Yes, suspected means it's based on behavior, whereas confirmed means it's been checked by a CU. However, if I had thought there was sufficient evidence to block when the report was filed at SPI, I would have done so. Of course, you are entitled to disagree with me, but as I believe a CU said on the noticeboard, if there was additional evidence, it should have been presented to me. But, I'll dispense with that nicety if you would just be kind enough to give me more detail as to what you're basing your conclusion on, i.e., diffs of the suspected puppet compared to diffs of the master or a blocked puppet. That would be appreciated. BTW, it's nice to meet you. -)