Wikipedia:Sockpuppet investigations/BurritoSlayer/Archive

• {{checkuser|1=LedgerTom}}
• {{checkuser|1=RedmondKane}}
• {{checkuser|1=ContainerPat}}
• {{checkuser|1=RTICorbit}}
• {{checkuser|1=Barlowmichael32 }}
• {{checkuser|1=Feather3}}
• {{checkuser|1=DemoTent}}
• {{checkuser|1=Mollybloomin}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=Tomwsulcer User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

I don't file this report on a long-term user lightly, but unfortunately I believe this might be a case of using a sock farm for undeclared paid-editing by a user who has the autopatrolled permission. Most of the links here will be to user contributions limited to page creations rather than diffs, because it is easier to compare that way and it makes the point. There will be some diffs as well and I can provide more specifics if need be.

The first thing that connected me to this was the creation today of The Rise Fund by LedgerTom. I noticed that for a relatively inexperienced user that they created a page from scratch and knew to create the talk page instantly after. Poking around further in :Category:TPG Capital companies led me to Tomwulcler where I noticed the conncetion between the name and the claimed place of residence when I saw [https://en.wikipedia.org/w/index.php?title=Talk%3ATPG_Capital&type=revision&diff=718753922&oldid=562528947 this talk page post] about the ownership of the main company that reminded me of [https://en.wikipedia.org/w/index.php?title=Talk:Ronald_Burkle&diff=prev&oldid=790160063 a similar talk question] by LedgerTom. Further poking around at pages edited by Tomwucler and the suspected socks led me to what appears a sock farm with very similar name formats, userpages if they have them, and similar editing paterns and talk page styles.

All of the accounts show tendencies towards creating talk pages of companies or BLPs: [https://en.wikipedia.org/w/index.php?limit=50&title=Special%3AContributions&contribs=user&target=Tomwsulcer&namespace=1&tagfilter=&newOnly=1&start=&end= Tomwsulcer], [https://en.wikipedia.org/w/index.php?limit=50&title=Special%3AContributions&contribs=user&target=RedmondKane&namespace=&tagfilter=&newOnly=1&start=&end= RedmondKane], [https://en.wikipedia.org/w/index.php?limit=50&title=Special%3AContributions&contribs=user&target=RedmondKane&namespace=&tagfilter=&newOnly=1&start=&end= LedgerTom],

The tactic of creating a talk page instantly after creation of an article is one followed in all of [https://en.wikipedia.org/w/index.php?limit=50&title=Special%3AContributions&contribs=user&target=Tomwsulcer&namespace=&tagfilter=&newOnly=1&start=&end= Tomwsulcer's] recent page creations all follow that pattern as does: LedgarTom ( [https://en.wikipedia.org/w/index.php?title=The_Rise_Fund&oldid=792379645 ] [https://en.wikipedia.org/w/index.php?title=Talk:The_Rise_Fund&oldid=792379712] ), [https://en.wikipedia.org/w/index.php?limit=50&title=Special%3AContributions&contribs=user&target=RTICorbit&namespace=&tagfilter=&newOnly=1&start=&end= RTICorbit]

There is also a similarity in moving titles to more sophisticated sounding disambiguators: [https://en.wikipedia.org/w/index.php?title=W._Ben_Hunt_%28investment_strategist%29&type=revision&diff=771802673&oldid=771198030 LedgersTom] [https://en.wikipedia.org/w/index.php?title=Jonathan_Philip_Klein&type=revision&diff=720251246&oldid=720107633 Tomwsulcer]

There is also a tendency to attempt to either whitewash or remove content/advocate for deletion of articles that are not favourable, including the removal of maintenance tags: [https://en.wikipedia.org/w/index.php?title=Talk%3AMark_Nordlicht&type=revision&diff=773811273&oldid=761277082 LedgerTom], [https://en.wikipedia.org/w/index.php?title=Mark_Nordlicht&diff=prev&oldid=782844585 Barlowmichael32 removing negative content] from the same article as an SPA. The pattern of removing negative information is repeated by [https://en.wikipedia.org/w/index.php?title=Black_Eagle_Litigation_Fund&diff=prev&oldid=785358607 RedmondKane]. Additionally, both LedgerTom ([https://en.wikipedia.org/w/index.php?title=Talk:David_Ryan_(investor)&diff=prev&oldid=772885816],[https://en.wikipedia.org/w/index.php?title=Talk:Adam_Sender&diff=prev&oldid=772818405] ) and RedmondKane ([https://en.wikipedia.org/w/index.php?title=Talk:Stout_Risius_Ross&diff=prev&oldid=710229672], [https://en.wikipedia.org/w/index.php?title=Talk:Mesut_Darendeli&diff=prev&oldid=772490370] ) both post on talk pages of investors they don't find notable advocating against the article. My suspicion here is that it might be competition to their clients if it is a paid ring. The main account doesn't do this as much, but it is similar to him posting on the [https://en.wikipedia.org/wiki/Talk:Catalina_Garcia talk page] of a murder victim advocating for redirecting it or dabing it to a [https://en.wikipedia.org/w/index.php?title=Monsieur_Periné&oldid=766833834 a page he just created]. The style of that post from the what appears to be the main account matches the format of above.

Looking through the articles, I suspect there are other accounts, but those didn't have enough for me to feel that there could be a behavioral case made. I'm requesting CU mainly because I also suspect there are others that might be sleepers or that don't intersect. There could be a VPN being used on even the accounts listed that would make CU less useful if this is a paid editing socking issue, but I think there is enough behavioral evidence to make this a behavioral case if CU is not useful. TonyBallioni (talk) 23:51, 26 July 2017 (UTC)

• Note I've added Feather3 and DemoTent: both are SPAs that follow the same pattern ([https://en.wikipedia.org/wiki/Special:Contributions/Feather3 Feather3] [https://en.wikipedia.org/wiki/Special:Contributions/DemoTent DemoTent] of page creation and immediate talk page creation. I found both accounts after looking through the tool again and at the edit history of Salient Partners: created by DemoTent with the only other substantial edits to that page being by [https://en.wikipedia.org/w/index.php?title=Salient_Partners&diff=next&oldid=781111070 Feather3], [https://en.wikipedia.org/w/index.php?title=Salient_Partners&diff=next&oldid=771967389 ContainerPat], and [https://en.wikipedia.org/w/index.php?title=Salient_Partners&diff=next&oldid=771197397 RTICorbit] all linking to new articles they created. The last link showing a change of the name in the piping to avoid a redirect after LedgerTom's move of W. Ben Hunt (investment strategist) linked above. DemoTent is likely stale for CU, but I've included them in the list of socks since an article they created ties together three of the other accounts and is important behavioral evidence. TonyBallioni (talk) 14:05, 27 July 2017 (UTC)
• Yet another potential sock: [https://en.wikipedia.org/w/index.php?limit=50&title=Special%3AContributions&contribs=user&target=Mollybloomin&namespace=&tagfilter=&newOnly=1&start=&end= Mollybloomin], inexperienced user where the talk page is very similar in format to the others. This one has a more direct link to Tomwsulcer because he [https://en.wikipedia.org/w/index.php?title=Wikipedia%3AArticles_for_deletion%2FYoni_Assia&type=revision&diff=792011200&oldid=791817686 participated in the AfD] that saved the article. Sorry to Bbb23 for adding this as the check is still ongoing, but this one is another clear behavioral link to the suspected master. TonyBallioni (talk) 16:09, 27 July 2017 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Also, pinging {{replyto|Doc James|Kudpung}} since I reached out to both of them off-wiki when I saw the first article for advice, but before I found the potential socks. TonyBallioni (talk) 00:03, 27 July 2017 (UTC)
• {{u|GeneralizationsAreBad}}, thanks for your work on this. Just so you're aware I've posted about these accounts at COIN. TonyBallioni (talk) 20:47, 27 July 2017 (UTC)
• {{replyto|Bbb23|GeneralizationsAreBad}} were the following accounts checked/would these be good duck blocks: SPAs that only edit on Group 2 drafts
• {{checkuser|Docamat12}}
• {{checkuser|Le laela}}

:Thanks for both of your hard work. TonyBallioni (talk) 20:58, 27 July 2017 (UTC)

• Note: The following accounts were CU blocked by KrakatoaKatie after I raised concerns about them to her on IRC. She said if others were added to this SPI to make a note of it:
• {{checkuser|CrystalWarner}}
• {{checkuser|RussiaBusiness}}

:Behaviorally they intersected with Chinabusiness from group 1, but unsure of the technical details.

• {{u|GeneralizationsAreBad}} Doc James has raised concerns at COIN about the following account being liked to group 4, which I know you are working on:
• {{checkuser|Yinonk}}

:Thanks to all. TonyBallioni (talk) 03:00, 28 July 2017 (UTC)

• The following account was the only other editor on China Hongqiao Group, an article created by Chinabusiness, an account confirmed to Group 1. It also shows promotional activity on other articles:
• {{checkuser|Lele323}}

:Sorry for making this page such a mess. A lot of possible accounts are coming up in the cleanup. TonyBallioni (talk) 05:42, 28 July 2017 (UTC)

• Potential Group 1 connected proxy. Geolocate connects all to companies that Google says are proxy or VPN providers. They are the only other substantial contributors on Bruce Flatt, an article created by AnalyticCat:
• {{checkip|199.189.27.149}}
• {{checkip|199.189.27.123}}
• {{checkip|77.234.46.169}}
• {{checkip|192.154.137.87}}

:{{replyto|KrakatoaKatie|Bbb23}} pinging you to alert both of you of the potential group 1 connected proxies here. TonyBallioni (talk) 06:09, 28 July 2017 (UTC)

::These four IPs belong to Privax Ltd, who own HideMyAss.com, a proxy. All blocked now.Kudpung กุดผึ้ง (talk) 09:05, 28 July 2017 (UTC)

• {{u|GeneralizationsAreBad}}, you're aware of this, but I'm listing this here so it can be evaluated as part of the record behaviorally. Yesterday Kudpung noticed the following account had significant [https://tools.wmflabs.org/xtools/pages/index.php?user=Urbanrenewal&lang=en&wiki=wikipedia&namespace=0&redirects=noredirects article creations] that were edited by some socks in group one:
• {{checkuser|Urbanrenewal}}

:I ran a random sampling of the group one socks against it in the editor [http://tools.wmflabs.org/sigma/editorinteract.py?users=Urbanrenewal&users=Amber+Schruz&users=LedgerTom&users=RedmondKane&users=Chinabusiness&users=Mark+Banter&users=SaturnsRings27&users=Selimabner6&users=CharlesDeMint&users=AnalyticCat&users=Eringround&users=Escritor83&users=Hurburt1066&users=&users=&users=&users=&users=&users=&users=&startdate=&enddate=&ns=&server=enwiki interaction tool] and came up with over 40 pages that aligned from the group sampled. This is obviously stale for CU, but given the overlap, those creations might be a place to start as a behavioral investigation. TonyBallioni (talk) 17:02, 28 July 2017 (UTC)

• Comment from Tomwsulcer. Just came across this page. I am not a sockpuppet, never have been, never will be, have never have taken $$$ for editing, and never will.--Tomwsulcer (talk) 18:21, 17 August 2017 (UTC)

::{{clerknote}} Hi {{ul|Tomwsulcer}}, the section below is a mess so I'm commenting on this here. This case is filed under your name in error and will be moved, but it's taking some time to work out where it should be moved to. This page will be cleared once we figure that out. Ivanvector (^Talk/_Edits) 18:56, 17 August 2017 (UTC)

Cetainly a worrying amount of behavioural coincidence even if the stalk tool doesn't tell us much - which is to be accepted if all this is part of a cleverly conceived activity - the sock accounts would not want to be seen editing the same articles unless there was a momentary slip.Kudpung กุดผึ้ง (talk) 07:40, 27 July 2017 (UTC)

• Group 1 – the following accounts are {{confirmed}} to each other:
• {{checkuser|Amber Schruz}}
• {{checkuser|AnalyticCat}}
• {{checkuser|CharlesDeMint}}
• {{checkuser|Chinabusiness}}
• {{checkuser|ContainerPat}}
• {{checkuser|Drafeer}}
• {{checkuser|Eringround}}
• {{checkuser|Escritor83}}
• {{checkuser|Feather3}}
• {{checkuser|Hurburt1066}}
• {{checkuser|LedgerTom}}
• {{checkuser|Mark Banter}}
• {{checkuser|OGrowder}}
• {{checkuser|Paulgladders}}
• {{checkuser|RedmondKane}}
• {{checkuser|SaturnsRings27}}
• {{checkuser|Selimabner6}}
• {{checkuser|Soerehoere}}
• {{checkuser|WatchingContent}}
• {{checkuser|Yazdan Pathan}}
• Group 2 – the following accounts are {{confirmed}} to each other and {{possible}} to Group 1:
• {{checkuser|Clingerdango119}}
• {{checkuser|Selmatorah}}
• {{checkuser|Spacycower921}}
• {{checkuser|Wimpyjoseph98}}
• Group 3 – the following accounts are {{confirmed}} to each other and {{possible}} to Groups 1-2:
• {{checkuser|Apaixonar2}}
• {{checkuser|BlossomFlower}}
• {{checkuser|BurritoSlayer}}
• {{checkuser|Spyderthoughts}}
• Group 4 – the following accounts are {{confirmed}} to each other and {{unrelated}} to Groups 1-3:
• {{checkuser|Mollybloomin}}
• {{checkuser|Monetæ}}
• {{checkuser|SarahReborn}}
• {{checkuser|VikingGamer}}
• {{checkuser|1-555-confide}} is {{tallyho}} from the accounts in Group 4 but {{Behav}}.
• Tomwsulcer and Barlowmichael32 are {{unrelated}}. RTICorbit and DemoTent are {{IPstale}}. Blocked the accounts in Groups 1-4 without tags.--Bbb23 (talk) 17:29, 27 July 2017 (UTC)
• {{clerknote}} {{re|Bbb23}} I've emailed you regarding group 4 and 1-555-confide. GAB^gab 20:39, 27 July 2017 (UTC)

:*{{re|GeneralizationsAreBad}} Thanks. I've received it and will respond later.--Bbb23 (talk) 20:43, 27 July 2017 (UTC)

• {{clerknote}} {{re|TonyBallioni}} No problem. My investigation regarding Plarium is ongoing. GAB^gab 20:49, 27 July 2017 (UTC)
• {{relisted}} - Well, this is about to get real. Please check the following against group 2:
• {{checkuser|1=Docamat12}}
• {{checkuser|1=Le laela}}

And please check {{checkuser|1=White caterpillar}} against group 4. Thanks, GAB^gab 21:02, 27 July 2017 (UTC)

: {{yo|GeneralizationsAreBad}} Did you want a fresh look or do you want Bbb23 to look since he did the initial check? Katie^talk 21:08, 27 July 2017 (UTC)

::{{re|KrakatoaKatie}} If you are interested, I wouldn't object {{smiley}} GAB^gab 21:09, 27 July 2017 (UTC)

• {{Inprogress}} - Katie^talk 21:10, 27 July 2017 (UTC)
• {{Inprogress}} - Katie^talk 21:11, 27 July 2017 (UTC)
• White caterpillar appears {{unrelated}} to group 4.
• Le laela and Docamat12 are {{unrelated}} to each other and appear {{unrelated}} to group 2, but Docamat12 is {{possible}} to group 1. Katie^talk 21:41, 27 July 2017 (UTC)
• {{clerknote}} I've gotta fire up the Bat-Signal on this one. Pinging {{u|Ivanvector}} and {{u|Berean Hunter}}. I'd particularly appreciate hearing your thoughts regarding group 4 and 1-555-confide. Thanks very much, GAB^gab 16:51, 28 July 2017 (UTC)
• GAB, 1-555 is precisely the same person as the four confirmed socks in the group. For BEANS reasons, I don't want to make it too clear here but will email you if needed. It's also worth comparing [https://tools.wmflabs.org/guc/?user=Mollybloomin confirmed global contribs here] with the [https://tools.wmflabs.org/guc/?user=1-555-confide 1-555 global contribs] which help make it clearer. Some of these accounts may need global locks. I didn't look the whole case over just the isolated group 4 compared to 1-555.
   — Berean Hunter (talk) 15:06, 29 July 2017 (UTC)
• {{clerknote}} {{re|Berean Hunter}} What do you advise in regards to block duration for 1-555? Thanks again, GAB^gab 00:13, 31 July 2017 (UTC)

::Indeffing with a cu confirmed tag. Undisclosed COI socks...no reason to not indef. If they wish, they can file a block appeal and they would have to make a convincing case with well-founded understanding in policies. Right now, they are flagrantly violating policies.
 — Berean Hunter (talk) 00:31, 31 July 2017 (UTC)

• {{clerknote}} {{re|Berean Hunter}} {{Done}}, no tag, though. GAB^gab 00:36, 31 July 2017 (UTC)
• {{rtp}} I concur with Berean Hunter here: clearly the same person or group of meatpuppets as group 4, and should be globally locked for cross-wiki spam. I'm late to the party, but if Tomwsulcer is unrelated than many of these accounts have been tagged incorrectly, and the case needs to be moved. I haven't delved in deep enough to determine if the first three groups should be one case or separate cases, but the oldest confirmed accounts are:
• Group 1: {{checkuser|LedgerTom}}
• Group 2: {{checkuser|Spacycower921}}
• Group 3: {{checkuser|BurritoSlayer}}
• Group 4: {{checkuser|Mollybloomin}} (note that {{user|1-555-confide}} is older by many years, but not confirmed)

:Although, having reviewed this now I have no doubt the first three should all be treated as one group, and BurritoSlayer is the oldest of the three. I'm also quite certain now that {{user|Docamat12}} is behaviourally linked to Group 2, and I have blocked without tags.

:As for {{user|Le laela}}, the obscure draft they picked up as one of their first edits is a salted subject with a very long history of promotional editing. That article is attributed to Knoblauch129, and in the history I see obvious Wikipedia:Sockpuppet investigations/PlikoraT accounts, but I couldn't say from behaviour whether Le laela is part of one of those groups. I've left this account unblocked given that technical evidence isn't enlightening.

:I don't see anything to go on regarding {{user|White caterpillar}}. Ivanvector (^Talk/_Edits) 14:15, 31 July 2017 (UTC)

::Given that the case is sitting idle under the name of one of the only accounts listed here that's not confirmed, I'm taking it upon myself to close this now. I interpret the CU result for 1-555-confide as close enough to be confirmed given that they're blocked for behaviour already, and so I will move the Group 4 accounts to a new case under that name. All of the other accounts will be grouped together and moved to BurritoSlayer. Re-tagging in progress. Ivanvector (^Talk/_Edits) 19:01, 17 August 2017 (UTC)

:::All confirmed accounts {{bnt}}. Case closed. Ivanvector (^Talk/_Edits) 19:29, 17 August 2017 (UTC)

----

• {{checkuser|1=Mark Banter}} (already {{Confirmed}})
• {{checkuser|1=Biker1932}}
• {{checkuser|1=KindleReader}}
• {{checkuser|1=Applegeeks}}
• {{checkuser|1=GSF 323}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=BurritoSlayer User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Biker1932 recreated [https://en.wikipedia.org/w/index.php?title=Rajat_Bhageria&oldid=796586228 Rajat Bhageria] previously created by [https://en.wikipedia.org/w/index.php?title=Special:Undelete&target=Rajat+Bhageria×tamp=20170223095838 Mark Banter]. The other accounts are all new and have arrived at Wikipedia:Articles for deletion/Rajat Bhageria (3rd nomination):[https://en.wikipedia.org/w/index.php?title=Wikipedia:Articles_for_deletion/Rajat_Bhageria_(3rd_nomination)&diff=796758057&oldid=796732250] [https://en.wikipedia.org/w/index.php?title=Wikipedia:Articles_for_deletion/Rajat_Bhageria_(3rd_nomination)&diff=796600536&oldid=796596455] [https://en.wikipedia.org/w/index.php?title=Wikipedia:Articles_for_deletion/Rajat_Bhageria_(3rd_nomination)&diff=796763176&oldid=796760015]. SmartSE (talk) 09:54, 23 August 2017 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{u|Smartse}}, I've switched this to a CU request because the last case gave us 28 socks that didn't all overlap. As a non-admin, I can't see which account created the old version, but it would probably make it easier for the CUs if you listed it as well: there were a bunch of VPNs here and the sock family that was condensed to this SPI originally came up as three groups. Behaviorally, they share creating the talk page soon after creation and having minimumal userpagss for the most part, which was similar to the old farm. TonyBallioni (talk) 12:11, 23 August 2017 (UTC)

:{{re|TonyBallioni}} Thanks for that I had meant to do that myself! And yep I've added Mark Banter now too. SmartSE (talk) 12:18, 23 August 2017 (UTC)

::Thanks. Looking at the article history while some of the behavioral stuff is a bit less complex than previous socks from this group (initial creation wasn't perfect), it also fits in that you have multiple accounts working on the same article pretty quickly after creation and the talk page creation with comments. The change in initial creation also could be an attempt to get around some new tools that would have caught this. TonyBallioni (talk) 12:27, 23 August 2017 (UTC)

• Following are {{confirmed}} to each other:
• {{checkuser|KindleReader}}
• {{checkuser|Applegeeks}}
• {{checkuser|GSF 323}}
• {{checkuser|Biker1932}}
• {{checkuser|Skatekid9089}}

:There is a webhost being used so I can't be sure on the connection to BurritoSlayer (or Mark Banter). Callanecc (talk • contribs • logs) 11:56, 24 August 2017 (UTC)

----

• {{checkuser|1=Joel Asher}}
• {{checkuser|1=Lowenboy}}
• {{checkuser|1=Horserider1888}}
• {{checkuser|1=LedgerTom}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=BurritoSlayer User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Both these accounts follow the BurritoSlayer model of perfect creations of articles in one attempt on articles that were previously G5ed as belonging to the BurritoSlayer family: Joel Asher at Khamis Al-Khanjar and Lowenboy at Ellington Management Group.

Lowenboy also shares overlap with:

• {{checkuser|Urbanrenewal}}

The suspected original stale master of the BurritoSlayer family (never blocked, but speculated as such behaviorally in the first case). With Lowenboy's [https://en.wikipedia.org/w/index.php?title=AdultVest&diff=prev&oldid=797601235 first edit] being an article that Urban renewal had (rightfully) removed negative information from previously [https://en.wikipedia.org/w/index.php?title=AdultVest&type=revision&diff=321858966&oldid=321857832].

Behaviorally, I think they're pretty obvious DUCK blocks as being part of this ring, even if they are technically not confirmed to one another.

Given the scope of the previous cases, I'm asking for checkuser to compare the accounts against eachother, search for sleepers, and also see if there are similarities with the accounts in the archives. I know that this farm tend to use webhosts so it might be tough. Worth noting is that BurritoSlayer had three groups, with BurritoSlayer being the oldest overall. Both the articles Lowenboy and Joel Asher recreated were from the group where {{checkuser|LedgerTom}}

was the oldest confirmed account, and I've added it above for ease of reference.TonyBallioni (talk) 21:29, 29 August 2017 (UTC)

I've also added Horserider1888 to this SPI: they recreated Justworks today, which was originally part of the Group 3 set of accounts in the original SPI. I can't see the original author from that group, because the page was deleted. All three of these accounts recreated BurritoSlayer linked articles on 29 August. TonyBallioni (talk) 22:20, 29 August 2017 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{u|Smartse}}, did you notice when doing the G5s if the recreations of these articles were substantially the same as the previously deleted versions? If they were, given the CU finding re: proxies and IP jumping, we probably have a DUCK case for meatpuppetry based on articles saved in Google Docs or something similar amongst a group of editors. TonyBallioni (talk) 13:45, 30 August 2017 (UTC)

::Much of the text of the recreations of both Khamis Al-Khanjar and Ellington Management Group was identical to the deleted versions. Either its being copied from another online source, or these users are the same. Yunshui ^雲_水 13:50, 30 August 2017 (UTC)

:::{{re|TonyBallioni}} Yep I checked the previous versions and EMG as well as Justworks where both recreations so WP:PROXYING applies. The account that recreated Justworks has other suspect creations at Mulberrys Garment Care and Mark Gillespie (entertainment manager). SmartSE (talk) 15:25, 30 August 2017 (UTC)

::::Sigh. The Mark Gillespie (entertainment manager) title matches the pattern of marketing speak disambiguators such as W. Ben Hunt (investment strategist), which was one of the articles I originally discovered the BurritoSlayer family at (I think it was a LedgerTom creation or work). Behaviorally these are a near perfect match for a meatpuppetry ring. TonyBallioni (talk) 15:35, 30 August 2017 (UTC)

LedgerTom is already confirmed and blocked. The other accounts listed are technically {{Unrelated}}, but there is a fair amount of IP hopping and proxy server use going on. Yunshui ^雲_水 11:27, 30 August 2017 (UTC)

{{Sblock}} - all others. Kudpung กุดผึ้ง (talk) 23:28, 31 August 2017 (UTC)

{{User:Sro23/ClerkAtWork}}

• Tagged and closing. Sro23 (talk) 03:20, 1 September 2017 (UTC)

----

• {{checkuser|1=Mr Mike Wang}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=BurritoSlayer User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Mr Mike Wang created China Hongqiao Group, an article originally created by {{checkuser|Chinabusiness}}, a BurritoSlayer sock. The article was claimed to be translated written on de:China Hongqiao Group, which was also written by Chinabusiness. Requesting CU against accounts in the archive and also the group at Wikipedia:Sockpuppet investigations/Pleaschamp, which have been connected to the BurritoSlayer family by CU evidence. I'd also like to note that this might help with the behavioral evidence on that case. Not the similarities in declared interest between {{checkuser|Gemchadur}} [https://en.wikipedia.org/w/index.php?title=User:Gemchadur&oldid=792398896] on their userpage created as their second edit and Mr Mike Wang's first edit [https://en.wikipedia.org/w/index.php?title=User:Mr_Mike_Wang&oldid=803733121]. Also note the similarities of edit summaries "create my Wiki page" and "create my page" TonyBallioni (talk) 05:18, 13 October 2017 (UTC)

• Just noting that I have informed Ponyo and Smartse on the Pleaschamp case of this new BS sock. TonyBallioni (talk) 05:35, 13 October 2017 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{re|Ivanvector}} pinging {{re|Kudpung}} on this because he just left me a message about BurritoSlayer related activity by an IP on his talk page. TonyBallioni (talk) 13:58, 13 October 2017 (UTC)

• {{Inprogress}} - ~ Rob₁₃^Talk 12:09, 13 October 2017 (UTC)
• {{Inconclusive}}. They're editing from behind a proxy. ~ Rob₁₃^Talk 12:18, 13 October 2017 (UTC)

::{{yo|BU Rob13}} are you able to tell if the proxies they're using are the same as the proxies that previous socks used? Ivanvector (^Talk/_Edits) 12:21, 13 October 2017 (UTC)

:::{{re|Ivanvector}} They are not, but that's not surprising. Proxies are a dime a dozen, and most sockmasters swap regularly as individual proxies stop being available or are blocked. You're going to have to go on behavior alone here. ~ Rob₁₃^Talk 12:24, 13 October 2017 (UTC)

• {{yo|BU Rob13}}, did you check if IP 206.121.154.134 is a proxy? If it is I know what to do. Kudpung กุดผึ้ง (talk) 14:19, 13 October 2017 (UTC)
• {{re|Kudpung}} No comment on the IP with regard to my check, but it doesn't appear to be a proxy. ~ Rob₁₃^Talk 14:28, 13 October 2017 (UTC)
• There has been no action on this case for two months, so I'm closing it. --Deskana (talk) 22:35, 15 December 2017 (UTC)

----

• {{checkuser|1=Sunflowersblooming}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=BurritoSlayer User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Blocked by {{u|Alex Shih}}, behaviorally, but when I talked to him, he said he didn't run a sleeper check or check for other accounts. Recreation of Bruce Flatt. This account also matches the name of one of Mollybloomin one of the socks in Wikipedia:Sockpuppet investigations/1-555-confide/Archive, which further connects that UPE ring to the BS ring.

Requesting CU to look for additional accounts given how large the original sock family was. TonyBallioni (talk) 18:54, 8 January 2018 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{Endorse}} - To find other extant accounts. Thanks, GAB^gab 19:09, 8 January 2018 (UTC)
• I second the endorse. I took a quick look but it's too complicated for me. Alex Shih (talk) 19:29, 8 January 2018 (UTC)
• No other accounts seen. He's using three webhosts and one mail server. Closing.--Bbb23 (talk) 21:56, 8 January 2018 (UTC)

----

• {{checkuser|1=Dmrwikiprof}}
• {{checkuser|1=KomodoD}}
• {{checkuser|1=Cougarsurf}}
• {{checkuser|1=MattJasonBrown}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=BurritoSlayer User compare report] Auto-generated every hour.

I found evidence suggesting that Go Fish Digital (GFD), a marketing company offering Wikipedia services, is connected to some sockpuppet groups reported previously on this SPI.

In the light of this, the behavioral connection between some of them becomes much clearer if we focus on articles related to known GFD clients ([https://gofishdigital.com/about-us/], [https://gofishdigital.com/], [https://gofishdigital.com/case-study/clothing-retailer-doubles-website-traffic/], [https://gofishdigital.com/case-study/online-trading-academy-smart-investment-seo/], [https://members.nctech.org/list/member/go-fish-digital-7132]).

These articles, together with suspicous contributors, are:

• {{la|American Advisors Group}}
• {{la|Balsam Hill}}
• {{la|Bella Ella Boutique}}
• {{la|The Carlyle Group}}
• {{la|Custom Ink}}
• {{la|GEICO}}
• {{la|George Mason University}}
• {{la|Holland & Knight}}
• {{la|Hyatt}}
• {{la|Marriott International}}
• Michael & Son Services (no article)
• {{la|Monster Energy}}
• {{la|Moosejaw}}
• {{la|The New York Times}}
• Next Day Blinds (no article)
• {{la|Online Trading Academy}}
• {{la|Penn State Nittany Lions}}
• {{la|Snapfish}}
• {{la|SurveyMonkey}} (LinkedIn search)
• {{la|Symantec}}
• {{la|Toys "R" Us}}
• {{la|eToys.com}}

Additionally, the following article is connected to GFD founders:

• {{la|Attentiv}}

Group 3 seems clearly connected to GFD:

• BurritoSlayer: de-PROD'ed Attentiv ([https://en.wikipedia.org/w/index.php?title=Attentiv&diff=695246123&oldid=694625830&diffmode=source]), edited Toys "R" Us (e.g. [https://en.wikipedia.org/w/index.php?title=Toys_%22R%22_Us&diff=prev&oldid=791482775&diffmode=source]), contributed to Bella Ella Boutique
• Spyderthoughts: significant contributions to American Advisors Group (e.g. [https://en.wikipedia.org/w/index.php?title=American_Advisors_Group&diff=prev&oldid=787637872&diffmode=source], [https://en.wikipedia.org/w/index.php?title=American_Advisors_Group&diff=prev&oldid=786643833&diffmode=source]), contributed to Bella Ella Boutique
• Apaixonar2: edited eToys.com ([https://en.wikipedia.org/w/index.php?title=EToys.com&diff=prev&oldid=778372814&diffmode=source]), Monster Energy ([https://en.wikipedia.org/w/index.php?title=Monster_Energy&diff=prev&oldid=781854916&diffmode=source])
• Horserider1888: edited Monster Energy ([https://en.wikipedia.org/w/index.php?title=Monster_Energy&diff=prev&oldid=797192062&diffmode=source])

I suspect that the {{U|Dmrwikiprof}} is one of the master accounts of GFD. The link here is at the Attentiv article history. I have sent further evidence of this link to the functionaries-en@ mailing list, since it involves off-wiki research with real names.

Then, based on the edits on Attentiv and John P. McConnell (businessman), I suspect that {{U|KomodoD}} is also sockpuppet of Dmrwikiprof.

Additionally, the following accounts seem to be part of the BurritoSlayer group:

• {{U|MattJasonBrown}}: significant edits to Balsam Hills (quite rare article, [https://en.wikipedia.org/w/index.php?title=Balsam_Hill&diff=prev&oldid=686897771]), Balsam Hill promo on Artificial Christmas tree (https://en.wikipedia.org/w/index.php?title=Artificial_Christmas_tree&diff=prev&oldid=669716189&diffmode=source]), Toys "R" Us ([https://en.wikipedia.org/w/index.php?title=Toys_%22R%22_Us&diff=prev&oldid=607869284])
• {{U|Cougarsurf}}: edits on Toys "R" Us ([https://en.wikipedia.org/w/index.php?title=Toys_%22R%22_Us&diff=prev&oldid=817195517&diffmode=source]), Monster Energy ([https://en.wikipedia.org/w/index.php?title=Monster_Energy&diff=prev&oldid=801502626&diffmode=source])

--MarioGom (talk) 20:31, 26 July 2018 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Cougarsurf also edited the article {{la|Reza Jahangiri}}, which a American Advisors Group executive ([https://en.wikipedia.org/w/index.php?title=Reza_Jahangiri&diff=prev&oldid=838556020&diffmode=source]). This makes 3 coincidences with the BurritoSlayer group, all of them known GFD clients too. --MarioGom (talk) 19:25, 27 July 2018 (UTC)

All of the listed accounts are stale except Cougarsurf. The previous technical data in this case is very complicated and it's unlikely that all the accounts are operated by the same person. In the initial report in the archive filed on July 27, 2017, which is almost exactly one year ago and gives you an idea of the age of the technical data I'm using for comparison to this particular account, I broke down the accounts into four groups. Cougarsurf is {{likely}} to Group 3, which includes BurritoSlayer.--Bbb23 (talk) 21:15, 26 July 2018 (UTC)

• Based on the technical 'Likely' , the other evidence here, and the concerns expressed by {{U}Jytdog}} on the user's talk page, I recommend blocking this Cougarsurf account. Kudpung กุดผึ้ง (talk) 03:32, 29 July 2018 (UTC)
• Cougarsurf is {{bnt}}. Closing. TonyBallioni (talk) 18:05, 1 August 2018 (UTC)

----

• {{checkuser|1=Capricornthought}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=BurritoSlayer User compare report] Auto-generated every hour.

Edits:

• {{la|Nina Teicholz}}: suspected GFD client, also edited by {{U|Cougarsurf}} ([https://en.wikipedia.org/w/index.php?title=Nina_Teicholz&diff=845591834&oldid=845181508])
• {{la|Toys "R" Us}} ([https://en.wikipedia.org/w/index.php?title=Toys_%22R%22_Us&diff=prev&oldid=819476554&diffmode=source], [https://en.wikipedia.org/w/index.php?title=Toys_%22R%22_Us&diff=prev&oldid=815410229&diffmode=source], [https://en.wikipedia.org/w/index.php?title=Toys_%22R%22_Us&diff=prev&oldid=814246747&diffmode=source]), known GFD client, also edited by {{U|Cougarsurf}} and {{U|BurritoSlayer}}. Both Cougarsurf and Capricornthought interested specifically in Toys "R" Us philantropic activity ([https://en.wikipedia.org/w/index.php?title=Toys_%22R%22_Us&diff=prev&oldid=812572953&diffmode=source], [https://en.wikipedia.org/w/index.php?title=Toys_%22R%22_Us&diff=prev&oldid=815410229&diffmode=source])
• {{la|Lemony Snicket's A Series of Unfortunate Events}} ([https://en.wikipedia.org/w/index.php?title=Lemony_Snicket%27s_A_Series_of_Unfortunate_Events&diff=prev&oldid=838060160&diffmode=source], [https://en.wikipedia.org/w/index.php?title=Lemony_Snicket%27s_A_Series_of_Unfortunate_Events&diff=prev&oldid=838033528&diffmode=source]): does not really look like COI or promo, but it is suspicious that {{U|Cougarsurf}} also edited related article Daniel Handler

It also followed the same editing pattern as other sockpuppets in the same group: they start creating very short user page to avoid their name to stand out in red in history, then start doing a lot of minor and often irrelevant edits, usually on pop culture topics, and then they do just a few major contributions to articles that are likely GFD clients. MarioGom (talk) 13:54, 2 August 2018 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

{{confirmed}} to {{user2|Cougarsurf}}. {{bnt}}. Closing.--Bbb23 (talk) 14:33, 2 August 2018 (UTC)

----

• {{checkuser|1=Breeze897}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=BurritoSlayer User compare report] Auto-generated every hour.

• Created {{la|1776 (company)}}: confirmed Go Fish Digital (GFD) client ([https://gofishdigital.com/about-us/ see testimonials])
• Created {{la|Crescent Electric Supply Co.}}: suspected GFD client ([https://www.elitefixtures.com/blog/post/2683/bitcoin-mining-costs-by-country/ see parent company and author of Google Form])
• Shares {{la|Remy Ma}} and {{la|Firefly Music Festival}} with {{userlinks|Cougarsurf}}
• Created {{la|Mark Gillespie (entertainment manager)}}, which works for {{la|Three Six Zero}}. Articles by artists working with this firm were edited by various sockpuppets here:
• {{userlinks|BurritoSlayer}} did quite a few edits to Calvin Harris.
• {{userlinks|BlossomFlower}} edited Calvin Harris, Frank Ocean.
• {{userlinks|Horserider1888}} edited Deadmau5
• Edited {{la|National Endowment for Democracy}}, Cougarsurf edited the article of its president, {{la|Carl Gershman}}

I think the account should be checked for relation with accounts reported in Wikipedia:Sockpuppet_investigations/Pleaschamp too. Since some of them seem to be related to Three Six Zero artists too. MarioGom (talk) 18:36, 6 August 2018 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

:{{U|Bbb23}}: Isn't it possible to perform behavioral comparison? Relation is quite obvious and establishing it would help later cleanup (e.g. speedy deletion, reverts, as well as estabilishing data points for further sockpuppets). --MarioGom (talk) 19:55, 6 August 2018 (UTC)

Breeze897 is {{IPstale}}. Closing.--Bbb23 (talk) 19:47, 6 August 2018 (UTC)

:{{re|MarioGom}} Not worth the time. If the user edits again, you can reopen.--Bbb23 (talk) 20:02, 6 August 2018 (UTC)

----