NormalguyfromUK (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• Andrewtopg (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Sock recreating the deleted works of the master. UtherSRG (talk) 15:34, 23 June 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Confirmed Courcelles (talk) 02:31, 26 June 2023 (UTC)[reply]
•  Blocked and tagged. Also throwing in Mozziko (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) as another  Confirmed sock. Closing. --Blablubbs (talk) 09:51, 28 June 2023 (UTC)[reply]

• Andrewtopg (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Based.shqiptar.frompirok (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

obvious behavioral sock - early edit overlap on obscure article after sockmaster blocked https://sigma.toolforge.org/editorinteract.py?users=Andrewtopg&users=NormalguyfromUK&users=&startdate=&enddate=&ns=&server=enwiki https://en.wikipedia.org/w/index.php?title=East_German_uprising_of_1953&diff=prev&oldid=1161263064 is a INFOBOX edit which is NormalguyfromUK's favourite gnoming.

creation of tendentious Albanian article https://en.wikipedia.org/w/index.php?title=Draft:Operation_Breakthrough_(Military_Invasion)&action=history with magic instant editing of a draft article from Based.shqiptar.frompirok (these socks/meat puppets usually claim to be following each other so they find drafts, but there's no excuse for Based.shqiptar.frompirok to have found this so quickly)

Immediate alibi/ Excuse set up for meat puppetry/IP sharing - https://en.wikipedia.org/w/index.php?title=User_talk:Andrewtopg&diff=prev&oldid=1161439034 Awlof (talk) 20:41, 23 June 2023 (UTC)[reply]

In addition to the extremely obvious naming similarities, Based.shqiptar.frompirok has now recreated as draft 1949_Anglo-American_invasion_of_Communist_Albania https://en.wikipedia.org/w/index.php?title=Draft:1949_Anglo%E2%80%93American_invasion_of_Communist_Albania&action=history. This is NormalguyfromUK's preferred name for Operation Valuable and some of the last actions of NGfUK were undiscussed moves of that page https://en.wikipedia.org/w/index.php?title=Operation_Valuable&diff=prev&oldid=1160443046 to the title now being created, as well as earlier undicsussed moves to this title in March https://en.wikipedia.org/w/index.php?title=Operation_Valuable&diff=prev&oldid=1147547886

There are large cut and pastes being made into the draft from Operation Valuable source- https://en.wikipedia.org/w/index.php?title=Draft:1949_Anglo%E2%80%93American_invasion_of_Communist_Albania&diff=prev&oldid=1163993258

There are the same extremely obscure additions being made to the new infobox - https://en.wikipedia.org/w/index.php?title=Draft:1949_Anglo%E2%80%93American_invasion_of_Communist_Albania&diff=prev&oldid=1163996942 - that NGfUK was making to Operation Valuable back in March https://en.wikipedia.org/w/index.php?title=Operation_Valuable&diff=prev&oldid=1147352075 Guavausher (talk) 17:05, 7 July 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• the behavioural evidence here and below suggest he definitely is. Proxies/meatpuppetry. 37.245.41.140 (talk) 05:30, 10 July 2023 (UTC)[reply]

Special:Contributions/37.245.41.140 is an IP sock of User:Orchomen. Mztourist (talk) 06:55, 10 July 2023 (UTC)[reply]

• The CU data indicates that Based.shqiptar.frompirok is  Unrelated RoySmith (talk) 12:30, 9 July 2023 (UTC)[reply]

  Closing per evidence below. Ivanvector (^Talk/_Edits) 17:08, 3 August 2023 (UTC)[reply]

• Fantasticer (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: original case name)

• AcEagle12 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• NormalguyfromUK (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Hello. I'm not completely sure which account is the sockmaster but I am confident all three are run by the same individual. Fantasticer was indefinitely banned today. I had reverted an edit this user made earlier today as it was an unsourced addition and came with an oddly threatening edit summary. Three hours later, AcEagle12 restored the edit albeit with "sources" but then promptly self-reverted with another strange edit summary. Both accounts have edited exclusively on the same topics.

NormalguyfromUK (originally Albanian 7) was indefinitely banned a few weeks ago. This user's first block was on 30 January 2023. The AcEagle12 account was created on that day and edited the same talkpage.

NormalguyfromUK and Fantasticer are already indefinitely blocked but AcEagle12 is not and is now apparently going to be more active, given today's edits including the creation of a sandbox. I'm not sure whether or not CheckUser is needed here.

Thank you. --Local hero ^talk 17:12, 7 July 2023 (UTC) --Local hero ^talk 17:12, 7 July 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Clerk assistance requested: - Please move to Wikipedia:Sockpuppet investigations/NormalguyfromUK, which is currently active. Bbb23 (talk) 15:16, 8 July 2023 (UTC)[reply]
•  Clerk note: Moved. qedk (t 愛 c) 12:26, 9 July 2023 (UTC)[reply]
• The CU data indicates both of these are  Unrelated, but I wouldn't be shocked if there were proxies in use to obscure the true identity. RoySmith (talk) 12:42, 9 July 2023 (UTC)[reply]

  Closing per subsequent investigations. Ivanvector (^Talk/_Edits) 17:09, 3 August 2023 (UTC)[reply]

• GokuRose (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Based.shqiptar.frompirok (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

New account immediately editing Albanian People's Army and adding obscure Albanian sources [1] and the usual greater glory of Albania POV [2]

This page is a favourite of NormalguyfromUK and the Based.shqiptar.frompirok sock. https://en.wikipedia.org/w/index.php?title=Albanian_People%27s_Army&action=history.

Like both NormalguyfromUK and Based.shqiptar.frompirok, GokuRose likes to use "improved/improvement" in edit summaries

GokuRose

• https://en.wikipedia.org/w/index.php?title=Melissa_Mars&diff=prev&oldid=1164093078
• https://en.wikipedia.org/w/index.php?title=Anastas_Ngjela&diff=prev&oldid=1163430371

NGfUK

• https://en.wikipedia.org/w/index.php?title=Battle_of_Mashkullor%C3%AB&diff=prev&oldid=1156535551
• https://en.wikipedia.org/w/index.php?title=Battle_of_Mashkullor%C3%AB&diff=prev&oldid=1156530700
• https://en.wikipedia.org/w/index.php?title=Albania%E2%80%93Yugoslav_aircraft_incident_(1967)&diff=prev&oldid=1155069304

BShfP

• https://en.wikipedia.org/w/index.php?title=Battle_of_Mashkullor%C3%AB&diff=prev&oldid=1156530700
• https://en.wikipedia.org/w/index.php?title=Albanian%E2%80%93Ottoman_Wars_(1432%E2%80%931479)&diff=prev&oldid=1123973119

On wikimedia commons GokuRose uploaded this file at 17.11 on 7 July *https://commons.wikimedia.org/wiki/File:Collage_from_the_1949_Anglo_American_invasion_of_Communist_Albania.jpg

• https://commons.wikimedia.org/wiki/Special:Contributions/GokuRose

Only five minutes later At 17.16 on 7 July Based.shqiptar.frompirok added the file to their current recreation of NormalguyfromUK's repeated attempted page move at 1949 Anglo–American invasion of Communist Albania

• https://en.wikipedia.org/w/index.php?title=Draft:1949_Anglo%E2%80%93American_invasion_of_Communist_Albania&diff=prev&oldid=1164033961 Guavausher (talk) 12:44, 8 July 2023 (UTC)[reply]

  I would like to point out 1 of your arguments, 1) I mostly edit Wiki articles/drafts about the Albanian People's Army and that I add " Based.shqiptar.frompirok (talk) 13:16, 10 July 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• GokuRose is  Confirmed See 23 June 2023 for Based.shqiptar.frompirok RoySmith (talk) 12:32, 9 July 2023 (UTC)[reply]

• Polalb 2 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Confirmed. Split from Wikipedia:Sockpuppet investigations/Illyrian5999 (Special:Permalink/1160612526). MarioGom (talk) 22:22, 12 July 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• KleovoulosT (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Illirus (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Let me start by saying that User:KleovoulosT was indefinitely blocked some days ago, on 14 July (block log). Now, the account was created on 12 June 2023 (CA), which is only a week after User:NormalguyfromUK was caught socking. Even though not much time has elapsed, three more accounts have been confirmed as sockpuppets of User:NormalguyfromUK since then, which shows that they continue to be active. User:KleovoulosT doesn't have many contributions (only 12), but the few they have are in the same topic area as those of User:NormalguyfromUK; namely military incidents involving ethnic Albanians. Furthermore, they were both interested in the casualties of the 2022–2023 North Kosovo crisis; see diff1 and diff2. If there is indeed a relationship, i don't think CU will provide certain confirmation, because it has already been used a number of times since 12 June; however, i don't know exactly how the tool works, and whether an account could pass undetected in the case that special focus wasn't given by the checkuser.

User:Illirus was created six days ago, on 13 July (CA), and has been editing in the same topic area as User:NormalguyfromUK. Their very first edit was to revert (diff) an IP's contribution from the beginning of the month (diff), by reinstating the phrase "Many were killed or captured" in an infobox of Albanian–Yugoslav conflict; the phrase was originally added by User:NormalguyfromUK when they created the article (diff). Even though only six days have elapsed since the creation of User:Illirus, there is already overlap in eight pages that were also edited by User:NormalguyfromUK. Even more interesting, 18 out of the 26 total edits made by User:Illirus are in those eight pages (EIA). Demetrios1993 (talk) 02:07, 19 July 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• KleovoulosT is oversight-blocked - I'm not party to the reason for the block, but I don't see any technical connection between them and the accounts in this case. Illirusis  Confirmed to Llaberia, who is in turn  Confirmed to NormalguyfromUK. Blocking both. Girth Summit _(blether) 12:40, 19 July 2023 (UTC)[reply]

• Based Person (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

User:Based_Person was created on 20 July (CA), which is exactly one day after the last sockpuppets of User:NormalguyfromUK were blocked; see the case from 19 July 2023. User:Based_Person is active in the same topic area that User:NormalguyfromUK (and former socks) was active, and even though only 11 days have elapsed since the creation of the account, their activity overlaps in 14 pages with that of User:NormalguyfromUK (EIA). It's actually 15 pages, if we also include an additional page edited by User:Illirus (EIA); the last confirmed sockpuppet of User:NormalguyfromUK. Demetrios1993 (talk) 02:32, 1 August 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Clerk endorsed - Looks likely to me. qedk (t 愛 c) 16:23, 1 August 2023 (UTC)[reply]

  Technically  Unlikely, and also  Unrelated to Based.shqiptar.frompirok who was identified in an earlier investigation, despite the username similarity. Geolocation is inconsistent, but Based Person consistently locates within one country while Illirus et. al. are never in that country, but bounce around throughout countries which surround it. I doubt that this shows intentional obfuscation, but technical data does not rule out meatpuppetry. However:

  Pringlesringles (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) is  Confirmed to Illirus. This account is  Blocked and tagged.

  -- Ivanvector (^Talk/_Edits) 17:02, 3 August 2023 (UTC)[reply]

  I think there's enough here to say their behaviour makes it suspected enough to block and have done so. Courcelles (talk) 20:05, 4 August 2023 (UTC)[reply]

  Tagged as suspected. Case closed. Courcelles (talk) 20:06, 4 August 2023 (UTC)[reply]

• Christopherschweinsteiger (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

The account was created recently on 4 August. Immediately after creation, they started editing Albanian-topic area articles (1 and 2), compatible with the sockmaster's area of interest. They also edited the article Anglo–American invasion of Communist Albania, where two blocked socks of NormalguyfromUK have also edited (Llaberia and Illirus). For me, this does not appear to be a coincidence, since the article in question (then still a draft) was not edited for almost a month (look at the gap here). With this in mind, I'd like administrators to also take note of Based.shqiptar.frompirok's behavior, since he also "coincidentally" returned to editing the article (draft) on 6 August, the same day that Christopherschweinsteiger started editing it (3). The editor is also promoting the same narrative that NormalguyfromUK was promoting about Operation Valuable (4 and 5). Thank you. EDIT: It wouldn't hurt to include this here too: Between 2000-01-01 and 2023-08-08 on en.wikipedia.org User:NormalguyfromUK (talk | contribs) and User:Christopherschweinsteiger (talk | contribs) both made edits to some pages in common. You can see a chronological list of all their edits on the Interaction Timeline or a table view on the Interaction Analyser. StephenMacky1 (talk) 14:43, 8 August 2023 (UTC)[reply]

The reason for my lack of editing on the page is because I was focused on other pages like the 2001 insurgency in Macedonia, Liberation of Tepelena, National Liberation Army (Macedonia), Battle of Tetovo and others. + You need to remember its summer break so I have other real life things to take care of. I have that page (Anglo–American invasion of Communist Albania) on my watch list so every time someone edits it I get a notification so when Christopherschweinsteiger edited the page I remembered it and started to edit on it again. Based.shqiptar.frompirok (talk) 15:24, 8 August 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Confirmed Blocked and tagged Courcelles (talk) 14:51, 8 August 2023 (UTC)[reply]

  Noting that Based.shqiptar.frompirok did not show up when I checked this sock, and I've not checked them directly. Courcelles (talk) 15:46, 8 August 2023 (UTC)[reply]

• Based Person l (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Checked while investigating a report at WP:RFPP. That's a lowercase L, by the way. See below. Ivanvector (^Talk/_Edits) 18:56, 11 August 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Based Person l is  Confirmed to Based Person (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), but still technically  Unlikely to other accounts in this case. Based on behaviour I'd say this is a second group related to the same sockmaster, and I'll leave it up to the clerks to determine if this should be a new case or kept with this one.
• These accounts are  Confirmed to each other and very  Likely to the Based Person group:
  • History 122311 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Spjsisj (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • History12299 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

All of the accounts are blocked without tags. Ivanvector (^Talk/_Edits) 18:56, 11 August 2023 (UTC)[reply]

Struck part of my comment above, per new findings below. Ivanvector (^Talk/_Edits) 21:59, 11 August 2023 (UTC)[reply]

• El Mangupo (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Another new account, which was created on 9 August. Immediately after creation, they have only edited one Albanian-topic area article (diff). However like another NormalguyfromUK's sock Christopherschweinsteiger (diff), he's also promoting the same narrative about Operation Valuable and trying to influence the consensus in a deletion discussion (diff). StephenMacky1 (talk) 20:04, 11 August 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Was already checking this related to something else. El Mangupo is  Confirmed to Pringlesringles. Also, El Mangupo is  Confirmed to Liliannnaa who in turn is  Likely to the "Based Person" group above, so you can forget what I said about them possibly being separate cases. Ivanvector (^Talk/_Edits) 21:59, 11 August 2023 (UTC)[reply]

• 185.191.166.17 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Self-explanatory. Restoring NormalguyfromUK's desired version on Operation Valuable and making silly personal attacks (diff 1) and (diff 2). StephenMacky1 (talk) 16:56, 16 August 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Check declined by a checkuser - Courcelles (talk) 17:39, 16 August 2023 (UTC)[reply]

  Already blocked, I’ve semied the two articles. But we don’t connect IPs and accounts. Case closed. Courcelles (talk) 17:40, 16 August 2023 (UTC)[reply]

• Shqipodrilo (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Hello. I had some suspicions about the editor before, but I decided to wait and assume good faith, then I encountered this. Looks like there will be another attempt to create a POV fork article of the Operation Valuable and the editor is promoting the same narrative as NormalguyfromUK regarding this. They have also restored the POV fork article Battle of Vidohovë (created by NormalguyfromUK) on the Albanian People's Army article (diff). Apart from that, they show interest in the Albanian topic area much like NormalguyfromUK (see 1, 2 and 3). StephenMacky1 (talk) 15:05, 22 August 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• @RoySmith: You might wish to look at this. The suspected sock filed a report on August 15 at Wikipedia:Sockpuppet investigations/Orchomen, and there's also User talk:Courcelles#Wikipedia:Sockpuppet investigations/Orchomen.--Bbb23 (talk) 15:19, 22 August 2023 (UTC)[reply]

  Thanks for the ping, but I may need to leave this for somebody else. I know it's shocking, but my attention these days has turned to content creation. I'm working through the backlog of articles I've written but needed a bit of work to send to WP:GAN, and perhaps a WP:FA. RoySmith (talk) 15:32, 22 August 2023 (UTC)[reply]

•  Confirmed, blocked and tagged. Leaving this open in case RoySmith thinks anything else needs doing in light of the links above. Girth Summit _(blether) 15:30, 22 August 2023 (UTC)[reply]

  Not really. I suspect we haven't see the last of this, however. RoySmith (talk) 16:18, 22 August 2023 (UTC)[reply]

• Elbasan.patriot (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

User:Elbasan.patriot was created just a few hours ago (CA); the last sock of User:NormalguyfromUK was blocked a few days ago, on 22 August (here). There is already overlap in three articles, where they made four out of their five edits. There are obvious similarities if you compare their contributions (EIA). As an example, both User:NormalguyfromUK (diff1, diff2) and User:Elbasan.patriot (diff) tried to present 3,000 casualties for Nazi Germany, in the article Liberation of Tirana. Demetrios1993 (talk) 03:30, 26 August 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• CU data isn't entirely conclusive, but they look very similar in several ways - coupled with behaviour, blocking and tagging as proven. Girth Summit _(blether) 13:38, 26 August 2023 (UTC)[reply]

• Truth t (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Truth T restoring NormalguyfromUK edits:

TT - [3] NgfUK [4] also very similar edit summaries

Repeated addition of the same list of battles to infobox by all three accounts TT [5] NgfUK [6] Bsfp [7]

TT and NgfUK repeatedly making the same unsupported changes to result parameter

https://sigma.toolforge.org/timeline.py?page=Albanian_revolt_of_1911&users=Truth+t&users=NormalguyfromUK&server=enwiki

TT [8] [9] NgfUK [10] [11]

Result fiddling in favour of the Illyrians forces

TT [12] NgfUK [13]

TT also uses one of Bsfp's favourite formats here - trying to add the 'initial victory' [14] idea for the Albanians to an infobox result parameter that should just be Albanian defeat [15]

Truth T restoring Bsfp edits

Insisting on Mehmed II as a commander TT [16] Bsfp [17]

Insistence on a commander in the Greek WoI being Albanian https://sigma.toolforge.org/timeline.py?page=Markos_Botsaris&users=Based.shqiptar.frompirok&users=Truth+t&server=enwiki Also here's NgfUK making the similar changes to the name - https://en.wikipedia.org/w/index.php?diff=prev&oldid=1137822586 37.245.46.162 (talk) 14:09, 29 August 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Not unrelated to Truth t though, which he clearly is as presented here ( and behaviourally all the time) 31.218.19.163 (talk) 15:18, 29 August 2023 (UTC)[reply]

• Comment by Ktrimi991:

It is hilarious because this SPI itself is a block evasion. The 2 IPs are both User:Orchomen. Orchomen, just like the IPs, edited from the UAE and reported and had conflicts with NormalguyfromUK. Ktrimi991 (talk) 16:41, 29 August 2023 (UTC)[reply]

I've removed Based.shqiptar.frompirok who was found unrelated (see archive).--Bbb23 (talk) 14:22, 29 August 2023 (UTC)[reply]

• CheckUser requested - Requesting CU to confirm and look for others. Also a new account, Montesoße (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki), who looks very similar. Bbb23 (talk) 15:43, 29 August 2023 (UTC)[reply]
• Thanks, Ktrimi991, I figured the IPs were someone else but was too lazy to figure out who; they're now both blocked, although Orchomen does a lot of IP-hopping. Leaving the CU request in place, though.--Bbb23 (talk) 17:44, 29 August 2023 (UTC)[reply]
• Montesoße is  Confirmed. Truth t appears to be unrelated. RoySmith (talk) 01:29, 30 August 2023 (UTC)[reply]

• Nizyos (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Obvious sock of NGfUK, almost exclusicely editing some of the sockmasters favourite articles- https://sigma.toolforge.org/editorinteract.py?users=NormalguyfromUK&users=Nizyos&users=&startdate=&enddate=&ns=&server=enwiki

making very similar infobox changes - https://sigma.toolforge.org/timeline.py?page=Albanian_People%27s_Army&users=Nizyos&users=NormalguyfromUK&server=enwiki 2.48.56.94 (talk) 10:30, 19 September 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Here he is making one of NGfUK's favourite gnoming activities - adding Albanian emblems to infoboxes - on an NGfUK created article that's otherwise only had maningful edits to the content by NGfUK and his socks. https://en.wikipedia.org/w/index.php?title=Anastas_Ngjela&diff=prev&oldid=1176243351176.204.115.35 (talk) 05:09, 21 September 2023 (UTC)[reply]

•  Confirmed RoySmith (talk) 17:52, 28 September 2023 (UTC)[reply]

• Openheimer24 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Restoring word for word edits of Nizyos, a recently blocked sock

• Openheimer - https://en.wikipedia.org/w/index.php?title=Kadri_Hazbiu&diff=prev&oldid=1180418478
• Nizyos - https://en.wikipedia.org/w/index.php?title=Kadri_Hazbiu&diff=prev&oldid=1175994428

Making result fiddles to Infoboxes - a fabvourite NgfUK activity - https://en.wikipedia.org/w/index.php?title=Operation_%22Edelweiss%22&diff=prev&oldid=1180568749 37.245.43.164 (talk) 09:14, 19 October 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• I'd call this  Highly likely on a combination of the technical and behavioral data. RoySmith (talk) 21:06, 23 October 2023 (UTC)[reply]

• Albanianguy123 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Probable sleeper account. Clear naming similarities, mainly interested in editing infoboxes for the greater glory of Albania/the KLA per NgfUK's normal MO,

• https://sigma.toolforge.org/timeline.py?page=Battle_of_Tetovo&users=NormalguyfromUK&users=Albanianguy123&server=enwiki
• https://sigma.toolforge.org/timeline.py?page=Battle_of_Ko%C5%A1are&users=NormalguyfromUK&users=Albanianguy123&server=enwiki

and the creation of content fork pages about Albanian battles 2.49.39.17 (talk) 04:47, 27 October 2023 (UTC) 2.49.39.17 (talk) 04:54, 27 October 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Another filing by an Orchomen now-blocked IP.--Bbb23 (talk) 13:35, 27 October 2023 (UTC)[reply]

• From the CU data, it's  Possible, maybe even  Possilikely (a mix between possible and likely). Tagging as suspected largely on the strength of the behavioral evidence. RoySmith (talk) 14:34, 27 October 2023 (UTC)[reply]

• Reizones (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Hello. Looks like the sockpuppet tale continues. Promoting the same dubious narrative about Operation Valuable. They also restored an image collage which was created by a sockpuppet of theirs ([18]). StephenMacky1 (talk) 16:59, 29 October 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Highly likely, blocking as proven RoySmith (talk) 13:14, 30 October 2023 (UTC)[reply]

  PS, I semi-protected a few of the recent targets. RoySmith (talk) 13:17, 30 October 2023 (UTC)[reply]

• لهثسن (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Another clear behavioral sock. This one is restoring old "supported by" KLA and Bulgaria 2001 insurgency in Macedonia edits the NgfUK edit warred over back in January this year

https://sigma.toolforge.org/timeline.py?page=2001_insurgency_in_Macedonia&users=NormalguyfromUK&users=%D9%84%D9%87%D8%AB%D8%B3%D9%86&server=enwiki

• لهثسن - https://en.wikipedia.org/w/index.php?diff=prev&oldid=1182039542
• NgfUK - https://en.wikipedia.org/w/index.php?diff=prev&oldid=1136052153 - https://en.wikipedia.org/w/index.php?diff=prev&oldid=1136052153

Also extensively making NgfUK's usual favourite edits to add flags/shields to infoboxes

• لهثسن https://en.wikipedia.org/w/index.php?title=Northern_war_in_Ukraine&diff=prev&oldid=1182454310
• https://en.wikipedia.org/w/index.php?title=July_26_Baku_Coup_d%27%C3%A9tat&diff=prev&oldid=1179807211
• https://en.wikipedia.org/w/index.php?diff=prev&oldid=1136356109
• https://en.wikipedia.org/w/index.php?title=Spartacist_uprising&diff=prev&oldid=1179690782

etc etc

Fiddling with result parameters as usual

• https://en.wikipedia.org/w/index.php?title=Battle_of_Aghdam&diff=prev&oldid=1179990240
• https://en.wikipedia.org/w/index.php?title=Silesian_Uprisings&diff=prev&oldid=1179690985
• https://en.wikipedia.org/w/index.php?title=Capture_of_Trabzon_(1918)&diff=prev&oldid=1179758692

etc etc 176.204.85.88 (talk) 10:34, 1 November 2023 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

User:لهثسن also reverted redirect at Second Battle of Sadakhlo, created by blocked sock User:Nugoooo: [19].
Strong edit overlap with Nugoooo: [20]Wikishovel (talk) 11:14, 1 November 2023 (UTC)[reply]

• The following are  Confirmed to each other:
  • LewonK on YT (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Qwertz169 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • لهثسن (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • لهثسنك (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• LewonK on YT is clearly somebody's sock - they gamed ACPERM to create new pages in violation of an ARBAA2 ECP restriction, and were blocked twice for it. The other accounts were made to evade those blocks and have engaged in the same behaviour; all are  Blocked without tags. This group is  Possible to this case: they geolocate to the same general area but use different devices from previously flagged NgfUK socks.  Behavioural evidence needs evaluation. Ivanvector (^Talk/_Edits) 14:02, 2 November 2023 (UTC)[reply]
• I think those rightfully belong here. Closing without taggs. Vanjagenije (talk) 01:20, 13 November 2023 (UTC)[reply]

• Nysreti1 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Possible sockpuppet of the blocked editor due to the same POV additions. See 1 and 2. StephenMacky1 (talk) 15:04, 4 February 2024 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Comment by Demetrios1993

I don't know if User:Nysreti1 is a sockpuppet of NormalguyfromUK or not, but I believe that the activity of numerous recently-created accounts in List of wars involving Albania, just in the past two weeks, justifies a CU check; I have been monitoring the page for some time now, and this is not normal activity. I am specifically referring to the following four red-linked accounts; though, there is also some IP activity that might be related:

• User:Nysreti1 (created on 11 August 2023)
• User:Illyriandibra1912 (created on 26 January 2024)
• User:AlbaScot (created on 30 January 2024)
• User:Spongy mysophyll productions (created on 9 February 2024)

Maybe User:Nysreti1 is unrelated to NormalguyfromUK, and the three other accounts are associated with the former; theirs is the only account out of the four, whose timespan exceeds two weeks, being six months old. Besides the dates of their creation, compare the contributions of the four users, who all seem to focus on the aforementioned page; almost exclusively. Demetrios1993 (talk) 14:04, 10 February 2024 (UTC)[reply]

•  Clerk assistance requested: - This is messy. AlbaScot I would call  Confirmed to Albanianhistorian123, who has a separate SPI at Wikipedia:Sockpuppet_investigations/Albanianhistorian123, should probably be merged. As best as I can tell, the other accounts named above are all  Unrelated to each other. There is considerable logged-out editing, but not obviously intentional. Nysreti has also created two accounts that have no edits; SidritPrizrenali and Zenun12. I'm undecided as to what to do with them, so I'm going to leave this out for another admin or CU. There's slight technical overlap between a couple of these, but I need to return to those some other time. Vanamonde93 (talk) 01:16, 13 February 2024 (UTC)[reply]
• Instead of moving this section to Albanianhistorian123 I've filed a new one with just AlbaScot. Changing the case status to checked. 0xDeadbeef→∞ (talk to me) 11:43, 21 February 2024 (UTC)[reply]
•  Closing without action The Wordsmith^{Talk to me} 03:03, 5 March 2024 (UTC)[reply]

• Azphalt (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• AlbaScot (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

A random IP (5.38.104.105) has been mass reverting those two accounts' edits as being NormalguyfromUK socks, and I'm not familiar with this case but I can see the section above me has one of the accounts I'm reporting already. Requesting CU for those two accounts. LilianaUwU ^{(talk / contributions)} 03:44, 11 February 2024 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• AlbaScot and Azphalt appear to be technically  Unrelated. I have not looked extensively into the behavior but I don't see anything at the moment which would justify a behavioral block either. Vanamonde93 (talk) 00:23, 13 February 2024 (UTC)[reply]
• See comment in previous section. Vanamonde93 (talk) 01:17, 13 February 2024 (UTC)[reply]
•  Closing without action Insufficient behavioral evidence to justify a block. The Wordsmith^{Talk to me} 03:04, 5 March 2024 (UTC)[reply]

• TemporaryAccount100 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• TempAcc102 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• TemporaryAccount6384 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

These three are CU-confirmed with each other (and blocked for their disruption), and they are likely socks of our guy. Drmies (talk) 03:59, 2 March 2024 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Accounts tagged. The Wordsmith^{Talk to me} 03:08, 5 March 2024 (UTC)[reply]

• Based-Hay (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Recreating articles created by other socks, account was created shortly after the last cleanup. Yamla (talk) 21:15, 18 March 2024 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Unrelated, as far as the technical evidence is possible of showing. Closing with no action. --Yamla (talk) 21:19, 18 March 2024 (UTC)[reply]

• Based guyy (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

This account appears to be related to User:Based Person, a sock of NormalguyfromUK. See Based Person vs Based guyy for example. The numerous obscure article overlaps, similarity in gnoming and user names could all just be a huge coincidence/misunderstanding, and this is the kind of potential socking situation that I normally ignore. But my concern is that they are making edits (and edit warring) in the contentious WP:ARBPIA topic area, and that topic area in particular should not have any editors willing to use deception. Hence the SPI report. Sean.hoyland (talk) 04:25, 9 April 2024 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• CU data isn't conclusive, but it is certainly possible; the level of article overlap is also alarming. Blocking as suspected, requesting lock, closing. Girth Summit _(blether) 16:38, 11 April 2024 (UTC)[reply]

• Random editorr (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Hello. Based guyy was recently blocked as a sockpuppet. I think the editor is evading their block through this account (see 1 and 2 for comparison). The editor is also editing Israeli-Palestinian conflict articles, which is also what interested Based guyy before the block. StephenMacky1 (talk) 17:12, 16 April 2024 (UTC)[reply]

Like StephenMacky1, and @UtoD:, I also think it's likely to be another sock. See User_talk:Sean.hoyland#Possible_sock?. Sean.hoyland (talk) 17:37, 16 April 2024 (UTC)[reply]

• Random editorr is  Confirmed to Based guyy, behavior is also ducky. Blocking, closing, requesting g-lock. Vanamonde93 (talk) 18:05, 16 April 2024 (UTC)[reply]

• Random personnn (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Clearly Basedguyy evading block and editing articles about military conflicts (especially Macedonian and Israeli-Palestinian conflict ones). StephenMacky1 (talk) 11:47, 6 June 2024 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• No need for CU here, this is too obvious. I'll block and tag. --Yamla (talk) 12:24, 6 June 2024 (UTC)[reply]

• Helloimhim (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Possible sock. Requesting CU just in case. My suspicion relies on the username (which reads like a confession) and having a personal issue with me (see diff). It's uncommon for an editor to have an issue with me. StephenMacky1 (talk) 22:01, 14 June 2024 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Helloimhim is  Confirmed to Prizrenali.berisha, and there's substantial evidence of intentional logged out editing as well. I'd say this is fairly likely to the master based on behavior, but I don't see a slam-dunk technical link. Vanamonde93 (talk) 04:15, 15 June 2024 (UTC)[reply]
•  Global lock(s) requested TheSandDoctor ^Talk 05:26, 15 June 2024 (UTC)[reply]