Wikipedia:Sockpuppet investigations/Andrew5

{{SPI case status|close}}

{{socklist|1=2600:387:15:5316:0:0:0:4|tools_link=yes}}

Undid my prior reversion of a likely sock at Tornadoes in Chicago. Follows per this LTA's IP-hopping habits. Departure– (talk) 15:04, 29 April 2025 (UTC)

:Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

:Here's a diff of Ponyo acknowledging the previous user as a DUCK sock. Special:Diff/1287835741 is the edit from this IP I'm referring to. Departure– (talk) 15:07, 29 April 2025 (UTC)

::{{u|Izno}} The relevant range you should be blocking is {{rangevandal|2600:387:15:4000:0:0:0:0/51}}. All of Andrew's editing habits are here, from weather related discussions to his most recent interest in U.S. elections. wizzito | say hello! 06:51, 30 April 2025 (UTC)

:::e.g. see history of Tropical Storm Debby (2012) and 2026 United States House of Representatives elections in Virginia wizzito | say hello! 06:52, 30 April 2025 (UTC)

::::That's a busy /51 just to block Andrew5, who also hasn't returned on that range today. Izno (talk) 15:34, 30 April 2025 (UTC)

:::::Izno, following up with you to note that Andrew was active on the range and continues to be active on it as of May 9. See {{IPvandal|2600:387:5:803:0:0:0:1D}} and {{IPvandal|2600:387:15:5118:0:0:0:4}} wizzito | say hello! 00:48, 10 May 2025 (UTC)

::::::We could also independently block {{rangevandal|2600:387:5::/52}} and {{rangevandal|2600:387:15::/49}}, since those are the two most active ranges right now. (also forgot to ping you {{u|Izno}}) wizzito | say hello! 01:32, 10 May 2025 (UTC)

:::::::Both of those ranges still have too much good faith activity on them to issue range blocks. Izno (talk) 05:10, 11 May 2025 (UTC)

::::::::{{u|Izno}} so how the hell are we supposed to stop him from editing? wizzito | say hello! 00:51, 12 May 2025 (UTC)

:::::::::This is his most active range now by far and if we don't issue blocks he will keep going. wizzito | say hello! 00:53, 12 May 2025 (UTC)

:::::::::Your option is to convince someone more willing to block that much good faith activity. WP:ANI is a good way to surface such users. This category is another. Otherwise you're more or less SOL and you have to resort to page protection. Izno (talk) 00:53, 12 May 2025 (UTC)

::::::::::Another alternative is to request a filter for the relevant ranges. Izno (talk) 00:54, 12 May 2025 (UTC)

::::::::::I'll ask another recent blocking admin, Ponyo, for a second opinion. The problem is the pages are so varied that an edit filter and page protections don't do much unless he's on one of his revert chains. wizzito | say hello! 00:57, 12 May 2025 (UTC)

:::::::::::I replied to Ponyo on their talk page. wizzito | say hello! 23:36, 13 May 2025 (UTC)

• Blocked, but meant to block not-the-/64 because of the weird addressing. Sigh. Izno (talk) 16:21, 29 April 2025 (UTC)

::{{PING|Wizzito}} I have no problem semi-protecting their most common targets. Are there articles when Andrew5 is currently active that are not semi-protected? You can provide me a list on my talk page.-- Ponyo^{bons mots} 20:43, 12 May 2025 (UTC)

----

===14 May 2025===

{{SPI case status|close}}

====Suspected sockpuppets====

{{socklist|1=72.159.224.92|tools_link=yes}} DUCK activity at Tornadoes in Chicago. Departure– (talk) 15:12, 14 May 2025 (UTC)

====Comments by other users====

:Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

====Clerk, CheckUser, and/or patrolling admin comments====

• 1 edit's not enough even to issue a block. Re-report to AIV if editing resumes. Izno (talk) 17:08, 14 May 2025 (UTC)
• :I beg to differ. This edit by the accused is almost the exact same as this, this, this, and this, each by blocked Andrew5 socks, and it came less than 24 hours after page protection was lifted. Departure– (talk) 17:21, 14 May 2025 (UTC)
• ::In this case, I say it not because I do not think it proves innocence or guilt, but because blocking an IP with a single edit is a waste of time. See WP:BLOCKPREVENTATIVE. Izno (talk) 17:22, 14 May 2025 (UTC)
• :::Do you think the page's protection should be reinstated? Departure– (talk) 17:23, 14 May 2025 (UTC)
• ::::WP:RFPP is <- that way. Izno (talk) 17:24, 14 May 2025 (UTC)
• :::::I'm not specifically asking for it to be protected, but I want to know your input as a more versed editor than I. Departure– (talk) 17:25, 14 May 2025 (UTC)
• ::::::RFPP is the right place to ask about whether protections should be (re)instated, which is my opinion as a more versed editor. If there was a previous protection due specifically to Andrew5, yes, it's probably the case it should be reinstated, but RFPP has admins smart enough to know whether that's enough to protect a page. Izno (talk) 17:28, 14 May 2025 (UTC)
• :::::::Alright, I'll keep an eye out for any more disruption, revert the edit for now (as a likely sock), and bring this to RFPP if this happens again. Cheers! Departure– (talk) 17:29, 14 May 2025 (UTC)

{{outdent}} Closing the loop here, I've restored the protection.-- Ponyo^{bons mots} 17:47, 14 May 2025 (UTC)

----

{{SPI case status|}}

{{sock list|1=0ram2025|tools_link=yes}}

0ram2025 focuses on U.S. elections and politics (a relatively recent interest of Andrew5 - see blocked sock {{vandal|WisconsinSupporter}} as one example, although editing talk pages instead), shows knowledge of citation templates, and adds large amounts of information in relatively few edits. These fit with patterns of previous socks. The main difference is that 0ram2025 is using the "cite web" template as opposed to the "cite news" template used by previous socks, including [https://en.wikipedia.org/w/index.php?title=Tornado_outbreak_and_floods_of_April_2%E2%80%937,_2025&diff=prev&oldid=1284141685 Easteregg9999]. Previous socks Easteregg9999 and [https://en.wikipedia.org/w/index.php?title=February_2025_North_American_storm_complex&diff=prev&oldid=1279181300 Scramblis2822], as well as [https://en.wikipedia.org/w/index.php?title=Ghazala_Hashmi&diff=prev&oldid=1286892378 0ram2025], do not add author names to their citations. wizzito | say hello! 23:54, 14 May 2025 (UTC)

:Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

----

{{SPI case status|closed}}

{{sock list|1=ScratchTheBack21|tools_link=yes}}

This new user's only edit so far is to [https://en.wikipedia.org/w/index.php?title=Template:Hurricane_Dorian_related&diff=prev&oldid=1290423609 undo a likely sock revert done by admin Ponyo]. Many other socks have been created by Andrew5 just to undo revert chains; see MrBeast370 as one example. The username is also in CamelCase - a pattern noted on the LTA page. wizzito | say hello! 05:20, 15 May 2025 (UTC)

:Said user is now reverting previous reversions of sock-edits and throwing insults. Definitely a sock. MarioProtIV (^talk/_contribs) 12:55, 15 May 2025 (UTC)

::Your wrong.--ScratchTheBack21 (talk) 12:56, 15 May 2025 (UTC)

::NPA violations, anyone? Departure– (talk) 12:56, 15 May 2025 (UTC)

:Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

This account was glocked today by {{u|XXBlackburnXx}} as an LTA. Pickersgill-Cunliffe (talk) 13:05, 15 May 2025 (UTC)

----

{{SPI case status|Closed}}

{{socklist|1=Senilinity11|tools_link=yes}}

DUCK activity at the template targeted previously. Requesting a CU to check for sleepers. Departure– (talk) 16:05, 15 May 2025 (UTC)

:Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Already blocked, no obvious sleepers. Recent target articles semi-protected.-- Ponyo^{bons mots} 21:01, 15 May 2025 (UTC)

----