MrRosstheScientist ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)

09 December 2021

Suspected sockpuppets

• Scantydu ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• Billbob104 ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Two days after MrRosstheScientist's block, and while MrRosstheScientist was submitting an unblock request, Scantydu's account was created. Both accounts solely focused on editing the articles Google Santa Tracker and NORAD Tracks Santa to sound like Santa exists and is actually tracked by those services. Both users have similar incorrect grammar, misspellings, and all-caps words on their user pages and in talk page messages. Tol ( talk | contribs) @ 04:07, 9 December 2021 (UTC) reply

Both users have also used Template:Retired on their talk pages with a similar tirade against other editors. I'd also like to note that I opened this after @ Loew Galitz suggested sockpuppetry at Wikipedia:Administrators' noticeboard/Incidents#User:Scantydu ( permalink). Tol ( talk | contribs) @ 04:12, 9 December 2021 (UTC) reply

I've added User:Billbob104 due to this edit, where the account — which was created right after Scantydu's last edit — inexplicably shows up at the aforementioned ANI thread. Tol ( talk | contribs) @ 04:16, 9 December 2021 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• The QUACKING is extremely loud. GoodDay ( talk) 04:18, 9 December 2021 (UTC) reply
• Billbob104 ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
  Jumped to defense of Scantydu in AN/I after two (reverted) edits. Familiar with Wikipedia parlance; I guess more socks /sockmaster around. Edits of Scantydu look more like trolling than genuine conviction. Loew Galitz ( talk) 04:18, 9 December 2021 (UTC) reply
• 106.206.202.92 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser ( log))
  Realised I should have placed this here: 106.206.202.92 made this questionable diff on 5 December, which has the hallmarks too. Theknightwho ( talk) 15:01, 9 December 2021 (UTC) reply

  Perhaps Santa's been drinking and driving again. Must be losing it in the run-up to Christmas. Theknightwho ( talk) 16:22, 9 December 2021 (UTC) reply

Clerk, CheckUser, and/or patrolling admin comments

Also:

• 2600:1000:B052:A666:CF7:C037:13ED:D775 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser ( log))

tag-teaming with Billbob104. DMacks ( talk) 04:45, 9 December 2021 (UTC) reply

• All named accounts have been blocked, so  Clerk declined for now. One more duck and a check would probably be advisable just to see if this ties back to someone we already know. As to the IP, yep, and looks they've been disruptive on that range for a bit now, with the /41 already pblocked by Ohnoitsjamie. Special:Contribs/2600:1000:B000::/41 looks like it might have some collateral damage (although those might be less-problematic edits from the same person, but the assigned /44's all disruption for the past 13 hours, so  Awaiting administrative action ​: Please block 2600:1000:B050::/44 with expiry 32 hours (anon. only, account creation disabled). Also, revdel may be needed for some of the edits to Christopher Stone (actor) (  | talk | history | protect | delete | links | watch | logs | views). -- Tamzin ^{cetacean needed} (she/they) 05:03, 9 December 2021 (UTC) reply
  • Range blocked and edits poofed. DMacks ( talk) 05:12, 9 December 2021 (UTC) reply
• Thanks, DMacks. Accounts  Tagged. Closing. -- Tamzin ^{cetacean needed} (she/they) 05:31, 9 December 2021 (UTC) reply

  It has been brought to my attention, by a party whose name I will omit given the great sensitivity of the matter, that I requested a 32-hour block of the range when I should have requested a 31-hour block. Obviously, 31 hours is a block length arrived at by great amounts of research and consideration, while 32 hours is arbitrary and patently excessive. Not even the worst vandal deserves to be blocked for a number close to 31 hours but not exactly that length. I apologize profusely. Sadly, as we all know, the extra hour is the one the block starts with, so it is too late to reverse course here. / s -- Tamzin ^{cetacean needed} (she/they) 07:39, 9 December 2021 (UTC) reply

  That's it...the 10% pay-raise you were about to get is gone. makes *yoink* gesture followed by paper-shredding motions. DMacks ( talk) 08:00, 9 December 2021 (UTC) reply

• @ Theknightwho: Peculiar... This one's in India (on a weirdly quiet range), while the more recent IP is in the U.S. Neither appears to be a proxy. If this continues, I guess its transcontinental nature will be one of the things we have to figure out. Hopefully they'll just get bored, though. -- Tamzin ^{cetacean needed} (she/they) 16:08, 9 December 2021 (UTC) reply

  ( edit conflict)@ Theknightwho: Actually, I realized ( a.k.a. I had it pointed out to me, although not by the same person concerned about 31 vs. 32) that all we really know about Billbob is that they're also the IPv6, that they trolled ANI on behalf of Scantydu, and that they have some writing-style similarities but no "smoking gun" ones, which leaves open the possibility of being some other vandal/LTA, a possibility made more likely by the geolocations. So, I've downgraded that tag from "proven" to "blocked". For the avoidance of confusion, I'm saying that, behaviorally, MRtS == Scantydu == 106.206.202.92 and Billbob == 2600:1000:B050::/44. Behaviorally the two groups are likely each other, but the geolocation brings this down to "possible". Again, I'll endorse a check if this continues. -- Tamzin ^{cetacean needed} (she/they) 16:33, 9 December 2021 (UTC) reply

• On simplewiki, they seem to be using the
  • 2401:4900:3B00:0:0:0:0:0/40 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser ( log))

range according to histories of simple:NORAD Tracks Santa and simple:Google Santa Tracker. And simple:User:MrRosstheScientist is also active on simplewiki. But that range is silent on enwiki and the 2600:1000:B050::/44 range is not being used on simple. DMacks ( talk) 17:37, 9 December 2021 (UTC) reply

Looks like that /40 is part of a /34 that's indeffed on en, although I can't explain the reverse phenomenon on simple. Regardless, I've rv'd and speedy-tagged their edits on simple. Pinging Vermont for xwiki assist, if they're available; noting that simple:Special:Contributions/MrRosstheScientist and simple:Special:Contributions/Scantydu have both made edits. -- Tamzin ^{cetacean needed} (she/they) 17:52, 9 December 2021 (UTC) reply

It appears to go a bit more than the /34. See this /32. As for the accounts, those two are confirmed to each other. Handled on simple and reported to SRG. Thanks for the ping. Vermont ( talk) 23:32, 9 December 2021 (UTC) reply

Thanks, Vermont. That /32 and its block log were already marked as visited for me, and you know that's never a good sign. I wonder if it's time to just give the whole range a few weeks off, at least from mainspace/talkspace. But I suppose that goes beyond the scope of this SPI at the moment. -- Tamzin ^{cetacean needed} (she/they) 23:46, 9 December 2021 (UTC) reply

• I'm relisting this for another checkuser to review. I think these are all Wikipedia:Sockpuppet investigations/Rrmmll22. They're on the same /44 (check my CU log from today for specifics) but I don't have time to do a thorough check as I'm heading out shortly. If I'm correct the accounts tagged as MrRosstheScientist need to be retagged.-- Jezebel's Ponyo ^{bons mots} 19:14, 9 December 2021 (UTC) reply
• The two groups Ponyo mentioned are  Unrelated as far as I can tell, unless i'm missing something. -- Amanda (aka DQ) 17:07, 10 December 2021 (UTC) reply

  @ AmandaNP: Just to clarify, does this mean MRtS == Scantydu, per Vermont's simplewiki check? And does it mean that Billbob is indeed unrelated? -- Tamzin ^{cetacean needed} (she/they) 20:52, 10 December 2021 (UTC) reply

  They are  Confirmed per local checks here. -- Amanda (aka DQ) 01:42, 11 December 2021 (UTC) reply

  @ AmandaNP I'm not sure I'm parsing what you wrote correctly, i.e. I'm not sure who "They" refers to. I think what you're saying is "Scantydu and Billbob are both confirmed to MrRosstheScientist". Is that correct? -- RoySmith (talk) 02:26, 17 December 2021 (UTC) reply

  We spoke off line, I'll mark Scantydu as confirmed, and leave Billbob as suspected. -- RoySmith (talk) 02:52, 17 December 2021 (UTC) reply

  Confirming it was MRtS and Scantydu. Billbob104 is  Unrelated as far as I can tell. -- Amanda (aka DQ) 02:53, 17 December 2021 (UTC) reply