#astro!

The context

We already added anomalocaris to the list a little while ago after finding evidence of scamming - as far as we're concerned, they're an incredibly prolific scammer who consistently and intentionally targets as many new users as possible around December 18th.

While investigating a different user, we noticed one of their victims also had pets from anomalocaris. Out of equal parts curiosity and frustration, we took another quick look at their account and noticed that their signature mentions three other users - two by name - that they apparently know IRL and share wifi with. Knowing how scummy they already are, we thought it was worth looking into these other users.

It was immediately apparent to us that there were enough surface-level oddities to warrant a closer look at these accounts.

MULTIACCOUNTING

The sockpuppets

anomalocaris directly named starsets (761928) and uncanny valley (119705) in their signature as their "friends". They also mention a sibling who isn't named, but a quick search of the word "sibling" in their posts revealed this pet, linked to astro! (116168), who has "quit".

Although uncanny valley (hereafter UV) and astro joined slightly earlier, we do believe that anomalocaris is the "main" account, at least currently; this account has the most pets by far and appears to be going for a complete collection. It's also the account which sends out the scam trades.

The initial similarities are not major and certainly wouldn't raise eyebrows in isolation, but it was enough for us to become curious. Just by looking at the four accounts' profiles, we can already find a few things in common. We've colour coded them so we can point them out.

Blue: All of them write, including astro, although that isn't in the profile here and will be found later. Also important for later, starsets apparently has an English degree according to their interests.

Green: All of them RP (again, including anomalocaris and astro, although not apparent in the profiles).

Red: starsets and UV both have a rescue horse. anomalocaris also has a horse as seen in this post, and astro may as well based on this post.

Purple: Both anomalocaris and UV are interested in history.

Yellow: Both anomalocaris and UV express interest in politics and seem very politically involved, with the same opinions on important topics.

Black: Both anomalocaris and UV seem to identify as non-cis. We did find at least one post where starsets goes by any pronouns. All four accounts mention wanting to do LGBTQ+ RP without being specific about their identities, and there are other posts regarding gender which we're not posting here as it feels unnecessary.

(For clarity, the politics and identity stuff is being mentioned only because it is the same across all 4 accounts, not because we have an issue with any of it.)

Additionally, all three signatures use 85% size text, with anomalocaris and starsets' being very similar - they are also centred, mention being WIP, and mention the other accounts ("friends/roommates"). astro's trade rules also use 85% centred text. There are very similar stamp designs across anomalocaris, UV, and astro!'s displays, including all three making use of the same blue flowers, and at least two of them using the ivy, candles, or pixel text quotes. anomalocaris also mentions liking birds, and a bird stamp features on UV's display.

Basically, this was already quite telling in our opinion, but at the very least this was enough to make us want to look more into things.

anomalocaris seems to pride themselves on being a writer. Unfortunately for them, they never bothered to differentiate their writing style and identifiable quirks. Even more unfortunate, Mod P has a great interest in that kind of thing, and way too much time to spare. We don't doubt we could have got super deep into the writing analysis if we wanted to spend even longer on it, and probably would have found more similarities in syntax etc, but this is probably enough.

Across all 4 accounts, there are a variety of traits which are shared almost universally - even when they differ, the differences are consistent across all accounts, which in our opinion proves the connection even more. They even have the exact same "inconsistencies", basically.

This can be split across three types, which we'll go through from least to most damning: format, style, and content.

Format

Similar formatting occurs across all four accounts. All four make frequent use of smaller text size (typically 85%). anomalocaris and UV also use specifically the colour #400040 (or #400080) at times.

These formatting choices are not consistent across all posts on the accounts; all four switch between smaller text and regular text in non-rp posts at least some of the time.

All 4 make liberal use of text decoration, such as using decorative unicode symbols as bullet points, especially in RP posts. We do understand that some of this (including text size) is very common on the RP side of CS - the point is that all 4 make use of the same formatting in the same way, and with the same inconsistencies. Ultimately, this is the weakest evidence regarding their writing, and moreso means something only as part of the greater analysis.

Style

Here is a list of stylistic identifiers, with examples from each of the 4 accounts, in no particular order. These are screenshots from our research document and may not be the most visually appealing.

All 4 accounts have effectively perfect grammar (congrats) when writing RP posts, which is basically unchanged - again, on all 4 accounts - for over 10 years. All 4 also use <3 often.

Again, not all of these are very strong on their own, but the consistency within and across the accounts, in combination with the other evidence, is why this is meaningful.

Content: interests

This is where we feel evidence is strongest and most telling, at least in regards to the post evidence alone.

To begin with, all 4 accounts have exactly the same interests. They aren't just into similar things - they all have exactly the same fandoms. With a couple of exceptions for starsets' lower post count and anomalocaris doing less RP overall, they have all engaged with Warrior Cats (x x x x), Supernatural (x x x x), Doctor Who (x x x x), Hunger Games (x x x), and others - there are effectively no fandoms that any one of them expresses interest in which are not also shared by the others.

The 3 who have posted 1x1 RP partner searches before are all looking for exactly the same things at around the same time. They're all already "friends". Odd that they aren't just RPing with each other, isn't it?

The last Supernatural-related RP posts from any of the 4 accounts are in 2018; in 2019, anomalocaris mentions no longer being in the Supernatural fandom.

On the rare occasions in which one account seems to signal something unique, you can't actually find anything related to it in their post history.

One of UV's old usernames was literally "sailboat123", and they still mention their sailboat in their interests. There is no references to boats, or the great lakes (which they also mention) on any of the accounts (outside of RP). The exception is the term "sailboat" on astro's account, which reveals a history of them apparently always being away from RPs at the same times to do the same things.

Similarly, only starsets mentions Lord of the Rings, but it can't be found in any of their posts. These seem like either loose interests or potentially fake interests that were used to try and make the accounts seem like different people at a glance.

Content: shops

All 4 accounts have briefly run various creative "shops" on CS, with all 4 abandoning these shops quickly when they didn't receive much interest; anomalocaris sold art, starsets sold D&D characters, uncanny valley sold writing, and astro sold both writing and art. Anomalocaris started theirs in 2022, but the rest all started in 2018/2017, and all had very similar layouts and content.

Even specific wording occurs across multiple shops. In some cases, this is either slightly peculiar or very specific, such as the use of non-descript "credentials".

Both astro and UV describe the same so-called "credentials", and both UV and starsets specifically list English degrees. astro also mentions English grades, although for High School(?).

Considering all of the above, we think the content similarities are the most telling as far as multiaccounting goes. The likelihood that 4 people who are all friends/siblings use exactly the same wording in exactly the same places, and all start art shops at the same time with the same "credentials", is basically non-existent.

Evidence, oddities, and theories

Adding this here because I just stumbled across it. This is a post from anomalocaris' account in 2012. Eep is astro's old name, and so Lily appears to be anomalocaris. It wouldn't be too unusual for siblings to be "next to each other", but it could just as easily be that a much younger anomalocaris just couldn't be bothered to switch accounts. Again, take it in combination with everything else discussed here, not just on its own.

(Also potentially worth noting is that if you search through astro's posts for "Lily", they appear to be frequently RPing using a character called Lily just before Lily-anomalocaris makes their CS account. To me, this feels very in-line with the idea of someone creating fake accounts to be their "friends/siblings" etc, naming them after OCs.)

If you believe these accounts are NOT all the same person, you would have to believe that all 4 of these people:

Have used the exact same writing style as one another for over 10 years, all with perfect grammar and the same quirks.

Have all had the exact same interests as each other for over 10 years, with all of them leaving the Supernatural fandom at the exact same time, and with all of them studying the same thing/s.

Have all used the exact same wording across the art shops which they all started in very close proximity to one another.

All use the exact same relatively uncommon -- between clauses (potentially reflexive of the n-dash – which will be autocorrected from -- in writing programmes), same emoji combination of c: and :)/:( interchangeably, use the exact same message formatting, and use the exact same stamps.

Have all remained more-or-less equally as active across CS since joining, with the exception that starsets account joined a few years later, despite now supposedly being in their late 20s or early 30s with jobs and years of higher education, and that level of activity is relatively high.

Have all been participating in (sometimes the same) RPs on CS for literally almost 15 years, consistently, while doing all that other life stuff.

We do personally believe there's enough here to strongly suspect that all of these accounts are run by anomalocaris. We believe that there is a good chance that one or more of these accounts may have ORIGINALLY been a sibilng or friend, but anomalocaris has been in control of these accounts for a long time.

There is one significant disparity that we could find, which is conversations surrounding college.

It does appear that UV and astro talked about going to Houston for college in 2014-2015, while anomalocaris mentions going to Portland in 2018-2019. starsets mentions doing a Master's degree, but we can't find any evidence of when they started this.

We believe there are three reasonable explanations for this difference that don't disprove multiaccounting here:

anomalocaris is just acting out different personas in order to try and keep the accounts undetectable, and/or because they're really seriously lonely.

anomalocaris is using real details from either people they know IRL or the original owners of the accounts.

At the time the original posts were made, they were made by the ORIGINAL owners of the accounts. However, due to the typing similarities, we doubt this is the case.

Our theory is that uncanny valley and astro may have genuinely originally been friends, and astro may have been anomalocaris' older sibling. However, at some point, anomalocaris took control of the accounts, either with permission or otherwise, and has simply maintained the personas (not very well) in an attempt to avoid suspicion. As starsets is newer, we think that may just be a separate fake account that anomalocaris made intentionally. It could also be, especially since astro quit and liquidated to anomalocaris, that astro is the "real" person, and anomalocaris is either just their newest persona or is indeed their younger sibling, whose account they took over. This would be more consistent with their established writing style beginning all the way back in 2011/2012 on the astro account.

Flight Rising evidence

The final piece of evidence that definitively links all four accounts is Flight Rising. We don't know how the Flight Rising community feels about multiaccounting; we don't play it and don't know if it's normal or if it's banned like it is on CS. However, if it is against the rules, then hopefully this post serves as evidence for the FR side of things as well. This is why we're also tagging this post for FR.

anomalocaris is very careful not to share their CS usernames publicly on FR, or their FR usernames on CS.

We believe this is intentionally and done to prevent people from seeing the multiaccounting, since the approach on each site is slightly different. All 4 mention having FR accounts but either avoid mentioning the username, or specifically ask to be PM'd to give it out. There is one exception, however:

We checked out the uncannybagel (693056) account on FR. Their account was only made in 2023, which is long after we suspect the CS account was taken over by anomalocaris.

The account has only 3 friends - doikayt (333233), starsets (203783), and festivalofjoy (642558). Immediately, starsets and festivalofjoy stand out - obviously starsets is the same username as the CS account, but festivalofjoy also has an important note on their profile.

It seems very likely that starsets' previous username, Festival, and the horse they own, are the same Festival in FestivalOfJoy's username & profile. They also include the note of being a student like starsets does.

However, of course, there is a separate starsets profile on FR. Well, not that unusual - perhaps they just abandoned their old account and wanted to make a new one, right?

Ah. Interesting. So starsets goes by squid (bigfin squid was anomalocaris' previous username, remember) and likes cephalopods... as well as space. Remind you of anyone? Like astro, perhaps? And to top it all off, they use the same -- between clauses as all four of the other accounts.

The other account mentioned, doikayt, also contains a couple of interesting tidbits.

Namely the 'in progress' used on both anomalocaris and starsets accounts, and mentioning once again they're a sci-fi/fantasy writer who works with horses. These are literally all the same person.

Here, you can see starsets was quitting recently. And, to tie it back to the start of this section, you can see that they again request to be PM'd in order to get their CS username. The person at the bottom of this image, who asks in the thread, never gets a (public) answer, although starsets does come back to respond to other people in the thread. They're hiding their username because they don't want people to know that all of the accounts are the same person.

HACKING ACCOUNTS

The first clues

Of course, while checking through everything, we ended up going through some of anomalocaris' valuable pets once more. Aside from finding evidence of literally dozens and dozens of stolen pets from new accounts with absolutely no fair payment in return, we also noticed something odd - some of their rarer pets all came from the same few users: horselover88, ponyzx, and London*Fog.

When we noticed all 3 of them had horse-related names and/or profiles, we first assumed they were also alts, but that they had been used purely to collect pets. However, we noticed that none of them had actually been very active, especially when you compared to their recent login dates.

All three had very bare but not empty or fake-looking accounts, but all three definitely didn't have enough posts for the amount of time between first joining and last being online.

The signs of hacking

Because of how unusual this was, we actually checked to see when the most recent posts were, and found that indeed, none of them had actually posted for years and years. It seemed very much like these accounts had been forgotten about, but then suddenly logged back in recently to 'trade' with anomalocaris.

Then we took a look at their individual collections. All 3 were completely emptied. Only a few assorted pets, probably missed when adding to trades, remained in London*Fog's account.

To be clear, we do believe all of these pets went to anomalocaris. Several valuable pets from these users are in their keeping and trading groups.

This is just a small selection. We aren't exaggerating when we say they have hundreds and hundreds of pets from these three users, just like they have dozens of stolen D18s from newbies. There may even be other users included in this - we didn't have the time to search through all of these pets, that's how many there are.

While it is possible that these users just happened to go back to their accounts after all this time just to liquidate them to anomalocaris, or that these were genuinely just alts the entire time which anomalocaris suddenly remembered how to access, we were convinced this was hacking.

That's when we remembered a post on salty-cs at some point recently about password guessing, and a data breach. We searched for pet site leaks and found that Neopets had apparently had user passwords leaked in July 2022.

All three of these players suddenly logged on after the password leaks. Two of them were within months of the leak.

As we don't have a Neopets account (and didn't want to make one for this), we could only search the usernames, not see the actual accounts. But (with some slight difference in usernames), all three users appear to have accounts on Neopets.

To be clear, this data breach is available for people who want to spend the time finding it. Considering the horse connection, it's possible that anomalocaris already knew these users, or that there was another leak they used in some way. But it still seems extremely likely, in our opinion, that anomalocaris used information from the Neopets leak to hack these accounts, and transfer everything to their collection.

Oh, and for what it's worth...

CONCLUSION

Summary

This is an incredibly long post. We did want to go over everything thoroughly. Obviously there's plenty to explain, and we didn't want to leave anything out.

We're not under any illusion that this is all "total proof", to be clear. There is an infinitesimal chance that anomalocaris is just misunderstood - they really do have 2 friends and a sibling that are identical to them in every way, they really did get the entire accounts of 3 random users from 2011, and it just so happens that the dozens of newbies who gave them their D18s were given fair payment, which just happens not to be visible in their accounts in any way.

Again, we believe it's the combination of all of the evidence that makes it most clear - any of these things individually would not be too unusual.

Realistically, however, we're about as certain as you can be from circumstantial evidence alone: anomalocaris has been multiaccounting and stealing pets for years, and there's a good chance they've even hacked abandoned accounts and taken everything they have. We can't recommend strongly enough that you block all four of these accounts. And if you want to do the community a favour, report them first and link this post.

Some thoughts (very melodramatic, you can skip)

In regards to the thoughts I (Mod P) expressed the other day, yes, this was about anomalocaris. I don't want to be personal on this blog, but as I said in that post, there is more to this than just a pet site - it's what it says about you as a person, and what you're doing to the community.

It seems pretty clear to us that anomalocaris is, in no uncertain terms, a rather pathetic person. Assuming they really have been in control of all of those accounts for a long time, they RP with themselves and use these accounts to fake-order from their own art shops. They seem very keen to present themselves as a talented writer, but apparently they have enough free time to steal from children and pretend to be 3 other people.

More importantly, anomalocaris, if you're reading this - you are not a GOOD person. It doesn't matter how many Palestinian flags you put in your stamp collection (and again, I'm with you on your stance there). Good people - kind, honest, principled people - do not steal from the naive and vulnerable. It doesn't matter if its a game or not. If you really were as moral as you present yourself, you would work to better the community, not contribute to its failing economy and hostile atmosphere. You would have the empathy necessary to imagine the people you stole from when they find out, look back at their trades and see your username and realise just how much you took advantage, and start blaming themselves for being stupid, and leave the community because it's not a kind place. It's full of people like you.

And unfortunately, the site enables people like you. Even with all this evidence, we ourselves cannot report you and pass it on to the CS staff AND warn the community - because WE would be the ones who get banned for it just for running this blog. If staff do happen to read this, we would ask that you consider how you police users' offsite behaviour so that people like us, who really do just want to help the community, don't face being kicked out of it just for cleaning up the mess you allow to fester.