sock evidence

    First of all, the sockmaster creates a new account with a nonsensical, all-lowercase username.
    Most important clue: About one minute later, each account creates a sandbox article containing less than 20 bytes of content-free text (e.g. "James", "New Article", "Leap", or "hplink").
    Next, the sockmaster waits two to four weeks for the account to, uh, "improve with age".
    Now, each account writes a spammy article about a for-profit business. They usually don't use edit summaries. This takes multiple edits and at least a couple of days.
        Interestingly, almost all of the references follow the same format: an article title, a publisher, and an access date. The publisher is always always just a website hostname (without the "www"), such as "foxbusiness.com" or "i-newswire.com" or "todaysleadingwomen.com".
    The accounts then move the article into mainspace.
    Second-most-important clue: The sockmaster then marks the article as reviewed. See his log.