Wikipedia talk:Sockpuppet investigations

Logged out socking

What can be done about WP:LOUTSOCKing? I have seen an uptick in IP addresses editing drafts and creating articles of previous socks in an attempt to avoid detection. One that just caught my attention is Draft:Syedhwan which was edited by IP 29.205.115.53 and then a follow-up edit reverting the first. The second edit is from an Android device which is the same as the sock who created the draft. Almost as if they are testing different devices to see what their edit summaries say. I believe this because their operating systems have been called out continuously in the sock investigations. CNMall41 (talk) 06:33, 6 April 2024 (UTC)

That's not socking, and most people have no control over what IP address they're assigned. I started writing an "intro to how IP addresses work" page at User:NinjaRobotPirate/IP editors, which might go some way to explaining this. NinjaRobotPirate (talk) 02:09, 7 April 2024 (UTC)

Thanks for the link. I do understand the IP situation but it sounds like you are saying the we block accounts, not the people behind them. If that is the case, then a SOCK can get blocked and then come back and edit freely from an IP is that correct?--CNMall41 (talk) 20:19, 7 April 2024 (UTC)

I have no idea what you're talking about. I didn't say anything even remotely like that. NinjaRobotPirate (talk) 03:35, 8 April 2024 (UTC)

Okay. I re-read what I wrote and probably should clarify that the IP addresses editing the drafts are obvious socks who are LOUTSOCKING. So it isn't just others editing from random IPs. It is the SOCK or a member of that SOCK farm doing the editing. I can tell as when a sock is blocked, the same IP will then come and edit numerous articles or drafts of the sock that was banned. Similar editing pattern. How do we deal with that through SPI? I know that CUs are not allowed to connect accounts to IPs so not sure how to handle it. --CNMall41 (talk) 03:42, 8 April 2024 (UTC)

Indeed. I just sock reverted hundreds of IP edits and blocked the IPv6/64 range. I don't think there's much more we can do than range block and revert. - UtherSRG (talk) 10:44, 8 April 2024 (UTC)

How would you suggest I report them? Should I file an SPI under the master and just list the IPs? I hate to waste anyone's time but the persistent UPE is causing issues. --CNMall41 (talk) 19:07, 8 April 2024 (UTC)

Yes, you can do that. - UtherSRG (talk) 01:04, 9 April 2024 (UTC)

Okay. First one filed. It is one of our common visitors so........--CNMall41 (talk) 19:20, 10 April 2024 (UTC)

Yeah, you can't ask for CU, but you can file a non-CU SPI. Looks like you asked for CU since it was denied. - UtherSRG (talk) 19:56, 10 April 2024 (UTC)

Yup. I got schooled on that but now I am graduated so will do better next time. --CNMall41 (talk) 21:48, 10 April 2024 (UTC)

Anyone available?

Hate to ask to jump to the top of the queue but these sock are creating a lot of work that will need cleanup. Filed this SPI the other day and see they are definitely working with that farm (along with the many IPs editing right after creation). Yesterday user created Maya: The Love which was G5 earlier this year from the sock farm. The other long list of evidence is on the SPI page. CNMall41 (talk) 02:27, 14 April 2024 (UTC)

Well, I am disheartened myself over the backlog at SPI. It would be nice if the socks/master I did an SPI on would get handled but that is less of a problem than the older SPIs. I filed on April 13th but there are others over a month old...like these two - March 14th and March 16th. Those filers have been waiting for resolution a much longer time than you or I... Shearonink (talk) 15:00, 22 April 2024 (UTC)

Backlog

I can't myself quite fully decipher the Project page for this but how old is the oldest SPI request in the present backlog? The oldest CU request I could find was dated March 28th (for Elyelm) and then there's a clutch of un-CUed SPIs starting on April 9th... I haven't filed an SPI in ages and have one waiting but was just wondering how long the process might take. Thanks, Shearonink (talk) 16:51, 17 April 2024 (UTC)

There's a big table at WP:SPI#Cases currently listed at SPI which is sortable by each column by clicking on the column heading. For your purposes, you probably want "Filed at (UTC)", from which I can see that the oldest case that's still open is Wikipedia:Sockpuppet investigations/Cricket Butterfly which is about 2-1/2 months old at this point. Note that cases (such as this one) may show up multiple times in the table if there's multiple reports from different days.

SPI is chronically backlogged. Too many socks, not enough people working on processing cases. I worked a lot of SPI cases for a couple of years, but at this point I'm largely burned out on that and have moved on to other things, which is a pretty common story with sock hunters. RoySmith (talk) 15:13, 22 April 2024 (UTC)

I understand the burnout, on a lesser level than admins of course but I think any long-time editors who engage on a regular basis in any particular area around here get burned-out on vandal-fighting or draft-reviews or whatever. It just almost seems that this noticeboard has ceased functioning in a reliable fashion. If Wikipedia in general has to wait for 2.5 months for action to be taken on some SPIs then we are in effect saying "Have at it! Sock away! No repercussions for you." I am sorry about the burnout, I am glad you haven't given up entirely. Shearonink (talk) 17:29, 22 April 2024 (UTC)

I try to work through at least a few cases each time I'm on here but the burnout is real. One probably quick thing that will help with the backlog is for checkusers to go through the cases marked "checked" and see if there's actually anything left to do, and either do those things or close the report. I've run through quite a few lately that are left "checked" with nothing to do, and those ones just sit in the queue forever. Ivanvector (^Talk/_Edits) 18:08, 22 April 2024 (UTC)