Wikipedia:Long-term abuse/Andrew5

Andrew5

Wikilifespan	April 2019 - present
ISP	Altice USA, occasionally Verizon and AT&T
Known IPs	47.16.96.33, 71.125.62.0/24, 170.24.150.0/24, 69.116.96.0/24, etc.
Physical location	Nassau County, New York
Sockpuppet investigations	Wikipedia:Sockpuppet investigations/Andrew5
Instructions	Suspected socks should be reported to the SPI listed above, and SRG if they are locally blocked. Most IPs and associated ranges should recieve extended blocks (6 months-2 years) as they are known to return under previously blocked, static IP addresses and different IPs under smaller ranges. Personal attacks and/or threats made towards other editors can be revdelled as necessary, and more personal threats that the editor makes may be reported to emergencywikimedia.org or cawikimedia.org.
Status	Active

Basic information

Andrew5 (talk · contribs · block log · arb · SPI ^confirmed _suspected)
Comprehensive edits analysis
XTools Timecard

This user is a persistent sockmaster from Long Island who abusively uses multiple accounts and public IP addresses, often editing articles related to notable tropical cyclones, as well as winter storms and tornado outbreaks which have occurred recently. Edits may appear to be good faith, and some may be kept as minor improvements, but most information they add is trivial and unnecessary to include within articles.

Targeted areas, pages, themes

Notable, post-2010 tropical cyclones, winter storms that occurred in the 2020s, recent tornado outbreaks, and sports-related articles, especially baseball and ongoing seasons for MLB teams are frequent targets for this sockmaster. They may engage in protection-related disruption of Israeli-Palestinian topic areas as well. Outside of the English Wikipedia, they target talk pages of editors who report their sockpuppetry, and noticeboards of the sites which Andrew5 attacks them on.

Habitual behavior

• Seemingly legitimate edits which usually include minor details about weather events, often ones that affect the Northeastern United States, such as daily rainfall records within cities, road closures of roadways in certain regions, and closures of parks which may take place during storms. Some of these edits may be kept as minor improvements, but most are trivial and don't need to be included.
• Inclusion of controversial details and starting conflicts on such details. (example)
• Resubmitting declined drafts and asserting that the editors who declined the draft were doing so in a way that was invalid. (example)
• Including sources for damage totals that aren't from NOAA and starting numerous conflicts/discussions regarding the source, then dubiously attempting to justify their inclusion. (example)
• Engages in revert-warring across multiple different accounts and IPs when their edits are removed. They do so in an attempt to keep their edits in articles, citing policies such as the three-revert rule to prevent editors from reverting.
  • It is suggested that when accounts or IPs revert edits, they should be reported to administrators or stewards for blocking/locking. Wait until they are blocked, and then revert their edits. This page, Wikipedia:Long-term abuse/Andrew5, may also be linked in edit summaries to help explain why reversions are taking place. This essay is helpful to remember when reverting sockpuppets of theirs, and provides multiple avenues for reporting socks and requesting revision-deletion on the English Wikipedia.
• In addition to above, when being reverted, they may attempt to justify the edits made by their other sockpuppets, sometimes including personal attacks or threats within edit summaries (which may be revdelled, if necessary).
• They may make sleeper accounts to gain auto-confirmed status, making a number of "good" edits to weather or sports-related articles before engaging in vandalism on semi-protected pages. (Examples: CrossBayFan (also see meta-wiki contribs), 89.41a, StormsFan)
  • Usernames of sleeper accounts typically reference being a fan of Taylor Swift, are variations of previous sock names, are in CamelCase with the suffix "-Fan" and often, but not always, include multiple numbers at the end, or are a combination of these frequent username patterns.
• Posting unblock requests that focus on the nature of the IP's (saying it's a school or train station) and emphasizing how many people are affected.
• Requesting pre-emptive protection on articles under contentious topics (usually Israel-Palestine based on an ArbCom ruling) where no disruption or disputes have recently occurred. They may vandalize such articles (as well as relevant discussion pages) in order to get them protected. (example of protection request, example of vandalism)
• They target people who report/block their sockpuppets or revert their edits by harassing them cross-wiki, spamming talk pages with personal attacks and threats, which, again, may be revdelled if necessary. If you personally feel threatened, feel free to email emergencywikimedia.org or cawikimedia.org with information regarding the threat.
• They accuse other editors of paying administrators to block their sockpuppets. (example)
• Reports may be made on cross-wiki administrator noticeboards to attack the editors who report their sockpuppets or revert their edits, such as this discussion on the English Wikipedia, or this discussion on Wikimedia Commons.
• They may register usernames which impersonate, attack, or harass users as well. (Impersonation examples: WėatherWritor impersonating WeatherWriter, United States Stan impersonating United States Man, & on Meta-Wikimedia, multiple accounts named CheeseEric impersonating ChessEric)
  • Usernames registered to attack or harass editors should be privately reported to stewards for locking and/or hiding, which can be done by following the instructions here.
• They habitually seem to know about SPIs and are known to randomly comment related to the SPI, even if the reporter has not interacted with the account being reported.

Other notes

• They have been blocked indefinitely on Uncyclopedia under Gale5050, for incivility and personal attacks. Multiple sockpuppets were created there as well in an attempt to evade their block.

Confirmed and suspected accounts

• Sockpuppet category (if any): Category:Wikipedia sockpuppets of Andrew5
• Suspected sockpuppet category (if any): Category:Suspected Wikipedia sockpuppets of Andrew5