Cases of (not too well concealed) sockpuppetry can often be characterized by different accounts using the same IP and more or less massively upvoting each other in shorter or longer periods of time.

However, the same pattern of activities can arise, when a group of people working at the same place for example contributes to an online community, as for example whole universities may use a single IP, people may show each other and talk about their contributions in the real world, etc ...

How can one discern cases of illegal sockpupettry from a (small) group of people legally contributing while working together at the same workplace (company, university, etc)?

What complicates the issue in our community is the fact, that pseudonymous contributions are intentionally allowed and supported, such that it is generally not possible to map each contributing member to a real name.

What can be done to allow and support people contributing from a common workplace who potentially share a single IP, while discouraging and preventing sockpuppetry?

  • 1
    What does "illegal" sockpuppetry mean?
    – Air
    Commented May 1, 2015 at 22:08
  • 1
    @Air by illegal sockpuppetry I mean the use of multiple accounts in a way that is against the rules of most online communities. Commented May 3, 2015 at 10:32

3 Answers 3


I'll see if I can answer from a Stack Exchange perspective without giving any privileged information away.

If you can tell if a bunch of accounts are coming from the same IP and voting for each other, in the first instance if you can't really tell if they are sock-puppet accounts or co-workers/class mates. So rather than diving straight in with bans or account deletion you could send the participants a "targeted votes" message. Explain that they should be voting on the content not the user and they should be voting on content as they come across it on the site. If you can, invalidate the votes and annotate the accounts to explain to the next moderator what you've done.

If the behaviour continues, then issue suspensions and account deletions.

There are other things you can do to see if two or more accounts are being run by the same people, for example, textual analysis of their posts. If they are different people their posts will use different words and phrases. It's very hard to change your writing style so this is hard to fool.

However, it's probably not worth going to this level of analysis.

  • 1
    If the troll is persistent enough, recognizing them by the contents of their posts won't require any special tools. For several years around a period about a dozen years ago one site I frequented was plagued by a recurring troll who kept dialing in from new ISPs all over the country to avoid blocks. When we talked IRL one of the moderators said it had long since gotten to the point that after reading two or three posts from a new account she could recognize the trolls pattern of posting, apply a ban, and get a few days peace on the part of the board he griefed. Commented May 3, 2015 at 3:26
  • 3
    @Dan - trolls are different and often easy to spot as they want the attention. Socks can be harder as they want to go undetected.
    – ChrisF
    Commented May 3, 2015 at 7:25


Sockpuppets, meat puppets and collaborating cliques can all result in the same harmful effects. So there's not a lot of value in trying to differentiate between them, since you'll need to mitigate the effects of all of them.

Which is what you should be doing in the first place: mitigating the negative effects. Look for patterns in behavior that are far outside the norm and squelch them. You can use things like IPs/networks, timestamps, names, etc. as input into this, but only as a way of strengthening signals that've already been identified as problematic.

Also be aware that a truly determined puppeteer can work around just about any measures you put in place. A puppet that looks and behaves identically to a well-behaving user on your system will be extremely hard to suss out...

  • 2
    Someone should see if Randall ever got that working...
    – RubberDuck
    Commented May 2, 2015 at 14:23
  • @RubberDuck Even if Randall didn't, Jeff and Joel did. It's called Stack Exchange. What do you think review audits are? Commented Jan 9, 2016 at 17:55
  • @tepples not bots that leave constructive comments, that's for sure...
    – RubberDuck
    Commented Jan 9, 2016 at 17:59

I have come across this scenario in a forum I run. Typically someone posts the first post asking for opinion on a new product, etc. Then they register multiple other accounts (same Ip, emails which are obviously related), etc.

As was mentioned by ChrisF, its impossible to build a perfect automated solution to detect this with certainty.

Since we can't automate it, our solution was to develop tests which spotted patterns based on some pre-defined indicators (e.g. business rules), and insert the topic into a queue for moderator manual review.

If new patterns are found during the manual review, we have them added to the set of pre-defined indicators. So this way, the system theoretically becomes more efficient over time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.