Jump to content

Wikipedia:Sockpuppet investigations/Expertwikiguy/Archive

Add links
From Wikipedia, the free encyclopedia


Expertwikiguy

Expertwikiguy (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

25 October 2021[edit]

Suspected sockpuppets[edit]


  1. A few of these accounts participated in dodgy AfDs connected to SpareSeiko or with similar characteristics. The master was blocked as UPE by MER-C during that investigation. See:
  2. Draft:BizOps 2: created by Expertwikiguy [5], moved to mainspace 26 March 2021‎ [6], draftified on 13 April 2021‎, moved back to mainspace by Robertmason1 on 13 July 2021‎ [7].
  3. COI Request Tool: installed as the unique user script in August 2021 by Boredathome101 [8] and Lesliechin1 [9].
  4. Somewhat characteristic timecards [10]
  5. Consolidated contributions show sharp account alternation.
  6. Suspicious overlap at Benjamin Wey, together with other accounts that are also suspiciously similar (but left out of the report at the moment).
  7. Similar user pages.
  8. Similar edit summary style. With some tells that are very unique in statistical terms. Ping me for further info.

-- MarioGom (talk) 22:16, 25 October 2021 (UTC)[reply]

@MarioGom if you could mail me your additional evidence, I'd appreciate it. From what I see here, I'm on the fence about whether CU is justified. -- RoySmith (talk) 22:21, 26 October 2021 (UTC)[reply]
I think Roy was right about the undetected proxy usage. The following IPs seem to be the same person:
The proxy service is unknown to the checkers we use, but they all share the same fingerprint (HTTP proxy running on ports 3389, 5432, and 5433, all of them with the same fingerprint). MarioGom (talk) 15:54, 7 November 2021 (UTC)[reply]
154.3.30.3 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) had the same proxy fingerprint until 2021-08-31. MarioGom (talk) 17:10, 7 November 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  In progress - -- RoySmith (talk) 15:33, 27 October 2021 (UTC)[reply]
    Expertwikiguy is stale, but I was able to find some hints in the CU logs (ping Jpgordon). I see four groups, based on geolocation (Webmaster862 is in two groups):
    • Group 1 (Expertwikiguy, Peter303x, Honolulucb) all are in a small area near a major city, and on the same carrier/ISP
    • Group 2 (Boredathome101, Webmaster862, Carlcarterx) all in a major city
    • Group 3 (Webmaster862, Robertmason1) in a major city
    • Group 4 (Lesliechin1) scattered about a large geographic area
    None of the IPs are classified as proxies by any of our tools. The locations are scattered around the globe. User agents span a large range of common agents, even within a group. Overall (and looking just at the technical data), I'd say each group is  Possilikely (a mix between possible and likely) within the group. I would have said  Unlikely between groups, but I have a vague suspicion there might be proxies in use which are just not being detected by our tools, so I'll call it  Inconclusive between groups and we're definitely in  Behavioural evidence needs evaluation territory. I left some notes on cuwiki. -- RoySmith (talk) 17:33, 27 October 2021 (UTC)[reply]
  •  Checkuser note: I don't have anything to add; the one IP I got from my search did not cause me to take any action on the unblock request. --jpgordon𝄢𝄆𝄐𝄇 19:39, 27 October 2021 (UTC)[reply]
  • I think we've gone as far as we can with this one. The accounts in my group1 were the ones that seemed the most likely based on the CU data I found, and they've already been blocked. There doesn't seem to be enough to justify any addition action, so closing. -- RoySmith (talk) 15:09, 6 November 2021 (UTC)[reply]
  • Reopening, I'd like to take a second look at this. GeneralNotability (talk) 13:37, 7 November 2021 (UTC)[reply]
    @GeneralNotability are you still working on this? -- RoySmith (talk) 19:22, 16 November 2021 (UTC)[reply]
    Yup, sorry. There is definitely a proxy service in use that we are not currently acquainted with. I would say that Boredathome101, Lesliechin1, Webmaster862, Robertmason1, Carlcarterx, and Honolulucb are all almost certainly using it. Peter303x is also on what appears to be a proxy or webhost, but it has a different signature. Expertwikiguy is  Stale. Will block. GeneralNotability (talk) 00:34, 17 November 2021 (UTC)[reply]

04 January 2022[edit]

Suspected sockpuppets[edit]

Attempting to restore promotional ad for Devel Motors that was cut down to a redirect as per Wikipedia:Articles for deletion/Devel Motors. Robert McClenon (talk) 13:41, 4 January 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

10 January 2022[edit]

Suspected sockpuppets[edit]


  • Jaxarnolds: Consistent timecard, similar edit summary style (e.g. [11][12][13][14][15][16][17][18]), [19][20][21]), overlap with Lesliechin1 on Bitfinex, overlap with Boredathome101 on Chad Future, and edits to Gurbaksh Chahal (frequent UPE target). See user pages for shared interest in EDM music and web design (1 vs 2).
  • Sam raggio: Consistent timecard, similar edit summary style (e.g. [22][23][24]), overlap with Boredathome101 on Woody Johnson, overlap with Webmaster862 on CareCloud. See also user page similarity (1 vs 2).
  • Wikivipwiki: Consistent timecard, similar edit summary style (e.g. [25][26][27][28][29][30][31][32][33]), overlap with Carlcarterx on David Stanley Hewett (including Commons upload), suspicious and precocious move to mainspace of an article that had just been draftified at NPP LigoLab (which was a quite obvious UPE creation). Already blocked by MER-C.

Note to CheckUser: They use proxies. See my comments on the report 25 October 2021 for information about how to detect the proxies they used last time (at least for logged-out editing). MarioGom (talk) 16:52, 10 January 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  On hold -  Endorsed by a checkuser What I'm able to gather from the checks I ran is, I think, consistent with an unknown proxy. GeneralNotability investigated previously, and is substantially more clued up about this sort of thing than I am - GN, would you be able to comment on whether this is similar to what you have seen previously? Girth Summit (blether) 18:38, 10 January 2022 (UTC)[reply]
  • Thanks for the ping Girth Summit. This was a tough one, but some quality time with Shodan shows that when Jaxarnolds and Sam raggio were last active, their IPs were showing signs of a proy consistent with previous socks. I am not able to make the same call with respect to Wikivipwiki or RedRockRats, and Thegreatphalanx is  Stale.  Blocked and tagged the first two, leaving open for disposition of the rest. GeneralNotability (talk) 02:28, 11 January 2022 (UTC)[reply]
  • Everyone's blocked. I tagged the outstanding accounts as suspected based on behaviour. Closing. Thanks, Spicy (talk) 02:56, 11 January 2022 (UTC)[reply]

21 February 2022[edit]

Suspected sockpuppets[edit]

Account created after last set of blocks. Recreated EcoFlow, created by master and also edited List of renewable energy organizations like Sam raggio. Edit summaries are similar. Use of the visual editor. Similar editing times. Pikavoom Talk 11:17, 21 February 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Use of VPNs makes it impossible to confirm the connection technically, but their use of those VPNs is very similar to the last batch of socks, and the date of creation plus return to some of the same subject areas is telling. I'm sure this is someone's sock, and it's most probably this master. Girth Summit (blether) 11:53, 21 February 2022 (UTC)[reply]

10 March 2022[edit]

Suspected sockpuppets[edit]

This account has spent quite a bit of time !voting in the sort of "dodgy AfDs" discussed in the archives, and there are similar patterns that I can elaborate on if necessary. But most importantly, there are quite a few odd linguistic similarities here: for instance, the very particular phrase "Not enough news coverage to meet notability", which has only ever been used four times in the history of Wikipedia: once by Chelokabob here and three times by the blocked sockpuppet Peter303x here, here, and here. There's also the unusual phrase "no significant news coverage", used by Chelokabob here and by a plethora of other socks elsewhere: Boredathome101 here, Webmaster862 here, here, here, and here, Peter303x here and here, Lesliechin1 here and here, and more. We also have "good to meet notability", which has only ever been used twice: once by Chelokabob here and once by Expertwikiguy here. This account was previously CU'd at an unrelated SPI, where he admitted to using a proxy—a common denominator among Expertwikiguy socks. CU might be helpful to confirm the nature of the proxy, but I think the behavioral evidence should suffice on its own. Extraordinary Writ (talk) 07:24, 10 March 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  In progress - -- RoySmith (talk) 15:33, 10 March 2022 (UTC)[reply]
  • Based on a bunch of technical data (as GeneralNotability put it, some quality time with Shodan), I'll call Chelokabob  Confirmed to the bunch of socks from 25 October 2021, so I'll tag them as suspected to Expertwikiguy. -- RoySmith (talk) 16:25, 10 March 2022 (UTC)[reply]

11 March 2022[edit]

Suspected sockpuppets[edit]

This account, just like the one I reported here yesterday, participates in "dodgy AfDs" and follows a similar broad editing pattern. But as before, I'll focus on the language-related quirks: 1) We have the phrase "not enough citations provided", which has only ever been used twice in the history of Wikipedia, once by Caphadouk here and once by blocked Expertwikiguy sock Peter303x here. 2) Caphadouk has used here the unusual phrase "not enough news coverage", which has been previously used by, inter alios, Lesliechin1 here and Chelokabob here and here. 3) Caphadouk uses the odd wording "info in Google"; so did Boredathome101 here and Expertwikiguy here. More behavioral evidence available on request. Feel free to give CheckUser a try: despite the proxy usage, deft CUs have been able to extract useful technical evidence from previous members of this sockfarm. Extraordinary Writ (talk) 07:02, 11 March 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  In progress - -- RoySmith (talk) 14:34, 11 March 2022 (UTC)[reply]
  •  Confirmed. More details in cuwiki. -- RoySmith (talk) 14:54, 11 March 2022 (UTC)[reply]
  • Sorry, grabbed the wrong menu item. Caphadouk is suspected to Expertwikiguy. -- RoySmith (talk) 14:55, 11 March 2022 (UTC)[reply]

12 March 2022[edit]

Suspected sockpuppets[edit]

Similar patterns of fishy behavior at AfD; similar language-related irregularities. A few examples: "not enough news coverage", used by MartinWilder here, has been used by Chelokabob here and here, Caphadouk here, Peter303x here, here, and here, etc. MartinWilder's "does not meet guidelines for notability" here is reminiscent of Peter303x's "does not meet guidelines" here; his "keep as per arguments posted by DGG" here resembles Chelokabob's "Keep as per keep arguments posted above are convincing" here. "Delete Does not meet notability", used by MartinWilder here, also matches similar !votes from Peter303x here and here, Lesliechin1 here and here, Webmaster862 here and here, and Expertwikiguy here and here (among others). CheckUser should be useful here. Extraordinary Writ (talk) 07:08, 12 March 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  In progress - -- RoySmith (talk) 14:43, 12 March 2022 (UTC)[reply]
  • I can't quite confirm MartinWilder to anybody, but they're  Likely based on the CU data, and the behavior described here is more than enough to block on. -- RoySmith (talk) 15:05, 12 March 2022 (UTC)[reply]

12 April 2022[edit]

Suspected sockpuppets[edit]

Recreated EcoFlow, created now by two Expertwikiguy socks (Sam raggio, Cherycherylady) recently. Also the username is, well, not imaginative yet authoritarian. Uses the visual editor like previous sock.Pikavoom Talk 06:04, 12 April 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

30 August 2022[edit]

Suspected sockpuppets[edit]

I noticed these two users while patrolling CSD. Uranium Backup had been tagged for deletion as WP:G11. The article was authored by Jerseyfire, who contested the deletion, which is fairly normal, but Zeddedm also contested the deletion, which is not. They had also at one point when the article was a draft removed the speedy tag. According to the Editor Interaction Analyzer, besides intersecting on Uranium Backup and its Talk page, they also intersected on Kevan Barlow. But what was most damning was that Eddedm had uploaded Kevan Barlow 2.png, which was deleted as a copyright violation on December 27, 2021. On August 3, 2022, Jerseyfire uploaded Kevan Barlow 2.jpg and inserted it into the article. I'm requesting CU to confirm. Bbb23 (talk) 19:51, 30 August 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

03 September 2022[edit]

Suspected sockpuppets[edit]

Samanthany shows the typical editing pattern of many consecutive edits to articles using the Visual Editor, followed by rapid-fire participation in AfD (compare [34], [35], [36]). Repeated use of phrasing that is consistently used by Expertwikiguy socks (e.g. [37], used by Lesliechin1, Peter303x, MartinWilder, Chelokabob, Caphadouk and Expertwikiguy). Removed a COI tag from an article substantially edited by Expertwikiguy socks. Other overlap here and here.

Elliswiki7 has edited several obscure articles in close proximity to blocked socks [38][39][40][41], uses Visual Editor, and has a similar username pattern to some previous sock accounts (Expertwikiguy, Wikivipwiki). In March 2021 this account added promotional mentions of "BizOps" to several articles [42][43][44][45]. Expertwikiguy and Robertmason1 repeatedly tried to create an article on BizOps [46]. Spicy (talk) 18:23, 3 September 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • CheckUser requested and endorsed by clerk - I'm aware that previous accounts are stale, but I'm requesting CU per RoySmith's comment here. There may be others - I found these while looking into another SPI, and there are some interesting interactions with other suspicious accounts, but I don't have enough evidence to list them here. Thanks, Spicy (talk) 18:25, 3 September 2022 (UTC)[reply]
  •  In progress - -- RoySmith (talk) 18:27, 3 September 2022 (UTC)[reply]
  • Both of these are  Confirmed or at least  Highly likely to Peter303x and Honolulucb from what I called Group 1 back in 25 October 2021. I'll block and tag them as suspected to Expertwikiguy. @MarioGom and GeneralNotability: who both opined about the use of a previously unknown proxy service back then, so might be interested in this. -- RoySmith (talk) 18:50, 3 September 2022 (UTC)[reply]

04 September 2022[edit]

Suspected sockpuppets[edit]

Found this pair of accounts on Wikipedia:Articles for deletion/International Beauty Industry Awards. Lovewiki106 is clearly a UPE. Lovewiki106 and Zeddedm are suspiciously similar due to a common interest in AFD and how they create articles.

Geodudegolem is the author of that article but doesn't show this pattern. I've listed them for completeness. MER-C 12:03, 4 September 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

10 September 2022[edit]

Suspected sockpuppets[edit]

Spam pages with intersection between each other or previous sockpuppets: Sapphire Ventures, Special:Undelete/Jeff Charney. Two of these are still fresh (not Philz2020) and weren't picked up by the previous CU, so there are likely still more accounts out there. MER-C 09:22, 10 September 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

10 September 2022[edit]

Suspected sockpuppets[edit]

Found some more obvious socks. Overlaps:

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

31 October 2022[edit]

Suspected sockpuppets[edit]

Brand new user, who was created shortly before another puppet of the puppeteer, user:MiamiYamiga was blocked. And even though they are a new user, they went to an article of the other puppet which had been sequestered to draft for UPE concerns, edited it and moved it back, Draft:Howard K. Grossman. Onel5969 TT me 10:39, 31 October 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • CU data is inconclusive; editing interests and some other BEANS stuff is enough to persuade me. Blocking, tagging as suspected. Girth Summit (blether) 13:06, 31 October 2022 (UTC)[reply]

26 February 2023[edit]

Suspected sockpuppets[edit]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

I've blocked the IP filer for one week for block evasion (User:Neunermialog). @Ohnoitsjamie and Salvio giuliano: I thought you might want to take a look.--Bbb23 (talk) 16:34, 26 February 2023 (UTC)[reply]

22 April 2023[edit]

Suspected sockpuppets[edit]

Characteristic behavior. Spam articles created: Proscenic, Fire Department Coffee, Fazale Rana. Sites spammed:

Already blocked and tagged but taking a punt on CU. MER-C 16:28, 22 April 2023 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Clerk endorsed - given the linkspam, timecard match and editing style. MarioGom (talk) 17:43, 22 April 2023 (UTC)[reply]
  •  In progress - -- RoySmith (talk) 18:27, 22 April 2023 (UTC)[reply]
  • Benjornix is  Likely. Operationz is  Possible. Extensive proxy use for both. They're already blocked, so not really anything else useful to do here, so closing. -- RoySmith (talk) 18:49, 22 April 2023 (UTC)[reply]

27 June 2023[edit]

Suspected sockpuppets[edit]

Googleboywonder appears to be a new paid editor, following a pattern seen in previous Expertwikiguy accounts. (Single edit to remove the redlink from their username, editing seemingly randomly to build up a history, then focusing on writing promotional articles in a very small number of edits). I flagged two of the articles as paid, but a second editor has raised concerns that this is Expertwiki, and it seems to match. Given the nature of Expertwiki's paid editing, I suspect other accounts. - Bilby (talk) 02:51, 27 June 2023 (UTC) Bilby (talk) 02:51, 27 June 2023 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Proxy use means no clear link, however,  Possible to this case based on CU evidence. Dreamy Jazz talk to me | my contributions 13:17, 27 June 2023 (UTC)[reply]
  • Pink clock Awaiting administrative action - Some of this behavior is common among spammers, but the timecard and proxy use move the needle towards Expertwikiguy. Please, block it as suspected. Thank you. MarioGom (talk) 20:42, 28 June 2023 (UTC)[reply]
  • Thanks. Blocked and tagged as suspected. Close. Dreamy Jazz talk to me | my contributions 23:59, 28 June 2023 (UTC)[reply]

07 February 2024[edit]

Suspected sockpuppets[edit]

Similar username pattern (x at the end), like previous socks User:Peter303x, User:Thegreatphalanx, User:Benjornix, User:Carlcarterx, and stylometry. Recently, they were hired to fix Benzinga article. 217.165.12.18 (talk) 12:41, 7 February 2024 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Check declined by a checkuser - Account is  Stale.  Behavioural evidence needs evaluation. Spicy (talk) 15:10, 30 March 2024 (UTC)[reply]
  • The suspected sock hasn't edited in over 3 months. If they resume, this report may be refiled. Closing. Bbb23 (talk) 15:16, 30 March 2024 (UTC)[reply]

08 February 2024[edit]

Suspected sockpuppets[edit]

Alleged misuse, Other account to afd !vote to look independent, ChaturvediUtkarsh created SMK Tennis Academy [59], Syed Sadique Hussain !voted keep at Wikipedia:Articles for deletion/SMK Tennis Academy [60].

In this edit Syed Sadique Hussain says that they are Utkarsh Chaturvedi [61]

That was immediately reverted [62] and 3 minutes later ChaturvediUtkarsh makes a near same edit [63]

ChaturvediUtkarsh claims "Original research has been removed, all other issues resolved" [64] on a page created by Syed Sadique Hussain. Edit also add an image uploaded to commons by Syed Sadique Hussain 11 minutes earlier.

Similar to behaviour by Syed Sadique Hussain.

ChaturvediUtkarsh page creation with a longwinded disclaimer [65] "Creating this page for an organisation which has significant coverage, here I have followed all the guidelines strictly and in a neutral point of view, I have added a categories list as well and have written the article in a Wikipedia language format."

As does Syed Sadique Hussain [66]"creating a page after checking the guidelines of Wikipedia with regards to voice over artist and checking it with reliable source as well... after careful research i came into the conclusion that this person has significant coverage in multiple reliable sources which where independent from the topics. i have added the category list as well" [67] "I am creating a biographical page for a fashion designer known as Jeffrey. Since it is a living biographical page i have tried to include as much Citation as possible from primary, secondary, and tertiary source best of my knowledge. i also make sure to write copyright-free content with regard to Wikipedia guidelines and terms. i also added a category box" duffbeerforme (talk) 06:17, 8 February 2024 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Blocked, tagged, closing. The archiving clerk might want to consider requesting a CU to look for others. Bbb23 (talk) 14:44, 8 February 2024 (UTC)[reply]
    PrakashShettyK, Skilledwikivolunteer and Kosmosfacttor came up as sleepers of ChaturvediUtkarsh and have been blocked and tagged. Courcelles (talk) 16:59, 15 February 2024 (UTC)[reply]
    That all said, the geolocation of the Hussain account and the Utkarsh one and their socks does not line up. So I'm not sure what is going on here. Courcelles (talk) 17:18, 15 February 2024 (UTC)[reply]

23 April 2024[edit]

Suspected sockpuppets[edit]

– Joe (talk) 12:32, 23 April 2024 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

Per ticket:2024020510012831, it looks like this account and its sockpuppets are socks or meatpuppers of Wikipedia:Sockpuppet investigations/Expertwikiguy. Could somebody please merge them? – Joe (talk) 12:32, 23 April 2024 (UTC)[reply]

Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Expertwikiguy/Archive&oldid=1221835516"