The Sandbox Troll
Shortcut: WP:LTA/SBT, WP:SBT
Wikilifespan	2007–present
ISP	Telecom Italia
Physical location	North-central Italy: Florence, Prato, Tuscany (also Bologna, Emilia-Romagna)
Sockpuppet investigations	Wikipedia:Sockpuppet investigations/87.6.121.105
Instructions	Please do not take any action if this user is not causing significant disruption. Please do not warn this user. If reporting, please link to this long-term abuse report. When the active abuse has been taken care of, please update this report with the latest information.
Status	Active

Please read this page in full before taking any action.

Basic information

The Sandbox Troll is known to repeatedly disrupt Wikipedia sandbox pages. Typical behaviour includes repeatedly blanking or resetting the sandbox, undoing others' edits, and writing profanities in English or Italian. They will normally attack any user who reverts, warns or blocks them. They do not use registered usernames.

Targeted areas, pages, themes

This user exclusively targets Wikipedia sandbox pages, their own talk pages, and the user/talk pages of any users who interact with them. They may sometimes also warn other users who are disrupting the sandbox (in their opinion). The main targets are:

In the past they have shown that they might also disrupt almost any other project-wide sandbox page.

Habitual behaviour

Repeatedly blanking or resetting sandboxes, calling people idiots, adding "fuck off all",[1][2], or "fuck off admins".[3][4][5] and similar abuse in Italian. If they receive warnings they will typically blank them and start throwing abuse.

Other notes

Edit filter 847 is used to limit their edits. Please do not report to admins, or warn, or block, if their edits are being disallowed by the filter and they are not causing significant visible disruption.
Blocks for block evasion or triggering the filter are not going to be effective, and are likely to actually increase disruption. Please try and minimise all interaction with this user, including blocks.
If any blocks are required, they should preemptively disable talk page access. Any range blocks, which are not recommended, should typically allow account creation.
Cross-wiki edits are also often made to the Italian sandbox and the German sandbox, along with several other wikis.
Further observations can be found on the talk page.

Cases

Cross wiki vandalism report (2008)
Wikipedia:Administrators'_noticeboard/IncidentArchive371#Template:X1 (2008)
Wikipedia:Administrators'_noticeboard/IncidentArchive375#Templates...again (2008)
Wikipedia:Suspected sock puppets/151.49.9.71 (2008)
User_talk:Zzuuzz/Archive_26#87.6.121.181 (2015)
Wikipedia:Sockpuppet_investigations/87.6.121.105 (2015)
Wikipedia:Administrators'_noticeboard/IncidentArchive1068#IP_user (2021)
Various other reports are regularly made about this user being abusive and/or edit-warring; check 'What links here' for more.

Confirmed and suspected accounts

No user accounts have ever been identified.

IP addresses

As of 2015–2022 they are mainly using IP addresses in the following ranges (all Telecom Italia in Northern Italy):

62.18.128.0/17
79.0.0.0/10
82.48.0.0/12
87.0.0.0/11
95.224.0.0/11
193.207.128.0/17

A few other Telecom Italia ranges in the same region are occasionally used, as seen below.

Partial list of IP addresses used:

Basic information

Targeted areas, pages, themes

Habitual behaviour

Other notes

Cases

Confirmed and suspected accounts

IP addresses

2023

2022

2021

2020

2019

2018

2017

2016

2015

2012

2011

2010

2009

2008

2007