Wikipedia:Sockpuppet investigations/Pleaschamp/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * All four accounts are SPAa created in the span of 10 minutes on May 27th. The characteristic behaviour involves creating a one-line draft for a BLP or ORG and then very quickly expanding it over 10+ edits. The articles share a similar formatting and referencing style.
 * Diffs:
 * Jamesknock21:
 * Pleaschamp:
 * Judahpure:
 * Crestacts: contributions deleted

-- Rentier (talk) 15:43, 31 August 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' Its a minor overlap in MO and behavior to be sure, but the BLP edits are similar enough that if there was a technical match to SamRustic, I wouldn't consider it a false positive. how confident are we that the technical data links SmartRustic and Gemohadur? TonyBallioni (talk) 13:05, 15 September 2017 (UTC)
 * if group 1 are confirmed to eachother, I am comforable labeling them BurritoSlayer socks based on the behavior of and . See similarities between their userpage and two BurritoSlayer socks. The willingness to engage on talk pages also matches a key characteristic of that the BurritoSlayer farm followed: this would be the largest case of it, but there aren't to many paid editing sock farms out there that use talk pages actively.Also compare 's post here with, the first BurritoSlayer sock uncovered   (and there are plenty others like that from the farm). I'm convinced that the group 1 socks you found are a match to BurritoSlayer if you believe they are technically connected.Group 2 has , somewhat similar userpage to RedmondKane and LedgerTom. More advanced, but follow the standard intro sentence closely. This edit though from  confirms it for me though. It follows the standard BurritoSlayer pattern of creating talk pages of articles which don't have them , and matches one of the common name formats for that farm (GenericnameRandomterm).Ponyo, if you feel comfortable enough with CU blocking these, I'd call it a next to perfect behavioral match. TonyBallioni (talk) 23:17, 14 September 2017 (UTC)
 * , there are some similarities between Gemchadur and the farm, which does have a Chinese business connection (see ). The edits like these  also follow a similar pattern of adding truthful but negative information to articles that involve living people (see Khamis Al-Khanjar as an example of a promotional coatrack by this farm). I'd have to dig through more of the contributions, but depending on how strong the technical positive is to SamRustic, who I am convinced is a BurritoSlayer sock, I think you do have some behavioral overlays. TonyBallioni (talk) 23:27, 14 September 2017 (UTC)
 * That still seems pretty tenuous to me - Lee Jae-yong (businessman) is Korean for instance and their contribs are mainly about current affairs rather than business. It's also strange that SamRustic wasn't picked up before if they are a BS sock. Some of their edits really don't fit the bill either e.g., in fact I can't find a single diff of theirs that screams UPE. SmartSE (talk) 00:07, 15 September 2017 (UTC)
 * I'm an idiot for not seeing the Korean difference. I had seen the China economy and connected it in Asia. My bad there.The diff you cited on SamRustic fits BS very closely. It is not just an advertising UPE operation, they also work to delete articles. See this edit by LedgerTom that is nearly identical: trying to remove negative information about white collar crime from Wikipedia. TonyBallioni (talk) 00:12, 15 September 2017 (UTC)
 * See also SamRustic's talk page creation history and compare to the two linked above. This was one of the defining characteristics of the original BurritoSlayer farm, and it wasn't always on articles that they had any relation to. TonyBallioni (talk) 00:51, 15 September 2017 (UTC)
 * You know them much better than I do and yes I can see the similarites now between SamRustic and the confirmed socks. Still struggling to see how Gemchadur is behaviourally linked, but if the technical evidence is concrete that they are using the same device then it must be an attempt to create a good hand for ulterior uses later on. SmartSE (talk) 12:48, 15 September 2017 (UTC)
 * Soulsider fits the user page pattern, which if these socks have one, fits one of a few very specific formats. For comparison here are three similar CU confirmed to the initial sockfarm  ., sorry for all the pings, but could you tell us which accounts in the BS archive these overlap with technically? On BurritoSlayer we've had several groups of socks unrelated to the initial finding, but which were related to one another or blocked behaviorally despite being unrelated technically. This could help us further figure out that UPE operations MO and assess the behavioral evidence here. Thanks for all your work. TonyBallioni (talk) 17:17, 15 September 2017 (UTC)
 * just noting here that we have another likely BurritoSlayer sock at Sockpuppet investigations/BurritoSlayer. Behavioral evidence in terms of edit summary and userpage also aligns with the socks above. They might have changed VPN providers by now compared to these, but probably worth checking against. TonyBallioni (talk) 05:22, 13 October 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
✅ that the following accounts are related: It's that Judahpure is related to Crestacts, but the evidence is kind of contradictory at parts. The ranges are quite busy, and there appear to be a lot of unrelated accounts on it, so I'm leaving this request open for a second opinion and a deeper scour. If no-one else gets around to it in the mean time, I'll come back and do it later. --Deskana (talk) 09:49, 1 September 2017 (UTC)
 * - Please compare these accounts and check for others - I strongly doubt these are the only ones. GABgab 19:37, 31 August 2017 (UTC)
 * - GABgab 16:41, 1 September 2017 (UTC)
 * This looks like a clear case of WP:PAID. The two accounts I checked, and, were exclusively using webhosts  to edit, which, given the overlap, cannot be a coincidence. Although , I can see from when Deskana made his check that  and  were also editing exclusively through webhosts. Again, this is unlikely to be a coincidence. There is technical overlap with Sockpuppet investigations/BurritoSlayer/Archive, which is a wormhole of paid editing, so that could very well be what we're looking at.  I would take a good behavioural look at the following accounts as well (with an eye to the BurritoSlayer connection):
 * Group one:
 * Well Go USA was obvious UPE. Logo added to that article by may merit investigation.
 * crossover with
 * Group two:
 * - NEW
 * Well Go USA was obvious UPE. Logo added to that article by may merit investigation.
 * crossover with
 * Group two:
 * - NEW
 * - NEW
 * - NEW


 * and have recently dealt with this sockfarm and may have some valuable input regarding behaviour.  -- Jezebel's Ponyo bons mots  22:36, 14 September 2017 (UTC)
 * I will take a look but it will need to wait a while. Note though that Yunshui also found a weak link to Burritoslayer 2 days ago at Sockpuppet_investigations/Stars_Stripes_Forever but suspected it might just be due to the same VPN provider. SmartSE (talk) 22:45, 14 September 2017 (UTC)
 * I've checked the contribs of and see absolutely nothing to indicate they are behaviourally related to the other accounts listed here or to Burritoslayer. I think that is a false positive, but just in case they are trying to build up a good reputation, It'd be helpful for  to elaborate on the technical evidence. SmartSE (talk) 23:17, 14 September 2017 (UTC)
 * Gemchadur is using the same operating system version as SamRustic, with the only difference being the browser used. They have also shared a few IPs on the same range, despite both of them only having used IPs from a small subset of the range. Both of those together mean that technically it is quite likely that they are related. Since you see no behavioural similarities, then the technical similarities are not strong enough to rule out it being a complete coincidence. I recommend giving Gemchadur the benefit of the doubt, and watching closely rather than blocking. I applaud your sharp eye! --Deskana (talk) 13:44, 15 September 2017 (UTC)
 * Thanks for the info. I agree that given the chance it is a coincidence a block is not a sensible action for now. I will drop them a note just to let them know they were mentioned here in case they are caught up again. SmartSE (talk) 14:51, 15 September 2017 (UTC)
 * I've blocked a couple but where does the behaviour of Gemchadur leave us in regard to SamRustic? I can see some similarities to BS as Tony has discussed above, but if we are fairly sure that Gemchadur isn't linked to BS, can we say that SamRustic is? SmartSE (talk) 16:09, 15 September 2017 (UTC)
 * SmartSE This really comes down to a behaviour analysis as Deskana has provided about the extent of what what Checksusers can safely divulge. It's clear that both SamRustic and Gemchadur were very familiar with Wikipedia terminology from the get go (e.g. Gemchadur using flawless citation templates in their very first edit and noting ""wikipedia standards" and "source material") and the fact that they were using the same webhosting service, with more than one cross-over point, and one of these IPs was also used in the same time period by, is very concerning. In addition, running the CU on an edit by edit basis as opposed to by account, I can see that it is extremely that Gemchadur also created  and . Rerunning the check I can also see Gemchadur overlapping with , who I've added to Group 2 above.-- Jezebel's Ponyo bons mots  16:53, 15 September 2017 (UTC)
 * Again, the checkuser tool is only so useful when it comes to these vast farms operating solely from VPNs/webhosts with multiple devices and browsers at their disposal. Group 1 was uncovered based on my check of and it is this same group that the BurritoSlayer account popped up, so I dug deeper and found the rest of the accounts listed in Group 1. Group 2 was uncovered based on my check of .-- Jezebel's Ponyo bons mots  18:07, 15 September 2017 (UTC)


 * I didn't list all of the accounts I saw, just the ones that had some behavioural similarities.-- Jezebel's Ponyo bons mots 22:51, 14 September 2017 (UTC)
 * I've blocked the remainder of the accounts listed in Group 1 as BurritoSlayer socks, but will hold of on any others until the behavioural evidence is sorted between Group 1 and 2. At some point this will need to be split and merged to Sockpuppet investigations/BurritoSlayer/Archive. you noted "blocked and tagged" for a couple of the accounts, but they're not actually tagged.-- Jezebel's Ponyo bons mots  18:42, 15 September 2017 (UTC)
 * This has been sitting here for a very long time. Wouldn't you like to dispose of it? It makes me dizzy just to look at it.--Bbb23 (talk) 23:03, 2 December 2017 (UTC)


 * Unfortunately after the long delay in dealing with this SPI many of the accounts have not edited for a long time, so actions taken now may have little or no effect. Nevertheless, in those cases where there is clear evidence of sockpuppetry the accounts may as well be blocked, partly for the record and partly in case they ever do try to return to editing.
 * As far as the four accounts for which this investigation was originally opened are concerned, the behavioural evidence is strongly suggestive, and taking the coincidence of use of web hosts into account too I have blocked the accounts.
 * ClarckArt and Robharrison12 are obviously the same person. Even though the amount of behavioural evidence is tiny, it is such a perfect match that combined with ChekUser evidence of a connection it is too much of a coincidence to be anything else, so I have blocked those accounts.
 * Gemchadur is difficult. Since, unlike most of the accounts mentioned, this one is still active, a clear verdict would be worth while, but a clear verdict doesn't seem to be possible. There are so many indications of possible connections to other accounts that I can't be comfortable in dismissing the concerns of sockpuppetry. However, the amount of behavioural similarity is not great enough to be confident in saying that this is another sockpuppet. On balance I think the most likely explanation is SmartSE's suggestion that it is "an attempt to create a good hand for ulterior uses later on", in which case Gemchadur should be blocked. However, there is enough room for doubt that I reluctantly agree with Deskana and SmartSE that we have to give the benefit of the doubt. Since this investigation has been open for not far short of seven months, and there has been no contribution at all for more than six months (apart from an exhortation to close it) the likelihood of anyone coming up with anything better now is remote, so I am closing it. The editor who uses the pseudonym "JamesBWatson" (talk) 15:53, 20 March 2018 (UTC)