Wikipedia:Sockpuppet investigations

This page has an administrative backlog that requires the attention of willing administrators. This notice will automatically hide itself when the backlog is cleared.

Sockpuppet investigations is for requesting an investigation of whether two or more Wikipedia accounts are being abusively operated by the same person. This process is described in some length at the guide.

Before opening an investigation, you need good reason to suspect sockpuppetry.

1. Evidence is required. When opening an investigation, you must immediately provide evidence supporting a suspected connection between the accounts listed in the investigation. This evidence must include diffs of relevant edits, links or references to relevant log entries (if applicable), and a detailed explanation identifying the specific behaviors, similarities, or other circumstances that suggest the accounts are connected. If the relevant edits have been deleted, provide the names of the pages edited by the accounts instead of diffs.
2. Evidence must be presented clearly. Vaguely worded submissions will not be investigated. You must clearly explain, using specific evidence, why it is reasonable to suspect that the accounts are connected.
3. Concision is key. Due to the size of the backlog, investigations supported by clear, concise explanations and evidence can generally be handled more quickly.

Investigations are conducted by a clerk or an administrator, who will compare the accounts' behaviour and determine whether they are likely connected. When appropriate, a checkuser may also conduct a technical investigation upon request, examining technical data associated with the accounts to assess whether they are connected. CheckUser results are often referred to as technical evidence, in contrast to publicly available behavioural evidence.

Under Wikipedia's CheckUser policy, checkusers will conduct a technical investigation only if clear behavioural evidence of suspected sockpuppetry has also been submitted; if you request a technical investigation without providing behavioural evidence, the investigation may not proceed. Additionally, under the privacy policy, checkusers will not publicly connect a named account with an IP address or temporary account except in extremely rare circumstances.

How to open an investigation

To add to an existing investigation (or case), enter the case name in the box below. To create a new investigation, enter the username of the oldest-created registered account (the "sockmaster")—or, if only IP addresses are involved, the IP that made the first relevant edit. Then click "Submit". Note: Do not include "User:" or any other commentary.

For example, if a prior filing was at Wikipedia:Sockpuppet investigations/John Doe, or this is a first filing and the oldest registered account is User:John Doe, you should enter John Doe in the box below.

You will then be taken to another page containing a form you must complete to open the investigation. The process for opening a subsequent investigation on the same user is the same as for creating a new case. Again, do not include "User:" in any of the numbered fields.

You do not need to notify the accused editors that you have opened an investigation on them, and in most cases should not. An administrator or clerk can handle this if necessary.

Cases currently listed at SPI

This version of the page may not reflect the most current changes. Please purge this page to view the most recent changes.

v t e There is one request for CheckUser attention at the Unblock Ticket Request System. Checkusers can help: Log in to UTRS

Quick CheckUser requests

Use this section to request CheckUser information relating to a situation that does not involve sock puppetry. To request CheckUser in a case which does involve sock puppetry, see the "How to open an investigation" section above.

You could use this section to request, for example:

• Underlying IPs of an account, where the autoblock has expired or been ineffective.
• Collateral damage checks for the informed hardblocking of IPs or ranges.
• IP block exemption checks before granting IPBE (or to verify it is being used constructively).

For threats of harm (to self or others) you must email emergencywikimedia.org (see the threats of harm page) and not use this page. Requests to investigate and confirm sockpuppetry should be listed in the sockpuppet section above, and not here (such requests will be summarily removed).

To make a request here, copy the following template and paste it to the end of this section (quick link to edit) – replacing "header" with an informative title, and adding underneath the template any relevant information – then sign using "~~~~", preview, and click "save".

==== HEADER ====
{{SPIquick}}
* {{Checkuser|username}}

~2026–56926–08

This case has been marked as closed.

• ~2026-56992-26 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki · SI)
• ~2026-57030-10 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki · SI)

Possible socks of User talk:~2026-56926-08. Edit warring similar edits on several pages, particularly Confectionery store Aspifi (talk) 21:45, 25 October 2026 (UTC)

• @Aspifi -- nah, they're probably not the same person. Note Confectionery store is on the main page right now as the TAFI. If further vandalism occurs feel free to report to AIV. Regardless a CU is not needed to connect TAs and won't connect them to named accounts. Closing. Staraction (talk · contribs) 21:49, 25 October 2026 (UTC)

Navboxes