Wikipedia:Sockpuppet investigations#DSP2092

This page has an administrative backlog that requires the attention of willing administrators. This notice will automatically hide itself when the backlog is cleared.

This page is for requesting that we investigate whether two or more Wikipedia accounts are being abusively operated by the same person.

1. Evidence is required. When you open the investigation, you must immediately provide evidence that the suspected sock puppets are connected. The evidence will need to include diffs of edits that suggest the accounts are connected. (This requirement is waived if the edits in question are deleted; in this case just provide the names of the pages that the accounts have been editing.)
2. You must provide this evidence in a clear way. Vaguely worded submissions will not be investigated. You need to actually show why your suspicion that the accounts are connected is reasonable.
3. Concision is key. Evidence should be presented in a concise format. Because of the length of the backlog, cases with clear and concise explanations and evidence are handled the most quickly.

Investigations are conducted by a clerk or an administrator, who will compare the accounts' behaviour and determine whether they are probably connected. Upon request, investigations can also be conducted by a checkuser, who can look at technical data behind the accounts in order to determine how likely it is they are connected. CheckUser results are often called technical evidence, in contrast to publicly available behavioural evidence.

Due to Wikipedia's CheckUser policy, checkusers will conduct a technical investigation only if clear, behavioural evidence of sockpuppetry is also submitted; if you ask for technical evidence to be looked at but do not provide behavioural evidence, the investigation may not be allowed to proceed. Additionally, checkusers will not publicly connect an account with an IP address per the privacy policy except in extremely rare circumstances.

To add to an existing investigation (or case), enter the case name in the box below. To create a new investigation, enter the username of the oldest-created registered account (the "sockmaster")—or, if only IP addresses are involved, the IP that made the first relevant edit. Then click "Submit". Note: Do not include "User:" or any other commentary.

For example, if a prior filing was at Wikipedia:Sockpuppet investigations/John Doe, or this is a first filing and the oldest registered account is User:John Doe, you should enter John Doe in the box below.

You will then be taken to another page containing a form you must complete to open the investigation. The process for opening a subsequent investigation on the same user is the same as for creating a new case. Again, do not include "User:" in any of the numbered fields.

If you also wish a checkuser to investigate, change |checkuser=no to |checkuser=yes in the edit box on the next page and explain why you are requesting it.

This version of the page may not reflect the most current changes. Please purge this page to view the most recent changes.

==== HEADER ====
{{SPIquick}}
* {{Checkuser|username}}

This quick case is open.

• MagicatthemovieS (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• MagicatthemovieS2 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)

Converting this to a quick request from Wikipedia:Sockpuppet investigations/MagicatthemovieS, since this is not a sockpuppetry case. (I.e. the account, if verified, is a WP:LEGITSOCK.) Could a CU verify that MagicatthemovieS2, who claims to be an alt account of locked-as-compromised user MagicatthemovieS2, is in fact the same person? Self-endorsed by clerk for checkuser attention since ruling out impersonation is a valid use of CU to prevent disruption.

(I also wrote at the SPI that the original account should be checked to verify the claim of compromise, but now I see that at Wikipedia:Administrators' noticeboard/IncidentArchive1193 § Possibly hacked editor? the finding was no IP evidence of compromise but plausible device-level compromise, so I'll leave it at that and talk to the user directly about the nature of that compromise.) -- Tamzin^{[cetacean needed]} (they|xe|🤷) 02:52, 17 July 2025 (UTC)[reply]