Wikipedia:Suspected sock puppets/Fredrick day (2nd)

User:Fredrick day (2nd)

 * Suspected sockpuppeteer

(and other IP addresses, see Wikipedia talk:Suspected sock puppets/Fredrick day
 * Suspected sockpuppets

Abd (talk) 16:50, 14 April 2008 (UTC)
 * Report submission by

Attention was drawn to Seddon69 by from an IP suspected to be associated with Fredrick day, acknowledging that it was a "mobile edit from Seddon69," and his response to a query,.
 * Evidence

193.35.134.151 edits began appearing June 30, 2006 and continued until there were ten edits in October 2006. These edits largely ceased and Seddon69 began editing November 1, 2006, one day after the last edit in this sequence from 193.35.134.151, and made 21 edits on that day, then two edits on December 27, 2006. 193.35.134.151 made 9 more edits through January 17, 2007. Fredrick day then began editing January 21, 2007, very actively. Seddon69 did not reappear until June 2, 2007. Thereafter, sessions of Fredrick day edits alternated with sessions of Seddon 69 edits. 8,287 edits from Seddon69, Fredrick daytime, Fredrick day, and all identified IPs shown on Wikipedia talk:Suspected sock puppets/Fredrick day, were compared. The patterns are consistent with a single user, over thousands of edits and many sessions of edits, and the level of coincidence needed for these accounts to be independent is beyond reason.

Example of session alternation:

Seddon69....... 9:46	16-Oct-07 + 4 edits Seddon69....... 9:55	16-Oct-07 Fredrick day.. 10:55	16-Oct-07 + 16 edits Fredrick day.. 21:00	16-Oct-07 Seddon69...... 21:07	16-Oct-07 + 5 edits Seddon69...... 21:45	16-Oct-07 Fredrick day.. 22:27	16-Oct-07 + 14 edits Fredrick day... 0:24	17-Oct-07 

or this sequence when Fredrick day was IP vandalizing: 

87.113.64.63... 0:25	22-Mar-08 + 1 edit 87.113.64.63... 0:30	22-Mar-08[] 87.115.1.132... 0:37	22-Mar-08[] 87.115.1.132... 0:44	22-Mar-08[] 87.113.8.101... 0:47	22-Mar-08[] + 1 edit 87.113.8.101... 0:50	22-Mar-08[] 87.114.3.85.... 0:54	22-Mar-08[] + 3 edits 87.114.3.85.... 1:07	22-Mar-08[] 87.112.67.165.. 1:30	22-Mar-08[] + 6 edits 87.112.67.165.. 2:07	22-Mar-08[] 87.113.93.118. 12:48	22-Mar-08[] + 2 edits 87.113.93.118. 12:58	22-Mar-08 Seddon69...... 13:41	22-Mar-08 + 8 edits Seddon69...... 14:30	22-Mar-08 87.113.93.118. 18:36	22-Mar-08 + 5 edits 87.113.93.118. 19:42	22-Mar-08 Seddon69...... 20:10	22-Mar-08 + 11 edits Seddon69...... 22:29	22-Mar-08 87.113.93.118. 23:26	22-Mar-08 + 3 edits 87.113.93.118. 23:33	22-Mar-08[] 87.114.141.40.. 0:14	23-Mar-08[] + 9 edits 87.114.141.40.. 1:15	23-Mar-08 

Fredrick day was indef blocked 23 March, 2008, having been found to be vandalizing as an IP editor, see Suspected sock puppets/Fredrick day. In various edits, he indicated that he had other accounts used for more legitimate purposes, and that he intended to continue IP editing, as he did, provocatively. He showed that he knows how to use an open proxy, among other things, but the bulk of his blatant sock IP edits appear to come from the range 87.112.0.0 - 87.115.255.255 which is PlusNet, Sheffield, UK, with some (including what looks like stable IP) from 193.35.128.0 - 193.35.143.255 is Orange, Bristol, UK, so locations are compatible. --Abd (talk)

As to edit content, this appears to be a good hand account (Seddon69), with a bad hand account (Fredrick day), an openly nasty IP editor, and now Fredrick Dayton. There is an accusation that 193.35.134.151 has been used by User:MarkThomas, blocked for sock puppetry, see User:193.35.134.151. I have not investigated this possible connection yet.

I will email the spreadsheet with full data to any checkuser on request--Abd (talk) 16:50, 14 April 2008 (UTC)


 * Comments

I just received the notice on my talk page regarding this Suspected sock puppets case and so i wanted to respond to this as swiftly as possible. I fully admit editing from the Orange IP but as i have said this is from a mobile phone and is most likely a dynamic IP. I stated it was me who edited so that the edited not be considered vandalism. However i have only used this once and i was not aware of this user until the comment posted from User:Abd. After this comment i will edit this page from my IP address so that you can find out that i edit from BT broadband. Also i will request that someone from IRC makes a copy of the whois from that again to show i edit from BT. I welcome any checkuser that wishes to check my IP address and to compare the IP's. I hope that this can be resolved quickly. Seddon69 (talk) 18:32, 14 April 2008 (UTC)
 * This is User:Seddon69 editting from my Home IP. 86.143.124.153 (talk) 18:36, 14 April 2008 (UTC)


 * I'd love to be wrong. Seddon69 is a civil and active editor. However, I must note that Fredrick day has claimed to be able to use many different and providers, and he has shown himself capable of that. Notice that the single-user pattern edits are vast comparing Fredrick day and Seddon69 (if the checkuser does not have a tool to compare the thousands of edits involved, I can send a spreadsheet.) It is possible that the IP edit, allegedly from a mobile phone, might actually be that and that suspicion was thus unfairly drawn to Seddon69. However, it did establish that Seddon69 are operating in the same relatively small region. I was in doubt until I looked at all the edits together, it took me almost a week to get around to doing that. The evidence is strong (but not conclusive) that Seddon69 began editing from IP, the same range as in the report. The evidence that Seddon69 and Fredrick day are the same user is overwhelming. With certain precautions, Fredrick day may have been able to make the connection invisible to checkuser, we know he is capable of that. But it's hard to make yourself into two editors that don't sleep at the same time.--Abd (talk) 18:57, 14 April 2008 (UTC)

"Orange, Bristol, UK" - Orange is not a place in Bristol. UK IPs do not geolocate *at all* - I think I live in Manchester according to my current IP, and have been in Aberdeen in the past. Orange is a mobile phone network and provides access to the internet through GPRS/HSDPA edit: and ADSL, see below. It probably uses a very narrow gateway for this. Martinp23 18:45, 14 April 2008 (UTC)

The evidence seems sketchy to me, perhaps easily explained by coincidence. The IP correlation with that 195.*.*.* is something I feel confident ignoring, as it belongs to a mobile network which isn't at all static and is also (I've just realised! Bloody name changes Freeserve -> Wanadoo -> Orange) an ISP, using dynamic addresses again (from experience..). Plusnet: dynamic again, I believe. Geolocation: Massive pile of fail. Edit patterns: Evidence isn't really compelling. No evidence noted of abuse during !votes etc, or even of similar editing patterns (other than times, easily explained by saying they're in the same timezone). my thoughts, Martinp23 18:52, 14 April 2008 (UTC)


 * Yes, I am aware. The location is merely where the ISP has an address. Orange is also a direct internet provider, not only phone network. The phone connection may be a red herring, but the edit record is not. I presume that checkusers know what they are doing. However, the IP involved has clearly been long-term used by the same user, from article patterns. There is a *lot* more evidence than I have presented here. There are a few edits above, the complete study was of 8287 edits. If someone else has the tools, look, for example, at all the edits of Fredrick day and Seddon69. There *has* been double voting, in one case, but this is not a place to complain about such behavior, and, given the rest of what has happened, that is trivial. It is not just Fredrick day's account. Look at the other accounts on the SSP talk page linked above as well. It's a lot of work, which is why I've offered to send the spreadsheet to a checkuser. Soon as I know which one! This report is only filed for possible supplemental evidence, and sometimes checkuser reports show additional socks. If it's premature, that's fine with me, but I'd rather see a checkuser make that decision.--Abd (talk) 19:02, 14 April 2008 (UTC)


 * hum.. I've hum'd and err'd about responding to this in case it makes things worse for Seddon69, but then it's not really right for me to drop him in the shit by omission.

Let's do this a bit at a time.

1) Yes I am Fredrick day - blocked user.

2) I am not and have never been Seddon69, he has never been me.

let's look at the evidence presented by Abd, line by line, hopefully I can convince people we are not one and the same.

However, it did establish that Seddon69 are operating in the same relatively small region. - I have no idea how he has come to this conclusion. Yes we both live in the UK (which explains the fact that we both post at similar times) but the 'relatively small region' is the whole UK. The 193.XX address is the range for the mobile (or cellar) gateway provided by Orange, the largest mobile telecoms provider in the UK - this is used by @12 million users (off the top of my head)! The other problem, as mentioned by Martin is that UK isp generally don't geolocate, so the location given by WHOIS will generally bear no relationship to the location of the edit (and if you don't mind me saying - only a yank would think that Sheffield and bristol are relative!)

As for the "edit patterns", besides the fact that we operate in the same time zone, I cannot find, from looking at edit histories over the last year, of any occasion where our paths have crossed (didn't we used to have a tool that would check the contributions of two accounts for crossover? if so, can someone run it). --Fredrick Dayton (talk) 19:13, 14 April 2008 (UTC)


 * What has been studied is the timing of edits. It's pretty difficult for a single person to run two different active accounts without there being a correlation in edit timing. This is entirely apart from article crossover, which is normally a clue. There is, of course, some crossover; this is, indeed, how all the accounts but Seddon69 were identified. There is some crossover, I think I recall, of Seddon69 and IP associated with Fredrick day, very minor. It looks to me like Fd was quite careful to keep the accounts segmented. (Fredrick Dayton has likewise been mostly separate). There is even some interleaving of edits at certain times. Had this been done consistently, it would have been more difficult to detect the patterns, but it would still be possible. One person is not two people, two people who aren't connected with each other will show much more independence in the patterns than is present here. In any case, the evidence is now available, see Suspected sock puppets/Fredrick day (2nd)/Evidence. --Abd (talk) 04:16, 15 April 2008 (UTC)


 * I cannot offer much more than to say other than this. From the very first edit i made on wikipedia a year and a half ago until now i have only looked to contribute well to this project. I have never been banned, i have never 3RR'd except when fighting vandalism, i have never been accused of incivility towards users, I have never been posted as a problem on the administrators noticeboard. I have nominated an FA which passed and also a featured picture, have worked on problems on peoples GAN's, I mediate at WP:MEDCAB and i am in the middle of helping what was a backlog at WP:MEDCOM, I have taken steps to be open about my true identity, when receiving incivility from users i have never retaliated and have always looked to find a way around problems. I freely make email and irc options to allow people to contact me, despite not having a great talent at article writing i have always strived to improve my abilities steadily over time. If that isn't enough to show that i have nothing but good intentions for this project. I dont know what else i can do. Seddon69 (talk) 20:51, 14 April 2008 (UTC)
 * information from the ip i edit from at home. Seddon69 (talk) 21:06, 14 April 2008 (UTC)


 * There really isn't anything for you to do, Seddon69, if you are not Fredrick day. I'm human, I make mistakes. If I've made one, the community here has some pretty bright people who will be able to find what I've done wrong. I'm not on any crusade against you as an editor, and you could recite hosts of awards or achievements, it's basically irrelevant here. If you are not Fredrick day, I'd suggest not worrying about it. There are other people experienced with this kind of evidence, and I trust that truth will out. On the other hand, if you are Fredrick day, and you want to continue contributing here, the sooner you acknowledge what you have done, the easier it will be for you to resume your editing. My general advice is to trust in the truth. Any other alternative can make us pretty crazy.


 * One more thing. There are lots of avenues left for studying the data. In particular, I intend to test the method with some controls, and to look for ways to refine how the data is presented, to avoid certain biases that the present method seems to exhibit (it could make, under some conditions, unconnected accounts of certain kinds look connected. I don't think that's the case, but if I have erred, that would probably be connected with it). Believe me, if I find that I can exonerate you, I will rush here to do it. I have no investment in being right, only an obligation to disclose what I see.--Abd (talk) 04:29, 15 April 2008 (UTC)


 * I just looked through every edit by Seddon69 that's visible in checkuser. Basically it's pretty much a consistent pattern of perfectly normal editing behaviour, with occasional use of what look like shared IPs, as explained above. No evidence that I would say indicates any sort of bad behaviour. Any other checkers want to check? - David Gerard (talk) 21:12, 14 April 2008 (UTC)

Here is what I'd look for: edits to pages of interest to Seddon69 by IP from 87.112-87.115 range. I could eventually find these, if they exist, but I haven't started looking at the complete range. It may, however, be easier for me to find this, unless checkusers have some good tools -- I have no idea what tools are available. Similarly, I'd examine that IP range for other Fd IP or socks. As to the IP that Seddon69 has explained as being a friend's mobile phone, perhaps Fredrick day has been borrowing the same phone? Because three edits from that exact IP are linked to Fredrick day:

20:23, 9 April 2008 User talk:129.174.91.115‎  20:37, 8 April 2008 Wikipedia:Mediation Cabal/Cases/2008-01-13 24 character merging of minor characters‎ (Mobile edit by seddon69) 15:03, 24 March 2008 Wikipedia talk:Village pump (policy)‎ (this edit was made immediately upon revelation that Section 31 was Fredrick day.) 00:44, 3 March 2008 User talk:Fredrick day

Contrary to what is implied above, this IP shows consistent interest over time in certain articles, it is not dynamic IP, I'd suggest. (It's still possible it is shared in some way.) See Special:Contributions/193.35.133.151, and, in particular, these edits to Kaley Cuoco:       These edits come before, between, and after the edits linked to Fredrick day (and the sole one explicitly linked to Seddon69).


 * I hadn't looked at Abd (talk)

I'd like to make it clear that the spreadsheet showing all these accounts together in time sequence is plain as, well, day. If you are looking at each account alone, or only at IP evidence, I'm not surprised it would be murky, because this user is likely to have deliberately used different access for each account (such as multiple wireless networks accessible to him). I think I've laid out enough evidence that someone interested in identifying a sock would see it as a reasonably possible ID; only if I have displayed all I have would it be reasonable to rule it out or consider it weak. But I did a time and article coincidence study of almost 9,000 edits. The sequences above are not necessarily the clearest ones, merely ones I quickly found as interesting. I'm certainly not going to post the whole thing to a Wikipedia page! That's why I've suggested that a checkuser -- or other trusted user -- look at the spreadsheet. If I had found something different I'd have clearly exonerated Seddon69 from the charge that Sarsaparilla made. And if something is wrong with my analysis, I'd really like to know. Otherwise I'll go to my grave believing that I found a sock puppet and nobody wanted to listen.... (I don't know that nobody will listen, this isn't over yet....) Maybe I'll ask Durova.... --Abd (talk)

* [Seddon] (n=chatzill@host86-132-128-87.range86-132.btcentralplus.com): Sun, Sex, Sin, Death and Destruction * [Seddon] #wikipedia-en-roads #wikipedia-en * [Seddon] irc.freenode.net :http://freenode.net/ * [Seddon] End of WHOIS list

Result of a whois on Seddon69 through IRC. Seddon has been a user in good standing for quite a while; I find it highly unlikely that he's a sock of a blocked user. —Scott5114↗ [EXACT CHANGE ONLY] 00:48, 15 April 2008 (UTC)

Please see Suspected sock puppets/Fredrick day (2nd)/Evidence for a wikified spreadsheet, cut down a bit to eliminate unnecessary information. What was cut was long series of edits from only one account, with no intervening edits from another. What I have considered conclusive is the data in this table, in addition to circumstantial evidence mentioned before; if I have erred, I would appreciate correction. I actually hope that I'm wrong, but it appears that Seddon69 was a good hand account, with Fredrick day intended as the bad hand, and with IP edits for the really nasty stuff. I have seen no problem editing from Seddon69, so I have no wonder that there would be editors unhappy with this. What to do about it is an entirely separate issue. This report does not ask for any punitive measures, this is only to establish the fact. --Abd (talk) 04:05, 15 April 2008 (UTC)


 * I would like to request that no extreme comments be directed at any user in this SSP case especially from what i assume was from Fred Deyton. Abd is doing one role that is necessary on wikipedia. I know that he is mistaken but like everything on wikipedia we must let this process run its course. I request that if user want to contribute to this SSP that they concentrate on the location of my internet provider which i know to be BT broadband, and also the edits that i have made and to realise that i think my contributions should be part of people assuming good faith.


 * I would like to bring people attention in the evidence list to 13:27 24-Mar-08 where supposedly i would have had to sign out of seddon69 where i was editting an article in my userpsace, then sign in to the Phil McCavity account that is i believe a confirmed sock of Fred, then in 60 seconds make an edit, sign out, sign back in to seddon69 and then make another edit. It seems a little far fetched. As has been said previously that the fact i edit at the same time as someone in the UK simply isn't good enough evidence. I don't know what i would have to do to go about and edit from an open proxy IP even if i wanted to. Seddon69 (talk) 11:13, 15 April 2008 (UTC)


 * I've added User:Fredrick Dayz above, since his edits to the Copyvio notice board as well as his own user and talk page, closely resemble that of Frederick Dayton. --Tikiwont (talk) 13:53, 15 April 2008 (UTC)

I would like to note that the following edits could not have been made by me. This is due to the fact i was college at these times. I will go even further back through the edit history if necessary but if we are going to throw WP:AGF completely out of the window then tell me what evidence you need and i will get it for you. I have taken into account the time difference between UTC time and the current BST:
 * Anomolies in evidence


 * Edits by 218.56.8.72
 * 14:54, April 7, 2008
 * 11:57, April 7, 2008


 * Edits by 82.77.190.85
 * 14:11, April 9, 2008


 * Edits by Fredrick day
 * 15:52, April 10, 2008
 * 15:50, April 10, 2008
 * 15:49, April 10, 2008
 * 10:34, April 10, 2008
 * 10:32, April 10, 2008

Seddon69 (talk) 19:34, 15 April 2008 (UTC)

Ah-ha, I know how we put this one to bed. During January and feb, some of my edits might resolve to hotel networks as I think I did some editing while away for work. Since we have established that Seddon69 has a BT ip, if he posts on the same days then that should finish this one off (unless abd wants to suggest he was booking into hotels, making a couple of edits and then driving home all within a couple of hours). Checkuser should pick them up those odd ip edits in my history during that timeperiod (I'll have to dig out my diary to find the days and it's in the office, I'll have to pick it up tomorrow). --87.115.17.90 (talk) 19:47, 15 April 2008 (UTC)


 * Conclusions
 * blocked as block-evading sock. Sarcasticidealist (talk) 19:43, 14 April 2008 (UTC)
 * has also been blocked indefinitely, for the same reason. Sarcasticidealist (talk) 19:02, 15 April 2008 (UTC)
 * is ❌ insofar as behavioural and editorial evidence can ascertain. Anthøny 00:12, 16 April 2008 (UTC)
 * Evidence suggests the IPs being related are, but further to my review, evidence is . Anthøny 00:14, 16 April 2008 (UTC)