Wikipedia:Sockpuppet investigations
- WP:RFCU redirects here. You may be looking for Wikipedia:Requests for comment/User conduct (WP:RFC/U), CheckUser policy (Wikipedia:CheckUser), or Wikipedia:Changing username (WP:CHU).
Welcome to Sockpuppet investigations (SPI), a centralized forum regarding suspicions of sock puppetry amongst users as well as any additional CheckUser requests.
| If the evidence is sensitive, privacy is needed, or if it involves sock puppetry by an administrator, seek advice by email from a Checkuser or the Arbitration Committee first. Private information, emails, logs, etc, may not be posted on Wikipedia; if they are important evidence, you must also seek advice by email first. |
Contents
|
Important notes
- Before submitting a case, check that there isn't one already in progress using the search button at the bottom of this page.
- Please provide evidence (preferably with diffs and any reasonable deductions and impressions as a result) that show disruption or deception via IPs or accounts via sock puppetry. Cases without any evidence or with solely vague beliefs or assumptions will likely be rejected.
- Remember to assume good faith when possible.
- Consider notifying the suspected accounts by adding
{{subst:socksuspectnotice|PUPPETMASTER}} ~~~~to the bottom of their talk pages. Notification is not mandatory, and may, in some instances, lead to further disruption or provide a sockpuppeteer with guidance on how to avoid detection. - Keep it simple. Simple, concisely presented evidence leads to a quickly resolved case.
- Do I need to request CheckUser?
- CheckUser is a tool used by a small number of trusted users. It allows them to access evidence from Wikipedia's server logs to help resolve the case. For most cases, behavioral evidence is enough, with no need for CheckUser.
- To request CheckUser, there must be credible evidence supporting the suspicion of sockpuppetry or abuse, and good cause why CheckUser is required. Requests for checkuser without evidence will be declined, because
CheckUser is not for fishing. CheckUser is also not
magic pixie dust, and should not be requested to investigate canvassing or meatpuppetry,
Stale account(s) that have not edited for many months, or cases where behavioral evidence is sufficient to decide the matter (see also the
duck test). Finally, while CheckUser will not be used to confirm that a user is editing from a specific IP address; quick requests may be made for the purpose of getting an underlying IP address or range blocked, however a CheckUser will not disclose what that IP address is. - If you see a purported suicide note or threat of harm (try IRC first in an emergency, at #wikipedia-en-spi connect).
| Requesting checkuser work for an existing case |
|---|
|
Anyone can request CheckUser at any time on an open case if it is necessary. If you wish to request CheckUser to any existing open case, then do the following:
|
- Quick CheckUser requests
If you need a CheckUser to review something, but it does not fall into the above categories, please see here for instructions.
- Administrator's instructions
If any administrator wants to help out at SPI, but is unsure how to get started, please read Wikipedia:Sockpuppet investigations/SPI/Administrators instructions. If you need help with anything, please ask one of the active SPI clerks.
Submitting an SPI case
Create the case by replacing "SOCKMASTER" in the white box below with the user name of the oldest account (the "sockmaster"), or the previous case name, and then clicking the button under the box. For example, if the case name is about User:John Doe or a prior case is at Wikipedia:Sockpuppet investigations/John Doe, then you should enter Wikipedia:Sockpuppet investigations/John Doe in the white box, and then click the button under the box. You will be taken to the next page, where there is a form to fill out giving the details of your report. Note that this form should be used for both opening a case for the first time, as well as opening a new case for a previous sockmaster.
If CheckUser might be needed, change |checkuser=no to |checkuser=yes in the edit box.
| Start or continue an SPI case here |
|---|
|
|
See also
- SPI clerks and clerking
- List of indicator icons used at SPI
- Suspected sock puppets and Requests for checkuser – predecessors to SPI which both ceased as of January 2009
- The SPI bot's edits.
Case status summary
Case status summary |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Open cases
Cases
Questionable pulse |
|---|
|
Questionable pulse
11 February 2012
As I am a checkuser myself, albeit inexperienced, and based on plausible behavorial and timing evidence from the edit histories of the articles NXIVM and Keith Raniere, I did a preliminary check to see if this seemed worthy of further investigation. In my opinion based on what I saw there, it does at least warrant a closer look. I seek help from a more experienced checkuser. I have sent my results privately to checkuser-l. Jimbo Wales (talk) 09:03, 11 February 2012 (UTC) Comments by other usersAccused parties may also comment/discuss in this section below. See Defending yourself against claims. Clerk, CheckUser, and/or patrolling admin comments
Edits of the editor in question come from the range of a hosting company. Besides the account under investigation there are many other accounts. Their exact relations are unknown, but some are definitely related. I do know that it's more than one person there. There are at least two groups of accounts that have a significant enough timing overlap to make it very unlikely they are the same. Practically all edits in this range are very similar to each other. The vast majority of edits is gnomish and appears constructive. On first glance, no abuse of multiple accounts is apparent. The explanation I was given after discussion with one account was that this is done to protect privacy. In my opinion, considering the big picture, this is not a sufficient explanation for all of this. Two or more people in the same range making the same kind of edits, thousands of edits spread over those accounts, meticulously using one IP per account and switching/faking UAs, IPs from a hosting provider - this takes effort and money. Would any legit user, whose only intention is to improve Wikipedia, do that? I don't know. There /are/ potentially problematic edits. I have not really looked at edit content, so only know one example:
There may be a significant connection here: according to our article NXIVM sued Rick Ross' institute. That was nine years ago though. And could be a coincidence. Someone would need to take a much longer look to determine whether there is a problem here. Here are some of the groups that I am convinced are operated by the same person:
Then there is a sequence of accounts that were created on January 31 within a brief period, all to make 6-11 edits and then stop editing (some have resurfaced since):
Again, all of those I mention here (plus others) edit using a dedicated IP per account, and the person I've talked to claims this is all innocent. Amalthea 15:07, 1 March 2012 (UTC) |
Jshan826 |
|---|
|
Jshan826
This page's archived case(s) is/are at Wikipedia:Sockpuppet investigations/Jshan826/Archive.
28 February 2012
Latest in a row of sockpuppets edit warring on Optometry. Quacks like a duck. Others have been indefinitely blocked. Chrisieboy (talk) 17:56, 28 February 2012 (UTC) Comments by other usersAccused parties may also comment/discuss in this section below. See Defending yourself against claims. Clerk, CheckUser, and/or patrolling admin comments
|
Castroby |
|---|
|
Castroby
01 March 2012
User:Nashtam has been given till level - 4 warning for the 4 times destructive changes [[1]], [[2]], [[3]], [[4]]. User:Nashtam account has been created only at 13:27, 29 February 2012. Within few minutes from another username User:Keralean started the same vandalism behaviour [[5]]. at the sametime(19:22, 29 February 2012), a new user User:Iteratededits has been created to do modifications on the same article. I saw a note from User:Nashtam to User:Castroby on User talk:Castroby which looks like an acknowledgement for request. When User:Nashtam has been created only at 13:27, 29 February 2012 how could User:Castroby could have discussed. Looks like User:Nashtam has been created with intention to do the vandalism behaviour. Information about User:Castroby is that the person has already did destructive changes few time back [[6]], [[7]], [[8]]. I also suspect Sock puppetry on these 4 usernames and suspect User:Castroby is the main user. Sathishmls (talk) 06:40, 1 March 2012 (UTC) Sathishmls (talk) 06:40, 1 March 2012 (UTC) Comments by other usersAccused parties may also comment/discuss in this section below. See Defending yourself against claims. Clerk, CheckUser, and/or patrolling admin comments
|
Instantnood |
|---|
|
Instantnood
This page's archived case(s) is/are at Wikipedia:Sockpuppet investigations/Instantnood/Archive. 28 February 2012
147.8.102.172 was blocked for a week on 22 February. This new IP has reinstated 102.172's comments on Talk:Republic of China, saying in the edit summary "Why are my comments struck out and collapsed?" It seems obvious to me that he is both evading his block and demonstrating yet sock account. I should also point out that the move discussion at Talk:Republic of China has been plagued by SPAs, including Instandnood's socks. This is proving very disruptive. John Smith's (talk) 12:49, 28 February 2012 (UTC) In retrospect I don't think a checkuser is necessary. 147.8.202.87 has shot himself in the foot. John Smith's (talk) 12:52, 28 February 2012 (UTC) Comments by other usersAccused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments |
Akhunbaba |
|---|
|
Akhunbaba
This page's archived case(s) is/are at Wikipedia:Sockpuppet investigations/Akhunbaba/Archive. 29 February 2012
Babakhorasan created Akhun chalak baba, which is a duplicate of Akhun Khel Miangan Syed , which was originally created by User:Akhunbaba and later deleted at Wikipedia:Articles for deletion/Akhun Khel Miangan Syed. In [9] and [10], the IP attempted to add a large chunk of that same information to Akhun Khel. Other IPs have done so in the past as well, but this is the most recent. Khanadam also created a duplicate of the master's article, back in October 2011, as his user page; User:Khanadam was deleted via Wikipedia:Miscellany for deletion/User:Khanadam. I'm not sure why we didn't bring this up as sockpuppetry back then. So, all 3 editors (and other, older IPs) are trying to add the same content, under a variety of different names/articles, to Wikipedia; apparently not learning our rules about sourcing and OR. Since there have now been at least 3 different user names at different times, I think a sweep is also in order to find any others. Qwyrxian (talk) 12:26, 29 February 2012 (UTC)
Comments by other usersAccused parties may also comment/discuss in this section below. See Defending yourself against claims. Clerk, CheckUser, and/or patrolling admin commentsPerhaps I'm missing something, but it appears Babakhorasan and Khanadam are either stale or close to it. Is there any current disruption going on (aside from the IP)? TNXMan 14:25, 29 February 2012 (UTC)
|
98.216.188.72 |
|---|
|
98.216.188.72
29 February 2012
(IPs placed in chronological order of vandalism, original offender placed as sockmaster). All accounts have made edits to Chris Jericho (between yesterday and today) asserting he is the inventor of Canada. Evidence for IPs in order of listing: [13], [14], [15], [16], [17], [18], [19], [20], [21], [22], [23], [24], [25], [26], [27]. Comments by other usersAccused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments |
Praline97 |
|---|
|
Praline97
01 March 2012
User makes the same non-constructive edits to the Roger Federer career statistics article. Praline97 is currently blocked for disruptive editing. Armbrust, B.Ed. Let's talkabout my edits? 02:37, 1 March 2012 (UTC) Comments by other usersAccused parties may also comment/discuss in this section below. See Defending yourself against claims. It would appear that he has also made the same edits under the IP 138.202.132.33. Fyunck(click) (talk) 03:09, 1 March 2012 (UTC) Clerk, CheckUser, and/or patrolling admin comments |
Agbilalmali |
|---|
|
Agbilalmali
01 March 2012
Almost exact same username and same unexplained edits removing info again an again [28][29] despite warnings (User talk:Agbilalmali)
Comments by other usersAccused parties may also comment/discuss in this section below. See Defending yourself against claims.
Clerk, CheckUser, and/or patrolling admin comments |
Websense, Inc. |
|---|
|
Websense, Inc.
This page's archived case(s) is/are at Wikipedia:Sockpuppet investigations/Websense, Inc./Archive. 01 March 2012
Link: [30] Huge longterm abusive organisation returning, see previous Wikipedia:Sockpuppet_investigations/Websense,_Inc./Archive - many accounts and previous IPs that are very likely them listed there, the ranges/ISPs etc on the previous list should be properly checked and listed to prevent against long term abuse over several years... But it could well be totally as well that it is a PR firm they have employed too, which would of course show up as negative in a SPI... is there no actual enforcement of WP:COI to stop corporations and PR organisations directly editing articles to push an agenda in blatant violation of WP:COI? Comments by other usersAccused parties may also comment/discuss in this section below. See Defending yourself against claims. Clerk, CheckUser, and/or patrolling admin comments |
Sanzana45 |
|---|
|
Sanzana45
01 March 2012
Initially reported to WP:AIV: http://en.wikipedia.org/w/index.php?title=Wikipedia%3AAdministrator_intervention_against_vandalism&diff=479686348&oldid=479686294 An example of suspicious diffs for comparison is here: http://en.wikipedia.org/w/index.php?title=Naked_News&diff=prev&oldid=479503080 and here: http://en.wikipedia.org/w/index.php?title=Naked_News&diff=prev&oldid=478779518 These arouse suspicion because both accounts edited the same page to added sexual things and have been targeting the topic of pornography. Kiko4564 (talk) 18:16, 1 March 2012 (UTC) Comments by other usersAccused parties may also comment/discuss in this section below. See Defending yourself against claims. Clerk, CheckUser, and/or patrolling admin comments |
Oktavas |
|---|
|
Oktavas
01 March 2012
User account was created at 17.23, just after an argument arose between me and Oktavas over an article. User has only made one contribution so far, and that was to contribute to the argument on the side of Oktavas. English used in writing the comment is also quite similar to that of Oktavas. Aunty-S (talk) 18:39, 1 March 2012 (UTC) Comments by other usersAccused parties may also comment/discuss in this section below. See Defending yourself against claims. Clerk, CheckUser, and/or patrolling admin comments |
Cases: Administrator Action Needed
Open cases: awaiting Checkuser processing
Cases in this section have an open request for Checkuser that is being processed. Any user may update or act on this case, and any patroller or clerk may decide the case. However it will not be closed if the Clerks believe any further action is needed.
- Endorsement or decline of Checkuser request may only be made by a Clerk or Checkuser.
- If your case is not showing up here, or this section seems out of date, please click the .
Awaiting clerk approval
Nangparbat |
|---|
|
Nangparbat
This page's archived case(s) is/are at Wikipedia:Sockpuppet investigations/Nangparbat/Archive.
01 March 2012
As user MarcusMaximus0 this guys sole purpose was to revert everything I added to any article. His first edits ever were to revert me on an article which very few people have ever edited.[32] He has now appeared on an article undergoing review for GA status, and is wreaking havoc, as he said he would as MarcusMaximus0 when he said he would revert and screw up any edits I make to Wikipedia. Darkness Shines (talk) 10:04, 1 March 2012 (UTC) Comments by other usersAccused parties may also comment/discuss in this section below. See Defending yourself against claims. Clerk, CheckUser, and/or patrolling admin comments |
Awaiting Checkuser
Quick Checkuser requests
This section is for CheckUser requests unrelated to sockpuppetry, such as:
-
- Underlying IPs for identification and blocking for a longer term than autoblock.
- Collateral damage checks for the informed hardblocking of IPs or ranges.
- Threats of harm (to self or others) where the location and other details is needed law enforcement or medical authorities; but in actual emergencies, emergency
wikimedia.org should be used instead. - IP block exemption checks before granting IPBE (or to confirm it is being used constructively).
Requests to investigate and confirm sockpuppetry should be listed in the sockpuppet section above. If such a request is posted here, it will be summarily delisted by a Clerk or CheckUser.
Copy the following template and paste it to the end of this page (quick link to edit) with a useful header and details, then sign using "~~~~" and click "save".
-
==== HEADER ====
{{SPIquick}}
Soapfan2013
| This case has been marked as closed. |
- Soapfan2013 (talk+ • tag • contribs • deleted contribs • logs • filter log • block user • block log • SUL • checkuser (log))
This user appears to need IP block exemption as he is caught in a rangeblock right now. Reaper Eternal (talk) 13:52, 29 February 2012 (UTC)
Archived cases
The following are old SPI cases, separated by month. This archival system was deprecated in February 2010.
| 2009 | |||
| January | February | March | April |
| May | June | July | August |
| September | October | November | December |
| 2010 | ||
| January | February | March |
| April | May | June |
| July | August | September |
| October | November | December |
(For help, see Wikipedia:Purge) |
|
|---|
|
||||||||||||||