Wikipedia:Sockpuppet investigations/Davebrayfb/Archive

15 November 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Davebrayfb was blocked, provisionally, for disruptive editing resulting from an apparent lack of basic competence. His block was provisionally lifted when he agreed to accept mentorship and not to edit substantively without discussion with his mentor. He immediately breached the terms of his unblock by continuing to edit, and was blocked indefinitely on October 28. See Talk page entries beginning here for more details; there are also several ANI discussions that I can track down if anyone’s interested. Recent edits (beginning after the indef block) from several different IP addresses bear the hallmarks of his edits and I believe Davebrayfb is evading his block by editing without logging in. My evidence consists of identity in 1) editing interests; 2) editing style and 3) geography (based on information supplied by Davebrayfb).

I am not asking for a CU on the IPs here. I think the behavioral evidence is sufficient.

First – start with the last. Davebrayfb is in Ireland. During his provisional block, he edited a page from an IP address, and identified himself. See diff. That IP, 194.46.182.142 geolocates to Ireland. Both of the suspect IPs are also in Ireland. (Beyond that I don’t pretend to know whether they are in the same range or place, etc.) I am not reporting the IP -142 as it appears to be dormant.

Second, identity of interests. Davebrayfb’s edits focused almost exclusively on childrens’ television – articles about particular shows (mostly cartoons) and their associated networks. A quick look at his contribution history shows this. Both of the IP editors and suspected puppets have recently edited only such pages, each including at least one page that Davebrayfb also edited. Specifically:


 * 194.46.187.225 – Fred Figglehorn
 * 194.46.229.232 – Bob the Builder, Fred: The Show; Ben and Holly’s Little Kingdom.

Third, substance. One of Davebrayfb's signature edits was to add countries of origin to cartoon shows, usually Canada. These additions were sometimes based on a Canadian company having a role in the production; and sometimes were unsourced. See diff1 and diff2 for examples. IP editors 225 and 232 have both made the same edit to other pages, 225 – here and here, and 232 – here.

Davebrayfb was blocked for incompetence but was not above occasional instances of vandalism. See this example. Both -225 and -232 introduced false favorable 3d party ratings of cartoon shows. 225, 232.

I think these three factors pretty well establish that Davebrayfb is using the IPs to evade his block. Finally, I have also listed the registered account Davebrayfb1. It’s obviously the same person and while it has been dormant for several months it would seem appropriate to extend the indef block to that account as well. JohnInDC (talk) 13:00, 15 November 2012 (UTC)
 * I've added a third IP to the list, -193. While this editor is a bit more, mm, voluble than the prior incarnations, the focus of edits is identical (kids' TV - the User Compare report shows extensive overlap with pages edited by Davebrayfb), the types of edits quite similar (a lot of fussing with genres, countries of origins, e.g. here and here, plus occasional forays into outright vandalism, e.g. here and here.)  NB too that this IP editor restored the old text of an article back over a consensus merge & redirect, precisely as Davebrayfb did earlier.  IP restoration, Davebrayfb restoration.  The IP editor, like Davebrayfb, seems to have difficulty properly distinguishing "they're", "their" and "there".  IP edit summary, Davebrayfb edit summary.  Finally, the geography matches as well.  JohnInDC (talk) 20:10, 20 November 2012 (UTC)
 * Another IP, same characteristics, in particular the "country of origin" edit, here and here as two examples. (Like the others, the IP geolocates to Ireland.)  This editor is quite deliberately and systematically undertaking to avoid his block.  JohnInDC (talk) 00:33, 22 November 2012 (UTC)
 * Another. Here's an edit: Diff.  JohnInDC (talk) 02:19, 24 November 2012 (UTC)
 * Added 194.46.188.186. I can't offer edits precisely like the foregoing, but the IP address matches the range, the subject matter is identical, and the vaguely confused edit summary commentary is consistent with Davebrayfb's style.  JohnInDC (talk) 19:06, 25 November 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' I never did the Bubble Guppies edit.I also never knew what what  mentor was or how would I know. — Preceding unsigned comment added by 194.46.229.232 (talk) 17:19, 15 November 2012 (UTC)

Please do not come to my house if you know where I live. — Preceding unsigned comment added by 194.46.229.232 (talk) 17:56, 15 November 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * I've applied a rangeblock to hopefully stop the sock edits and indefinitely blocked the account. Closing. Reaper Eternal (talk) 15:14, 26 November 2012 (UTC)

03 December 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Davebrayfb was indef blocked for incompetent editing and for violating the terms of a provisional unblock. See the SSI archive for this puppetmaster for more detail. He had continued to edit from various IP addresses, which recently resulted in a rangeblock. I am now reporting two other IP addresses (I guess, somehow outside the blocked range) which continued editing since then.

My evidence here for the first listed IP, -18, is essentially the same as it was in the prior report, albeit more limited as I am filing the report a bit sooner. The evidence is, 1) range and location (Ireland) of the IP consistent with prior socks and with the original puppetmaster; 2) the exclusive editorial focus on children / teen TV shows and the networks that carry them, e.g. Bob the Builder and All Grown Up! (both edited by prior socks); and 3) the actual edits (adding genres, making or removing redirects without consensus and error-prone edit summaries being three examples). I am including the second IP, -29, on the strength of a single edit to Bucket & Skinner's Epic Adventures because it restored an edit by the first IP above, and locates to Ireland like all the others. JohnInDC (talk) 17:38, 3 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I've rangeblocked 194.46.224.0/19 for a short time to try to halt the abuse. Reaper Eternal (talk) 18:08, 3 December 2012 (UTC)

04 December 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Davebrayfb was indef blocked for incompetence and for violating the terms of a provisional unblock. See the archive. Since his block, he has returned to edit several times from various IP addresses (all described in the archive too). I believe Davebrayfb is continuing to edit from a recently registered account, and offer the evidence below. I am asking for checkuser to remove any doubt, as well as to look for sleepers – if this is Davebrayfb, it appears that he is a fairly determined puppetmaster.

Evidence:
 * The suspect account, Mario is really awesome, was created on November 27, the day after the first set of sockpuppet IPs were blocked. (I would have thought that an IP rangeblock would prevent account creation; but in that regard, the initial rangeblock did not entirely end Davebrayfb’s IP puppetry, and presumably the account was created from one of the still-unblocked IPs.  That, or I completely misunderstand how these things work.)
 * The accounts exhibit identical areas of interest, namely, childrens’ television programs and related networks. Just eyeballing it I would say that half of Mario’s edits are to pages that Davebrayfb or his socks also edited.
 * The nature of edits is also the same. In my original report I noted that Davebrayfb was fond of tweaking 1) genres of television shows and 2) countries of origin, usually to add Canada; 3) he moved pages for questionable reasons and without discussion (e.g.) and 4) was not above a bit of vandalism from time to time – which sometimes he’d go and immediately fix.  See this IP example.  5)  Davebrayfb and his socks were all pretty bad spellers too.

In just 28 edits, Mario has exhibited all these characteristics.


 * Genres: Diff, diff.


 * Country of origin: Diff, adding Canada


 * Vandalism: Diff.  Also making a mess, then immediately cleaning it up.


 * Questionable & unilateral move: Diff.


 * Typos / misspellings: Diff.

A couple of hours after the additional IPs were rangeblocked yesterday, Mario edited his user page to add the claim that he is from Canada. As previous reports have noted, Davebrayfb is in Ireland. I read this as either a naïve attempt to throw others off the scent, or a joke. (Ah, as I was making this entry, he changed it to "UK", see diff.)

In sum, it is extremely unlikely that a new, unrelated editor would come into being just as Davebrayfb’s socks were being blocked, and then proceed to make essentially identical edits to the very same pages. This is clearly him. JohnInDC (talk) 21:38, 4 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Endorsing per the evidence presented. Reaper Eternal (talk) 21:43, 4 December 2012 (UTC)
 * Unsurprisingly, they are ✅. ​—DoRD (talk)​ 23:07, 4 December 2012 (UTC)
 * Already blocked and tagged, closing and archiving Courcelles 02:20, 5 December 2012 (UTC)

10 December 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

I will be briefer this time. This IP is 1) in the same range and location as prior Davebrayfb socks in the archive; 2) it edits the same kids' TV / network articles; and 3) it makes the same sorts of edits (e.g. country of origin) - even following up on a Talk page discussion begun by a prior sock, here. Either a rangeblock has expired, or the existing one needs to be tweaked a bit. JohnInDC (talk) 21:56, 10 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The user is editing from a dynamic range that, unfortunately, is too busy to have an effective rangeblock applied. I'll give this address a short block, but I expect that they'll show up with a new one before long. ​—DoRD (talk)​ 22:53, 10 December 2012 (UTC)

12 December 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

This IP (in the same range as prior socks) admits to being the same editor as prior IP socks. See diff. JohnInDC (talk) 15:16, 12 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. ​—DoRD (talk)​ 15:33, 12 December 2012 (UTC)

15 December 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

The IP, already established as a sock, resumed editing immediately after the 48 hour block expired. User "I can't think of a username 2" was created today and immediately set out to restore a variety of Davebrayfb / puppet edits, e.g. diff, diff. CU to check for sleepers (particularly since the username implies an earlier iteration). JohnInDC (talk) 20:58, 15 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Similar looking edits from 194.46.189.63 also. Bonusballs (talk) 12:46, 16 December 2012 (UTC)
 * Added 194.46.189.63 - same IP range, plus he addressed me in his edit summary. JohnInDC (talk) 12:49, 16 December 2012 (UTC)

Possibly also 194.46.241.193, for similar reasons. Very odd edits, but there do seem to be a few particularly persistent sockpuppet vandals against Children's Television articles in this geographic area. Bonusballs (talk) 13:03, 16 December 2012 (UTC)
 * That one was reported earlier and is him. So far every edit I've seen coming out of an address beginning 194.46 has been him.  JohnInDC (talk) 13:15, 16 December 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Named user is ✅. I've blocked the IPs, but the range is too busy for a rangeblock, unfortunately. ​—DoRD (talk)​ 14:22, 16 December 2012 (UTC)

23 December 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same IP range as Davebrayfb's socks, same focus on childrens' TV & networks; same typical vandalism followed by a quick self remedy, e.g. here to here. JohnInDC (talk) 12:56, 23 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked (CheckUser was not used). Tiptoety  talk 16:49, 23 December 2012 (UTC)

26 December 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

IP addresses locate to Davebrayfb's range and the edits by these IPs are typically, and exclusively, to childrens' shows and TV, as are all of Davebrayfb's edits. JohnInDC (talk) 15:59, 26 December 2012 (UTC)
 * Added -224, which has just taken up the editing pen. JohnInDC (talk) 21:36, 28 December 2012 (UTC)
 * Another. Same Ip range,mrepeating same edits. JohnInDC (talk) 12:55, 31 December 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I'm blocking them, as it's a duck block. However, the range is far too busy for a rangeblock, and the edits are too spread for protection. Not much to do here. ( X! ·  talk )  · @332  · 06:58, 1 January 2013 (UTC)