Jump to content

Wikipedia talk:Sockpuppet investigations/Archive 19

Page contents not supported in other languages.
From Wikipedia, the free encyclopedia

User:Badiacrushed admits they are a sockpuppet of banned User:Calamitybrook

Please see here where User:Badiacrushed admits they are a sockpuppet of banned User:Calamitybrook. Calamitybrook was permanently blocked by SarekOfVulcan on October 6, 2011 for "Personal attacks or harassment: telling editors they had better hide their RL identity is beyond the pale" - see here. Ruhrfisch ><>°° 19:10, 15 March 2017 (UTC)

Sarcasm, not an admission. Please see Wikipedia:Sockpuppet investigations/Calamitybrook/Archive#28 February 2017. Ivanvector (Talk/Edits) 20:25, 15 March 2017 (UTC)
OK, thanks for the link - I had not seen that SPI Ruhrfisch ><>°° 18:27, 16 March 2017 (UTC)

Why isn't there a bot to archive SPI's?

I was wondering, since most noticeboards and talk pages have a bot to archive discussions, why do SPI cases need to be manually archived when a bot could do all the hard work instead? The bot could archive cases placed in the "Cases awaiting archiving" category. Are there any bots in development for this purpose too? Class455 (talk|stand clear of the doors!) 16:33, 19 March 2017 (UTC)

We have decided that each case should be reviewed by a clerk or checkuser to be sure that the case is complete, and the correct action has been taken, prior to archiving. We do use a script to assist us, so archiving isn't hard work at all. ​—DoRD (talk)​ 16:39, 19 March 2017 (UTC)
Ahh I see, but shouldn't each case be reviewed when the case is marked as closed, then a bot archives it? I'm not suggesting that I develop a bot, as I don't have any software on my Mac and I've forgotten most of my coding skills from when I was studying computer science, so I don't know how to code a bot but others could consider it if consensus agreed to it? Class455 (talk|stand clear of the doors!) 17:22, 19 March 2017 (UTC)
We also decided at some point that the clerk closing the discussion should not be the clerk to archive, so that the second check is guaranteed by procedure. It works very well, actually, although the list of closed cases awaiting archiving sometimes gets long. Ivanvector (Talk/Edits) 18:00, 19 March 2017 (UTC)
Exactly. Two sets of eyes are better than one. ​—DoRD (talk)​ 18:29, 19 March 2017 (UTC)

Template:SPImonth

Greetings, is Template:SPImonth still used anywhere? Jo-Jo Eumerus (talk, contributions) 21:32, 25 March 2017 (UTC)

No, it doesn't seem to be. My best guess is this was part of the old Wikipedia:Suspected sock puppets process. It seems to be mostly orphaned now. Ivanvector (Talk/Edits) 17:32, 6 April 2017 (UTC)

Admin facilitating block evasion

I am growing increasingly concerned with the administrative actions of User:Nyttend with respect to sockpuppetry. Earlier today they declined the WP:G5 speedy deletion of Ol Ravy on the basis that the page had been moved from Draft:Ol Ravy. I objected to this on their talk page, based on the fact two CheckUsers seemed to disagree on how to handle AfC submission by sockpuppets, pointing out that User:DeltaQuad and User:Courcelles had speedy deleted accepted drafts on Ly Vahed, Ros Kungsomrach, and Seut Baraing created by the same sockpuppeteer. Nyttend immediately took this as an open invitation to restore two of the articles, essential using their admin tools to facilitate block evasion. This is deeply troubling to me, and like some input from admins more involved the investigation process. Sir Sputnik (talk) 17:01, 6 April 2017 (UTC)

@Sir Sputnik: This has nothing to do with SPI. This is about how the community wants to handle WP:G5. --NeilN talk to me 17:04, 6 April 2017 (UTC)
Be that as it may, I would like some input from admins more familiar with sockpuppetry, and this page seemed like a good place to find them, even if it isn't entirely the correct forum for this discussion. Sir Sputnik (talk) 17:10, 6 April 2017 (UTC)
This is governed by the policy at WP:CSD. The issue is whether a page move is significant edit. They are automatically marked as minor; in my view they are not significant. However WT:CSD is the place to clarify the policy. -- zzuuzz (talk) 17:16, 6 April 2017 (UTC)
Like everyone else said this should be at WT:CSD, but anyway my opinion is that G5 makes deletion of a page created by a sockpuppet optional, not compulsory, and it is permitted for editors in good standing to take responsibility for a blocked editor's contributions (all explained at WP:BANREVERT). I presume Nyttend intended to do so, and restored the articles' histories to comply with WP:ATTRIBUTION. While you might wish to quibble about whether restoring these pages from deletion constitutes wheel warring (on the balance I think it does not) it's an extremely large stretch to say this is "using admin tools to facilitate block evasion". Ivanvector (Talk/Edits) 17:39, 6 April 2017 (UTC)
I also agree that moving a page from draft to main space is housekeeping and not significant. Other kinds of moves may not be so trivial. Ivanvector (Talk/Edits) 17:41, 6 April 2017 (UTC)
Moving a page from Draft to article space is not a "substantial edit" and should not negate the applicability of the G5 tag. Creating an article in draft space in order to avoid immediate detection or to circumvent main space salting is a common ploy used by socks and it can be frustrating to see these actions appear to be endorsed by admins if you have a history of dealing with cleaning up after LTA sockmasters. That being said, there is nothing in our policies that state the articles must be deleted, and if they are CSD declined or restored in accordance with WP:BANREVERT wherein an editor is taking responsibility for the content, then there's no further action that needs to be taken.--Jezebel's Ponyobons mots 17:58, 6 April 2017 (UTC)
I would just like to clarify my initial statement here, since in re-reading it's not worded quite as precisely as it should have been. I don't think for an instant that Nyttend was deliberately facilitating block evasion, but rather that making it easier was consequence of their actions that they did not fully appreciate. I see now that no further action is needed here. Thank you all for your input. Sir Sputnik (talk) 18:02, 7 April 2017 (UTC)
While we're on the topic, I want to echo Ivanvector's statement - while G5 is a useful tool for cleaning up garbage created by blocked users and can be used to deter people from socking, it isn't a requirement, and we shouldn't shoot ourself in the foot (by deleting good content) just to spite a blocked user. Sam Walton (talk) 18:58, 7 April 2017 (UTC)
I think it's unfair (and generally inaccurate) to ascribe the motive of a G5 deletion as "spite".--Bbb23 (talk) 19:37, 7 April 2017 (UTC)

When you notice an obvious sock account but do not know whose sock she/he is

What can we do in that case? Catharsis of Mind (talk) 16:32, 9 April 2017 (UTC)

Nothing. Just keep watching it until it does 'something.' But bear in mind that an 'obvious sock' is often in the eye of the beholder. — O Fortuna velut luna 16:37, 9 April 2017 (UTC)
Not quite nothing. CUs have their hands tied. Admins can block per WP:SCRUTINY. I've blocked obvious socks with a "sock of someone" reason. --NeilN talk to me 16:46, 9 April 2017 (UTC)
Indeed. I took the second-person plural to indicate the OP referred to what other editors like them could do themselves. — O Fortuna velut luna 16:52, 9 April 2017 (UTC)

Fresh perspective

I've been working on a possible SPI case, but I'd like some fresh perspective first before submitting. Please let me know if you think there's sufficient evidence to open a new case, or anything else you think may be relevant:

Thanks. Levdr1lp / talk 09:55, 10 April 2017 (UTC)

Based on the responses I've received at my talk page, I've reopened a previous case at Wikipedia:Sockpuppet investigations/StylesClash18. Levdr1lp / talk 14:52, 10 April 2017 (UTC)
Update: a CU determined that the suspected registered users in the case are unrelated. I have revised the draft above accordingly. Levdr1lp / talk 12:34, 11 April 2017 (UTC)

Anonymity while reporting?

Hi,
Can a user maintain his anonymity while submitting a request for sock-puppetry investigation? Kindly ping me when you reply. —usernamekiran (talk) 19:44, 25 April 2017 (UTC)

@Usernamekiran: A user can try. It is not prohibited, but that sort of action invites scrutiny of the filing party, and may result in him being checked for sockpuppetry or block evasion. The case will still be looked. Someguy1221 (talk) 19:53, 25 April 2017 (UTC)
@Someguy1221: Thanks. But wouldnt this automatically create trouble/problems between the reporter and abuser? —usernamekiran (talk) 19:58, 25 April 2017 (UTC)
@Usernamekiran: Yes, but the same is the case for reports to AIV, ANI and AN3. Unless the report involves private information that should not be posted on Wikipedia, it is preferred that all discussions be public. And that is because it was decided at Wikipedia's founding that transparency is important. Someguy1221 (talk) 20:23, 25 April 2017 (UTC)
@Usernamekiran and Someguy1221: you can also try emailing a trusted user or admin to request that they file the case for you and keep you anonymous; that way they can vouch for the good faith nature of the request. ansh666 22:53, 25 April 2017 (UTC)
@Ansh666: yes, that seems doable. Thanks for the advice. :) —usernamekiran (talk) 22:56, 25 April 2017 (UTC)

Re-open a closed SPI?

Is it possible to re-open a closed SPI?

I submitted an SPI with behavioral evidence which seemed overwhelming. An unrelated administrator commented: "In my opinion this is obvious and [the editor] should be blocked per WP:DUCK and the below CU result", as well as "In my opinion this is a clear [editor's name] sock, or a closely related meatpuppet (friend/roommate/etc) editing at his direction. The editing interests, style, and combativeness are the same".

The SPI was investigated and the result was "inconclusive". The suspected sock is a prolific editor, and their talk page is littered with warnings.

My intent is in no way meant to negatively comment on the original clerk. I'm just requesting a second opinion. I haven't seen any policy about this however. Thank you. Magnolia677 (talk) 19:30, 26 April 2017 (UTC)

Magnolia677 which case?
 — Berean Hunter (talk) 22:13, 26 April 2017 (UTC)
Berean Hunter - See Wikipedia:Sockpuppet investigations/Xboxmanwar/Archive. The only editor I suspect is "Bloomdoom2". The other suspected socks listed were added by other editors. Thank you. Magnolia677 (talk) 23:37, 26 April 2017 (UTC)
Looking this over some more, the likeness of the edits, couple with the volumes of behavioral evidence, seems too unlikely to be a coincidence. In two minutes of looking I found more...
  • [1][2] - The only edit was to "Epic Records".
  • [3][4] - Edit to the word "Daxz". It goes on and on like that. Magnolia677 (talk) 00:54, 27 April 2017 (UTC)
@Vanjagenije: He was when he wrote them. Magnolia677 (talk) 09:55, 27 April 2017 (UTC)
  • I don't believe there's any relevant policy, but I'm happy to have another clerk review the case in detail. I've already reviewed it twice. Ivanvector (Talk/Edits) 13:43, 27 April 2017 (UTC)
  • I object to it being reopened. No need to review it again.--Bbb23 (talk) 14:22, 27 April 2017 (UTC)
Bbb23, I completely understand why you would object, and the last thing I would want to do is waste anyone's time on here.
As you know, I'm not a regular on these boards, but from time to time I notice similarities in editing and I report it. In this case, I had many interactions with the blocked puppetmaster, Xboxmanwar, who was an angry and prolific editor of rap music articles, and whose editing behavior could best be summarized as "80% sourced, 20% original research". It took months until they were finally blocked indefinitely, and I regularly encounter the mess this editor left behind.
Most of my edits are to small US towns, which I love, but for about a year now I have been reverting vandalism to rap music articles. I rarely add content to the rap articles. When I encountered Bloomdoom2, the similarities to Xboxmanwar appeared overwhelming. I spent hours compiling difs and reported them, and then a few months later, I discovered what I felt was a very clear offline link between Xboxmanwar and Bloomdoom2 as well. I reported this subsequently.
My efforts to curtail Bloomdoom2's "80% 20%" style of editing has been difficult, as you can see by his talk page. The level of hostility this editor expresses towards those who question their edits is another striking similarity between these two editors. Just look at this edit summary and this one.
I realize how much time Wikipedia demands of us, and I would not be asking that this be looked at by a different clerk if I did not feel it would benefit the project, particularly a part of the project so plagued by vandals and paid editors. Thank you. Magnolia677 (talk) 16:32, 27 April 2017 (UTC)
I still object. I suggest you let it go.--Bbb23 (talk) 16:54, 27 April 2017 (UTC)

Why so many socks?

I know, it's a dumb question. But in moments of frustration, like when the community has to clean up after another extended-confirmed sockpuppet when it could have used that time to do something else, I find myself asking this question. Please humor me for a second. There has to be thousands of sockpuppets. I've never done it before, but they make it seem as if evading blocks is no trouble at all. I've seems many, many cases where the socks make it all the way to WP:XCON status before being detected, multiple times over. It's like the block button has no effect whatsoever. Why is it so easy for blocked editors to come back? Why are there so many socks? Sro23 (talk) 01:13, 18 April 2017 (UTC)

@Sro23: It's your fault. If you didn't file so many meritorious SPIs, many of the socks would escape notice completely.--Bbb23 (talk) 02:11, 18 April 2017 (UTC)
If a sock gets blocked in the forest... GABgab 02:19, 18 April 2017 (UTC)
  • By "how many socks" does anyone have a distribution plotted for socks vs. sockmasters? My impression is that a handful of sockmasters are extremely prolific, such that a very large proportion of the total socks are coming from a small number of masters. Within those, there are both the dedicated POV pushers and the commercial editors, as two distinguishable groups. Andy Dingley (talk) 14:51, 25 April 2017 (UTC)
That very well could be true - that the majority of socks come from a small number of dedicated masters. Probably the most common types of masters are the POV pushers, the nationalistic sort of editors in general. But then there's also prolific sockmasters like this one, for example. CC5K socks are obsessed with Justin Knapp and will insist Weekly Shōnen Jump is a terrorist/hate group. Isn't that oddly specific? Sro23 (talk) 02:27, 28 April 2017 (UTC)
I agree with Sro23 regarding "the most common types of masters". I also think that many of them are paid editors. 46.221.223.222 (talk) 06:15, 28 April 2017 (UTC)

Semi-protected edit request on 4 May 2017

Copy from Wikipedia:Administrator intervention against vandalism. Found that User-4488 may use socks puppets repeatedly improper editors. Like Pipcai and User-4488.The common point is that the edited pages have traces of IP-(2600:387:6:X)'s edits 

* 袜子1 (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log)  May be User-4488 and use IP 2600:387:6:80d::7a 2600:387:6:80d::75 / 2600:387:6:80d::82.
:See [talk:袜子1: Revision history] / Special:Contributions/2600:387:6:80D:0:0:0:82 / Special:Contributions/2600:387:6:80D:0:0:0:75 / 
Special:Contributions/2600:387:6:80D:0:0:0:7a / [talk:User-4488: Revision history] / [[https://en.wikipedia.org/w/index.php?title=User_talk:Widgetsz89&action=history%7CUser 
talk:Widgetsz89: Revision history]] / Special:Contributions/User-4488 / Special:Contributions/袜子1
:These IP and account editing time is quite close account editing time is quite close. 61.224.5.200 (talk) 01:03, 4 May 2017 (UTC)
:: Note:  This seems a bit more sophisticated, consider taking this to WP:SPI —k6ka 🍁 (Talk · 
Contributions) 01:22, 4 May 2017 (UTC)
::Add new Pipcai may be User-4488. find use 2600:387:6: X find 2600:387:6:80d::84 and Widgetsz89 in 
Military activity of ISIL.--61.224.5.200 (talk) 06:06, 4 May 2017 (UTC)61.224.5.200 (talk) 06:48, 4 May 2017 (UTC)

--61.224.5.200 (talk) 06:48, 4 May 2017 (UTC)

 Not done. Please expand the box labeled "How to open an investigation:" on the main SPI page, then expand the green box within to file a report. ​—DoRD (talk)​ 12:10, 4 May 2017 (UTC)

Wikipedia talk:Sockpuppet investigations/Tirgil34 - new SPI request on the wrong page

This has been brought by an IP who added it to the wrong page, and I'm not sure what is the best way to fix it. Thanks. Doug Weller talk 13:54, 7 May 2017 (UTC)

I copy/pasted it to the main SPI, referencing the request in the edit summary. ​—DoRD (talk)​ 14:00, 7 May 2017 (UTC)

Hard blocks at SPI

Sometimes an IP address will come up at SPI, and I'll see it's been stable for over a year, obviously being used for nothing but block evasion. The block log reveals that it's been hard blocked by a CheckUser in the past. When I block this IP, should I make it a hard block? I assumed not, because I obviously don't have access to CheckUser data, but then I saw a CheckUser convert one of my blocks to a hard block. This made me wonder if I was making extra work for the CheckUsers. NinjaRobotPirate (talk) 16:12, 10 May 2017 (UTC)

@NinjaRobotPirate: In my view, a non-CU should not be hard-blocking "normal" IPs. An exception would be webhosts and the like. The probable reason a CU converted your soft block is the CU can see how much collateral damage there is with a hard block and whether the hard block is justified. I wouldn't think of that as your making extra work for CUs. I'm sure the CUs and others appreciate your initial block.--Bbb23 (talk) 17:27, 10 May 2017 (UTC)
If it has previously been hardblocked by a CU, it's probably safe to hardblock again, but the circumstances might have changed, so it's best to ask a CU to have a look. ​—DoRD (talk)​ 17:41, 10 May 2017 (UTC)

Merge request

Could an admin clerk please merge Wikipedia:Sockpuppet investigations/Football asen to Wikipedia:Sockpuppet investigations/Nuttawat. In addition to the obvious similarities of both using multiple accounts and both having a near exclusive interest in football in Laos, both have gotten in trouble over bad copy/paste editing (see the only entry in the SPI archive for Nuttawat, and Football asen's edits here), and both have frequently uploaded logos of Laotian football clubs without evidence permission (see talk page notifications here and here). Thanks. Sir Sputnik (talk) 02:37, 29 May 2017 (UTC)

Eciffociu Investigation

Just wondering... Why do some investigations take such a long time? What makes this case so special that it takes much longer than usual?

https://en.wikipedia.org/wiki/Wikipedia_talk:Sockpuppet_investigations/Eciffociu 87.100.241.178 (talk) 21:55, 11 June 2017 (UTC)

WP:AN discussion about Template:IPsock

Cross-posting this discussion as relevant to SPI: Wikipedia:Administrators' noticeboard#Tagging IP addresses with Template:IPsock. ☺ · Salvidrim! · ✉ 16:40, 12 June 2017 (UTC)

Merge request

Wikipedia:Sockpuppet investigations/StewieRox should be merged with Wikipedia:Sockpuppet investigations/ImmaBeeBe. StewieRox was shown to be a sock of ImmaBeeBee in a CU (documented in Wikipedia:Sockpuppet investigations/ImmaBeeBe) but a later SPI was filed on StewieRox, and a couple of other accounts (User:MmmMcGriddles and User:ILoveKrabbyBurgers) have been tagged as socks of StewieRox as well. I was about to start another SPI when I noticed this. --bonadea contributions talk 08:24, 19 June 2017 (UTC)

Additional complication: I have just come across WhenDatHotlineBling who was blocked back in November (but posted a stream of unblock requests in April), and who I am convinced is also the same user. Not only because of this, but their user talk page "contributions" are very similar to those of other blocked socks, and before they were blocked they also edited a similar range of pages such as McGriddles. Assuming it is the same user, it should be the sockmaster. I think I'll stop digging now before I unearth something even more ancient... --bonadea contributions talk 13:32, 19 June 2017 (UTC)

 Partly done - I have merged the cases. I suggest adding evidence for HotlineBling to a new report at Wikipedia:Sockpuppet investigations/ImmaBeeBe and a clerk will move the case to the new master if a connection is determined. Ivanvector (Talk/Edits) 14:04, 19 June 2017 (UTC)
Thank you! I will do that. --bonadea contributions talk 14:46, 19 June 2017 (UTC)

Martimc123/Dwdpuma

I was just speaking to Martimc123 on the #wikipedia-en-unblock IRC channel, and they claim there's some (but not total) overlap between these two SPIs. The primary thing being that a number of the accounts listed in the Dwdpuma SPI are in fact Martimc123 socks. Specifically Variouswrestlinglover, TheNewHelper41, TheWrestlerHelper15, Wrestlingloveditor, ThePerstigousHelper134, TheSwordofHell23, and TheBuilder456. Whether someone wants to do something with this information is up to you. Sam Walton (talk) 11:04, 22 June 2017 (UTC)

Re-opening SPI

I've re-opened an SPI at Wikipedia:Sockpuppet investigations/DawgDeputy based upon recent activity. Do I also need to manually add this to Wikipedia:Sockpuppet investigations#Cases currently listed at SPI, or will this be added by a bot or an SPI clerk once WP:CHK has been completed? AldezD (talk) 16:00, 22 June 2017 (UTC)

The table is auto-updated by bot every so often, so you don't need to do anything else. Sir Sputnik (talk) 16:16, 22 June 2017 (UTC)

 Stale calculator

Might we be able to incorporate some sort of indicator into the SPI page, the form filled out to file a new case, or the Twinkle module for case-filing, indicating the earliest date an account could have last edited and still be CU'd? Might it even be possible to work out some sort of script indicating which accounts are stale, a bit like the markblocked script? At the simplest level, we could just link to this. This would be very helpful because it would save us a good deal of non-actionable CU requests. GABgab 14:05, 23 June 2017 (UTC)

If it can be done - it would need to take into account any deleted edits as well as live edits - it might be something to add to {{Checkuser}} and {{CheckIP}} (or SPI-specific versions of those). Template code can handle the calculation, but the rest? I don't have a clue. A user script could probably do it easier, though. ​—DoRD (talk)​ 14:17, 23 June 2017 (UTC)
If we ever update {{Checkuser}} for any reason, we should add a link that gives us the creation date of the account. Now it requires two clicks, which can be very tedious when there's a long list. Of course, what would be best is for the WP:SPI and the Twinkle openings of a new case to warn the filer if they picked an account that isn't the oldest. I get tired of moving cases.--Bbb23 (talk) 14:21, 23 June 2017 (UTC)
What we really need is a dedicated case filing script, like the one that TCanens was working on a few years ago (User:Timotheus Canens/SPIW.js), rather than relying on Twinkle or the template subst-ing kluge we have now. Unfortunately, Tim doesn't have time to work on it, nobody else has taken much interest in it, and my programming skills are decades out of date, so there it sits. ​—DoRD (talk)​ 14:50, 23 June 2017 (UTC)
I'll bet MusikAnimal could do a good job with this but even if he doesn't have the time then he may know of someone that does. Some of these functions sound great to me.
 — Berean Hunter (talk) 15:45, 23 June 2017 (UTC)
Man I wish I could help but I'm swamped with other tech work! The JavaScript gurus who come to mind that are currently active and may be able to help include Enterprisey and Writ Keeper. Best — MusikAnimal talk 15:51, 23 June 2017 (UTC)
I'm not gonna have a ton of time this weekend, but I can take a look. Writ Keeper ⚇♔ 16:09, 23 June 2017 (UTC)
One of the user info CSS scripts (I forget which now) already indicates when a user last edited if you're viewing their user or user talk page, and I think takes into account deleted edits and maybe also edits which are denied by an edit filter (not sure). It should be possible to incorporate that "last edited" code into {{checkuser}} for example, although the viewer may need to have that same script installed. This is just a slightly educated guess. Ivanvector (Talk/Edits) 14:34, 23 June 2017 (UTC)
WP:POPUPS - but it fails to give correct information in a number of situations. ​—DoRD (talk)​ 14:50, 23 June 2017 (UTC)
No, not POPUPS, it's the one that adds "an extended confirmed user, pending changes reviewer, {yy} years {mm} months old with {editcountitis} edits, " etc. below the page title. Of course it seems to be broken right when I'm trying to find it. Ivanvector (Talk/Edits) 17:34, 23 June 2017 (UTC)
It's this one: User:PleaseStand/userinfo.js. My browser's Javascript seems to have stopped completely :( Ivanvector (Talk/Edits) 17:37, 23 June 2017 (UTC)
Actually, this script is about as good as it's going to get without dealing with the deleted edits problem. Thanks for mentioning it. GABgab 22:02, 23 June 2017 (UTC)
As it turns out, it will count deleted edits, but it just won't display when they were made. GABgab 22:07, 23 June 2017 (UTC)
Yeah, deleted edits are a problem. So this wouldn't be a panacea, just somewhat useful. GABgab 14:37, 23 June 2017 (UTC)
And the "oldest account" indicator would be amazing... although it would render me obsolete. GABgab 14:41, 23 June 2017 (UTC)
LOL, it would mean only that you wouldn't have an excuse for making a mistake about account age. You're not going to use that as an excuse for getting out of clerking.--Bbb23 (talk) 14:58, 23 June 2017 (UTC)
Nah, he's got to stick around to fix the screwups I make about oldest account age. "It's this one!" "No, it's that one!" "No, it's the other one!" "No, it's the first one!" Katietalk 16:44, 23 June 2017 (UTC)
Hey, y'all, in the course of this, does anyone mind terribly if I make some non-visible edits to the templates used in the CU pages (like Template:checkuser)? It'd be a lot easier if I could add pre-baked CSS classes to the templates to key off of for page manipulation. Writ Keeper ⚇♔ 16:51, 23 June 2017 (UTC)
@Writ Keeper: I'm knitting you a cape for Christmas.--Jezebel's Ponyobons mots 17:30, 23 June 2017 (UTC)
Go for it.
 — Berean Hunter (talk) 19:25, 23 June 2017 (UTC)
@GeneralizationsAreBad: @DoRD: @Berean Hunter: @Ponyo: et al.: First draft is done, here: User:Writ Keeper/Scripts/cuStaleness.js. Install by adding mw.loader.load("/w/index.php?title=User:Writ Keeper/Scripts/cuStaleness.js&action=raw&ctype=text/javascript"); to your common.js page (or whichever skin page you prefer), as usual. It will only work on SPI case pages (and on my sandbox for testing), and keys off of Template:Checkuser and (now) Template:Checkip; if you don't see anything at first, try purging the page, which might be necessary to see the prerequisite template changes. Feedback, comments, concerns, rotten tomatoes welcome, as always; the script should work but hasn't been extensively tested yet, so apply grains of salt as necessary (there are especially a lot of edge cases around deleted vs. normal contribs, so keep an eye out there especially). Cheers! Writ Keeper ⚇♔ 05:47, 28 June 2017 (UTC)
Thank you, Writ Keeper! I have started a discussion page at User talk:Writ Keeper/Scripts/cuStaleness.js. ​—DoRD (talk)​ 11:25, 28 June 2017 (UTC)
  • This is what we've needed all our lives (and also I wish I was an admin so that I could check deleted contribs). *weeps on altar* --QEDK (愛) 20:01, 2 July 2017 (UTC)

Opening an IP LTA?

What's the best way to open an LTA case on an IP-hopper?

There is a US Comcast user who focuses on UK steam locomotive articles, with a range of minor and often accurate edits, but sneaking in some subtle vandalism along with it. They're not easy to spot unless you're subject-familiar, or have encountered them before (fortunately their field of attack is specialised). It would be useful for those dealing with AIV reports to have an LTA case to refer to, to make this long history obvious.

Favoured articles would be

Identities (at least a year of these)

Should a LTA case be opened on an early IP? Or under a given name? Any suggestions? - or are they filed away somewhere already? Andy Dingley (talk) 08:24, 20 June 2017 (UTC)

I've wondered about this re a different LTA (Andy, I'll see your "at least a year" and raise you to over two years!). However I wonder if the principles of WP:RBI should be followed. It is clearly just a game; they cannot believe that their efforts will ever be allowed to remain. Giving them recognition in the form of a "wanted poster" may simply encourage them. Jeh (talk) 21:33, 20 June 2017 (UTC)
I know some editors find it useful to keep the information in a subpage of their user space. When a new IP following the pattern shows up they can provide the subpage link in their WP:AIV or WP:ANI report when requesting a block. This way the reviewing admins don't have to try to piece the history together each time the IP-hopper is reported. --Jezebel's Ponyobons mots 21:45, 20 June 2017 (UTC)
I thought that sort of thing was precluded by WP:POLEMIC ? Jeh (talk) 21:53, 20 June 2017 (UTC)
Tracking IP-hopping socks doesn't run afoul of polemic and is common practice. Which part of WP:POLEMIC do you think prohibits such use? It's not the same as keeping a laundry list of complaints about good faith fellow editors.--Jezebel's Ponyobons mots 22:00, 20 June 2017 (UTC) --Jezebel's Ponyobons mots 22:00, 20 June 2017 (UTC)
Reviewing POLEMIC, I guess I was interpreting "statements attacking or vilifying groups of editors, persons, or other entities" too broadly. I suppose that once an IP has been blocked and tagged as a SP, collecting a history of such IPs won't be an issue, since TPBP have designated them as SPs.
In my most recent SP report on this case I included the recent IPs from the group - I was thinking I could just keep copying that list to future reports, appending the new IP(s) each time. I have no preference for either method; I want to stay in the rules, while perhaps making the need and justification for a rangeblock more quickly apparent.
Ponyo - no support for an LTA case? Jeh (talk) 23:06, 20 June 2017 (UTC)
An LTA case would be fine, I was just providing an additional option.--Jezebel's Ponyobons mots 20:01, 21 June 2017 (UTC)
(ec) I agree with Ponyo. Anyway, the most current four IPs are part of 2601:281:cb80:53c::/64, which is blocked until this time next year. It's unlikely that they'll be able to stray out of that range very easily, but if they do, it shouldn't be difficult to put a stop to the editing. Jeh's LTA, if it's who I'm thinking of, is a bit more difficult to get a handle on, unfortunately. ​—DoRD (talk)​ 23:11, 20 June 2017 (UTC)
FWIW Andy, I spent time trying to match this to other socks or LTAs but came up negative.
 — Berean Hunter (talk) 01:36, 21 June 2017 (UTC)

RfC sockpuppet suspicions

In closing RfC's I sometimes see accusations of sockpuppetry (example) and in other cases there are numbers of SPA's and IP's with few edits making similar arguments. Is there a tool that a non-admin has access to which can help in evaluating such a discussion? I would hate to waste checkuser time by blanket reporting an entire RfC as "fishy" but, at the same time, allowing manipulation of a discussion to create a fake consensus is also something to be guarded against. Any suggestions? thanks. Eggishorn (talk) (contrib) 03:14, 6 July 2017 (UTC)

It is fairly common practice with paid editing to see multiple similar accounts weigh in on the same RfC. Sounds like a good use of SPI. Doc James (talk · contribs · email) 06:35, 6 July 2017 (UTC)
That is one scenario I had in mind but I'm also suspecting some RfC's have a meatpuppet/sockpuppet mish-mash. Would you recommend just referring the entire RfC or individually identifying the most suspicious ones? Thanks. Eggishorn (talk) (contrib) 16:48, 6 July 2017 (UTC)
One would need to provide evidence based on, on Wikipedia links. One would need to explain which accounts you believe are being operated by the same person and why. Meat puppetry is harder to deal with. Doc James (talk · contribs · email) 17:57, 6 July 2017 (UTC)

Should all sockpuppets come here?

If I, as a non-admin, see blatant, obvious sockpuppetry by a master who does not already have a preexisting SPI case, should I always file a case? I just made this one, but full cases about these likely drive-by users just seem to add to clutter and distract from the complex ones. – Train2104 (t • c)

Yes this is the place to file sock puppet concerns. Doc James (talk · contribs · email) 03:15, 10 July 2017 (UTC)

Suspected sockpuppet, but I can't remember the prior account or how to find it

I recall a few weeks back a user who was creating articles based on the premise that "most African Americans are exclusively focused on using technologies from early 1901 up until December 31, 1999, such as VHS VCRs, cathode-ray-tube (CRT) television sets and computer monitors, landline telephones, typewriters, early 1970s-late 1990s desktop personal computers with built-in floppy disk drives and dial-up Internet access included, very early MP3 players from the mid-to-late 1990s, vinyl record players, analog television services, audio cassettes/CDs, pagers, payphones, PDAs, etc."

I now see that User:HelloWindows95 is putting the same claim into articles, but I don't remember the prior user who was doing that before. Does anyone remember that other user? --Metropolitan90 (talk) 01:18, 10 July 2017 (UTC)

I can't tell who the master account is either, but I'm going to hazard a guess that this same person operated all the other accounts blocked as socks that have edited Drexel Hill, Pennsylvania and West Philadelphia recently. @Bbb23: should be able to shed some light on the matter since they blocked many of them. Sir Sputnik (talk) 01:29, 10 July 2017 (UTC)
Actually, after a bit of digging, I'm pretty sure that this SPI case is the one you're looking for. Sir Sputnik (talk) 01:36, 10 July 2017 (UTC)
Thanks for finding that. I see that User:HelloWindows95 has already been blocked. --Metropolitan90 (talk) 02:15, 10 July 2017 (UTC)

Checking if two groups of socks are related

Were do we propose this? Specifically these two groups have a similar style:

This one Scorpion sock [5] This one Scorpion sock [6] This one Susana sock [7]

Refs are similarly formatted with similar ref naming style. Doc James (talk · contribs · email) 00:25, 14 July 2017 (UTC)

Perhaps open a new report for Scorpion, asking for the comparison with Hodge (ie, with Hodge as the suggested sockpuppet). --Tryptofish (talk) 00:35, 14 July 2017 (UTC)
The accounts also both worked on [8] Doc James (talk · contribs · email) 01:48, 14 July 2017 (UTC)
  • Everybody's blocked whether or not they're related, and all the accounts in SPI/Scorpion293 are too stale to Checkuser. ☺ · Salvidrim! · ✉ 02:08, 14 July 2017 (UTC)
Yah Scorpion's last edit was in Jan 2017. I guess the question is should we be keeping IP data from blocked sock puppet account? Doc James (talk · contribs · email) 03:45, 14 July 2017 (UTC)

Wildcard searches on deleted contribs

I've searched around to see if anyone else has ever suggested this but not finding anything. As I frequently check IP ranges for their contribs, I would like to see wildcard searches applied to deleted contribs. As an example, we admins can see these deleted contribs but when trying to search the whole /24 range's deleted contribs which should include 182's, we get nil. Essentially, as deletions occur we are losing information that could prove helpful ferreting out socks, COI cases, spammers, etc.

I realize that the next community wishlist at meta is still several months away but I was wanting to put this on the table to discuss the idea and its feasibility.
 — Berean Hunter (talk) 15:34, 20 July 2017 (UTC)

That would be useful addition. I agree. Vanjagenije (talk) 15:50, 20 July 2017 (UTC)

Where to start listing new GdB socks?

It looks like User:Guido den Broeder has started socking again. As part of his previous banned/unbanned/banned/unbanned/banned history, he was either renamed to User:Roadcreature, or that's one of his socks, or something. His latest incarnation, User:Guido den Broeder, has no SPI and a (relatively) clean block log that doesn't show all his history of socking, which is now under User:Roadcreature's name. Anyway, do I file a new SPI under Guido's current account name, or under Roadcreature's, or do we rename Roadcreature's SPI archive to be under his current name, or - since I've already blocked the socks - are "for the record" SPI's not really useful and I should just go away? --Floquenbeam (talk) 14:27, 21 July 2017 (UTC)

Floquenbeam, Go ahead and file under the Roadcreature name and if the checkusers decide they want us to move it then one of clerks will take care of it.
 — Berean Hunter (talk) 19:59, 21 July 2017 (UTC)

IP 120.150.84.85

I also posed this question to Widr on his talk page, since he blocked the IP. But this might be a more appropriate place for me to ask in regards to whether or not I found an IP involved in socking. I looked at the edit filter log for this IP before I knew Widr had blocked it, and I saw numerous other accounts using this IP on today's date. I've been blocking them as socks. Am I correct? Should I continue to block the others? Never seen this situation before. — Maile (talk) 13:20, 25 July 2017 (UTC)

I'm confused, but there seems to be some confusion over what's going on. The edit filter for the IP only shows two edits hitting two different filters within a space of two minutes. The IP has not edited since; unless you're a checkuser (which you're not) then you can't see anyone else who has been using it. Accounts are registered users, right? Are you blocking registered accounts who have hit the same filters? If so, definitely don't continue doing that. -- zzuuzz (talk) 13:34, 25 July 2017 (UTC)
If I understand you, an edit filter can show a list of edits by different accounts. Regardless of what it says at the top blank for User, there can be other unrelated editors listed on that same filter. And showing up on the same edit filter it does not mean they're vandalizing or socking. That was my confusion. I did not know more than one unrelated account could show up on the same edit filter. Glad I asked, and I stopped blocking when I saw Widr blocked the IP. My mistake, thanks for clarifying. — Maile (talk) 13:40, 25 July 2017 (UTC)
I didn't block many, so I just unblocked the ones I thought were socks with a note that it was my error. — Maile (talk) 13:47, 25 July 2017 (UTC)
Thanks for asking, you can come again! There's only a very small number of filters which are always the same editor - these are usually labelled ...LTA or ...vandal, or similar (filters 759 and 808 are examples, but 860 is not). It's very rare - most filters have multiple users (and even false positives). -- zzuuzz (talk) 14:03, 25 July 2017 (UTC)
@Maile66, Zzuuzz, and Widr: Maile, there are some extra characters (%E2%80%8E) in the link to the filter log you posted above, somehow causing it to pick up log entries having nothing to do with that IP address. The correct link is [9], and it only shows four hits to one article. ​—DoRD (talk)​ 14:09, 25 July 2017 (UTC)

Re-requesting CheckUser on a CU-declined investigation

I requested CheckUser before to connect a User and an IP address. CheckUser was declined for this. While the user has been blocked for disruptive editing, there's a new autoconfirmed user exhibiting similar behaviour. Would it be possible to re-request for a CheckUser in the same investigation? Thanks! --YewGotUp (talk) 15:03, 29 July 2017 (UTC)

The above post by YewGotUp is most likely referring to Wikipedia:Sockpuppet investigations/Reid62. EdJohnston (talk) 15:30, 29 July 2017 (UTC)
If a case is dealt with, and there's new accounts, just add another case with the date below the current case. I don't know which one you're referring to of course, but that's the thumbrule. --QEDK (愛) 14:58, 1 August 2017 (UTC)
CheckUsers will never connect a user with an IP address, but if there's a new account behaving similarly to the user account in the original investigation, the two accounts can be checked. You should file a new case request following the instructions on the main WP:SPI page. Ivanvector (Talk/Edits) 17:04, 1 August 2017 (UTC)

New tag template for clerks/patrollers

Hey folks, I've created and added a template, {{blockedwithouttags}} (shortcut {{bwt}}) which produces  Blocked without tags. Fire at will. Ivanvector (Talk/Edits) 13:01, 3 August 2017 (UTC)

Hehe, even though I created User:Salv/SPIH (which gives " WP:DUCK: blocked & tagged; closing. ") a while ago, I haven't seen anyone but me use it. :p Ben · Salvidrim! ✉ 15:31, 3 August 2017 (UTC)
Tell me about it. User:GeneralizationsAreBad/Banhammer -> , User:GeneralizationsAreBad/Salt ->  Salted. GABgab 00:13, 7 August 2017 (UTC)
Speaking of which, might it be possible (or better yet, actually useful) to create a new SPI parameter, "Investigating," a bit like the "Checking" parameter only for behavioral investigations? Thanks! GABgab 00:22, 7 August 2017 (UTC)

Similar sockfarms

As has been pointed out by Smartse, KrakatoaKatie and GeneralizationsAreBad there seems to be a good deal of likenesses here. The redlink removals to their userpage and user talk page either immediately or within a short period of time after beginning to edit is certainly a commonality. I get the feel that we have someone (sockmaster) who has given instructions to meats. The lines blur for me here as I'm seeing the four cases as highly related. Could they be all the same? Different meat groups working in tandem? Inviting Ponyo and Doc James to the party. Maybe I've seen too many accounts and they are all starting to look alike here. Would the checkusers shed some light on that possibility?

I had to take a step back from looking at all of this and wanted other opinions. Also to answer Smartse's question here about Commons checkusers, there are only five. If we have requests for them, we had better point out which accounts have uploads to help sift it out of these haystacks.
 — Berean Hunter (talk) 19:13, 4 August 2017 (UTC)

It is fairly well known that we have companies that are teaching people how to do undisclosed paid editing while avoiding detection. We also have companies involved in paid editing with half a dozen employees and companies that use subcontractors for their work. Looking at writing style
  • OfficialPankajPatidar: uses cite template. links "author", uses "Official website", uses "URL|", , uses same ref tag [10]
  • Stoubora: uses cite template, adds categories, links "author", uses "URL|", , uses same ref tag[11] :::*Anatha: uses cite template, adds categories, uses "Official website", uses same ref tag[12]
  • BusInCordoba: Many of the articles are smaller than the others. Not as well put together even those categories present.
So first three are very similar and the last one less so.Doc James (talk · contribs · email) 19:10, 4 August 2017 (UTC)
Agreed, BusInCordoba is a specific freelancer (perhaps the most prolific Upworker who does UPE, certainly in top 3). I have little doubt that Alechkoist and its socks were also used by that person (see the discussion here). The other groups are unlikely to be related to BusInCordoba, but may be related to each other. OfficialPankajPatidar, Stoubora, Anatha... could be different employees of a single company. Rentier (talk) 10:26, 5 August 2017 (UTC)
I agree with Doc James' analysis and I agree with Rentier that this is likely Alechkoist based on the same behavioral modus operandi and naming likenesses. Although all of the accounts in that case are stale, maybe the CU wiki has some notes so that comparisons may be made. If so, then we could merge those cases and that would leave us with the remaining three.
 — Berean Hunter (talk) 14:49, 5 August 2017 (UTC)
There are no data concerning Alechkoist on the CU wiki, unfortunately. The investigation I'm currently involved in (Wikipedia:Sockpuppet investigations/Anatha Gulati) is rather puzzling, because the IPs are all over the place and socks from Wikipedia:Sockpuppet investigations/OfficialPankajPatidar keep appearing, because various IP ranges are used by both sock farms. I don't know if it's one single farm or multiple employees of the same company or even a bunch of different meat puppets, each with many sock puppets... Salvio Let's talk about it! 15:22, 5 August 2017 (UTC)
I honestly can't say, but there are apparent overlaps on the Anatha Gulati case and Wikipedia:Sockpuppet investigations/Airserma, Wikipedia:Sockpuppet investigations/ProudIndian007, and Wikipedia:Sockpuppet investigations/Xingzuin. GABgab 21:19, 6 August 2017 (UTC)
Pinging Vanamonde93 who blocked one of the socks before and may be able to shed some light on this. Rentier (talk) 11:11, 7 August 2017 (UTC)
I think I may fairly describe this as an unholy mess, which I can't be of much help in resolving. I have had passing interactions with some members of the ProudIndian007 sockfarm. I was approached by one of them with allegations about socking by other users, including editors that I knew to have previously indulged in sockpuppetry; so I took them seriously. Over the course of the conversation, though, they admitted to being a sock, and to have dodged the CU (not saying how per BEANS but it's the common method) and so blocked them. That's as much as I know. I don't have the mental space to examine those investigations for similarity, I'm afraid. Vanamonde (talk) 13:20, 7 August 2017 (UTC)
This is the problem with the paid editing groups, it may not be the same individual, but it's the same contract. That's enough to enforce the WP:MEAT portion of WP:SOCK as far as I'm concerned, but it often means that CU can be rendered useless. There are some paid editing groups that appear to work out of the same building and the dots are easy to connect, but when disparate individuals are responding to online contracts, there likely will be no technical connection. I still keep a standard unblock decline I used during the Morning227 debacle that states "I am declining your unblock request because it does not address the reason for your block, namely your participation in a paid editing group. To be unblocked, you must convince the reviewing administrator(s) that the block is no longer necessary because you understand what you have been blocked for, will not continue to cause damage or disruption, and will make useful contributions instead. While you are welcome to edit as an individual, you will not be unblocked in order to continue to create promotional articles for monetary return." --Jezebel's Ponyobons mots 17:48, 9 August 2017 (UTC)

Time-sensitive SPI

I would greatly appreciate if a CheckUser took a look at the case Wikipedia:Sockpuppet investigations/Capeman7 in the next 24 hours. One of the two accounts is about to get stale. Thanks, Rentier (talk) 21:30, 9 August 2017 (UTC)

Public access IP range

Someone here might want to have a look at the 82.132.184.0/22 ip range. I checked the range because 10alatham (talk · contribs) has used it in the past (see Category:Suspected Wikipedia sockpuppets of 10alatham), and came across other editors claiming that two other sockpuppeteers were also using the same range (see this and this.) I haven't done any checking to see if there's any merit to these accusations, but given the significant number of edits about royalty from this range the former certainly seems plausible. Having three seemingly unrelated sockpuppeteers all editing from the same range seems worrisome to me. I'm not sure what, if anything, can or needs to be done about it, but reporting it here seemed like a logical first step. Sir Sputnik (talk) 02:29, 10 August 2017 (UTC)

RfC regarding edit filter helper user right

There is currently an RfC at Wikipedia:Edit filter noticeboard#RFC - creation of the edit filter helper user right regarding the creation of an edit filter helper user right, which will allow non-admins to be granted the right to view details and logs of private edit filters. SPI clerks are one of the groups this is expected to be most useful for. Thryduulf (talk) 14:29, 14 August 2017 (UTC)

Question About No Visible History

I think I know the answer, but would like to be sure. I would like to be sure that a sockpuppet investigation can go forward if there is no visible edit history to a non-admin editor for either the sockmaster or the sockpuppet because the article that they were editing has been speedy-deleted. It is my understanding that an admin, and therefore a clerk who is an admin, and any CheckUser, can see the history of deleted edits. Robert McClenon (talk) 18:11, 15 August 2017 (UTC)

Ok. Good. The sockpuppets that I find are often trying to submit stupid articles that get A7 or G11. Using a sock to pull the speedy tag, so that you aren't pulling it "yourself", may seem like a good way to game the system. Robert McClenon (talk) 20:45, 15 August 2017 (UTC)

Terminological Question: Tagged

What does "tagged" mean with regard to an SPI? I sometimes see this as a status note. I understand blocked. Does locked mean globally blocked, by a steward? What does "tagged" mean? Robert McClenon (talk) 03:01, 16 August 2017 (UTC)

Tagged means the Template:sockpuppet tag has been placed on the sock account's user page so that it can be identified and categorized as such. Sir Sputnik (talk) 03:34, 16 August 2017 (UTC)
Thank you. I have seen that. Now I know that that is what is meant by tagging. Robert McClenon (talk) 03:56, 16 August 2017 (UTC)

Sleeper Search

I have a guess as to what is meant by looking for sleeper accounts, but I would like an answer. I gather that CheckUser has access to session data that contains, among other things, the account name and the IP address. Does the search for sleepers consist of retrieving session data by IP address, rather than by name, to see whether there are any other names coming in from the same addresses? (I can see this getting complicated because of ranges, since IP addresses with most (not all) ISPs are assigned dynamically.) Robert McClenon (talk) 03:01, 16 August 2017 (UTC)

I don't think that CUs are likely to explain this process, per WP:BEANS. ansh666 06:31, 16 August 2017 (UTC)

Clerk or CU requested on old SPI

Wikipedia:Sockpuppet investigations/Housesimple2017 I filed this 5 days and there has been no activity. Because I did it on Saturday, I don't know if it fell off the radar. Thanks, L3X1 (distænt write) )evidence( 01:53, 18 August 2017 (UTC)

Rest assured it is not forgotten nor "old". SPIs can be responded to within 24hour up to a couple of weeks depending on clerk availability and backlog length. :) Ben · Salvidrim! ✉ 02:00, 18 August 2017 (UTC)
Noting also that a lot of the checkusers were at Wikimania and are just now resuming their usual productivity. It's not just the clerks. :-) Risker (talk) 02:24, 18 August 2017 (UTC)
On it. --QEDK (愛 • 海) 17:56, 18 August 2017 (UTC)

Clerk request

Could one of our super helpful but unfortunately overworked clerks please move Wikipedia:Sockpuppet investigations/Meadow The Cat/Archive to reflect User:Kaylee Procter as the master? Thank you! --Jezebel's Ponyobons mots 20:29, 18 August 2017 (UTC)

I hope a trainee will do just fine. :) --QEDK (愛 • 海) 10:07, 20 August 2017 (UTC)
@Ponyo: Ahhh, Sro23 beat me to it. --QEDK (愛 • 海) 10:08, 20 August 2017 (UTC)

Reminder

Reminding a final decision and closure of Wikipedia:Sockpuppet investigations/Tyagiland--MahenSingha (Talk) 18:08, 20 August 2017 (UTC)

Bazaan

Hi, could someone please change the status of Wikipedia:Sockpuppet investigations/Bazaan from More info req. to CU requested. The request has been addressed and the page also has a new case. Thanks.—Cpt.a.haddock (talk) (please ping when replying) 07:59, 29 August 2017 (UTC)

 Done. GABgab 15:45, 30 August 2017 (UTC)

Possible sockpuppet

Annabetty (talk · contribs · deleted contribs · logs · filter log · block user · block log)

This user has stated on their user page "can you delete my account". This makes it seem like that they have created a new account and are asking for their old account to be deleted (which isn't possible, but that's beside the point here). Additionally, this account has been engaging in disruptive editing by creating inappropriate pages, which makes me think that this is a sock of someone, although I don't have a clue on earth who. Please advise. Checkuser needed 24.91.248.60 (talk) 21:01, 1 September 2017 (UTC)

I don't necessarily think that their userpage is evidence of socking in itself. fish CheckUser is not for fishing. GABgab 21:58, 1 September 2017 (UTC)
Per above CheckUser no Declined. Callanecc (talk • contribs • logs) 08:21, 2 September 2017 (UTC)

Semi-protected edit request on 7 September 2017: My Royal Young case

Already done User has already been blocked. — nihlus kryik  (talk) 08:43, 7 September 2017 (UTC)

user:Slothflipper

I'm confused about how the checkuser came about for Slothflipper (talk · contribs). I'm not seeing a SPI report, and don't know where else to look. I'd assume that some of the ip's involved in the edit-warring would be checked as well, but I don't know what accounts and ip's were checked, nor if there's a discussion somewhere that I can review to see if a further request might be needed. --Ronz (talk) 18:09, 7 September 2017 (UTC)

Often, accounts and IPs are encountered through behavioural evidence and/or technical evidence, without the reason for the check being documented on-wiki. I don't know if that happened here, but there is an SPI Special:WhatLinksHere/User_talk:Slothflipper. -- zzuuzz (talk) 19:27, 7 September 2017 (UTC)
Thanks! --Ronz (talk) 19:32, 7 September 2017 (UTC)

I've found more socks!

I've found more socks of user:Modern Fire. I'm a bit rusty about reporting procedure, so would appreciate some guidance. Do I just add the new ones to the existing case, with supporting evidence? Also, I'd like to have all confirmed socks globally blocked. Is that possible? Mjroots (talk) 19:54, 11 September 2017 (UTC)

What I've always done is to just use the template ("How to open an investigation") on the SPI page to open a new report for the sockmaster name. The template will append the case to the existing page for that sockmaster whether there's an existing case or not (as far as I can tell there is not one), and whether there is an existing case or not, that appears to be the right thing to do. (If there IS an existing case, do not edit it yourself to include your new report, regardless of how seemingly small the edit would be.) The investigator and/or clerk will move the case(s) to the archive once the investigation is closed. Jeh (talk) 20:59, 11 September 2017 (UTC)

Leaving notes about archived investigations

Without getting into the details here, I just came across some info on Wikipedia that could be very useful if a SPI is reopened (specifically, Wikipedia:Sockpuppet investigations/Editor2626744). There's no LTA page or anything, and there's no reason to reopen the SPI, but if it does eventually get reopened (which seems pretty reasonable, considering its history) this could make things dramatically simpler. If I leave a comment about that in the talk page of the SPI, will anyone notice it? Is there a better place to leave a comment like this? Grayfell (talk) 23:50, 10 September 2017 (UTC)

  • Not really anywhere better, and the archives are frequently consulted. Courcelles (talk) 19:27, 18 September 2017 (UTC)

EFH

Please note, there is now a new user group that may be useful for non-administrator clerks in this area. For more details, including requirements and procedures, please see Wikipedia:Edit filter helper. Thank you, — xaosflux Talk 15:40, 27 September 2017 (UTC)

Help us decide the best designs for the Interaction Timeline feature

Hello all! In the coming months the Anti-Harassment Tools team plans to build a feature that we hope will allow users to better investigate user conduct disputes, called the Interaction Timeline. In short, the feature will display all edits by two users on pages where they have both contributed in a chronological timeline. We think the Timeline will help you evaluate conduct disputes in a more time efficient manner, resulting in more informed, confident decisions on how to respond.

But — we need your help! I’ve created two designs to illustrate our concept and we have quite a few open questions which we need your input to answer. Please read about the feature and see the wireframes at Wikipedia:Community health initiative on English Wikipedia/Interaction Timeline and join us at the talk page!

Thank you, — CSinders (WMF) (talk) 19:44, 3 October 2017 (UTC)

Related footwear question, sort of

Along the same lines as the above, what is normal practice for this not-so-hypothetical scenario: A sock is blocked, oh, let's say today. The clue was him creating an LTA page about the master. Now let's say a few weeks ago a slew of random IPs appear to add prior socks to the Category:socks-of... category for the master by creating previously non-existant userpages. Should those userpages, and by extension the category which I'm 99% certain the CU's don't need for this one, be A:kept as useful, B:deleted outright per DENY/G5/IAR/etc, or C:taken to MFD for a wider and more publicity-generating discussion? I know an SPI would not be useful since they're IPs and thus not-linkable to named accounts, but from today it is clear that socky is looking for a hall of fame of one sort or another. Thoughts? CrowCaw 21:57, 29 September 2017 (UTC)

Probably just delete the pages, per WP:DENY. There's a few petty vandals whose only goal is to leave a record of their nonsense. If they don't already have sock-tagged user pages, there's probably a good reason the clerks didn't create them. Ivanvector (Talk/Edits) 16:07, 5 October 2017 (UTC)
  • That's my thought as well. Any volunteers to pull the trigger? CrowCaw 15:56, 6 October 2017 (UTC)

Laundry - how far to go?

If an unquestioned sock has created valid articles, there is some agreement per WP:DENY that these should be deleted as part of cleanup.

However how far does that go? If there have been redlinks to this article for some years, from articles which the sock hasn't touched, should those redlinks be removed too? My concern is that laundry is getting out of hand here and we're gratuitously damaging the encyclopedia, just for revenge on a sock. Andy Dingley (talk) 11:24, 29 September 2017 (UTC)

The agreement is that they may be deleted. If deleting these articles is doing more harm than good then these are unwise deletions. We don't delete things "for revenge", although we do sometimes as deterrence. For your redlinks question I'd take advice from WP:REDLINK, and in most cases it seems apparent that they should not be removed. Ivanvector (Talk/Edits) 14:28, 29 September 2017 (UTC)
When it comes to socks of undisclosed paid editing companies, their articles are generally 98% spam / advertising and would take a lot of work to clean up / verify. Much of the time the refs are just there for show / to get the article accepted. When one tries to verify the content based on the ref often it simply does not support the content. The existence of these articles generally hurts Wikipedia. Deletion is not for revenge but simply clean up. With respect to red links agree WP:REDLINK should be followed. Doc James (talk · contribs · email) 15:36, 29 September 2017 (UTC)
If an article passes our policy, it stays, I doubt the problem is as serious as you put it, mostly mass nukes are done iff majority of them contain spam and uncleanable promotional material. --QEDK (愛 • 海) 17:05, 29 September 2017 (UTC)
You mean you do not believe that the refs often do not support the content added? Often it appears that a promotional piece is written and than the refs are added as an after thought.
Will provide some examples during my next review of some of these. Doc James (talk · contribs · email) 18:01, 29 September 2017 (UTC)
No, I was adressing the OP, my indenting is just awful, pardon me (fixed now). --QEDK (愛 • 海) 08:15, 1 October 2017 (UTC)
I noticed it from metallurgical coal (and redlinks stripped from articles I'd written) but now I see that clay soil and geological process have gone too. Andy Dingley (talk) 19:00, 29 September 2017 (UTC)
MfortyoneA created a lot of redirects, and spent a good amount of effort linking them from random articles. I spent a lot of time cleaning up links (eg: repiping and removing them when necessary). It seems like the links to those articles should have stayed, so feel free to revert. I noticed you have already done so from a few articles. -- Tavix (talk) 20:22, 29 September 2017 (UTC)
But what's the goal here? Reverting the sock, or purging the unclean topic? One of them is based on contributions history (and is broadly supported), the other is going after content, because it's content. I really can't get behind that. Andy Dingley (talk) 22:20, 29 September 2017 (UTC)
Which involved then deleting the valid redlinks to it, [13], which had had nothing to do with this editor. Why are we doing this? @GeneralizationsAreBad:? Andy Dingley (talk) 16:03, 6 October 2017 (UTC)
@Andy Dingley: I apologize if this redlink-removal was hasty. It's a habit of mine when G5'ing pages, and I'll be more careful in the future with this. I deleted the page because it was a) created and almost solely edited by a blocked sock of Biscuittin and b) it was already of (imo) dubious quality, to boot. However, I'd be happy to restore it upon request for further improvements. GABgab 21:18, 12 October 2017 (UTC)

Proposed unusual multi-case merge

We've been hinting at this for a few weeks and I've resisted because it's complicated, but I think there's enough evidence and overlap now that several highly active cases should be merged into one. I'm proposing to merge Ren Yifan, Mokezhilao, and 123Aristotle, with the reasoning that all three have CU-confirmed socks that intersect on a narrow set of articles, as well as CU frequently showing connections between checked accounts and confirmed socks in more than one of the other cases. However, all three cases already have long archives in parallel with each other. Normally I would do a history merge and sort out the archives, but this is going to leave a mess of an archive with intersecting parallel histories splotched together in a nonsensical manner. What I propose to do instead is to move the archives of the newer cases to subpages under the archive of 123Aristotle (the older case), and otherwise leave the archive histories alone. Future cases would be filed at 123Aristotle and added to the new master archive. Any thoughts on this? Ivanvector (Talk/Edits) 13:16, 10 October 2017 (UTC)

I see no problem with this so long as everything is linked from the main page. There's precedent for avoiding complicated merges (e.g. Stylized as "stylized" currently; formerly "stylizeD"), and clearly we've made due with these being entirely separate for some time. Do you have thoughts on this, Katie? ~ Rob13Talk 19:38, 10 October 2017 (UTC)
No comment on how the merge would be made, but I support it. GABgab 21:20, 12 October 2017 (UTC)
Ok I've done it. I didn't actually move any of the pages, but I've added notes to each of the pages to direct to the various archives, and direct users to report at 123Aristotle. Remains to be seen if they will, I suppose. Ivanvector (Talk/Edits) 15:01, 17 October 2017 (UTC)
@Ivanvector: Thanks for taking the time to do this - it's a headache to work out, I'm sure. So if a user was found to be unrelated to 123Aristotle, could they be re-reported as Mokezhila (or Ren Yifan)? In other words, is the latter case basically "dead"? Best, GABgab 15:06, 17 October 2017 (UTC)
Well, I think the evidence shows that all three cases are the same user, or the same set of meatpuppets. If we find later that an account is technically and behaviourally unrelated, that should be justification for a new case. Ivanvector (Talk/Edits) 15:08, 17 October 2017 (UTC)
@Ivanvector: OK. And as for tagging? We still have a number of untagged socks, but I think it doesn't really matter as long as we have the SPI listed in the block log. GABgab 15:11, 17 October 2017 (UTC)
Yeah I'm working on that, the template doesn't really support this kind of situation. My intent is to have all of the socks tagged and categorized as 123Aristotle socks with details about CU confirming to the other accounts, but I haven't got there yet. Ivanvector (Talk/Edits) 15:23, 17 October 2017 (UTC)
We might also want to review the creations of User:Vixvovessor to see what to G5. GABgab 19:55, 17 October 2017 (UTC)

Move a case to the older username, please

I don't want to do it in case there are technical ramifications, so I am asking someone here to move a case and its archive from a sock name to the older sockmaster name. The username Littlemixfan! was registered on April 21, while the username Hercules123! was registered two weeks later on May 6.

Thanks in advance... Binksternet (talk) 04:55, 16 October 2017 (UTC)

Current case names
More appropriate case names
I went ahead and moved them myself. If I messed up, let me know. Binksternet (talk) 04:41, 17 October 2017 (UTC)
@Binksternet: thanks for the note here. There are additional steps to an SPI move/merge which you didn't do, which is why these moves are best left to the SPI clerks. Easy to clean up, though, I'll take care of it. Ivanvector (Talk/Edits) 15:02, 17 October 2017 (UTC)
@Ivanvector and Binksternet: I don't know if you "took care", but User:Littlemixfan! is still tagged as a sockpuppet of Hercules123! and User:Hercules123! is tagged as a sockmaster. Please, when you move the case, also re-tag all user pages, that is very important step. Vanjagenije (talk) 16:33, 17 October 2017 (UTC)
Yep, I missed that step, doing too many things at once. Will fix now. Ivanvector (Talk/Edits) 16:39, 17 October 2017 (UTC)
Argh, okay, retagged the accounts listed in the SPI. But in doing so, I discovered a whole extra batch of accounts in Category:Wikipedia sockpuppets of Hercules123! that have been blocked between July-August (before the history of this SPI) by Materialscientist, JamesBWatson and Ponyo. They're all tagged as "proven" but I can't find any discussion related to the blocks, and no older history that was accidentally overwritten or anything, so I don't know if it's appropriate to re-tag these accounts. Ivanvector (Talk/Edits) 16:55, 17 October 2017 (UTC)
@Ivanvector: Admins and Checkusers often block sockpuppets without investigation and with no discussion. So, it's nothing strange. You should always look for such accounts when re-tagging. You should re-tag them too, of course. Vanjagenije (talk) 17:16, 17 October 2017 (UTC)
These are not checkuser blocks, as far as I can tell. I dislike the practice of blocking users without some rationale or a link to a discussion, especially users who haven't edited, though I've probably done it myself a few times. My concern here is more that something's happened to the archive that's caused older cases to vanish, and those old edits need to be restored. I know the obvious answer is there are no prior edits, but I'd appreciate if someone else could take a look and confirm. I tried but didn't see anything. Ivanvector (Talk/Edits) 19:32, 17 October 2017 (UTC)

Running a SPI

Wondering if CUs are run on accounts that send threats of violence to editors? Doc James (talk · contribs · email) 02:13, 5 October 2017 (UTC)

Depends on the level of threat, and the assessed disruption. If it seems even a bit serious, the emergency@WMF will probably take care of the issue instead of local CUs, but if say an editor demonstrates a pattern of threatening and it surfaces again from a different account, that'd probably be grounds for checking. But I'm only a trainee clerk, should probably hear from an active CU in awareness of policy. --QEDK (愛 • 海) 06:16, 5 October 2017 (UTC)
Yeah pretty much what QEDK said. Threats of violence should be directed to WP:EMERGENCY and the WMF will check as they need to. Local CUs might check if there is a suspicion of socking (as normal). Callanecc (talk • contribs • logs) 11:00, 5 October 2017 (UTC)
Okay thanks. One needs a second account before a CU... Doc James (talk · contribs · email) 18:19, 5 October 2017 (UTC)
No necessarily. Some accounts are obviously socks, for example if the first edit an account made was to threaten another user then it's very likely a sock so a CU check would likely be appropriate. Callanecc (talk • contribs • logs) 01:50, 7 October 2017 (UTC)
They are now calling my work to try to figure out my schedule. As I look at it further unlikely to be a sock. Doc James (talk · contribs · email) 09:06, 7 October 2017 (UTC)
You likely already know but it might be worth emailing emergency@ or meta:Support and Safety (and/or ArbCom) so they are in the loop (they, especially WMF, might also be able to issue a block/ban to take some heat off you). Callanecc (talk • contribs • logs) 09:21, 7 October 2017 (UTC)
@Doc James: At this point, the first call you make should be to the police. Stay safe. ~ Rob13Talk 13:40, 10 October 2017 (UTC)
Hey All. The Royal Canadian Mounted Police were really helpful. Doc James (talk · contribs · email) 22:40, 19 October 2017 (UTC)
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia_talk:Sockpuppet_investigations/Archive_19&oldid=1159114560"