On 21 May 2009, The Red Peacock was blocked for a month. On 25 May, the account John Asfukzenski was created. Both were inactive for a long period until Showtime2009 created Wikipedia:Articles for deletion/Andrea Tantaros, where The Red Peacock and John Asfukzenski turned up to support deletion (and were the only users to do so). All three recommended deletion again at Wikipedia:Articles for deletion/Angry white male (3rd nomination) (along with IP sock 172.163.150.240). For The Red Peacock, these are his/her only AFD comments. Below are some article-specific "coincidences":
Atfree market, The Red Peacock made a large blanking. John Asfukzenski edited two minutes later, hiding the removal from watchlists. Asfukzenski and 63.215.29.202 later attempted the same blanking several times without an edit summary. 172.163.142.128 and 172.129.69.245 were used for the "vandal role".
If you look at those edits, you will see I was reverting the ip edits and was not participating in the disruptive editing. Richard (talk) 22:10, 16 March 2010 (UTC)[reply]
In November 2009, I discovered similar patterns (or, in some cases, the same edits) as described above - involving Showtime2009, John Asfukzenski, The Red Peacock, several 172... AOL IPs, 63.215.29.202, 63.215.29.212 and another account that I would like to add to the investigation:
Back then I contented myself with reverting the unexplained deletions and other POV edits that had been "covered" by such subsequent IP vandal edits. I began to prepare a SPI request but didn't finish it. Below, I reproduce the sockpuppet evidence I collected back then (apologies for some overlaps with Prolog's material):
Ted Poe: John Asfukzenski removes a large portion of text (including 14 references), immediately afterwards the whole article is blanked by AOL IP 172.164.186.155, two minutes later Richard reverts the IP to John Asfukzenski's version
Four minutes later the same pattern repeats at Dick Morris: The Red Peacock removes several sourced statements without explanations, one minute later the same AOL IP blanks the page, only to be reverted immediately by Richard
Free market: In this edit, John Asfukzenski removed almost 10 kByte of mostly referenced text without explanation, followed one minute later by AOL IP 172.163.142.128 blanking the whole article, which in turn is reverted two minutes later by Richard.
Individualism: Showtime2009 removes the entire "Criticism" section and other content without explanation. Four minutes later, AOL IP 172.129.169.21 makes a minor edit to the same article. Nine minutes later, the same IP self-identifiesasUser:Showtime2009.
63.215.29.212 (talk·contribs) showed the same pattern (examples [1], [2]inJohn Hostettler on 16 September 2009, [3] on 11 June 2009 in the Dick Morris article, which in November 2009 saw similar edits by The Red Peacock, 63.215.29.202, Showtime2009 and Richards, as described above).
Another pattern common to some of the accounts is the addition of negative material, sourced from Cybercast News Service (formerly Conservative News Service), to the BLPs of Democratic U.S. politicians:
Snakemeets012: [4][5], John Asfukzenski: [6][7], The Red Peacock: [8]
Answer to the comment by Richard above: "If you look at those edits, you will see I was reverting the ip edits..." - read the evidence again, that is exactly what is said there. "reverting the ip edits" is part of the described disruptive editing pattern: The IP vandalism followed by a revert have the effect of "hiding" the previous, controversial edit from other users' watchlists, which appears to have been intentional.
In any case, the point was not that these edits are vandalism in themselves, but that they make it likely that the account Richard is operated by the same user.
Another independent piece of evidence connecting Richard to the group is the use of reflinks, a not very widely used tool:
Richard: e.g. [9], Showtime2009: e.g. [10], Snakemeets012: e.g. [11]
All accounts listed are Confirmed to have been editing from the same computer at some point. No comment on the IP addresses - you'll note from the WHOIS reports that most of those are AOL, so they could very easily be just about anyone else by now, even if they were used by this user at some point. Still looking to see if other accounts are involved. Hersfold(t/a/c)17:23, 17 March 2010 (UTC)[reply]
Administrator note All accounts listed above are blocked. I'm leaving Richard4410 unblocked since there was only one edit and behavioral evidence is lacking. Tim Song (talk) 18:44, 17 March 2010 (UTC)[reply]
It may be a hunch, but for some reason an IP address accused of being Showtime2009 in the last investigation returning to edit his signature on the WikiProject Severe Weather page seems very suspect to me and quacks loudly. Requesting checkuser because the checkuser in the previous case did not comment on the IP addresses (this one is not AOL as far as I can tell). Ks0stm(T•C•G)19:36, 31 March 2010 (UTC)[reply]
Clerk declined I don't think a checkuser is necessary, as this is clearly a DUCK. From behavioral evidence, it looks as if the IP has been stationary for the past six months or so, so I'd recommend a decently long block here. Auntie E. (talk) 04:33, 2 April 2010 (UTC)[reply]
Completed: Reviewed by a Checkuser, results and comments are below. Requested by Prolog (talk) 05:06, 13 March 2010 (UTC) [reply]
Clerk endorsed Tim Song (talk) 05:58, 13 March 2010 (UTC)[reply]
Confirmed to have been editing from the same computer at some point. No comment on the IP addresses - you'll note from the WHOIS reports that most of those are AOL, so they could very easily be just about anyone else by now, even if they were used by this user at some point. Still looking to see if other accounts are involved. Hersfold (t/a/c) 17:23, 17 March 2010 (UTC)[reply]
Administrator note All accounts listed above are blocked. I'm leaving Richard4410 unblocked since there was only one edit and behavioral evidence is lacking. Tim Song (talk) 18:44, 17 March 2010 (UTC)[reply]
Declined, the reason can be found below. Requested by Ks0stm (T•C•G) 19:36, 31 March 2010 (UTC) [reply]
