The title gets it mostly. On EE.SE we have recently given out a few suspensions and in almost every case they attempted to make a sock puppet and continue with their previous behavior.

If a flag had been raised for moderators of the existence of the account we could have been watching and prepared for the repeating behavior instead of reacting after many users were harassed again.

The basic process would be:

  1. User X from IP A is suspended.
  2. User Y from IP A is created during suspension of User X.
  3. Flag Moderators of the presence of User Y with relation to user X.
  4. Moderators monitor and have advantages if users continue unacceptable behavior/issues and use super secret moderator stuff.

A more broad tab notifying of coinciding users based on this alone might be interesting but is secondary to this.

  • 3
    For smaller/beta sites, why not have a notification for all users who have shared an IP with another, never mind suspensions. To make them less annoying, keep them on a separate page, linked to from /admin/links. A few weeks ago, we had something on chem.SE which we just happened to see. It could have easily slipped our notice. Jun 29, 2012 at 14:08
  • 1
    Regarding my previous comment, a configurable (mods can switch on/off) Community auto flag would be ideal for this. Jun 29, 2012 at 14:28
  • 1
    @ManishEarthwantsmorewaffles Yes, a lot could be done here with more thought into the topic, lets see what devs want to do :)
    – Kortuk
    Jun 29, 2012 at 14:29
  • 1
    Related: Implement some form of browser fingerprinting to help suss out socks. Notifying of new accounts with the same IP is a better, less invasive solution to the problem, I think.
    – user149432
    Jul 1, 2012 at 23:02
  • @MarkTrapp browser fingerprinting is probably more thorough, but ip address seems super easy to do. Both might be effective ways to accomplish this task.
    – Kortuk
    Jul 1, 2012 at 23:48
  • 1
    Or even a community flag when an email address matches an existing account. Anything would help.
    – W5VO
    Aug 13, 2012 at 20:20

2 Answers 2


I like this idea. I've only been at this a few days, but I've already had to deal with a couple users who've created multiple sock puppet accounts to work around either a suspension or the automated question-asking ban. It took a bunch of work to suss them out, and such a notification would have made it immediately obvious that these were new accounts by the same person attempting to work around a ban or suspension.

To counter Aaron's doubts about the problems of shared IP addresses, these would just be notifications or Community user flags, which are easy to glance at and dismiss if not relevant.

Also, I think the frequency of these notifications would be less than he anticipates. At a given moment, how many users are suspended or banned from asking questions? How many of those users are on shared IP addresses? On those shared IP addresses, how frequently are new accounts are being created? Somehow, I think we'll see fewer of these notifications than Community's "too many comments" or "multiple deletions in a short period of time" flags, and we deal with those just fine.

The time saved from not having to track down new accounts from these repeat offenders, not to mention the garbage questions, etc. that the community won't have to see, in my opinion would offset the minor inconvenience of having to dismiss false-positive flags.

  • Yes, on our site we have only had one person receive a 7 day suspension and only given out 5 or 6 day long suspensions, if SO can handle the increase flag weight the other sites can for sure.
    – Kortuk
    Jun 29, 2012 at 14:55
  • 9
    I'd like this done in a way that our 10k+ crowd can see the flags as well, since (on Stack Overflow) it would be a very common system raised flag. Let the 10k folks investigate and counter flag so we have an easier time weeding through false positives. ISPs like Airtelbroadband.in tend to crowd as many people as possible behind their NATs, so it would definitely create quite a bit of noise.
    – user50049
    Jun 30, 2012 at 7:40
  • 1
    Yes. It may need to use HTTP_X_FORWARDED_FOR headers to cope with mobile providers' NATs (which are generally well-behaved and add that header). Jun 30, 2012 at 17:37
  • @TimPost Hmm, that is interesting. I am not sure if I want them having to worry about duplicate accounts, but you might be correct here, it might help.
    – Kortuk
    Jun 30, 2012 at 17:49

We on WordPress Stack Exchange have a user whose 11th sock puppet I had to remove just two days ago. There are other users with up to four sock puppets but this one we have to watch very carefully – and manually. Daily.

It would really help to get a notification. Some users will never stop to open new accounts and our time should not be wasted on tasks so easily to automate. And the earlier we get the notification the faster we can delete their questions, preventing other users wasting their time with answers.

  • 2
    We on WordPress Stack Exchange have a user whose 11th sock puppet I had to remove just two days ago. Weak, Programmers wins once again: One user, 50 socks...
    – yannis
    Aug 5, 2012 at 21:49
  • @YannisRizos We are on the order of 20 sock puppets right now, but they are going up by 2-3 per day.
    – Kortuk
    Aug 14, 2012 at 13:00
  • @YannisRizos I hope your sock puppet is keeping up the pace - we're at 53
    – W5VO
    Aug 24, 2012 at 16:59
  • @W5VO 60 + the main account (+ a couple suspected clones I didn't bother merging). But has gone silent since a couple of months ago, so yours has a very good chance of winning, if (s)he keeps at it.
    – yannis
    Aug 24, 2012 at 17:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .