Wikipedia:Sockpuppet investigations/OnceaMetro/Archive

;Suspected sockpuppets

• {{checkuser|1=SimpleStitch}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=OnceaMetro User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

SimpleStitch appears to have taken over some of the financial industry articles formerly tended to by OnceaMetro. Refer to WP:COIN#Various hedge funds and their managers ([//en.wikipedia.org/w/index.php?title=Wikipedia:Conflict_of_interest/Noticeboard&diff=673550811&oldid=673548523 longer-lived link]) for details, here are representative diffs:

On Pine River Capital Management, OaM [//en.wikipedia.org/w/index.php?title=Pine_River_Capital_Management&diff=616151725&oldid=615829331 adds awards]; SS [//en.wikipedia.org/w/index.php?title=Pine_River_Capital_Management&diff=672274128&oldid=647155541 adds awards].

On JAT Capital Management, an article with all of 4 editors, OaM [//en.wikipedia.org/w/index.php?title=JAT_Capital_Management&oldid=650042832 creates article], SS [//en.wikipedia.org/w/index.php?title=JAT_Capital_Management&diff=661253964&oldid=659566174 maintains it].

{{ping|Vanjagenije}} Added following per your request. This table summarizes all these two editors' specific article crossovers (via editor interaction tool).

{{collapse top|title=Editor interaction analysis }}

{{collapse bottom}}

Findings:

1. There appears to be a pattern in many cases here of the master handing off cases to SimpleStitch. If the two weren't coordinated, if not the same person, this pattern would be extremely unlikely.
2. Behavioral evidence should be plain as both are nearly exclusively doing COI type work on Wall Street investment firms and fund managers.
3. Many times, suspiciously similar edit summaries in the same article, as noted. I haven't had time to examine all the edits more closely.
4. Suspiciously similar edit summaries in different articles, e.g.
5. [//en.wikipedia.org/w/index.php?title=Steve_Ballmer&diff=635383805&oldid=633765517 "credited source"] (SimpleStich) vs [//en.wikipedia.org/w/index.php?title=Micky_Arison&diff=630794843&oldid=623558440 "Fixed reference to credit source"] (OaM) and
6. [//en.wikipedia.org/w/index.php?title=JAT_Capital_Management&diff=prev&oldid=661253964 "have been creating on a page"] (SimpleStitch) vs [//en.wikipedia.org/w/index.php?title=Julian_Robertson&diff=648961386&oldid=648870164 "have been working on a page"] (OaM).
7. By my count, SimpleStitch has edited just 100 articles. 13 of them are in the table above, meaning he overlapped with the master 13% of the time.SimpleStitch has substantial numbers of overlaps with master. Again, statistically unlikely for two unconnected individuals.
8. By my count, OnceaMetro created 7 articles. Two of them were visted by SimpleStitch quickly after being created. Again, statistically unlikely for two strangers.

I will try to do more complete filings in future. Brianhe (talk) 03:05, 29 July 2015 (UTC)

Some more behavioral similarities. Both editors use similar idiosyncratic phrasing in edit summaries.

No one thing is utterly convincing but taken all together I can't imagine this not being the work of one person. - Brianhe (talk) 06:06, 29 July 2015 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I am in no way affiliated with OnceaMetro. I do not know this person or nor have I interacted with him in any way. — Preceding unsigned comment added by Jordansocial (talk • contribs) 00:18, 29 July 2015 (UTC)

:Hi Brianhe, I'm not familiar with the user but I obviously did edit pages that the suspect also did. My format and language I use I just derived from other editors, mostly cut and paste on those actual pages. I don't feel any of my contributions violated editing requirements. Thanks.--SimpleStitch (talk) 05:23, 31 July 2015 (UTC)

::Hi again Brianhe, per your message on my talk board, no I don't get paid for editing. I tried to go to the link you provided but I think it is archived or something like that. Either way, I don't know anybody in my personal life that actually edits on Wikipedia except my classmates from the one course I took that started us all editing. Again, I think my contributions have been factual. --SimpleStitch (talk) 17:33, 5 August 2015 (UTC)

;Relevant suspicions.

{{ping|Brianhe}}, {{ping|Vanjagenije}}: I have been following this. I think, and have for some time, that Simplestitch may be a sock of this bunch https://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/Sherlock4000/Archive. My evidence comes from Gustavo Ferraro.

One user and one IP active on the page were blocked in this SPI. Here are there edits:

• 98.166.157.157
• https://en.wikipedia.org/w/index.php?title=Gustavo_Ferraro&diff=636182326&oldid=636054926
• https://en.wikipedia.org/w/index.php?title=Gustavo_Ferraro&diff=636367863&oldid=636352534
• https://en.wikipedia.org/w/index.php?title=Gustavo_Ferraro&diff=636709816&oldid=636653722
• https://en.wikipedia.org/w/index.php?title=Gustavo_Ferraro&diff=637433088&oldid=637419930

• Sherlock4000
• https://en.wikipedia.org/w/index.php?title=Gustavo_Ferraro&diff=667103285&oldid=663697168

And here are some of Simplestitche's edits, removing the same content.

• https://en.wikipedia.org/w/index.php?title=Gustavo_Ferraro&diff=627554590&oldid=627554252
• https://en.wikipedia.org/w/index.php?title=Gustavo_Ferraro&diff=628215473&oldid=627554590
• https://en.wikipedia.org/w/index.php?title=Gustavo_Ferraro&diff=634854875&oldid=630546141
• https://en.wikipedia.org/w/index.php?title=Gustavo_Ferraro&diff=627554252&oldid=627504059

I have little doubt this account is just another sock for the larger group of them, since the behavioural evidence fits. DaltonCastle (talk) 23:17, 11 August 2015 (UTC)

::Nice try DaltonCastle, let's review what I posted about your attacks that I put on the Conflict of Interest Noticeboard on September 29, 2014

I have come across the entry for Gustavo Ferraro. The editor DaltonCastle has blatantly disregarded all the removed information and reasoning behind it. This editor has taken their crusade against anyone they perceives has a connection to Néstor Kirchner or Cristina Fernández de Kirchner and created entries that are set up solely to include a section filled with quotes and theories by editors of publications to attack. The list includes Carlos Zannini, Miguel Ángel Pires, Carlos Molinari, Enrique Omar Suárez, César Guido Forcieri, Juan Pablo Schiavi and Federico Elaskar. And those are just the new ones the editor created. This editor allegedly used LinkedIn to create the background before the accusations against Gustavo Ferraro but that source doesn't exist. I will request speedy deletion of this entry but wanted to note the obvious non-neutral and conflicted agenda of the editor that should be examined. Wikipedia is not meant to be a venting blog for theorists.--SimpleStitch (talk) 15:51, 29 September 2014 (UTC)

::No need to get so personal. If you are innocent then there is not harm done. DaltonCastle (talk) 22:01, 12 August 2015 (UTC)

• Vanjagenije take a look at DaltonCastle and what he has erased from his talk page and who himself has backed down to my accusations, after he accused me, let's get real. I'm a student at USC, come see me, if I was getting paid I wouldn't be on student loan. If you are truly a defender of Wikipedia and not a partsian shill you would examine DaltonCastle entries. And yes, if you are a neutral Wikipedia editor look at Gustavo Ferraro and the conjecture and soapbox and even the defamatory reasoning he justifies for the content and even Bobrayner, who said, in a threatning manner - I'm concerned that SimpleStitch has deliberately tagged stuff with {{citation needed}} - and then removed it entirely - despite knowing that it's supported by sources. That would be a very bad thing. Let's not repeat that, hmm? So let's open up real intent here. Will you ignore this?--SimpleStitch (talk) 04:20, 13 August 2015 (UTC)

• {{moreinfo}} - {{ping|Brianhe}} Your evidence is weak, indeed. Please, explain what the two edits at Paul Allen prove? They are not even similar. ALso, the two edits at Pine River Capital Management don't look like being related. Try to find some real evidence. Try to find diffs that show some kind of similarity between accounts. Vanjagenije (talk) 01:02, 29 July 2015 (UTC)
• {{clerknote}} {{noping|OnceaMetro}} is, unfortunately, {{StaleIP}}, so we can't run the CheckUser. In my opinion, the behavioral evidence is simply not strong enough to block him. I'm leaving this to somebody else to close because I'd like to hear second opinion. Vanjagenije (talk) 23:20, 1 August 2015 (UTC)
• {{Requestandendorse}} - to compare Simplestitche with Sherlock4000. Vanjagenije (talk) 23:31, 11 August 2015 (UTC)

• {{confirmed}}:

:{{checkuser|1=SimpleStitch}}

:{{checkuser|1=AbeFrohman1977}}

:{{checkuser|1=Ombase}}

:{{checkuser|1=JimJReynolds}}

:{{checkuser|1=Seyoda}}

:{{checkuser|1=TridentBrook}}

::However, these accounts seem very {{unlikely}} to be related to Sherlock4000. Any connection to OnceaMetro will need to be based upon behavioral evidence. Mike V • Talk 03:02, 17 August 2015 (UTC)

:::Tagged as socks of OnceaMetro based on behavior. Closing now. Vanjagenije (talk) 17:59, 31 August 2015 (UTC)

----

;Suspected sockpuppets

• {{checkuser|1=Qwert4321}}

• [http://tools.wmflabs.org/betacommand-dev/cgi-bin/uc?uc=OnceaMetro User compare report] Auto-generated every hour.
• [http://tools.wmflabs.org/sigma/editorinteract.py Editor interaction utility]

Think I found another. SimpleStitch, confirmed sockpuppet(eer) jumped in to RSE ventures section [//en.wikipedia.org/w/index.php?title=Stephen_M._Ross&type=revision&diff=654915751&oldid=654508706 here]. Qwert4321 is an RSE Ventures SPA who twiddled the section earlier [//en.wikipedia.org/w/index.php?title=Stephen_M._Ross&type=revision&diff=642651423&oldid=640606798 here] and has created a failed draft article Draft:RSE Ventures. Brianhe (talk) 18:07, 21 August 2015 (UTC) Brianhe (talk) 18:07, 21 August 2015 (UTC)

:{{ping|Vanjagenije}} Do I need to do something else here? I might have messed up the process by injecting a new user at the wrong time or in the wrong section. Brianhe (talk) 01:44, 27 August 2015 (UTC)

::{{ping|Vanjagenije}} Did I stall this SPI? — Brianhe (talk) 17:51, 31 August 2015 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{Clerknote}} I don't think this evidence is enough to block him. And, the CU check was performed this month, and Qwert4321 was not confirmed although he made some edits in June. So, I believe he is technically unrelated. I'm closing this now. Vanjagenije (talk) 18:02, 31 August 2015 (UTC)

----

• {{checkuser|1=BelBivDov|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=UConnSofB18|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=FrankTursetta|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=JAMillerKC|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=TerrellTrevon|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=Canyonpass|master name={{#titleparts:{{SUBPAGENAME}}}}}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&users={{urlencode:BelBivDov}}&users={{urlencode:UConnSofB18}}&users={{urlencode:FrankTursetta}}&users={{urlencode:JAMillerKC}}&users={{urlencode:TerrellTrevon}}&users={{urlencode:Canyonpass}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&user={{urlencode:BelBivDov}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

This group is a continuation of OnceaMetro and LedgerTom (see BurritoSlayer Group 1). For some initial background, here's an explanation of why I think LedgerTom is OnceaMetro:

{{cot|OnceaMetro and LedgerTom link}}

• The OnceaMetro SPI was filed on 2015-07-29. SimpleStitch tried to defend themselves until 2015-08-13. The sockfarm was blocked on 2015-08-17 (03:00 UTC).
• LedgerTom signed up on 2015-08-17 (15:08 UTC).
• Overlap between OnceaMetro and LedgerTom sockfarms (46 articles, mainspace and talkspace are conflated, not counting deleted revisions): Activision, Bill Ackman, Brookfield Asset Management, Cerberus Capital Management, Daniel Och, Davidson Kempner Capital Management, Eddie Lampert, Eric Mindich, First Manhattan Co., Galleon Group, Glenview Capital Management, Highfields Capital Management, Invesco, Jeffrey Vinik, John Thain, Kevin Kimberlin, Kirk Kerkorian, Larry Robbins, Leon Cooperman, Les Hinton, Lewis Eisenberg, List of Wharton School alumni, Lone Star Funds, Louis Reijtenbagh, Matthew Bucksbaum, Michael Dell, Michael Walrath, Peter A. Cohen, Philip Anschutz, Pine River Capital Management, Quantum Group of Funds, Robert D. Beyer, Ross Levinsohn, Roy Niederhoffer, Sanford I. Weill, Sheldon Adelson, Société Générale, Southeastern Asset Management, Stanley Druckenmiller, Steve Feinberg, TPG Capital, Thema International Fund, Tiger Management, Winklevoss Capital Management, Winton Group, Yan Huo
• Edit summary similarities:
• "updated and sourced" (OnceaMetro: OnceaMetro; LedgerTom: CharlesDeMint)
• "removed dead link" (OnceaMetro: OnceaMetro, SimpleStitch, Ombase; LedgerTom: WatchingContent)
• "added citation needed" (OnceaMetro: Seyoda, OnceaMetro, SimpleStitch, Ombase, AbeFrohman1977, TridentBrook, JimJReynolds; LedgerTom: CharlesDeMint)
• "[...] already in references" (OnceaMetro: Seyoda; LedgerTom: CharlesDeMint, LedgerTom)
• "[...], doesn't exist" (OnceaMetro: TridentBrook; LedgerTom: RedmondKane, CharlesDeMint)
• "[...] not external links" (OnceaMetro: OnceaMetro; LedgerTom: RedmondKane)
• Similar timecard, compare SimpleStitch and LedgerTom, for example.

{{cob}}

BelBivDov and UConnSofB18 are part of the original LedgerTom cohort created after the OnceaMetro blocks. After the LedgerTom blocks in 2017, editing patterns changed, and a new editing pattern was established for new socks, which are much better at segregating article overlap as well as editing styles. But not good enough, a strong editing pattern connect UConnSofB18, FrankTursetta, TerrellTrevon and Canyonpass.

Since this is a very experienced UPE operation (first account signed up in 2007), and they have demonstrated certain capacity to plan their edits ahead of time to avoid fingerprinting, I'm going to omit explicit explanations about current behavior. I'm listing below all behavioral evidence that is not significant for their present activity. Let me know if further information is needed.

{{cot|BelBivDov}}

; Before 2017 LedgerTom blocks

• Edit summary similarities:
• "this is a stub" (CharlesDeMint)
• "created a Talk page" (WatchingContent)
• "missing title" (Ombase, LedgerTom, CharlesDeMint, RedmondKane, WatchingContent)
• "added missing title" (Seyoda, BelBivDov)
• "removed, doesn't exist" (RedmondKane)
• "changed issue [...]" (WatchingContent, RedmondKane, CharlesDeMint, JAMillerKC)
• "[...] link rot [...]" (LedgerTom)
• "[...] Wikipedia entry [...]" (CharlesDeMint)
• "[...] no longer exists" (Seyoda, CharlesDeMint)
• "reference format" (Ombase)

; After 2017 LedgerTom blocks

• After 2017-07-21 the account went silent until 2017-11-24, possibly because of the 2017-07-27 block round.

{{cob}}

{{cot|UConnSofB18}}

; Before 2017 LedgerTom blocks

• No significant activity other than creating Archview Investment Group LP (and the associated talk page). It seems it went to sleep until May 2019.

; After 2017 LedgerTom blocks

• Edit summaries:
• "[..] line error" (referring to cite templates) (LedgerTom)
• Strong behavioral match: UConnSofB18, FrankTursetta, TerrellTrevon, Canyonpass. Details omitted.

{{cob}}

{{cot|FrankTursetta}}

• Edit summaries:
• "[...] added stub" (LedgerTom, BelBivDov, CharlesDeMint, WatchingContent, JAMillerKC)
• "removed, addressed" (JAMillerKC)
• Strong behavioral match: UConnSofB18, FrankTursetta, TerrellTrevon, Canyonpass. Details omitted.

{{cob}}

{{cot|JAMillerKC}}

• Edit summaries:
• "changed issue [...]" (BelBivDov, CharlesDeMint, RedmondKane, WatchingContent)
• "removed dead link" (Ombase, SimpleStitch, CharlesDeMint, BelBivDov, FrankTursetta)
• "added stub" (LedgerTom, CharlesDeMint, WatchingContent, BelBivDov, FrankTursetta)

{{cob}}

{{cot|TerrellTrevon}}

• Particularly close to FrankTursetta. Just username pattern and open contributions side by side, although contributions are carefully segregated and there is zero overlap.
• Strong behavioral match: UConnSofB18, FrankTursetta, TerrellTrevon, Canyonpass. Details omitted.

{{cob}}

{{cot|Canyonpass}}

• Strong behavioral match: UConnSofB18, FrankTursetta, TerrellTrevon, Canyonpass. Details omitted.

{{cob}}

There is also a quite consistent timecard for all socks, old and new. Article overlap is also pretty big.

CU may be ineffective for a sockmaster with this much experience (also last SPI mentioned VPNs), but I'm requesting it just in case. A sleeper check may be useful too. MarioGom (talk) 21:23, 8 April 2021 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{possilikely}}:
• :{{checkuser|UConnSofB18}}
• :{{checkuser|FrankTursetta}}
• :{{checkuser|JAMillerKC}}
• :{{checkuser|TerrellTrevon}}
• :{{checkuser|Canyonpass}}

:{{inconclusive}}:

::{{checkuser|BelBivDov}}

::{{checkuser|OnceaMetro}}

:~Oshwah~^{(talk) (contribs)} 06:29, 9 April 2021 (UTC)

• {{awaitingadmin}} - please block the lot, per filer and CU result, including BelBivDov{{snd}}the information in the filing is sufficiently convincing there. I can provide details about the present behavioural links on request if it isn't clear enough. --Blablubbs|talk 07:38, 18 May 2021 (UTC)
• Tagged and bagged. Closing. GeneralNotability (talk) 00:32, 19 May 2021 (UTC)

----

{{sock list|1=NorthBond|2=WondoMathias|tools_link=yes}}

Extensive overlap, see {{EIA|WondoMathias|OnceaMetro|Canyonpass|TerrellTrevon|JAMillerKC|SimpleStitch|FrankTursetta|RedmondKane|LedgerTom|Monstermike99|UConnSofB18|NorthBond}} and {{EIA|NorthBond|Canyonpass|Monstermike99|OnceaMetro|RedmondKane|LedgerTom|TerrellTrevon|CharlesDeMint|JAMillerKC|SimpleStitch|FrankTursetta|BelBivDov|WondoMathias}}, especially Davidson Kempner Capital Management. In the previous report I explained the change in style a few years ago. NorthBond and WondoMathias both used the older editing and edit summary style in the first years. NorthBond is particularly telling (e.g. {{diff2|695111216}}{{diff2|701681549}}, {{diff2|701300668}}{{diff2|706711914}}, {{diff2|703476782}}{{diff2|882715853}}) not only reusing the same edit summaries, but also doing it in relatively small time windows. WondoMathias also has some tells (e.g. {{diff2|713214108}}{{diff2|691694752}}{{diff2|742268901}}, {{diff2|778880284}}{{diff2|695416985}}{{diff2|675762742}}, {{diff2|719972353}}{{diff2|690627270}}{{diff2|785615306}}, {{diff2|899533949}}{{diff2|1017672718}}). NorthBond also uses the new style (e.g. {{diff2|903796036}}{{diff2|908567828}}). Both timecards are also a good match.{{pb}}Note for CU: Given the years of experience of this sockfarm, and previous CheckUser results, I don't expect CU to be effective. MarioGom (talk) 22:34, 9 May 2022 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• I find the evidence presented to be compelling. CU does not reveal any other accounts, but with so few recent edits I wouldn't really expect it to. Blocking as suspected, closing. Girth Summit _(blether) 14:46, 2 June 2022 (UTC)

----