Wikipedia:Sockpuppet investigations/Andrewbf/Archive

20 April 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Andrewbf is presently blocked for genre warring and his block was extended for another 2 weeks as he was continuing to edit war while logged out. This new account was created on 19 April. Similarities include genre warring, inserting genres into info boxes on articles. Notably, both accounts like to add genres to the "stylistic origins" field; Pulum34 is using a mobile device; while Andrewbf did not edit via mobile exclusively, there were a few mobile edits on 29 and 30 March. Diannaa (talk) 02:12, 20 April 2014 (UTC)
 * Andrewbf: ; ;
 * Pulum34: ; ;

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * On Dianaaaa's talk page, someone suggested Special:Contributions/Higo1 was also involved. --Demiurge1000 (talk) 01:06, 21 April 2014 (UTC)
 * Duck-blocked that account before I saw this report. Seems to clearly be the same pattern, and same edits, as .  Kuru   (talk)  01:17, 21 April 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Per 's evidence which is quite helpful! Callanecc (talk • contribs • logs) 13:17, 20 April 2014 (UTC)
 * . Tiptoety  talk 02:46, 23 April 2014 (UTC)
 * Already blocked, closing. King of &hearts;   &diams;   &clubs;  &spades; 21:50, 23 April 2014 (UTC)

28 April 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

New account created 3 days after the last sock was blocked. Same deal, genre warring, especially adding genres to the "stylistic origins" field;, , ,. Account already blocked 72 hrs for genre warring, needs indef if it's a confirmed sock please. Diannaa (talk) 18:36, 28 April 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ sock, along with .--Jezebel's Ponyo bons mots 20:37, 28 April 2014 (UTC)
 * I have re-blocked User:Laratadelaciudad as an indefinite block. -- Diannaa (talk) 21:02, 28 April 2014 (UTC)
 * Already blocked and tagged, closing. Callanecc (talk • contribs • logs) 01:57, 29 April 2014 (UTC)

12 May 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Entering for the record. Paul Erik (talk) (contribs) 03:01, 12 May 2014 (UTC)

Also, based on behavioural evidence: Paul Erik (talk) (contribs) 01:57, 14 May 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Blocked 187.211.106.72 as an obvious sock. User:Ponyo already blocked 187.211.26.6 Paul Erik  (talk) (contribs) 03:01, 12 May 2014 (UTC)

14 May 2014

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Obvious WP:DUCK, edits are all genre warring and a lot are restoring edits made by other socks and IP address used previously by Andrewbf STATic message me!   04:04, 14 May 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I just found out his/her another IP address from another new computer, Special:Contributions/94.41.116.190. He/she did not doing EDM songs and genre pages but contributed a few Avril Lavigne pages. Here's the proof diff of Avril Lavigne album. Seems to clearly be the same edits as diff of Recess (song) and diff of Nothing but the Beat. I think would block for extend one or 2 years. Destiny Leo (talk) 08:25, 15 May 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ and blocked.--Jezebel's Ponyo bons mots 17:01, 14 May 2014 (UTC)
 * Addendum: I've blocked the IP noted by as a proxy.--Jezebel's Ponyo bons mots  18:25, 15 May 2014 (UTC)

16 May 2014

 * Suspected sockpuppets
 * User compare report Auto-generated every hour.
 * Editor interaction utility
 * User compare report Auto-generated every hour.
 * Editor interaction utility
 * Editor interaction utility

All restoring edits by the other sockpuppets on multiple articles. WP:DUCK. STATic message me!   01:09, 16 May 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ✅ and blocked:


 * I've applied some liberal doses of semi-protection to some of the target articles. Maybe they'll get bored and find a new hobby.--Jezebel's Ponyo bons mots 16:31, 16 May 2014 (UTC)
 * IP duck blocked for 1 week, closing.

16 May 2014

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Restoring edits by the other sockpuppets, all genre related. Obvious duck. STATic message me!   23:16, 16 May 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I found Special:Contributions/136.169.185.174, it was the same undid pattern. Destiny Leo (talk) 10:18, 18 May 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Duck blocked.--Jezebel's Ponyo bons mots 00:19, 17 May 2014 (UTC)

22 May 2014

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Restoring genre edits by the sockpuppets on Sexy Bitch and Ragga Bomb. Obvious WP:DUCK. STATic message me!   15:05, 22 May 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * You're right, it's an obvious duck. I've blocked and semi-protected a couple more articles.--Jezebel's</b> Ponyo <sup style="color:Navy;">bons mots 20:32, 22 May 2014 (UTC)

02 November 2014

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Editing same sort of articles. Changing genre without consensus.

Blocked as they quack. No need for CU. https://en.wikipedia.org/w/index.php?title=Recess_(song)&diff=prev&oldid=630868978

https://en.wikipedia.org/w/index.php?title=Bangarang_(song)&diff=prev&oldid=630859057

https://en.wikipedia.org/w/index.php?title=Electro_swing&diff=prev&oldid=632087349

https://en.wikipedia.org/w/index.php?title=Alternative_dance&diff=prev&oldid=632087171

https://en.wikipedia.org/w/index.php?title=Traditional_pop_music&diff=prev&oldid=602328592

https://en.wikipedia.org/w/index.php?title=Instant_Crush&diff=prev&oldid=602221064 5 albert square (talk) 03:39, 2 November 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Thanks for your report. Mike V  •  Talk  04:10, 2 November 2014 (UTC)

15 May 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Andrewbf has often been associated with IPs from the Mexico region a little north of Mexico City. Andresbfarrera is very similar in name and identical in behavior and focus. Binksternet (talk) 19:30, 15 May 2015 (UTC)


 * This edit by the IP is exactly the same as this edit by Andresbfarrera.


 * The problem can be traced to the city of Querétaro in Mexico. If we take a look at the editing history of the dance-pop article, a Querétaro IP shows up in February 2014, then on March 17 and 21 he adds the EDM genre and also the techno genre. Then Andrewbf shows up later on March 21, 2014, shifting techno and adding trance, electro house, and pop rock. All of this work is reverted by an IP from Kuching in Malaysia. Through the next week, Andrewbf can be seen edit warring back and forth with the same Malaysia-based person using various IPs. On March 30, Andrewbf was edit warring over and over with, , and . Andrewbf was blocked the next day for abusing multiple accounts. Right after Andrewbf was blocked, Querétaro IP 187.211.26.6 began to edit the same articles, soon coming into conflict again with Malaysian IPs as well as the previous handful of interested editors. At the dance-pop article, he re-added techno, trance and house on April 8, 2014. Sockpuppet account  got into the article on April 20, 2014, re-adding EDM and techno. So we have established that Andrewbf, and a sock account, and Querétaro IPs have been warring to insert the same material. Jumping ahead to 2015, another Querétaro IP 187.211.45.66 began to edit the article on April 18, 2015, adding EDM, and again the next day re-adding EDM as well as changing disco to post-disco, because he did not like disco there, with an edit summary of "club beats (EDM) is waht source says". Other people reverted him and worked on the article. Then on May 15, Andresbfarrera got rid of Disco and changed it to Club, just like the Querétaro IP said in the edit summary of "club beats". Binksternet (talk) 01:22, 16 May 2015 (UTC)


 * Further connection of the Querétaro location and Andresbfarrera can be found on 's talk page. A Mexican IP posted a new discussion saying "I'm not a block evasion of andrew bf..." Etheldavis replied, then the discussion was continued by Andresbfarrera saying "my intention isn't vandalize wikipedia..." The full discussion is at User_talk:Etheldavis. Binksternet (talk) 01:35, 16 May 2015 (UTC)


 * Note that Spanish-language Wikipedia is also seeing the contributions of the following:
 * Andresbfarrera at es.wikipedia.org
 * 187.211.45.66 at es.wikipedia.org
 * 187.211.26.6 at es.wikipedia.org
 * Andrewbf at es.wikipedia.org

I am sympathetic to this person's wish to contribute, however his English language skills are not up to the challenge of making fine distinctions between English terms in the complex field of musical genres, where even native speakers differ. Binksternet (talk) 01:53, 16 May 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

My notes show the user editing from the same range of IPs in the past, including (April 2014) and  (March 2015). I'll leave it up to Binksternet to provide evidence tying in the named account. -- Diannaa (talk) 00:36, 16 May 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Please, provide WP:diffs of edits made by ALL accused accounts and IPs, and diffs of edits made by Andrewbf (or previous socks), so to explain their similarity.  Vanjagenije   (talk)  20:40, 15 May 2015 (UTC)
 * because all previous Andrewbf accounts are stale. Anyway, the evidence presented by Binksternet is strong enough to block Andresbfarrera as a sock of Andrewbf based on behavior and similar username.  Vanjagenije  (talk)  09:45, 16 May 2015 (UTC)
 * I've blocked the account as a really obvious sock. Last time I looked at range block options here, it would have taken out a good chunk of Mexico., I have a pretty good grasp of the pattern from past incidents - if you see a sock or IP with 20+ edits, please drop me a note. Kuru   (talk)  14:09, 17 May 2015 (UTC)


 * Closing the case.  Vanjagenije  (talk)  14:15, 17 May 2015 (UTC)

Suspected sockpuppets
This IP range from Mexico has been engaged in unsourced genre additions and changes over the past few months, across various articles, much like the previous Andrewbf IP socks.

Here are some samples:
 * On Who's That Girl? (Eurythmics song): some overlinking issues, "neatening up" of infobox content
 * On Here Comes the Rain Again: unsourced addition of electronic music genre, rearrangement of another genre. More overlinking, "neatening up" of infobox content.
 * On Sexcrime (Nineteen Eighty-Four) (song): Some overlinking, infobox neatening
 * On Sisters Are Doin' It for Themselves: Some overlinking and infobox neatening
 * On Would I Lie to You? (Eurythmics song): Infobox neatening, more overlinking
 * On What It Feels Like for a Girl: Unsourced genre changes of 'electronic' to 'electronica', addition of 'glitch pop', alongside the usual infobox neatening and overlinking.

I know it's been many years since the last SPI report was made for this user here, but Andrewbf has actually been quite active on Wikipedia since the last report throughout all this time, continuing to make unsourced undiscussed genre changes, nowadays only using multiple IP addresses/ranges and no longer creating new accounts. Quite a number of these new subsequent IPs/ranges have actually been blocked through other means, such as an AIV or ANI report.

I dug up these three reports from the ANI archive:
 * Archive 1143 § Renewed activity by block evading Andrewbf of Mexico (November 2023)
 * Archive 1125 § Lindsay Lohan's big fan in Mexico (April 2023)
 * Archive 1104 § Andrewbf evading block with Mexico IPs – four rangeblocks proposed (July 2022)

To make the connection here, this is a list of diffs from previous IP ranges that were actually blocked for block evasion of Andrewbf, as a result of those ANI reports above:
 * From 189.172.0.0/16 (blocked 2y since April '23):
 * On This Is Your Night (Amber song): genre-warring
 * On This Is Your Night (Amber song): genre-warring, infobox neatening
 * On Sweet Dreams (La Bouche song): Unsourced composer and duration changes
 * On You Lied to Me: infobox neatening, some overlinking, messing with wikilinks to music genres
 * From 189.174.0.0/18 (blocked 6m from July '22):
 * On Come Go with Me (Exposé song): Infobox neatening, genre change from dance-pop to dance-rock, changing double-quote mark to "-inch", some overlinking.
 * On Love Come Down: Infobox neatening, genre additions of dance-pop and post-disco, uncited date change, some overlinking, change of "American" to "U.S."
 * On Borderline (Madonna song): Infobox neatening, some overlinking, use of "U.S."
 * On Don't Leave Me This Way: infobox neatening, overlinking, unsourced duration changes

These diff samples above are all taken from right before the blocks were placed on the ranges.

Obviously, the one thing that stands out in common of all of these IP ranges is that the users behind them apparently all have a common interest on pop and dance music articles...

I feel like we could use a rangeblock on 187.147.0.0/16 here as the ratio of edits from this suspected-to-be-Andrewbf user is incredibly high in comparison to edits from other users unlike him on that IP range.

Note: when I say "infobox neatening", I mean the usage of hlist, duration and start date templates in place of plain old text separated by break tags, commas or other list methods in the article's infobox. — <span style="background:#1F6295;color:white;padding:1q 5q;border-radius:10q;font-family:Franklin Gothic, Verdana">AP 499D25  (talk)  03:37, 21 December 2023 (UTC)


 * The active IP ranges 187.147.160.0/19, 187.147.192.0/19 and 187.147.224.0/19 in the list below are all covered neatly by the one larger IP range 187.147.0.0/16. — <span style="background:#1F6295;color:white;padding:1q 5q;border-radius:10q;font-family:Franklin Gothic, Verdana">AP 499D25  (talk)  02:57, 24 December 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I've been tangling with this sock farm for nine years. There are periods of quiescence, then bursts of activity. The last four months have seen Andrewbf-style edits from the following IPs:
 * – Blocked for three months
 * – Blocked for two years
 * – Blocked for two weeks
 * – active now
 * – Blocked for two years
 * – active now
 * – Blocked for two weeks
 * – active
 * – Blocked for one week
 * – active in September
 * – Blocked for 31 hours
 * – active in October
 * – active in November
 * – Blocked for three months
 * – active

Regarding good-faith edits... I have seen some article improvements mixed in with the usual manual of style problems and gross misinterpretations of the sources. The person isn't trying to vandalize by adding bad text or wrong facts, they are just very persistent in evading their block. That's the main issue here. Binksternet (talk) 05:38, 21 December 2023 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * This is not CUable. That aside, the history of that range says it would be better off blocked. I think I see like 1 good faith edit in the past 6+ months. Izno (talk) 04:03, 21 December 2023 (UTC)
 * I've blocked for 3 months. Closing. Callanecc (talk • contribs • logs) 09:13, 26 December 2023 (UTC)