. The following is a copy of my statement there.
I am opening this thread to discuss a group of around 60 accounts that are engaged in what appears to be paid editing without disclosure. Almost all of them were found and sent to me by a user on discord who prefers to remain anonymous. All of these accounts exhibit highly similar behavioural patterns (detailed below) and some are definitely associated with each other. Our assumption is that at least some of these accounts are run by the same individuals and that at least some of those individuals are affiliated with each other. It is unclear, however, whether they are all run by the same marketing operation. It is a distinct possibility that the common behaviours are linked to individuals reading the same manual on covert marketing.
A checkuser investigation seems appropriate to
- Potentially associate accounts with one another
- Investigate whether private proxies are being run for editing and block them if that is possible without collateral damage
- Check for sleeper accounts
- Check for associations with potentially related prior sockfarms (see below)
If this is indeed a case of one or more large UPE operations, it is unlikely that blocking these accounts – even though such blocks would seem appropriate – would stop the disruption in the long run; however, documenting and investigating the behavioural patterns alone might provide beneficial in tracking down similar accounts in the future.
Behavioural patterns
- Edits are almost exclusively to pages about businesses, occasionally BLPs
- Specific industries include:
- Software and technology
- Video games, see [12]
- Clothes
- Other retail
- Entertainment
- Software and technology
- Specific industries include:
- Remarkably similar edit summaries
- Almost never marked as "minor"
- No personal commentary, just stating the facts; "good" edit summaries
- Regular use of the word "request" (e.g. "requested citations")
- Mainly small edits (punctuation, CN tags), interspersed with large additions that hint at potential COIs
- Accounts rarely make multiple edits to a single page in a row.
- Single accounts edit a large number of pages – not the typical SPA behaviour seen with more primitive UPEs.
- Some target only specific industries, others have more variety
- Potential targeting of competitors by use of cleanup and CN tags?
- Occasional AfD votes, but almost no communications with other editors; mainspace participation well above 90% is the norm
- Lots of "information maintenance" edits, e.g. noting that companies have been purchased by other firms
- All involved accounts edit only on weekdays with very few exceptions; however, the editing times vary significantly
- Userpages are either a single sentence or a single sentence and a few userboxes below
- Adding the userpage is often the first edit they make
- Often show up after less sophisticated (mostly SPA) COI/UPE editors have already edited an article. — Blablubbs (talk • contribs) 16:09, 6 September 2020 (UTC)
Addendum: There are multiple sockfarms that were investigated prior and may have links to this one, namely
— Blablubbs (talk • contribs) 16:45, 6 September 2020 (UTC)
Comments by other users
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
- I contributed a bit to this as it evolved on WP:COIN (I am not the discord user referred to by the opener). If I see new evidence for CU team, I will add it here. ☆ Bri (talk) 18:06, 6 September 2020 (UTC)
Clerk, CheckUser, and/or patrolling admin comments
CheckUser requested and endorsed by clerk - Based on Blablubbs's comment, CU was intended, and I endorse regardless. I've been helping Blablubbs as they investigated this case, and while there is a lot here, I believe there is enough behavioral similarity that this isn't a fishing expedition - something suspicious (I almost said "fishy") is going on here. Further, based on the behavior I think this is some kind of UPE farm. The big question is going to be "are there multiple groups at work here" - it could be one sock farm or it could be multiple working off of the same playbook. Endorse, and if a reviewing CU thinks this looks too much like fishing, please talk to me first before you decline - I strongly believe that this is a justified case. GeneralNotability (talk) 16:38, 6 September 2020 (UTC)- I've done the retail and law clusters, and they're all technically
Unrelated. I think that's what you're going to find throughout, but it was worth the look IMO. With two exceptions, they all geolocate to the same country. I don't have time to do the rest so I'll leave the status as-is, so I or someone else can finish it (or decide it's not worth the trouble and close it). Behavior is another matter; I suspect that blocking one or more of them might force the issue. Katietalk 14:53, 7 September 2020 (UTC)
