Jump to content

User:1997kB/Training

From Wikipedia, the free encyclopedia

Initial questions[edit]

If you haven't already done so, please read Wikipedia:Sockpuppet investigations/SPI/Clerk and checkuser procedures. After that, answer the following questions:

  1. What kinds of behavior are considered disruptive from a policy standpoint?
  2. What can a clerk do in a case?
    • endorse/decline for CU per their findings
    • may ask users to cease patrolling or posting to SPI pages (other than to open a case or present evidence) if there are problems
    • remove or refactor (within reason) any material by any user that is not strictly relevant to SPI
    • archive cases
    • if necessary can fix malfunctioned cases (like signing unsigned comment or moving case to master if it's opened under worng name)
  3. What can't a clerk do in a case?
    • don't do things that are not instructed to do
      • On this point, that's more for trainees: full clerks can do any of the clerk tasks without asking a CU, while in training though, just don't get too far ahead :) TonyBallioni (talk) 18:39, 27 February 2019 (UTC)
    • trainee clerk can't coach a trainee
    • should not archive cases closed by themselves
    • can't history merge or view deleted contribs if they are non-admin
  4. When evaluating a new case, what would be your checklist of things to look at?
    • while reviewing a case firstly I'd check whether the case has been filed properly, comment is signed, case is under master account, if not then I'd fix them first. After that I'd look over CA to get an idea about accounts, then I'd check the evidence provided by filing user and based on these evidence and by comparing account edits (if there's deleted contribs contacting patrolling admin), creation dates, overlap in edits, edit summary, phrases, odd behaviour decide whether the accounts are violating sock puppet policy or not. Then I'd endorse/decline for CU per cu criteria and leave a summarised note about my findings and recommendations. Also If there's a lack of evidence in report then asking for more information or if the evidence does not establish a relation between accounts then close the case as groundless.
      • Good stuff for dealing with accounts. What are cases where you would close the case without action even if it appears to be the same user (assume a WP:ILLEGIT violation did happen)? TonyBallioni (talk) 20:04, 27 February 2019 (UTC)
        • if a user is blocked for username violation and they create a new account
        • if previous account are stale and behaviour evidence isn't enough to identify pattern as there could be many people with interest in similar articles
        • if there's a use of multiple accounts but there's no overlap of edits between them, for eg. someone forgot their password and created another account or it's a clean start
        • if user is newbie and using multiple account but they have no intention to disrupt or create any illusion, in such case a friendly note to user is better instead of action as newbies are generally not aware of Wikipedia policies
        • user filing the report is trying to create an illusion of violation of sock-puppetry policy
        • if accounts are already blocked or locked
        • more of I think WP:NOASSUMESOCK explain it in detail
  5. When evaluating a reopened case, what would be be your checklist of things to look at?
    • apart from above check I'd look in archive to check behaviour meets the same person and evidence in archive are helpful in establishing connection or the old accounts are stale or not.
  6. What time zone are you in?
    • +0530 UTC
      • I'm UTC -5/-4 (East Coast of North America), but we overlap frequently, so it shouldn't be a big deal. Just useful to know. TonyBallioni (talk) 20:04, 27 February 2019 (UTC)

If you have a question, feel free to ask me either here or via IRC. If you are unsure of anything at any point in this training, don't hesitate to reach out to me or any of the other CUs/clerks. Rob has also said he's willing to help out with this, so he'll probably be commenting on this page as well. Once you've answered these questions, and we've talked about it, I'll go ahead and add you to the clerk's list. I have this watchlisted, but please ping me when you're done so I know what to look at before commenting :) TonyBallioni (talk) 21:04, 26 February 2019 (UTC)

@TonyBallioni: I have answered the questions. Please have a look. ‐‐1997kB (talk) 16:36, 27 February 2019 (UTC)
Good initial answers. I've made a comment on one of the points, but overall I think you get the jist. I'm busy most of the rest of today, but I'll add some more things tonight to work on and any additional comments (sorry, life is busy rn for me.) I'll go ahead and add you to the clerk list now though :) TonyBallioni (talk) 18:39, 27 February 2019 (UTC)
@TonyBallioni: No problem, life is first priority. I'm also shifting this weekend to new place, so will be little slow in response. ‐‐1997kB (talk) 17:25, 28 February 2019 (UTC)

March 2019[edit]

1 March 2019

So, first some house keeping/scripts stuff:

A few more questions

  1. What is a sleeper? When do you endorse a CU to "look for sleepers"?
    • Sleeper is an account that currently appears to be dormant. They could be good faith user (someone who lost interest in editing, clean start) or bad faith (planned for disruptive activity by sock-master). Whether I endorse for sleeper check depends upon the evidence in SPI, if there's some signs like multiple accounts appearing with same behavior.
      • I wouldn't ordinarily consider a valid clean start to be a sleeper, but you get the idea here. CU has the ability to detect any logged action, including automatic creation of accounts created on other projects on en.wiki (local CUs cannot detect accounts created on other projects that have not attached on en.wiki, though.)
        While sleeper in the strictist sense means accounts that are not in use, you'll people often use it to mean "other accounts that aren't readily identifiable but could be out there." There's a fine line between a sleeper check and a fishing expedition, but generally its a good call to endorse for a sleeper check if the case has a history of multiple accounts running at the same time or if the case has had multiple reports and a CU has not looked at it yet. In the latter case a CU can also look to see if there is a feasible block of the underlying range to stop the account creation or even a hardblock. TonyBallioni (talk) 16:44, 5 March 2019 (UTC)
  2. When you endorse a CU, do you need to say why?
    • As the procedure says, a short explanation is always helpful when acting on request or deferring to CU.
  3. How do you decide whether to block based on behavior vs. endorse a CU?
    • Block based on behavior will work - disruptive "throwaway" account used only for a few edits , obvious disruptive sock puppet, LTA cases where they have peculiarities, evidence easily shows connection between suspected accounts and there's no signs of sleepers.
      • Very good, just to flesh this out a bit more: I tend to be on the harder line when it comes to socking, but the principle I use for first time socking incidents if there is only one other account is "Would the actions in themselves lead to a block if it weren't for the socking?" If the answer is "Yes", I tend to give a longer block up to an indef, but starting with a week if the block wouldn't be indef: I do consider socking to compound the issue as it increases the disruption. If the answer is "No", a warning or shorter block of the master is usually best with a soft block of the sock. If there are policy violations, the sock accounts should always be indef'd, even if the master isn't.
        The other thing I want to point out both here and at AIV is that high school kids doing dumb stuff should not be treated like LTAs. If there is a repeated problem with socking or vandalism, yeah, we indef, but SPI is not bloodsport and kids adding poop to articles isn't really that big a deal in the grand scheme of things. You'll often get people coming to SPI looking for blocks over minor stuff, and it's important not to be afraid to close a case because the disruption has stopped and is stale or is so minor as not to warrant action. People might not like it, but sorting out the important stuff from the unimportant stuff is a big part of the job of a clerk. TonyBallioni (talk) 16:44, 5 March 2019 (UTC)
    • I'd defer to CU if - there's signs of sleepers, serious pattern of vandalism involving dozens of incidents, evasion of community-based bans or blocks, complex cases where behavior alone cannot determine which accounts are socks.
      • Good, see also my statement above about it probably being a good idea to get a CU too look at it if there have been 2-3 previous reports and a CU has never looked at it. I'll also note here (because it seems like the best place to note it) that CUs don't always block even if the accounts are  Confirmed. Some prefer that the blocks be community blocks based on their findings plus the behaviour. While this is less common these days than it used to be, it still happens. I personally will note accounts as  Confirmed if I'm not sure how long a block should be or if I want to leave it to the community via clerks or patrolling admins to determine how severe of a policy violation it was.
        If you've watchlisted a case and a CU returns results ( Confirmed or otherwise) that you feel require admin action, but they haven't acted on themselves, just set the case status to admin and someone will block. TonyBallioni (talk) 16:44, 5 March 2019 (UTC)
  4. Is there a difference between endorsing a CU on a new case vs. endorsing a CU on an established case?
    • There's not much difference, if it meets the cu criteria I'd defer it to CU, but in established cases there's a pattern available in archives, so I think CU defers in such cases will be less.
      • So, there are some qualitative differences here, but the principles remain the same (which you are right on.) In an established case, you have a history to go by: are sleepers normal, are there copycats, are there a lot of accounts that just look like socks but aren't, and even if a CU has said whether or not it would be helpful in the future. The question to ask in every case is what is there to be gained by running a check. Established cases give you more clues as to if the benefits are worth the costs in terms of the time of the CU and the privacy of the accounts. TonyBallioni (talk) 16:44, 5 March 2019 (UTC)

Finally, here are some cases to look at. Don't comment on them there, but if you could respond here how you would work through each of them, we'll talk about these, and then I can put you on working cases. Note two of them have already been dealt with. Try not to look at the result. Rather, think through what you would have done in each of the instances.

After we go through these, we can work on cases "in the wild". TonyBallioni (talk) 20:23, 1 March 2019 (UTC)

@TonyBallioni: Answered the questions. Sorry for being late, past week has been bad (mobile got stolen with 2FA codes and just got back the account yesterday). Will work on the cases in coming days. ‐‐1997kB (talk) 15:06, 5 March 2019 (UTC)
No problem. My life is extremely hectic right now as well, so I understand. Sorry about your phone getting stolen. I hope everything is okay now, though. I've responded to your answers, which were all very good, but there were points I wanted to hit on in each one. Also, just a note about my style: I have a bad habit of talking too much. If I give you a long reply, it isn't because anything you said is wrong, but its because there was a point I wanted to hit on and it took a lot of words to describe it :) TonyBallioni (talk) 16:44, 5 March 2019 (UTC)
Wikipedia:Sockpuppet investigations/Arshad Roshan.a.a
  • Edit interaction between Noobie anonymous and Arshad Roshan.a.a is 4yrs (1): Where Noobie only made 3 edits overlapping with master, which doesn't indicate much behaviorally.
  • Edit interaction between Noobie anonymous and Made in IN (latest sock) is ~3 months (2): Again only 3 edits overlapping with Made in IN.
  • With most of the sock there's no interactions at all (3, 4)
  • Finally all the accounts in both of cases provided in evidence are stale (5, 6)

Although there's a pattern in archive to create articles on Series name (TV series) and copyright violations, but that could be someone else too and being from south asia (non-native english speakers) people generally tends to copy paste. So based on less behaviorally evidence and staleness of all socks confirmed, I'd close the case with no action and suggest to watch over. ‐‐1997kB (talk) 13:49, 12 March 2019 (UTC)

  • Good. Yeah, so if you look at how it was recently closed Reaper Eternal (former CU) closed it after three weeks as not having enough evidence of socking. If you also look through the history of that article, all of the other accounts are CU blocked, but this one isn't. In those circumstances, it is likely that a CU has looked at the account. You could ping the blocking CU to ask about it, but in this case I think the answer would be "we didn't find anything", which is why they are still unblocked.
    This is also a case where it might be worth asking a patrolling admin to look at the delete pages for you. They were both essentially cast lists, but the new versions include the awards and some other slight differences. Likely not enough to block on here. TonyBallioni (talk) 17:00, 18 March 2019 (UTC)
Wikipedia:Sockpuppet investigations/Damolisher
  • On two occasions that IP appeared to undo exactly on 3rd edit (1, 2)
  • There are many editor on that article editing with same views as IP (3-4, 5-6, 7-8)
  • Based on the diff above this IP could be Vjmlhds, Chaosithe, Damolisher or entirely different user.

Finally I'd CU decline it as CheckUsers won't connect IP's to named accounts and assuming that this could be mistake that someone from them forgot to login, a warning to IP would be sufficient. ‐‐1997kB (talk) 08:11, 13 March 2019 (UTC)

  • Good. CUs don't connect IPs to accounts, so declining is the right thing. I didn't look at the technical data, and not making a connection that way, but from the behaviour it does look like they are the same person to me. If you compare the edit summaries you see both talk in complete sentences and use quotation marks in words on the same topic area (compare [1], [2].) I agree that a warning is the most that should happen here, and I did warn the account letting them know if it was them, not to do it in the future. I also closed the SPI case as stale: blocks aren't punitive and we usually don't block if there isn't on going disruption and its the first report of logged out editing. TonyBallioni (talk) 16:38, 18 March 2019 (UTC)
Wikipedia:Sockpuppet investigations/Bertrand101

This one is pretty easy to spot, comparing the case history and edit they did on Tarlac (1).

  • A quick google search shows (2) that two of those stations frequencies are in Tarlac Province but have different names and 936 kHz is not operated by Audiovisual Communicators also 1431 kHz isn't even in that list.
  • The same behavior of adding false information can be seen in last active socks (3, 4, 5) and their LTA case page (6).
  • Plus usernames are pretty WP:DUCK too.

As the case archive shows there's a sleeper pattern too, so I'd endorse the CU request. ‐‐1997kB (talk) 13:37, 16 March 2019 (UTC)

  • Very good. Yeah, this is an obvious case, but it is one where you should virtually always endorse for CU (in fact, it was the first case I was trained on as a CU.) There are a ton of sleepers and they are very easy to spot from the CU interface. Some of us have it watchlisted, but if you run across it, feel free to endorse to get attention more quickly.
    It is also a good example of the type of case you are looking to endorse for a sleeper check: it has a history of accounts, you are all but guaranteed to find something when you look, and the accounts are disruptive enough that you don't just want to wait until they show up again. TonyBallioni (talk) 16:47, 18 March 2019 (UTC)

@TonyBallioni: Responded to all the cases. Don't worry about long replies, I also curious to see what you think about responses. I also have this habit of explaining things but due to my en-3 language skills, I'm little restricted with my replies. :) ‐‐1997kB (talk) 13:37, 16 March 2019 (UTC)

18 March 2019

Very good on all those. Now is a good time to do two cases "in the wild". I've put both of the below cases

@1997kB: Use the template you created to work on them. You can change the case status (closed, admin, self-endorsed, etc.) and another admin/clerk/CU may action them. If I'm around when you act on them, I'll help as well. We'll discuss them here, but I want you to get a feel for them. You should explain your reason for requesting the action you did/closing the case here like you did above, but don't go into too much detail on the case page. Just enough for someone else to see why you are doing what you are doing (i.e. WP:BEANS.) TonyBallioni (talk) 17:13, 18 March 2019 (UTC)

Wikipedia:Sockpuppet_investigations/Banana19208#18_March_2019_2
  • Propaedia was already blocked by Yamla, but given the evidence (1) it is enough to warrant a block behaviorally.
  • Behavior evidence (1, 2, 3) is compelling in case of Micropaedia, so I'd request a block for it.

Additionally there were many sleepers in last check, so {{endorse}}. ‐‐1997kB (talk) 07:57, 20 March 2019 (UTC)

Both Confirmed, blocked and tagged. Although I think a sleeper check was no worth here, since day before there were some confirmed. ‐‐1997kB (talk) 03:21, 22 March 2019 (UTC)
I think a sleeper check was fine here. There was a history of them and they immediately had a new account after the one that was originally reported was blocked, so it made sense. It was a judgement call, and while I wouldn't run them every time on that case, it probably makes sense to request CU at least every few reports or so. If you check the current version of the case, you'll see I also did a sleeper check on the latest report and didn't turn up anything. I suspect this master is going to be with us a while, so likely good to keep it on your watchlist now that you're familiar with it. Also, this one is a pretty straightforward action to request: they are banned per WP:3X so any socks should be blocked on sight. All around, good work on this case. TonyBallioni (talk) 03:21, 24 March 2019 (UTC)
Wikipedia:Sockpuppet investigations/MiG29VN
  • Baccaihp-Utakem8: Baccaihp behaviorally looks like Utakem8 to me (1, 2), which these diff (3, 4) confirms strongly.
  • Baccaihp-Mendako: Since deleted revisions is involved here (5, 6), I'd ask admin to compare them.

Although I requested admin to check deleted revisions to compare Baccaihp-Mendako behaviourlly, after which I was planning for a CU check between two listed accounts since all the accounts were stale in archives, but Bbb23 checked them and both were confirmed to each other and with previous socks with some additional accounts too. ‐‐1997kB (talk) 03:21, 22 March 2019 (UTC)

I was also a bit confused with what you were saying here, but I worked it together: just as a tip, when you are discussing revisions deleted say "revdel'd content" or "hidden content" rather than "Deleted". We tend to think of deletion as actual page deletion, so I would have been confused too. Not your fault, but just a tip for going forward. On this point, while looking at hidden content can sometimes be useful, in the case of copyright violations, they are normally caught very quickly these days so if one page has it hidden as a copyvio, it is somewhat unlikely the other will have it. Not always the case, but usually not worth flagging down an admin for if the other evidence is compelling. If you're dealing with comparison of two pages both with copyvio content, it would probably be more worth it then to see if they're copying the same articles, etc.
Yes, I agree with your analysis of the diffs. Something that you'll also want to note there is that the edit summaries are very similar. If you aren't in the habit of looking at edit summaries when comparing accounts, I would suggest it. People rarely change up their shorthand between accounts, and while it isn't enough on its own to prove or disprove socking, it is a very strong indicator that with other evidence can justify a CU or a block if it is DUCKish enough. TonyBallioni (talk) 03:30, 24 March 2019 (UTC)

General comments: Very good work so far. You're systematic and cautious, which is good for an SPI clerk. The one significant piece of feedback I would also give is if the behaviour that you have available to you is overwhelming, don't feel the need to get an admin to analyze deleted content for you or even to go through every single edit of an account. There are cases where this will be necessary, and might take an hour or more to go through, but there are others that you can look at even without magic admin goggles and make the call based on what you have.

When you're new, being more cautious is good, but as you get more experience, you'll be able to use your judgement as to when it is best to get more evidence that you might not be able to see and take a longer time versus when it is best to block on cases with only a few diffs because the evidence is strong enough.

SPI is overwhelming an area of judgement calls, and we picked you to clerk because we trust your judgement. Be cautious, but don't be afraid to use that judgement . TonyBallioni (talk) 03:43, 24 March 2019 (UTC)

24 March 2019

Okay, now it is your turn to pick the cases. Find three cases that you want to work, use the training template to let people know that you're in training. Work the case and list it here. You can pick cases that are green for having CU run, yellow, for needing to be evaluated as to whether CU is needed, or the regular "open" cases. You can go ahead and work them without me telling you it is okay, just be sure to use the training template you created and list them here when you are done :) TonyBallioni (talk) 03:43, 24 March 2019 (UTC)

Wikipedia:Sockpuppet investigations/Shakira111
  • ShawRunRun created few days after the latest sock blocked.
  • ShawRunRun is active in same area as of master, even on zhwiki, which is odd for a new user.
  • The diff provided in report are almost identical.

Finally haven't requested a CU check because there's is strong behavior evidence and archive shows last CU checks haven't revealed much. ‐‐1997kB (talk) 11:31, 24 March 2019 (UTC)

  • Yeah, pretty much by the book here. Good work. TonyBallioni (talk) 04:01, 29 March 2019 (UTC)
Wikipedia:Sockpuppet investigations/Bhanwar singh vaish

Both the accounts were editing same area, but since master is blocked Jay prakash bais started editing same articles as of master with no edit summary and mobile only edits pattern. Convincing behaviour + CU check indicate that they are same person. Deferred for admin to action. ‐‐1997kB (talk) 14:31, 24 March 2019 (UTC)

  • I think you’re right that they’re the same person (I ended up blocking.) The one bit of feedback I’d give is that when requesting admin action, it’s best to recommend specific action rather than defer. If an admin disagrees with you, they’ll ping you or won’t act, but if you just leave it open ended, it may stay there a while unactioned. TonyBallioni (talk) 04:05, 29 March 2019 (UTC)
Wikipedia:Sockpuppet investigations/Farooqahmadbhat

Comapring Christ2019 with other socks in archive, it's pretty obvious to spot that all of them revolving around Kashmir related articles and specifically trying to get Jaan Nissar Lone published. Also it's very uncommon that new user asking CU about deletion who acted on that SPI.

Declined CU as previous checks haven't revealed anything helpful plus Bbb23's comment about technical data being unhelpful. ‐‐1997kB (talk) 02:26, 25 March 2019 (UTC)

  • Good call on declining CU, especially given the previous comments. Just as a general comment, I think you’ve done a really good job at picking out cases that are a good place to start SPI work. If you’re not comfortable with something, you can always just skip it. TonyBallioni (talk) 04:10, 29 March 2019 (UTC)
28 March 2019

All good. As a heads up, I’m going to be offline for most of the next few weeks because of some RL stuff, but I’ll follow this page and comment so as to keep your training going. Just won’t be around IRC as much. If you need something from me, best to ask here or via email. For today, two things:

  • Pick three more cases like above and do the same thing.
  • Can you describe the process of archiving a case and what you would look for?

Thanks. TonyBallioni (talk) 04:15, 29 March 2019 (UTC)

Wikipedia:Sockpuppet investigations/84101e40247

Their registration date and evidence provided in case were convincing that they could be same user. Since there was many new accounts involved with less behaviour evidence and case history shows there's a sleeper pattern too, so endorsed CU check. ‐‐1997kB (talk) 14:54, 4 April 2019 (UTC)

All sock tagged and closed the case.
I have a question about tagging here. As seen in case archive sometimes we tag and sometimes don't, how's that decided? ‐‐1997kB (talk) 10:49, 5 April 2019 (UTC)
Good call on endorsing because of the sleeper pattern.
On the tagging, it's a case-by-case thing. You'd need to ask @DoRD and Bbb23: why they didn't in this case. I personally don't tag when I come across a case where the technical evidence is less than clear who the original master is or where there may be other peculiarities in the technical details, but it is clear that there is a lot of socking going on (see Wikipedia:Sockpuppet investigations/Lascava/Archive for one like this). Other reasons accounts may not be tagged is for WP:DENY for LTAs. It really is up to the discretion of the blocking admin/CU and members of the clerk team. TonyBallioni (talk) 04:16, 8 April 2019 (UTC)
Sometimes I want everyone to stop tagging per DENY, but in this case I think it was because of the fact that there were two groups and my comment about proxies. I think I was a bit annoyed, not exactly the best reason for tagging/not tagging. --Bbb23 (talk) 10:21, 8 April 2019 (UTC)
There are a lot of times that I don't want socks tagged for the same reason: DENY. In this case, I wouldn't have recommended tagging the three accounts that I marked technically indistinguishable because I wasn't convinced that they belong to this master. They're all controlled by one person, and they were all being disruptive, but it's possible that they're someone else, hence no {{confirmed}} tag. —DoRD (talk)​ 12:01, 8 April 2019 (UTC)
Wikipedia:Sockpuppet investigations/Ah8007

From behaviour point of view Erin07 and Ah8007 looks same: mobile only editing, overlap of edits and perticularly these diff: 1, 2. But as Erin07 was registered on 1 March, and on that case last CU was on 1 April, I think they might be using proxy/VPN, so self endorsed CU. ‐‐1997kB (talk) 04:23, 7 April 2019 (UTC)

Given the history of sleepers here and the overlap, the self-endorse is a good call. While we can fairly easily see accounts on the same range that are obvious, it is possible for us to miss accounts or be conservative with reporting if there is not behavioural evidence. Cases like this where there are a large number of accounts and behaviour that indicates a connection are places where a second look in CU. TonyBallioni (talk) 04:36, 8 April 2019 (UTC)
Wikipedia:Sockpuppet investigations/Nickanisawesome

Looks like throw-away accounts. First on IP, then accounts, in any case this is obvious vandalism and should be reported at WP:AIV if resumes. Thus declined CU (Also CU won't connect IP to accounts) and closed the case. ‐‐1997kB (talk) 17:06, 10 April 2019 (UTC)

Yep. I agree. I didn't run a check either. My gut says this is high school students. SPI isn't bloodsport, so closing without action is what I would have done here. Also, if you could go through your criteria for when you would archive a case before we move on :) TonyBallioni (talk) 22:00, 10 April 2019 (UTC)
Process of archiving a case

Before archiving a case I will check:

  • Case has been closed or not. If closed..
  • All the alleged socks are either blocked or cleared.
  • Any instructions left by CU has been actioned or not. If not..
  • Implement those such as tagging, merging etc.
  • Then archive using that script you linked above. ‐‐1997kB (talk) 04:03, 11 April 2019 (UTC)
Good. I would add that in the rare case where you disagree with the action of a patrolling admin or of another clerk, talk to them about it/ping them. Archiving is supposed to be a second set of eyes. It will be pretty rare that you disagree, but it is something to keep in mind. It is also the reason that you shouldn't archive cases that you close.
Okay, so I think you have enough experience and we've walked through enough cases now that you can go ahead and start archiving cases and also working cases individually on your own. Please keep a record of any clerk action you do here by day like Cabayi has at User:Cabayi/Clerking. I'll go through them and comment if there is anything I see that could be improved on or that I think you should take a second look at. If you have any other questions, let me know by a post here, on my talk page, email, or via IRC. So long as you're a trainee clerk, still keep using the clerk at work template, and make a record of every case you work here.​ TonyBallioni (talk) 22:25, 11 April 2019 (UTC)
A word of caution in addition to TonyBallioni's advice - the script will archive all the cases on the page regardless of status. It was written in happier times when sockmasters had the decency to wait for one case to close before creating more puppets. I've raised it with TC - User talk:Timotheus Canens/Archives/2019/3#SPI-Archive. Happy clerking. Cabayi (talk) 07:56, 12 April 2019 (UTC)

April 2019[edit]

13 April 2019
14 April 2019
Sheffieldgraduate-Tigerson1995: Behaviourally both looks same person which is strongly confirmed with edit interaction, similar edit summary pattern and visual edit tag, thus requested block.
Mehuljindal18: Account is stale with not much to assess behaviourally thus blocking it doesn't make sense.
15 April 2019
16 April 2019
  1. Edit overlap (a): Although not very huge, but I figured this is because most of sock have deleted contribs, specially the page they created.
  2. Recreation of article (b) that was previously created by User_talk:Wiki3310.
  3. Edits in same area such as here and then nominating draft about same subject for deletion which was created by previous socks.
  4. Similiar edit summary pattern: c and d and that visual edit tag on most of edits.
  5. Similiar userboxes (e) and mentioning that they work as teacher: f and g.
  6. And at last removing social media marketer from userpage after SPI results, which also indicate that they are aware of SPI and after that for illusion they also created userpage on enwiki.
Taking all these evidence into account I'm requesting indef block for their socks. ‐‐1997kB (talk) 09:49, 17 April 2019 (UTC)
17 April 2019
18 April 2019
19 April 2019
  • Wikipedia:Sockpuppet investigations/InsideRecordings: Casepage moved to InsideRecordings and closed.
  • Wikipedia:Sockpuppet investigations/Bumashes: Multiple accounts appearing with similiar view, looks suspicious. Endorsed CU.
    • I closed this without action after reading DoRD's comment and looking over the edits. I don't necessarily think endorsing for CU was wrong here. There were similar patterns: usernames, outrange, etc. but in cases like this, the gut feel was much more of "angry people who heard of an insult to their profession on some online forum and came here all at once." than anything else. Developing a sense for sock vs. meat takes time, and using CU to sort it out is often useful, but in this case, since two of us agreed on behaviour that it was likely different people, I closed without action. TonyBallioni (talk) 02:17, 20 April 2019 (UTC)
      • Thanks for closing. Looking at Bumashes (a) and Bethany72 (b), I thought they are same person, although they appears to be on different device (on the basis of edit tag). But it also make sense that these could be bunch of people working in same profession. ‐‐1997kB (talk) 12:18, 20 April 2019 (UTC)
  • Wikipedia:Sockpuppet investigations/Truth gatekeeper: Closed.
  • Wikipedia:Sockpuppet investigations/WillPleasant123: Casepage moved to WillPleasant123. ‐‐1997kB (talk) 03:54, 21 April 2019 (UTC)
21 April 2019
25 April 2019
26 April 2019
27 April 2019
29 April 2019

May 2019[edit]

21 May 2019
31 May 2019

June 2019[edit]

6 June 2019
7 June 2019
8 June 2019
9 June 2019
10 June 2019
11 June 2019
12 June 2019
13 June 2019
22 June 2019

July 2019[edit]

5 July 2019
14 July 2019
15 July 2019
  • Closed: JMCT2018 - Protection to article would be nice here.
  • DeferredToAdmin: Conrailman4122 - same guy, requested another two months block on /21. ‐‐1997kB (talk) 15:46, 15 July 2019 (UTC)
19 July 2019
21 July 2019

August 2019[edit]

5 August 2019
21 August 2019
22 August 2019

September 2019[edit]

19 September 2019
  • DeferredToAdmin: Abhishek9779 - tags, edit summaries and area of interest points that its the same user. ‐‐1997kB (talk) 15:17, 25 October 2019 (UTC)

October 2019[edit]

17 October 2019
  • Closed: Dreerwin - Report moved to Dreerwin. ‐‐1997kB (talk) 15:17, 25 October 2019 (UTC)
27 October 2019

December 2019[edit]

23 December 2019
24 December 2019
  • Closed: ShaynDiamond - casepage moved to ShaynDiamond. closed.. ‐‐1997kB (talk) 09:54, 26 December 2019 (UTC)

January 2020[edit]

7 January 2020

February 2020[edit]

12 February 2020
13 February 2020
21 February 2020
25 February 2020
26 February 2020
29 February 2020

March 2020[edit]

2 March 2020
4 March 2020
9 March 2020
Note
  • After discussing with my trainer, from now on I will not list cases that I will archive. ‐‐1997kB (talk) 03:54, 10 March 2020 (UTC)
10 March 2020
Retrieved from "https://en.wikipedia.org/w/index.php?title=User:1997kB/Training&oldid=944900950"