This post is to inform the English Wikipedia editing community that the Checkuser team has identified a very large group of socks creating promotional articles, inserting promotional external links, and otherwise editing disruptively on this project. The investigation is named "Orangemoody" because this was the first sock identified.

During the course of this investigation, evidence has been identified that this group is editing for profit (i.e., that they are paid editors). Only a few of the accounts have made any disclosure related to paid editing, and those which did failed to make complete disclosures. The investigation began in early July 2015. Many functionaries have participated in the investigation and identification of accounts, as well as the review of articles created by the accounts. The Community Advocacy department of the WMF is also an active participant, focusing on issues best addressed by WMF staff.

It is important to note that the 381 accounts identified in this investigation are only those that were editing from the end of April to early August. This reflects the time-limited availability of checkuser data. Many of the identified accounts were editing before that time, and the nature and quality of the edits suggests that this paid editing scheme had been in place for some time before it was fortuitously identified. The WMF in particular will continue its liaison with article subjects, and will be reviewing data to determine further steps that are not directly available to the community.

There are 381 socks currently being blocked as a result of this investigation. All of the socks are linked by both technical data and behavioural evidence. The list of socks has been posted at Wikipedia:Long-term abuse/Orangemoody/Accounts. All of these blocks are checkuser blocks. They are being performed by EgressBot using a standardized block summary and user talk page template, so that reviewing administrators and editors will be able to identify that they are part of this group. A copy of the block summary and template is posted on the page listing the identified socks. Unblock requests can be brought to the attention of checkusers; this can be done by posting a link at the SPI talk page. It will take the blocking bot approximately an hour to complete all of the blocks; if for other behavioural reasons an administrator needs to block any of the accounts in the interim, the block will be superseded by the bot with the applicable summary and template. The same will apply to any accounts that have already been blocked.

The socks all exhibit at least one of the following behavioural traits:

• "Article creation" socks create articles in draft space or user space mainly based on submissions to Articles for creation that had been declined, or articles that had been added to article space and deleted as being too promotional. These articles do not give proper attribution to the original authors. There are occasional variations to this process. Most of the articles created in this way have been moved to article space; a few are still in draft or user space.
• "Helper" socks will usually complete a series of useless edits in order to be autoconfirmed. They then continue making gnoming-type edits that will periodically include the addition of spammy external links. Some of these socks also participate in Page Curation, and they will “mark reviewed” articles created by the other socks.
  • Examples of "useless edits" include adding {{italictitle}} or wiki-linking words like Asia and United States, or making minor formatting changes.
• The groups are not entirely distinct and some socks have acted as both article creators and helpers.

Early in the sockpuppetry investigation, it became apparent that several of the articles and the individual socks were tied to deletion discussions, OTRS comments, and complaints directed at specific administrators, where allegations of either demands for payment or complaints that articles were being deleted despite payment were made. The WMF Community Advocacy team were contacted, and User:Jalexander-WMF and User:Kalliope_(WMF) have both been directly involved in working with article subjects and complainants. The work being done by this socking group is unsolicited.

The editing pattern has been identified as follows:

• An AfC draft is declined, usually because of notability concerns or excessively promotional content. There are variations on this, including deletion of articles in article space for similar reasons.
• An Orangemoody sock begins work on the article, usually based on the original contributor’s content, and develops it sufficiently to prepare it for a move to article space.
  • In some cases, the sock will create a redirect page with the article being redirected to another topic. Most of these redirects are very implausible.
• External contact is made with the article subject and/or the original draft/article creator. An offer is made to publish the article in article space for a fee. The person making the contact will usually claim to be an experienced editor or administrator. The names of genuine editors and administrators are often used (for example, the names of administrators who have deleted related material), and this has been reported to this noticeboard in the past.
• Money is exchanged. The article is moved to article space. It will frequently be marked reviewed by another sock, sometimes with the addition of tags.
• Some time later the article subject or person who has paid for the article to be moved to mainspace is then contacted again and advised that, for a specific monthly fee ($30/month in examples that have been confirmed), the “editor” will continue to protect the article from vandalism and prevent its deletion, claiming that they had previously done that without charge.

The use of declined drafts (and in some cases deleted articles) to identify and approach potential clients is a new wrinkle in the way paid editing is being conducted. The return to demand further money to "protect" the article is also significant, and we do have examples of socks proceeding to request deletion of pages.

The list of articles created by the socks is located at Wikipedia:Long-term abuse/Orangemoody/Articles. This list is not considered complete; due to time constraints, there may be additional articles created by these socks that are not included here. Most articles relate to businesses, businesspeople, or “artists”.

Review of this list of articles reveals that the overwhelming majority of them would qualify for deletion under one or more speedy deletion criteria. In this specific case, however, in order to prevent article subjects from continued shakedowns by bad actors who are causing significant harm to the reputation of this project, the articles are all being deleted. It is important to break the cycle of payment demands, and to make it clear that the Wikipedia community, and not a small group of paid editor accounts, controls the content of this project. This mass deletion is without prejudice to recreation by experienced Wikipedians who believe that the subject is sufficiently notable for an article. We emphasize again that all indications are that the editing was not solicited by the article subjects.

Because so many of the articles contain unattributed material and/or copyvios, administrators are urged NOT to undelete articles or move them to userspace.

• Review the edits of the sock accounts for quality and for spam links, and make repairs as needed
• Review the edits of the sock accounts for any undeleted article creations. It may be appropriate to delete these articles as well
• Continue to be vigilant for allegations of similar schemes
• Review the list of deleted articles and consider creating new, well-sourced, independently written versions of articles about notable subjects. Some suggestions have been made at Wikipedia:Long-term abuse/Orangemoody/Articles
• A special OTRS queue, info-orangemoodywikipedia.org, has been set up. Please feel free to refer any complaints from article subjects to this email address. The English Wikipedia Volunteer Response Team will work with the subjects, and this queue will be monitored as well by WMF’s Community Advocacy team if further assistance is needed.
• Please be kind to the article subjects. They too are victims in this situation.

On behalf of the Functionary team, Risker (talk) 23:04, 31 August 2015 (UTC)[reply]