Wikipedia talk:Sockpuppet investigations/Archive 23

Village pump discussion related to "CheckUser blocks" section

There is a village pump discussion on the wording in Wikipedia:Blocking policy § CheckUser blocks (WP:CUBL), which is related to the content in the "CheckUser blocks" section. If you are interested, please participate at WP:VPP § Altering vs. loosening CheckUser and oversight blocks. (originally posted to WT:CHECKUSER by Newslinger) Ivanvector (^Talk/_Edits) 13:55, 12 October 2020 (UTC)

Quick CheckUser requests heading

Something weird must be going on as I looked at the source code of WP:SPI and see that the "Quick CheckUser requests" heading is grouped together with the {{/SPI/Quick check header}}, but when looking at the actual page visually, the "Quick CheckUser requests" heading appears to be together with the listings for the main SPI cases rather than with the aforementioned header. It seems that the page has been experiencing this problem ever since the SPI page was edited so the table of cases run from the backup SPI listing source at User:AmandaNP/SPI case list. Does anyone know what's happening there? Hx7 10:06, 18 October 2020 (UTC)

Fixed. The close table wikicode wasn't included when transcluding the template, so I've added it in below (as the bot will probably overwrite any changes in the list) Dreamy Jazz ^{talk to me | my contributions} 21:49, 18 October 2020 (UTC)

MaranoFan

I cannot get over this, back in July 2020, MaranoFan thought I created an account: Youcancallmejimmy, and assumed I was trying to come back in a different account that's not even miine!! If you take a look at some Billie Eilish articles like "Come Out and Play (Billie Eilish song)" and "&Burn", it shows that I revert the disruptive edits Jimmy makes. It pisses me off so much to think that MaranoFan can do this to other people and not get any sort of consequence. Also, my first name is even Jimmy! It's not even close to that! The Ultimate Boss (talk) 09:31, 25 October 2020 (UTC)

Meatpuppets and the applicability of G5

Are articles created by a meatpuppet and also created at the direction of a blocked user (i.e. the creation itself was meatpuppetry / proxy editing) eligible for WP:G5? Dreamy Jazz ^{talk to me | my contributions} 13:55, 25 October 2020 (UTC)

I ask this because of Draft:Zinia Zafrin Luipa. This is because the creator admitted that one of my friend asked me to create this article ... (diff), and from the investigation in the SPI it seems likely that this "friend" was Anupamofficial (or indeed they are the same person. I assumed they were telling the truth and decided that they were a meatpuppet). The creation and subsequent edits of the draft are meatpuppetry / proxy editing. However, whe wording of G5 does not mention meatpuppetry. Dreamy Jazz ^{talk to me | my contributions} 13:58, 25 October 2020 (UTC)

I would say "be careful," the spirit of G5 would suggest that if the meat-puppet page is created at the direction of the sockmaster, then yes, but if it's a birds of a feather meat-farm without a single "puppet-master" then G5 would not apply. I doubt I could tell the difference most of the time, absent obvious re-use of content or an outright admission. This is one of those cases where you might be able to delete anyway under WP:Ignore all rules pointing to the spirit of WP:BMB, WP:CSD#G5, WP:NOTHERE, and other policies and guidelines to back you up. As an established administrator with a specialty in sock-puppetry, I doubt you would get much if any push-back on this as long as you explained what you were doing and why.

That said, the fact that you ask the question suggests perhaps that G5 needs tweaking to explicitly include certain types of meat-puppetry. davidwr/(talk)/(contribs) 14:28, 25 October 2020 (UTC)

@Davidwr and Dreamy Jazz:, I'm really conflicted here. On the one hand, I'm all about stomping on UPE and socks. But, before getting into SPI work, I spent a lot of time at WP:DRV. The DRV crowd tends to take a very literal view of WP:CSD, asserting that it's one of the few places where IAR doesn't apply. I'm not saying don't do it, just be ready for push-back should it ever get to DRV. -- RoySmith (talk) 15:08, 25 October 2020 (UTC)

@RoySmith: I haven't spent enough time at DRV to learn the prevailing consensus there, but if that's still the case, then I'm going to have to rethink what I said earlier. I do know there seems to be a consensus that if someone with all the facts at their disposal could reasonably object to a speedy-G6 then it probably shouldn't be a G6. The same "if in doubt, don't" arguably applies across all of CSD. davidwr/(talk)/(contribs) 15:32, 25 October 2020 (UTC)

I'll leave it be then. Its probably a good honey pot anyway. Dreamy Jazz ^{talk to me | my contributions} 15:56, 25 October 2020 (UTC)

Miesm/Arsan Faris?

I recently responded to a request to restore Peyman Keshavarzi Nazarloo, which was an attempt to recreate Peyman Keshavarz, which was deleted at AfD this September. The requesting person, an IP address, stated that the page was improperly deleted under G4 since it was a new creation by a confirmed editor. Looking into this I saw that it dealt with the above two accounts. I don't know if this IP is one of those two users (or if the users are the same person) but I thought I'd bring it up here. The IP address is 5.73.221.5.

The IP address also claims to have created 80 pages, which doesn't match up with their edit history. They could be jumping IPs, which can happen with people who edit from multiple locations, but I thought it was worth bringing up here. The original IP that created this new version was 5.126.226.121. I think I'll go ahead and block this IP as a block evasion, but wanted to let you guys know. ReaderofthePack(formerly Tokyogirl79) (｡◕‿◕｡) 07:47, 29 October 2020 (UTC)

I'm looking into this. This is an LTA. -- Amanda (aka DQ) 19:49, 29 October 2020 (UTC)

ArmanAfifeh

This is only an IP, but I figured I'd give you guys a head's up. 5.134.189.191 was asking for the restoration of Amir Sarkhosh, a typical request for ArmanAfifeh. I don't think it's worth opening an SPI for since I don't know of any actual accounts, but I figured that it'd be worth letting y'all know. ReaderofthePack(formerly Tokyogirl79) (｡◕‿◕｡) 03:44, 30 October 2020 (UTC)

• Dunno if I should block the IP just because it requested restoration, so I'll leave that up to someone here. ReaderofthePack(formerly Tokyogirl79) (｡◕‿◕｡) 03:46, 30 October 2020 (UTC)

  ReaderofthePack, that's them. Requested a global block, and you're always welcome to open an SPI even if you only have IPs - it'll just be a behavioral investigation. GeneralNotability (talk) 12:38, 30 October 2020 (UTC)

  @GeneralNotability: Re: you're always welcome to open an SPI even if you only have IPs - Thanks. SPI for another recent IP against ArmanAfifeh opened, it and a third IP are now listed. Both are blocked. davidwr/(talk)/(contribs) 16:50, 30 October 2020 (UTC)

• That's good to know that I can! It's been a while since I opened a SPI and I'm a bit embarrassed at how much I've apparently forgotten in the meantime. ReaderofthePack(formerly Tokyogirl79) (｡◕‿◕｡) 02:44, 31 October 2020 (UTC)

User:Martimc123

New sock appears to be User:TiredAsF12, same editing pattern (i.e. enormous introductions, use of user-generated sites such as TRANSFERMARKT.com and ZEROZERO.pt as sources for content). Now engaged in an edit war with me in two articles, i have stopped with my actions now, they have not. I meant to contact admin User:Bbb23 (who performed the original block), but they are all but retired.

Attentively --Quite A Character (talk) 01:21, 1 November 2020 (UTC)

Im not User:Martimc123, im trying to reach a concensus with this user, but i dont think he is trying to listen, besides this user is having a lack of evidences to convict me to be this supposed user, so please forget this case, its nonesense.

Attentively — Preceding unsigned comment added by TiredAsF12 (talk • contribs) 01:25, 1 November 2020 (UTC)

@Quite A Character: Please report this with supporting evidence to WP:SPI. Sir Sputnik (talk) 02:47, 1 November 2020 (UTC)

Special:Diff/986478320 - "Thanks for the heads up User:Sir Sputnik, but i have conversed with said user and we seem to be on the same page now. Apologies to everyone concerned." — Preceding unsigned comment added by Quite A Character (talk • contribs) 03:12, 1 November 2020 (UTC)

@Quite A Character: It seems I also owe you an apology. I didn't mean to brush off like this. I apparently misread my watchlist, thinking that you had posted this to WT:FOOTY, which would have been decidedly the wrong place for this discussion. Posting it it here was perfectly fine. Sir Sputnik (talk) 18:40, 1 November 2020 (UTC)

@Quite A Character: This was definitely them. See Wikipedia:Sockpuppet investigations/Martimc123. -- Amanda (aka DQ) 23:11, 1 November 2020 (UTC)

Tips, Guidance and Suggestions on actively finding Sockpuppets and their Sockmasters

Hello everyone, I was looking for any kind of useful tips, guidance and suggestions on how can I actively find Sockpuppets and their Sockmasters. Occasionally, I may across an editor who I suspect might be socking and after thorough investigation, if I highly suspect that they are, then I file the SPI report. However, what I wanted to know is that is there any simpler and easier way in which I can actively go around searching in trying to find Sockpuppets and their Sockmasters in any area of Wikipedia? All kinds of suggestions are welcome. TheGeneralUser (talk) 17:44, 25 October 2020 (UTC)

I don't know about "actively seeking them out" but I usually find them when a page that was on my watch list and later deleted due to bad-faith editing reappears, either in the main encyclopedia or Draft: space. I DO take the effort to watchlist that page name in both namespaces if I suspect it will be deleted and resurrected in bad faith. In the last week, I've spotted 2 confirmed socks that way and got very suspicious of a third but couldn't get enough info to do an SPI. Fortunately, another editor could and did and that account is now indeffed.

Another thing I do, or did until it was taking up too much time and causing too much stress, was watch the Teahouse for "naive sounding" questions, particularly if the English is broken, then checking that editor's contributions for the next few days.

Something I don't do but which would probably work is to monitor the edit filter log for events associated with "new accounts" that indicate an experienced editor, such as a large page created early in an editor's history. There are also some edit filters that are specifically labeled as likely to be used by socks, such as this one which unfortunately is private so I can't use it to "go hunting." Maybe if you go through RFA one day you can find and use that filter to go on a spam hunt.

I do feel a bit "like I need to take a shower" or at least a mental one when I spend too much time in these areas. Not because of the content - it's almost all commercially motivated spam not hate-filled diatribes thank goodness - but because I feel like I'm stalking someone waiting for them to make a fatal mistake. I'm sure I feel that way because that's exactly what I'm doing when I'm editing with the goal of finding socks. There is another mental health risk I ran into the other day which is one reason I'm taking a break from the Teahouse: It turned out someone I saw editing in bad faith, or in this case more WP:NOTHERE than WP:NOTPROMO, let slip enough about their real life identity that WP:OVERSIGHT was required. Based on what I saw off-wiki, it looks like a sad case of someone who, let's just put it charitably, doesn't meet WP:CIR. Now I'm going to need to go take a mental health break to get that situation out of my mind.

I'll end by saying that working in areas like this, especially ones that leave you needing to get out the "mental floss" and take a "mental shower," are a good way to give back to the Wikipedia community, especially if your strength is not in creating content. However, your own mental health comes first. davidwr/(talk)/(contribs) 21:49, 25 October 2020 (UTC)

tl;dnr version: Doing laundry and getting rid of unwanted socks: It's a dirty job, but an important one. davidwr/(talk)/(contribs) 21:50, 25 October 2020 (UTC)

Thanks for your advice and suggestions Davidwr, they will be very useful. TheGeneralUser (talk) 13:22, 27 October 2020 (UTC)

Update/self-reply: I re-read what I wrote 2 days ago. I didn't mean to encourage people to take risks with their mental health when I said working in areas like this, especially ones that leave you needing to get out the "mental floss" and take a "mental shower," are a good way to give back to the Wikipedia community. What I meant was, "it's a dirty job, but someone's got to do it" with the "and the rest of the community and readers are grateful they don't have to" implied. Just to re-iterate - your mental health comes first. davidwr/(talk)/(contribs) 14:41, 27 October 2020 (UTC)

• It would be helpful and I would be thankful if more editors could give their input/advice on finding Sockpuppets and their Sockmasters. TheGeneralUser (talk) 16:21, 2 November 2020 (UTC)

Ip requesting sp investigation

Hi. Could someone please start a sock puppet investigation of User:Jorgensen William? I believe he is also user:Cutelaba based on the same pattern of disruptive editing here and here. They also appear to edit similar pages pursuing a near identical agenda. Thanks. --1.144.107.217 (talk) 23:42, 4 November 2020 (UTC)

Edit filter trip-log

Would it be helpful to have a bot write to a trip-log when certain SPI-related edit filters are hit? Question inspired by this edit by Dreamy Jazz. For example, it would've been handy changes to these logs could be put someplace where they would get attention. davidwr/(talk)/(contribs) 20:10, 5 November 2020 (UTC)

I would note that such a list will almost completely be seen by LTAs who know their way round the wiki, so perhaps this place is probably best kept for sockpuppeteers who won't notice or care. The filter noted above is definitely a candidate for this list. Dreamy Jazz ^{talk to me | my contributions} 20:28, 5 November 2020 (UTC)

It wouldn't have to be on a page visible to the public. A mailing list or "subscribe-only" userpage-notification-bot that only admins could subscribe to would work. Heck, even something subtle like message-delivery bot that did this:

• If user is subscribed to me ("me" being the message-delivery-bot), and that log's last update was later than the last time of the user's most recent contribution, make a "mention" to the user on some page in his user-space, then revert the edit.

This would alert the user to manually go check that log.

davidwr/(talk)/(contribs) 20:40, 5 November 2020 (UTC)

IRC folks can also use MusikBot to send them a private message when specific filters are tripped. GeneralNotability (talk) 20:56, 5 November 2020 (UTC)

That's helpful for me. I'll use that for this filter. Dreamy Jazz ^{talk to me | my contributions} 21:35, 5 November 2020 (UTC)

How old is too old for an SPI?

I was cleaning up an unsourced article and going through the history to see who the previous editors were. I saw that the article creation and the next few edits had been blanked completely (can't remember the wiki term for it) for copyvio and the article creator was subsequently indeffed for just copy and pasting. About a year later, an editor with a very similar name added more unsourced content to the article, which until I stepped in had been left in the article. I checked this user and their first edit was about a month after the first had been blocked. The only interaction on their talk page is another warning about copyvio, but the account also hasn't made an edit in about 3 years. Is it worth blocking this new account in case the editor comes back or just leave it? It's unlikely they'll come back, but on the other hand there's nine years between my first edit and my second. LotT (talk) 11:23, 16 November 2020 (UTC)

In general, three years is too old. Blocks are meant to be preventive rather than punishment and it would hardly be preventing anything if the account hasn't been used in 3 years. BUT, it is block evasion... I for one would take a look of the specifics if a report were made. FYI, it's easier to report with Twinkle. Cabayi (talk) 12:02, 16 November 2020 (UTC)

LotT, I think the forgotten wiki term you're thinking of is WP:Revision deletion. -- RoySmith (talk) 16:27, 16 November 2020 (UTC)

Thanks Roy, that was what I'd meant! Cabayi - I'll probably leave it for now then. They weren't a particularly prolific editor before or after being banned and on the balance of things, I do think it's unlikely that they'll return LotT (talk) 18:21, 17 November 2020 (UTC)

Reporting a sock

As an IP I cannot report a sock, but I would like to file a report on the user Bofuses, who is a sock of Brogo13, even to the extent of repeating the user page (both say "I just lurk here", both Link To [particle]Dilligence[/wparticle], and both use 8r'). The odd edit summaries of both users should point the way too. - 109.249.185.101 (talk) 16:26, 17 November 2020 (UTC)

I'll create the report for you. -- RoySmith (talk) 18:08, 17 November 2020 (UTC)

Sorry I was doing one as well, and hadn't noticed you'd posted here (it took me a while to get used to doing one). Is there anyway to delete my report? LotT (talk) 18:18, 17 November 2020 (UTC)

Please watch Joginder Singh (soldier)

I hope it's a false alarm but the Wikipedia:Sockpuppet investigations/Punjabier/Archive sock farm might have harvested the cotton fields and ramped up the textile factory. One recent edit by an IP undid my WP:BMB revert of some recent sock edits. That IP is in the same range of some suspected IP socks from 2019 according to the SPI archive.

A brand-new account came in right after and made some minor edits.

Since both edits are plausibly "good edits" I'm not going to open an SPI just yet, but I am asking people with a "better nose for dirty laundry" than me to watch this article and other articles favored by the Punjabier darning needle.

Putting "new/IP edit detected and logged or tagged" honey-pot filters on Joginder Singh (soldier) and other "favorites" for a month might prevent the need for semi-protecting these down the road.

Courtesy ping to Indy beetle since they have opened SPIs for Punjabier in the last few months. davidwr/(talk)/(contribs) 13:55, 19 November 2020 (UTC)

Highly probable sockpuppet

Hello there,

I'm mainly a French Wikipedia contributor, so please forgive me if I'm reporting this in the wrong place.

Today, on personal talk page, a dynamic IP asked me to copypaste a "translation" on the Consumers Distributing article (from this contents). Note that this contents comes from a French Wiktionary ConDist user talk page that has been autoerased, and that the section opened in my talk page has also been erased. Also, this user didn't make any other contribution on the French Wiktionnary than this contents on his talk page. This is clearly suspicious

I copied it and wanted to check the changes and the overall quality of information and sources, and I noticed the {{pp-30-500}} template : the message "If you have been invited by an IP editor or newly-registered account to edit this page, please note that the editor may be evading a community ban." was describing exactly what happened, and that's why I am here.

I don't know what measures you can take with dynamic IPs, but I figured you might be interested to know.

Best regards, --Daehan (talk) 09:24, 20 November 2020 (UTC)

Yes, it's a sock puppet. I'll contact a steward. NinjaRobotPirate (talk) 04:06, 21 November 2020 (UTC)

Sockpuppet suspicion

As an IP editor I cannot open a sockpuppet investigation, but I suspect user EditsToday44 (contribs) to be a sockpuppet of user Bonnar212 (contribs). I think the editor has no malicious intent, and is simply trying to create an extra 'voice' for something they strongly believe in. Still, likely a sockpuppet. --143.176.30.65 (talk) 16:15, 24 November 2020 (UTC)

Maybe also check on user BrianBanksEditor (contribs). --143.176.30.65 (talk) 18:21, 24 November 2020 (UTC)

I see it's already taking place here. --143.176.30.65 (talk) 11:10, 25 November 2020 (UTC)

Moving cases

So we might potentially have a problem over here. SPI's filed under the wrong name are being moved improperly, and it seems to be connected to the new SPI script everyone's been using nowadays. Example 1 2 3 4 etc and I know there are more instances of this. Per Wikipedia:Sockpuppet investigations/SPI/Clerk and checkuser procedures#Cases filed under the name of the sock, if a case needs to be moved to a different name, you need to hit the "move" button on the top right of the page, move the page to the correct location, and then replace the redirect at the old name with {{SPIarchive notice|newcasename}}. However instead I think people have been hitting the "move case section" button on User:GeneralNotability/spihelper which seems to be the cause of the issue here, because this didn't used to happen until recently (not exactly sure how far back this has been going on for). The script is making copy-and-paste moves, some of the edit summaries being left for attribution are broken (see Special:diff/985839602 for example) and redirects pointing users to the new SPI case name are not being left on SPI's filed under the wrong name (See Wikipedia:Sockpuppet investigations/Kerkükli. Kerkükli is a sockpuppet of 3Oh Hexelon, so Wikipedia:Sockpuppet investigations/Kerkükli shouldn't exist on its own, it should instead redirect to Wikipedia:Sockpuppet investigations/3Oh Hexelon, but it doesn't). I've been noticing more and more checkusers doing this (haven't seen clerks making these bad moves yet). Pinging the script creator GeneralNotability. Maybe I'm making this out to be a bigger deal than it really is, but I don't know. I think cases filed under the wrong name being cut-and-paste moved and missing redirects pointing users to the new case name will cause confusion. Sro23 (talk) 01:17, 26 November 2020 (UTC)

Sro23, sigh. There are actually two different "move" modes in the script: move section and move/merge case (the distinction is whether you've selected a specific case or "All Sections" in the section selector). The former is cut-and-paste with attribution and is for the situation where an individual case turns out to have been a different master (someone filed a case against established sockmaster A but the actual sockmaster was sockmaster B). The latter is for cases where someone filed with the oldest account as a sock, or files a new case which CU connects to an existing sockmaster. Also, the latter mode will attempt histmerge per the clerk directions if needed (delete target, move, restore history). The reason for the distinction is that under the hood my version of spihelper has two "modes," one which will only edit a specific section at a time, the other will edit the whole case. I suspect this is a UI/UX thing, which I will cheerfully admit is not my strongest area. GeneralNotability (talk) 01:43, 26 November 2020 (UTC)

I see. Is it possible for "All sections" to be checked by default then? Would that make things easier? I just moved an SPI (histmerge) using your script, and I'm not going to lie, it was absolutely no different than moving the old fashion way, I still had to manually clean up the SPI after the move, replace the old case name with a redirect to the new name and restore the deleted revisions myself post merge. As for the former mode, well, doing a cut-and-paste move manually isn't all that difficult or time consuming. I hope you don't take this the wrong way, because the script has a lot of really cool features helpful to many users, but maybe the "move" feature is more trouble than it's worth. Sro23 (talk) 02:07, 26 November 2020 (UTC)

No, I completely agree, that feature probably causes problems more often than it's actually used. So I don't want "all sections" selected by default because most day-to-day clerk + checkuser operations are on an individual section (usually the first one). I'm working on a patch now which will disable that button by default unless you set a particular config variable and will clearly indicate that you probably want to select "All sections". Give me a few minutes to roll it out. GeneralNotability (talk) 02:10, 26 November 2020 (UTC)

Version 2.2.14 deployed, it disables the feature entirely unless you set the passive-aggressively named config option iUnderstandSectionMoves and has a big "READ ME" with hovertext next to the section move checkbox telling you what you should be doing instead. GeneralNotability (talk) 02:30, 26 November 2020 (UTC)

Thanks for doing that. Cut-and-paste moves are needed on occasion, but the other type of merge is far more common, and I think people weren't even aware they had to change the date selected to "all sections" in order to do a full move. Sro23 (talk) 02:34, 26 November 2020 (UTC)

I agree - like I said, UI/UX is not my forte, so I probably could have made this clearer from the start. GeneralNotability (talk) 02:35, 26 November 2020 (UTC)

New case

I submitted a report regarding an user. buidhe had said that this was the right page:

https://en.wikipedia.org/w/index.php?title=User_talk:Buidhe&diff=990728303&oldid=990728248

It appears on the talk page. Can you please move it to main page? Also please stop this malicious user using his accounts and ips to force his revisions on pages. — Preceding unsigned comment added by 46.106.247.214 (talk) 07:00, 26 November 2020 (UTC)

ISP related discussion at technical village pump

There is a disccusion at WP:VP/T § wikimedia sites not loading with BSNL Broadband which might use technical experince of CUs, and related persons. Regards, —usernamekiran (talk) 18:27, 27 November 2020 (UTC)

Curious, what's the longest between returning socks?

This one blocked today returned after just shy of 5 years.

Obviously, I'm only asking about those who have been caught after a long absence. My "secret hope" is that ever bad-actor will quietly go away for at least 6 months then come back as a productive editor who is WP:HERE to build an encyclopedia. Just given the numbers, I'm sure that's happened more than once in the history of Wikipedia. davidwr/(talk)/(contribs) 00:38, 28 November 2020 (UTC)

Ping request for clerks or oversighters

There is a request at Wikipedia:Miscellany for deletion/Userspace drafts of banned sockpuppet Oliverdrinkstars57 for a response from an oversighter or SPI clerk. davidwr/(talk)/(contribs) 22:10, 2 December 2020 (UTC)

Commented. GeneralNotability (talk) 22:34, 2 December 2020 (UTC)

Useful user-right

A subset of the WP:RESEARCHER that would let me see JUST the date, username, and page-name of a recent (say, last 6 months) deleted edit if I knew either the username or the pagename would be very useful in filtering suspected socks, or uncovering ones I might have missed.

While creating a whole new user-right isn't going to happen, creating a pseudo-userright managed by an external tool that had these rights on the English Wikipedia AND which required a login that was a CU-managed whitelist if the user wasn't already an admin would be very useful.

For example, it would be useful to know who edited Draft:Asteroid Mining Corporation .. (edit | talk | history | links | watch | logs) and when before making an SPI (a related SPI might be forthcoming from a different editor, see Wikipedia talk:WikiProject Articles for creation#Draft:Asteroid Mining Corporation). However, per longstanding rules, I and other non-admins shouldn't have access to the text of the deleted edits without an RFA-like process, and edit summaries probably wouldn't be helpful enough to make part of this proposed pseudo-userright.

While this is in my mind unquestionably useful, the question of "is it worth it" is "um, not sure, that's why I'm asking for input." davidwr/(talk)/(contribs) 16:27, 7 December 2020 (UTC)

For such a tool to work a sysop account's password is needed. I'm not sure many administrators would be happy allowing their account to be used as a proxy for viewing selected information from deleted revisions, especially as accounts should be used by one person. Having a bot account act as this proxy would require a BRFA + admin bot discussion (if I understand correctly), but would get around the one account issue. However, this way does seem a bit hacky, especially as it would be sending deleted revisions without admin pre-approval (i.e. automatically without the manual intervention of an administrator emailing or restoring content) to an external tool.

Such a pseudo-right is going to need consensus regardless of method, so if this goes forward, a discussion at AN / VPR seems best. If there is widespread consensus for it, an actual right and interface built into the mediawiki software seems better than an external tool. It's certainly less hacky, ensures that deleted revisions are not sent to some external tool and ensures that the actions of one account remain only their action. Dreamy Jazz ^{talk to me | my contributions} 16:55, 7 December 2020 (UTC)

The idea of unbundling permissions to view deleted content is one of the most common WP:PERENNIAL proposals, and other proposals to unbundle admin tools usually fail on this specific point - the WMF has made clear they want deleted content only visible to users who have "passed an RFA-like process". It's not going to happen, to be blunt. However, I'd like to see a proposal for non-admins to view basic summary info about deleted contribs. Admins can view Special:DeletedContributions which is a per-user listing similar to Special:Contributions which shows the date of an edit, the deleted page, and the edit summary, but this screen doesn't actually show any deleted content. Non-admins should just have access to it, really. The related tool to view deleted revisions by page is Special:Undelete, which is also the tool for viewing deleted content with different parameters, so that'll be a more tricky one. Ivanvector (^Talk/_Edits) 17:11, 7 December 2020 (UTC)

I guess its how "deleted content" is defined as to how far this would go. I would say that it encompasses all information about a deleted revision, including page name, edit time and username. Log entries store page creations with summary, username and time (which are not deleted if the page is too), but this would effectively expand this to all revisions which are deleted. Edit summaries could be an issue, as revision deletion for particularly troubling summaries is unlikely to have happened if the page was deleted first (as administrators can see both deleted content and deleted revisions, so if a page was to stay deleted its an extra action for nothing gained). Usernames and edit times are less of an issue to me, but if WMF has weighed in saying they don't want deleted content visible by users who have not passed something like RfA, they may still not like username and edit times being visible. Trying to limit this to sock related stuff would be hard and impractical, so such a tool or user-right would have to account for allowing users who haven't passed RfA being able to usernames + edit times for all deleted content. Dreamy Jazz ^{talk to me | my contributions} 17:33, 7 December 2020 (UTC)

Good points. My understanding from past discussions is that the WMF's objections have to do with copyright, not the whole spectrum of revdelete criteria, and as far as I know material that requires oversight is retroactively oversighted from deleted contribs (because it's not supposed to be visible to admins either), but I could be wrong about that. Anyway it would need to be a discussion with the WMF as to what they would permit.

As a fallback you can always ask an admin, or find someone in Category:Wikipedia administrators willing to provide copies of deleted articles. Ivanvector (^Talk/_Edits) 17:53, 7 December 2020 (UTC)

Maybe a naive comment, but the BAG nominations process is an "RFA-like process" I guess, and it isn't too daunting and relatively calm. So maybe it's possible to create an RFA-like process for this thing too, which is ran on this page or something, open to the whole community but de facto is more informal and just becomes mostly CUs/clerks/SPI-interested people vouching for the suitability of a person to the request? ProcrastinatingReader (talk) 17:56, 7 December 2020 (UTC)

Everyone can view the deleted history of pages without the content and edit summaries using mw:API:Deletedrevisions/mw:API:Alldeletedrevisions. comment/parsedcomment requires the deletedhistory right, and content requires the deletedtext or undelete right. — JJMC89 (T·C) 04:38, 8 December 2020 (UTC)

Bingo. davidwr/(talk)/(contribs) 05:09, 8 December 2020 (UTC)

Move request

There's a move request at Wikipedia talk:Sockpuppet investigations/Pemasangan papan nama stasiun KA Baru (2020 ver.) (to move it to the Wikipedia namespace). It seems logical but I figure it's worth having an SPI clerk look over it and action if appropriate. ProcrastinatingReader (talk) 10:11, 10 December 2020 (UTC)

Wikipedia:Sockpuppet investigations/MidwoodMartin

The user has been renamed to "Midwood123". Should be the case page moved? -- CptViraj (talk) 04:23, 13 December 2020 (UTC)

65.128.47.220

Our friend in Minneapolis is back, this time creating or updating more drafts from 1960s Japanese police movies. He hasn't done anything to definitively tie him to this known sockfarm and as far as I know he's just using an IP, so I'm not going to open a SPI, but it's worth watching.

• Special:Contributions/65.128.47.220
• Draft:Nippon musekinin jidai (edit | talk | history | links | watch | logs)
• Draft:Hyappatsu hyakuchu (edit | talk | history | links | watch | logs)

Dreamy Jazz blocked a nearby /24-block for 2 months for being a part of this farm in November, see Special:Contributions/65.128.87.152. Our friend may have moved on from that IP range. davidwr/(talk)/(contribs) 🎄 16:27, 16 December 2020 (UTC)

Davidwr, in comparing deleted drafts and live drafts, I see enough for a block. Dreamy Jazz ^{talk to me | my contributions} 17:17, 16 December 2020 (UTC)

165.120.15.66 asking to be investigated

I don't know whether it is a common thing for an individual accused of being a sock to post here, asking that an investigation concerning them be expedited, but having waited for some time with nothing happening, I'd quite like someone to resolve the issue if possible, if only so I can get back to editing before my ISP randomises my IP yet again for no good reason and confuses things further. So can someone take a quick look at Wikipedia:Sockpuppet investigations/KyleJoan, reach a conclusion to it (which I needn't discuss here, given the inevitable result) and let me carry on without having this silliness hanging over me. 165.120.15.66 (talk) 23:19, 18 December 2020 (UTC)

Trying to rush an investigation and claiming you know the outcome ahead of time, as if evidence were meaningless, seems very Trump-like. Whether you are socking, as it appears to me, or not, a possibility I raised myself in my filing, claiming innocence doesn't have any bearing one way or the other, and inadvertently insulting admins by accusing them of going along with "silliness" doesn't seem helpful to anyone.-- Tenebrae (talk) 02:20, 20 December 2020 (UTC)

Do WP:BMB and WP:G5 apply to suspected, but not confirmed, socks?

This came out of this SPI I opened in error.

It was my understanding that BMB and G5 applied only to confirmed socks, not to suspected ones. This understanding came from reading policies and some level of observation. However, I could have easily mis-read things or failed to observe enough to make the right call. If I'm wrong, that would mean less bureaucracy, but less "due process." If I'm right, it means more "due process" but more "bureaucracy."

So....

What has been the recent standard practice for applying BMB and G5 to indef-blocked, unconfirmed, suspected sockpuppets with respect to edits made before the new account's block but after the suspected sock-master's block, particularly those with no public "admin-made" ties to the "old" accounts in the block logs, user-page templates, an existing SPI, or elsewhere?

I'm asking because I want to make sure I'm "not doing it wrong." davidwr/(talk)/(contribs) 🎄 18:36, 13 December 2020 (UTC)

Please don't bold random phrases. Wikipedia has a crushing bureaucracy, not any kind of due process. And God help us, it seems like you're trying to inflict even more bureaucracy on us. Policy on blocks and bans apply to everyone equally, not just confirmed sock puppets. NinjaRobotPirate (talk) 06:13, 14 December 2020 (UTC)

Agree with NRP. Additionally the policy does not require the original master be known for G5 to apply, just that it be by a banned or blocked user. As an example that’s been used in the past: if there’s a sock farm with 30 accounts all of whom show expansive knowledge of Wikipedia from their first edit, it’s reasonable to assume that at some point in the past there was a previously blocked account. G5 could be reasonably applied in such circumstances even without knowing the original master if the content seems harmful. Same with suspected socks where an identified master exists. TonyBallioni (talk) 06:21, 14 December 2020 (UTC)

“Suspected” sock is weak. Suspected by anyone? I suggest that G5 applies reasonably to any “likely” sock. Any sock “judged” to be a sock, for sure. Erroneous G5 actions are relatively easy to appeal by a completely innocent editor, aren’t they? —SmokeyJoe (talk) 07:12, 14 December 2020 (UTC)

• "after the suspected sock-master's block" is also misleading. The block applies to the person, not just the blocked account, so G5 applies to any pages created after the first indef block of any of the master's accounts, master or sock. It's commonplace to see socks blocked before their master. Cabayi (talk) 13:27, 14 December 2020 (UTC)

Thank you all, especially TonyBallioni for the historical example. That example made things very clear. Perhaps this example can be added to WP:BMB and WP:G5 as a footnote.

Cabayi I'm sorry if I was unclear about "sock-master's block," I meant any edits made by any account definitively tied to any account indef'd at the time of the edit.

NinjaRobotPirate In general, I tend to lean toward having clear, consistent processes (with plenty of room for things like WP:IAR, unanimous consent, suspension of the rules, and the like of course) occasionally forgetting that "process exists to serve a mission, not to serve itself." Thank you for calling me out on that. Also, while I disagree with calling the bolding "random," knowing you and probably others think it is gives me pause. I'll try to be more conservative with text-emphasis it in the future. davidwr/(talk)/(contribs) 🎄 14:15, 14 December 2020 (UTC)

• There's a good technical reason why G5 shouldn't depend on a sock being CU-confirmed. Some WP:LTA cases go stale, i.e. it's no longer possible to build a chain of confirmed socks back to the original master. To say we can no longer G5 pages created by new socks in those cases would be absurd. -- RoySmith (talk) 14:23, 14 December 2020 (UTC)
• Responding to a few points that aren't in order (sorry):
  • To Cabayi's comment about blocks applying to the person: that applies to blocks and bans. G5 applies to any page created in contravention of a block or ban, so for example a page on a Hot Wheels toy created by a person topic-banned from miniature versions of things would be eligible for G5 (as long as they created it while the ban was in force) even if they weren't using an alternate account at the time. Also, the block need not be indefinite (I think that one's obvious) and I think it also needn't be sitewide (i.e. using a second account to evade a partial block is still sockpuppetry).
  • About CU confirmation: it's not required. Remember that sockpuppetry is determined by evidence, and blocks are made by admins. Checkusers can provide more private evidence in the form of findings, but ultimately the determination of sockpuppetry is the responsibility of the patrolling administrator. Of course it's not a bright line; we're not a bureaucracy and don't have segregation of duties, checkusers are also administrators and often also do the admin part, and can also flag a block as being based on private evidence and needing review by other admins with access to that evidence, and so on. The point of all this is that account blocks for sockpuppetry are all the same with respect to these guidelines, whether they're based on private connection data (proven) or an administrator's weighing of evidence (suspected/proven). Ivanvector (^Talk/_Edits) 14:44, 22 December 2020 (UTC)
  • To SmokeyJoe: I think you misunderstand the use of "suspected" in this context. Any account blocked for sockpuppetry is blocked because an administrator determines that the user is abusing multiple accounts, based on evidence provided and the admin's experience; complicated investigations often involve discussions among multiple admins and clerks. "Suspected" refers to the identified sockmaster - we suspect that a tagged sockpuppet account is the identified user's sockpuppet. Putting the two together: a blocked suspected sock is "this account is blocked because it has violated WP:SOCK, and also we think it's a sock of this other user", not "this account might be a sock". An admin has to be able to justify every action they take (WP:ADMINACCT) and admins blocking accounts on their own whims and suspicions that they can't back up with evidence aren't going to be admins very long. Ivanvector (^Talk/_Edits) 14:44, 22 December 2020 (UTC)

    Ivanvector, Regarding, Putting the two together: a blocked suspected sock is "this account is blocked because it has violated WP:SOCK, and also we think it's a sock of this other user", not "this account might be a sock"., is that spelled out somewhere in official policy? The "This account can't possibly be a new user, but I don't know who they're a sock of" scenario comes up often, and it's never 100% clear how to deal with that. WP:SOCK#Blocking comes close, but doesn't quite come out and say, "even if you don't know who they're a sock of". Is there someplace that's more explicit about this? -- RoySmith (talk) 15:54, 22 December 2020 (UTC)

    No, there's not really, I just think it's common sense considering WP:ADMINACCT. Personally the "not a new user" investigations make me mad: if you can't make a coherent argument that a new account is violating the policy then don't waste our time. Checkusers are expressly forbidden from investigating those (WP:NOTFISHING) but as a habit I close those investigations outright without waiting for more evidence. Being a new user who can read instructions isn't a crime, and accusing a new account of sinister motives because they seem to know what they're doing is counterintuitive to editor retention (we want editors to do things properly), not to mention bitey and a personal attack. Experienced users abandon accounts or IPs decide to create a new account all the time, and nothing about that is inherently sockpuppetry. But beyond that simple case it's all a grey area - even with CU-confirmed accounts there's room for judgement and discretion, this is why we don't have very many bright-line rules. Maybe an obviously not new account makes 10 edits and then edits a semiprotected article with a history of socking; that warrants investigation. Maybe a brand new account has spent their first 496 edits alternately adding and removing a period from their sandbox; I'll definitely investigate that. I probably wouldn't block either one unless more compelling evidence turned up, but it's worth our time to look at least. (None of this is directed at you personally, by the way, I'm sure none of it is new to you). Ivanvector (^Talk/_Edits) 16:36, 22 December 2020 (UTC)

Nomination for deletion of Template:Puppet

Template:Puppet has been nominated for deletion. You are invited to comment on the discussion at the entry on the Templates for discussion page. Ivanvector (^Talk/_Edits) 14:58, 22 December 2020 (UTC)

Template filing dates

What's up with the "date filed" column in the main table at WP:SPI? It's giving dates that are inaccurate by months. Ivanvector (^Talk/_Edits) 20:06, 23 December 2020 (UTC)

It's listing the date the Sockpuppet investigation page was created, rather than the date the most recent case was filed. Sro23 (talk) 17:54, 24 December 2020 (UTC)

Category:Wikipedia long-term abuse – Pending approval

Hello, Checkusers and SPI clerks,

Not sure where to post this so I'm posting it here. I came across this category and it looks like "pending approval" isn't a formal or timely process. I think some of these cases have been in this category for years. So, could these cases either be approved or denied approval and deleted? Right now they are in a limbo land and it doesn't seem like it's anyone's responsibility to "approve" these cases. Any ideas on how to get these cases moved through no man's land? Liz ^{Read! Talk!} 06:27, 27 December 2020 (UTC)

Yes, it's basically limbo. Nobody knows (or even seems to care) who's supposed to be approving this stuff or what the rules are. Part of the problem is that a lot of the reports are unnecessary – just common vandals and socks, nothing special. If I see something particularly unhelpful, I nominated it for deletion via WP:MFD. NinjaRobotPirate (talk) 06:17, 28 December 2020 (UTC)

Sockpuppet suspicion

As I requested earlier, you could check on user BrianBanksEditor (contribs). --143.176.30.65 (talk) 10:24, 29 December 2020 (UTC)

You need to provide evidence when requesting an investigation, we don't just "check on" users as a matter of policy. If you can't edit an SPI page then you can put evidence on this page, or contact a clerk on their talk page. However, I see what you're looking at, and I'll update Wikipedia:Sockpuppet investigations/Bonnar212 in a moment. Ivanvector (^Talk/_Edits) 14:05, 29 December 2020 (UTC)

Sorry for not providing (more) details. Thanks for looking into this. --143.176.30.65 (talk) 17:38, 29 December 2020 (UTC)

suspected IP edits by globally blocked account

Hello. Could someone please tell me where to report that I suspect an IP address is being used by a blocked editor? It seems to me that once the account was blocked, the person just kept editing using an IP address. Regards, MrsSnoozyTurtle (talk) 22:54, 30 December 2020 (UTC)

MrsSnoozyTurtle - Start by reading the guidance on Wikipedia:Sockpuppet investigations. Then, since you're using Twinkle, go to the user's talk page, from the TW menu click on ARV & set the report type to Sockpuppeteer & fill in the details with diffs to support your case. Cabayi (talk) 12:02, 31 December 2020 (UTC)

Hi Cabayi. Many thanks for your help with this. Regards, MrsSnoozyTurtle (talk) 13:37, 31 December 2020 (UTC)

When does the data expire to perform a checkuser analysis?

I strongly suspect sockpuppetry in a particular case, and the suspected sock was created precisely six months after the last sock was blocked. Snooganssnoogans (talk) 16:27, 5 January 2021 (UTC)

@Snooganssnoogans: Per meta:CheckUser_policy#CheckUser_status it is held for 90 days, so in your case it will have to be judged on behavioural evidence. SmartSE (talk) 17:08, 5 January 2021 (UTC)

Re-blocking already blocked sockpuppets

Sometimes, in the course of SPI proceedings, a sockpuppet that had been already blocked indef (often for unrelated reasons) is discovered via CU and reblocked to clarify the new block is a Checkuser block. When performing these re-blocks, I'd like to request CU's & clerks be careful not to accidentally re-enable talk page and/or email access if that had been disabled previously by the first blocking admin. I've seen this happen on several occasions now where a batch of socks that had already been blocked with email/tp turned off are blocked for a second time by a CU and the previous block settings get overridden. Normally this isn't such a huge deal, most sockpuppets don't log back into their accounts after being blocked, but there are a number of LTA's where the MO is to log back into old blocked accounts and abuse talk page and email, so I don't think we should allow them a chance to do that. In the SPI script, all you have to do is tick the "NTP" and "NEM" boxes to remove talk page and email access. Sro23 (talk) 02:45, 6 January 2021 (UTC)

Wikipedia:Categories for discussion/Log/2021 January 2#Category:Wikipedia sockpuppets of BlyatPutin

Just wanted to post this discussion here before I (or someone else) close it as merge. --Trialpears (talk) 23:51, 20 January 2021 (UTC)

Now closed. I just wanted to be on the safe side as I know that some SPI people want all related XfDs to be advertised here. --Trialpears (talk) 09:24, 21 January 2021 (UTC)

Wikipedia:Sockpuppet investigations/Johnson05678

Wikipedia:Sockpuppet investigations/Johnson05678 isn't linking to the archive Wikipedia:Sockpuppet investigations/Johnson05678/Archive. The page source shows it has the same templates {{SPIarchive notice}} and {{SPIpriorcases}} that a random other case with a working archive link I looked at (Wikipedia:Sockpuppet investigations/Kauffner) does so I don't know the cause to fix it. Thryduulf (talk) 16:55, 21 January 2021 (UTC)

Thryduulf, purging the page fixed it, that's usually the quick fix for "automatic page linking isn't working". (shameless plug: of course, if one were to use my updated spihelper, they would get automatic page purging, among a variety of other improvements over the Tim Canens version...) ^{SubjectiveNotability} _{a GN franchise} (talk to the boss) 17:34, 21 January 2021 (UTC)

Thanks. I have no helper scripts installed for SPI (or even for XfD where I spent most of my time). Thryduulf (talk) 18:12, 21 January 2021 (UTC)

Thryduulf, that was directed at the unnamed SPI clerk who did the archiving, not at you ;) ^{SubjectiveNotability} _{a GN franchise} (talk to the boss) 19:19, 21 January 2021 (UTC)

Edit by User:Hurbad

@SubjectiveNotability: - re this revert, it may have something to do with an issue raised at WP:ANI. Can we dismiss the possiblilty of sockpuppetry here? Mjroots (talk) 13:33, 24 January 2021 (UTC)

Sonny Solina formatting error

Hello. In the time since I submitted a sockpuppet report, the account has been blocked and I suspect the master has moved onto a new account. Unfortunately when I tried to update the report, it broke the formatting of the usernames section of the report. Could someone please fix this up for me? It's Wikipedia:Sockpuppet investigations/Sonny Solina. Thanks, MrsSnoozyTurtle (talk) 01:06, 26 January 2021 (UTC)

@MrsSnoozyTurtle: I turned the "0" back into "1" to make the correct name show up. Is that what you wanted done? davidwr/(talk)/(contribs) 01:13, 26 January 2021 (UTC)

• Hi davidwr, thanks for your help. Unfortunately the first line is still saying "Example" instead of Kanoawi. I am happy for this investigation to be done without CheckUser evidence, to hopefully speed it up (it has been waiting for a response for over a week). Regards, MrsSnoozyTurtle (talk) 01:17, 26 January 2021 (UTC)

• Doh, not sure how I missed that. Fixed. In any case, it's the {{SPI case status}} line that is changed if you are requesting a checkuser or not. I left it unchanged. davidwr/(talk)/(contribs) 01:23, 26 January 2021 (UTC)

• Great, thanks davidwr.
  Could anyone suggest if there's something wrong with the report please? I'm wondering if there's a reason it hasn't had a response in two weeks. Regards, MrsSnoozyTurtle (talk) 22:36, 29 January 2021 (UTC)

  MrsSnoozyTurtle, there has been a large backlog of cases (as seen on the large list of case pages on the main page for SPI). I have dealt with it and closed it too. Dreamy Jazz ^{talk to me | my contributions} 23:31, 29 January 2021 (UTC)

• Many thanks Dreamy Jazz for your actions here, I really appreciate it. And I apologise for accidentally jumping the queue! Regards, MrsSnoozyTurtle (talk) 23:36, 29 January 2021 (UTC)

requesting IP block exempt

Hello. My IP block excempt recently expired. I didnt give it much thought as the wikimedia sites were loading okay-ishly. But since last two-three days they are loading extremely slowly, and sometimes not loading at all ("server stopped responding"). Other sites are behaving normally. Kindly see special:permalink/991034777#‎wikimedia sites not loading with BSNL Broadband for further details. Also per CU ticket #2020070810007624. Yesterday, I couldnt edit anything for the entire day because the sites were not even loading normally, and VPN's IP ranges were blocked. —usernamekiran (talk) 07:30, 4 February 2021 (UTC)

@Usernamekiran: Just FYI, I'm a normal user who doesn't need ip-exempt, but for the past few days I've been having issues with Wikipedia/Wikimedia servers logging me out or suddenly saying I need to refresh the page because I'm centrally logged in but not logged in on the wiki I've been editing the last few minutes. In other words, even if you do get ip-exempt, you may still have some issues. davidwr/(talk)/(contribs) 15:40, 4 February 2021 (UTC)

@Davidwr: Hi. Yes, thats a different issue. I had read about it once on WP:VP/T. But I had that issue only once, I was logged out. Regarding this current issue, I have been facing this since like two years, I used to switch to mobile data. But tethering/hotspot has taken toll on my mobile's battery life. I had IP block exempt for one year, I used to turn on VPN whenever my ISP used to act weirdly. I use a paid (well known/trustworthy) VPN on computer, and a free yet trustworthy on mobile devices. —usernamekiran (talk) 17:22, 4 February 2021 (UTC)

@SQL: would you kindly take a look? Please feel free to run a CU on me if you need/want to. —usernamekiran (talk) 19:01, 6 February 2021 (UTC)

@Usernamekiran:  Done! SQL^{Query me!} 19:35, 6 February 2021 (UTC)

User:ION News

Please check the IP address of User:ION News. I have seen that their username may be advertising or promotional, which is not allowed. Please check for any other accounts used by this user. If there are, that would lead you to believe they are a sock. Thank you. KirkburnFandom (talk) 08:56, 17 February 2021 (UTC)

KirkburnFandom, you need to have a specific reason to believe that someone may be socking in order to request checkuser on someone, I don't see one here. ^{SubjectiveNotability} _{a GN franchise} (talk to the boss) 14:45, 17 February 2021 (UTC)

Okay, sorry about that. KirkburnFandom (talk) 15:25, 17 February 2021 (UTC)

GeneralNotability, KirkburnFandom's behavior leads me to believe they may have more experience than their editing history might otherwise suggest. I also note they have been CU-blocked on simple-wiki by Operator873. -- RoySmith (talk) 15:35, 17 February 2021 (UTC)

I've blocked the account. There's plenty of overlap between this account and other local and global LTA blocks. @NinjaRobotPirate: in case you want to look as you have history with a number of the IPs that came up in my check.-- Jezebel's Ponyo^{bons mots} 22:42, 17 February 2021 (UTC)

Yeah, probably PoliceOfficer124 aka AstronomerOfSpace etc. "Hello, I'm a staff member of Fandom" is a new persona, though. NinjaRobotPirate (talk) 23:02, 17 February 2021 (UTC)

I get the feeling that this is just a long troll and we get whatever tickles their fancy in any given period.-- Jezebel's Ponyo^{bons mots} 23:10, 17 February 2021 (UTC)

Request investigation

Regarding the Grace Randolph article. After this edit of mine (see the edit summary), user TotalCinemaFan has now re-added a birth date, with an unreliable source. I have reason to believe aforementioned user is yet another sockpuppet of Bonnar212. Only a bit more than a single day has passed since the removal of the birth date, and it's the user's only contribution. I therefore request a sockpuppet investigation on user TotalCinemaFan. Pinging User:Ivanvector, User:Destroyeraa, User:Oshwah, User:GeneralNotability and User:NinjaRobotPirate, some of whom may still be aware of the previous, related investigations. Thanks. --143.176.30.65 (talk) 18:20, 25 February 2021 (UTC)

Looks pretty similar to me.  Blocked and tagged. NinjaRobotPirate (talk) 23:26, 25 February 2021 (UTC)

Thanks. --143.176.30.65 (talk) 10:57, 26 February 2021 (UTC)

Categories

Hey, SPI folks,

Not sure if this has ever come up but is there a particular reason why SPI cases are not categorized? It might make them easier to find for regular editors who are looking into them rather than relying on the search option on the main page. Just wondering. Liz ^{Read! Talk!} 05:36, 24 March 2021 (UTC)

Liz, admittedly the thought has simply never occurred to me. What sorts of categories were you thinking of adding? Mz7 (talk) 19:18, 24 March 2021 (UTC)

Suggesting SPI subsume LTA, and an SPI CSD criterion

Hi,

This may be similar to my past suggestions here, not sure, but today I am prompted by Wikipedia:Miscellany for deletion/Wikipedia:Long-term abuse/Rgalo10, which I consider to be yet another example in the long history of lack of competent management process of LTA. There, SPI clerk User:Praxidicae (alias VAXIDICAE) has expressed some strong opinions critical of LTA. My observation, noting the history of MfDs of LTA subpages, as well as the four MfDs of WP:LTA itself, is that LTA has benefits, weaknesses, and is largely a un-owned process. In comparison, WP:SPI runs efficiently and professionally.

I suggest that WP:SPI somehow subsume WP:LTA, and manage it. Move it to a subpage of WP:SPI? And rename it? I think LTA is not the same as SPI, but where LTA cases are not sufficiently recorded on the userpage and block log of the abuser, the cases really require the experience and privileges of SPI to supervise or manage.

In this small reform process, I would also like to introduce a new CSD, which is to authorize speedy deletion of any SPI subpage on the discretion of any SPI admin clerk. I do not think that SPI subpages or LTA subpages should be discussed lengthily at MfD, as happens from time to time. Either SPI qualified clerks or better think the page better deleted, or none do, and unqualified Wikipedians are ill-placed to second guess them. I have suggested this before, and never seen agreement or disagreement. I think the driving reason for most deletions will be WP:DENY, and a quiet, but traceable, deletion is how to do them. Also... at the moment G6 is abused for this purpose, and I would like to see the SPI CSD criterion used in place of G6 abuse. --SmokeyJoe (talk) 00:46, 25 March 2021 (UTC)

I don't know that moving it to a subpage of SPI would be the best but I do think having it "moderated" so to speak, like SPI with clerks/admins/cus would be the safest bet. I find that probably 90+% of our newer LTA pages serve as no help to identifying LTAs but do serve as a trophy. I was thinking a few weeks ago about a tool/process similar to how WP:AFC/P is set up which requires names being added to the AFC/P list to use AFCH - this could also be accomplished with a filter I suppose but I do think it should be limited to clerks/knowledgeable admins and CUs to create these. Sorry if this is a little rambly, I just wanted to get my initial thoughts out and will expand further tomorrow. VAXIDICAE💉 00:50, 25 March 2021 (UTC)

I agree generally with the concerns about the current state of LTA, and like Praxidicae, I would also appreciate a bit more moderation on this front. For example, perhaps the permission/approval of an SPI clerk or administrator should be necessary before creating a new LTA page. (For the wide majority of sockmasters, no LTA page is necessary and may even be counterproductive per WP:DENY.) As far as the CSD criterion goes, I'm not opposed either, but personally I don't see it as abusive to use G6 for this purpose. Mz7 (talk) 18:31, 30 March 2021 (UTC)

Requester Changing Status?

I requested a sockpuppet investigation via Twinkle, and meant to ask for CheckUser, and forgot to check the box, so that the case is Open. Am I permitted to edit the SPI and change the status of the case to CheckUser Requested, or should I just wait until a clerk reviews the case? Robert McClenon (talk) 00:07, 11 April 2021 (UTC)

Robert McClenon, I can't see any reason not to change it on your own. -- RoySmith (talk) 02:27, 11 April 2021 (UTC)

Yep, you are allowed to edit the SPI and change it on your own. Specifically, you can change the {{SPI case status}} template to {{SPI case status|CUrequest}}. Mz7 (talk) 06:42, 11 April 2021 (UTC)

Archived investigation, potential new username found

I've recently been subjected to a determined ad hominem attack canvassing others for support against me at their TPs, playing the newbie-impunity card. This reminded of another 2020 situation where the master claimed ...Wikipedia rules says its no problem to have as many accounts you want. Its just not allowed to do voting or stuff like that or appear in one article with 5 diffrent accounts or something and try to manipulate a vote or dabate or anything. 17 confirmed, others inconclusive. The new attack has copied text from the SPI, verbatim, in the onslaught against me.

I couldn't easily remember the main SPI username(s), and initial guessing has revealed another likely (IMO) unused/dormant account. Should I annotate this suspicion, and if so how? By creating a Talk page to the archived investigation? As there's nothing to see except registration. Thank you.--Rocknrollmancer (talk) 11:20, 1 April 2021 (UTC)

@Rocknrollmancer: Just to make sure I understand here, is it the case that you suspect that another editor is a sockpuppet, but you forget who the sockmaster is? Do you remember any of their previous accounts? If so, check their user pages to see if they have any {{sockpuppet}} tags. After you identify the sockmaster, you can file a new case under their name the way that you would usually file an SPI case. Mz7 (talk) 06:47, 11 April 2021 (UTC)

Hello, Mz7 - apologies it was unclear. I remember the SPI very well, but couldn't locate the archive instantly from memory due to the clerk moving it. As I remembered the basic format used - a few permutations of names and numbers - I keyed in the basic name, which returned another name from two years or so earlier than the block sequence.

I didn't want to start a new SPI as I know the WMF only keep data for a limited period and there would be nothing to compare to; also as the SPI was actioned by a very experienced editor, after I'd been followed to my regular topics by new users building edit-count with nonsense wikilinks. This experienced editor made a mistake, resulting in me being templated as a sock - a bit too complicated for me to embark upon, even if it was current. I had done research into European Wikis and other websources in late 2020 related to the socking ring activities, and didn't want to retrace my steps now if there was nowhere to place any links found (just as supporting evidence of the 'new' username format). I would prefer it to be recorded for posterity, instead of screengrabbed to my computer, hence the query.

The archive is Wikipedia:Sockpuppet investigations/Frider443/Archive and the suspected sleeper (created on 30 March 2017) is Mia Lara (talk · contribs · deleted contribs · logs · filter log · block user · block log). Thank you.--Rocknrollmancer (talk) 11:15, 11 April 2021 (UTC)

@Rocknrollmancer: Hmm, all right. Since that sleeper account has been dormant for years, I don't think any action is needed at this time. If the account is ever used, we can deal with it then. Mz7 (talk) 21:09, 11 April 2021 (UTC)

Noted Mz7, I thought there may be potential for a soft block.--Rocknrollmancer (talk) 21:45, 11 April 2021 (UTC)

Sock template discussion

Hi, I've opened a discussion about the "an editor has expressed a concern that this user is a sockpuppet of XYZ" version of the {{sockpuppet}} template on the template's talk page. I'd welcome any input that SPI folks may have. Thanks and best, Blablubbs|talk 16:42, 21 April 2021 (UTC)

Query for checkusers and SPI clerks

Hello, SPI crew,

I patrol CSD categories and sometimes look into CSD G5, tagged pages that are claimed to have been created by blocked sockpuppets. It's not uncommon to find that some of these page creators aren't blocked as sockpuppets but are under a global block and there is no explanation provided. Can it be assumed this is due to sockpuppetry? Or could CUers or clerks tag the user pages as sockpuppets so it is clear? Thanks. Liz ^{Read! Talk!} 02:20, 22 April 2021 (UTC)

Liz, global locks are often given by stewards on their own without going through the SPI process, so it's often news to us too. My "decoder ring" for global locks is that if the reason is "long-term abuse" it isn't necessarily an LTA but is definitely someone who's been blocked or locked before and so should be fair game for G5. Same goes for "lock evasion". ^{SubjectiveNotability} _{a GN franchise} (talk to the boss) 13:22, 22 April 2021 (UTC)

Possible duplicate categories

• Category:SPI cases awaiting a CheckUser
• Category:SPI cases waiting for a CheckUser

Both have the same meaning. The former (currently) has exactly the same cases as the latter, plus Wikipedia:Sockpuppet investigations/Yoodaba (which is relisted, rather than CU endorsed as most are). Is there any way to do this more elegantly? For example, merge the categories but create a subcategory for relisted cases (if a separate category is even needed)? I'm not a clerk or CU, so I don't know how the internals of SPI work too well, but these categories just seem somewhat pointless. Tol | Talk | Contribs 17:09, 25 April 2021 (UTC)

In the event it's helpful

Yesterday I blocked Sonny the King of Satellite TV (talk · contribs · deleted contribs · logs · filter log · block user · block log) for disruptive editing, edit warring and not communicating. This morning I blocked Sonny the Satellite Geek (talk · contribs · deleted contribs · logs · filter log · block user · block log) as a block evading sock. I'm bringing this here in the event the editing patterns/areas are recognized as belonging to an LTA that may be helpful to note. It may be possible they need to be added to a known sock puppeteer's record. Tiderolls 12:47, 12 May 2021 (UTC)

• Update. Looking a bit further I found Wikipedia:Sockpuppet investigations/Dimpsboyno3. Tiderolls 14:00, 12 May 2021 (UTC)

• And the hits just keep on coming Sonny the Computer Geek (talk · contribs)

@Tide rolls: Sonny the Computer Kid may be a sleeper (no edits but a very similar name and created in February). Tol | Talk | Contribs 19:13, 12 May 2021 (UTC)

Wikipedia:Sockpuppet investigations/Mikemikev is preventing me from submitting a new spi for him

I've found yet another one and went to add it but found the page linked above. Left over from my earlier report this week? Doug Weller talk 18:48, 15 May 2021 (UTC)

Sorry, I don't get it. How is that preventing you from filing a report? Cabayi (talk) 19:09, 15 May 2021 (UTC)

@Cabayi: what happens when you enter Mikemikev in the field to start a new investigation? Doug Weller talk 19:36, 15 May 2021 (UTC)

It opens the edit window prefilled with a blank report. Isn't it for you? Cabayi (talk) 19:45, 15 May 2021 (UTC)

I don't know what I was thinking, except that I'd just done one that said something slightly similar because there was an existing spi I didn't know about. Doug Weller talk 19:53, 15 May 2021 (UTC)

IP Editing: IP Info feature

Hi all,

Given the particular importance to SPI-involved individuals, I'm just noting a post I've put at Wikipedia:Administrators' noticeboard#IP Editing: IP Info feature with regard to a meta project page about making some information about IPs readily summarised without use of a Lookup function. It's not clear (to me, at least) whether this particular step conceals any information.

It may already be known to those in the biz, but I missed it despite major activity in IP-masking field, so thought it best to make sure. They don't seem to have had any feedback, so that would be great. Nosebagbear (talk) 00:44, 19 May 2021 (UTC)

Amaltheabot malfunctioning

Hi, it appears that the case list currently isn't being updated correctly; the bot has made no updates since 0431 UTC today. My attempt to transclude User:AmandaNP/SPI case list instead failed rather miserably. Not sure what to do, so noting this here. Also pinging Amalthea who might know what's going on. --Blablubbs|talk 15:53, 21 May 2021 (UTC)

Update: I've managed to switch over to the backup now. --Blablubbs|talk 16:07, 21 May 2021 (UTC)

In case we ever need a backup to the backup, I have now created a new bot that updates User:Mz7/SPI case list. I've tried to design it so that it emulates the behavior of Amalthea's bot as closely as possible (i.e. same headings, cases ordered chronologically and only appear once). Currently, as I await the approval of my Toolforge account request, I have it running as a cronjob on my Raspberry Pi. I haven't filed a BRFA or anything since it's just updating my userspace for the time being. Source code. This is my first ever Wikipedia bot, so go easy on me in case there's something wrong. :P Mz7 (talk) 07:26, 22 May 2021 (UTC)

Thanks! I've added a hidden note that points to your case list as well. I actually think it's useful to have cases listed multiple times if there are multiple filings with a different status (otherwise filings can sort of "get lost" and sit for a long time), but that might be a minority viewpoint. --Blablubbs|talk 09:58, 22 May 2021 (UTC)

@Blablubbs: Hmm, yeah, I can experiment with that. Right now I have it set up so that there is a hierarchy of statuses that override each other. For example, if there are two reports under the same name, one with a "clerk" status and the other with an "open" status, the clerk one takes priority. The full hierarchy is inprogress > endorsed > relist > CUrequest > admin > clerk > checked > open > cudeclined > declined > moreinfo > cuhold > hold > close. I could potentially tweak it so that certain statuses will always appear, such as "clerk", e.g. if there is one with an "endorsed" status and another with an "admin" status, it will appear twice in the list as both endorsed and admin. Mz7 (talk) 16:56, 22 May 2021 (UTC)

I should mention the main reason I'm doing this is purely for concision—not make the table too long—as well as this is how it used to be done, I believe. Mz7 (talk) 16:57, 22 May 2021 (UTC)

I would say that for close, clerk, admin, checked, and the first four in the priority list above we should be listing them as separate entries in the SPI case list. This is because:

• If I am working on archiving reports, I will take a look at the closed reports listed. Case pages with one non-closed report but any number of closed reports will not be shown in the closed reports section. I have seen situations where a 3 or 4 closed reports are awaiting and ready for archive but are not flagged for archiving until all the reports have been closed.
• clerk should ideally be always shown as I try to deal with reports with the clerk status before looking at other reports. A CUrequest on another report may hide the clerk request. For example, if the clerk request is to move the case page to the oldest master and another report has been filed with a CU, both reports need clerk assistance (as both would be merged) but this clerk assistance isn't shown on the SPI main page
• admin should ideally be always shown as reports which have the status of admin are often quick to close as the evidence has already been evaluated and a recommendation on how to use the admin tools has been made. This means that these reports can be quickly dealt with, and is useful for me if I don't have time to evaluate a report but have time to double check and block.
• checked may be hidden by a new check user request, and as such a report with CU results is hidden from the list until a CU has run the check / the check has been declined. Some results may be a quick block after behavior is looked over, and as such it delays the time before this report is listed as checked on the SPI main page.
• The first four in the priority list inprogress > endorsed > relist > CUrequest ideally should be a separate order of priority, so that CUs can see if any report on the case page is requesting a check when other reports are open with different statuses and also not hide these reports.
• Lastly, the remaining statuses should keep the order in the above and only be shown if any of the above are not in any report. This means it would be open > cudeclined > declined > moreinfo > cuhold > hold. These statues don't need to be shown in the list if other reports have more important statuses.

At minimum I would like to see admin and clerk shown separately if present. The others are not as important, but would be useful. In summary this would mean the priority lists are clerk, admin, checked, close, inprogress > endorsed > relist > CUrequest, and then open > cudeclined > declined > moreinfo > cuhold > hold (but only if any of the previous priority lists had no match). Dreamy Jazz ^{talk to me | my contributions} 18:09, 22 May 2021 (UTC)

@Dreamy Jazz: OK, this seems reasonable to me. I will work on this now. Mz7 (talk) 20:04, 22 May 2021 (UTC)

@Dreamy Jazz: I've just implemented this as you've described. You can see that, in my table, Wikipedia:Sockpuppet investigations/Ineedtostopforgetting, which currently has 8 (!) active reports, appears three times: in the checked, open, and close categories. The one limitation at the moment is that for the "Filed at (UTC)" column, the bot is just pulling the first timestamp it can find on the page, so it may not be accurate for reports that appear multiple times in the table—not sure how much of an issue that really is. Mz7 (talk) 21:35, 22 May 2021 (UTC)

Shouldn't be much of an issue with regards to filed at. To get it exact you would probably need to parse the first timestamp in the section with the first correct status, but that might be more extra code than needed. With regards to the exact behavior, my thought was that open > cudeclined > declined > moreinfo > cuhold > hold could only be shown if it's not already in the table? That would save one row for Ineedtostopforgetting if space is a concern. Dreamy Jazz ^{talk to me | my contributions} 22:20, 22 May 2021 (UTC)

Dreamy Jazz, ahhh I see now. Yeah, I misread you before. That should be an easy fix. Mz7 (talk) 23:19, 22 May 2021 (UTC)

It's a minor thing, but would it be possible (and desired) to adjust the default case order as well? If I recall correctly, the default sort order in the table currently shows (from top to bottom) inprogress > endorsed > requested > completed > clerk > admin > moreinfo > declined > hold > close. I think it might make sense to put the default sorting hierarchy in line with the one Mz7 described above, hence moving those cases where a course of action has already been determined closer to the top (i.e. making the default sort order inprogress > endorsed > relist > CUrequest > admin > clerk > checked > open > cudeclined > declined > moreinfo > cuhold > hold > close).

I've boldly switched over to Mz7's case list now – would be a shame to not take advantage of newly added features. Thanks for all your work. :) --Blablubbs|talk 08:15, 23 May 2021 (UTC)

Thanks for that. Dreamy Jazz ^{talk to me | my contributions} 10:15, 23 May 2021 (UTC)

@Dreamy Jazz and Blablubbs: I've just implemented both of your suggestions. Mz7 (talk) 22:32, 23 May 2021 (UTC)

Thanks. I say that we stay using Mz7's bot for now as it's got new features. Dreamy Jazz ^{talk to me | my contributions} 06:20, 24 May 2021 (UTC)

Just noting here that it looks like Amalthea's bot is back up now—Wikipedia:Sockpuppet investigations/Cases/Overview—and has apparently been up since 07:51, May 22, 2021‎ (UTC). I just didn't notice until now because Amalthea hasn't responded on his talk page. I'm going to keep my bot running (it's now BRFA approved too ), but since it seems like I'm a bit more around than Amalthea, I would be happy to have my bot be the main one and use Amalthea's bot as the first backup and AmandaNP's bot as the second backup. Mz7 (talk) 22:17, 26 May 2021 (UTC)

@Mz7, it looks like your bot hasn't been updating for a few hours now ([1]) – I've switched back to Amalthea's case list for the time being, though I agree that it would make the most sense to stick with yours as the default in the future. --Blablubbs|talk 11:26, 27 May 2021 (UTC)

@Blablubbs: Whoops, that was embarrassing. This is my first time deploying something on Toolforge, and it seems like there was a weird issue when scheduling the job there. I made a change, and it should be back up now. Mz7 (talk) 18:11, 27 May 2021 (UTC)

Wikipedia:Sockpuppet investigations/Mike Matthews17

I think all three SPI cases there should be closed as the accounts have now been blocked and it has been two weeks since I last edited the linked page in this section. Iggy (Swan) (Contribs) 20:48, 26 May 2021 (UTC)

@Iggy the Swan:  Done. --Blablubbs|talk 11:22, 27 May 2021 (UTC)

Reopened case missing from index

I don’t see Wikipedia:Sockpuppet investigations/I Nyoman Gede Anila at the main SPI page. ☆ Bri (talk) 01:59, 27 May 2021 (UTC)

Because it didn't include the {{SPI case status}} template. The lists should update within the next 15 minutes & we'll see then Bri whether that fixed it. Cabayi (talk) 05:48, 27 May 2021 (UTC)

Looks like this fixed it. In the future, to avoid formatting issues, I recommend either using Twinkle to file cases or the form if you expand the "How to open an investigation:" box on the main WP:SPI page. Mz7 (talk) 06:58, 27 May 2021 (UTC)

Mz7, it was filed by Vinhfast, an SPA. I fear that the teachable moment may fall on deaf (& probably socky) ears. Cabayi (talk) 11:32, 27 May 2021 (UTC)

Merging SPIs

While doing a casual Google search for the banned Wikipedia editor Zhoban, I came across a page on the Resident Evil Wiki that listed him as being a sock puppet of SyphonFilter1987. Curious, I checked out that editor's page here and discovered that they had been grouped together under the sock master JohnRamirez, who is unmistakably Zhoban from several years prior, with identical behaviors and edits from extremely close I.P. ranges in Jersey City and Riverside, Florida. Could we merge the JohnRamirez SPI into the Zhoban SPI? DÅRTHBØTTØ _(T•C) 21:54, 27 May 2021 (UTC)

The JohnRamirez SPI has been dormant for almost a decade. Personally, I would say that no action is needed for the time being; the organization doesn't need to be perfect, and in the event that the sockmaster returns to activity, then we can deal with this then. Mz7 (talk) 20:26, 29 May 2021 (UTC)

Mz7, It would be nice if there was an easy way for somebody to add a note like this to an archived case. We don't let people not on the SPI team touch the archives, but it's a shame for observations like this to disappear into the void. I suppose DarthBotto could open a new SPI report for one or the other of those cases with the note, "I'm not reporting any new activity, but I did find this tidbit which I'm noting here for the use by some future clerk should this case ever become active again". The report would get closed and archived, and thus achieve the goal of adding it to the repository of knowledge. I think it's a reasonable plan, but will stop short of actually suggesting they do that until other clerks add their two cents. -- RoySmith (talk) 14:53, 6 June 2021 (UTC)

Making a "dummy" report as you've described is a potential way to do this, but I would recommend doing this very sparingly, e.g. specifically to request a case be merged with another case based on new information, not just to make note of any new information at all. I've actually done this once before too. In this case, since this particular vandal has been dormant for several years now (last activity on Zhoban was 2017), I suspect that we probably won't be seeing them again, or if we do, it will be very difficult for us to recognize them correctly even with this note. Mz7 (talk) 22:18, 6 June 2021 (UTC)

@Mz7: He's still active. DÅRTHBØTTØ _(T•C) 00:13, 7 June 2021 (UTC)

DarthBotto, Well, if you think he's active again, I would certainly file a report so it can get investigated. -- RoySmith (talk) 01:23, 7 June 2021 (UTC)

Suspicious edits

I am not used to this aspect of Wikipedia and would be grateful for advice on how to proceed. One of the more articles on my Watch-list is Congolese National Liberation Front (an obscure anti-government militia active principally in the 1970s) which has been edited by only half a dozen users since its creation in 2007. However, since 3 June 2021 it has been edited by 9 separate accounts with no user pages - most have little if no other editing on other articles. It may be that one or more of the accounts are legit, but the pattern looks very suspicious to me. I am not sure it's enough to found an investigation here though? —Brigade Piron (talk) 11:00, 5 June 2021 (UTC)

I have seen this before and it is probably this: Category:Wikipedia articles needing copy edit from May 2021. It was tagged for copy editing at 13:57, May 31, 2021‎ by Eik Corell. Dawnseeker2000 23:23, 5 June 2021 (UTC)

Head's up

The use Sandro-gi has just explicitly stated that they will create sockpuppet accounts now that they're blocked. It may be worthwhile to check for any new accounts opened now that his main account is blocked. ReaderofthePack(formerly Tokyogirl79) (｡◕‿◕｡) 13:41, 18 June 2021 (UTC)

I ran a check and found Thragoni (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki) as  Confirmed to Sandro-gi. Because this appears to be a sleeper account creation in progress,  Blocked and tagged. Mz7 (talk) 17:17, 22 June 2021 (UTC)

Wikipedia:Sockpuppet investigations/Tobias Grau

I've really messed up here and can't work out how to get it formatted correctly now Wikipedia:Sockpuppet investigations/Tobias Grau. Sorry! Theroadislong (talk) 18:50, 21 June 2021 (UTC)

Looks like this is fixed now. Mz7 (talk) 18:58, 22 June 2021 (UTC)

Rename request

Nothing that there is a thread at ANI requesting input with regard to a global rename request from a locally-blocked account.-- Jezebel's Ponyo^{bons mots} 15:48, 6 July 2021 (UTC)

All we would need to do in case of a global rename is move the case and retag. So as long as they are being constructive at eswiki, I don't see why we should stop a rename? Not particularly aware of global renaming policies, so policy may say otherwise. Dreamy Jazz ^{talk to me | my contributions} 16:57, 6 July 2021 (UTC)

That's pretty much how I see it as well. Easy enough to retag etc., as long as we're aware. -- Jezebel's Ponyo^{bons mots} 17:38, 6 July 2021 (UTC)

If sock X is renamed to Y, presumably User_talk:X would be a permanent redirect to User:talk:Y? There needs to be a way for people to see what happened to user X when they are trying to work out what's going on in some contentious topic and they're looking at discussions. Johnuniq (talk) 23:52, 6 July 2021 (UTC)

As it stands global renames move the userpage and user talk page (including subpages) of the globally renamed user while leaving a redirect. These redirects can be deleted, but for this user it's deletion is very unlikely. Usually references to an account's previous username easily point towards the new username, but this is not always easy going the other way. However, the new username has the block log and their user talk page history so linking user X and Y should be relatively easy. For this case the sockpuppet case under their old username has been moved while leaving a SPI redirect, so links to the old case will lead to the case under their new username. Dreamy Jazz ^{talk to me | my contributions} 12:31, 7 July 2021 (UTC)

Backlog?

I am experiencing unusually long waiting times on my reports. Did SPI lose people recently? Usedtobecool ☎️ 01:49, 7 July 2021 (UTC)

It's Northern hemisphere summer. People are usually less focused on Wikipedia this time of year if they're not in school and have been around a while, which describes most CUs and admins. I think our backlog usually peaks between now and August most years. TonyBallioni (talk) 04:07, 7 July 2021 (UTC)

Thanks TB, that's useful to know. Regards! Usedtobecool ☎️ 12:48, 9 July 2021 (UTC)

Dealing with suspicious new accounts

Is there a recommended approach for dealing with suspicious new accounts where the master isn't clearly apparent (to the encountering editor)? --Paul_012 (talk) 12:06, 9 July 2021 (UTC)

@Paul 012: I would contact a checkuser privately (e.g. via Special:EmailUser) about the user, with the understanding that a check may not always be run or may not always be conclusive in these cases. Mz7 (talk) 18:09, 23 July 2021 (UTC)

Bot task proposal: Archival of closed cases

A perennial issue at WP:SPI is the large backlog of closed cases awaiting archival, which can be over a month old. This is the simplest phase of the SPI process, because as noted at WP:SPI/PROC#Closing a request, closure is used only after all necessary actions (e.g. blocking and tagging of sock puppets) have been taken by human editors. Thus the archival step can be outsourced to a bot. Does this sound like a feasible idea? –LaundryPizza03 (dc̄) 07:22, 2 August 2021 (UTC)

If it were merely archiving it would be bot-able. The points which spring immediately to mind:

1. The "archiving" stage also requires checking that G5-able material is tagged. That requires an assessment about whether other editors have made "significant" contributions to the article or not.
2. The manual process also ensures that more clerks have at least a passing acquaintance with the case, which is useful when, as is too often the case, the puppeteer creates another sock.
3. Archiving may need to wait for cross-wiki reports to use, and for global lock requests to be acted on.

Just my 2¢. Cabayi (talk) 07:47, 2 August 2021 (UTC)

Some thoughts:

1. Generally as part of the closing of a case I will go around and delete the G5'able stuff. As part of my clerk traineeship the CU that was training me wanted me to understand that closing the case should only be done once everything is done on enwiki.
2. I agree entirely with this point, as a SPI clerk needs to evaluate what an admin / CU / other clerk has done to see if anything was missed before archiving. In cases where an admin who is less experienced in SPI has closed a case, they may have missed tagging the account or reporting the account at SRG. We all can also make mistakes, and so having a second pair of eyes over even the most experienced clerk's work may find small mistakes.
3. Although cross-wiki reports may find the closed SPI report useful, perhaps a bot could not automatically archive if the accounts are listed at SRG? Dreamy Jazz ^{talk to me | my contributions} 08:39, 2 August 2021 (UTC)

This is not a bot-able task. As mentioned above, the hard part of archiving is not the mechanical moving of text from one page to another, but the checking of the case to make sure there's nothing further that needs to be done. It's more than just checking to make sure tags have been applied and everything is formatted correctly. I also give everything a once over to see if I can spot any additional problems. Sometimes that's just a cursory glance, but if something catches my eye, I'll go digging, and I may end up asking questions or even pushing back on a result. It's just basic quality control.

But, I gotta ask. You brought up the same point at WT:SPI/C#SPI backlog and were told it's not something that needs worrying about. So why are you so worried about it? -- RoySmith (talk) 15:51, 6 August 2021 (UTC)

We used to have a bot that did archiving, among other things. I'm not aware of the entire history, but it seems like it had a tendency to break, and eventually got deprecated; I don't think anybody really misses that feature. As others have pointed out above, archiving is actually a fairly important part of the process – I regularly get pings asking me about things I may have forgotten or insufficiently explained when I closed a case, and I regularly hand out such pings (or just quietly tweak or add tags, things like that). --Blablubbs (talk) 16:07, 6 August 2021 (UTC)

IP sock question

The AFD at Wikipedia:Articles_for_deletion/Mario_Kleff_(2nd_nomination) is overrun with socks or meatpuppets, but they are all IP editors. Is there any point to filing an SPI? I have a sense of who the master account might be, as there is a current COIN case for the article. I guess I am wondering how to get some checkuser action in there. --- Possibly ☎ 21:48, 11 August 2021 (UTC)

A checkuser won't connect a registered account to an IP, but admins can block IPs based on behavior. MarioGom (talk) 12:36, 16 August 2021 (UTC)

I was under the impression that CUs would compare registered to IPs (and registrations to website businesses, for example universities) before taking action against the account? This would need CU to enable sanctions against the registered/master. Is this wrong?--Rocknrollmancer (talk) 14:46, 16 August 2021 (UTC)

@Rocknrollmancer: CUs do have access to that data, what Mario meant is that they will not disclose it publicly (i.e. "connect"). --qedk (t 愛 c) 16:45, 16 August 2021 (UTC)

Yeah, @QEDK: thanks for the clarification.--Rocknrollmancer (talk) 19:29, 16 August 2021 (UTC)

Shameless plug

Our official guide to filing cases is relatively short, so I decided to write my own at User:Blablubbs/How to file a good SPI. It comes with a list of dos and don'ts, a few examples of good case formatting and a complementary image of a cute badger. I imagine I will mostly be linking to it instead of (or in conjunction with) using {{diffsneeded}}, but figured I would drop a note here in case somebody else finds it useful. --Blablubbs (talk) 17:05, 29 July 2021 (UTC)

Nice! -- RoySmith (talk) 17:32, 29 July 2021 (UTC)

Yes, very nice! Just one observation: I'm often a bit vague when presenting behavioural evidence – I'll say something like "compare the writing style of the sockmaster [diff] with this user [diff]" instead of "both the sockmaster and this user sprinkle their talk page posts with Wodehouse quotes, for instance 'a cousin in need is a cousin indeed'[diff][diff]". I do that to avoid telling the reported users how to avoid detection, per WP:BEANS, but I really don't want to cause extra work for the SPI clerks and admins! On the other hand, I do try not to go overboard with diffs, so as not to give you too many links to click and compare. Is it better to be more explicit, even at the risk of telling the puppeteers what it is they do that's so easily identified? I haven't actually seen a sockmaster quote Bertie Wooster, and if I did, I'd probably feel a bit more friendly towards them. --bonadea contributions talk 19:28, 29 July 2021 (UTC)

@Bonadea: I think the best answer I can give you is "it depends". The difference between you linking me to five 10-paragraph diffs and requiring me to go digging for common spelling errors versus linking me to five diffs where the shared grammatical mistake is in the edit summary is massive. There are indeed cases where the WP:Beans concerns outweigh the need for very detailed filings (see e.g. WP:Sockpuppet investigations/Yoodaba, where I would actively discourage users from pointing out too many similarities); use your best judgement – as noted in the essay, linking without a precise description is still "green". My general line of thinking is that the longer a case gets, the less beansy the evidence needs to be, and that reports can and should become far less verbose if we notice that a sockmaster is trying to evade detection. It's often good to present a few pieces of clearly actionable evidence and keep some in your pocket; if there are evasion attempts, vague hints or emails are indeed preferred. --Blablubbs (talk) 23:20, 29 July 2021 (UTC)

Please, go overboard with the diffs. It's easy to stop looking at more diffs once you've found what you need to make up your mind. It's much harder to have to go on a scavenger hunt when the reporter isn't specific enough. If you've got something which you think might tip off the sock on how to change their behavior and don't want to disclose that, at least make a note of the exact diffs for yourself and put in the report, "I've got more specifics that I can share off-wiki".

Another thing I should point out is that in many cases, the filer is much more familiar with the case than the clerk working it. You've been living and breathing the conflict for a long time and can recognize a new sock on sight. Writing, "Another ducky sock up to their old habits" may make total sense to you, but to a clerk working the case cold, it's meaningless. -- RoySmith (talk) 23:48, 29 July 2021 (UTC)

It looks good. It contains some excellent points for SPI-inexperienced people who try to enforce their SPI enforcement ideas at MfD. I might try linking it at them when they do this. SmokeyJoe (talk) 00:31, 30 July 2021 (UTC)

• Looks good, I'll cross-plug this at WP:COIN. ☆ Bri (talk) 17:25, 27 August 2021 (UTC)

Is this sockpuppetry?

• ReputationUP (talk · contribs · deleted contribs · logs · filter log · block user · block log)
• ReputationUPitalia (talk · contribs · deleted contribs · logs · filter log · block user · block log)

These could be two accounts that were created in June this year by the same paid-editing firm listed at WP:PAIDLIST#ReputationUP. One of them was displayed by the firm's advert doing test edits. But apparently neither one has actually saved an edit. Are they considered socks, even though edit count=0 on both? ☆ Bri (talk) 17:31, 27 August 2021 (UTC)

Could you file an SPI? That'll make it easier to process this as part of the normal workflow. Thanks. -- RoySmith (talk) 17:42, 27 August 2021 (UTC)

Sure. Just wanted to make sure it wouldn’t just get rejected as invalid. ☆ Bri (talk) 10:49, 28 August 2021 (UTC)

Marking cases as historically stale

Just posting to get some eyes/opinions on my proposed changes to {{SPI archive notice}} ~TNT (she/they • talk) 06:59, 30 August 2021 (UTC)

Found an older account of a banned sock

While doing my (near) daily clean up of ZestyLemonz socking, a check on a new sock revealed a clear connection between ZestyLemonz and Wikipedia:Sockpuppet investigations/Jackstarrzz (evidence on CU wiki for the benefit of checkusers). ZestyLemonz is an extremely prolific, globally-locked sockmaster. Is it worth retagging everything cross-wiki to note the correct sockmaster? -- Jezebel's Ponyo^{bons mots} 18:28, 30 August 2021 (UTC)

I have a similar case (recently found that CharmenderDeol is LaurelWest, who is glocked). So I'm interested in the responses. I think it's useful to improve tags in these cases for a number of reasons: G5 limit date, glock requests, and it's also useful for researching sockfarms and building detection systems. Given that there are CU-confirmation trails in both cases, I think it is also useful to preserve these when doing retags (e.g. preserving confirmed tag to ZestyLemonz and add suspected/alt tag to Jackstarrzz). MarioGom (talk) 19:29, 30 August 2021 (UTC)

Yeah, basically everything Mario said. -- RoySmith (talk) 22:01, 30 August 2021 (UTC)

non-public information

If one has non-public information suggesting a long-term sockpuppet has moved to a new location, rendering most old technical information unusable, how should that be reported? nableezy - 17:43, 2 September 2021 (UTC)

It really depends what you mean by non-public information. Most stuff available to non-functionaries on-wiki is likely to be as good as public. Assuming it's public and there's no LTA page or other documentation, I'd say just mention it when you get the opportunity - maybe during some report like SPI. If it's really non-public then you could just say that they've changed location. You'll often find LTAs have interested admins or checkusers. You could just let them know in private, even with non-public data (it may be a bit more complicated if you got the info through a WMF NDA). Having said all that, I think most people who worry about technical information will know that it can change. -- zzuuzz ^(talk) 18:17, 2 September 2021 (UTC)

If the information is limited to "<account name> has moved to a new location", there is no problem with it, at all levels it is merely a claim, but once you specify a location or something identifiable, that I believe is where WP:OUTING becomes a realistic issue (the policy covers non-editors, and I reckon blocked editors are non-editors) so you would need to communicate such details via private mailing lists (AC/functionaries). But, that aside I think what zzuuzz said is what you should keep in mind, such technical details do change and communicating them might not be 100% necessary and simply mentioning a claim or fact in your report is good enough imo. --qedk (t 愛 c) 18:47, 2 September 2021 (UTC)

New clearing house for cross-wiki spam

Please see m:Talk:Wikiproject:Antispam, established a month ago. Please notify any sockpuppet investigations that uncover non-trivial cross-wiki spam (either articles or external links) so that they can be investigated further and spam on other language wikis remediated. MER-C 13:20, 5 September 2021 (UTC)

2021 CheckUser and Oversight appointments: announcement

The Arbitration Committee is seeking to appoint additional editors to the Checkuser and Oversight teams. The arbitrators overseeing this will be Bradv and KrakatoaKatie. The usernames of all applicants will be shared with the Functionaries team, and they will assist in the vetting process. This year's timeline is as follows:

• 6 September to 18 September: Candidates may self-nominate by contacting the Arbitration Committee at arbcom-en-cwikimedia.org.
• 19 September to 23 September: The Arbitration Committee and Functionaries will vet the candidates.
• 24 September to 26 September: The committee will notify candidates going forward for community consultation and create the candidate subpages containing the submitted nomination statements.
• 27 September to 6 October: Nomination statements will be published and the candidates are invited to answer questions publicly. The community is invited and encouraged to participate.
• By 17 October: Appointments will be announced.

For the Arbitration Committee, Katie^talk 11:40, 6 September 2021 (UTC)

VPNs unboringed

If you want to know more about VPNs and want to know more about sock puppets, you might want to watch this video starting at 8:26. Those lacking a sense of humor need not apply. -- RoySmith (talk) 01:02, 14 September 2021 (UTC)

Semi-protected edit request on 19 September 2021

The user who needs to be investigated for Sockpuppet is Noorullah21. The sockpuppet accounts he used are: Patasaunii7

Ali banu sistani

IPs 120.21.*.* (* changes frequently)

AfghansPashtun

Mblam9416

Eyafocul

Connection of all these sockpuppet accounts can be found on article Second Anglo-Afghan War and Third Battle of Panipat. The changes and reverts made by all these accounts are similar.

Same changes on Second Anglo-Afghan War : By AfghansPashtun 18:17, 1 July 2021‎ [2] By Noorullah21 21:14, 27 August 2021 [3] By AfghansPashtun 14:12, 17 February 2021 [4]

By Noorullah21 on 18:56, 24 June 2021‎ [5] By 04:45, 24 June 2021‎ 120.21.24.91 [6]

Same changes on Third Battle of Panipat By 18:44, 5 September 2021 Noorullah21 [7] By 05:56, 5 September 2021 Noorullah21 [8] By 01:43, 29 April 2021 MbIam9416 [9] By 10:40, 8 September 2021 MbIam9416 [10] By 10:22, 3 June 2021 Ali banu sistani [11] By 07:52, 26 May 2021‎ Eyafocul [12] 199.82.243.91 (talk) 13:19, 19 September 2021 (UTC)

 Note: Not a request for an edit, closing. No comment on the accusation. ScottishFinnishRadish (talk) 16:03, 19 September 2021 (UTC)

mini SPAs?

Some years back I ran into an article that had been edited by a few new ~SPAs. Some of the edits seems fairly promotional, like co-crediting the company promoted for image uploads and moving the article to a brand name. I drafted a sockpuppet investigation req at the time, but wasn't sure if it merited submission. Given some of the problems with paid-editing rings, perhaps that was a mistake. Opinions? None of the individual SPAs have done anything much, a handful of edits each, but between them an article was fairly promotional for the better part of a decade, and the promotional content got copied by some off-wiki sources. HLHJ (talk) 21:57, 19 September 2021 (UTC)

SPI inquiry

I believe a particular sockmaster actually has sock puppets from two other masters. How could we possibly untangle them? Or do we need to? The problem I am facing is that I believe at least two of these masters socks are active, but for obvious reasons do not match with the master. , though they will match with previous socks. What is the procedure to correct this unhappy situation? Chaipau (talk) 18:54, 28 September 2021 (UTC)

Are we talking about Wikipedia:Sockpuppet investigations/Sairg? -- RoySmith (talk) 19:33, 28 September 2021 (UTC)

Yes. I am unsure how to proceed. Chaipau (talk) 20:31, 28 September 2021 (UTC)

Well, as I said in the SPI, If you are convinced they're one of those, please open a new report on one of those cases and provide strong evidence (i.e. diffs) to back that up. -- RoySmith (talk) 20:46, 28 September 2021 (UTC)

Could you please help me with what did not convince you? Because it was DUCK to me. They had the same narrow interest. Same propensity to use primary sources. Uploaded the same map as "owner". And as I pointed out, some of the strongest evidences are fading (the map in commons was deleted, the map which you noted here [13]) So, I am at a loss. Unfortunately, some of the other admins who are familiar with this case are inactive, and I am trying to see how I could build some institutional memory around this. Chaipau (talk) 22:12, 28 September 2021 (UTC)

I'm not sure I can explain any better than I did in the SPI. Maybe another clerk wants to take a look with a fresh set of eyes, but I just wasn't seeing it. -- RoySmith (talk) 14:32, 29 September 2021 (UTC)

That is obvious. I just don't understand what it is you are looking for—which of the patterns are not convincing to you. For all I see you went just by CU. Is SPI only about CU? Chaipau (talk) 11:11, 30 September 2021 (UTC) I am striking that out. I think the way forward is to get some help to investigate the SPI/Sairg. I reached out here and I wonder where I could go next. Chaipau (talk) 11:16, 30 September 2021 (UTC)

User:Hardenian

User:Hardenian appears to be the latest sock of Caleb Hughes. See Wikipedia:Sockpuppet investigations/CalebHughes/Archive. The new user has been blocked for vandalism, but is it possible to confirm sock status and thereby delete his creation of yet another bogus rivalry article at Michigan–Wisconsin football rivalry. User:UW Dawgs has previously been diligent in bird-dogging these socks but he appears to be inactive for the past month. Cbl62 (talk) 00:49, 2 October 2021 (UTC)

@Cbl62 Please open a SPI report. The instructions are at WP:SPI, where it says, "How to open an investigation". Thanks. -- RoySmith (talk) 01:01, 2 October 2021 (UTC)

@RoySmith: I opened the report (Wikipedia:Sockpuppet investigations/CalebHughes) but think I may have screwed it up. Cbl62 (talk) 01:42, 2 October 2021 (UTC)

Hmmm, I'm not sure what went wrong there, but I made some effort to clean it up. It's good enough, thanks. -- RoySmith (talk) 01:57, 2 October 2021 (UTC)

Actually, it looks like I edit-conflicted with Tamzin's cleanup, and they did a better job than I did, so I just left that :-) -- RoySmith (talk) 01:58, 2 October 2021 (UTC)

Did something wrong

I did something wrong when I opened this SPI:https://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/SoaringLL

I want to request CU but the system put it in the section where CU wasn't requested. --Supreme Deliciousness (talk) 10:42, 7 October 2021 (UTC)

Try changing {{SPI case status|}} to {{SPI case status|CUrequest}}. --David Biddulph (talk) 10:52, 7 October 2021 (UTC)

Didn't work, still listed in the no CU section. --Supreme Deliciousness (talk) 11:07, 7 October 2021 (UTC)

The case list is updated by a bot, so it can take a while for the status to change. I've also merged to Wikipedia:Sockpuppet investigations/יניב הורון, since SoaringLL is blocked as a sock of that master. --Blablubbs (talk) 11:08, 7 October 2021 (UTC)

Ethnic Business Awards and Joseph Assaf

I believe a SPI should be opened looking into the editors of Ethnic Business Awards and its founder Joseph Assaf. There seem to be editors like Dbmn12345, DianeBataa and Maithili_nair who heavily edited these pages and both were created by the same editor, Crazedmongoose. Yes this was a while ago but I still thought I'd bring it up. MaskedSinger (talk) 04:33, 20 October 2021 (UTC)

Requesting restoration of deleted behavioural notes

Hello, I would like to request that the SPI case deleted here be restored to the relevant archive. To my understanding, the account was blocked due to a CU in another investigation (in which the specific account was not listed) before the evidence here was looked at, leaving it as not needing specific action. However, a CU block does not leave the behavioural notes as without future use. Having them in the archive makes them much easier to refer back to at later points. Best, CMD (talk) 03:07, 29 October 2021 (UTC)

DasSoumik

DasSoumik (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)

Populated account categories: confirmed · suspected

For archived investigations, see Wikipedia:Sockpuppet investigations/DasSoumik/Archive.

Please note that a case was originally opened under Archive 23 (talk · contribs) but has been moved to Wikipedia:Sockpuppet investigations/DasSoumik. Future cases should be placed under Wikipedia:Sockpuppet investigations/DasSoumik.

{{SPI case status}}

Suspected sockpuppets

• Weftpies (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• २ तकर पेप्सी (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)

Their editing pattern looks like they are operated by User:DasSoumik. Weftpies was created/started editing after User:Bapinghosh was blocked, where as २ तकर पेप्सी mentions they have been paid by ZEE5 here. 2402:3A80:1C3C:46EE:7102:137B:F670:1102 (talk) 10:38, 2 November 2021 (UTC)

•  Not done. Hi Amkgp. While your continued commitment to SPI is appreciated, evading your block in order to report someone for evading theirs is a little ironic; this report is also very light on diffs, and as such not actionable, at least not easily. --Blablubbs (talk) 10:44, 2 November 2021 (UTC)

Suspicious behavior

I voted at Wikipedia:Articles for deletion/Robbie Strazynski and two editors came out of the woodwork to vote keep. Neither had made an edit in a while and neither has made an edit since. Is this enough to warrant opening a SPI against them? MaskedSinger (talk) 05:20, 4 November 2021 (UTC)

{{IPSock}}

A user has mistakenly used {{IPSock}} to report sockpuppetry (diff), something we had previously hoped to prevent when modifying {{Sockpuppet}} and its documentation.

Is {{IPSock}} actually used in the SPI process nowadays? Do clerks/checkusers add it to IP pages or IP talk pages? Because if they don't, and as WP:HSOCK says that "only blocked accounts should be tagged", we could perhaps start a deletion discussion, reword the policy, deprecate the template or something.

Related discussions:

• "135.180.153.166_and_135.180.156.116"
• Template-protected edit request on 26 September 2021

~ ToBeFree (talk) 00:03, 1 November 2021 (UTC)

I never tag IPs, and I don't think I've ever seen another SPI regular tag one; most of them are dynamic and hence it's not really worth it; reporting them in the relevant SPI if logged-out editing is a chronic issue is the preferable option, imo. Also noting some related discussion at User talk:GeneralNotability/Archives/2021/October#removal of IP sock template (perma) and Wikipedia:Bots/Requests for approval/GeneralBotability 2. --Blablubbs (talk) 00:52, 1 November 2021 (UTC)

I have seen it being used for very static IP addresses for cases where long term blocks (years) have been applied to a IP or small IP range that is being used only by a sockmaster. I agree that the "an editor has expressed concern" option should not be part of the template, and if someone tries to use the template without this parameter it should display a error message that this isn't the way to report socks.

It should be only be used for when an IP address is actually blocked too. For example in the case of a very long term static IP it may be appropriate to tag the IP address. However once the IP changes hands and the IP block ceases, the IPSock template should go. Perhaps deletion would be useful here and at minimum I think the "an editor has expressed concern" option should not be recommended or outright removed. For IPs, even more than accounts, having the "I think this might be a sock" template isn't helpful. Dreamy Jazz ^{talk to me | my contributions} 01:08, 1 November 2021 (UTC)

I think for those very very rare cases, we might as well just allow clerks and CUs to add the category manually, or add a handwritten note; if we know that an IP has been used by the same persistent socker for years, it should almost certainly be blocked anyway, and noting the master in the block log should do the trick just as well 90% of the time. Having the tag sort of invites people to use it in ways that aren't very helpful. --Blablubbs (talk) 10:52, 2 November 2021 (UTC)

Removing SPI user notifications from Twinkle

Please see Wikipedia_talk:Twinkle#Request_to_remove_the_SPI_notification_checkbox and comment if there are any concerns about the proposed change to Twinkle. – SD0001 (talk) 11:48, 22 November 2021 (UTC)

Requesting IP block exception

Hello.
Around an year or two ago, I was having trouble with AWB, I discussed it on WT:AWB. The issue was probably with ISP. Whatever the problem was, it seems to be gone if I use a VPN. Both the issues were discussed at special:permalink/978588530#AWB_not_starting, and the section "restarting in" on same page. Since last week or two, I have been facing a similar problem again. I did two edits using VPN without any issues: special:diff/1055383683, and special:diff/1055383654. Would somebody kindly grant IP block exempt to my alternate accounts usernamekiran (AWB), and KirabBOT. I dont have any objections to run a CU on the accounts. Regards, —usernamekiran • sign the guestbook • (talk) 16:04, 15 November 2021 (UTC)

KiranBOT has the IPBE right already. See WP:IPECPROXY for the AWB account. — JJMC89 (T·C) 08:38, 19 November 2021 (UTC)

Hmm, that is a strange issue. The next time you encounter the error, check your IP address to see whether it is part of a range that is blocked on enwiki. (You can do this by logging out and then trying to edit Wikipedia:Sandbox.) If it is, I suspect there may be some bug affecting AWB users trying to log in from blocked IP addresses. Mz7 (talk) 01:15, 20 November 2021 (UTC)

BTW, opening a Private browsing window may be more convenient than logging out and logging back in again, and achieves the same effect. -- RoySmith (talk) 01:23, 20 November 2021 (UTC)

@Mz7, JJMC89, and RoySmith: Last time I encountered the issue with AWB, I could edit enwiki with account without any problem, only AWB was having problem. I dont remember if I tried to edit while logged out. Most probably I didnt. I am not 100% sure about it, but there is high probability that the issue was being caused by my ISP at that time, BSNL/BSNL Broadband. It works very unreliably, once it had blocked many sites starting with x by mistake while blocking porn sites (eg xvideos).

A few minutes ago, I did two AWB edits without VPN, and it worked fine. But switching the VPN on and off is also annoying, as I need to use VPN most of the times. It would be better if I have IPBE for usernamekiran (AWB). —usernamekiran • sign the guestbook • (talk) 14:57, 20 November 2021 (UTC)

@Mz7: Facing it again, when I start the AWB, first it says "operation timed out". Later it says "Object reference not set to an instance of an object." IP is 106.66.28.45 —usernamekiran • sign the guestbook • (talk) 10:31, 1 December 2021 (UTC)

If I try to make a list under checkwiki error number, it says "operation timed out", but I am able to make list through categories. —usernamekiran • sign the guestbook • (talk) 10:43, 1 December 2021 (UTC)

Even though the list is made, I'm unable to load/edit the pages. If I click on "start", it says "restarting in XYZ" with a countdown timer. —usernamekiran • sign the guestbook • (talk) 10:46, 1 December 2021 (UTC)

@Usernamekiran:  Done. I have granted your AWB account an IP block exemption expiring 19:34, February 6, 2022, which is the same time that your main account's IPBE expires. When and if you request an extension on your IPBE on your main account, you should also ask for an extension on your alternative account. Mz7 (talk) 02:12, 2 December 2021 (UTC)

Precocious editing

Quackgates is a WP:BRANDNEW account exhibiting WP:PRECOCIOUS behaviour - day one edits include installing Twinkle and StubSorter, and using HotCat, and on day two getting stuck in to anti-vandalism. Nothing wrong in that per-se, hopefully it is an ex-IP editor who has decided to set up an account, but with their choice of account name are they trying to tell us something? I thought I'd mention it here, in case this matches a persistent sock's pattern. Curb Safe Charmer (talk) 10:20, 8 December 2021 (UTC)

Curb Safe Charmer, it matches several, in fact, but isn't strong enough to block (and depending on the CU, might not be enough for a fishing expedition either - this is solidly in "discretionary check" territory). GeneralNotability (talk) 22:02, 16 December 2021 (UTC)

Backlog

I occasionally file an SPI, and the backlog always seems to hover at around 50 cases or so. I don't know who's so dramatically reduced it to only 6 open cases, but I'm impressed. Thank you all (CUs, clerks, etc.) for your work! Tol (talk | contribs) @ 01:29, 7 January 2022 (UTC)

Yes, the new CUs and clerks we've appointed in the last year have really done a tremendous job. I would also like to thank them sincerely for their hard work. In my time here, the closest we've ever gotten to having no open cases was on October 30, 2019. Let's see if we can beat that record. Mz7 (talk) 23:39, 7 January 2022 (UTC)

I couldn't believe my eyes when I saw the main SPI page. Way to go! Firefangledfeathers 06:25, 9 January 2022 (UTC)

Wow! I didn't recognise the page at all. CMD (talk) 08:53, 9 January 2022 (UTC)

It was at literally just 2 earlier. The record seems to have been tied. Invalid^OS_talk 14:52, 10 January 2022 (UTC)

The record stands at 0. SPI-zero was reached at 07:10, 10 January 2022. Dreamy Jazz ^{talk to me | my contributions} 17:59, 10 January 2022 (UTC)

And there's even a celebratory image that may have never seen daylight before. all round to the clerks, admins, and other helpers. CMD (talk) 21:32, 10 January 2022 (UTC)

It was added following the discussion at Wikipedia talk:Sockpuppet investigations/SPI/Clerks/Archive 4#SPI Zero?. Dreamy Jazz ^{talk to me | my contributions} 22:02, 10 January 2022 (UTC)

Screw-up

Profuse apologies - I just screwed up. I attempted to merge the open Zagweking1000 case into PaullyMatthews, but clicked on the wrong tab and merged SheryOfficial instead. I don't have time to fix it right now - got work stuff to do in a few minutes. If any clerk is able to undo my damage, please go ahead, I will owe you big time. FWIW, the sock in the Zagweking1000 case is  Confirmed, along with a bunch of sleepers - I will take action once the cases are sorted out. Girth Summit _(blether) 09:07, 11 January 2022 (UTC)

@Girth Summit:  Done Just the archive merge needed to be reverted. — JJMC89 (T·C) 09:16, 11 January 2022 (UTC)

You are a star, thank you! Girth Summit _(blether) 09:44, 11 January 2022 (UTC)

Tool request

I track a lot of cross-wiki messes, so I want easy access to global account (Special:CentralAuth) info from enwiki. The {{Checkuser}} template gives a nice [CA] link. But sometimes an SPI is opened after a bunch of accounts have already been indefed and tagged as "suspected", or after indef'ing an LTA account admins don't always remember/bother to file a pro-forma SPI note. By the time someone is browsing the SPI, there could be lots of accounts that we'd want to investigate/compare, which means making a list of {{Checkuser}} entries. It would be useful if I could get to [CA] of an account directly from the "Suspected sockpuppets..." category. Is there a tool that adds those links to User: entries in a cat? Or is there a way to add that link to the WP:Popups menu? DMacks (talk) 11:39, 22 January 2022 (UTC)

@DMacks: Would adding a CA link to {{Sockpuppet category/suspected}} and {{Sockpuppet category/confirmed}} suffice for what you're asking? -- Tamzin^{[cetacean needed]} (she/they) 20:43, 22 January 2022 (UTC)

That seems like it would be CA for the master (header of the cat). I'm looking for each user in the cat. DMacks (talk) 22:19, 22 January 2022 (UTC)

Perhaps, if no such exists, a script could be made that converts links in the category page to IPs or accounts into uses of the {{checkuser}} template? I don't know of a script that does this already. Dreamy Jazz ^{talk to me | my contributions} 23:22, 22 January 2022 (UTC)

Let me see if I can create something quickly. Dreamy Jazz ^{talk to me | my contributions} 23:26, 22 January 2022 (UTC)

I've created a script that replaces all userlinks in sockpuppet categories with those usernames with the checkuser template. This includes the CA link. It is at User:Dreamy Jazz/sockpuppet-category-helper.js. Dreamy Jazz ^{talk to me | my contributions} 00:20, 23 January 2022 (UTC)

@DMacks for the above in case you are not watching this page. Dreamy Jazz ^{talk to me | my contributions} 00:20, 23 January 2022 (UTC)

I've also made some changes to ensure that it still works with other scripts like User:Writ Keeper/Scripts/sockStaleness.js. Let me know of any other compatibility issues. Dreamy Jazz ^{talk to me | my contributions} 01:53, 23 January 2022 (UTC)

@Dreamy Jazz: Just FYI, DMacks was reporting some issues with the script, so I forked it and tweaked it slightly; seems to work now. I think the userlink class isn't part of the standard interface, though what script might add it I have no idea. Writ Keeper ⚇♔ 19:42, 23 January 2022 (UTC)

Oh, I thought userlink was added automatically. I think this might be the mark blocked gadget adding it. Thanks for fixing, I'll update that in my copy too. Dreamy Jazz ^{talk to me | my contributions} 21:14, 23 January 2022 (UTC)

Works awesomely. Thanks!!! DMacks (talk) 23:36, 23 January 2022 (UTC)

Screw-up II

Look guys, I'm really sorry about this - I've screwed up a merge again. I think I'm going to have to do a refresher course on using SPI helper before I attempt any further merges. I had intended to merge the current case that was listed under Cambria Math into the Nainanike case, because I think the sock is a much better fit there (in terms of creation date, time card, and stuff I saw when I ran a CU). I have instead merged both cases. I don't want to fiddle about trying to fix it only to make it worse - is this something that can be reverted, or have I just broken the internet? Girth Summit _(blether) 17:29, 24 January 2022 (UTC)

(Pinging JJMC89 who dug me out of the same hole last time... Girth Summit _(blether) 17:30, 24 January 2022 (UTC))

@Girth Summit: I've reverted the merge back to the prior state. Just to be clear, you want the Im Jitendra 03 report to be moved to the Nainanike case? — JJMC89 (T·C) 17:53, 24 January 2022 (UTC)

Yes - Im Jitendra 03 is a much better fit for Nainanike than they are for Cambria Math. Girth Summit _(blether) 18:21, 24 January 2022 (UTC)

 Done — JJMC89 (T·C) 18:25, 24 January 2022 (UTC)

Thanks. I will hold off on doing any more case merging until someone has sat down and given me a good talking to. Girth Summit _(blether) 18:55, 24 January 2022 (UTC)