Jump to content

Wikipedia:Sockpuppet investigations/OnceaMetro/Archive

Add links
From Wikipedia, the free encyclopedia


OnceaMetro

OnceaMetro (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

29 July 2015

[edit]
Suspected sockpuppets

SimpleStitch appears to have taken over some of the financial industry articles formerly tended to by OnceaMetro. Refer to WP:COIN#Various hedge funds and their managers (longer-lived link) for details, here are representative diffs:

On Pine River Capital Management, OaM adds awards; SS adds awards.

On JAT Capital Management, an article with all of 4 editors, OaM creates article, SS maintains it.

@Vanjagenije: Added following per your request. This table summarizes all these two editors' specific article crossovers (via editor interaction tool).

Editor interaction analysis
Article Nature of article date of OnceaMetro's last edit date of SimpleStitch's first edit in-order edits? (OaM then SS) comments
Anthony Chiasson (edit | talk | history | protect | delete | links | watch | logs | views) American hedge fund manager 17 April 2015 18 December 2014 no article created by OaM ~120 days prior to SS's first edit
Steve Case (edit | talk | history | protect | delete | links | watch | logs | views) American businessperson 11 January 2015 26 November 2014 no
JAT Capital Management (edit | talk | history | protect | delete | links | watch | logs | views) American investment firm 5 March 2015 7 May 2015 yes (~60 days) article created by OaM ~60 days prior to SS's first edit
Bill Lipschutz (edit | talk | history | protect | delete | links | watch | logs | views) American hedge fund manager 2 December 2014 7 February 2015 yes (~60 days)
Micky Arison (edit | talk | history | protect | delete | links | watch | logs | views) Israeli-American CEO 24 October 2014‎ 26 January 2015 yes (~90 days)
Atari (edit | talk | history | protect | delete | links | watch | logs | views) duh 17 December 2014 27 March 2015 yes (~90 days) Edit summaries nearly identical: fixed broken reference, fixed reference
Steve Ballmer (edit | talk | history | protect | delete | links | watch | logs | views) American businessperson 3 August 2014 25 November 2014 yes (~120 days)
Jim Breyer (edit | talk | history | protect | delete | links | watch | logs | views) Equity investment CEO 8 December 2014 24 April 2015 yes (~5 months)
Leona Helmsley (edit | talk | history | protect | delete | links | watch | logs | views) American businessperson 16 August 2014‎ 2 January 2015‎ yes (~120 days)
Al Lerner (edit | talk | history | protect | delete | links | watch | logs | views) American businessperson 14 October 2014‎ 5 April 2015‎ yes (~6 months)
Philip Falcone (edit | talk | history | protect | delete | links | watch | logs | views) American hedge fund founder 2 April 2015‎ 29 September 2014‎ no Edit summaries nearly identical: fixed reference, fixed references
Julian Robertson (edit | talk | history | protect | delete | links | watch | logs | views) American hedge fund manager 26 February 2015‎ 29 July 2014 no
Pine River Capital Management (edit | talk | history | protect | delete | links | watch | logs | views) Hedge funds and stuff 19 November 2014‎ 20 July 2015‎ yes (~8 months)

Findings:

  1. There appears to be a pattern in many cases here of the master handing off cases to SimpleStitch. If the two weren't coordinated, if not the same person, this pattern would be extremely unlikely.
  2. Behavioral evidence should be plain as both are nearly exclusively doing COI type work on Wall Street investment firms and fund managers.
  3. Many times, suspiciously similar edit summaries in the same article, as noted. I haven't had time to examine all the edits more closely.
  4. Suspiciously similar edit summaries in different articles, e.g.
    1. "credited source" (SimpleStich) vs "Fixed reference to credit source" (OaM) and
    2. "have been creating on a page" (SimpleStitch) vs "have been working on a page" (OaM).
  5. By my count, SimpleStitch has edited just 100 articles. 13 of them are in the table above, meaning he overlapped with the master 13% of the time.SimpleStitch has substantial numbers of overlaps with master. Again, statistically unlikely for two unconnected individuals.
  6. By my count, OnceaMetro created 7 articles. Two of them were visted by SimpleStitch quickly after being created. Again, statistically unlikely for two strangers.

I will try to do more complete filings in future. Brianhe (talk) 03:05, 29 July 2015 (UTC)[reply]

Some more behavioral similarities. Both editors use similar idiosyncratic phrasing in edit summaries.

Phrase SimpleStitch OnceaMetro
"working on..." [1] [2], [3]
"info box" [4] [5]
"fixed bare url and..." [6] [7], [8], [9], [10]
"bare url fix[ed]" [11] [12]
"credited source[s]" [13], [14], [15] [16], [17], [18], [19]
"Wiki link" (identical caps and space) [20] [21]
"added citations needed" [22], [23] [24], [25]
"Wiki is not X" (identical caps) [26] [27]

No one thing is utterly convincing but taken all together I can't imagine this not being the work of one person. - Brianhe (talk) 06:06, 29 July 2015 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I am in no way affiliated with OnceaMetro. I do not know this person or nor have I interacted with him in any way. — Preceding unsigned comment added by Jordansocial (talk • contribs) 00:18, 29 July 2015 (UTC)[reply]

Hi Brianhe, I'm not familiar with the user but I obviously did edit pages that the suspect also did. My format and language I use I just derived from other editors, mostly cut and paste on those actual pages. I don't feel any of my contributions violated editing requirements. Thanks.--SimpleStitch (talk) 05:23, 31 July 2015 (UTC)[reply]
Hi again Brianhe, per your message on my talk board, no I don't get paid for editing. I tried to go to the link you provided but I think it is archived or something like that. Either way, I don't know anybody in my personal life that actually edits on Wikipedia except my classmates from the one course I took that started us all editing. Again, I think my contributions have been factual. --SimpleStitch (talk) 17:33, 5 August 2015 (UTC)[reply]
Relevant suspicions.

@Brianhe:, @Vanjagenije:: I have been following this. I think, and have for some time, that Simplestitch may be a sock of this bunch https://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/Sherlock4000/Archive. My evidence comes from Gustavo Ferraro.

One user and one IP active on the page were blocked in this SPI. Here are there edits:

And here are some of Simplestitche's edits, removing the same content.

I have little doubt this account is just another sock for the larger group of them, since the behavioural evidence fits. DaltonCastle (talk) 23:17, 11 August 2015 (UTC)[reply]

Nice try DaltonCastle, let's review what I posted about your attacks that I put on the Conflict of Interest Noticeboard on September 29, 2014

I have come across the entry for Gustavo Ferraro. The editor DaltonCastle has blatantly disregarded all the removed information and reasoning behind it. This editor has taken their crusade against anyone they perceives has a connection to Néstor Kirchner or Cristina Fernández de Kirchner and created entries that are set up solely to include a section filled with quotes and theories by editors of publications to attack. The list includes Carlos Zannini, Miguel Ángel Pires, Carlos Molinari, Enrique Omar Suárez, César Guido Forcieri, Juan Pablo Schiavi and Federico Elaskar. And those are just the new ones the editor created. This editor allegedly used LinkedIn to create the background before the accusations against Gustavo Ferraro but that source doesn't exist. I will request speedy deletion of this entry but wanted to note the obvious non-neutral and conflicted agenda of the editor that should be examined. Wikipedia is not meant to be a venting blog for theorists.--SimpleStitch (talk) 15:51, 29 September 2014 (UTC)[reply]

No need to get so personal. If you are innocent then there is not harm done. DaltonCastle (talk) 22:01, 12 August 2015 (UTC)[reply]
  • Vanjagenije take a look at DaltonCastle and what he has erased from his talk page and who himself has backed down to my accusations, after he accused me, let's get real. I'm a student at USC, come see me, if I was getting paid I wouldn't be on student loan. If you are truly a defender of Wikipedia and not a partsian shill you would examine DaltonCastle entries. And yes, if you are a neutral Wikipedia editor look at Gustavo Ferraro and the conjecture and soapbox and even the defamatory reasoning he justifies for the content and even Bobrayner, who said, in a threatning manner - I'm concerned that SimpleStitch has deliberately tagged stuff with [citation needed] - and then removed it entirely - despite knowing that it's supported by sources. That would be a very bad thing. Let's not repeat that, hmm? So let's open up real intent here. Will you ignore this?--SimpleStitch (talk) 04:20, 13 August 2015 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

[edit]
  •  Confirmed:
SimpleStitch (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
AbeFrohman1977 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Ombase (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
JimJReynolds (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Seyoda (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
TridentBrook (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
However, these accounts seem very  Unlikely to be related to Sherlock4000. Any connection to OnceaMetro will need to be based upon behavioral evidence. Mike V • Talk 03:02, 17 August 2015 (UTC)[reply]
Tagged as socks of OnceaMetro based on behavior. Closing now. Vanjagenije (talk) 17:59, 31 August 2015 (UTC)[reply]

21 August 2015

[edit]
Suspected sockpuppets


Think I found another. SimpleStitch, confirmed sockpuppet(eer) jumped in to RSE ventures section here. Qwert4321 is an RSE Ventures SPA who twiddled the section earlier here and has created a failed draft article Draft:RSE Ventures. Brianhe (talk) 18:07, 21 August 2015 (UTC) Brianhe (talk) 18:07, 21 August 2015 (UTC)[reply]

@Vanjagenije: Do I need to do something else here? I might have messed up the process by injecting a new user at the wrong time or in the wrong section. Brianhe (talk) 01:44, 27 August 2015 (UTC)[reply]
@Vanjagenije: Did I stall this SPI? — Brianhe (talk) 17:51, 31 August 2015 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

[edit]
  •  Clerk note: I don't think this evidence is enough to block him. And, the CU check was performed this month, and Qwert4321 was not confirmed although he made some edits in June. So, I believe he is technically unrelated. I'm closing this now. Vanjagenije (talk) 18:02, 31 August 2015 (UTC)[reply]

08 April 2021

[edit]

Suspected sockpuppets

[edit]


This group is a continuation of OnceaMetro and LedgerTom (see BurritoSlayer Group 1). For some initial background, here's an explanation of why I think LedgerTom is OnceaMetro:

OnceaMetro and LedgerTom link

BelBivDov and UConnSofB18 are part of the original LedgerTom cohort created after the OnceaMetro blocks. After the LedgerTom blocks in 2017, editing patterns changed, and a new editing pattern was established for new socks, which are much better at segregating article overlap as well as editing styles. But not good enough, a strong editing pattern connect UConnSofB18, FrankTursetta, TerrellTrevon and Canyonpass.

Since this is a very experienced UPE operation (first account signed up in 2007), and they have demonstrated certain capacity to plan their edits ahead of time to avoid fingerprinting, I'm going to omit explicit explanations about current behavior. I'm listing below all behavioral evidence that is not significant for their present activity. Let me know if further information is needed.

BelBivDov
Before 2017 LedgerTom blocks
  • Edit summary similarities:
    • "this is a stub" (CharlesDeMint)
    • "created a Talk page" (WatchingContent)
    • "missing title" (Ombase, LedgerTom, CharlesDeMint, RedmondKane, WatchingContent)
    • "added missing title" (Seyoda, BelBivDov)
    • "removed, doesn't exist" (RedmondKane)
    • "changed issue [...]" (WatchingContent, RedmondKane, CharlesDeMint, JAMillerKC)
    • "[...] link rot [...]" (LedgerTom)
    • "[...] Wikipedia entry [...]" (CharlesDeMint)
    • "[...] no longer exists" (Seyoda, CharlesDeMint)
    • "reference format" (Ombase)
After 2017 LedgerTom blocks
  • After 2017-07-21 the account went silent until 2017-11-24, possibly because of the 2017-07-27 block round.
UConnSofB18
Before 2017 LedgerTom blocks
  • No significant activity other than creating Archview Investment Group LP (and the associated talk page). It seems it went to sleep until May 2019.
After 2017 LedgerTom blocks
  • Edit summaries:
    • "[..] line error" (referring to cite templates) (LedgerTom)
  • Strong behavioral match: UConnSofB18, FrankTursetta, TerrellTrevon, Canyonpass. Details omitted.
FrankTursetta
  • Edit summaries:
    • "[...] added stub" (LedgerTom, BelBivDov, CharlesDeMint, WatchingContent, JAMillerKC)
    • "removed, addressed" (JAMillerKC)
  • Strong behavioral match: UConnSofB18, FrankTursetta, TerrellTrevon, Canyonpass. Details omitted.
JAMillerKC
  • Edit summaries:
    • "changed issue [...]" (BelBivDov, CharlesDeMint, RedmondKane, WatchingContent)
    • "removed dead link" (Ombase, SimpleStitch, CharlesDeMint, BelBivDov, FrankTursetta)
    • "added stub" (LedgerTom, CharlesDeMint, WatchingContent, BelBivDov, FrankTursetta)
TerrellTrevon
  • Particularly close to FrankTursetta. Just username pattern and open contributions side by side, although contributions are carefully segregated and there is zero overlap.
  • Strong behavioral match: UConnSofB18, FrankTursetta, TerrellTrevon, Canyonpass. Details omitted.
Canyonpass
  • Strong behavioral match: UConnSofB18, FrankTursetta, TerrellTrevon, Canyonpass. Details omitted.

There is also a quite consistent timecard for all socks, old and new. Article overlap is also pretty big.

CU may be ineffective for a sockmaster with this much experience (also last SPI mentioned VPNs), but I'm requesting it just in case. A sleeper check may be useful too. MarioGom (talk) 21:23, 8 April 2021 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

[edit]
 Inconclusive:
BelBivDov (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
OnceaMetro (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
~Oshwah~(talk) (contribs) 06:29, 9 April 2021 (UTC)[reply]

09 May 2022

[edit]

Suspected sockpuppets

[edit]

Extensive overlap, see Editor Interaction Analyser (WondoMathias, OnceaMetro, Canyonpass, TerrellTrevon, JAMillerKC, SimpleStitch, FrankTursetta, RedmondKane, LedgerTom, Monstermike99, UConnSofB18, NorthBond) and Editor Interaction Analyser (NorthBond, Canyonpass, Monstermike99, OnceaMetro, RedmondKane, LedgerTom, TerrellTrevon, CharlesDeMint, JAMillerKC, SimpleStitch, FrankTursetta, BelBivDov, WondoMathias), especially Davidson Kempner Capital Management. In the previous report I explained the change in style a few years ago. NorthBond and WondoMathias both used the older editing and edit summary style in the first years. NorthBond is particularly telling (e.g. [28][29], [30][31], [32][33]) not only reusing the same edit summaries, but also doing it in relatively small time windows. WondoMathias also has some tells (e.g. [34][35][36], [37][38][39], [40][41][42], [43][44]). NorthBond also uses the new style (e.g. [45][46]). Both timecards are also a good match.

Note for CU: Given the years of experience of this sockfarm, and previous CheckUser results, I don't expect CU to be effective. MarioGom (talk) 22:34, 9 May 2022 (UTC)[reply]

Comments by other users

[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/OnceaMetro/Archive&oldid=1138676767"