Wikipedia:Sockpuppet investigations

WP:RFCU redirects here. You may be looking for Wikipedia:Requests for comment/User conduct (WP:RFC/U), CheckUser policy (Wikipedia:CheckUser), or Wikipedia:Changing username (WP:CHU).

Welcome to Sockpuppet investigations (SPI), a centralized forum regarding suspicions of sock puppetry amongst users as well as any additional CheckUser requests.

Important notes

• Before submitting a case, check that there isn't one already in progress using the search button at the bottom of this page.
• Please provide evidence (preferably with diffs and any reasonable deductions and impressions as a result) that show disruption or deception via IPs or accounts via sock puppetry. Cases without any evidence or with solely vague beliefs or assumptions will likely be rejected.
• Remember to assume good faith when possible.
• Consider notifying the suspected accounts by adding {{subst:socksuspectnotice|PUPPETMASTER}} ~~~~ to the bottom of their talk pages. Notification is not mandatory, and may, in some instances, lead to further disruption or provide a sockpuppeteer with guidance on how to avoid detection.
• Keep it simple. Simple, concisely presented evidence leads to a quickly resolved case.

Do I need to request CheckUser?

• CheckUser is a tool used by a small number of trusted users. It allows them to access evidence from Wikipedia's server logs to help resolve the case. For most cases, behavioral evidence is enough, with no need for CheckUser.
• To request CheckUser, there must be credible evidence supporting the suspicion of sockpuppetry or abuse, and good cause why CheckUser is required. Requests for checkuser without evidence will be declined, because CheckUser is not for fishing. CheckUser is also not magic pixie dust, and should not be requested to investigate canvassing or meatpuppetry, Stale account(s) that have not edited for many months, or cases where behavioral evidence is sufficient to decide the matter (see also the duck test). Finally, while CheckUser will not be used to confirm that a user is editing from a specific IP address; quick requests may be made for the purpose of getting an underlying IP address or range blocked, however a CheckUser will not disclose what that IP address is.
• If you see a purported suicide note or threat of harm (try IRC first in an emergency, at #wikipedia-en-spi ^connect).

Quick CheckUser requests

If you need a CheckUser to review something, but it does not fall into the above categories, please see here for instructions.

Administrator's instructions

If any administrator wants to help out at SPI, but is unsure how to get started, please read Wikipedia:Sockpuppet investigations/SPI/Administrators instructions. If you need help with anything, please ask one of the active SPI clerks.

Submitting an SPI case

Create the case by replacing "SOCKMASTER" in the white box below with the user name of the oldest account (the "sockmaster"), or the previous case name, and then clicking the button under the box. For example, if the case name is about User:John Doe or a prior case is at Wikipedia:Sockpuppet investigations/John Doe, then you should enter Wikipedia:Sockpuppet investigations/John Doe in the white box, and then click the button under the box. You will be taken to the next page, where there is a form to fill out giving the details of your report. Note that this form should be used for both opening a case for the first time, as well as opening a new case for a previous sockmaster.

If CheckUser might be needed, change |checkuser=no to |checkuser=yes in the edit box.

Start or continue an SPI case here

See also

• SPI clerks and clerking
• List of indicator icons used at SPI
• Suspected sock puppets and Requests for checkuser – predecessors to SPI which both ceased as of January 2009
• The SPI bot's edits.

Case status summary

Open cases

Cases

Cases: Administrator Action Needed

Open cases: awaiting Checkuser processing

Cases in this section have an open request for Checkuser that is being processed. Any user may update or act on this case, and any patroller or clerk may decide the case. However it will not be closed if the Clerks believe any further action is needed.

• Endorsement or decline of Checkuser request may only be made by a Clerk or Checkuser.
• If your case is not showing up here, or this section seems out of date, please click the .

Awaiting clerk approval

Awaiting Checkuser

Quick Checkuser requests

This section is for CheckUser requests unrelated to sockpuppetry, such as:

• Underlying IPs for identification and blocking for a longer term than autoblock.
• Collateral damage checks for the informed hardblocking of IPs or ranges.
• Threats of harm (to self or others) where the location and other details is needed law enforcement or medical authorities; but in actual emergencies, emergencywikimedia.org should be used instead.
• IP block exemption checks before granting IPBE (or to confirm it is being used constructively).

Requests to investigate and confirm sockpuppetry should be listed in the sockpuppet section above. If such a request is posted here, it will be summarily delisted by a Clerk or CheckUser.

Copy the following template and paste it to the end of this page (quick link to edit) with a useful header and details, then sign using "~~~~" and click "save".

==== HEADER ==== {{SPIquick}}

BlazeTheMovieFan

This case has been marked as closed.

• BlazeTheMovieFan (talk⁺ • tag • contribs • deleted contribs • logs • filter log • block user • block log • SUL • checkuser (log))

Hello, I'm kind of uncertain of what to do about this, which seems to be a case of somebody's account becoming compromised. Do we normally block the IP of the hacker? Reaper Eternal (talk) 20:58, 27 February 2012‎ (UTC)

A CU can probably provide some evidence on whether the account was indeed compromised. I'm not aware of any practice of blocking the hacker's IP, though. T. Canens (talk) 22:45, 27 February 2012 (UTC)

Juding by other edits of this account from a few months ago like it doesn't appear to be compromised, I'm afraid. Amalthea 23:17, 27 February 2012 (UTC)

Oh, so he turned vandal. I'll update the block message. :/ Reaper Eternal (talk) 13:57, 28 February 2012 (UTC)

Soapfan2013

This case has been marked as closed.

• Soapfan2013 (talk⁺ • tag • contribs • deleted contribs • logs • filter log • block user • block log • SUL • checkuser (log))

This user appears to need IP block exemption as he is caught in a rangeblock right now. Reaper Eternal (talk) 13:52, 29 February 2012 (UTC)

• • Posted on their talk page, IPBE granted. TNXMan 14:32, 29 February 2012 (UTC)

Archived cases

The following are old SPI cases, separated by month. This archival system was deprecated in February 2010.

2009
January	February	March	April
May	June	July	August
September	October	November	December

2010
January	February	March
April	May	June
July	August	September
October	November	December

(For help, see Wikipedia:Purge)