Wikipedia:Sockpuppet investigations/The owner of all/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

On 10 July, an IP geolocating to Atlanta, Georgia tried to log into my account. This has been happening every few days since then, and recently came from the two IPs listed here (I can provide a full list of the IPs, but to the best of my knowledge the above two are the only ones who have edited English Wikipedia within the same timeframe). At the time that this started, the only editor I was in conflict with on the site was The owner of all, who coincidentally is also interested in the state of Georgia and in roads. The owner of all's logged in edits showed an interest in road infrastructure in Georgia and indeed mentioned that roads were his main editing interest (I think this was on his user page, but that was deleted as part of the controversy that led to his block so I can't access it). He had also made many edits relating to Georgia in the past, probably a greater proportion of his total edit count than is reasonable for someone who doesn't live there (or hasn't lived there). I think this is strong evidence that (i) the IPs editing Wikipedia, (ii) the person or persons trying/threatening to hack my account, and (iii) The owner of all are all the same person. (i) and (ii) are definitely the same, since this edit was made just four minutes (or possibly 64 minutes -- daylight savings time confuses me) before I got an email that read Someone (probably you, from IP address 96.5.254.134) requested a reset of your password for Wikipedia, which was dated 07:28 today, Japanese time; if (i) and (iii) are also the same (which I understand is not something that can be "proven" with CU evidence, so I'm hoping the circumstantial evidence presented above is sufficient), this is also block evasion. Hijiri 88 ( 聖やや ) 02:42, 19 November 2021 (UTC)
 * I hadn't checked, but in addition to the e-mail I got on 2021/11/13 土 06:25 about 96.5.254.136 trying to hack my account (which prompted me to check it's Wikipedia contribs), I also got emails about the same IP on 2021/11/02 火 03:24 and 2021/11/09 火 03:43, the latter being either nine minutes or 69 minutes before this edit. Hijiri 88 ( 聖やや ) 02:48, 19 November 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Depending on the nature of the emails, this may involve some serious violations of the harassment policy, in addition to any socking considerations. It may be appropriate to communicate the emails privately to ArbCom, for further examination. --Tryptofish (talk) 16:10, 19 November 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * not sure why those IPs are targetting you with password resets etc, but there doesn't appear to be a larger issue at play. This could unfortunately be one of several LTAs. Range(p)blocking & closing ~TheresNoTime (to explain!) 16:22, 19 November 2021 (UTC)
 * For future reference, it's best to contact a CU about this kind of thing directly, or T&S if you prefer. There's never going to be enough evidence for a block on behavior in a case like this, so CU is needed for any block, but CUs can't publicly link accounts to IPs (usually), so better to reach out off-wiki and see if any unexplained blocks come down after that. --  Tamzin  [ cetacean needed ] (she/they) 16:43, 19 November 2021 (UTC)