@Mz7: I think there is a problem with the way bot sorts the cases in the table. If there are several ongoing investigations on the same casepage at the same time, and some of them are open and some are closed (example: 1), the bot sorts that page as "closed". This is problematic. The "open" (or any other status) should override the "close" status. Vanjagenije(talk)18:01, 8 November 2023 (UTC)
@Vanjagenije: The diff you linked is from 22:20, 6 November 2023. Here is the SPI case table shortly after that: [1]. As you can see, Wikipedia:Sockpuppet investigations/AndresHerutJaim appears three times in the case table under these sections: "CUrequest", "clerk", and "close".
The logic for this is actually somewhat complicated. It is based on Dreamy Jazz's suggestion from this discussion back in May 2021. Originally, when Amalthea's bot was the one updating the table, SPI cases would appear only once in the table, and there was probably some kind of hierarchy that decided which one takes priority. We decided that there are certain times where we want to have a case appear multiple times in the table, but we didn't want to just throw all of the statuses on the table, lest it grow too long.
Nowadays, a case may appear multiple times in the SPI case list based on the following logic:
Category 1: if a case has one of these statuses, then it will always appear in the table under that status:
clerk, admin, checked, close
Category 2: if a case has one of these statuses, then one of them will always appear in the table (listed in order of decreasing precedence, where ">" means that the left status has higher priority over the right one):
inprogress > endorsed > relist > CUrequest
Category 3: all other statuses will only appear once if no other status is present (listed in order of decreasing precedence):
open > cudeclined > declined > moreinfo > cuhold > hold
In the case of the AndresHerutJaim SPI, it appeared 3 times under "CUrequest", "clerk", and "close" because "clerk" and "close" are both Category 1 statuses, and "CUrequest" is in Category 2. The "open" and "moreinfo" statuses are hidden because they are in Category 3: they would only be shown if no other status is in the table already.
The rationale for having "close" always appear (i.e. Category 1) was that sometimes if a sockmaster is very prolific, there will often be a case open for that sockmaster, and if "close" gets hidden by any active case, then for those sockmasters, a backlog of closed, waiting-to-be-archived cases starts to pile up.
Spicy, thanks very much, that's great, cheers! (Now no one is beyond my reach, bwahahahah!)[FBDB] By the way, do you how does it defines 'recent'? Appreciated, ——Serial18:36, 15 November 2023 (UTC)
"This tool lists people who have edited recently, made over 10,000 edits in total, and not opted out." So, only checkusers who have actually edited recently (so, not dealing with UTRS, not just paying attention to Wikipedia while doing an AI course, etc.) --Yamla (talk) 18:46, 15 November 2023 (UTC)
Hello! I have sent an email to get ip block exemption several days ago but get no response so far. Please process my request as soon as possible. Thanks! Whisper of the heart05:21, 20 November 2023 (UTC)
What I mean is that I don't have access to the email queue, so it's probably still sat there waiting for someone to read it. -- zzuuzz(talk)10:35, 21 November 2023 (UTC)
I have filed a few SPI reports lately all related to film-related topics from a UPE company. On all pages where the socks have edited, there is an IP range that also edits and then comes back for more editing once the original socks are blocked. Is there a way to block that specific range as part of an SPI investigation? CNMall41 (talk) 20:31, 5 December 2023 (UTC)
It's certainly possible. But the admin and/or CU who handles the case will look at what else is happening on that range. If all of the traffic on that range is disruptive, it's a no-brainer to block it. But more often, there's other, legitimate, activity happening on that range. If you block the IP range, you also impact that other traffic. That's what we call collateral damage. It's often a murky situation which requires a judgement call on whether cutting off the sock justifies the collateral cost. If there's a small set of pages that are being affected, page protection may be a better tool in a particular case. RoySmith(talk)21:27, 5 December 2023 (UTC)
Thanks. So, without seeing what a CU sees, I should just mention in the SPI and allow them to make a decision based on overall traffic from the IP correct? And, if it doesn't warrant an IP block due to too much collateral damage, request WP:SEMI for the specific pages. Hopefully I understood you correctly. --CNMall41 (talk) 21:57, 5 December 2023 (UTC)
It doesn't hurt to list the IP range in your SPI filing, but to be honest, when I'm working a case as a CU, I go on what I can see in the CU tool and don't pay much attention to anything else :-) RoySmith(talk)22:02, 5 December 2023 (UTC)
Understood. And, I am sure you would get thousands of results on a CU from an IP range so that would be difficult. I think I will still note them in the SPI filings so I have a history in the event I request an IP range block or page protection. Will have something to point to at least so admins reviewing the block request have something more to refer to. Thanks for the guidance. --CNMall41 (talk) 22:15, 5 December 2023 (UTC)
@RoySmith:, Here is just a small snapshot of the rabbit hole I have been in the past few weeks. Note that you can go to pages one IP edited, find a similar IP in that range in the edit history, and follow those contributions to other pages edited by now blocked/banned sock. I could make a new list daily and never find the bottom of the pit. --CNMall41 (talk) 08:37, 6 December 2023 (UTC)
SPI was filed but I know they are behind. Wondering if there is a way to get these confirmed as DUCKs (based on this) so we can clean up pages in the meantime. Clearly this is the blocked user as Gunjal was deleted a day before they recreated it and 6 days before another IP in the same range removed the paid editing tag. --CNMall41 (talk) 22:14, 13 December 2023 (UTC)
I hate to push as I know SPI is pretty busy; however, was hoping someone can take a look at this. The SOCK is still creating drafts and articles through IP address. --CNMall41 (talk) 18:49, 18 December 2023 (UTC)
I'll add that using one of the automated tools such as the "How to open an investigation" form on the WP:SPI page, or something like WP:TWINKLE are strongly preferred to manually editing the SPI case page. The formatting is complex and manual editing is likely to get it wrong, creating extra work for a clerk who has to fix it up. RoySmith(talk)17:14, 26 December 2023 (UTC)
Are these sockpuppets?
I don't have any experience investigating sockpuppets, so here's some evidence for someone to decide if these IPs are sockpuppets.
They all edited the same page over and over again, writing the same thing with the same edit summaries.
111.125.87.162
110.54.145.161
110.54.134.16
110.54.150.89
209.35.161.36
110.54.134.151 JohnLaurensAnthonyRamos333 (correct me if I'm wrong) 06:42, 28 December 2023 (UTC)
Not a concept that applies easily to IPs, which can simply be dynamic, but the correct route here was the listing on RfPP, hopefully the page gets protected soon. CMD (talk) 06:53, 28 December 2023 (UTC)
They might be meatpuppets. SPI is for disruptive sockpuppetry but not obvious vandalism. If it's obvious vandalism and ongoing, they should be directly reported to AIV (optionally after warnings). In this case, yes, with so many IPs, RFPP is the correct way to go.--94rainTalk07:07, 28 December 2023 (UTC)
Open SPI (hidden)
A new open SPI (you need to scroll to the bottom of the page to notice it) is shown as CU completed on the main page. Is that how it's meant to be shown until the other is closed and if so, how are the CUs supposed to notice it? Thanks. M.Bitton (talk) 17:30, 25 January 2024 (UTC)
Hmmm, I'm guessing there's something wrong with the page formatting then. I took a look but didn't see anything; maybe somebody with sharper eyes will catch the problem. RoySmith(talk)17:49, 25 January 2024 (UTC)
Don't have an account, but have something to report…
It's not dormant, per se – it was created seconds after the most recent sock was blocked. I was looking at the user creation log and saw it appear and, well, obvious sock is obvious. Hasn't edited, but assume it's been caught in an autoblock (I don't think there's a way for unregistered users like me to see that). 2A00:23C5:50E8:EE01:9DA7:D1AF:1C91:3847 (talk) 21:37, 27 January 2024 (UTC)
I've checked and blocked, thanks. I'm not a huge fan of pro forma cases for vandalsocks because they tend to lead to reporters going to the wrong venue as well as DENY issues, so I'd probably suggest just linking to a past sock in the AIV report. Also noting that I slightly reformatted the initial comment – {{vandal}} -> {{checkuser}} – simply for convenience reasons. I hope that's alright. --Blablubbs (talk) 23:02, 27 January 2024 (UTC)
SPI is perpetually backlogged and could especially use help from administrators. Admins don't need to have any prior experience with SPI to action cases, but many seem to find it intimidating. In the interest of encouraging more admins to contribute, I've tried my hand at writing an informal guide that is more accessible than the instructions on the main SPI page: User:Spicy/SPI quick guide. Let me know if this is helpful (or not). Thanks, Spicy (talk) 23:25, 27 January 2024 (UTC)
Might be good to post to AN. I think it's a pretty good guide; I think one of the intimidating things about SPI is it's not clear what you can or cannot do without getting yelled at, so it's nice to have that up front. Galobtter (talk) 07:07, 28 January 2024 (UTC)
Recently the subject of a WP:NOTHERE block, claims to have done "many small edits" and "wrote an entire page". Checking global contribution I find not that many edits and no articles created. They appear to indicate they have a sockpuppet account but have no idea what it is. Can you make an SPI report on that basis? WCMemail14:49, 29 January 2024 (UTC)
This sounds like it would be WP:NOTFISHING. More to the point, there's legitimate reasons somebody might have had another account earlier, i.e. WP:CLEANSTART. And they said they wrote an entire page in a different language, which I assume means on another wikipedia project, which would not be socking. In short, I don't think there's anytihng to do here. RoySmith(talk)16:05, 29 January 2024 (UTC)
Due to the user's main interests (Indonesian football, very clear once you check the first page of their contributions), i am almost 100% sure this is a sockpuppet of the original User:Dwinug.
I realize CU's are busy but was wondering if anyone can look at this for a quick DUCK block while waiting a CU. Pretty obvious IMHO. CNMall41 (talk) 21:42, 6 February 2024 (UTC)
SPI move needed
In Wikipedia:Sockpuppet investigations/Rao And Sapru/Archive, I listed a number of accounts that were confirmed to each other and noted the master of those accounts, then marked the SPI as checked so that a closing admin/clerk could review the evidence and, I assumed, move the page or split it off to reflect Achujabal as the master. It was closed and archived by Izno without any changes being made. Can someone fix this please?-- Ponyobons mots22:36, 20 February 2024 (UTC)
Please see [2], User:BigWarren5 states having had a previous account on which they were indef blocked. It is unclear if this occurred on en.wiki or at simple. Not sure how to really proceed with this, especially not knowing who might be the main. ☾Loriendrew☽☏(ring-ring)23:27, 28 February 2024 (UTC)
Process question about socks blocked before an SPI was filed
When a sock is blocked before an SPI report is made, does a notice automatically get logged somehow and eventually added to the reports and/or archives? I came here to read up on SwissArmyGuy (talk·contribs) and learn their pattern, because of a CU block on User:Ferretivo (by Ferret; thanks for that!). Am I just too quick off the blocks (er, no pun intended) and need to be patient, or do I need to look in logs or somewhere else for the full picture? I guess I'm asking if the Archives eventually contain everything, or only actual reports that have been filed; how do I learn about other socks for which no report was filed because an alert admin got there first? P.S. I am subscribed. Mathglot (talk) 19:41, 16 March 2024 (UTC)
@Mathglot SPIs are not required for admins to perform sockpuppet blocks or checkuser blocks. Strictly speaking, not even tagging is required, though I almost always do. The category populated by the sockpuppet tags is almost always more complete than the SPI archives. -- ferret (talk) 19:43, 16 March 2024 (UTC)
The tables on the main page are lengthy and challenging to scroll through looking for a specific case. Could you clear out older cases so that the tables only contain cases that haven't been reviewed yet or ones that were closed within the past two weeks? It looks like there has been a big push to catch up on older, open SPI cases and I applaud all Checkusers, SPI clerks and admins who help out for taking care of them. It would be nice though if Wikipedia:Sockpuppet investigations oage just contained recent cases and ones that still have to be investigated or archived. Probably a bot takes care of all this but maybe its settings need to be tweaked. Thanks again for all that you do for the project. LizRead!Talk!01:31, 31 March 2024 (UTC)
Archiving is not done by bot, but manually; that's an intentional choice to ensure that every case has been looked over by at least two people and at least one member of the SPI team. The archiving process usually entails a cursory look at the closed case (e.g. to ensure everyone who is supposed to be blocked and tagged actually is blocked and tagged correctly), but can also take substantially more time if a case is more complex or requires more in-depth review. At least for me personally, it tends to not be a priority task at times where we're significantly backlogged (speaking of which, thank you Spicy for doing so much work, and sorry I've been slacking lately Ü). --Blablubbs (talk) 10:34, 1 April 2024 (UTC)
Master known for random changes to demographic stats
I seem to have reached the limits of my ability to remember, for a given pattern of vandalism, which user I've seen previously performing the same types of edit. In this case I'm looking at a user, Trinity337777, who changes random digits in infobox demographic statistics. That the edits aren't constructive updates is clear because many consist of altering digits to the left of the decimal point while the fractional part is magically unchanged. I'm looking to report the user but can't think of who the predecessor was. Does this ring a bell for anyone? I checked WP:LTA, not there. Largoplazo (talk) 12:11, 31 March 2024 (UTC)
Initially, I wasn't familiar with the Cordelia Hasanah account until Ariandi Lie mentioned it in relation to a sockpuppet investigation on id.wiki. Upon digging deeper, I noticed that both accounts share a strong interest in Indonesian biographies. While their early edits focused on old Indonesian actresses/celebrities, which didn't seem directly connected, they later shifted to editing articles about the Zakaria family from Bengkalis Regency, a non-notable family in Indonesia. These edits, particularly about the Zakaria family, link the two sock accounts.
Cordelia Hasanah and Asphonixm, along with their associated socks, have been active across en.wiki, id.wiki, and Commons. While their edits on en.wiki may not seem connected at first glance, a closer look at their contributions on Commons reveals similar editing patterns, especially when it comes to the Zakaria family. For example, Marissa Lavigna, confirmed as a sock of Cordelia Hasanah by CU on en.wiki, uploaded files related to the ancestors of the Zakaria family on Commons. This behavior is the same as Asphonixm's, as he also engages in similar activities. This indicates a connection between these accounts.
I kindly request other SPI team to investigate this situation further. Your input and expertise would be greatly appreciated in resolving this matter. Ckfasdf (talk) 14:15, 5 April 2024 (UTC)
Logged out socking
What can be done about WP:LOUTSOCKing? I have seen an uptick in IP addresses editing drafts and creating articles of previous socks in an attempt to avoid detection. One that just caught my attention is Draft:Syedhwan which was edited by IP 29.205.115.53 and then a follow-up edit reverting the first. The second edit is from an Android device which is the same as the sock who created the draft. Almost as if they are testing different devices to see what their edit summaries say. I believe this because their operating systems have been called out continuously in the sock investigations. CNMall41 (talk) 06:33, 6 April 2024 (UTC)
Thanks for the link. I do understand the IP situation but it sounds like you are saying the we block accounts, not the people behind them. If that is the case, then a SOCK can get blocked and then come back and edit freely from an IP is that correct?--CNMall41 (talk) 20:19, 7 April 2024 (UTC)
Okay. I re-read what I wrote and probably should clarify that the IP addresses editing the drafts are obvious socks who are LOUTSOCKING. So it isn't just others editing from random IPs. It is the SOCK or a member of that SOCK farm doing the editing. I can tell as when a sock is blocked, the same IP will then come and edit numerous articles or drafts of the sock that was banned. Similar editing pattern. How do we deal with that through SPI? I know that CUs are not allowed to connect accounts to IPs so not sure how to handle it. --CNMall41 (talk) 03:42, 8 April 2024 (UTC)
Indeed. I just sock reverted hundreds of IP edits and blocked the IPv6/64 range. I don't think there's much more we can do than range block and revert. - UtherSRG(talk)10:44, 8 April 2024 (UTC)
How would you suggest I report them? Should I file an SPI under the master and just list the IPs? I hate to waste anyone's time but the persistent UPE is causing issues. --CNMall41 (talk) 19:07, 8 April 2024 (UTC)
Hate to ask to jump to the top of the queue but these sock are creating a lot of work that will need cleanup. Filed this SPI the other day and see they are definitely working with that farm (along with the many IPs editing right after creation). Yesterday user created Maya: The Love which was G5 earlier this year from the sock farm. The other long list of evidence is on the SPI page. CNMall41 (talk) 02:27, 14 April 2024 (UTC)
Well, I am disheartened myself over the backlog at SPI. It would be nice if the socks/master I did an SPI on would get handled but that is less of a problem than the older SPIs. I filed on April 13th but there are others over a month old...like these two - March 14th and March 16th. Those filers have been waiting for resolution a much longer time than you or I... Shearonink (talk) 15:00, 22 April 2024 (UTC)
I understand. Trust me. I also understand its a daunting task for admins and CUs and takes away from their enjoyment of editing topics they want to. Kind of hard to find a balance sometimes. --CNMall41 (talk) 23:52, 22 April 2024 (UTC)
Backlog
I can't myself quite fully decipher the Project page for this but how old is the oldest SPI request in the present backlog? The oldest CU request I could find was dated March 28th (for Elyelm) and then there's a clutch of un-CUed SPIs starting on April 9th... I haven't filed an SPI in ages and have one waiting but was just wondering how long the process might take. Thanks, Shearonink (talk) 16:51, 17 April 2024 (UTC)
There's a big table at WP:SPI#Cases currently listed at SPI which is sortable by each column by clicking on the column heading. For your purposes, you probably want "Filed at (UTC)", from which I can see that the oldest case that's still open is Wikipedia:Sockpuppet investigations/Cricket Butterfly which is about 2-1/2 months old at this point. Note that cases (such as this one) may show up multiple times in the table if there's multiple reports from different days.
SPI is chronically backlogged. Too many socks, not enough people working on processing cases. I worked a lot of SPI cases for a couple of years, but at this point I'm largely burned out on that and have moved on to other things, which is a pretty common story with sock hunters. RoySmith(talk)15:13, 22 April 2024 (UTC)
I understand the burnout, on a lesser level than admins of course but I think any long-time editors who engage on a regular basis in any particular area around here get burned-out on vandal-fighting or draft-reviews or whatever. It just almost seems that this noticeboard has ceased functioning in a reliable fashion. If Wikipedia in general has to wait for 2.5 months for action to be taken on some SPIs then we are in effect saying "Have at it! Sock away! No repercussions for you." I am sorry about the burnout, I am glad you haven't given up entirely. Shearonink (talk) 17:29, 22 April 2024 (UTC)
I try to work through at least a few cases each time I'm on here but the burnout is real. One probably quick thing that will help with the backlog is for checkusers to go through the cases marked "checked" and see if there's actually anything left to do, and either do those things or close the report. I've run through quite a few lately that are left "checked" with nothing to do, and those ones just sit in the queue forever. Ivanvector (Talk/Edits) 18:08, 22 April 2024 (UTC)
Visually that would help. I just look at the sheer size of the overall page and think "Abandon hope all ye who enter here"... - Shearonink (talk) 18:45, 22 April 2024 (UTC)
I tried to knock down the backlog a bit last Thursday and Friday, but have never seen such a dearth of Clerks available to help out. I've been waiting for weeks for a case to be split and the oldest CU-request cases really need Clerk review due to the amount of evidence presented. I've been trying to do all of the blocking, tagging and such myself on the cases I've handled to help take some of the burden off the Clerks, but the situation is the worst I've seen.-- Ponyobons mots19:38, 22 April 2024 (UTC)
Oh good it's not just me then...makes me feel somewhat better. How many SPI Clerks are there? Are we somehow down in the numbers at the moment? - Shearonink (talk) 19:42, 22 April 2024 (UTC)
Also, IMO, some of the clerks listed as "active" should be moved to temporarily inactive at least as they haven't even edited Wikipedia in six months or more, let alone clerked.--Bbb23 (talk) 22:02, 22 April 2024 (UTC)
List of SPI Clerks & their latest edits to SPI (numbered from Ponyo's list mentioned above & deliberately not mentioning usernames)
1st - April 2024
2nd - October 2023
3rd - September 2023
4th - sometime in 2022?...
5th - March 26
6th - August 2023
7th - April 2024
8th - January 2024
9th - December 2023
10th - December 2023
11th - April 2024
Plus the 4 "Temporarily inactive clerks"
So it looks like that's 4 SPI Clerks who have edited in this sphere within the past month or so?... This pattern does not seem sustainable. Does anyone think SPI is actually working at its optimal best? Is it possible that SPI might be broken or at least limping badly? I mean really - why should any of us file SPIs if filings are going to languish in limbo? I'm kind of feeling like maybe it would be best to just withdraw my latest SPI and not bother to file another one. Shearonink (talk) 01:53, 23 April 2024 (UTC)
@Shearonink If you want to withdraw your SPI, that's your prerogative. But might I suggest that a more productive course of action would be lending a hand to help with the backlog? RoySmith(talk)15:59, 23 April 2024 (UTC)
If I had time and my life outside WP weren't so stressful right now I might consider it but I cannot take any more responsibilities at this time. Something would have to give and it would probably be me. Shearonink (talk) 18:13, 23 April 2024 (UTC)
There's an editor request to join clerkship pending since two months ago. Maybe no one has done anything about it because there has been no participation and therefore no consensus. But might I suggest that in that case or any other, the process is not working? Nowhere else does it take that long to answer a volunteer application on this project. — Usedtobecool☎️16:22, 23 April 2024 (UTC)
One need not be a clerk to help at SPI. A really useful thing that anybody can do is to grab an old case, dig through the edit histories, and provide a clear summary of the similarities and differences. Cases that have been sitting in the queue for a long time are usually the ones that are difficult to understand, so this type of curation/summarization is very helpful to getting them off the docket. RoySmith(talk)17:45, 23 April 2024 (UTC)
You mean something like this which in my opinion is clear case for DUCK? I can provide 100 more examples of how they are connected but seems like it would just clutter up the filing even more. --CNMall41 (talk) 19:28, 23 April 2024 (UTC)
I must admit, I don't quite get why the separation of SPI roles as detailed at WP:SPI/PROC is quite so prescriptive; for example, why can't administrators perform clerking duties like archiving closed cases, of which there are more than 150 currently listed at WP:SPI? ~~ AirshipJungleman29 (talk) 22:54, 23 April 2024 (UTC)
Admins can do most of the things that actually matter at SPI. It does not really matter if a closed case sits on the page for a while before being archived, but it might matter if an admin who is inexperienced with SPI failed to realize that an account that should have been blocked was not, that global locks were not requested, that a case was filed under the wrong name, etc. I'd encourage any admins who are concerned about the backlog to read User:Spicy/SPI_admin_guide and consider helping out. Spicy (talk) 11:46, 24 April 2024 (UTC)
Is there a way to help with the backlog without becoming an admin?
The truth is that I don't really know that an adminship would be a great idea in my case. I tend to edit in a lot of contentious topic areas and I've seen the sorts of arguments that arise when an admin is WP:INVOLVED and does so much as put up a template warning on another editor's page. That seems like a headache I'd rather avoid. However I sincerely want to help with the backlog. Are there roles that I could serve that would be helpful moving things forward that don't require a sysop? Simonm223 (talk) 16:41, 7 May 2024 (UTC)
I hate to sound bitter, but frankly I am. What do I need to do at this point? I will beg if need be but this is one where behavioral evidence alone ties these accounts together, is almost 30 days old, and the accounts are still active and creating pages. Despite asking here in a thread that auto-archived and here at ANI, I cannot seem to get anyone to look. I get it. There is a backlog, but there are many other SPIs that have been looked at before this. Is it something to do with how it was filed? Is it me? CNMall41 (talk) 18:33, 7 May 2024 (UTC)
I'm neither a CU nor a clerk, but, tbh, you're one of the pushiest filers I've seen. If I were a CU or a clerk, that would make it less likely that I would review your filing.--Bbb23 (talk) 23:01, 7 May 2024 (UTC)
Thanks. Actual feedback that helps. Can you give me some examples as I obviously don't have the self-awareness of that?--CNMall41 (talk) 23:18, 7 May 2024 (UTC)
Got it. I did those when the socks were becoming disruptive but I see the point. I'm just gonna pull away from film related pages for a while as it is getting me to the point of Wikistress. Likely take a few days off to recuperate.--CNMall41 (talk) 00:21, 8 May 2024 (UTC)
Whatever is best for you, but don't let my comments discourage you from editing generally or editing at SPI. AFAICT, you do a lot of very good work. I find that sometimes the more time we spend on a particular issue the more we get invested, which can sometimes lead to frustration and a loss of perspective. We are human after all, although the jury is out whether I am. :-) --Bbb23 (talk) 00:36, 8 May 2024 (UTC)
Actually, your comments are fine. I would rather have someone say it straight than leave me sit to wonder why (and get bitter about it). Believe me, taking a break isn't a grandstanding thing as it isn't going to affect a single thing that happens on Wikipedia and frankly that's not me to do something like that. Maybe just a couple days to reflect before I wind up crossing a line with a policy or guideline. The feedback was truly appreciated. --CNMall41 (talk) 00:53, 8 May 2024 (UTC)
Potential sockpuppetry across Wikipedia editions
Earlier today a user requested on my talk page that I review their draft of an article about an Italian company. In checking to see if the company had articles on other editions of Wikipedia, I noticed that the Italian article was deleted five days ago for LTA evasion. Given the timing, it would appear this might be a case of sockpuppetry, but does the policy apply to users on different editions of Wikipedia? -CoolieCoolster (talk) 02:43, 15 May 2024 (UTC)
Hey @CoolieCoolster, if sockpuppetry and other problems that led to their block there are also present in the English Wikipedia, you may file a report here and also report them at Meta for cross-wiki abuse. Aintabli (talk) 14:34, 22 May 2024 (UTC)
Fixed. Interesting, looks like it is because you wrote [[WP:DUCK]. When I added in the missing right square bracket, then it worked. Not sure why that typo should cause the template substitution to fail. Mz7 (talk) 06:57, 26 May 2024 (UTC)
I don't know if this is the right place to ask this, but do we have an "IP hopping" policy on Wikipedia? I know we have our Sockpuppetry policy, but how about IP hoppers who are NOT abusively editing?
Twenty edits from 5 different IP addresses give the IMPRESSION of five editors (consensus), but when looking at timing of edits it becomes apparent that it is the same editor. In this case the IP(s) has NOT edited abusively (never implied that they were different or colluded in any way).
IP addresses can hop automatically completely out of the control of the user. This is common enough that I suspect most editors would not take away the impression that a number of IP addresses are five different editors, especially as changed IP addresses often still share a large number of digits and thus appear visually similar. CMD (talk) 05:47, 25 June 2024 (UTC)
Unless one is paying for a fixed IP address, the address is dynamic, assigned by whichever network is supplying the device's Internet service at a given moment. Even a desktop computer user's IP address is likely to change, at least on occasion, such as when the computer restarts. For a mobile user it happens all the time: arrive at home, when the connection switches from phone system to wi-fi (the home Internet service is drawing from a different pool of addresses from the phone service); then leave, drive to a cafe and connect to their wi-fi. Switch, switch, switch. I don't know what happens as one's connection jumps from one cell tower to another but I'm supposing the IP switches at least from zone to zone. Largoplazo (talk) 12:17, 25 June 2024 (UTC)
I'm sorry, I didn't explain my question well enough. I fully understand what you both mean (I previously worked in computers/systems administration and understand IP's and allocation and dynamic/static IPs and routing quite well.)
How about when it APPEARS that someone is using a service which INTENTIONALLY hops to VASTLY different IPs. I am not familiar with Tor (network) 's behavior and whether users can specify to choose vary their exit nodes on a timed basis.
Specifically, edits here [3] starting at 2024-05-30T14:06:59 forward seem to be all by the same editor, but with geo-locations varying from Florida to California to Michigan...with times of 20 minutes or less between locations. ---Avatar317(talk)21:03, 25 June 2024 (UTC)
Bottom line, we don't have a policy about IP hopping because, in the vast majority of cases, it is completely out of the control of the editor. Most individuals have no idea if, or when, their IP address changes. If one is using a mobile IP address (very commonplace, around 1/3 of all edits), it's commonplace for every edit, no matter the time between them, to have a different IP. The question that would be appropriate here is "is this specific user, in this specific case, possibly using some sort of proxy?" It is only really relevant if the edits are of a problematic nature. Are they? There are too many IP editors involved in this article, making a big range of changes, to think they're a single person; more likely, this case has been the subject of some sort of recent media report/social media campaign and many people are putting in their two cents. Risker (talk) 21:17, 25 June 2024 (UTC)
IP editing is permitted, thus we have to accept that the IP used can change.
IP hopping in order to present the impression of a false consensus becomes an abuse. But it does so when deliberately presented as being different editors, not just from use of the IPs.
Multiple IPs may take part in a discussion, and readers should be careful to not judge them automatically as being multiple editors (i.e. tending to a consensus). If this reduces the weight of an IP in a debate, then so be it - they're welcome to create an account instead. Andy Dingley (talk) 21:36, 25 June 2024 (UTC)
This can be closed with no further action, as the accounts have been blocked already. I know SPI is forever backlogged, so closing this will mean one fewer case listed as active. Thanks. Trainsandotherthings (talk) 13:21, 4 July 2024 (UTC)
Is there a way to withdraw an investigation
Recently I started an investigation, but I'm realizing now that there might not be enough evidence and that I kind of screwed up, is there a way to withdraw an investigation. Gaismagorm (talk) 20:15, 31 July 2024 (UTC)
I am not sure you should..... there is no overlapping edits yet considering one account only has five edits. But after looking here...... It does seem a bit odd.... with a master account unlocked and a sub account blocked thus far. Moxy🍁 20:38, 31 July 2024 (UTC)
Is there a preferred way to link en.wiki and Commons SPIs?
@The Squirrel Conspiracy: I don't think there is a preferred way. We already have the |crosswiki= flag set to yes in the {{SPIarchive notice}} template on Wikipedia:Sockpuppet investigations/YilevBot, which informs SPI folks to consider reporting results on Meta so that socks can be globally locked. I suspect that's probably sufficient, but if you think it would be helpful to note the Commons SPI, maybe you could add an {{mbox}} or something on the archive page. Mz7 (talk) 07:28, 4 August 2024 (UTC)
Also, be aware that each project has their own governance and policies about socking. So while it can sometimes be useful to cross-reference investigations on other projects, it's also something that needs to be done with care. RoySmith(talk)14:24, 5 August 2024 (UTC)
See Special:Diff/1240169372. A user placed text on this talk page and talks about sockpuppets of someone. The user also seems to self-identify as a sockpuppet of an unnamed user (If you still want to report my Idd.. in spI it's okay). Maybe something should be done with this information. --Stefan2 (talk) 15:35, 14 August 2024 (UTC)
There is often an extensive backlog at SPI that can result in reports going unreviewed for months. For the most active socks, this can give them time to make thousands more edits and thus be significantly more disruptive.
Would clerks and check users be interested in prioritising such editors?
If they are, it might be helpful to include a column containing the number of edits made in the past 60 days - the easiest way to do this would probably to update Mz7s bot, but if that isn’t an option for whatever reason we could just add an additional column that I could create a bot to fill. BilledMammal (talk) 01:08, 27 August 2024 (UTC)
If CU's and clerks want a different metric I'm happy to try and make it work - just let me know what you would like to see and we can try it out. BilledMammal (talk) 10:35, 31 August 2024 (UTC)
The SPI table task is already relatively expensive, taking around a minute to go through all the SPI cases and pull the information it needs to construct the table. My first concern is that pulling the edit counts of all socks across all SPIs might be a heavy operation that would worsen the already suboptimal performance of the bot. I also don’t think it needs to be done every 10 minutes, which is the current frequency of the bot. If this is desired, I think it might be better to do it as a separate bot that updates a different page (at least to start) on a less frequent basis (e.g. maybe once per day rather than every 10 mins). Mz7 (talk) 00:11, 28 August 2024 (UTC)
This is a great initiative. Does anyone know the main 2 or 3 causes of the backlog, not enough checkusers, not enough clerks, the inherent advantage of replicators in a community of agents etc.? Sean.hoyland (talk) 08:24, 1 September 2024 (UTC)
I'd support any system that helps prioritizes cases. I think a daily report would be sufficient. I've also wondered about the bottleneck, sometimes an SPI case I file gets reviewed the same day I post it while others linger around for days or weeks. Also cases are not being archived after being closed so I think you might need to make a pitch for more SPI clerks to come on board. LizRead!Talk!22:17, 1 September 2024 (UTC)
I can't speak for other SPI denizens, but from my perspective the best way to get a case handled quickly is to lay out the evidence clearly and simply, which almost always means pairs of specific diffs. The harder it is to understand the evidence, the more likely I'm going to skip over a case and move on to something else. RoySmith(talk)22:44, 1 September 2024 (UTC)
I would agree with RoySmith here. Yesterday I went through most of the backlog, and was usually skipping cases where it was not laid out for me with diffs. In some cases I could see the similarity quickly, but I want to avoid doing a deep dive to not find enough evidence to run a check. Dreamy Jazztalk to me | my contributions09:12, 2 September 2024 (UTC)
It's difficult to provide a "good" case for a prolific editor, but I would emphasise diffs are important. Essentially something like Editor A edited [diff 1] article 1 to add the same content as Editor B in [diff 2] is very helpful as it establishes a common editing pattern and also the grounds for violating WP:SOCK (editing the same page using multiple accounts without disclosure). Even something like Editor A [diff 1] compared to Editor B [diff 2] is still good as long as it's clear why the diffs are similar. When it's a editor who has been around longer, more diffs helps because the chance of a it happening without them being the same person drops as they make more edits. However, adding a boat load of diffs can be unhelpful. For example Editor A [diff 1] [diff 2] [diff 3] [diff 4] [diff 5] [diff 6] [diff 7] [diff 8] [diff 9] [diff 10] and Editor B [diff 11] [diff 12] [diff 13] [diff 14] [diff 15] [diff 16] [diff 17] [diff 18] [diff 19] is not as good because I cannot immediately see pairs of diffs that establish a common editing pattern. Dreamy Jazztalk to me | my contributions21:49, 4 September 2024 (UTC)
Prototype
@RoySmith, Aloha27, and Mz7: I've thrown together a prototype; see User:BilledMammal/SPI Edit Counts. There are currently six open SPI's where the accused accounts have made more than 1000 edits in the past month.
It took a few minutes to compute, but that was due to the API being needed as I did so locally - it would be much faster on toolforge, as it's possible to use SQL queries there. BilledMammal (talk) 18:11, 30 August 2024 (UTC)
The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.
That's a content dispute issue, but regardless, the fact that it's about the Arab-Israeli conflict (A contentious topic) means that neither of you should be discussing it. M.Bitton (talk) 03:14, 9 September 2024 (UTC)
Thank you for your consideration and guidance. I see no conflict here as the contentious topic itself was not discussed but referenced to document the individuals involvement. As per the guidelines, anonymous shouldn't be editing/undo/reverting more than once every 24hrs. I'd like to report their (2603:7000:2101:AA00:8463:3822:2153:CF14) violation of that policy. Smartiest Marty (talk) 03:28, 9 September 2024 (UTC)
It's not about what you can see. It is an objective fact that the content is covered by WP:ARBECR. So, it falls outside of what either you or IPs are permitted to work on. I have added a template to the talk page notifying users that parts of the article are within scope of WP:ARBECR. If the ECR violations continue I will request that the page is extendedconfirmed protected. Sean.hoyland (talk) 07:46, 9 September 2024 (UTC)
" to provide complete information and not to promote one particular point of view over another. As such, the neutral point of view does not mean the exclusion of certain points of view; rather, it means including all verifiable points of view which have sufficient due weight."
Anon is not following content dispute procedures and did not discuss the validity of content with me on the talk page, nor edited the content constructively. They opted to simply and flatly delete it.
Have a look at the Further information part of the Warning: active arbitration remedies note at the top of the talk page. The procedure is to make an edit request. It can be on the talk page or centrally at Wikipedia:Requests_for_page_protection#Current_requests_for_edits_to_a_protected_page. Edit requests most likely to succeed are those that are 'Specific, Uncontroversial, Necessary, Sensible' per WP:EDITXY. It will then be handled by extendedconfirmed editors in due course. Might take a while. I know it's annoying but the rules are there to reduce disruption and apply to thousands of articles. Sean.hoyland (talk) 08:19, 9 September 2024 (UTC)
Why am I the sock and not the obviously competent anon? You can visibly see that I'm fumbling around, but in good faith, lol.
Read my contributions history, it's me just asking for advice in how to navigate wikipedia.
On top of that apparently just mentioning someone said something negative about arabs is invalid. It's genuinely and fundamentally disenfranchising and culturally invalidating.
Arabs and their issues are not valid unless someone external deems so, pending 30 day review and prove your worth with 500 edits (except for anon). It's so disheartening. Smartiest Marty (talk) 08:37, 9 September 2024 (UTC)
No one except the IP user has said you're a sock and that user hasn't given any basis for calling you that. Possibly the IP user doesn't even know what a sockpuppet is. In any event, in the absence of any reason to give credence to that claim, this discussion has turned out to be off-topic and should end. Largoplazo (talk) 11:57, 9 September 2024 (UTC)
The discussion above is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.
Paperwork questions
Hi SPI, can you please give me some guidance about best practices for these kinds of filings:
If there are multiple socks and I think it's one master, should I open one SPI under the master and list all suspected socks (and then in the filing explain one by one why I think each one is a sock), or should I open multiple SPIs under the same master, one for each sock?
If I have a group of suspected socks but I think there are multiple possible masters, is it better to just pick a master and list all the socks under that master, or should I try and "best guess" which socks go to which master, and file multiple SPIs, and cross-reference them? Like, "here's a bunch of socks, I don't know if they're LTA1 or LTA2 or LTA3, but probably one or more of those", what's the best way to file that?
If I have a group of socks but no idea who the master is, is it better to file it under "best guess," or just pick the oldest suspected sock account and file it under that account as a 'new master'?
If I think it's a compromised account, or group of compromised accounts, and I don't know who the master is, again: should take a "best guess" and file it under that master, or open an SPI under the oldest account as the master with no sock, or open separate "one-account" SPIs, one for each account? (E.g., if I think they're compromised but don't know if they're compromised by the same person or different people.)
The SPIs I have in mind are all ARBPIA and could match to any of a half dozen or so sockmasters who have had socks sanctioned in the same relative time period (first half of 2024), some of whom are familiar LTAs. I know there are editors who are much more familiar with these ARBPIA LTAs than I am and could probably figure out who goes with whom. I'm wondering how much effort I need to put into connecting those dots, as opposed to just saying "here are suspicious accounts with suspicious behaviors [diff, diff, diff]" and letting a CU review it and sort it as they will.
What is the best way to organize information in the above 4 categories from the point of view of SPI patrollers? (If there's a help doc that explains this, please point me to it.) Thanks in advance for any guidance, Levivich (talk) 18:12, 14 September 2024 (UTC)
The answer to #1 is clearly open one SPI and list all the accounts you believe are socks. For the purpose of SPI, we define "the master" as the account which was created first. For cases 2-4, I guess just put it all into one SPI filing. SPI cases get split and merged all the time as information emerges, so don't sweat the details. RoySmith(talk)20:10, 14 September 2024 (UTC)
@RoySmith I've been thinking about similar myself but mostly from a UPE perspective than Levivich's situation. Do you think a table something like the below would be helpful?
Suspected Master/one of their socks
Editor A
Editor B
Additional info
Article and/or behaviour
diff/log/other evidence (or ?/possibles)
diff/log/other evidence (or ?/possibles)
diff/log/other evidence
diff/log/other evidence
diff/log/other evidence
diff/log/other evidence
This is extremely crude and it depends on the evidence as what makes sense structurally but I hope you get the idea. S0091 (talk) 20:38, 14 September 2024 (UTC)
The best way to write a good SPI is to stick to hard evidence, which usually means diffs and links to log entries. Where things go off into the weeds is when people write long essays. If presenting the diffs in a table works for you, that's just fine, but the important stuff is the diffs themselves. RoySmith(talk)21:38, 14 September 2024 (UTC)
@Levivich: Vanished users get locked to satisfy IIRC EU laws. You are correct though, such locks made through renaming processes are not logged in meta:Special:Log/globalauth. Please also remember that some accounts are locked without prior input on SRG, this is result of stewards performing CU actions through loginwiki or through private email channel. Best regards, A09|(talk)20:54, 16 September 2024 (UTC)
I would like to have a better understanding of the minimum requirements for an SPI report. For example, the SPI page says, "Before opening an investigation, you need good reason to suspect sockpuppetry".
A. What if the reason to suspect sockpuppetry or ban evasion is an apparent inconsistency between an account's revision count (across all wiki sites) and their experience level?
B. What if, in addition to A, the account heads straight for a contentious topic area where ban evasion is relatively common?
C. What if, in addition to A & B, there is evidence of source misrepresentation, bias/POV pushing, features associated with ban evasion, to the extent that the account is reported at AE?
B: Lots of new people head straight to contentious topics. People edit what they are interested in.
C: Lots of people involved in editing contentious topics share biases. That doesn't make them socks.
These things are all just clues, and there's no easy way to define an algorithm for how many clues have to line up before your sock-o-meter buzzes. RoySmith(talk)15:09, 28 September 2024 (UTC)
I agree with your views on B and C. They shouldn't have a significant impact on the sock-o-meter reading because within a contentious topic area those things are not really any more common among socks than non-socks, as far as I can tell anyway. So, let's say it's just A, but with the additional constraint that information provided by the user rules out the caveats in paragraph 2 of WP:PRECOCIOUS, what then? What I'm trying to get a better understanding of is the location of the boundary between reports that will trigger investigation and reports that won't. I know it must exist, it might have a fuzzy border zone, it might be different for every SPI clerk and checkuser, but it recently dawned on me (having filed numerous SPI reports in the past) that I really have no idea where that lower bound actually is. At the same time, I see numerous accounts that I would checkuser without hesitation if I could because the chance that ban evasion is involved is substantially higher than zero. So, I find myself in a kind of no-man's-land between ignoring potential ban evasion and reporting it...somehow, with an intractable cost vs benefit question I don't know how to answer.
Another question I have been thinking about is how best to present article intersection evidence when the objective is to justify a checkuser? Presenting lots of intersections is apparently not enough when accounts have made lots of edits and/or intersections are at non-obscure/popular-ish articles it seems. It should be possible, in principle at least, to write down a function that computes an importance score for each intersection based on...some things. What should they be is the question. I guess the score would be proportional to some things like number of edits at intersecting articles and inversely proportional to other things like user edit count, number of unique articles edited, per article revision counts, pageviews etc...or at least some way to rank the significance of intersections to boost signal over noise for SPI clerks to increase the chance of checkuser usage being approved. Sean.hoyland (talk) 16:22, 28 September 2024 (UTC)
It should be possible, in principle at least, to write down a function that computes an importance score for each intersection based on...some things. This is what machine learning is all about. Lots of very smart (and well-funded) people have been working on the general problem of machine learning for many years. They've made some progress, but it's still an area of active research and lots more to be done. Variation on the "is this a sockpuppet?" question include "Is this email spam?", "Will the price of this stock go up or down?", and "Is this a picture of a cancer cell?" RoySmith(talk)16:39, 28 September 2024 (UTC)
I don't mean those kinds of high dimensional functions (that you can't write down). I mean a simple function like F = ma that could tell you that intersection A is more significant (more improbable) than intersection B because, for example, article A only has 100 revisions and 5 unique editors whereas intersection B has 20,000 revisions and 500 unique editors. Sean.hoyland (talk) 14:19, 29 September 2024 (UTC)
I don't mean to be dismissive, but if it was really that easy, somebody would have written the tool already. What you're talking about here is Feature engineering. You've defined two features:
and hypothesized that the first feature should be weighted higher than the second, based on a sample size of one. So now, run an experiment. Go through all the old SPI reports and find all the pairs of users who have been accused of being socks. Of those, find all the pairs who have edited both of those articles vs all the pairs where only one has edited both of those articles. See how well that correlates with having been declared a confirmed sock.
If you do that experiment, I strongly suspect you'll quickly find that there aren't enough data points to do anything useful. So your next step might be to change the definition of your features to something broader and try again. And pretty soon you'll be deep into reading the machine learning literature to discover what those who have gone down this road before you have learned and see if you can apply their techniques to this data set.
I'm not being at all facetious. It's an interesting area and you can get your feet wet with some ordinary programming skills and some basic understanding of statistics. And even if you don't make any substantial progress towards solving the sockpuppetry problem, you'll learn a bit about about the algorithms which are increasingly running our lives. RoySmith(talk)15:25, 29 September 2024 (UTC)
In addition to the mentioned indicators and others that raise suspicions of a specific account being a sockpuppet, I have only opened SPIs where I know what other account(s) that specific account links to. That means either the suspicious account matches an existing farm I am familiar with, or I have found multiple accounts that produce the same suspicions. CMD (talk) 08:17, 29 September 2024 (UTC)
An editor who hasn't edited for months (and very little in the past year), and made an odd series of edits to a vey controversial stub article (domicide) just a minutes after I tidied it up. They had never edited on this article beforehand. I find it hard to believe that this is their only account and that they were not watching this article from another live account. However, is this something that can be considered under SPI or other type of investigation? thanks. Aszx5000 (talk) 11:03, 6 October 2024 (UTC)
I don't see anything there that makes me suspect sockpuppetry or any other kind of abuse. My suggestion is to engage with the other editor on the article talk page to see if you can each help the other understand your differing opinions. RoySmith(talk)16:09, 7 October 2024 (UTC)
Requesting advice on how to request a sockpuppet investigation on users vandalising Manisha Ganguly
Hi all
Today I reported to ANI vandalism, including trying to get the page deleted all together and suspected sock puppets of multiple users editing Manisha Ganguly and its talk page here (the first time I've every reported anyone). I see that two of the usernames have been banned as suspected sock puppets. I have a question, to summarise:
The now banned sockpuppets showed that they were really quite knowledgable about Wikipedia, its different policies, how to nominate an article for deletion etc within 24 hours of creating both accounts, this makes me think that this was an established user who decided to use sock puppets to try to vandalise this page. The user also requested their account was deleted once their edits were reported to ANI.
An additional IP address has done an edit to again add one of the maintainance tags the sock puppets added, the first edit from that IP address.
The edit appear to be politically motivated to discredit the journalist, she writes about killings of journalists and bombings of hospitals in Gaza and the vandalism was done on the anniversary of the start of the Israel Hamas war. The articles is part of the WP:ARBECR on this topic. We know that the pro Israel government organisations has been using Wikipedia as a propaganda tool for many years eg reporting here and here here.
Is there a way of requesting that someone checks into other edits made by the IP address used by the sock puppets?
Many thanks RoySmith yes I've read that, I guess I'm confused by the process since I've never been taken part before. In this case I do not know who the sockmasters name is but two of their accounts have been banned as sockpuppets. As I describe above I think its a reasonable and likely assumption these are not the primary accounts given that they less than 24 hours old but were familiar with many of Wikipedia's policies. Is it allowed to request someone check if these socks are connected to any other accounts? John Cummings (talk) 17:42, 8 October 2024 (UTC)
Thanks for the reply RoySmith, I feel like perhaps I'm not being clear, to be specific, I want to tell people there may be a wider problem, do the rules allow for a wider investigation if the sockmaster is unknown? John Cummings (talk) 18:02, 8 October 2024 (UTC)
The main purpose of SPI is to stop ongoing disruption. Since the accounts that were making disruptive edits are already blocked and the page is already protected, there's really not much more SPI would do. RoySmith(talk)18:44, 8 October 2024 (UTC)
The supposed 'defamation' relates to possible block evasion way back in 2011. Jairon Levid Abimael Caál Orozco (talk·contribs) began editing in June 2011 after Seeker02421 (talk·contribs) was blocked in March 2011. Both editors have a very specific purpose of promoting a specific pronunciation of the Tetragrammaton. There has been no accusation of 'socking'. It is possible that the editors were simply known to each other rather than the same person. It is unlikely that the two editors are entirely unaffiliated.--Jeffro77Talk09:22, 10 November 2024 (UTC)
Fake AfC approval notices
I cannot recall, but there is a recent SPI case that was filed where SOCKS were leaving AfC notices on pages that were not really approved through AfC. If anyone can recall the specific SPI case it would be helpful to one I am filing. CNMall41 (talk) 17:24, 9 December 2024 (UTC)
Thanks. That may have been it but I've already wasted hours of time digging. Coincidentally, the user you mentioned is the SPI I added to today. --CNMall41 (talk) 20:39, 9 December 2024 (UTC)
