Wikipedia:Long-term abuse/Morning277: Difference between revisions
Content deleted Content added
→Non-Sublimeharmony topics: note author |
update number of suspected accounts |
||
| Line 21: | Line 21: | ||
{{Vandal-m|{{SUBPAGENAME}}}}</br> |
{{Vandal-m|{{SUBPAGENAME}}}}</br> |
||
[http://en.wikichecker.com/user/?l=all&t={{SUBPAGENAME}} Comprehensive edits analysis]</br> |
[http://en.wikichecker.com/user/?l=all&t={{SUBPAGENAME}} Comprehensive edits analysis]</br> |
||
This is a group of hired writers who collaborate without ''ever'' using talk pages to communicate with each other. As of |
This is a group of hired writers who collaborate without ''ever'' using talk pages to communicate with each other. As of January 2014, 323 accounts have been confirmed, with another 95 suspected. |
||
Off-wiki investigation by the media and others has identified [https://www.wiki-pr.com/ Wiki-PR] as the company behind this sock-farm. |
Off-wiki investigation by the media and others has identified [https://www.wiki-pr.com/ Wiki-PR] as the company behind this sock-farm. |
||
Revision as of 05:03, 5 January 2014
| Wikilifespan | August 2010 [1] to present |
|---|---|
| ISP | AT&T DSL |
| Known hostmasks | 84.169.0.0/16, 54.215.0.0/16, 54.241.0.0/16, and 54.251.0.0/16 confirmed with checkuser and blocked; 46.137.192.0/21 reported |
| Physical location | Pleasanton, California, San Diego, Miami, Bangladesh and others |
| Instructions | Suspected socks should be tagged and reported to sockpuppet investigations for confirmation. When reporting, please link to this long-term abuse report. When the active abuse has been taken care of, please update this report with the latest information. |
Please report all ongoing incidents of abuse to AIV or ANI.
Basic information
Morning277 (talk · contribs · block log · arb · SPI confirmed suspected)
Comprehensive edits analysis
This is a group of hired writers who collaborate without ever using talk pages to communicate with each other. As of January 2014, 323 accounts have been confirmed, with another 95 suspected.
Off-wiki investigation by the media and others has identified Wiki-PR as the company behind this sock-farm.
Targeted areas, pages, themes
These writers create or (less often) rewrite articles about the people and companies who commission them. It is believed that there is a company with several regular employees, which also hires freelancers from Odesk and Elance [2] [3].
The client base is almost entirely from the United States. It is heavily laden with Silicon Valley dot-coms and their principals, dubbed "serial entrepreneurs" in several instances. Small financial institutions also make a showing. Articles about authors, medical doctors, a musician, a small oil company, and even a minor political party [4] have been placed.
In the less frequent case when an article about the client already exists, the Morning277 writers make extensive changes, cleansing the article of any disparaging material in the process.
Below is a list of article subjects found in User:Sublimeharmony/sandbox11, linked to the corresponding articles (sometimes the name of the article name differed from the subject). Most of these articles were deleted, but attempts to replace some of them, most often with variations on the name, have been seen. Often the new articles are shorter, but comparison of the new articles to the drafts in User:Sublimeharmony/sandbox11 has shown identical passages. This is not an exhaustive list of Morning277's topics; these drafts appeared between 22 February and 11 July 2013.
Sublimeharmony sandbox topics
Non-Sublimeharmony topics
Below is a list of other topics not necessarily present in Sublimeharmony's sandbox but which were worked on by Morning277 writers (to do: remove the Sublimeharmony topics).
other topics
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Articles posted on simple wiki
The articles listed below were posted from two accounts. Due to overlap with Morning277 topics found on the regular English Wikipedia, all of these are assumed to be of interest to Morning277. The search links are for searching the regular English Wikipedia.
articles posted on simple wiki
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Habitual behavior
Morning277 articles usually cite stories from the Web sites below, some of which are blog-like in accepting material from "citizen journalists." Search links are provided for strongly indicative sites:
- Vatalyst.com (search)
- InvestmentUnderground.com (search)
- CaBusinessJournal.org (search) Project Spam page
- DividendKings.com (search) Project Spam page
- Business2Community.com (search) turns up some likely false positives
- DigitalJournal.com
- Voices.Yahoo.com (sometimes misleadingly referred to as simply Yahoo)
- Iwatch.CNN.com (sometimes misleadingly referred to as simply CNN)
- CrunchBase
- Technorati.com
Variations have been seen, but the most stereotypical editing chronology of these writers is as follows:
- a series of at least ten edits to existing articles, typically marked (accurately) as minor and without edit summaries, often concentrating on articles related to Bangladesh. This is done in order begin achieving autoconfirmed status.
- sometimes the creation of a user page and/ or talk page to go along with the account, the user page usually consisting of a one- or two-sentence biography stating the writer's ostensible reason for being on Wikipedia. This is done to prevent the username from showing up as a red link in the history of the user's contributions, which otherwise would be an easy flag.
- no edits for a few days while awaiting autoconfirmation.
- once account is autoconfirmed, creation of an article in a sandbox; when created, the article has multiple paragraphs and a list of references, although at this stage the citations are occasionally in a References section rather than in-line (no edit summary is given here, either)
- references are commonly named with a two- or three-character, capitalized abbreviation and are often used multiple times in the article, sometimes multiple times in the same paragraph, giving the article a visual appearance of overwhelming credibility— for this reason, the writers never bundle their citations as this would detract from the entire purpose of adding citations (i.e., to make the article seem legitimate at first glance or even second)
- another editor, often using an AT&T DSL IP address beginning in 70, 71, or 99 with "pltn" (believed to be Pleasanton, California) or "sndg" (believed to be San Diego) in the hostname may then remove the sandbox template while the article is still a sandbox
- after removal of the sandbox template but before the article is moved to main space, there may be a delay of hours or days
- the article is moved to the main space and may receive small or large changes (including changes before it is moved)
- account from which article was inserted is usually, but not always, abandoned soon afterward
- usually the contributed articles are left orphaned, or are linked only to other Morning277 articles; if an unaffiliated editor places an orphan tag on the article, it may be removed by a Morning277 editor without the status as orphan having been altered
- other affiliated writers, or writers who may be the client or the client's employees, often make small edits to the article; edits from IP addresses are common in this phase
- photos or logos, if added, are placed through a separate (not necessarily autoconfirmed) account.
- if the article is tagged for improvement or deletion, Morning277 accounts or IP editors frequently remove the tags or participate in AfD discussions. When tags are removed, the corresponding edit summary deceptively claims that grammar was corrected or promotional material was removed, decrying puffery, or states that the article's subject is well-known in a certain metropolitan area.
- if an article is deleted, it may be recreated from a different account, typically without the aid of an administrator, often under a different but very similar title
Morning277 articles are written in fluent English, with few spelling, grammatical or punctuation errors. However, they often have a promotional tone, and always contain material that is either neutral or that is flattering of their subjects, never material that is critical or negative, to the extent that they have sometimes been speedily deleted as spam. References sections always have a surfeit of citations, with the clients' press releases and web sites balanced by passing mentions in seemingly independent publications.
Cases
- Wikipedia:Sockpuppet_investigations/Morning277/Archive
- Wikipedia:Sockpuppet_investigations/Morning277/Archive/1
- Wikipedia:Sockpuppet_investigations/Morning277
- Wikipedia_talk:Sockpuppet_investigations/Morning277
- m:User:Rschen7754/Reports/Morning277
Other notes
Check-user information showed use of 184.169.0.0/16 belonging to row44.com, an ISP which provides service aboard airliners. Used 65.122.15.184 at the Phoenix airport. Edited from Amazon EC2/AWS hosts in the United States (184.169.0.0/16, 54.215.0.0/16, 54.241.0.0/16, and 54.251.0.0/16, all confirmed with check-user information) and Ireland (46.137.194.87, not CU confirmed).
Confirmed and suspected accounts
- Sockpuppet category: Category:Wikipedia sockpuppets of Morning277
- Suspected sockpuppet category: Category:Suspected Wikipedia sockpuppets of Morning277