Wikipedia:Wikipedia:Sockpuppet investigations

From Global Warming Art

The following page is a local copy of the Wikipedia page at Wikipedia:Sockpuppet investigations. (more info)

Administrator instructions

WP:RFCU redirects here. You may be looking for Wikipedia:Requests for comment/User conduct (WP:RFC/U), CheckUser policy (Wikipedia:CheckUser), or Wikipedia:Changing username (WP:CHU).

Welcome to Sockpuppet investigations (SPI). Please see the sockpuppet policy for detailed definitions and descriptions of what sockpuppetry is and is not. This page is used to discuss whether a user is likely to have violated that policy, or breached other restrictions (eg blocks or bans) using multiple accounts.


CheckUser

CheckUser is a tool that allows authorized users to look at technical information left when a user/IP makes an edit. This technical information can help determine if a single person is using more than one account. Use of the checkuser tool is governed by policies on the English Wikipedia and Wikimedia Foundation levels. For more information, see the Foundation policy, the local policy and the Foundation privacy policy.

When not to request CheckUser

There must be credible evidence supporting the suspicion of sockpuppetry. Requests for checkuser without supporting evidence will be declined, because CheckUser is not for fishing. CheckUser requests are also not  magic 8-balls or magic pixie dust, and such requests will likewise be rejected. CheckUser should not be requested to investigate canvassing or meatpuppetry, or if the account(s) suspected have not edited for many months (i.e. are Stale). In addition, if behavioral evidence alone clearly indicates sock puppetry (see the duck test) then any CheckUser requests will likely be rejected.

Quick CheckUser requests

See #Quick CheckUser requests. This page may also be used for other CheckUser requests unrelated to sock abuse, such as:

Evidence and SPI case guidelines

You need to provide evidence showing the accounts or IPs are acting in a disruptive or forbidden manner, which other users will then assess. If there is no evidence, then nothing will happen and can result in the case being speedily closed by the SPI clerks. Most SPI cases are decided based upon behavioral evidence, that is, the behavior of the accounts or IPs concerned. This evidence needs to be explicit; that is, use verifiable evidence in the form of diffs, links to the pages in which the sock puppetry is occurring, and reasonable deductions and impressions drawn from said evidence. Evidence solely consisting of vague beliefs or assumptions will be rejected.

Some general guidelines when making your SPI case:

  • Remember to always assume good faith when possible.
  • After submitting a case, consider notifying the suspected accounts by adding {{subst:socksuspectnotice|PUPPETMASTER}} ~~~~ to the bottom of their talk pages. Notification is not mandatory, and may, in some instances, lead to further disruption or provide a sockpuppeteer with guidance on how to avoid detection.
  • Do not use any section headers ("===") on case pages as this will break the report templates and mess up the formatting.
  • Keep it simple. Simple, concisely presented evidence leads to a quickly resolved case.
  • After administrators and/or checkusers have reviewed the case, it will be closed and archived by an SPI clerk. (Administrators may mark a case closed using {{SPIclose}}.)

Submitting an SPI case

Create the case by replacing "CASENAME" with the name of the oldest account, or previous case name in the box below. For example, if the case name is about User:John Doe or a prior case is at Wikipedia:Sockpuppet investigations/John Doe, then you should enter Wikipedia:Sockpuppet investigations/John Doe in the box, then click the button.

Start an SPI case WITHOUT a CheckUser request Start an SPI case WITH a CheckUser request



See also

Open cases: not awaiting CheckUser

User reported cases

(view cases | edit cases )



Bot-reported cases

(view cases | edit cases )

Open cases: awaiting Checkuser processing

Cases in this section have an open request for CheckUser that is being processed. Any user may update or act on this case, and any patroller or clerk may decide the case. However it will not be closed if the Clerks believe any further action is needed.

  • Endorsement or decline of CheckUser may only be made by a Clerk.
  • If your case is not showing up here, or this section seems out of date, please click the .

Awaiting Clerk approval

(view cases | edit cases )



Awaiting CheckUser

(view cases | edit cases )



Completed cases

Pending close

Cases here have been closed by users and are awaiting a Clerk to review for formal close and archiving.

  • If your case is not showing up here, or this section seems out of date, please click the .

(view cases | edit cases )



Quick CheckUser requests

This section is for CheckUser requests unrelated to sockpuppetry, such as:

  • Underlying IPs - identification and blocking for a longer term than autoblock.
  • Collateral damage checks - before hardblocking IPs and ranges.
  • Threats of harm (to self or others) - where the location and other details may be needed for law enforcement or medical authorities.
  • IP block exemption checks - before granting IPBE or to confirm proper use.

Requests to investigate and confirm sockpuppetry should be listed in the sockpuppet section above. If posted here, they will be delisted by a clerk without being actioned.

Copy the following template and paste it to the end of this page (quick link to edit) with a useful header and details, then sign using "~~~~" and click "save".

==== HEADER ====
{{SPIquick}}

Rangeblock check on 64.231.0.0/16

This case has been marked as closed. It either has been, or will shortly be, archived automatically.

I need a check on the 64.231.0.0/16 range for collateral damage in order to determine a rangeblock. This range is being used by Grawp. MuZemike 21:30, 31 August 2009 (UTC)

I don't see grawp-like edits there, am I missing something? (The /16 range looks very busy). -- Luk talk 09:33, 1 September 2009 (UTC)
There is [17] and another IP in this range being used by him. MuZemike 14:23, 1 September 2009 (UTC)
Note that 64.231.8.0/22, which includes 64.231.11.58, is already softblocked due to User:ScienceGolfFanatic. The other IP was possibly 64.231.202.35 (talk · contribs · block log)? Apart from this I haven't seen enough disruptive behaviour from this range for a block of this magnitude. I'm not even sure you could put a name to the particular vandal on these IPs. -- zzuuzz (talk) 14:35, 1 September 2009 (UTC)

Ip sock of user Dewan357

[18] looks like his ip sock is back hes evading a block 86.156.208.95 (talk) 12:32, 6 September 2009 (UTC)

N Not done - please open a full case with evidence following the instructions at the top of this page. This section is only for quick checks unrelated to sockpuppetry. Hersfold (t/a/c) 19:00, 6 September 2009 (UTC)



(For help, see Wikipedia:Purge)

Toolbox