Help:Special Investigate

Note: When you edit this page, you agree to release your contribution under the CC0. See Public Domain Help Pages for more info.

An introduction to Special Investigate

The Special:Investigate page in MediaWiki is a tool designed for users in the checkuser user group. It investigates and manage potentially abusive behavior, such as sockpuppetry (where one user operates multiple accounts) and other forms of disruptive editing.

The special page is a part of the MediaWiki extension called CheckUser , which provides detailed information on user activities to help detect and prevent abuse on the wiki.

Key features

Input form

You can add multiple users in the input form

• Multi-user lookup - You can now add multiple usernames or IPs into a single input field, allowing you to investigate several accounts at once.
• Efficient results - Although adding more usernames may slightly increase the time it takes to fetch results, the process remains reasonably fast and efficient for most cases.

Account information tab

The account information tab

The Account information tab provides a quick overview of an account's activity across different wikis, showing:

• Active wikis - Where the account is active.
• Block status - If the account is blocked on any wiki.
• Special permissions - Any special rights the account holds.

Unlike CentralAuth, this tab allows you to check information for multiple users at once.

No information is shown for IP addresses.

IP addresses and user-agents tab

The users and IP addresses tab

The IP addresses and user-agents tab provides a detailed view of all IP addresses and user-agent information linked to a specific account.

This tab displays the following information in a table format:

• Username - The username of the account being monitored.
• IP address - The IP address from which the user accessed the account.
• User-agent - Details about the device and browser the user was using at the time of access.
• Date range - The time period during which the user was active from the specified IP address and user-agent.

Sorting behavior also applies:

• Sortable columns - If all data fits on a single page, you can sort the table columns by clicking on the column headers.
• Pagination - If the data spans multiple pages, sorting will be disabled to ensure smooth navigation across pages.

A few things that can be done on this page:

Highlighting identical values across cells

Highlighting cells with similar IP addresses

Highlight cells with similar user-agents

We understand that tracking patterns like shared IP addresses or user-agent strings are important. To make this easier, you can now highlight cells with identical values in the table.

How it works:

• Hover to highlight - Simply hover your mouse over any IP address or user-agent string in the table. All other cells with the same value will automatically be highlighted, helping you spot duplicates at a glance.
• Sticky highlights - Want to keep the highlights visible while you scroll or move to a different page? Click the pin button () at the top right of the cell. This will lock the highlights in place, even if you navigate through multiple pages of data.
• Removing highlights - To turn off the highlights, just click the pin button again.

A few key things to note:

• Only one value can be highlighted at a time.
• Highlights will persist across different pages of data.
• The pin button becomes visible when you hover over the cell.

Tracking users from an IP address

When investigating user activity, it's common to explore connections between usernames and IP addresses. To make this process easier, there are two new features available:

• View all IP addresses for a user:
  • How it works - When you’re looking at a username in the table, click the ellipsis button () next to it. You'll see an option called Show all IPs of this user.
  • What it does - Selecting this option will display all the IP addresses that the user has used, adding this information to the table for further analysis.
• View all users on an IP address:
  • How it works - Similarly, when examining an IP address, click the ellipsis button () next to it. You'll find an option called Show all users on this IP.
  • What it does - This will show you all the other users (both registered and unregistered) who have accessed the site from this IP address, adding their activity to the table.

• 
  Show all users on this IP adds other users using that IP address to the table
• 
  Show all IPs of this user adds other IPs being used by this user to the table
• 
  Screenshot of the table after the Show all users on this IP was clicked

Whenever a user clicks on either of these options above, a new entry will be automatically created in the CheckUser log. The reason recorded in this new log entry will be identical to the reason provided in the initial form.

Copying wikitext for table contents

Demo of the wikitext copy feature

To copy the wikitext for a table, follow these steps:

• Navigate to the bottom of the page - Scroll down to the bottom of the page where you want to copy the table content.
• Locate the copy option - Look for the option labeled "Copy". This is usually found near the table or in a designated section.
• Click the copy button - Click on the button or link to copy the wikitext. This will allow you to paste the content elsewhere, such as when logging a case on the checkuser wiki.

By copying the wikitext, you can efficiently transfer table data for your documentation or case logging needs.

Filtering out non-sock accounts

Search filters for data on the Users and IPs tab

To effectively identify and remove users who are not sockpuppets, follow these steps:

• Hide users:
  • Identify and exclude non-sockpuppet users using the Hide the following users or IPs option. This simplifies your view.
• Adjust time duration:
  • Narrow your data by setting a specific timeframe with the Duration filter.

Timeline tab

Timeline tab feature to compare user activities

The Timeline tab is designed to help you track and compare the activities (potential sockpuppets) of different users more efficiently. It displays the following:

• New page creations
• Edits to existing pages
• Various log actions (e.g., login times, user role changes)

How to use it:

• Select the users to compare.
• View their activities in chronological order.
• Look for patterns like:
  • Editing the same pages
  • Being active at similar times

Blocking

New block page for Special:Investigate

The Special:Investigate page helps manage user and IP blocks.

Some key features include:

• Select users/IP addresses - Choose who to block.
• Block options
  • Talk page - Prevent them from editing their talk page.
  • Reason - Provide a reason for the block.
• Add notices
  • Prepend - Add a notice at the top of the user or talk page.
  • Append - Add a notice at the bottom.
  • Replace - Replace the page content with the notice.