Wikipedia:Sockpuppet investigations/Tscdrwh/Archive

Tscdrwh

Tscdrwh (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

14 July 2022

Suspected sockpuppets

Focus on content (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Bluea1bion (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Tschrwh (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Focus of content (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Tschrwd (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Tools: Editor interaction utility · Interaction Timeline · SPI Tools

The four accounts, all recently created, are editing the same articles, Tscdrwh making an edit that is reverted, with Focus of Content (who has since been CU blocked) and then Bluea1bion reverting back to Tscdrwh's version, and then Tschrwh reverting Bluea1bion. Below are three articles showing this pattern. there are several more articles they have been active on.

Article United States Department of Defense
- Tscdrwh adds content [1],
- GoodDay (talk · contribs · block user) reverts Tscdrwh [2],
- Focus on Content reverts GoodDay [3],
- GoodDay reverts Focus on Content [https://en.wikipedia.org/enwiki/w/index.php?title=United_States_Department_of_Defense&diff=1097944295&oldid=1097909736&diffmode=source},
- Bluea1bion reverts GoodDay [4],
- Tschrwh reverts Bluea1bion [5]

Article The Pentagon
- Tscdrwh adds content [6]
- GoodDay reverts Tscdrwh [7]
- Bluea1bion reverts GoodDay [8]
- Tschrwh reverts Bluea1bion [9]

Article History of the United States (1991–2008)
- Tscdrwh adds content [10]
- Drdpw (talk · contribs · block user) reverts Tscdrwh [11]
- Focus on Content reverts Drdpw [12]
- GoodDay reverts Focus on Content [13]
- Bluea1bion reverts GoodDay [14]
- Tschrwh reverts Bluea1bion [15] Donald Albury 19:56, 14 July 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I've suspected for a week or so, that these accounts are the same individual. Heck, two of them have near identical names. GoodDay (talk) 19:58, 14 July 2022 (UTC)[reply]

Hi there Goodday. I reverted one edit on the History of the United States (1945–1964) in complete good faith, not knowing there was and edit war going on with this person. I can see this person then name-dropped me a lot and then made a new account with a name very similar to my own, but I can assure you that I am not involved with them was pretty mad when i found out they copied my username to make pesky edits. I have been editing for years under this name and would not have made that revert if i had noticed beforehand that they were being a nuisance on other pages. Bluealbion (talk) 23:03, 14 July 2022 (UTC)[reply]

I believe there's new socks named @Focus of content: & @Tschrwd:, which just started editing, a few hours ago. GoodDay (talk) 10:16, 15 July 2022 (UTC)[reply]

And another sock: @Tschrwh:. -- GoodDay (talk) 10:39, 15 July 2022 (UTC)[reply]

Please note that Mz7 found no technical evidence linking Tschrwh to the other users in this case. I have asked Mz7 for his input on any connection between Tschrwh and Tschrwd, but I will note that they both have reverted the sockpuppets in this case. Donald Albury 13:19, 15 July 2022 (UTC)[reply]

It appears as though it's two individuals with each sets of socks. It's either they're fighting against each other 'or' amusing each other & messing with us. GoodDay (talk) 13:22, 15 July 2022 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

Clerk note: Changed Focus of Content → Focus on content in the socklist. --Blablubbs (talk) 20:02, 14 July 2022 (UTC)[reply]
CheckUser requested and endorsed by clerk - coordination seems likely based on the evidence in the filing. I'm endorsing to 1) figure out the precise relationship between FOC and the others since I find it curious that FOC is the only one who uses summaries and that the others don't seem to have shown up in the previous check, and 2) to see if there are any others. Also paging @Mz7: Is there a prior master in play here? --Blablubbs (talk) 20:15, 14 July 2022 (UTC)[reply]
In progress - Mz7 (talk) 20:42, 14 July 2022 (UTC)[reply]
Inconclusive. From a technical standpoint, I can't say these accounts look related, but there are aspects of the data that make me suspect some kind of evasion is happening. Tscdrwh appears to be using some kind of proxy or corporate VPN. Focus on content is using a kind of satellite Internet connection that we don't typically see, and their specific IP has been used in the past by LTAs, which—in combination with their clearly precocious and disruptive editing—is why I blocked that account (although admittedly, it has been several years since the LTAs used that IP, and I couldn't identify which LTA it was specifically—the past accounts were blocked for LTA without identifying the master in the block logs or elsewhere). Bluea1bion and Tschrwh are on residential connections in different regions of the same country.
As always, behavior should be the deciding factor, and I would say that at least Tscdrwh and Bluea1bion pass the WP:DUCK test. The two accounts are clearly involved with supporting each others' edits across several articles, and their technical differences can be explained by one account editing from work and the other editing from home. To a lesser extent, I think Focus on content also passes the WP:DUCK test: that account is clearly not a new editor, and they have also been primarily focused on supporting the edits of Tscdrwh and Bluea1bion across several articles. It's also quite suspicious that they share the same token IP that has had past LTA activity going back years. Tschrwh is the interesting one because, even though the username is remarkably similar to Tscdrwh, behaviorally it seems like that account has been involved in opposing and reverting the edits of the other accounts. ~~That is also the only account that looks more truly "unrelated" from a technical standpoint rather than "inconclusive".~~
For the reasons stated above, all accounts ~~except Tschrwh~~ Blocked and tagged, closing. Mz7 (talk) 21:18, 14 July 2022 (UTC)[reply]
I'm going to revise my findings a bit in light of the new information. Here's a more straightforward summary. The following accounts are Confirmed to each other (Group 1):
- Focus of content (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Focus on content (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
The following accounts are Possible to each other (Group 2):
- Tschrwd (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Tschrwh (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
- Tscdrwh (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Group 1, Group 2, and Bluea1bion (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) are Inconclusive to each other. At this point, given the behavior (username similarity and focus on these specific edits), I'm inclined to believe that all of the accounts are one person or a group of individuals intent on trolling us. All accounts Blocked and tagged. Mz7 (talk) 19:02, 15 July 2022 (UTC)[reply]