Wikipedia:Sockpuppet investigations

"WP:SI" redirects here. For the guideline on set index articles, see Wikipedia:Disambiguation § Set index articles.

To request CheckUser in a case that does not involve sockpuppetry, please scroll down to Quick CheckUser requests.

Update this page	If you suspect sock puppetry by an administrator, or if you need to submit off-wiki evidence for some other reason, you must email the CheckUser team to open an investigation. Private information, emails, logs, and other sensitive evidence must not be posted on Wikipedia. All evidence related to a sockpuppet investigation must otherwise be posted on the designated page.
←What is a sockpuppet? What happens in an SPI?→

Sockpuppet investigations
Current cases Sock puppetry policy
Information pages
Guide to filing cases Administrator instructions Signs of sock puppetry
SPI clerk pages
List of clerks Noticeboard (archive 1, archive 2) Procedures Training
SPI archives
Archived cases (historical) Malformed Cases (whitelist)

This page is for requesting that we investigate whether two or more Wikipedia accounts are being abusively operated by the same person.

Before opening an investigation, you need good reason to suspect sock puppetry.

1. Evidence is required. When you open the investigation, you must immediately provide evidence that the suspected sock puppets are connected. The evidence will need to include diffs of edits that suggest the accounts are connected. (This requirement is waived if the edits in question are deleted; in this case just provide the names of the articles that both have been editing.)
2. You must provide this evidence in a clear way. Vaguely worded submissions will not be investigated. You need to actually show why your suspicion that the accounts are connected is reasonable.

Investigations are conducted by a clerk, who will compare the accounts' behaviour and determine whether they are probably connected; this is a behavioural evidence investigation. Upon request, investigations can also be conducted by a CheckUser, who can look at the physical location of the accounts (and other technical data) in order to determine how likely it is they are connected; this is a technical evidence investigation.

Due to Wikipedia's CheckUser policy, CheckUsers will conduct a technical investigation only if clear, behavioural evidence of sock puppetry is also submitted; if you ask for technical evidence to be looked at but do not provide behavioural evidence, the investigation may not be allowed to proceed. Additionally, CheckUsers will not publicly connect an account with an IP address per the privacy policy except in extremely rare circumstances.

How to open an investigation:

To open an investigation (or case), enter the user name (or if there isn't one, IP address) of the oldest account (the "sockmaster"), or the previous case name, in the box below, then click "Submit". Note: Do not include "User:" or any other commentary. For example, if the case name is about User:John Doe or a prior case was at Wikipedia:Sockpuppet investigations/John Doe, you should enter John Doe in the box below. You will then be taken to another page containing a form you must complete to open the investigation. The process for opening a subsequent investigation on the same user is the same as for creating a new case. Again, do not include "User:" in any of the sock or ip fields. If you also require a CheckUser to investigate, change |checkuser=no to |checkuser=yes in the edit box on the next page. If you are an anonymous (IP address) editor, and the case page is protected or does not exist, please click "show" to the right and use the box below

Cases currently listed at SPI

Investigation	Status	Date filed	Last user to edit case	timestamp	Last clerk/checkuser to edit case	timestamp
HRA1924	CU requested	2016-09-11 12:57 UTC	Ponyo	2016-09-13 17:40 UTC	Ponyo	2016-09-13 17:40 UTC
Marianwolfe86	CU completed	2016-07-30 06:54 UTC	Bbb23	2016-09-01 14:25 UTC	Bbb23	2016-09-01 14:25 UTC
LanguageXpert	CU completed	2016-08-06 12:33 UTC	Kautilya3	2016-08-15 01:04 UTC	Bbb23	2016-08-06 14:36 UTC
Toyota97	CU completed	2016-08-17 07:16 UTC	Ponyo	2016-09-09 20:12 UTC	Ponyo	2016-09-09 20:12 UTC
Pamba23	CU completed	2016-08-20 08:54 UTC	Cabayi	2016-08-23 10:04 UTC	Bbb23	2016-08-20 13:48 UTC
Mexinkita	CU completed	2016-08-21 04:45 UTC	Bbb23	2016-08-21 12:02 UTC	Bbb23	2016-08-21 12:02 UTC
Papaursa	CU completed	2016-08-27 16:49 UTC	Papaursa	2016-09-09 04:39 UTC	Bbb23	2016-08-28 00:31 UTC
HenryBlum	CU completed	2016-08-28 12:50 UTC	GeneralizationsAreBad	2016-09-09 18:41 UTC	GeneralizationsAreBad	2016-09-09 18:41 UTC
Lamg123	CU completed	2016-08-29 04:36 UTC	Jytdog	2016-08-29 18:33 UTC	Bbb23	2016-08-29 18:29 UTC
Fanoftheworld	CU completed	2016-09-01 22:17 UTC	NeilN	2016-09-11 16:49 UTC	Ponyo	2016-09-07 19:48 UTC
Mr.Robertson88	CU completed	2016-09-03 11:07 UTC	Bbb23	2016-09-04 19:45 UTC	Bbb23	2016-09-04 19:45 UTC
Yujufan	CU completed	2016-09-04 08:04 UTC	Bbb23	2016-09-04 15:09 UTC	Bbb23	2016-09-04 15:09 UTC
Fleets	CU completed	2016-09-09 17:07 UTC	Gibson Flying V	2016-09-11 09:35 UTC	GeneralizationsAreBad	2016-09-09 17:09 UTC
Rajeshbhatt director	Open	2016-07-22 08:40 UTC	Risker	2016-09-04 03:07 UTC	Risker	2016-09-04 03:07 UTC
Hiyob346	Open	2016-07-28 00:50 UTC	Iazyges	2016-09-12 23:14 UTC	Vanjagenije	2016-08-14 10:35 UTC
Bambifan101	Open	2016-08-30 04:15 UTC	Vanjagenije	2016-09-13 17:49 UTC	Vanjagenije	2016-09-13 17:49 UTC
Astral Prince	Open	2016-08-31 20:53 UTC	Nthep	2016-09-03 21:19 UTC
Kingo7672	Open	2016-09-03 23:58 UTC	Darkknight2149	2016-09-10 21:15 UTC
Yaysmay15	Open	2016-09-05 02:22 UTC	NeilN	2016-09-11 14:21 UTC	Danlaycock	2016-09-05 19:23 UTC
NoCal100	Open	2016-09-10 19:48 UTC	Mike V	2016-09-13 19:03 UTC	Mike V	2016-09-13 19:03 UTC
Stubes99	Open	2016-09-12 11:52 UTC	82.79.214.252	2016-09-12 11:52 UTC
Elektrik Fanne	Open	2016-09-12 16:23 UTC	Burninthruthesky	2016-09-12 16:23 UTC
AHSApacheStudent	Open	2016-09-12 20:07 UTC	Sro23	2016-09-12 20:07 UTC
2601:80:4203:1A20:F1A0:208D:F46E:A3D2	Open	2016-09-13 03:47 UTC	YborCityJohn	2016-09-13 03:47 UTC
Vote (X) for Change	Open	2016-09-13 20:58 UTC	Jc3s5h	2016-09-13 20:58 UTC
Puffmuffin	Declined	2016-08-23 12:25 UTC	Smsarmad	2016-09-03 22:37 UTC	Richwales	2016-09-03 03:08 UTC
Renameduser024	Declined	2016-08-29 17:58 UTC	Jytdog	2016-09-06 16:26 UTC	Richwales	2016-09-02 05:37 UTC
Jeneral28	Declined (CU)	2016-08-16 12:59 UTC	Cordless Larry	2016-08-27 11:17 UTC	Bbb23	2016-08-23 19:49 UTC
Alberto flood	Declined (CU)	2016-08-27 07:15 UTC	Bbb23	2016-08-27 14:39 UTC	Bbb23	2016-08-27 14:39 UTC
WayneRay	Declined (CU)	2016-08-30 02:35 UTC	Jo-Jo Eumerus	2016-09-07 15:44 UTC	Bbb23	2016-08-30 12:53 UTC
49.196.159.137	Declined (CU)	2016-08-30 16:44 UTC	Sro23	2016-09-08 11:55 UTC	Bbb23	2016-08-30 18:40 UTC
IIvIIozzie	Declined (CU)	2016-09-02 19:48 UTC	Bbb23	2016-09-02 19:48 UTC	Bbb23	2016-09-02 19:48 UTC
84101e40247	Declined (CU)	2016-09-05 12:00 UTC	Voceditenore	2016-09-05 18:25 UTC	Bbb23	2016-09-05 13:50 UTC
178.121.228.214	Declined (CU)	2016-09-05 17:31 UTC	Bbb23	2016-09-05 18:08 UTC	Bbb23	2016-09-05 18:08 UTC
AnnLivinova	Declined (CU)	2016-09-08 19:47 UTC	Bbb23	2016-09-10 12:23 UTC	Bbb23	2016-09-10 12:23 UTC
Abu Musab 9	Declined (CU)	2016-09-12 15:54 UTC	Bbb23	2016-09-12 17:07 UTC	Bbb23	2016-09-12 17:07 UTC
Jeremy112233	On hold (CU)	2016-09-13 21:12 UTC	DeltaQuad	2016-09-13 21:28 UTC	DeltaQuad	2016-09-13 21:28 UTC
Dar tribe	Closed	2016-09-10 20:04 UTC	Vanjagenije	2016-09-11 17:42 UTC	Vanjagenije	2016-09-11 17:42 UTC
Brandon1222	Closed	2016-09-10 20:49 UTC	Vanjagenije	2016-09-11 17:47 UTC	Vanjagenije	2016-09-11 17:47 UTC
Famiddleton	Closed	2016-09-10 21:23 UTC	Vanjagenije	2016-09-12 19:26 UTC	Vanjagenije	2016-09-12 19:26 UTC
Rectify 54	Closed	2016-09-11 13:00 UTC	Vanjagenije	2016-09-12 19:33 UTC	Vanjagenije	2016-09-12 19:33 UTC
Shuklakhar	Closed	2016-09-11 20:07 UTC	Vanjagenije	2016-09-11 20:10 UTC	Vanjagenije	2016-09-11 20:10 UTC
Thedoubleunit2016	Closed	2016-09-12 18:55 UTC	Vanjagenije	2016-09-12 18:56 UTC	Vanjagenije	2016-09-12 18:56 UTC
Scionica	Closed	2016-09-13 10:50 UTC	Vanjagenije	2016-09-13 17:35 UTC	Vanjagenije	2016-09-13 17:35 UTC
Junior5a is not nice	Closed	2016-09-13 15:06 UTC	Bbb23	2016-09-13 21:23 UTC	Bbb23	2016-09-13 21:23 UTC

Quick CheckUser requests

Use this section to request checkuser information relating to a situation that does not involve sock puppetry. You could use this section to request, for example: Underlying IPs of an account, where the autoblock has expired or been ineffective. Collateral damage checks for the informed hardblocking of IPs or ranges. IP block exemption checks before granting IPBE (or to verify it is being used constructively). For threats of harm (to self or others) you must e-mail emergencywikimedia.org (see the threats of harm page) and not use this page. Requests to investigate and confirm sockpuppetry should be listed in the sockpuppet section above, and not here (such requests will be summarily removed). To make a request here, copy the following template and paste it to the end of this section (quick link to edit) – replacing "header" with an informative title, and adding underneath the template any relevant information – then sign using "~~~~", preview, and click "save". ==== HEADER ==== {{SPIquick}} * {{Checkuser|username}}

Ref Desk troll sockfarm

This case has been marked as closed.

• Cuthbertlillydeadsilly (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · SUL · CA · checkuser (log))
• Whytothesky8876 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · SUL · CA · checkuser (log))

For the past 2 days or so, we have a disruptive user who has created a massive sockfarm hammering the reference desks with blankings and malware links and porn and the like. They come within minutes of the desk protection expiring, and come fast and hard, with edits every few seconds. You can see the patterns by looking at the ref desk histories, for example here is the humanities desk and here is the science desk. We don't need a confirmation of these as being the same person; we know that. What we need is some assistance in shutting down the disruption. A checkuser could do the following two things for us:

1. Find the underlying IP address or range being used, and then institute an IP block or range block to shut them down and/or
2. Close down the sleeper socks, of which there still should be dozens.

Can we get some help with this? We don't really need a full case, because we don't need an investigation, we just need help shutting it down. I've included two recent socks, but there are several dozen if you check the editing history of the Ref Desks over the past 24-48 hours. Thanks in advance! --Jayron32 17:39, 13 September 2016 (UTC)

• NeilN already requested CU assistance for this on Bbb23's talk page and the answer was that there was heavy use of proxies and the ranges were too erratic to be range blocked.--Jezebel's Ponyo^{bons mots} 17:57, 13 September 2016 (UTC)

  Thanks for the update. Wasn't aware. Can we identify and shutdown the sleeper socks based on the CU information, or is that a lost cause too? --Jayron32 18:00, 13 September 2016 (UTC)

  That would suffer from the same defect. Can't very well find sleepers if we don't know where to look.--Bbb23 (talk) 18:36, 13 September 2016 (UTC)