Wikipedia:Sockpuppet investigations/Showtime2009/Archive

From Wikipedia, the free encyclopedia



Showtime2009

Showtime2009 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log· investigate · cuwiki)
Report date March 13 2010, 05:06 (UTC)[edit]
Suspected sockpuppets [edit]
Evidence submitted by Prolog [edit]

On 21 May 2009, The Red Peacock was blocked for a month. On 25 May, the account John Asfukzenski was created. Both were inactive for a long period until Showtime2009 created Wikipedia:Articles for deletion/Andrea Tantaros, where The Red Peacock and John Asfukzenski turned up to support deletion (and were the only users to do so). All three recommended deletion again at Wikipedia:Articles for deletion/Angry white male (3rd nomination) (along with IP sock 172.163.150.240). For The Red Peacock, these are his/her only AFD comments. Below are some article-specific "coincidences":

  • At free market, The Red Peacock made a large blanking. John Asfukzenski edited two minutes later, hiding the removal from watchlists. Asfukzenski and 63.215.29.202 later attempted the same blanking several times without an edit summary. 172.163.142.128 and 172.129.69.245 were used for the "vandal role".

More evidence is available, if necessary. Prolog (talk) 05:06, 13 March 2010 (UTC)[reply]

Added Snakemeets012, who added the same section on Thomas McDermott, Jr. as John Asfukzenski (originally) and other usual suspects had done earlier. At Ted Poe and Peter T. King, Snakemeets012's blankings are immediately followed by IP vandal edits from the usual ranges. Prolog (talk) 12:45, 13 March 2010 (UTC)[reply]
Showtime2009 has now admitted to socking. Prolog (talk) 22:56, 13 March 2010 (UTC)[reply]
Comments by accused parties [edit]

See Defending yourself against claims.

If you look at those edits, you will see I was reverting the ip edits and was not participating in the disruptive editing. Richard (talk) 22:10, 16 March 2010 (UTC)[reply]

Comments by other users [edit]

In November 2009, I discovered similar patterns (or, in some cases, the same edits) as described above - involving Showtime2009, John Asfukzenski, The Red Peacock, several 172... AOL IPs, 63.215.29.202, 63.215.29.212 and another account that I would like to add to the investigation:

Back then I contented myself with reverting the unexplained deletions and other POV edits that had been "covered" by such subsequent IP vandal edits. I began to prepare a SPI request but didn't finish it. Below, I reproduce the sockpuppet evidence I collected back then (apologies for some overlaps with Prolog's material):

Regards, HaeB (talk) 17:34, 13 March 2010 (UTC)[reply]

Another pattern common to some of the accounts is the addition of negative material, sourced from Cybercast News Service (formerly Conservative News Service), to the BLPs of Democratic U.S. politicians:

Regards, HaeB (talk) 01:19, 14 March 2010 (UTC)[reply]

Answer to the comment by Richard above: "If you look at those edits, you will see I was reverting the ip edits..." - read the evidence again, that is exactly what is said there. "reverting the ip edits" is part of the described disruptive editing pattern: The IP vandalism followed by a revert have the effect of "hiding" the previous, controversial edit from other users' watchlists, which appears to have been intentional.
In any case, the point was not that these edits are vandalism in themselves, but that they make it likely that the account Richard is operated by the same user.
Another independent piece of evidence connecting Richard to the group is the use of reflinks, a not very widely used tool:
Richard: e.g. [9], Showtime2009: e.g. [10], Snakemeets012: e.g. [11]
Regards, HaeB (talk) 02:07, 17 March 2010 (UTC)[reply]
Clerk, patrolling admin and checkuser comments [edit]
Checkuser request – code letter: C (Vote stacking affecting outcome )
Current status – Completed: Reviewed by a Checkuser, results and comments are below.    Requested by Prolog (talk) 05:06, 13 March 2010 (UTC) [reply]

 Clerk endorsed Tim Song (talk) 05:58, 13 March 2010 (UTC)[reply]

All accounts listed are  Confirmed to have been editing from the same computer at some point. No comment on the IP addresses - you'll note from the WHOIS reports that most of those are AOL, so they could very easily be just about anyone else by now, even if they were used by this user at some point. Still looking to see if other accounts are involved. Hersfold (t/a/c) 17:23, 17 March 2010 (UTC)[reply]
Maybe Richard4410 (talk · contribs) as well; hard to confirm since there's only one edit. Note that the account was created at Commons, so that may help. Hersfold (t/a/c) 17:31, 17 March 2010 (UTC)[reply]
information Administrator note All accounts listed above are blocked. I'm leaving Richard4410 unblocked since there was only one edit and behavioral evidence is lacking. Tim Song (talk) 18:44, 17 March 2010 (UTC)[reply]
Also blocked Mgmvegas (talk · contribs), which seems to have been automatically created when it was renamed to Richard (talk · contribs). Tim Song (talk) 18:49, 17 March 2010 (UTC)[reply]
This case has been marked as closed. It has been archived automatically.

Report date March 31 2010, 19:36 (UTC)[edit]
Suspected sockpuppets [edit]


Evidence submitted by Ks0stm [edit]

It may be a hunch, but for some reason an IP address accused of being Showtime2009 in the last investigation returning to edit his signature on the WikiProject Severe Weather page seems very suspect to me and quacks loudly. Requesting checkuser because the checkuser in the previous case did not comment on the IP addresses (this one is not AOL as far as I can tell). Ks0stm (TCG) 19:36, 31 March 2010 (UTC)[reply]


Comments by accused parties [edit]

See Defending yourself against claims.


Comments by other users [edit]
Clerk, patrolling admin and checkuser comments [edit]
Checkuser request – code letter: E (Community ban/sanction evasion )
Current status – Declined, the reason can be found below.    Requested by Ks0stm (TCG) 19:36, 31 March 2010 (UTC) [reply]

 Clerk declined I don't think a checkuser is necessary, as this is clearly a DUCK. From behavioral evidence, it looks as if the IP has been stationary for the past six months or so, so I'd recommend a decently long block here. Auntie E. (talk) 04:33, 2 April 2010 (UTC)[reply]

information Administrator note IP blocked 6 months. –MuZemike 20:37, 5 April 2010 (UTC)[reply]

This case has been marked as closed. It has been archived automatically.