Wikipedia:Sockpuppet investigations/Hamish Ross/Archive

Report date January 22 2009, 22:29 (UTC)

 * Suspected sockpuppets:

is indefinitely blocked for vandalism and created hundreds of sockpuppets in 2007 and early 2008, some of these have been used recently. A new account,, has a similar username and has edited the Court usher article, including the restoration of content originally added by , and , accounts that were blocked as a result of Requests for checkuser/Case/Boris Allen and appear to be sockpuppets of . â Snigbrook  22:29, 22 January 2009 (UTC)
 * Evidence submitted by â Snigbrook
 * I've added the IP based on these edits:  (similar to this: and other vandalism by User:Hamish Ross sockpuppets. â Snigbrook  22:45, 22 January 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by â Snigbrook 22:29, 22 January 2009 (UTC)
 * CheckUser requests


 * Clerk, patrolling admin and checkuser comments

IP blocked. Nishkid64 (Make articles, not wikidrama) 05:13, 23 January 2009 (UTC)
 * Conclusions
 * ✅ the following:

Report date February 8 2009, 22:40 (UTC)

 * Suspected sockpuppets:

The account was created on 22 November 2007, around the time that many sockpuppets of  were created. The user started editing a few days ago and has tagged a large number of accounts (most already blocked) as socks of User:Hamish Ross (many of the user's blocked accounts had added sock tags to their own talk pages recently). User:Cp fan has also pretended to be an administrator, creating a user page with an administrator template and declining an unblock request. At least two currently unblocked accounts were tagged, which were, created in January 2009 (this edit and the username make it likely to be a sock), and , created in November 2007, who I had already suspected to be a sock and mentioned to an administrator (the account, with no contributions, tried editing from a rangeblocked IP in September 2008, see unblock request and compare that IP's unblock requests around the same time with unblock requests by ). User:Cp fan also tagged the IP used by User:Computer whizz-kid as a sock. — Snigbrook 22:40, 8 February 2009 (UTC)
 * Evidence submitted by — Snigbrook


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by — Snigbrook 22:40, 8 February 2009 (UTC)
 * CheckUser requests
 * - Tiptoety  talk 05:46, 9 February 2009 (UTC)


 * Clerk, patrolling admin and checkuser comments

IPs blocked (one is high volume, so it has been softblocked). Nishkid64 (Make articles, not wikidrama) 06:42, 9 February 2009 (UTC) Mayalld (talk) 07:48, 9 February 2009 (UTC)
 * Conclusions
 * is . The following are ✅ as Hamish Ross:
 * Blocked and tagged. Tiptoety  talk 15:21, 9 February 2009 (UTC)

Report date March 4 2009, 21:54 (UTC)

 * Suspected sockpuppets

Blatantly obvious sockpuppet, sleeper account registered in November 2007, activated today just after many other sockpuppets were blocked in the previous checkuser request. Listing to check for more sleeper accounts, apparently this one was missed so there may be others. Mango juice talk 21:54, 4 March 2009 (UTC)
 * Evidence submitted by Mango juice talk
 * Added ; see discussion at WP:ANI for further details. Mango juice talk 21:58, 4 March 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by Mango juice talk 21:54, 4 March 2009 (UTC)
 * CheckUser requests
 * - To check for sleepers. Tiptoety  talk 23:41, 4 March 2009 (UTC)


 * Clerk, patrolling admin and checkuser comments


 * Conclusions
 * , no sleepers found. As I mentioned at AN/I, all accounts are socks of . Please move this case to Hamish Ross's SPI page. Nishkid64 (Make articles, not wikidrama) 04:40, 5 March 2009 (UTC)
 * ✅ - Next time please use Clerk Request. Thanks, Tiptoety  talk 23:19, 5 March 2009 (UTC)

Report date March 9 2009, 19:30 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by Jayron32. talk . contribs


 * Same MO as prior Hamish Ross/Possum Pint socks: Admin impersonations, incivility, etc. etc. Like earlier Hamish socks, these were all part of the same sock farm, created in November/December 2007.  Need to uncover other sleeper socks and block underlying IPs to minimize further disruption.  --Jayron32. talk . contribs  19:30, 9 March 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by Jayron32. talk . contribs 19:30, 9 March 2009 (UTC)
 * CheckUser requests


 * - Tiptoety  talk 19:32, 9 March 2009 (UTC)


 * Clerk, patrolling admin and checkuser comments


 * IP provisionally blocked, pointing users to ACC and IPBE in the block summary, as there is quite a lot of collateral. I'll try to keep an eye on it causes problems. Dominic·t 20:54, 9 March 2009 (UTC)


 * Conclusions

Report date March 10 2009, 18:24 (UTC)

 * Suspected sockpuppets

These accounts were created between 5pm and 6pm, the first account created user and user talk pages, then made a few edits, enough to become autoconfirmed when the account is old enough. The second account was created a few minutes after, created user and user talk from other users, and reverted a few IP edits, then the third account did the same. The usernames of these two accounts make me think User:Hamish Ross is the most likely sockpuppeteer. All three accounts have user pages based on the user pages of other users (User:FT2, User:Dominic and User:Od Mishehu). The fourth account was created a few minutes after the third account stopped editing, and has not edited but has a username similar to who appears to be a sockpuppet of User:Hamish Ross. — Snigbrook 18:24, 10 March 2009 (UTC)
 * Evidence submitted by — Snigbrook


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by — Snigbrook 18:24, 10 March 2009 (UTC)
 * CheckUser requests


 * Clerk, patrolling admin and checkuser comments

✅ all four. I'll block the IP. Dominic·t 19:12, 10 March 2009 (UTC)

All the accounts are now blocked with an expiry time of indefinite. -- Kanonkas : Talk  19:15, 10 March 2009 (UTC)
 * Conclusions

Report date April 8 2009, 11:24 (UTC)

 * Suspected sockpuppets

Obvious sockpuppet - account was created in December 2007 with no edits before today, edits include declining unblock requests, moving Goth subculture to Goff subculture and vandalism on Nicholas White article. — Snigbrook 11:24, 8 April 2009 (UTC)
 * Evidence submitted by — Snigbrook


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

--Nothing I can do here from an SPI point of view, as the account is already blocked. I do agree, however, that the behavioural similarities are compelling. Best, Peter Symonds ( talk ) 11:27, 8 April 2009 (UTC)
 * Clerk, patrolling admin and checkuser comments
 * Reblocked indefinitely. Peter Symonds ( talk ) 11:41, 8 April 2009 (UTC)


 * Conclusions

Report date April 22 2009, 11:39 (UTC)

 * Suspected sockpuppets

All accounts except the last three are already blocked (most for vandalism on User talk:Zzuuzz or Template:Unblock-auto reviewed). The last three accounts are were created around the same time as the first three accounts listed here, and have user names similar to other socks but have not been used or blocked. IP addresses or range should probably be blocked unless it would affect too many other users. — Snigbrook 11:39, 22 April 2009 (UTC)
 * Evidence submitted by — Snigbrook
 * I've added two new accounts, User:Judge Alan McCusker (username suggest obvious sock) and Snigbrook  23:47, 22 April 2009 (UTC)
 * Added User:A bad parent - appears to have made edits just to become autoconfirmed. Two other possible accounts, although there isn't any real evidence to connect these, are User:Frisky moose and User:Garden swing. — Snigbrook  00:06, 23 April 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by — Snigbrook 11:39, 22 April 2009 (UTC) CU on three accounts that haven't even edited, based on creation at a similar time, and vaguely similar usernames. This is way too premature. Mayalld (talk) 13:18, 22 April 2009 (UTC) Per Mayalld, I don't think there's going to be any action yet. If the evidence becomes more substantive, feel free to re-open the report. Thanks, Peter Symonds ( talk ) 16:52, 26 April 2009 (UTC)
 * CheckUser requests
 * Clerk, patrolling admin and checkuser comments

Peter Symonds ( talk ) 16:52, 26 April 2009 (UTC)
 * Conclusions
 * Nothing left to do. Archiving.  —  Jake   Wartenberg  17:12, 26 April 2009 (UTC)

Report date April 29 2009, 22:55 (UTC)

 * Suspected sockpuppets

The first account, User:Judge Alan McCusker, is already blocked. Others may have been created at the same time, two that look most likely are User:Not done enough work really and User:A bad parent, both have made enough edits to be autoconfirmed and neither appear to be new users. User:Polunin Capital and User:Pompous and arrogant were both created today, and have make apparently random reverts, again to make just enough edits (something recent User:Hamish Ross sockpuppets have done), User:DW805366597GB is an SPA that also made just enough edits, all in the gap before the next likely account, User:The diplomatic service, which is more obviously a sockpuppet (see user page). The edits by User:Rene the co-tenant start after the last account finished, are also disruptive and don't look like a new user, as the user has been adding test4 templates to user pages and undoing edits apparently at random. — Snigbrook 22:55, 29 April 2009 (UTC)
 * Evidence submitted by — Snigbrook
 * Also User:Overbearing tactics - obvious sock, all edits are vandalism. — Snigbrook 09:08, 30 April 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by — Snigbrook 22:55, 29 April 2009 (UTC)
 * CheckUser requests

to confirm that these are indeed socks of this user, and to look for any possible range blocks. Mayalld (talk) 06:35, 30 April 2009 (UTC) Looks good for the most part, but please give some evidence in the form of specific diffs. Thanks, — Jake   Wartenberg  03:04, 30 April 2009 (UTC)
 * Clerk, patrolling admin and checkuser comments

these accounts all represent one person. I don't know much about Hamish Ross, but he is usually on a different ISP in the same area; this may very well be him too, though. Unfortunately, a range block isn't really feasible at this point. Dominic·t 10:01, 1 May 2009 (UTC)


 * Conclusions

Blocked and tagged. Peter Symonds ( talk ) 10:15, 1 May 2009 (UTC)

Report date July 9 2009, 13:43 (UTC)

 * Suspected sockpuppets

Two new accounts with ten edits each. User:Walrus theory has been trolling/vandalising with nonsense about people who resemble walruses, this is similar to User:Asian Parents, Western Upbringing/Walruses which was created by a sockpuppet probably of User:Hamish Ross (I've tagged that page for speedy deletion as it probably meets the criteria for attack pages). The account User:Bald patch made a few minor edits to articles (one of the edits was vandalism), then created user and talk pages copied from User:Jpgordon which is similar to what User:Hamish Ross sockpuppets have done before. snigbrook (talk) 13:43, 9 July 2009 (UTC)
 * Evidence submitted by Snigbrook


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

Requested by snigbrook (talk) 13:43, 9 July 2009 (UTC)
 * CheckUser requests

Sedd&sigma;n talk|WikimediaUK 16:29, 9 July 2009 (UTC)
 * Clerk, patrolling admin and checkuser comments


 * Conclusions
 * Good instinct. The following are ✅ matches for each other:
 * No obvious sockmaster, but probably not worth taking a longer look either. Worth noting one user was named "Mister Ross". All of the accounts I've just listed are now blocked. – Luna Santin  (talk) 21:32, 9 July 2009 (UTC)
 * No obvious sockmaster, but probably not worth taking a longer look either. Worth noting one user was named "Mister Ross". All of the accounts I've just listed are now blocked. – Luna Santin  (talk) 21:32, 9 July 2009 (UTC)
 * No obvious sockmaster, but probably not worth taking a longer look either. Worth noting one user was named "Mister Ross". All of the accounts I've just listed are now blocked. – Luna Santin  (talk) 21:32, 9 July 2009 (UTC)
 * No obvious sockmaster, but probably not worth taking a longer look either. Worth noting one user was named "Mister Ross". All of the accounts I've just listed are now blocked. – Luna Santin  (talk) 21:32, 9 July 2009 (UTC)
 * No obvious sockmaster, but probably not worth taking a longer look either. Worth noting one user was named "Mister Ross". All of the accounts I've just listed are now blocked. – Luna Santin  (talk) 21:32, 9 July 2009 (UTC)
 * No obvious sockmaster, but probably not worth taking a longer look either. Worth noting one user was named "Mister Ross". All of the accounts I've just listed are now blocked. – Luna Santin  (talk) 21:32, 9 July 2009 (UTC)
 * No obvious sockmaster, but probably not worth taking a longer look either. Worth noting one user was named "Mister Ross". All of the accounts I've just listed are now blocked. – Luna Santin  (talk) 21:32, 9 July 2009 (UTC)
 * No obvious sockmaster, but probably not worth taking a longer look either. Worth noting one user was named "Mister Ross". All of the accounts I've just listed are now blocked. – Luna Santin  (talk) 21:32, 9 July 2009 (UTC)
 * No obvious sockmaster, but probably not worth taking a longer look either. Worth noting one user was named "Mister Ross". All of the accounts I've just listed are now blocked. – Luna Santin  (talk) 21:32, 9 July 2009 (UTC)


 * Tagged. Nathan  T 14:45, 13 July 2009 (UTC)

Evidence submitted by Snigbrook
All IP addresses listed have been used for vandalism on several user talk pages. When User talk:BigDunc was semi-protected, some accounts, which had been inactive since they were created all on the same day in 2008, made several disruptive minor edits to articles, and two of them – and  – vandalised User talk:BigDunc and have now been blocked. snigbrook (talk) 20:55, 28 October 2009 (UTC)

Comments by accused parties
See Defending yourself against claims.

CheckUser requests
Requested by snigbrook (talk) 20:55, 28 October 2009 (UTC)


 * NW ( Talk ) 21:53, 28 October 2009 (UTC)

Clerk, patrolling admin and checkuser comments

 * The following accounts are ✅:
 * . Brandon (talk) 05:27, 29 October 2009 (UTC)
 * . Brandon (talk) 05:27, 29 October 2009 (UTC)
 * . Brandon (talk) 05:27, 29 October 2009 (UTC)
 * . Brandon (talk) 05:27, 29 October 2009 (UTC)
 * . Brandon (talk) 05:27, 29 October 2009 (UTC)
 * . Brandon (talk) 05:27, 29 October 2009 (UTC)
 * . Brandon (talk) 05:27, 29 October 2009 (UTC)
 * . Brandon (talk) 05:27, 29 October 2009 (UTC)

15 January 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

Hamish Ross, at it again with his failed attempts at humorous trolling. These are all blocked already. I realize we can't block all the IPs in Britain, but one of his past practices was to create sleeper accounts, so please check for these. NawlinWiki (talk) 02:50, 15 January 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Found a sleeper,, other than that, no other unblocked accounts. WilliamH (talk) 02:55, 15 January 2012 (UTC)
 * Per WP:DENY I'm not going to tag. —  Hello Annyong  (say whaaat?!) 15:20, 15 January 2012 (UTC)

01 July 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

The user is clearly a sock of a major sockpuppeteer, as is clear by the name and by the user's only edit. He claims that he has "already amassed a sizeable armada of sockpuppet accounts". I have blocked the account in accordance with the sockmaster's own block, but I think that we need the IP address to be checked and probably blocked. עוד מישהו Od Mishehu 13:42, 1 July 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * CheckUser isn't helpful, but judging from his intentions he'll be easy to whack on appearance. WilliamH (talk) 13:57, 1 July 2012 (UTC)
 * Tagged. -- DQ  (ʞlɐʇ)  17:55, 1 July 2012 (UTC)

01 July 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

This has been moved from an SPI on CUTKD. Firstly EggCentric has suspicions that CUTKD is another sock puppet of the famous Hamish Ross (I am sure EG will comment soon). Then we have the IP's, the IP addresses have been sending me abuse for the last week (although this is now sorted out and they are blocked). What I suspect is happening is that the account CUTKD is being used to cover up the actions of Hamish Ross by framing other people by using the same word and phrases that other users have used. Also I have found that the IP's edit in the same time periods (7am -8am and 5pm to 11pm BST) as CUTKD which could link them together. Previously Hamish Ross said they had an 'armada' of sock puppets waiting, this could be some of it. We can see how CUTKD is framing people for example Griffith-Jones' message here and then an 2 IP addresses say the exact same thing: here and here. URGENT: Here an IP admits to being a sock puppet of CUTKD (may be someone else trying to frame them), and as I said it is after 5pm. Also since my user page is semi protected due to this they are clearly now using Egg Centric's talk page to send nasty notes. To anyone reviewing this, I would also consider the possibility that someone is trying to frame CUTKD and although the evidence stacks up, I don't fully believe this user is connected to hamish as they have been editing constructively (moslty) for the last 3 years. Thєíríshwαrdєn - írísh αnd prσud (talk) 16:34, 19 July 2012 (UTC)


 * I no longer want to persue this case as I believe that CUTDK is no sockpuppet or sockpuppeteer. Thєíríshwαrdєn - írísh αnd prσud (talk) 20:46, 19 July 2012 (UTC)

The IP's seem to send similar messages as the previous sockpuppets of Hamish Ross, the newer ones keep saying horrible little shit. On a second note I wanted to close it initially due to my belief CUTKD is innocent( nit sure anymore) the IP's are definitely connected to Hamish Ross Thєíríshwαrdєn - írísh αnd prσud (talk) 07:42, 20 July 2012 (UTC)

Well this needs to be sorted out as I've been get abuse messages for the last week. Look at my and EggCentric's talk page history full of harassment by these IP's. Second I put in CUTKD as an IP said they were a sock of them, then I tried to delete this as I knew it could be framing. Look at EggCentric's deleted post in here. Thєíríshwαrdєn - írísh αnd prσud (talk) 07:47, 20 July 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
As the editor who filed this report has withdrawn the request for review I see no reason why it can't be closed and archived. --Jezebel's Ponyo <sup style="color:Navy;">bons mots 22:00, 19 July 2012 (UTC)
 * Allright; this is an unmitigated mess. Clearly, there is someone who is – or who is pretending to be – Hamish Ross.  Not counting the numerous IPs trolling,  is a  match to  and/or much of the IP trolling; and there is more than a little funny business going on those ranges and having technical matches. That said, the closing admin really should pay attention to the history of this page and the relevant users' talk pages: there is more going here than straight up puppetting, and figuring out what is going on is going to require some investigation.  Behaviour here has been puzzling, and could stand a closer look.  &mdash; Coren (talk) 22:06, 19 July 2012 (UTC)
 * This is unfortunate. Please would anyone concerned contact me by email. Thanks, C.U.T.K.D  <b style="color:blue;">T</b> 19:16, 20 July 2012 (UTC)

— Berean Hunter   (talk)  20:11, 20 July 2012 (UTC)
 * Blocked and tagged. Closing.

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

On User talk:Sro23, believes that  has found Hamish Ross to be the sockmaster behind all the socking on User talk:TheGracefulSlick that is forcing the page to be extended-confirmed protected. The IP posted on User talk:Floquenbeam that it was counting down the days until the talk page would be unprotected, but is now indefinitely 30-500-protected. Requesting CU to see where all these accounts are coming from. — MRD2014 ( Merry Christmas! ) 14:25, 24 December 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I'll make a brief comment, though the Hamish Ross account is well stale, range blocks have not usually been practical, and most evidence resides somewhere in Wiki-memory (I would have to look quite hard). Hamish Ross has traditionally been UK-based, and traditionally used BT's huge ranges to vandalise from. More recently he has been known to edit from Hong Kong (eg), Canada, and various proxies. He has always had a habit of 'bigging up' his vandalism, including obsessive behaviour, particular html-tag formatting, and extensive warnings and threats at talk pages and ANI. Maybe someone will trawl the recent TP vandalisers to find a match, but this is long term and I'm convinced. To hand, there's also this and this. I'm not sure what a checkuser would look for, but a UK base (and especially BT, if he's not been thrown off it) would be persuasive. -- zzuuzz (talk) 14:58, 24 December 2016 (UTC)
 * I just wanted to see if it all coming from one place with the CU request. — MRD2014 ( Merry Christmas! ) 15:03, 24 December 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Katietalk 16:17, 24 December 2016 (UTC)
 * These accounts are ✅ to each other:


 * I think that's all. Not sure who the master is - pinging, to take a look, but based on geolocation this could be Hamish Ross. DoRD, I'd appreciate it if you'd run this again to make sure I got all of them and to look at the range. All already blocked without tags, and regardless of master I think it should stay that way. Katietalk 16:56, 24 December 2016 (UTC)
 * That looks like all of the accounts for now, but I'd like to mention that the IP address in the report above is ❌ to these accounts. The obsession with TheGracefulSlick makes me think that CrazyAces is the master. I disagree about the geolocation match with Hamish Ross, because unless there's something I'm overlooking, these socks are operating from a significantly different location than where Hamish was a few years ago. On the other hand, they're also in a different location, but relatively close, compared to Hamish, than the last known CA socks. ​—DoRD (talk)​ 16:17, 27 December 2016 (UTC)
 * Wasn't it initially suspected that the culprit was ? GABgab 17:41, 24 December 2016 (UTC)
 * So I gather, but were found to be unrelated at this SPI. Just noting, regardless of geolocation, many of these confirmed accounts speak with a distinctly British twang. Posting massive pictures of Jimbo, that's another Ross habit ("Jimbo lovin troll"). This IP (revdel'd) also shares similarites with some IPs I linked above, who share similarities with the talk page harasser. Compare some of these edits. Me, I'm still persuaded it's Ross. -- zzuuzz (talk) 18:26, 24 December 2016 (UTC)
 * You know much better than this humble clerk ever would - carry on. GABgab 18:31, 24 December 2016 (UTC)


 * All tagged. Case closed.  Vanjagenije  (talk)  00:55, 2 January 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Behaviorally obvious, disrupting ANI, giving fake warnings. Need a sleeper check. Of course there may be a known LTA involved, but I don’t know who. —/M endaliv /2¢/Δ's/ 01:42, 30 December 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Hipsterish beard is ✅. Dianna Connelly is ❌.--Bbb23 (talk) 03:35, 30 December 2017 (UTC)

This is probably Sockpuppet investigations/Hamish Ross. Pinging. Sro23 (talk) 04:04, 30 December 2017 (UTC)
 * Other checkusers may find this strange, but yes I believe this is Hamish Ross. Also, the several other socks involved in this vandalism. -- zzuuzz (talk) 10:11, 30 December 2017 (UTC)
 * Sro and zz: After the last Hamish case, very little surprises me anymore, so I'll gladly defer to your judgement. However, as Bbb said, Dianna appears to be technically unrelated to the other two. But again, I wouldn't be surprised if they're all the same. ​—DoRD (talk)​ 14:22, 30 December 2017 (UTC)


 * Case merged, no tags as per WP:DENY. Closing. GABgab 15:50, 1 January 2018 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

A bunch of throwaway socks used to disrupt ANI (listed here are some from today and some who started editing on December 29 and one from December 31), including building some up to autoconfirmed status. ANI has been extended protected several times because of the socking. Requesting CU because it seems like there are lots of sleepers, which were all created a while ago. — MRD2014 Talk 20:13, 1 January 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Closing. CU would not be helpful as the accounts are too old. Please report to AIV instead. Sro23 (talk) 20:24, 1 January 2018 (UTC)

Suspected sockpuppets



 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)


 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)
 * (blocked)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Nuddsy is a perfect CU match for Pteridactyl, and Dodged is operating with the same machinery but from a slightly different IP address; can't place a rangeblock. Need help with two things: 1. this may be an LTA, given their targets; 2. one of you may be able to figure something about the IP addresses. They're all blocked; nothing is tagged yet. Pinging User:Matthew hk, whose suspicions were confirmed. Thanks. Drmies (talk) 23:08, 2 January 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * Well, i had tagged for may be a dozen to 2 dozen accounts under User:Nuddddddsy (as i don't know before this account there is many), as well as i don't even bother to check which sleeper account is the oldest. Matthew hk (talk) 23:10, 2 January 2019 (UTC)
 * , you checked User:Lords Lords money and User:At the other end of the pole earlier. Matthew hk, please list the accounts you tagged. Thanks, Drmies (talk) 23:16, 2 January 2019 (UTC)


 * I don't have a list but a cat. It generated from inspecting page history of WP:ANI, viewing those with red link user page and posting [n]-day of Xmas and/or undo. 2 accounts were omitted as their edits were hidden. Matthew hk (talk) 23:18, 2 January 2019 (UTC)


 * Well, only two accounts had edited in the article namespace, (certainly a sock block material already) and, which Kippering sending a level 3 warning to , an account without edit at all. Matthew hk (talk) 23:30, 2 January 2019 (UTC)


 * Well the sockmaster has started his 10th day. Add for the same vandal pattern in ANI. Matthew hk (talk) 18:54, 3 January 2019 (UTC)

I'm surprised nobody has semi-protected ANI for the 12 days yet; it's obvious how long this will last. Do you think that would stop this, or would they just move somewhere else? ansh 666 21:26, 3 January 2019 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
If you're looking for an opinion on identification,Sockpuppet investigations/Hamish Ross/Archive - incidentally last filed this time last year. Also, User:Kippering is something of an outlier of this lot - either a copycat or mixed up in some other way (but not to be confused with being innocent). -- zzuuzz (talk) 05:58, 3 January 2019 (UTC)
 * I blocked some of these but I have no insight as to who is the actual master. I also don't think it really matters - the vandalism is very obvious, just WP:RBI and CUs can refresh the range blocks when appropriate. Ivanvector (Talk/Edits) 18:55, 3 January 2019 (UTC)
 * why protect ANI? The vandal is blowing through their sleeper collection as fast as we can block them. And yes, I do believe they'd just post elsewhere. Ivanvector (Talk/Edits) 13:04, 4 January 2019 (UTC)


 * Clerk, when ready please merge to Hamish Ross instead of archiving here. -- zzuuzz (talk) 13:12, 4 January 2019 (UTC)
 * Merged and re-tagged. Closing.  Vanjagenije  (talk)  17:49, 7 January 2019 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Hedgehog officer was edit warring and making personal attacks at Merrill. One example is: https://en.wikipedia.org/w/index.php?title=Merrill_(company)&oldid=1003424184. After they were blocked, the listed sock was reactivated to restore one of the HQ edits. Shiny edit bonjour. 23:01, 28 January 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Both accounts have already been blocked, and the CU log indicates that they both have already been checked. Closing. Mz7 (talk) 23:25, 28 January 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

More socks at Merrill (company) with the same personal attacks. Please check for sleepers - they appear to have invested time in creating socks and running what appears to be an automated script to get them to 10 edits. Pahunkat (talk) 19:14, 1 February 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' I swear I didn't know.... Shiny edit bonjour. 19:23, 1 February 2021 (UTC)


 * I've put Merrill (company) under ECP because of the ability to get round semi-protection. I've deleted the pages they created as part of this. Those accounts were all created in 2016 which seems like a long time for a sleeper so I wonder if they're guessing the passwords of dormant accounts instead.  Hut 8.5  19:33, 1 February 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * . Same country, geolocation, (very wide) IP range. Same common user agent.  ~Oshwah~  (talk) (contribs)   21:45, 1 February 2021 (UTC)


 * Closing per the above. All blocked, nothing further to do here. The SandDoctor  Talk 22:50, 1 February 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

On Merrill (company), same edits and provocative edit summaries. WP:DUCK Pahunkat (talk) 11:33, 14 March 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Blocked. Also, just noting my opinion that this is surely Hamish Ross. -- zzuuzz (talk) 13:12, 14 March 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Per 's comment the last time I filed at Sockpuppet investigations/Hedgehog officer, filing here instead. An account created in 2016 that suddenly comes back to life, restoring the paragraph added by socks of Hedgehog officer/Hamish Ross. Pahunkat (talk) 13:48, 21 March 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Blocked. Can this be closed and the other case merged? Pahunkat (talk) 15:09, 21 March 2021 (UTC)
 * , The cases have indeed been merged. -- RoySmith (talk) 16:10, 21 March 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Tagged Keila Sarti -- RoySmith (talk) 16:12, 21 March 2021 (UTC)
 * Feh. I see we're in DENY mode.  Undid that. -- RoySmith (talk) 16:18, 21 March 2021 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Another revert bomb like User:Aroha Parish. Need I say more than that? CU for rangeblocks and/or sleepers. Mako001 (C) (T) (The Alternate Mako) 14:43, 3 January 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Yes, that's Hamish Ross. The other account: I may tag these accounts for undisclosed reasons, but generally there's no need for them. -- zzuuzz (talk) 15:03, 3 January 2022 (UTC)
 * Thank you zzuuzz. Drmies (talk) 00:58, 4 January 2022 (UTC)
 * , here's another one for you: User talk:Mr Nicholas Need of East Locution. Please check and see what to do about that range? Drmies (talk) 01:06, 4 January 2022 (UTC)

Suspected sockpuppets
Distruptively editing pages and leaving edit summaries on other talk pages, abusively using the uw-vandalism4 template. See user contribs and edit summaries for evidence.  Wesoree  ( Talk ) 13:10, 5 April 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. Sir Sputnik (talk) 23:03, 5 April 2023 (UTC)

Suspected sockpuppets
posted above on previous section  Wesoree  ( Talk ) 14:41, 5 April 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. Sir Sputnik (talk) 23:03, 5 April 2023 (UTC)

Suspected sockpuppets
These accounts are already blocked and tagged. The pattern is obvious. They are all old accounts but started editing only recently. They create the same userpage. They make a bunch of test edits in their userspace. They start reverting editors willy-nilly. I'm filing this only for a check for other accounts. Bbb23 (talk) 22:55, 19 April 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * This is presumably Sockpuppet_investigations/Hamish_Ross (see recent reports in the archive), as are
 * etc.
 * if these haven't been checked already. Thanks, Spicy (talk) 23:03, 19 April 2023 (UTC)
 * if these haven't been checked already. Thanks, Spicy (talk) 23:03, 19 April 2023 (UTC)


 * - -- RoySmith (talk) 23:07, 19 April 2023 (UTC)
 * There's not a lot CU can add here.  is  to .   is  to .  The nature of the data isn't conducive to an effective sleeper check. -- RoySmith (talk) 23:32, 19 April 2023 (UTC)
 * Closing. This is Hamish Ross and a number of other accounts and future sleepers have been recently dealt with. -- zzuuzz (talk) 07:37, 20 April 2023 (UTC)
 * Shouldn't this report be merged?--Bbb23 (talk) 13:09, 20 April 2023 (UTC)
 * I guess so, yes. It's up to the clerks though :) I'll flag one down in case someone wants to do that. -- zzuuzz (talk) 13:13, 20 April 2023 (UTC)


 * I've merged the case and deleted the existing tags. (I don't think we've been tagging these, but if another clerk/admin wants to do so, I have no objection). Closing. Thanks, Spicy (talk) 19:42, 20 April 2023 (UTC)

Suspected sockpuppets

 * ( original case name)

Literally posting personal attacks on user talk pages, CU requested for sleeper checks, as I think there may be more sleepers there. Evidence can be explained via contribs. --  Wesoree  ( talk · contribs ) 13:28, 21 April 2023 (UTC)


 * aditionally WP:HOUNDING me, and some other editors. --  Wesoree  ( talk · contribs ) 13:29, 21 April 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments
This is Hamish Ross, who probably has a spreadsheet full of spare accounts. CU is obviously aware, but there's not much we can do to find sleepers which are 7 years old. Over to the clerks. -- zzuuzz (talk) 14:10, 21 April 2023 (UTC)
 * Case merged. With the accounts already blocked, no further action is required here. Sir Sputnik (talk) 15:47, 21 April 2023 (UTC)

Suspected sockpuppets

 * ( original case name)

A whole bunch of accounts created in 2016-2017 have suddenly started spamming garbage on admin noticeboards. Most recent (as of while I'm typing this) now is https://en.wikipedia.org/w/index.php?title=Wikipedia:Administrators%27_noticeboard/Incidents&diff=prev&oldid=1211926495 otherwise just read the page history. Checkuser asked for in case there are more sleepers out there. Daveosaurus (talk) 07:40, 5 March 2024 (UTC)

And User:70 tiger sharks. Daveosaurus (talk) 09:18, 5 March 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

There isn't much of a point to this, they've been doing it for a few days now(diff, other diff). A report just to tag them would be unnecessary for an LTA, maybe even discouraged, and checkusers have likely already checked them seeing that a few of the LTA blocks that have been done were by checkusers. – 2804:F14:80C2:4F01:BD62:EF68:43A3:3A61 (talk) 08:10, 5 March 2024 (UTC)


 * Just to clarify, I don't mean Kinu's blocks, I meant other blocks. – 2804:F14:80C2:4F01:BD62:EF68:43A3:3A61 (talk) 08:15, 5 March 2024 (UTC)
 * There does seem to be a correlation between the accounts (All 2016/2017) so I'll guess LTA made these on a similar IP range, and that they have several other accounts in reserve. ASmallMapleLeaf (talk) 08:37, 5 March 2024 (UTC)

User:Goodbye Mrs Merton another account. ASmallMapleLeaf (talk) 08:47, 5 March 2024 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * This is Sockpuppet investigations/Hamish Ross. Sleepers:


 * Anything else I saw was already blocked. Spicy (talk) 10:22, 5 March 2024 (UTC)
 * , closing. Spicy (talk) 10:25, 5 March 2024 (UTC)

Suspected sockpuppets
Pro forma, as Pasi Palmisano was just blocked. Same pattern of reverting (mostly) helpful edits, leaving incorrect warnings, old sleeper accounts.

CU requested for sleeper check. <small style="color:#0080FF;background:#EAEAFF;border:2px solid;border-radius:4px;padding:0 4px">Schrödinger's jellyfish &#9993; 21:08, 10 March 2024 (UTC)


 * Pinging @Yamla here as the blocker. (Thank you for blocking so quickly!) <small style="color:#0080FF;background:#EAEAFF;border:2px solid;border-radius:4px;padding:0 4px">Schrödinger's jellyfish  &#9993; 21:09, 10 March 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * No additional sleepers at this time. --Yamla (talk) 21:10, 10 March 2024 (UTC)

Suspected sockpuppets
Appears to be sleeper of Hamish Ross; "woke up" today, made 10 edits to userspace, then began reverting rapidly and giving all editors a level 4 final warning, similar to who was blocked in May as a Hamish Ross sock. Schazjmd  (talk)  17:36, 1 July 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


 * Total Agree, see WP:ANI. My real namm  (💬pros · ✏️cons) 17:43, 1 July 2024 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Yep. Spicy (talk) 17:38, 1 July 2024 (UTC)

Suspected sockpuppets
as they were a sleeper made in 2016, made some edits on their userspace, and simply undoes edits and gives 4/4im warnings on talk pages of IP users. Codename Noreste 🤔  Talk  07:56, 8 July 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Account is now locally blocked and globally locked. Closing. Bbb23 (talk) 12:36, 8 July 2024 (UTC)