Wikipedia:Sockpuppet investigations/BurritoSlayer/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

I don't file this report on a long-term user lightly, but unfortunately I believe this might be a case of using a sock farm for undeclared paid-editing by a user who has the autopatrolled permission. Most of the links here will be to user contributions limited to page creations rather than diffs, because it is easier to compare that way and it makes the point. There will be some diffs as well and I can provide more specifics if need be.

The first thing that connected me to this was the creation today of The Rise Fund by LedgerTom. I noticed that for a relatively inexperienced user that they created a page from scratch and knew to create the talk page instantly after. Poking around further in Category:TPG Capital companies led me to Tomwulcler where I noticed the conncetion between the name and the claimed place of residence when I saw this talk page post about the ownership of the main company that reminded me of a similar talk question by LedgerTom. Further poking around at pages edited by Tomwucler and the suspected socks led me to what appears a sock farm with very similar name formats, userpages if they have them, and similar editing paterns and talk page styles.

All of the accounts show tendencies towards creating talk pages of companies or BLPs: Tomwsulcer, RedmondKane, LedgerTom,

The tactic of creating a talk page instantly after creation of an article is one followed in all of Tomwsulcer's recent page creations all follow that pattern as does: LedgarTom, RTICorbit

There is also a similarity in moving titles to more sophisticated sounding disambiguators: LedgersTom Tomwsulcer

There is also a tendency to attempt to either whitewash or remove content/advocate for deletion of articles that are not favourable, including the removal of maintenance tags: LedgerTom, Barlowmichael32 removing negative content from the same article as an SPA. The pattern of removing negative information is repeated by RedmondKane. Additionally, both LedgerTom and RedmondKane  both post on talk pages of investors they don't find notable advocating against the article. My suspicion here is that it might be competition to their clients if it is a paid ring. The main account doesn't do this as much, but it is similar to him posting on the talk page of a murder victim advocating for redirecting it or dabing it to a a page he just created. The style of that post from the what appears to be the main account matches the format of above.

Looking through the articles, I suspect there are other accounts, but those didn't have enough for me to feel that there could be a behavioral case made. I'm requesting CU mainly because I also suspect there are others that might be sleepers or that don't intersect. There could be a VPN being used on even the accounts listed that would make CU less useful if this is a paid editing socking issue, but I think there is enough behavioral evidence to make this a behavioral case if CU is not useful. TonyBallioni (talk) 23:51, 26 July 2017 (UTC)
 * Note I've added Feather3 and DemoTent: both are SPAs that follow the same pattern (Feather3 DemoTent of page creation and immediate talk page creation. I found both accounts after looking through the tool again and at the edit history of Salient Partners: created by DemoTent with the only other substantial edits to that page being by Feather3, ContainerPat, and RTICorbit all linking to new articles they created. The last link showing a change of the name in the piping to avoid a redirect after LedgerTom's move of W. Ben Hunt (investment strategist) linked above. DemoTent is likely stale for CU, but I've included them in the list of socks since an article they created ties together three of the other accounts and is important behavioral evidence. TonyBallioni (talk) 14:05, 27 July 2017 (UTC)
 * Yet another potential sock: Mollybloomin, inexperienced user where the talk page is very similar in format to the others. This one has a more direct link to Tomwsulcer because he participated in the AfD that saved the article. Sorry to Bbb23 for adding this as the check is still ongoing, but this one is another clear behavioral link to the suspected master. TonyBallioni (talk) 16:09, 27 July 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Also, pinging since I reached out to both of them off-wiki when I saw the first article for advice, but before I found the potential socks. TonyBallioni (talk) 00:03, 27 July 2017 (UTC)
 * , thanks for your work on this. Just so you're aware I've posted about these accounts at COIN. TonyBallioni (talk) 20:47, 27 July 2017 (UTC)
 * were the following accounts checked/would these be good duck blocks: SPAs that only edit on Group 2 drafts
 * Thanks for both of your hard work. TonyBallioni (talk) 20:58, 27 July 2017 (UTC)
 * Thanks for both of your hard work. TonyBallioni (talk) 20:58, 27 July 2017 (UTC)
 * Thanks for both of your hard work. TonyBallioni (talk) 20:58, 27 July 2017 (UTC)


 * Note: The following accounts were CU blocked by KrakatoaKatie after I raised concerns about them to her on IRC. She said if others were added to this SPI to make a note of it:
 * Behaviorally they intersected with Chinabusiness from group 1, but unsure of the technical details.
 * Behaviorally they intersected with Chinabusiness from group 1, but unsure of the technical details.
 * Behaviorally they intersected with Chinabusiness from group 1, but unsure of the technical details.


 * Doc James has raised concerns at COIN about the following account being liked to group 4, which I know you are working on:
 * Thanks to all. TonyBallioni (talk) 03:00, 28 July 2017 (UTC)
 * Thanks to all. TonyBallioni (talk) 03:00, 28 July 2017 (UTC)


 * The following account was the only other editor on China Hongqiao Group, an article created by Chinabusiness, an account confirmed to Group 1. It also shows promotional activity on other articles:
 * Sorry for making this page such a mess. A lot of possible accounts are coming up in the cleanup. TonyBallioni (talk) 05:42, 28 July 2017 (UTC)
 * Sorry for making this page such a mess. A lot of possible accounts are coming up in the cleanup. TonyBallioni (talk) 05:42, 28 July 2017 (UTC)


 * Potential Group 1 connected proxy. Geolocate connects all to companies that Google says are proxy or VPN providers. They are the only other substantial contributors on Bruce Flatt, an article created by AnalyticCat:
 * pinging you to alert both of you of the potential group 1 connected proxies here. TonyBallioni (talk) 06:09, 28 July 2017 (UTC)
 * These four IPs belong to Privax Ltd, who own HideMyAss.com, a proxy. All blocked now.Kudpung กุดผึ้ง (talk) 09:05, 28 July 2017 (UTC)
 * pinging you to alert both of you of the potential group 1 connected proxies here. TonyBallioni (talk) 06:09, 28 July 2017 (UTC)
 * These four IPs belong to Privax Ltd, who own HideMyAss.com, a proxy. All blocked now.Kudpung กุดผึ้ง (talk) 09:05, 28 July 2017 (UTC)
 * pinging you to alert both of you of the potential group 1 connected proxies here. TonyBallioni (talk) 06:09, 28 July 2017 (UTC)
 * These four IPs belong to Privax Ltd, who own HideMyAss.com, a proxy. All blocked now.Kudpung กุดผึ้ง (talk) 09:05, 28 July 2017 (UTC)


 * , you're aware of this, but I'm listing this here so it can be evaluated as part of the record behaviorally. Yesterday Kudpung noticed the following account had significant article creations that were edited by some socks in group one:
 * I ran a random sampling of the group one socks against it in the editor interaction tool and came up with over 40 pages that aligned from the group sampled. This is obviously stale for CU, but given the overlap, those creations might be a place to start as a behavioral investigation. TonyBallioni (talk) 17:02, 28 July 2017 (UTC)
 * I ran a random sampling of the group one socks against it in the editor interaction tool and came up with over 40 pages that aligned from the group sampled. This is obviously stale for CU, but given the overlap, those creations might be a place to start as a behavioral investigation. TonyBallioni (talk) 17:02, 28 July 2017 (UTC)


 * Comment from Tomwsulcer. Just came across this page. I am not a sockpuppet, never have been, never will be, have never have taken $$$ for editing, and never will.--Tomwsulcer (talk) 18:21, 17 August 2017 (UTC)
 * Hi, the section below is a mess so I'm commenting on this here. This case is filed under your name in error and will be moved, but it's taking some time to work out where it should be moved to. This page will be cleared once we figure that out. Ivanvector (Talk/Edits) 18:56, 17 August 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Cetainly a worrying amount of behavioural coincidence even if the stalk tool doesn't tell us much - which is to be accepted if all this is part of a cleverly conceived activity - the sock accounts would not want to be seen editing the same articles unless there was a momentary slip.Kudpung กุดผึ้ง (talk) 07:40, 27 July 2017 (UTC)
 * Group 1 – the following accounts are ✅ to each other:
 * Group 2 – the following accounts are ✅ to each other and to Group 1:
 * Group 3 – the following accounts are ✅ to each other and to Groups 1-2:
 * Group 4 – the following accounts are ✅ to each other and ❌ to Groups 1-3:
 * is ✅ from the accounts in Group 4 but.
 * Tomwsulcer and Barlowmichael32 are ❌. RTICorbit and DemoTent are . Blocked the accounts in Groups 1-4 without tags.--Bbb23 (talk) 17:29, 27 July 2017 (UTC)
 * I've emailed you regarding group 4 and 1-555-confide. GABgab 20:39, 27 July 2017 (UTC)
 * Thanks. I've received it and will respond later.--Bbb23 (talk) 20:43, 27 July 2017 (UTC)
 * Group 2 – the following accounts are ✅ to each other and to Group 1:
 * Group 3 – the following accounts are ✅ to each other and to Groups 1-2:
 * Group 4 – the following accounts are ✅ to each other and ❌ to Groups 1-3:
 * is ✅ from the accounts in Group 4 but.
 * Tomwsulcer and Barlowmichael32 are ❌. RTICorbit and DemoTent are . Blocked the accounts in Groups 1-4 without tags.--Bbb23 (talk) 17:29, 27 July 2017 (UTC)
 * I've emailed you regarding group 4 and 1-555-confide. GABgab 20:39, 27 July 2017 (UTC)
 * Thanks. I've received it and will respond later.--Bbb23 (talk) 20:43, 27 July 2017 (UTC)
 * Group 2 – the following accounts are ✅ to each other and to Group 1:
 * Group 3 – the following accounts are ✅ to each other and to Groups 1-2:
 * Group 4 – the following accounts are ✅ to each other and ❌ to Groups 1-3:
 * is ✅ from the accounts in Group 4 but.
 * Tomwsulcer and Barlowmichael32 are ❌. RTICorbit and DemoTent are . Blocked the accounts in Groups 1-4 without tags.--Bbb23 (talk) 17:29, 27 July 2017 (UTC)
 * I've emailed you regarding group 4 and 1-555-confide. GABgab 20:39, 27 July 2017 (UTC)
 * Thanks. I've received it and will respond later.--Bbb23 (talk) 20:43, 27 July 2017 (UTC)
 * Group 3 – the following accounts are ✅ to each other and to Groups 1-2:
 * Group 4 – the following accounts are ✅ to each other and ❌ to Groups 1-3:
 * is ✅ from the accounts in Group 4 but.
 * Tomwsulcer and Barlowmichael32 are ❌. RTICorbit and DemoTent are . Blocked the accounts in Groups 1-4 without tags.--Bbb23 (talk) 17:29, 27 July 2017 (UTC)
 * I've emailed you regarding group 4 and 1-555-confide. GABgab 20:39, 27 July 2017 (UTC)
 * Thanks. I've received it and will respond later.--Bbb23 (talk) 20:43, 27 July 2017 (UTC)
 * Group 4 – the following accounts are ✅ to each other and ❌ to Groups 1-3:
 * is ✅ from the accounts in Group 4 but.
 * Tomwsulcer and Barlowmichael32 are ❌. RTICorbit and DemoTent are . Blocked the accounts in Groups 1-4 without tags.--Bbb23 (talk) 17:29, 27 July 2017 (UTC)
 * I've emailed you regarding group 4 and 1-555-confide. GABgab 20:39, 27 July 2017 (UTC)
 * Thanks. I've received it and will respond later.--Bbb23 (talk) 20:43, 27 July 2017 (UTC)
 * is ✅ from the accounts in Group 4 but.
 * Tomwsulcer and Barlowmichael32 are ❌. RTICorbit and DemoTent are . Blocked the accounts in Groups 1-4 without tags.--Bbb23 (talk) 17:29, 27 July 2017 (UTC)
 * I've emailed you regarding group 4 and 1-555-confide. GABgab 20:39, 27 July 2017 (UTC)
 * Thanks. I've received it and will respond later.--Bbb23 (talk) 20:43, 27 July 2017 (UTC)
 * Tomwsulcer and Barlowmichael32 are ❌. RTICorbit and DemoTent are . Blocked the accounts in Groups 1-4 without tags.--Bbb23 (talk) 17:29, 27 July 2017 (UTC)
 * I've emailed you regarding group 4 and 1-555-confide. GABgab 20:39, 27 July 2017 (UTC)
 * Thanks. I've received it and will respond later.--Bbb23 (talk) 20:43, 27 July 2017 (UTC)


 * No problem. My investigation regarding Plarium is ongoing. GABgab 20:49, 27 July 2017 (UTC)
 * - Well, this is about to get real. Please check the following against group 2:

And please check against group 4. Thanks, GABgab 21:02, 27 July 2017 (UTC)
 * Did you want a fresh look or do you want Bbb23 to look since he did the initial check? Katietalk 21:08, 27 July 2017 (UTC)
 * If you are interested, I wouldn't object GABgab 21:09, 27 July 2017 (UTC)

— Berean Hunter   (talk)  15:06, 29 July 2017 (UTC) — Berean Hunter   (talk)  00:31, 31 July 2017 (UTC)
 * - Katietalk 21:10, 27 July 2017 (UTC)
 * - Katietalk 21:11, 27 July 2017 (UTC)
 * White caterpillar appears ❌ to group 4.
 * Le laela and Docamat12 are ❌ to each other and appear ❌ to group 2, but Docamat12 is to group 1. Katietalk 21:41, 27 July 2017 (UTC)
 * I've gotta fire up the Bat-Signal on this one. Pinging and . I'd particularly appreciate hearing your thoughts regarding group 4 and 1-555-confide. Thanks very much,  GABgab 16:51, 28 July 2017 (UTC)
 * GAB, 1-555 is precisely the same person as the four confirmed socks in the group. For BEANS reasons, I don't want to make it too clear here but will email you if needed. It's also worth comparing confirmed global contribs here with the 1-555 global contribs which help make it clearer. Some of these accounts may need global locks. I didn't look the whole case over just the isolated group 4 compared to 1-555.
 * What do you advise in regards to block duration for 1-555? Thanks again, GABgab 00:13, 31 July 2017 (UTC)
 * Indeffing with a cu confirmed tag. Undisclosed COI socks...no reason to not indef. If they wish, they can file a block appeal and they would have to make a convincing case with well-founded understanding in policies. Right now, they are flagrantly violating policies.


 * ✅, no tag, though. GABgab 00:36, 31 July 2017 (UTC)
 * I concur with Berean Hunter here: clearly the same person or group of meatpuppets as group 4, and should be globally locked for cross-wiki spam. I'm late to the party, but if Tomwsulcer is unrelated than many of these accounts have been tagged incorrectly, and the case needs to be moved. I haven't delved in deep enough to determine if the first three groups should be one case or separate cases, but the oldest confirmed accounts are:
 * Group 1:
 * Group 2:
 * Group 3:
 * Group 4: (note that  is older by many years, but not confirmed)
 * Although, having reviewed this now I have no doubt the first three should all be treated as one group, and BurritoSlayer is the oldest of the three. I'm also quite certain now that is behaviourally linked to Group 2, and I have blocked without tags.
 * As for, the obscure draft they picked up as one of their first edits is a salted subject with a very long history of promotional editing. That article is attributed to Knoblauch129, and in the history I see obvious Sockpuppet investigations/PlikoraT accounts, but I couldn't say from behaviour whether Le laela is part of one of those groups. I've left this account unblocked given that technical evidence isn't enlightening.
 * I don't see anything to go on regarding . Ivanvector (Talk/Edits) 14:15, 31 July 2017 (UTC)
 * Given that the case is sitting idle under the name of one of the only accounts listed here that's not confirmed, I'm taking it upon myself to close this now. I interpret the CU result for 1-555-confide as close enough to be confirmed given that they're blocked for behaviour already, and so I will move the Group 4 accounts to a new case under that name. All of the other accounts will be grouped together and moved to BurritoSlayer. Re-tagging in progress. Ivanvector (Talk/Edits) 19:01, 17 August 2017 (UTC)
 * All confirmed accounts . Case closed. Ivanvector (Talk/Edits) 19:29, 17 August 2017 (UTC)

Suspected sockpuppets

 * (already ✅)


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Biker1932 recreated Rajat Bhageria previously created by Mark Banter. The other accounts are all new and have arrived at Articles for deletion/Rajat Bhageria (3rd nomination):. SmartSE (talk) 09:54, 23 August 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * , I've switched this to a CU request because the last case gave us 28 socks that didn't all overlap. As a non-admin, I can't see which account created the old version, but it would probably make it easier for the CUs if you listed it as well: there were a bunch of VPNs here and the sock family that was condensed to this SPI originally came up as three groups. Behaviorally, they share creating the talk page soon after creation and having minimumal userpagss for the most part, which was similar to the old farm. TonyBallioni (talk) 12:11, 23 August 2017 (UTC)
 * Thanks for that I had meant to do that myself! And yep I've added Mark Banter now too. SmartSE (talk) 12:18, 23 August 2017 (UTC)
 * Thanks. Looking at the article history while some of the behavioral stuff is a bit less complex than previous socks from this group (initial creation wasn't perfect), it also fits in that you have multiple accounts working on the same article pretty quickly after creation and the talk page creation with comments. The change in initial creation also could be an attempt to get around some new tools that would have caught this. TonyBallioni (talk) 12:27, 23 August 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Following are ✅ to each other:
 * There is a webhost being used so I can't be sure on the connection to BurritoSlayer (or Mark Banter). Callanecc (talk • contribs • logs) 11:56, 24 August 2017 (UTC)
 * There is a webhost being used so I can't be sure on the connection to BurritoSlayer (or Mark Banter). Callanecc (talk • contribs • logs) 11:56, 24 August 2017 (UTC)
 * There is a webhost being used so I can't be sure on the connection to BurritoSlayer (or Mark Banter). Callanecc (talk • contribs • logs) 11:56, 24 August 2017 (UTC)
 * There is a webhost being used so I can't be sure on the connection to BurritoSlayer (or Mark Banter). Callanecc (talk • contribs • logs) 11:56, 24 August 2017 (UTC)
 * There is a webhost being used so I can't be sure on the connection to BurritoSlayer (or Mark Banter). Callanecc (talk • contribs • logs) 11:56, 24 August 2017 (UTC)
 * There is a webhost being used so I can't be sure on the connection to BurritoSlayer (or Mark Banter). Callanecc (talk • contribs • logs) 11:56, 24 August 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Both these accounts follow the BurritoSlayer model of perfect creations of articles in one attempt on articles that were previously G5ed as belonging to the BurritoSlayer family: Joel Asher at Khamis Al-Khanjar and Lowenboy at Ellington Management Group.

Lowenboy also shares overlap with: The suspected original stale master of the BurritoSlayer family (never blocked, but speculated as such behaviorally in the first case). With Lowenboy's first edit being an article that Urban renewal had (rightfully) removed negative information from previously.

Behaviorally, I think they're pretty obvious DUCK blocks as being part of this ring, even if they are technically not confirmed to one another.

Given the scope of the previous cases, I'm asking for checkuser to compare the accounts against eachother, search for sleepers, and also see if there are similarities with the accounts in the archives. I know that this farm tend to use webhosts so it might be tough. Worth noting is that BurritoSlayer had three groups, with BurritoSlayer being the oldest overall. Both the articles Lowenboy and Joel Asher recreated were from the group where was the oldest confirmed account, and I've added it above for ease of reference.TonyBallioni (talk) 21:29, 29 August 2017 (UTC)

I've also added Horserider1888 to this SPI: they recreated Justworks today, which was originally part of the Group 3 set of accounts in the original SPI. I can't see the original author from that group, because the page was deleted. All three of these accounts recreated BurritoSlayer linked articles on 29 August. TonyBallioni (talk) 22:20, 29 August 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * , did you notice when doing the G5s if the recreations of these articles were substantially the same as the previously deleted versions? If they were, given the CU finding re: proxies and IP jumping, we probably have a DUCK case for meatpuppetry based on articles saved in Google Docs or something similar amongst a group of editors. TonyBallioni (talk) 13:45, 30 August 2017 (UTC)
 * Much of the text of the recreations of both Khamis Al-Khanjar and Ellington Management Group was identical to the deleted versions. Either its being copied from another online source, or these users are the same. Yunshui 雲 水 13:50, 30 August 2017 (UTC)
 * Yep I checked the previous versions and EMG as well as Justworks where both recreations so WP:PROXYING applies. The account that recreated Justworks has other suspect creations at Mulberrys Garment Care and Mark Gillespie (entertainment manager). SmartSE (talk) 15:25, 30 August 2017 (UTC)
 * Sigh. The Mark Gillespie (entertainment manager) title matches the pattern of marketing speak disambiguators such as W. Ben Hunt (investment strategist), which was one of the articles I originally discovered the BurritoSlayer family at (I think it was a LedgerTom creation or work). Behaviorally these are a near perfect match for a meatpuppetry ring. TonyBallioni (talk) 15:35, 30 August 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
LedgerTom is already confirmed and blocked. The other accounts listed are technically ❌, but there is a fair amount of IP hopping and proxy server use going on. Yunshui 雲 水 11:27, 30 August 2017 (UTC)

- all others. Kudpung กุดผึ้ง (talk) 23:28, 31 August 2017 (UTC)


 * Tagged and closing. Sro23 (talk) 03:20, 1 September 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Mr Mike Wang created China Hongqiao Group, an article originally created by, a BurritoSlayer sock. The article was claimed to be translated written on China Hongqiao Group, which was also written by Chinabusiness. Requesting CU against accounts in the archive and also the group at Sockpuppet investigations/Pleaschamp, which have been connected to the BurritoSlayer family by CU evidence. I'd also like to note that this might help with the behavioral evidence on that case. Not the similarities in declared interest between  on their userpage created as their second edit and Mr Mike Wang's first edit. Also note the similarities of edit summaries "create my Wiki page" and "create my page" TonyBallioni (talk) 05:18, 13 October 2017 (UTC)
 * Just noting that I have informed Ponyo and Smartse on the Pleaschamp case of this new BS sock. TonyBallioni (talk) 05:35, 13 October 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * pinging on this because he just left me a message about BurritoSlayer related activity by an IP on his talk page. TonyBallioni (talk) 13:58, 13 October 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - ~ Rob 13 Talk 12:09, 13 October 2017 (UTC)
 * . They're editing from behind a proxy. ~ Rob 13 Talk 12:18, 13 October 2017 (UTC)
 * are you able to tell if the proxies they're using are the same as the proxies that previous socks used? Ivanvector (Talk/Edits) 12:21, 13 October 2017 (UTC)
 * They are not, but that's not surprising. Proxies are a dime a dozen, and most sockmasters swap regularly as individual proxies stop being available or are blocked. You're going to have to go on behavior alone here. ~ Rob 13 Talk 12:24, 13 October 2017 (UTC)


 * , did you check if IP 206.121.154.134 is a proxy? If it is I know what to do. Kudpung กุดผึ้ง (talk) 14:19, 13 October 2017 (UTC)
 * No comment on the IP with regard to my check, but it doesn't appear to be a proxy. ~ Rob 13 Talk 14:28, 13 October 2017 (UTC)
 * There has been no action on this case for two months, so I'm closing it. --Deskana (talk) 22:35, 15 December 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Blocked by, behaviorally, but when I talked to him, he said he didn't run a sleeper check or check for other accounts. Recreation of Bruce Flatt. This account also matches the name of one of Mollybloomin one of the socks in Sockpuppet investigations/1-555-confide/Archive, which further connects that UPE ring to the BS ring.

Requesting CU to look for additional accounts given how large the original sock family was. TonyBallioni (talk) 18:54, 8 January 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - To find other extant accounts. Thanks, GABgab 19:09, 8 January 2018 (UTC)
 * I second the endorse. I took a quick look but it's too complicated for me. Alex Shih (talk) 19:29, 8 January 2018 (UTC)
 * No other accounts seen. He's using three webhosts and one mail server. Closing.--Bbb23 (talk) 21:56, 8 January 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

I found evidence suggesting that Go Fish Digital (GFD), a marketing company offering Wikipedia services, is connected to some sockpuppet groups reported previously on this SPI.

In the light of this, the behavioral connection between some of them becomes much clearer if we focus on articles related to known GFD clients.

These articles, together with suspicous contributors, are:


 * Michael & Son Services (no article)
 * Next Day Blinds (no article)
 * (LinkedIn search)
 * Michael & Son Services (no article)
 * Next Day Blinds (no article)
 * (LinkedIn search)
 * Michael & Son Services (no article)
 * Next Day Blinds (no article)
 * (LinkedIn search)
 * Michael & Son Services (no article)
 * Next Day Blinds (no article)
 * (LinkedIn search)
 * Next Day Blinds (no article)
 * (LinkedIn search)
 * Next Day Blinds (no article)
 * (LinkedIn search)
 * (LinkedIn search)
 * (LinkedIn search)
 * (LinkedIn search)

Additionally, the following article is connected to GFD founders:

Group 3 seems clearly connected to GFD:
 * BurritoSlayer: de-PROD'ed Attentiv, edited Toys "R" Us (e.g. ), contributed to Bella Ella Boutique
 * Spyderthoughts: significant contributions to American Advisors Group (e.g., ), contributed to Bella Ella Boutique
 * Apaixonar2: edited eToys.com, Monster Energy
 * Horserider1888: edited Monster Energy

I suspect that the is one of the master accounts of GFD. The link here is at the Attentiv article history. I have sent further evidence of this link to the functionaries-en@ mailing list, since it involves off-wiki research with real names.

Then, based on the edits on Attentiv and John P. McConnell (businessman), I suspect that is also sockpuppet of Dmrwikiprof.

Additionally, the following accounts seem to be part of the BurritoSlayer group:
 * : significant edits to Balsam Hills (quite rare article, ), Balsam Hill promo on Artificial Christmas tree (https://en.wikipedia.org/w/index.php?title=Artificial_Christmas_tree&diff=prev&oldid=669716189&diffmode=source]), Toys "R" Us
 * : edits on Toys "R" Us, Monster Energy

--MarioGom (talk) 20:31, 26 July 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Cougarsurf also edited the article, which a American Advisors Group executive. This makes 3 coincidences with the BurritoSlayer group, all of them known GFD clients too. --MarioGom (talk) 19:25, 27 July 2018 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
All of the listed accounts are stale except Cougarsurf. The previous technical data in this case is very complicated and it's unlikely that all the accounts are operated by the same person. In the initial report in the archive filed on July 27, 2017, which is almost exactly one year ago and gives you an idea of the age of the technical data I'm using for comparison to this particular account, I broke down the accounts into four groups. Cougarsurf is to Group 3, which includes BurritoSlayer.--Bbb23 (talk) 21:15, 26 July 2018 (UTC)


 * Based on the technical 'Likely', the other evidence here, and the concerns expressed by {{U}Jytdog}} on the user's talk page, I recommend blocking this Cougarsurf account. Kudpung กุดผึ้ง (talk) 03:32, 29 July 2018 (UTC)
 * Cougarsurf is . Closing. TonyBallioni (talk) 18:05, 1 August 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Edits:
 * : suspected GFD client, also edited by
 * , known GFD client, also edited by and . Both Cougarsurf and Capricornthought interested specifically in Toys "R" Us philantropic activity
 * : does not really look like COI or promo, but it is suspicious that also edited related article Daniel Handler

It also followed the same editing pattern as other sockpuppets in the same group: they start creating very short user page to avoid their name to stand out in red in history, then start doing a lot of minor and often irrelevant edits, usually on pop culture topics, and then they do just a few major contributions to articles that are likely GFD clients. MarioGom (talk) 13:54, 2 August 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
✅ to. . Closing.--Bbb23 (talk) 14:33, 2 August 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.


 * Created : confirmed Go Fish Digital (GFD) client (see testimonials)
 * Created : suspected GFD client (see parent company and author of Google Form)
 * Shares and  with
 * Created, which works for . Articles by artists working with this firm were edited by various sockpuppets here:
 * did quite a few edits to Calvin Harris.
 * edited Calvin Harris, Frank Ocean.
 * edited Deadmau5
 * Edited, Cougarsurf edited the article of its president,

I think the account should be checked for relation with accounts reported in Sockpuppet_investigations/Pleaschamp too. Since some of them seem to be related to Three Six Zero artists too. MarioGom (talk) 18:36, 6 August 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Isn't it possible to perform behavioral comparison? Relation is quite obvious and establishing it would help later cleanup (e.g. speedy deletion, reverts, as well as estabilishing data points for further sockpuppets). --MarioGom (talk) 19:55, 6 August 2018 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Breeze897 is. Closing.--Bbb23 (talk) 19:47, 6 August 2018 (UTC)
 * Not worth the time. If the user edits again, you can reopen.--Bbb23 (talk) 20:02, 6 August 2018 (UTC)