Wikipedia:Long-term abuse/Morning277

Who is Morning277?

Morning277 is Mike Wood (also known as Michael Wood; Elance / LinkedIn / G+), the owner of undisclosed paid editing firm Legal Morning. Morning277 has performed work for the undisclosed paid editing firm Wiki-PR during the Wiki-PR Wikipedia editing scandal. They use a group of hired writers who collaborate without ever using talk pages to communicate with each other. As of August 2025, a total of 676 sockpuppet accounts have been identified and blocked on the English Wikipedia, which include both Legal Morning and Wiki-PR accounts due to their heavy overlap.

Legal Morning sells Wikipedia article writing, monitoring, and translation services. Wood described his use of Wikipedia as a "promotional tool" in his article "I Get Paid To Edit Wikipedia For Leading Companies", and self-published the book Wikipedia as a Marketing Tool. Legal Morning claims, "For your protection – WILL NEVER DISCLOSE MY CLIENTS – we never disclose our clients in order to protect their anonymity", and showcases a podcast in which Wood says, "I never disclose my clients that I work with for Wikipedia" (at 20:50).

Morning277 attempted an illegitimate clean start in September–November 2012 with the account UsedEdgesII (talk · contribs), which was discovered and blocked after UsedEdgesII falsely accused an unrelated editor of being a sockpuppet of two other Morning277 sockpuppets. In August 2025, using the account M277FreshStart (talk · contribs), he requested to be unbanned (with the stated intention of attempting another clean start) in exchange for switching to disclosed paid editing, which was declined.

Targeted areas, pages, themes

These writers create or (less often) rewrite articles about the people and companies who commission them. It is believed that there is a company with several regular employees, which also hires freelancers from Odesk and Elance .

The client base is almost entirely from the United States. It is heavily laden with Silicon Valley dot-coms and their principals, dubbed "serial entrepreneurs" in several instances. Small financial institutions also make a showing. Articles about authors, medical doctors, a musician, a small oil company, and even a minor political party have been placed.

In the less frequent case when an article about the client already exists, the Morning277 writers make extensive changes, cleansing the article of any disparaging material in the process.

Below is a list of article subjects found in User:Sublimeharmony/sandbox11, linked to the corresponding articles (sometimes the name of the article name differed from the subject). Most of these articles were deleted, but attempts to replace some of them, most often with variations on the name, have been seen. Often the new articles are shorter, but comparison of the new articles to the drafts in User:Sublimeharmony/sandbox11 has shown identical passages. This is not an exhaustive list of Morning277's topics; these drafts appeared between 22 February and 11 July 2013.

Habitual behavior

Morning277 articles usually cite stories from the Web sites below, some of which are blog-like in accepting material from "citizen journalists." Search links are provided for strongly indicative sites:

• Vatalyst.com (search)
• InvestmentUnderground.com (search)
• CaBusinessJournal.org (search) Project Spam page
• DividendKings.com (search) Project Spam page
• Business2Community.com (search) turns up some likely false positives
• DigitalJournal.com
• Voices.Yahoo.com (sometimes misleadingly referred to as simply Yahoo)
• Iwatch.CNN.com (sometimes misleadingly referred to as simply CNN)
• CrunchBase
• Technorati.com

Variations have been seen, but the most stereotypical editing chronology of these writers is as follows:

• a series of at least ten edits to existing articles, typically marked (accurately) as minor and without edit summaries, often concentrating on articles related to Bangladesh. This is done in order to begin achieving autoconfirmed status.
• sometimes the creation of a user page and/ or talk page to go along with the account, the user page usually consisting of a one- or two-sentence biography stating the writer's ostensible reason for being on Wikipedia. This is done to prevent the username from showing up as a red link in the history of the user's contributions, which otherwise would be an easy flag.
• no edits for a few days while awaiting autoconfirmation.
• once account is autoconfirmed, creation of an article in a sandbox; when created, the article has multiple paragraphs and a list of references, although at this stage the citations are occasionally in a References section rather than in-line (no edit summary is given here, either)
• references are commonly named with a two- or three-character, capitalized abbreviation and are often used multiple times in the article, sometimes multiple times in the same paragraph, giving the article a visual appearance of overwhelming credibility— for this reason, the writers never bundle their citations as this would detract from the entire purpose of adding citations (i.e., to make the article seem legitimate at first glance or even second)
• another editor, often using an AT&T DSL IP address beginning in 70, 71, or 99 with "pltn" (believed to be Pleasanton, California) or "sndg" (believed to be San Diego) in the hostname may then remove the sandbox template while the article is still a sandbox
• after removal of the sandbox template but before the article is moved to main space, there may be a delay of hours or days
• the article is moved to the main space and may receive small or large changes (including changes before it is moved)
• account from which article was inserted is usually, but not always, abandoned soon afterward
• usually the contributed articles are left orphaned, or are linked only to other Morning277 articles; if an unaffiliated editor places an orphan tag on the article, it may be removed by a Morning277 editor without the status as orphan having been altered
• other affiliated writers, or writers who may be the client or the client's employees, often make small edits to the article; edits from IP addresses are common in this phase
• photos or logos, if added, are placed through a separate (not necessarily autoconfirmed) account.
• if the article is tagged for improvement or deletion, Morning277 accounts or IP editors frequently remove the tags or participate in AfD discussions. When tags are removed, the corresponding edit summary deceptively claims that grammar was corrected or promotional material was removed, decrying puffery, or states that the article's subject is well-known in a certain metropolitan area.
• if an article is deleted, it may be recreated from a different account, typically without the aid of an administrator, often under a different but very similar title.

Morning277 articles are written in fluent English, with few spelling, grammatical or punctuation errors. However, they often have a promotional tone, and always contain material that is either neutral or that is flattering of their subjects, never material that is critical or negative, to the extent that they have sometimes been speedily deleted as spam. References sections always have a surfeit of citations, with the clients' press releases and web sites balanced by passing mentions in seemingly independent publications.

Cases

• Wikipedia:Sockpuppet investigations/Morning277
  • Wikipedia:Sockpuppet investigations/Morning277/Archive
  • Wikipedia:Sockpuppet investigations/Morning277/Archive/1
  • Wikipedia:Sockpuppet investigations/Morning277/Archive/2
  • Wikipedia talk:Sockpuppet investigations/Morning277
• Cross-wiki abuse: m:User:Rschen7754/Reports/Morning277
• Simple English Wikipedia: simple:Wikipedia:Administrators' noticeboard/Current issues and requests archive 44#Spamming by Fatjesus564/Cornucopia

Other notes

Check-user information showed use of 184.169.0.0/16 belonging to row44.com, an ISP which provides service aboard airliners. Used 65.122.15.184 at the Phoenix airport. Edited from Amazon EC2/AWS hosts in the United States (184.169.0.0/16, 54.215.0.0/16, 54.241.0.0/16, and 54.251.0.0/16, all confirmed with check-user information) and Ireland (46.137.194.87, not CU confirmed).