Wikipedia talk:Sockpuppet investigations

From Wikipedia, the free encyclopedia
  (Redirected from Wikipedia talk:SSP)
Jump to: navigation, search

How to find out why someone was blocked years ago?[edit]

I frequently see editors who were blocked a very long time ago by an admin who is also no longer active. Is there an easy way to see what evidence was presented at the time without making it into a PhD thesis? Ottawahitech (talk) 15:36, 8 February 2015 (UTC)

You can look at the block log and see what comments the administrator provided, which may contain links to the discussion, or discussion posted on the editor's talk page at the time. You could also search the archives of SPI, AN or ANI. In some cases administrators blocked without discussion, so you have to look at what the editor posted shortly before the block. Often years ago there was less documentation when editors were blocked. Why do you want to know? TFD (talk) 15:42, 8 February 2015 (UTC)
Thanks for the speedy reply, TFD. To answer your question: the reason I wanted to know today is user:Straightpress. Other times I am interested in looking up the history of other editors. For example when I was blocked back in 2012 other editors who tried to help me, ended up being blocked themselves. Ottawahitech (talk) 15:52, 8 February 2015 (UTC)
Generally, blocks placed years ago aren't terribly relevant to anything anymore. I suggest completely ignoring them. Martijn Hoekstra (talk) 15:46, 8 February 2015 (UTC)
Straightpress was blocked 9 November 2007 as a sockpuppet of Amorrow, based on checkuser, according to the user page revision history.[1] A search for Amorrow on the SPI page leads to Wikipedia:Sockpuppet investigations/NatchitochesLA/Archive (2010), where Amorrow is mentioned as a "serial sockpuppeteer." (However that is not very helpful.)
Amorrow was blocked 10 August 2005, and blocked from editing his own talk page 29 December 2009, according to his block page.[2] He was then banned by the Wikimedia Foundation and his page protected 17 January 2015. There are a lot of mentions of Amorrow at ANI.[3]
All the postings about Amorrow appear to be from 2005-2007, so it is not really relevant to today. I don't know why he would be banned this year, but you could ask the administrator.
TFD (talk) 16:56, 8 February 2015 (UTC)
That's a valid ban. You can contact me privately about it per email, or google can help you. Martijn Hoekstra (talk) 17:06, 8 February 2015 (UTC)

──────────────────────────────────────────────────────────────────────────────────────────────────── @Martijn Hoekstra: You said blocks placed years ago aren't terribly relevant to anything anymore but with all due respect, I disagree. There are reasons people want to dig into history, and everyone expects wikipedia to be transparent. I may want to find out what evidence was presented to block ,say, User:Telanian183. Others may be interested in researching User:Wik, and still others may want access to information so that statistics can be compiled.

In any case why is there no standard way to denote information about “sock puppets”. Why is it necessary to ask here and take up valuable time of admins? Ottawahitech (talk) 16:39, 22 February 2015 (UTC)

@Ottawahitech: That is because we don't want to give sockpuppeteers more recognition than they deserve. Read this: Wikipedia:Revert, block, ignore. Vanjagenije (talk) 17:49, 1 March 2015 (UTC)

Is the linking of off-wiki accounts considered Outing?[edit]

Per WP:OTHERSITES I would like to link a Twitter feed to a Wikipedia user account mentioned in an SPI. Would that be considered WP:OUTING? In the case I'm speaking about (go on and look through my edit history you nosy parkers) the username and the Twitter name are the same. -Thibbs (talk) 17:11, 16 February 2015 (UTC)

Unless the user has posted their twitter feed on-wiki, it would be a violation of WP:OUTING for you to post it. ​—DoRD (talk)​ 20:11, 18 February 2015 (UTC)
Thank you. This is in agreement with the comments of User:Kyohyi at the other board I posted to (here). It looks like email is the best option for private evidence like this. -Thibbs (talk) 21:20, 18 February 2015 (UTC)
The RfC on "should the policy extend harassment to include posting ANY other accounts on ANY other websites?" has been closed and states that posting of other accounts is sometimes allowed. Doc James (talk · contribs · email) 02:04, 25 February 2015 (UTC)

Is there any point in opening a SPI against someone who knows a lot about computer software?[edit]

My neighbor recently showed be how he can hack into a computer on the other side of the earth and make his Wikipedia edits appear to come from it. Is there any point in opening an SPI against a user who is knowledgeable about hacking, or are SPIs really just to catch average sockpuppetry? Gouncbeatduke (talk) 17:30, 22 February 2015 (UTC)

Feel free to open up a case. We look at more than just the technical information available. Also, if a checkuser were to look at their user logs there's a good chance they'll see that someone is using some sort of trick to fake their IP address. Mike VTalk 05:03, 23 February 2015 (UTC)
What Mike said. From a CU perspective sometimes trying to avoid detection is as obvious as if they hadn't avoided protection, and it only takes one mistake to be caught. Plus if I post a result stating that the accounts in question where using open proxies then admins/clerks looking into account will take the attempt to avoid detection into account. Callanecc (talkcontribslogs) 11:28, 23 February 2015 (UTC)
@Callanecc: I don't believe User:Gouncbeatduke was talking about the use of Open proxy, but then I might be mistaken. Ottawahitech (talk) 15:48, 23 February 2015 (UTC)

Replacing dead links with spam[edit]

This company is recommending a spam technique that involves replacing dead links with spam links.

There is a user on Elance that is working for this company. They appear to be using hundreds of socks and claim to have made thousands of edits.

This user is editing in that fashion User:Bobkarlz. These are other accounts that have been picked up Wikipedia:WikiProject_Spam/Dead_link_spamming

Would a check user on these accounts potential help us find the sock master? Doc James (talk · contribs · email) 08:57, 25 February 2015 (UTC)

Special:Contributions/Bobkarlz seems to have been searching for dead links then replacing them with spam links. That website says that it has a business model doing this. It is sad that someone would make a business model by attacking Wikipedia with spam. Blue Rasberry (talk) 20:08, 25 February 2015 (UTC)
Yes there are a few businesses that are doing this. Doc James (talk · contribs · email) 00:49, 26 February 2015 (UTC)
Another new one has appeared. Reported to SPI [4] Doc James (talk · contribs · email) 02:13, 26 February 2015 (UTC)
@Doc James: CU is unlikely to be much use with these accounts, as you've discovered in that case. It's possible that they're socks and whoever it is very adept at evading detection by technical means (which is not as simple as merely changing your IP address with each edit, and is very difficult to do consistently over multiple accounts without an overlap between them); Occum's razor suggests it's more likely that they're meatpuppets or completely unrelated people who took a work-from-home job. Probably best not to put too much thought into it and just block, revert, ignore. And it's worth blacklisting the domains/URIs being used, especially if more than one account links to the same domain. HJ Mitchell | Penny for your thoughts? 18:07, 28 February 2015 (UTC)
Yes we likely need better detection methods for specifically this type of edit if these are meatpuppets rather than sockpuppets. Doc James (talk · contribs · email) 18:48, 28 February 2015 (UTC)
Blacklisting is a good idea, I found an account doing this a few days ago, must go back through my contributions and see about doing that. Sorry for the accidental revert, I was on my iPad trying to look at the talk page, not sure how that happened. Dougweller (talk) 19:21, 28 February 2015 (UTC)
James, there was some talk of an edit filter at WT:EF. I don't know if it went anywhere. I've blacklisted the two domains used by your latest two. HJ Mitchell | Penny for your thoughts? 20:15, 28 February 2015 (UTC)
Thanks Doc James (talk · contribs · email) 01:41, 1 March 2015 (UTC)

Launching an investigation into a sock if the puppetmaster's case has already been archived[edit]

I have a third user who I believe is a sock of a puppetmaster whose case is already archived following the investigation into the previous two socks. How do I proceed? Do I launch an investigation into the original puppetmaster again? Thanks, Dismas|(talk) 17:46, 28 February 2015 (UTC)

Jut file a new report under the master's name. This happens a lot, especially with prolific sockpuppeteers. HJ Mitchell | Penny for your thoughts? 17:50, 28 February 2015 (UTC)
Great! Thanks! Dismas|(talk) 00:38, 1 March 2015 (UTC)

Tagging question 1[edit]

If a checkuser spontaneously blocks a named account as a sock, with no SPI and no other discussion at all, should the blocked account be tagged as "confirmed" or as "suspected"? (talk) 21:21, 1 March 2015 (UTC)

Tagging question 2[edit]

If a non-checkuser administrator spontaneously blocks a named account and tags it as "confirmed" when there has been no SPI and no checkuser involvement, what can be done to get the tag corrected to "suspected"? (talk) 21:38, 1 March 2015 (UTC)