Wikipedia:Signs of sockpuppetry

Before we go on about what the actual signs are, we need to discuss what motivates people to commit deceptive sockpuppetry, and why these are not good reasons to do so.

When detectives set out to solve a crime, one of the first things they may do is to try to determine a motive for the crime. This will lead them to know whether or not a particular suspect would have had any desire to commit such a crime. A motive is a very useful piece of information in solving a crime, because it helps detectives know who would have such interest. While the motive cannot always be determined, it is hard to understand why one would commit a crime without a motive.

Likewise, knowing the motivations for sockpuppetry may help determine whether or not there is actual sockpuppetry taking place. Without a motive, there is no apparent reason why one may sock.

 

In discussions, such as deletion debates and talk pages, the outcome is generally determined by consensus. If there is a clear agreement in a particular direction, it becomes the outcome. The closing administrator will be required to follow the consensus, even if they personally disagree.

But when there are multiple opinions widely held, determining the consensus may be harder and sometimes impossible. Many discussions are relisted or closed as "no consensus" in these situations. Everyone's opinion, even those in the minority, is taken into account, and even the minority view may ultimately be the outcome in some cases.

Many users have a misconception that the outcome is determined by votes in numbers, and that the more people who vote in favor of a cause, the more likely it is to be the outcome. But that is not the case. Discussions are not a vote, and the outcome is really determined by those who cite policies and guidelines or otherwise have good ideas in their own individual words. Whether or not a sock puppet, those who follow the leader and just go along with what someone else says do not help advance the cause of the discussion. Such votes are generally discounted when determining the outcome of the discussion.

It is not uncommon for one whose article is being considered for deletion, especially a newbie, to "panic" when they see the proposal. A natural response under these circumstances would be to go ahead and create more accounts and to use them to cast additional votes in a desperate move to salvage the article.

Doing this, however, will not help save the article or otherwise advance the cause of the sockpuppeteer. The closing administrator and perhaps others who comment will see that the sock puppet accounts have little or no edit history, thereby prompting such suspicion. If multiple accounts with long edit histories that are operated by a sneaky experienced user are involved in casting multiple votes, at least some of the many signs described below may be present to help reveal the truth.

Besides the creator and others who have worked on or otherwise read an article, the only people who usually comment in a deletion discussion are those who specialize in this. While some may favor keeping and others support deletion, these people usually have a history of commenting in other deletion discussions, and they care more about the discussion than the article itself.

 

Edit warring is not uncommon on Wikipedia, even and especially among veteran users. It is human nature for one to want it their way. When an edit war occurs, the desired outcome for Wikipedia is a compromise.

Sock puppets are sometimes used to distort the balance in an edit war. Current guidelines allow for a maximum of three reverts for each user on a single day, and even fewer reverts may result in a block if it is obvious the user is being disruptive. If two users with opposite points of view are going back and forth, and another user jumps in, this would provide for six reverts for one side versus the three of the other. Seemingly, the user with support from one's own sock puppet account would win.

But that is not the case. When an uncontrollable edit war occurs, sometimes administrators must go as far as blocking those involved in the dispute and/or protecting the page in question from all editing by non-administrators.

When an edit war does occur, majority is not what determines the outcome. Edit wars are typically resolved by discussion/debate with the aim of achieving consensus.

 

Many editors have already established for themselves a good reputation with a long edit history free of disruptive behavior. To have such is treasured. But then, all of a sudden, one may wish to perform some controversial edit that they do not wish to appear in that history. There are legitimate reasons for doing this. For example, one who does not wish for a good-faith edit to a pornography-related article to appear in one's edit history due to the personal stigma it may accompany is permitted to do this.

But it is explicitly forbidden to use a second account to be intentionally disruptive and hide this from one's contributions. This phenomenon is called the good-hand bad-hand account. The editor who does this may be one who wishes to experimentally vandalize, violate Wikipedia's neutrality policy and engage in POV pushing, make threats against other users, or to otherwise disrupt Wikipedia to make a point.

Some users will create separate accounts to engage in activities that are generally permitted, but may anger other users, such as proposing articles for deletion. While it does not actually distort consensus, having separate accounts that are not identified as such on user pages is frowned upon. It is not uncommon for an account used only to propose one or more articles for deletion to be a suspected sock puppet.

In some most extreme examples, one might experiment to see the reactions of others or stir up artificial controversy between two or more of one's own accounts by having them edit war with one another, forming a discussion with two accounts seemingly being two separate people who disagree, or by creating an article with one account, then proposing it for deletion with another. All of these actions would constitute disrupting Wikipedia to make a point.

Wikipedia has a number of systems designed to enforce various policies and guidelines and altogether ensure the integrity of the encyclopedia. Newly created pages are patrolled. Recent edits are patrolled. Vandalism is reverted. References are checked.

Some editors, often veteran ones, have come up with sneaky tricks to circumvent these systems and bypass the enforcement using second accounts. For example, one might create an article with one account, then mark it as patrolled with another. One might vandalize a page with one account, then make a seemingly good faith edit immediately after with another, possibly marking it as a reversion of the vandalism. Or one might make a controversial edit to a page that one knows would not be liked by others, and then make a minor edit with another immediately after so the controversial edit is not the most recent and therefore goes unnoticed.

In order to get a discussion started, a user may make an assertion, then have a sock puppet counter that assertion as if there were a real discussion occurring. Also, a user could, with multiple accounts, make such opposing comments within an existing discussion.

Pump priming may occur as a method of testing a point-of-view, or the pump primer may actually want a particular outcome, but will give strong reasoning for the desired outcome, paired with weak reasoning for the opposing point-of-view.

Pump priming is a direct violation of disrupting Wikipedia to make a point.

 

The following are possible signs that two accounts may be operated by the same person, that the likelihood may be low, or that, contrary to popular belief, there is no likelihood at all. These signs mostly focus on the knowledge the users of the suspected accounts may either have or lack, or the behaviors they exhibit.

Most of the signs listed here have been derived from those used in prior sock puppet investigations that when listed as probable signs have led to positive identifications, and when listed as improbable signs have led to negative or inconclusive identifications.

When one or more of these signs are present, this does not automatically mean that sockpuppetry or even legitimate multiple account usage is definitely occurring. The more signs that are present, the more likely sockpuppetry is occurring, though no accusations shall be made unless, beyond a reasonable doubt, one is really certain.

 

A pair of usernames consisting of the same word followed by a pair of numbers in succession (e.g. User:SockPuppet1 and User:Sockpuppet2) may be the same person with two accounts. But as a sockpuppet is defined as one using multiple accounts deceptively, it is more likely that such use would not be so overt. If the example of numbers in succession is seen, more likely, one of them was probably made because the username of the other one coincided.

In the event that two accounts have a common word (e.g. User:Sock puppets and User:Green sock), the likelihood of the two accounts being operated by the same person likewise is low unless the word or name used is so rare that it would be practically unknown to anyone else, and the newer of the accounts was formed not too long after the older one (meaning that no one would have known to copy it).

 

Naturally, as one would expect, one who is new to something has little skill, and becomes more of an expert over time as experience is gained. A newbie's edits may be deficient in meeting editing requirements and skills (such as referencing, wikifying, etc., though they should not be discounted), may have some test edits, and may even exhibit some inappropriate behavior at times, up to and including vandalism and edit warring. One with a longer edit history would have more knowledge about correct policies and procedures, and may be familiar with the requirements to provide sources, recommendations to provide internal links and navboxes, and with some more complicated techniques (such as building charts, uploading images, or designing new templates). This commonly leads one to believe that an account with only a few edits that has been performing at a high level of knowledge of wiki rules and language is a sockpuppet.

When a new account's first edits appear like those made by a veteran editor, showing good knowledge of how Wikipedia works, it is likely that the account is a sockpuppet. But the user may not be a sockpuppet, and might instead be one who has prior experience with IP editing, has carefully read instructions, policies, and guidelines prior to editing, has worked a lot on other sister projects or has previously edited other websites that use MediaWiki, has read a book on Wikipedia such as Wikipedia – The Missing Manual, or has been coached by another editor known to them (see WP:Newbies aren't always clueless). Or else the account may be a second account used legitimately (see WP:Sockpuppetry#LEGIT) or that of one who has abandoned an earlier account and legitimately started over (see WP:Clean start).

Of particular concern is when multiple accounts are used simultaneously, particularly for a common cause, such as commenting on a deletion discussion, thereby giving the appearance of multiple votes. If an account that participated in the debate was created after the discussion began, the comments given by the new account will not be automatically discounted, but its comments may be given less consideration due to the possibility of sockpuppetry.

Very often, there will be an editor who will try to edit in a certain manner that is viewed as controversial in the eyes of the majority of the Wikipedia community. Normally when this happens, since Wikipedia is ruled by consensus, the majority view is likely to win and prevent the minority view from making its way into the final outcome of a dispute. Especially when the minority view is extremely unpopular, it is unlikely to get much support. The majority of editors agree on doing the right thing, even if they do not agree themselves with the majority view.

What's more, reliable sources that are believed to be accurate are what make true winners. Point-of-view pieces that do not provide information at a neutral stance are not considered to be in the reliable sources category, especially for subjects of a controversial nature.

A level of support greater than what can be expected from the overall population combined with other signs can be a possible sign of either sock or meat puppetry.

Receiving a barnstar is generally considered to be a great honor. It shows that one has worked hard to make useful contributions to Wikipedia. Many users are proud of the barnstars they've received and actively display them on their user pages.

Anyone can award a barnstar to anyone. Even an IP user can award or receive a barnstar. There are no qualifications required. This is nice because anyone who wants to award one in good faith can do so. At the same time, anyone who wants to award one in bad faith can do so.

It is therefore possible to award a barnstar to one's own sock puppet account, or to one who is acting as a meatpuppet for one's own cause in order to help legitimize the cause. The recipient can then justify their cause by stating "look, I was awarded a barnstar." This level of pride does not ever justify favor for the minority point-of-view, or any other actions contrary to Wikipedia guidelines, even when there is no sock or meat puppetry involved. But it has been interpreted as a suspicious sign for sock or meat puppetry.

If a single account is used to repeat the same edit, and it is continually reverted, that is well known as an edit war. A single user engaging in an edit war against multiple editors opposing the activity is almost certain to be blocked if the behavior is not stopped.

If multiple editors without a long history come into the scene, these may be sock or meat puppets. This may not only include edits to existing pages, but also creation of troublesome pages, uploading of problematic files, copyright violations, personal attacks, spam, or other behaviors in bad faith after being warned. Simply changing the name of a page does not resolve the problem. Editors engaging in such disruptive activity may attempt to be sneaky for using different names for such pages each time, just like they use different names for their accounts that are sock puppets. The names may or may not have resemblance to one another.

 

If two accounts have a history of edits to one or more of the same articles, or especially many identical articles, this may lead to suspicion that they may be operated by the same person. There may be even more suspicion if the edit(s) themselves are nearly identical, and even more so if they are disruptive in nature.

Then again, two different people who have an interest or experience in a certain field may work on many identical articles. For example, people living in the same area (who may or may not know each other personally) may edit lots of articles on regional interests. Fans of a sports team may edit articles on many of its players. Those with knowledge in biology may also have studied chemistry. As many musicians also act, those who work on songs of the musician may also be involved with movies the star is in.

In all, each article (unless it is lacking of proper wikification) is contained in one or more categories, is linked from one or more articles, and is often listed in one or more templates. Those who view the links or categories will therefore be led to view and often edit common pairs or groups of articles. So if any two or more accounts are used to edit common articles in such groups frequently, it is unlikely two or more of them are operated by the same person.

If two accounts operated by the same person are used to deceptively show more support for a cause, such as multiple "votes" on an AfD or a controversy created by a fake edit war between the two accounts, a violation has occurred. But if one account is used to contribute useful information to an article, and another is used in an unrelated productive manner (such as to fix spelling errors), no harm has occurred, and no action shall be taken.

If a checkuser inquiry or other evidence finds that two accounts are using the same IP address to edit the same articles, this does not necessarily mean the same person is operating both accounts. It is not uncommon for people who live or work together or who otherwise know each other to have common interests, or even to have face-to-face discussions about the same articles. Provided that there is no meatpuppetry or canvassing, and each person is editing in a manner that they naturally would independent of the other, this is acceptable.

It is even possible for two or more people to be making disruptive edits to the same article with no connections to one another whatsoever. If there is a subject that is of high interest to an immature or ideologically-bent crowd, and the article is popular among this crowd, it is possible to see more than one unconnected person performing the exact vandalism or POV editing to the article. When this occurs, the proper action is to consider protecting the page in question rather than accusing those involved in the disruptive behavior of sockpuppetry. If those involved have a history of doing the same collectively to multiple articles, then it is more likely sockpuppetry may be occurring.

In the event of an edit war, it is quite easy for accusations of sockpuppetry to occur. Even veteran editors will sometimes get quite nasty during edit wars and commit three-revert-rule violations, leading to getting blocked from editing.

If an edit war involves just two editors, each with an opposing viewpoint, and resulting in numerous reverts, the appearance of a third editor out of the blue supporting one side may lead to examination of that editor's history to determine if this account is operated by the same editor. Some possible signs to look for may be whether or not the third editor has previously edited the article in question or any related articles, though the outcome of such analysis does not provide conclusive proof that both accounts are or are not operated by the same individual, the third account is operated by one known to that of one of the first two, or that any canvassing has occurred.

In an edit war involving multiple, possibly numerous editors taking both sides, sockpuppetry accusations are also likely, though identification may be even more difficult. An examination in similarity of editing patterns, habits, or certain other factors may be able to either further confirm or else rule out such suspicion.

Making multiple comments on the same deletion discussion (AfD, CfD, TfD, etc.) with separate accounts is among the most forbidden uses of a sock puppet account. If two or more editors are seen on the same discussion, one may suspect sockpuppetry is occurring, especially if one of the accounts belongs to the creator, a major contributor, or the nominator.

There are, however, a large number of editors who regularly make comments on deletion discussions, and therefore, their names are found often together on many such debates. If any such editor is previously known to frequently propose articles for deletion or comment on deletion proposals made by others, this should be taken into consideration before sockpuppetry is suspected.

Two users who participate in multiple AfDs together could be a sign of common interests. But it should be noted in the event of a deletion discussion that if there is a user who normally does not participate in deletion discussions, but participates periodically in those of articles that were all created by a single user, but that they did not previously edit themselves, this may be a sign of meatpuppetry. This is especially so if the second account rarely otherwise participates in deletion discussions and has not participated in editing the associated or any related articles.

Some articles are known to many, and at the very least, receive lots of views, if not lots of edits. But other articles are of interest to few, or else may have been around for only a short time, and in all, are little known.

If an article on an obscure topic is created, and then, soon after its creation, receives edits from another account (other than those typically made by a new page patroller), this may raise suspicion that the two accounts are operated by the same person, or that they know each other. This may especially be the case if little or nothing has been done to spread awareness of the page's existence.

In these situations, analysis of other factors here may help rule sockpuppetry in or out.

In all, the people most likely to comment in a discussion will generally fit into one of several categories, as listed below:

1. Has created the page
2. Has made one or more significant contributions to the page
3. Has made one or more significant contributions to one or more related pages that would lead to the one in question being found through a link or common category
4. Regularly comments in similar types of discussions, regardless of interest in the specific page
5. Has commented in a discussion being held on or close to the same day that would be listed on the same page of discussions

Everyone is entitled to comment in a discussion. The lack of such a connection does not automatically make one a sock puppet. But this is something to consider when evaluating one may be using sock puppet accounts.

 

User A creates an article. User B is there to mark it as patrolled, expand it, or make other edits to it that make it seem more like a valid article.

User A starts a discussion. User B is there to comment in favor of User A's cause, though User B's contributions show no signs they are otherwise interested in that or any similar causes, or that User B even participates in discussions regularly.

An article User A created is proposed for deletion. User B "votes" to have it kept, though they have never worked on that article, and they rarely participate in AfD otherwise.

In any of the above scenarios, the same pattern is observed between Users A and B on multiple occasions. This may raise some suspicion that either Accounts A and B are operated by the same person, that the operators of these accounts know each other personally, or that they have a relationship with one another on Wikipedia.

If indeed such a pattern is observed, trying to observe if other signs are present may be worthwhile at this point.

If two accounts have edit histories that consistently show sets of edits made around the same time, one after the other, just minutes apart, but never at the exact same time, this may be reason to believe that they are operated by a single user who is logging onto one, editing, logging off, and then logging onto the other. It is also possible for one person to use two browsers, one logged in to one account, one logged into the other. In either case, these edits are occurring around the same time.

However, this is not definitive proof. This may be pure coincidence, as the chronology of one's edits is a reflection of the time one has available to make them. For example, these two editors may get home from work at around the same time on a regular basis, and both go straight to Wikipedia. A lot of editors have more (or sometimes less) time to work on Wikipedia on weekends, holidays, or other time outside of common business hours (which vary by location around the world, though days of the week are mostly consistent everywhere, see Days on and off below).

So if two accounts are always editing around the same times, and rarely or never at different times of day, this is not an initial reason to suspect sockpuppetry from the beginning, but it can be taken into consideration—especially when a checkuser inquiry has confirmed that the two accounts are operated from the same computer or connection, but one or both of the users claim they are different people who share that computer or connection.

The user may or may not provide hints regarding where they live on their userpage and by some of the edits they have made, which are useful in determining the country and time zone where they live.

 

While it may not always be so easy to determine sockpuppetry based on the times of day one edits, as this can be tricky based on common habits of society and different time zone, a better indicator could be the actual days when one edits, or does not.

If any account is used only certain days of the week (such as weekends), this may indicate the user is free only on those days. Likewise, if an account is consistently not used on any given day of the week, this may indicate someone who is consistently busy that day. This is so common that you cannot automatically call someone a sock puppet if their days on or off match that of another account.

If there is an extended period of time in which one edits or does not, this may indicate either that the user had nothing worthwhile to contribute during that time, or it could indicate that the user simply was too busy or otherwise unable to edit. It is possible that one could be editing either more or less around the time of either a major holiday observed by a large population or a personal vacation. Of course, it is important to be aware that different places and groups of people have holidays at different times on the calendar, so a holiday for one society could be a common time for another.

Like in the above example, this does not confirm sockpuppetry, but it can help either to rule it out or to rule it in pending other signs.

While it is possible that an editor may be using one account almost daily and another on rare occasions, the fact that an account is used infrequently does not automatically make it a sockpuppet. There are many real people who seldom edit Wikipedia, and may have some days or weeks in which they make a dozen or more edits, and then may go for weeks or months at a time without any editing. Wikipedia has no minimum number of edits that any active account must make, and an account is allowed to lie dormant for an unlimited period of time, and then resume editing. There are a variety of reasons a regular editor may take a break from editing, which may include work obligations that keep one busy, vacation, holidays, health problems, writer's block, exams and academic obligations or simply finding a lack of articles needing editing.

There are also legitimate reasons for operating a second account with occasional usage; e.g., one may want to make occasional good-faith edits on an embarrassing or otherwise controversial topic that they do not want on their edit history, such as pornography or politics.

There have also been accounts, often single-purpose accounts, that have been created to be used for only a short period of time, making fewer than 50 edits, then later abandoned. In some cases, these have been identified as sock puppets. But having such few edits is not automatically a sign of sockpuppetry.

The user with few edits may simply be a newbie who will one day have many more contributions. It may be someone who tried out Wikipedia, then gave up interest. It may be someone who only planned to make a few contributions ever. Or it may be one who only makes occasional contributions.

If an account has few edits, sockpuppetry should only be suspected if the user's behavior is disruptive and it appears to be the work of one who has familiarity with Wiki formatting.

 

Not all but many users edit at least some articles on topics likely to be known only to those in a particular city, metropolitan area, or region. Some users go as far as stating on their userpage where they live, and there are editors dedicated to working on articles on their hometown (such as those on local politicians, celebrities, sports teams, schools, businesses, infrastructure, etc.). There is nothing wrong with any of this.

An individual secretly operating multiple accounts probably would not be so overt that they would use two or more accounts to edit articles on the same locality, unless they are involved in an edit war on a local article. More likely, Account A may reveal the user's real home, and Account B may pretend to be a different person living in a different place by editing perhaps a few articles pertaining to another area (perhaps some place where they have lived or visited before). It is however possible in the event of meatpuppetry that if one editor supports another, both may have some of the above signs of living in the same area.

Just because two or more usernames are those of people who live in the same place does not automatically mean they are operated by the same person, or that they even know each other. And even if two people who know each other personally both comment in the same discussion or otherwise support the same cause, it does not automatically mean one has influenced the other. Still, geography can be a sign when combined with other factors.

In a major city with a population of several hundred thousand or more, there are likely thousands of Wikipedia editors, many of whom are highly dedicated and make almost daily edits. The typical editor may or may not know who other editors are, even if they are their co-worker, classmate, next-door neighbor, or a member of the family sharing a household. Therefore, geography alone is not a reason to automatically suspect sockpuppetry. It can only be used to continue to rule in an already existing suspicion.

If a checkuser inquiry is performed, this will likely reveal if two users accounts are based in the same area, since many IP addresses are bound to certain cities or regions. Possibly, if two accounts operated by the same person or family members supporting one another's cause have both edited while traveling, and such a pattern can be seen, this could be used to determine sock or meat puppetry.

It is possible that you may find that one who is pretending to live in an area where one does not live and has never lived may edit some article pertaining to that area, but not doing a good job of it.

For example, one who was briefly in a place (such as a tourist or business traveler) may edit articles on subjects of interest to visitors to that area, including hotels, tourist attractions, and the airport, but will never write anything about the day-to-day life of a resident in the place (such as local politicians, residential neighborhoods, schools, etc.).

One who lived in a place in the past, but does not currently live there or frequent the place may know about what life was like there in the past, but may not be up-to-date about it. The more time one has been removed from the area, the less up-to-date one will be. Additionally, one who is not in the area will not be able to take pictures of anything, and may not be able to read the local newspaper if it is not online.

Some sock puppet accounts will be created by one person pretending to be another, who like in the example above, is from another place, or is possibly of another gender, culture, nationality, or profession, just to name a few.

For example, a Caucasian person may pretend to be African-American. A man may pose as a woman. An Irishman may act like an Australian. A German may pretend to be Italian. A French person may pretend to be Mexican. Or an accountant may want others to think they are a physicist.

Given the limit of knowledge one can have, it'll take a really good actor to pass themself off as someone else like this.

The "actor" may make frequent edits to articles that they perceive are of interest to such a person, and may even go to the extreme of creating a user page describing such a person as if it were all real.

But one who has not studied or deeply experienced the real thing will not be likely to know anything above the surface. For example, while a real chemist would know in-depth about many concepts in chemistry, a layperson may just know about the periodic table of elements.

In any case, a genuine person may create lengthy articles from scratch and make complex edits pertaining to their personal truth. An actor would make very minor edits and create nothing more than stubs. And the actor will be missing edits on a lot of information known to a genuine person fitting that description.

And while one who uses a single account to make all their edits would probably have made edits to at least several areas of interest, a sock puppeteer who has multiple accounts and splits their contributions may use different accounts for different areas of interest, and would therefore have a limited range of topics they have edited.

Good-faith editors are for Wikipedia, while sockpuppets are for eroding Wikipedia in one or more ways. Good-faith editors will most likely want to establish themselves in the Wikipedia community. This means that they participate in discussions, cooperate to improve articles, give feedback to Wikipedians via venues such as peer review, and generally perform activities that seal their reputation as a productive editor.

However, sockpuppets want to disrupt Wikipedia. It is difficult to willfully establish one's self into a community or project that one despises or wishes to harm, even if not in a genuine manner. In addition, it draws attention to them, the antithesis of their goal of not driving any attention to them. Thus, sockpuppets will usually seclude themselves from the community, making only minor edits in a limited range of areas and avoiding cooperation if possible.

Many people have their own unique styles of writing or editing, or other habits. If edits made from separate accounts reflect such a common style, this may lead to suspicion that the accounts are operated by the same person. It is possible indeed that the accounts may be operated by the same individual. But it is not uncommon for people to learn from the writing styles of others, or copy the techniques used by other editors often not known to the editor in question. Different users editing in a similar fashion may be reflective of what an editor learns simply from reading other articles.

There is a correct way to spell every word in our language. Most people know how to spell it correctly, and good writers will endeavor to do so, or even possibly use spell checks to be sure of this. Many words are commonly misspelled, and they may be misspelled a variety of different ways. The same is true for punctuation, grammar, and other standards when it comes to writing.

There are some common errors that may be visible in many editors. For example, many writers confuse it's (= it is) and its (= belonging to it). Just because the same error is seen often does not automatically mean that the accounts are operated by the same person.

But if there are many common errors repeated a lot by two or more accounts along with other possible signs, this could be an indication of possible sockpuppetry.

When multimedia, such as pictures, are uploaded, all have a source filename that becomes invisible to most users as it is renamed to a destination filename. But it can still be viewed by some administrative staff. If two Wikipedia usernames have been used to upload files from the same computer username, either two people are sharing the same user account on the computer or sockpuppetry is occurring.

Some editors may attempt to masquerade as multiple users by constantly changing IP addresses, either by changing that of their own connections, or by editing from many locations. IP addresses are frequently bound to a region, so if all the IP addresses used come from the same area, this may be cause to believe all edits have been made by the same person. Such suspicion must be discounted when the article is on a topic not likely known to those outside the region, as only those living within the region would have interest in editing.

On the other hand, some editors use rerouting services to post from a variety of IPs located all over the world. This in itself can be a giveaway when the target article is only likely to be of interest to editors from one region. A few overseas IP editors may well be legitimate (e.g. expatriates or wandering editors), but if the IP editors start to look like a 'flags of all nations' collection, there may be something fishy. Using traceroute on IPs can provide more information—addresses like "ip-anywhere.net" or hosting services are sometimes used by rerouting services.

Also, there is no prohibition on editing non-protected articles using an IP address. If one makes frequent good-faith edits without an account, and the result is a large number of IP addresses being attributed to their edits, no violation has occurred.

Additionally, one who has an account may sometimes forget or be too lazy to sign in some of the time, or may be unable to for technical reasons, and therefore make IP edits. This is not considered sockpuppetry.

The session ID in the browser cookies, as much as the web browser's user agent, which can be seen by CheckUsers can provide clues about sockpuppetry.

When it is obvious that an account is being used for a single disruptive purpose, there may be reason in some cases to believe that its operator also has an account regularly used for productive editing, and its user does not want their regular account to be tarnished with the malicious behavior being performed by the second account. This may include vandalism, disruptive editing, personal attacks, hoaxes, edit warring, POV pushing, or gaming the system.

In all of the above cases, if the account that is used for such a purpose appears to show good knowledge of wiki usage beyond that of a newbie, it is a strong possibility that its operator does have another account. Depending on the situation, a checkuser inquiry may or may not be justified, and otherwise detecting the main account of such a user may or may not be easy or possible.

In the event that learning the regular account of such a user is difficult or of questionable justification, it is more appropriate simply to block the problematic account, either temporarily or permanently, depending on the situation. A common IP address does not automatically prove the account is operated by the same person – it may be someone who is simply using the same person's computer or connection.

Many Wikipedia editors are active not only on Wikipedia, but also on sister projects, Wikipedias in other languages, and non-Wikimedia sites such as Facebook, Twitter, blogs, other wikis, or other public venues.

When this is the case, they may or may not have usernames identical or similar to their Wikipedia name. Usernames on Wikimedia are global, so a user editing another Wikimedia project site with the same name as an account on Wikipedia is most definitely the same person. On other sites unrelated to Wikimedia, care should be taken not to mistakenly connect innocent users to ones on Wikipedia. If the username is a real human name, it is possible that another person shares the same name, even if that name is relatively uncommon in the overall population. If it is a human name followed by a series of identical digits, this is more likely. But if this is the case, or even if it is not a human name, it is possible that the user on that site is a copycat, or simply pure coincidence.

Another factor to look at is knowledge or behavior. Is the user on other sites writing about an identical subject? Are they trying to promote themself, a friend, or a personal point of view? Are they trying to invent a new concept, promote a new word, idea, or otherwise get the word out about something original? If the same information that is otherwise unknown or unpopular is being described on multiple sites, this could be an indication it is coming from the same person, even possibly one who is otherwise trying to cover this up.

Please note that having any number of accounts or engaging in any type of behavior on any other sites, including sister projects or Wikipedias in other languages is not a violation of English Wikipedia policy. Each site has its own guidelines for its users, and it is the responsibility of the operators of other sites to handle those who violate them. Many other sites actually allow behaviors that are not permitted on Wikipedia, sometimes including sockpuppetry, publishing original thought, self-promotion, or personal point-of-view. At issue is only one's behavior on English Wikipedia and when one person is using multiple accounts on Wikipedia or when one Wikipedia editor is supporting another's cause to get the word out.

If two separate accounts are being used on Wikipedia each to introduce something new on Wikipedia, but a single account on some other site is being used to introduce both those new things, this may be a sign that all of those accounts are operated by the same person.

Being a chance eye witness to a person in a public location logging in and out of multiple accounts may reveal a sock puppeteer. It is important to be aware that there are many legitimate reasons for using multiple accounts, so if this does occur, and you see the names of the accounts, examine the nature of the edits to determine whether or not any violation has actually occurred. If the edits made by the accounts around that time are in good faith and comply with the rules, no negative action shall be taken.

Usually, an editor who always acts in good faith and follows the rules is unlikely to be suspected of being a sockpuppet or operating sockpuppets. Even if one operates two or more accounts (which in some cases is permitted), provided that no rules are broken, suspicion is not likely. Only when one's editing becomes problematic in some way is sockpuppetry likely to be suspected.

The majority of sock puppet investigations involve one or more accounts with little or no edit history, so accounts that have long edit histories are less likely to become the focus of such an investigation. It is not uncommon for an investigation to include one account with a long edit history, and one or more others with little or none.

The following signs are frequently used to trigger a sock puppet investigation:

When an account is determined to be a single-purpose account, and is used for some purpose that in one way or another violates Wikipedia policy or is otherwise disliked, this may be a trigger to an investigation.

If the single-purpose account appears to be used for editing that is not that of a WP:NEWBIE, this will likely raise suspicion that it is the bad hand of someone with a good hand and bad hand account. This includes accounts that are being used only to vandalize, propose articles for deletion, comment in existing deletion or other discussions, or to support another user's cause(s).

If an account's first edit or series of edits are the creation of a page in any namespace, the participation in a discussion, or even proposing an article for deletion, no rules have been broken. Everyone has to start somewhere. Many people decide to create an account after a long history of IP editing. Sometimes, the decision to create an account comes when one must do something that only a registered account can do, such as creating a page. It is not uncommon for the first edit of an account to be a page creation.

One of the most common triggers of a sock puppet investigation is a user not editing in a civil manner. This is because incivility creates an offended party who is likely to report it. Since uncivil editing leads to being blocked, an editor opening a new account, who appears to be both uncivil and sophisticated or experienced, will normally immediately come under suspicion of editing in bad faith as a block evading sock puppet. This is particularly true if an editor in a dispute has recently been blocked, and suddenly a new uncivil user appears in the dispute. An account which appears to exist for the primary purpose of making personal attacks on other editors might also be the bad hand of a pair of good hand, bad hand accounts. This type of sock puppet is used by an editor in bad faith, to break rules with one account, knowing it will eventually be blocked, intending to keep the other clean account. Uncivil editing alone is not conclusive proof that an account is a sock puppet, as some editors have difficulty in following this principle, and it is possible for a new uncivil editor to join a discussion at any time.

 

A lot of vandalism is committed by unregistered or newly registered users who seldom if at all edit Wikipedia, but are just being silly or who otherwise do not know better, or are otherwise making some test edit. But some vandalism is committed by those who are experienced users who know the system well.

Certain types of vandalism take good wiki knowledge and planning. This includes mass vandalism (using a bot or other program), vandalizing a protected article, moving an article (page-move vandalism), or taking steps to cover up the vandalism so it goes unnoticed. Though not always, these acts are often committed by those using good-hand bad-hand accounts.

When there is an edit war in progress, sockpuppetry may be and is often suspected, especially if two or more accounts taking one side appear to be behaving in exactly the same manner with no evidence they are operated by two different individuals with no connections. In particular, if the three revert rule is broken, and a block is required as a result, an investigation may take place to determine if the violator is operating any other accounts.

It is common during a discussion for one or even several editors to simply say "per [other editor]." This in itself is not a sign of sockpuppetry, and in fact, it could be a sign of unanimous consensus. But it is of particular concern if an account, or even several accounts were formed after the discussion began, and take the same side.

The same is true in an edit war if more than one account were formed after the beginning of the discussion.

Vote-stacking may also be suspected when it would seem obvious to most that the consensus should be one way, but there are so many names saying something else.

If, for any reason, an account must be blocked or a user must be banned, since the entire IP address or range is affected, an investigation may take place to determine if other accounts may be using that address or range, and whether or not they are operated by the same individual.

• Wikipedia:Obvious sock is obvious
• Wikipedia:Consequences of sockpuppetry
• Wikipedia:Lurkers
• Wikipedia:The duck test
• Wikipedia:Witchhunt