Wikipedia:Sockpuppet investigations/BurritoSlayer/Archive

Add links
Source: Wikipedia, the free encyclopedia.


BurritoSlayer

BurritoSlayer (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

27 July 2017

Suspected sockpuppets

I don't file this report on a long-term user lightly, but unfortunately I believe this might be a case of using a sock farm for undeclared paid-editing by a user who has the autopatrolled permission. Most of the links here will be to user contributions limited to page creations rather than diffs, because it is easier to compare that way and it makes the point. There will be some diffs as well and I can provide more specifics if need be.

The first thing that connected me to this was the creation today of The Rise Fund by LedgerTom. I noticed that for a relatively inexperienced user that they created a page from scratch and knew to create the talk page instantly after. Poking around further in Category:TPG Capital companies led me to Tomwulcler where I noticed the conncetion between the name and the claimed place of residence when I saw this talk page post about the ownership of the main company that reminded me of a similar talk question by LedgerTom. Further poking around at pages edited by Tomwucler and the suspected socks led me to what appears a sock farm with very similar name formats, userpages if they have them, and similar editing paterns and talk page styles.

All of the accounts show tendencies towards creating talk pages of companies or BLPs: Tomwsulcer, RedmondKane, LedgerTom,

The tactic of creating a talk page instantly after creation of an article is one followed in all of Tomwsulcer's recent page creations all follow that pattern as does: LedgarTom ( [1] [2] ), RTICorbit

There is also a similarity in moving titles to more sophisticated sounding disambiguators: LedgersTom Tomwsulcer

There is also a tendency to attempt to either whitewash or remove content/advocate for deletion of articles that are not favourable, including the removal of maintenance tags: LedgerTom, Barlowmichael32 removing negative content from the same article as an SPA. The pattern of removing negative information is repeated by RedmondKane. Additionally, both LedgerTom ([3],[4] ) and RedmondKane ([5], [6] ) both post on talk pages of investors they don't find notable advocating against the article. My suspicion here is that it might be competition to their clients if it is a paid ring. The main account doesn't do this as much, but it is similar to him posting on the talk page of a murder victim advocating for redirecting it or dabing it to a a page he just created. The style of that post from the what appears to be the main account matches the format of above.

Looking through the articles, I suspect there are other accounts, but those didn't have enough for me to feel that there could be a behavioral case made. I'm requesting CU mainly because I also suspect there are others that might be sleepers or that don't intersect. There could be a VPN being used on even the accounts listed that would make CU less useful if this is a paid editing socking issue, but I think there is enough behavioral evidence to make this a behavioral case if CU is not useful. TonyBallioni (talk) 23:51, 26 July 2017 (UTC)[reply]

  • Note I've added Feather3 and DemoTent: both are SPAs that follow the same pattern (Feather3 DemoTent of page creation and immediate talk page creation. I found both accounts after looking through the tool again and at the edit history of Salient Partners: created by DemoTent with the only other substantial edits to that page being by Feather3, ContainerPat, and RTICorbit all linking to new articles they created. The last link showing a change of the name in the piping to avoid a redirect after LedgerTom's move of W. Ben Hunt (investment strategist) linked above. DemoTent is likely stale for CU, but I've included them in the list of socks since an article they created ties together three of the other accounts and is important behavioral evidence. TonyBallioni (talk) 14:05, 27 July 2017 (UTC)[reply]
  • Yet another potential sock: Mollybloomin, inexperienced user where the talk page is very similar in format to the others. This one has a more direct link to Tomwsulcer because he participated in the AfD that saved the article. Sorry to Bbb23 for adding this as the check is still ongoing, but this one is another clear behavioral link to the suspected master. TonyBallioni (talk) 16:09, 27 July 2017 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Thanks for both of your hard work. TonyBallioni (talk) 20:58, 27 July 2017 (UTC)[reply]
Behaviorally they intersected with Chinabusiness from group 1, but unsure of the technical details.
Thanks to all. TonyBallioni (talk) 03:00, 28 July 2017 (UTC)[reply]
Sorry for making this page such a mess. A lot of possible accounts are coming up in the cleanup. TonyBallioni (talk) 05:42, 28 July 2017 (UTC)[reply]
@KrakatoaKatie and Bbb23: pinging you to alert both of you of the potential group 1 connected proxies here. TonyBallioni (talk) 06:09, 28 July 2017 (UTC)[reply]
These four IPs belong to Privax Ltd, who own HideMyAss.com, a proxy. All blocked now.Kudpung กุดผึ้ง (talk) 09:05, 28 July 2017 (UTC)[reply]
I ran a random sampling of the group one socks against it in the editor interaction tool and came up with over 40 pages that aligned from the group sampled. This is obviously stale for CU, but given the overlap, those creations might be a place to start as a behavioral investigation. TonyBallioni (talk) 17:02, 28 July 2017 (UTC)[reply]
 Clerk note: Hi Tomwsulcer, the section below is a mess so I'm commenting on this here. This case is filed under your name in error and will be moved, but it's taking some time to work out where it should be moved to. This page will be cleared once we figure that out. Ivanvector (Talk/Edits) 18:56, 17 August 2017 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

Cetainly a worrying amount of behavioural coincidence even if the stalk tool doesn't tell us much - which is to be accepted if all this is part of a cleverly conceived activity - the sock accounts would not want to be seen editing the same articles unless there was a momentary slip.Kudpung กุดผึ้ง (talk) 07:40, 27 July 2017 (UTC)[reply]

And please check White caterpillar (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) against group 4. Thanks, GABgab 21:02, 27 July 2017 (UTC)[reply]

@GeneralizationsAreBad: Did you want a fresh look or do you want Bbb23 to look since he did the initial check? Katietalk 21:08, 27 July 2017 (UTC)[reply]
@KrakatoaKatie: If you are interested, I wouldn't object GABgab 21:09, 27 July 2017 (UTC)[reply]
Indeffing with a cu confirmed tag. Undisclosed COI socks...no reason to not indef. If they wish, they can file a block appeal and they would have to make a convincing case with well-founded understanding in policies. Right now, they are flagrantly violating policies.
 — Berean Hunter (talk) 00:31, 31 July 2017 (UTC)[reply]
Although, having reviewed this now I have no doubt the first three should all be treated as one group, and BurritoSlayer is the oldest of the three. I'm also quite certain now that Docamat12 (talk · contribs) is behaviourally linked to Group 2, and I have blocked without tags.
As for Le laela (talk · contribs), the obscure draft they picked up as one of their first edits is a salted subject with a very long history of promotional editing. That article is attributed to Knoblauch129, and in the history I see obvious Wikipedia:Sockpuppet investigations/PlikoraT accounts, but I couldn't say from behaviour whether Le laela is part of one of those groups. I've left this account unblocked given that technical evidence isn't enlightening.
I don't see anything to go on regarding White caterpillar (talk · contribs). Ivanvector (Talk/Edits) 14:15, 31 July 2017 (UTC)[reply]
Given that the case is sitting idle under the name of one of the only accounts listed here that's not confirmed, I'm taking it upon myself to close this now. I interpret the CU result for 1-555-confide as close enough to be confirmed given that they're blocked for behaviour already, and so I will move the Group 4 accounts to a new case under that name. All of the other accounts will be grouped together and moved to BurritoSlayer. Re-tagging in progress. Ivanvector (Talk/Edits) 19:01, 17 August 2017 (UTC)[reply]
All confirmed accounts  Blocked and tagged. Case closed. Ivanvector (Talk/Edits) 19:29, 17 August 2017 (UTC)[reply]

23 August 2017

Suspected sockpuppets

Biker1932 recreated Rajat Bhageria previously created by Mark Banter. The other accounts are all new and have arrived at Wikipedia:Articles for deletion/Rajat Bhageria (3rd nomination):[7] [8] [9]. SmartSE (talk) 09:54, 23 August 2017 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • Smartse, I've switched this to a CU request because the last case gave us 28 socks that didn't all overlap. As a non-admin, I can't see which account created the old version, but it would probably make it easier for the CUs if you listed it as well: there were a bunch of VPNs here and the sock family that was condensed to this SPI originally came up as three groups. Behaviorally, they share creating the talk page soon after creation and having minimumal userpagss for the most part, which was similar to the old farm. TonyBallioni (talk) 12:11, 23 August 2017 (UTC)[reply]
@TonyBallioni: Thanks for that I had meant to do that myself! And yep I've added Mark Banter now too. SmartSE (talk) 12:18, 23 August 2017 (UTC)[reply]
Thanks. Looking at the article history while some of the behavioral stuff is a bit less complex than previous socks from this group (initial creation wasn't perfect), it also fits in that you have multiple accounts working on the same article pretty quickly after creation and the talk page creation with comments. The change in initial creation also could be an attempt to get around some new tools that would have caught this. TonyBallioni (talk) 12:27, 23 August 2017 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

There is a webhost being used so I can't be sure on the connection to BurritoSlayer (or Mark Banter). Callanecc (talk • contribs • logs) 11:56, 24 August 2017 (UTC)[reply]

29 August 2017

Suspected sockpuppets

Both these accounts follow the BurritoSlayer model of perfect creations of articles in one attempt on articles that were previously G5ed as belonging to the BurritoSlayer family: Joel Asher at Khamis Al-Khanjar and Lowenboy at Ellington Management Group.

Lowenboy also shares overlap with:

The suspected original stale master of the BurritoSlayer family (never blocked, but speculated as such behaviorally in the first case). With Lowenboy's first edit being an article that Urban renewal had (rightfully) removed negative information from previously [10].

Behaviorally, I think they're pretty obvious DUCK blocks as being part of this ring, even if they are technically not confirmed to one another.

Given the scope of the previous cases, I'm asking for checkuser to compare the accounts against eachother, search for sleepers, and also see if there are similarities with the accounts in the archives. I know that this farm tend to use webhosts so it might be tough. Worth noting is that BurritoSlayer had three groups, with BurritoSlayer being the oldest overall. Both the articles Lowenboy and Joel Asher recreated were from the group where LedgerTom (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) was the oldest confirmed account, and I've added it above for ease of reference.TonyBallioni (talk) 21:29, 29 August 2017 (UTC)[reply]

I've also added Horserider1888 to this SPI: they recreated Justworks today, which was originally part of the Group 3 set of accounts in the original SPI. I can't see the original author from that group, because the page was deleted. All three of these accounts recreated BurritoSlayer linked articles on 29 August. TonyBallioni (talk) 22:20, 29 August 2017 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • Smartse, did you notice when doing the G5s if the recreations of these articles were substantially the same as the previously deleted versions? If they were, given the CU finding re: proxies and IP jumping, we probably have a DUCK case for meatpuppetry based on articles saved in Google Docs or something similar amongst a group of editors. TonyBallioni (talk) 13:45, 30 August 2017 (UTC)[reply]
Much of the text of the recreations of both Khamis Al-Khanjar and Ellington Management Group was identical to the deleted versions. Either its being copied from another online source, or these users are the same. Yunshui 雲水 13:50, 30 August 2017 (UTC)[reply]
@TonyBallioni: Yep I checked the previous versions and EMG as well as Justworks where both recreations so WP:PROXYING applies. The account that recreated Justworks has other suspect creations at Mulberrys Garment Care and Mark Gillespie (entertainment manager). SmartSE (talk) 15:25, 30 August 2017 (UTC)[reply]
Sigh. The Mark Gillespie (entertainment manager) title matches the pattern of marketing speak disambiguators such as W. Ben Hunt (investment strategist), which was one of the articles I originally discovered the BurritoSlayer family at (I think it was a LedgerTom creation or work). Behaviorally these are a near perfect match for a meatpuppetry ring. TonyBallioni (talk) 15:35, 30 August 2017 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

LedgerTom is already confirmed and blocked. The other accounts listed are technically Red X Unrelated, but there is a fair amount of IP hopping and proxy server use going on. Yunshui 雲水 11:27, 30 August 2017 (UTC)[reply]

 Blocked but awaiting tags - all others. Kudpung กุดผึ้ง (talk) 23:28, 31 August 2017 (UTC)[reply]

This case is being reviewed by Sro23 as part of the clerk training process. Please allow them to process the entire case without interference, and pose any questions or concerns either on their Talk page or on this page if more appropriate.

13 October 2017

Suspected sockpuppets

Mr Mike Wang created China Hongqiao Group, an article originally created by Chinabusiness (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), a BurritoSlayer sock. The article was claimed to be translated written on , which was also written by Chinabusiness. Requesting CU against accounts in the archive and also the group at Wikipedia:Sockpuppet investigations/Pleaschamp, which have been connected to the BurritoSlayer family by CU evidence. I'd also like to note that this might help with the behavioral evidence on that case. Not the similarities in declared interest between Gemchadur (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) [11] on their userpage created as their second edit and Mr Mike Wang's first edit [12]. Also note the similarities of edit summaries "create my Wiki page" and "create my page" TonyBallioni (talk) 05:18, 13 October 2017 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

@BU Rob13: are you able to tell if the proxies they're using are the same as the proxies that previous socks used? Ivanvector (Talk/Edits) 12:21, 13 October 2017 (UTC)[reply]
@Ivanvector: They are not, but that's not surprising. Proxies are a dime a dozen, and most sockmasters swap regularly as individual proxies stop being available or are blocked. You're going to have to go on behavior alone here. ~ Rob13Talk 12:24, 13 October 2017 (UTC)[reply]

08 January 2018

Suspected sockpuppets

Blocked by Alex Shih, behaviorally, but when I talked to him, he said he didn't run a sleeper check or check for other accounts. Recreation of Bruce Flatt. This account also matches the name of one of Mollybloomin one of the socks in Wikipedia:Sockpuppet investigations/1-555-confide/Archive, which further connects that UPE ring to the BS ring.

Requesting CU to look for additional accounts given how large the original sock family was. TonyBallioni (talk) 18:54, 8 January 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

26 July 2018

Suspected sockpuppets


I found evidence suggesting that Go Fish Digital (GFD), a marketing company offering Wikipedia services, is connected to some sockpuppet groups reported previously on this SPI.

In the light of this, the behavioral connection between some of them becomes much clearer if we focus on articles related to known GFD clients ([13], [14], [15], [16], [17]).

These articles, together with suspicous contributors, are:

Additionally, the following article is connected to GFD founders:

Group 3 seems clearly connected to GFD:

I suspect that the Dmrwikiprof is one of the master accounts of GFD. The link here is at the Attentiv article history. I have sent further evidence of this link to the functionaries-en@ mailing list, since it involves off-wiki research with real names.

Then, based on the edits on Attentiv and John P. McConnell (businessman), I suspect that KomodoD is also sockpuppet of Dmrwikiprof.

Additionally, the following accounts seem to be part of the BurritoSlayer group:

--MarioGom (talk) 20:31, 26 July 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Cougarsurf also edited the article Reza Jahangiri (edit | talk | history | protect | delete | links | watch | logs | views), which a American Advisors Group executive ([29]). This makes 3 coincidences with the BurritoSlayer group, all of them known GFD clients too. --MarioGom (talk) 19:25, 27 July 2018 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

All of the listed accounts are stale except Cougarsurf. The previous technical data in this case is very complicated and it's unlikely that all the accounts are operated by the same person. In the initial report in the archive filed on July 27, 2017, which is almost exactly one year ago and gives you an idea of the age of the technical data I'm using for comparison to this particular account, I broke down the accounts into four groups. Cougarsurf is  Likely to Group 3, which includes BurritoSlayer.--Bbb23 (talk) 21:15, 26 July 2018 (UTC)[reply]

02 August 2018

Suspected sockpuppets


Edits:

It also followed the same editing pattern as other sockpuppets in the same group: they start creating very short user page to avoid their name to stand out in red in history, then start doing a lot of minor and often irrelevant edits, usually on pop culture topics, and then they do just a few major contributions to articles that are likely GFD clients. MarioGom (talk) 13:54, 2 August 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

 Confirmed to Cougarsurf (talk · contribs · count).  Blocked and tagged. Closing.--Bbb23 (talk) 14:33, 2 August 2018 (UTC)[reply]


06 August 2018

Suspected sockpuppets


I think the account should be checked for relation with accounts reported in Wikipedia:Sockpuppet_investigations/Pleaschamp too. Since some of them seem to be related to Three Six Zero artists too. MarioGom (talk) 18:36, 6 August 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Bbb23: Isn't it possible to perform behavioral comparison? Relation is quite obvious and establishing it would help later cleanup (e.g. speedy deletion, reverts, as well as estabilishing data points for further sockpuppets). --MarioGom (talk) 19:55, 6 August 2018 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

Breeze897 is  Stale. Closing.--Bbb23 (talk) 19:47, 6 August 2018 (UTC)[reply]

@MarioGom: Not worth the time. If the user edits again, you can reopen.--Bbb23 (talk) 20:02, 6 August 2018 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/BurritoSlayer/Archive&oldid=854002192"