Jump to content

Wikipedia:Sockpuppet investigations/SpaghetticodeV

Add links
From Wikipedia, the free encyclopedia

SpaghetticodeV

07 May 2025

[edit]

– A checkuser has completed a check on relevant users in this case, and it is now awaiting administration and close.

Suspected sockpuppets

[edit]

The NordVPN article has recently received a string of promotional edits that I suspect may be undisclosed paid editing:

  • 4 April: SpaghetticodeV cited a highly promotional post with affiliate links to NordVPN and a call to action on the blog "Insider Gaming"
  • 9 April: Putongpengyou cited a highly promotional review with affiliate links to NordVPN and a call to action on the product comparison site "Comparitech". The content included the ad-like text "boosting its claim to be the most advanced VPN app on the market" and text with the trademark symbol, i.e. "Threat Protection Pro™".
  • 28 April: BettinoD added a list of "awards" from sites containing affiliate links to NordVPN and cited NordVPN marketing pages such as "Get our Emergency VPN Assistance for FREE".
  • 29 April: KnownStormChaser obscured NordVPN's Lithuanian origins to claim that NordVPN is Panamanian, citing a NordVPN support page that presents the Panama jurisdiction as a security benefit. KnownStormChaser also deleted my talk page notifications about conflict-of-interest editing on 30 April.

This editing pattern from accounts with minimal editing activity gives me the impression that the promotional article changes are coordinated. Requesting CheckUser to determine whether the March and April 2025 edits are technically linked. See also the noticeboard discussion at WP:COIN § NordVPN. — Newslinger talk 10:14, 7 May 2025 (UTC)[reply]

Note the peculiar use of links with text fragments (#:~:text=) in SpaghetticodeV's Special:Diff/1283908737 and Putongpengyou's Special:Diff/1284730733. — Newslinger talk 06:01, 10 May 2025 (UTC)[reply]

Comments by other users

[edit]
Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

[edit]
  • Red X Unrelated. PhilKnight (talk) 11:26, 7 May 2025 (UTC)[reply]
  • Add Vinny.navey56 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) too. Putongpengyou signed up on 2020-07-22 07:33 (zhwiki), Vinny.navey56 on 2020-07-28 09:20 (enwiki) and BettinoD on 2020-07-28 10:39 (itwiki). The three of them with mostly no activity until 2024. It seems quite implausible to me that they all signed up in this short time frame, and came back after so long, all for NordVPN, just by chance. It has all the tells for UPE, including strict Monday-Friday timecards, in European business hours (except KnownStormChaser). MarioGom (talk) 22:43, 7 May 2025 (UTC)[reply]
    Yeah, I took a look this morning after the PhilKnight look and I'd actually put it in the realm of possible, because I see behavioral similarities between the group. The user agents are all the same and though the IPs weren't marked as proxies on relevant services, I'm pretty sure they're each using a proxy. And given the subject matter, it would not shock me to know they were using the specific VPN of interest.... Izno (talk) 22:49, 7 May 2025 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/SpaghetticodeV&oldid=1289688312"