This page in a nutshell: An obvious sockpuppet is obviously a sockpuppet.
There is no doubt these are socks
Yes, dear Wikipedians, an obvious sock is quite obvious. For instance: If Editor A is blocked for harassing Editor B and then a brand-new account, Editor C, comes along and mimics the harassing behaviour of blocked Editor A, then A and C are obviously the same user. This may also be called the DUH principle.
This also applies to plain vanilla vandalism. Long-term vandals often have their own "pet" articles that they like to target, so if Vandal B comes along and starts vandalizing some articles that are on Vandal A's pet article list in a similar manner to Vandal A, then you are relatively safe in assuming that they are the same user. The principle of "assume good faith" always applies, but assume good faith is not a suicide pact and bad behaviour should not be ignored. Sometimes it is quite right to call a spade a spade.