Commons:Requests for checkuser/Case/Moonrivers

If you are creating a new request about this user, please add it to the top of the page, above this notice. Don't forget to add
{{Commons:Requests for checkuser/Case/Moonrivers}}
to the checkuser page here. Previous requests (shown below), and this box, will be automatically hidden on Requests for checkuser (but will still appear here).
The following discussion is preserved as an archive of a Request for checkuser. Please do not modify it.

Moonrivers

Rationale, discussion and results

Reason: The sockmaster has previously been blocked several times on Commons (, , , ), with the longest period for uploading unfree files being a one year block.

The majority of the sockmaster's activity on Wikimedia projects has been on Wikimedia Commons. Here, the user has taken up the task of creating svgs of logos. I was patrolling on Commons when I noticed that some of the logos had copyright problems, and I was a bit surprised when I saw that so many of the logos had been added to articles on EnWiki even though their creator was blocked.

Lo and behold, I encountered the apparent sock account, Jamil.V.Estorninos who seems to also have an interest in corporate logos. The account's most recent 500 undeleted contributions on the English Wikipedia (i.e. all of their undeleted contributions) seem to be very larely focused on adding images/logos to articles. I've taken a sample of ten out of their most recent 50 edits to EnWiki, and all edits in the sample involved doing so.

But, not only does it involve adding just any images to Wikipedia, but all of those images appear to have been created/edited by Moonrivers right before they were placed by the sockpuppet on EnWiki:

  1. This edit adds File:Haus Labs logo.svg to an article a mere two minutes after the image's creation.
  2. This edit adds File:Encyclopaedia Brittanica Inc logo.svg to an article a mere 5 minutes after the image's creation
  3. This edit adds File:TCB&TL_wordmark.svg a mere four minutes after the image's creation.
  4. This edit adds the (now-deleted) File:Chuck-E-Cheese_new_logo.svg to an article a mere 8 minutes after the logo was created.
  5. This edit adds File:Swarovski new logo.svg to an article a mere three minutes after the logo was created.
  6. This edit adds File:PDEA seal.svg to an article less than ten minutes after the seal was posted to Commons.
  7. This edit adds File:National Economic and Development Authority (NEDA).svg to an article a mere 12 minutes after that image had been edited by the sockmaster.
  8. This edit adds File:Avatar franchise logo.svg to an article a mere five minutes after the vector file was uploaded to Commons by Moonrivers.
  9. This edit adds File:Seeker new logo.svg a mere three minutes after the vector was uploaded to Commons.
  10. This edit adds File:BoysTown logo.svg to an article within ten minutes of the final version being uploaded to Commons by the sockmaster.

What's more, the sockpuppet created their global account a mere three days after the master was first blocked for three months.

This appears to be way more overlap than would be expected for mere coincidence. Indeed, this appears to be a pretty convincing behavioral case that we've got some sort of coordination between the two accounts: the master (who is on their last chance for copyright violations) appears to be creating the images, and the sock appears to be placing the images on the English Wikipedia.

Because the master account has a history of being blocked for copyright violations, this appears to be evasion of scrutiny as to their uploads, and several of the sockpuppet's uploads have been deleted or nominated for deletion as copyright violations. There also would have been historical block evasion, as the account made edits to Commons when Moonrivers was blocked here (I note this only as an aside, since it is not ongoing). Because of this, I am requesting checkuser to evaluate the extent of technical connection between these two accounts.

The IPs here obviously cannot be confirmed publicly, but they also appear to be related to this; just like the sockpuppet account has a habit of placing Moonrivers-created logos on other projects, so too do they (see: wikidata:Special:Contributions/223.25.62.82 for evidence as to the one IP, and note that the second IP added an image to an EnWiki article that had been uploaded by Moonrivers a mere two minutes prior). I'm including the IPs more for the ease-of-checkuser's sake, since both are within the same range. I would be unsurprised if there were other socks I've missed, or if there's a sleeper or two.

— Red-tailed hawk (nest) 21:15, 14 September 2023 (UTC)

I've done a bit more auditing; it looks like 203.189.119.110 and 203.189.119.115 have been active on Wikidata with a heavy focus on adding logos created by Moonrivers to relevant items very shortly after the logos were uploaded. Again, not abusive on Commons, so not asking for a check of it, but I'm noting it for posterity and completeness sake. — Red-tailed hawk (nest) 04:50, 15 September 2023 (UTC)
  •  Not done - The en.wiki SPI filed simultaneously with this one confirmed a connection; a redundant Commons check is thus not needed. Эlcobbola talk 02:18, 19 September 2023 (UTC)
    Seems reasonable. Will block as such. — Red-tailed hawk (nest) 00:52, 21 September 2023 (UTC)
    For posterity sake, noting that there was local confirmation as well, following the master's block appeal. — Red-tailed hawk (nest) 15:35, 21 September 2023 (UTC)
    The above discussion is preserved as an archive of the Request for checkuser. Please do not modify it.
    Subsequent requests related to this user should be made     above, in a new section.