Wikipedia:Sockpuppet investigations/Showtime2009/Archive

Evidence submitted by Prolog
On 21 May 2009, The Red Peacock was blocked for a month. On 25 May, the account John Asfukzenski was created. Both were inactive for a long period until Showtime2009 created Articles for deletion/Andrea Tantaros, where The Red Peacock and John Asfukzenski turned up to support deletion (and were the only users to do so). All three recommended deletion again at Articles for deletion/Angry white male (3rd nomination) (along with IP sock 172.163.150.240). For The Red Peacock, these are his/her only AFD comments. Below are some article-specific "coincidences":


 * At Murder of George Tiller, John Asfukzenski, 63.215.29.202, Showtime2009 and The Red Peacock have made very similar edits, removing text and refs that link the incident to domestic terrorism. Throwaway vandal socks 172.162.240.4 and 172.162.25.142 were used immediately after the edits to hide the removals from watchlists, as was 63.215.29.202 when the edit done from 172.129.12.44 instead.


 * At free market, The Red Peacock made a large blanking. John Asfukzenski edited two minutes later, hiding the removal from watchlists. Asfukzenski and 63.215.29.202 later attempted the same blanking several times without an edit summary. 172.163.142.128 and 172.129.69.245 were used for the "vandal role".


 * At Dick Morris, The Red Peacock, 63.215.29.202 and Showtime2009 have blanked the same section. 172.164.186.155 was used for the vandal role, as was 63.215.29.202 when the edit was done from 172.166.121.166 instead.


 * At Trent Franks, Showtime2009, The Red Peacock, 63.215 and John Asfukzenski all removed the article's controversy/criticism section. John Asfukzenski and 63.215.29.202 violated 3RR through socking, and a vandal sock was again used earlier.

More evidence is available, if necessary. Prolog (talk) 05:06, 13 March 2010 (UTC)


 * Added Snakemeets012, who added the same section on Thomas McDermott, Jr. as John Asfukzenski (originally) and other usual suspects had done earlier. At Ted Poe and Peter T. King, Snakemeets012's blankings are immediately followed by IP vandal edits from the usual ranges. Prolog (talk) 12:45, 13 March 2010 (UTC)


 * Showtime2009 has now admitted to socking. Prolog (talk) 22:56, 13 March 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

If you look at those edits, you will see I was reverting the ip edits and was not participating in the disruptive editing. Richard ( talk ) 22:10, 16 March 2010 (UTC)

Comments by other users
In November 2009, I discovered similar patterns (or, in some cases, the same edits) as described above - involving Showtime2009, John Asfukzenski, The Red Peacock, several 172... AOL IPs, 63.215.29.202, 63.215.29.212 and another account that I would like to add to the investigation:

Back then I contented myself with reverting the unexplained deletions and other POV edits that had been "covered" by such subsequent IP vandal edits. I began to prepare a SPI request but didn't finish it. Below, I reproduce the sockpuppet evidence I collected back then (apologies for some overlaps with Prolog's material):


 * Articles for deletion/Angry white male (3rd nomination): The Red Peacock and AOL IP 172.163.150.240 supported John Asfukzenski deletion request.
 * Michelle Caruso-Cabrera: The Red Peacock removes several sourced statements without explanation, next edit is vandalism by AOL IP 172.130.168.107, reverted one minute later by Richard.
 * Ted Poe: John Asfukzenski removes a large portion of text (including 14 references), immediately afterwards the whole article is blanked by AOL IP 172.164.186.155, two minutes later Richard reverts the IP to John Asfukzenski's version
 * Four minutes later the same pattern repeats at Dick Morris: The Red Peacock removes several sourced statements without explanations, one minute later the same AOL IP blanks the page, only to be reverted immediately by Richard
 * Free market: In this edit, John Asfukzenski removed almost 10 kByte of mostly referenced text without explanation, followed one minute later by AOL IP 172.163.142.128 blanking the whole article, which in turn is reverted two minutes later by Richard.
 * In Ian McKellen, both Richard and John Asfukzenski inserted the same controversial statement.
 * America's Affordable Health Choices Act of 2009: John Asfukzenski adds content referenced to a controversial conservative source (Cybercast News Service). Seven minutes later, Richard makes a minor edit to the same article.
 * Health care reform in the United States: AOL IP 172.162.103.225 adds a statement referenced to Cybercast News Service. Two minutes later, Richard makes a minor edit to the same article.
 * Individualism: Showtime2009 removes the entire "Criticism" section and other content without explanation. Four minutes later, AOL IP 172.129.169.21 makes a minor edit to the same article. Nine minutes later, the same IP self-identifies as User:Showtime2009.
 * showed the same pattern (examples, in John Hostettler on 16 September 2009,  on 11 June 2009 in the Dick Morris article, which in November 2009 saw similar edits by The Red Peacock, 63.215.29.202, Showtime2009 and Richards, as described above).

Regards, HaeB (talk) 17:34, 13 March 2010 (UTC)

Another pattern common to some of the accounts is the addition of negative material, sourced from Cybercast News Service (formerly Conservative News Service), to the BLPs of Democratic U.S. politicians:
 * Snakemeets012:, John Asfukzenski: , The Red Peacock:

Regards, HaeB (talk) 01:19, 14 March 2010 (UTC)


 * Answer to the comment by Richard above: "If you look at those edits, you will see I was reverting the ip edits..." - read the evidence again, that is exactly what is said there. "reverting the ip edits" is part of the described disruptive editing pattern: The IP vandalism followed by a revert have the effect of "hiding" the previous, controversial edit from other users' watchlists, which appears to have been intentional.
 * In any case, the point was not that these edits are vandalism in themselves, but that they make it likely that the account Richard is operated by the same user.
 * Another independent piece of evidence connecting Richard to the group is the use of reflinks, a not very widely used tool:
 * Richard: e.g., Showtime2009: e.g. , Snakemeets012: e.g.
 * Regards, HaeB (talk) 02:07, 17 March 2010 (UTC)

Clerk, patrolling admin and checkuser comments
Requested by Prolog (talk) 05:06, 13 March 2010 (UTC)

Tim Song (talk) 05:58, 13 March 2010 (UTC)


 * All accounts listed are ✅ to have been editing from the same computer at some point. No comment on the IP addresses - you'll note from the WHOIS reports that most of those are AOL, so they could very easily be just about anyone else by now, even if they were used by this user at some point. Still looking to see if other accounts are involved. Hers fold  (t/a/c) 17:23, 17 March 2010 (UTC)


 * Maybe as well; hard to confirm since there's only one edit. Note that the account was created at Commons, so that may help. Hers fold  (t/a/c) 17:31, 17 March 2010 (UTC)


 * All accounts listed above are blocked. I'm leaving Richard4410 unblocked since there was only one edit and behavioral evidence is lacking. Tim Song (talk) 18:44, 17 March 2010 (UTC)


 * Also blocked, which seems to have been automatically created when it was renamed to . Tim Song (talk) 18:49, 17 March 2010 (UTC)

Evidence submitted by Ks0stm
It may be a hunch, but for some reason an IP address accused of being Showtime2009 in the last investigation returning to edit his signature on the WikiProject Severe Weather page seems very suspect to me and quacks loudly. Requesting checkuser because the checkuser in the previous case did not comment on the IP addresses (this one is not AOL as far as I can tell). Ks0stm (T•C•G) 19:36, 31 March 2010 (UTC)

Comments by accused parties
See Defending yourself against claims.

Clerk, patrolling admin and checkuser comments
Requested by Ks0stm (T•C•G) 19:36, 31 March 2010 (UTC)

I don't think a checkuser is necessary, as this is clearly a DUCK. From behavioral evidence, it looks as if the IP has been stationary for the past six months or so, so I'd recommend a decently long block here. Auntie E. (talk) 04:33, 2 April 2010 (UTC)

IP blocked 6 months. –MuZemike 20:37, 5 April 2010 (UTC)