Wikipedia:Sockpuppet investigations/Ugbedeg/Archive#19 December 2021

• {{checkuser|1=Cryforjustice}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&users={{urlencode:Cryforjustice}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&user={{urlencode:Cryforjustice}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

The immediate cause for this SPI is this; A user places a prod tag on an article created by {{u|Ugbedeg}} as can be seen [https://en.m.wikipedia.org/wiki/Special:MobileDiff/963969569?diffmode=source here] & this is the auto message on tp of Ugbedeg; [https://en.m.wikipedia.org/wiki/User_talk:Ugbedeg#Proposed_deletion_of_ID_Africa here] & magically @{{u|Cryforjustice}} comes along to contest this prod as can be seen [https://en.m.wikipedia.org/wiki/Special:MobileDiff/964099333?diffmode=source here]. Both Ugbedeg & Cryforjustice registered exactly 5 months ago, type/talk in similar manner & even edit the same type of articles, which are political related articles as can be observed here. This are a few of the articles created by {{u|Ugbedeg}}; Kogi East Senatorial District, Plateau North Senatorial District & Niger East Senatorial District now observe a few of the articles created by {{u|Cryforjustice}}; Gombe State House of Assembly, Adamawa State House of Assembly, & Taraba State House of Assembly. Notice how they all are related to Nigerian politics & how both editors have similar edit pattern? So either this is blatant sockpuppetry or this is meat puppetry either of the two. Also the WP:DUCK test can be applied here. We have enough problems with sock puppetry & Paid editing ring amongst Nigerian editors & we certainly do not need anymore bad faith editors. Celestina007 (talk) 12:51, 27 June 2020 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{inprogress}}. They are a close match but it will take some investigation to determine how close. ST47 (talk) 13:16, 27 June 2020 (UTC)
• I'm adding the following account, based on technical connections, article overlap, and other behavioral similarities:
• {{checkuser|NotTooSmooth}}
• These three accounts are highly {{likely}} to be sockpuppets. They are definitely connected in some way, my only doubt is whether they are one person or several working in concert. The data in this case is rather difficult to sift through, with individual users rapidly moving between different IPs and ranges, all of which are very busy. However, there is evidence that these users are routinely editing from the same internet connections as each other, and at the same times. We also have a few instances of article overlap each, and very strong behavioral cues. I will block all three accounts. ST47 (talk) 14:51, 27 June 2020 (UTC)

----

• {{checkuser|1=Northern Escapee|master name={{#titleparts:{{SUBPAGENAME}}}}}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&users={{urlencode:Northern Escapee}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&user={{urlencode:Northern Escapee}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

In June the master sock who was a Nigerian editor got blocked for sockpuppetry and in July the suspected sock registers his account and begins to edit in a similar pattern to the confirmed sock master which was Prodding articles CSD Nominations and predominantly anything related to NPR, For example see edits by Ugbedeg; [https://en.m.wikipedia.org/wiki/Special:MobileDiff/964726939?diffmode=source 1], [https://en.m.wikipedia.org/wiki/Special:MobileDiff/964560488 2] & [https://en.m.wikipedia.org/wiki/Special:MobileDiff/964411512?diffmode=source 3], now compare with Norther Escapee; [https://en.m.wikipedia.org/wiki/Special:MobileDiff/994739630?diffmode=source 1] [https://en.m.wikipedia.org/wiki/Special:MobileDiff/994745005?diffmode=source 2] & [https://en.m.wikipedia.org/wiki/Special:MobileDiff/994398596?diffmode=source 3].

Furthermore Ugbedeg tried all he could to hack into new page reviewing and acquire advanced user right very quickly. See this [https://en.m.wikipedia.org/wiki/User_talk:Ugbedeg#Tracking_your_AfD_votes_and_CSD%2FPROD_Nominations thread] & now compare with this [https://en.m.wikipedia.org/wiki/Special:MobileDiff/994156678?diffmode=source request] by {{noping|Northern Escapee}} & also observe the [https://en.m.wikipedia.org/wiki/User_talk:Northern_Escapee talk page] of Northern Escapee.

Furthermore, Ugbedeg and his confirmed alternate sock account @{{u|Cryforjustice}} both had bizarre/random texts on their Userpage. Now take a look at [https://en.m.wikipedia.org/w/index.php?title=User:Northern_Escapee&oldid=972707773 this text] currently present in the userpage of the suspected sock account.

I believe this is sock puppetry. Can the duck test also be applied here? Celestina007 (talk) 18:39, 23 December 2020 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

{{ trim | This case is being reviewed by Girth Summit as part of the clerk training process. Please allow them to process the entire case without interference, and pose any questions or concerns either on their Talk page or on this page if more appropriate. }}

• {{clerknote}} The old accounts are stale, so I'm declining the CU. Based on behaviour, I can see that there is some similarity in terms of editing pattern, and the dates are fairly close, but there's no overlap in terms of articles they've edited (which there was last time), so there's not enough for me to make a definite connection and justify a block. Closing. GirthSummit _(blether) 17:11, 27 December 2020 (UTC)

----

• {{checkuser|1=Dotardhead}}
• {{checkuser|1=Enapee}}
• {{checkuser|1=JacksonofJacksonville}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

Promotional editing (cf. Draft:Kyle Anfernee) and interest in Nigeria-related topics (cf. Special:PageHistory/Tiwalola Olanubi) as was the case for the confirmed socks. In addition, there are distinct edit summary similarities, namely the use of "Link", "Punctuation", "Typo" and "Typos", first letter capitalised, no punctuation (all immediately visible on the contribs pages). Additionally, there is the use of "Re-used source", note the hyphen (sock: Special:Diff/1001354840; master: Special:Diff/964282398). The most recent sock alternates between use of VisualEditor on mobile and VisualEditor on desktop, as did the others. Best, Blablubbs|talk 16:08, 21 January 2021 (UTC)

:Adding {{noping|Enapee}} and {{noping|JacksonofJacksonville}}; both show the same edit summary and VE-use pattern and both have been working on Olumide Gbenro, another Nigeria-related topic. For Enapee, see also the edit summary in Special:Diff/996385393 and compare Special:Diff/971785212 and Special:Diff/971785212. Blablubbs|talk 14:10, 22 January 2021 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{Inprogress}} - Mz7 (talk) 22:53, 29 January 2021 (UTC)
• This is a hard one from a CU standpoint. Technically, all of them are {{possible}} to each other, but Dotardhead is more possible to Enapee than to JacksonofJacksonville. Behaviorally, I can definitely see the similarities, and especially looking at the Tiwalola Olanubi page history, I would say Dotardhead passes the WP:DUCK test, as well as Enapee based on the technical and behavioral similarities. {{bnt}}. I'm going to take no action against JacksonofJacksonville at this time because of the technical dissimilarities, but if they return to activity, they should be checked again. Closing. Mz7 (talk) 23:22, 29 January 2021 (UTC)

----

• {{checkuser|1=S.Kennedy}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

Appears to be a sleeper meat/sock puppet, see Olumide Gbenro CUPIDICAE💕 14:46, 21 February 2021 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Other than the obviously COI-laden recreation of Olumide Gbenro, I'm not seeing anything that makes me think S.Kennedy is a sock. Their behavior doesn't match any of the users mentioned in the archive that I can see. UPE for sure, but not a sock. I'll leave a warning on their talk page. -- RoySmith (talk) 15:19, 21 February 2021 (UTC)

----

; Active

• {{checkuser|1=Northern Escapee|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=Salbador7070|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=Boardchief|master name={{#titleparts:{{SUBPAGENAME}}}}}}

; Probably stale

• {{checkuser|1=Veteran Fellow|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=Beinos|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=Africa1900|master name={{#titleparts:{{SUBPAGENAME}}}}}}
• {{checkuser|1=Ojimafebian|master name={{#titleparts:{{SUBPAGENAME}}}}}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&users={{urlencode:Northern Escapee}}&users={{urlencode:Salbador7070}}&users={{urlencode:Boardchief}}&users={{urlencode:Veteran Fellow}}&users={{urlencode:Beinos}}&users={{urlencode:Africa1900}}&users={{urlencode:Ojimafebian}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&user={{urlencode:Northern Escapee}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

All accounts used mobile editing in 2020, and those that are later active, stopped using it. They use the same gnoming patterns. Salbador7070 created Walter Mosley (lawyer), and Veteran Fellow and Northern Escapee shared an interest in keeping it (see AfDs 1, 2). See overlaps at obscure topics Alessio Sundas, Valentina Sassi, and Netng. Also see similar timecards in some cases (e.g. [https://xtools.wmflabs.org/ec-timecard/en.wikipedia.org/Salbador7070 Salbador7070] and [https://xtools.wmflabs.org/ec-timecard/en.wikipedia.org/Ojimafebian Ojimafebian]), as well as similar edit summary patterns. More recently, Northern Escapee switched interests and started doing contributions in line with Radovicdarko538 (I don't think they are the same sockfarm, but probably sharing a client). MarioGom (talk) 22:14, 14 October 2021 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• I completely agree with the apt analysis of {{u|MarioGom}}. This is something I discovered one year ago I expressly note [https://en.wikipedia.org/w/index.php?diff=987409528&diffmode=source this here], but nothing really came out of that. I’m happy a more comprehensive analysis is being reported. Celestina007 (talk) 23:27, 14 October 2021 (UTC)

{{ trim | This case is being reviewed by Spicy as part of the clerk training process. Please allow him to process the entire case without interference, and pose any questions or concerns either on his talk page or on this page if more appropriate. }}{{pb}}

• {{Endorse}} - I've taken a close look at the non-stale accounts. They all share a very distinctive edit summary style and pattern of editing with each other and the master, and while there is not much direct page overlap, what there is is fairly suggestive because it is on obscure topics. Northern Escapee's creation of stubs about African politicians [https://xtools.wmflabs.org/pages/en.wikipedia.org/Northern_Escapee] is also in line with previous Ugbedeg accounts ([https://xtools.wmflabs.org/pages/en.wikipedia.org/Cryforjustice]), and all of the currently active accounts signed up shortly after Ugbedeg's block. I've seen the pattern of "generic UPE pivoting to geopolitical influence editing" before (see Wikipedia:Sockpuppet_investigations/Bennet43/Archive), and while I don't think this is related to that case, it furthers the impression that something untoward is going on here. I think Checkuser is warranted to confirm the connections between these accounts. Thanks, Spicy (talk) 23:38, 15 October 2021 (UTC)
• {{Inprogress}} Dreamy Jazz ^{talk to me | my contributions} 11:47, 16 October 2021 (UTC)
• I'm unsure what to make of the CU data. Leaving for another CU. Dreamy Jazz ^{talk to me | my contributions} 11:53, 16 October 2021 (UTC)
• {{Inprogress}} - ~TNT (she/her • talk) 22:00, 16 October 2021 (UTC)
• Oh this is going to take a while ~TNT (she/her • talk) 22:02, 16 October 2021 (UTC)
• {{possible}} leaning {{inconclusive}} - this looks like you're dealing with either account sharing, or a UPE group (i.e. multiple users using multiple accounts). I checked {{noping|Boardchief|Salbador7070|Northern Escapee}} - there is overlap on busy ranges and some weird WHOIS data ~TNT (she/her • talk) 22:15, 16 October 2021 (UTC)
• Thanks. The CU results sound similar to what has previously been described in this case (see Wikipedia:Sockpuppet_investigations/Ugbedeg/Archive#27_June_2020) and are suspicious in themselves insofar as they indicate account sharing and/or CU evasion. I am confident that the three users are behaviourally linked to each other and the master based on their edit summary patterns and general MO (Northern Escapee has been making a lot of automated edits lately, but look at their older edits for the pattern - see, for example, this: [https://en.wikipedia.org/w/index.php?target=Ugbedeg&namespace=4&tagfilter=&start=&end=&limit=50&title=Special%3AContributions][https://en.wikipedia.org/w/index.php?title=Special:Contributions&dir=prev&target=Northern+Escapee&namespace=4&tagfilter=&start=&end=]). In the course of this investigation I also came across the accounts {{np|Maco Paco}}, {{np|Jokolis}} and {{np|Johncombo}}, which were blocked for socking by {{u|MER-C}} in 2020. I'm confident these accounts are related to this case as they share the same behavioural cues & there is overlap on Alessio Sundas: [https://en.wikipedia.org/w/index.php?title=Alessio_Sundas&dir=prev&action=history]. See also [https://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletion/Mediacraft_Associate] and Special:Log/Mediacraft Associates, which ties them to one of the stale accounts listed above. Anyway, this is all to say that I believe these accounts are sockpuppets of Ugbedeg, are engaging in UPE, and should be indefinitely blocked. {{awaitingadmin}} - please indef the three non-stale accounts. I think the stale accounts are also socks but as none of them has edited in over a year I don't think it's necessary to block them at this time; feel free to re-report if they reactivate. Spicy (talk) 16:11, 17 October 2021 (UTC)
• {{bnt}} the lot, including the stale ones to prevent reactivation since they're clearly the same person. --Blablubbs (talk) 17:14, 17 October 2021 (UTC)
• Thanks, {{u|Blablubbs}}. Added missing tags (I tagged them all as suspected). I don't have time to look into what needs to be G5'd right now, but FWIW the date is 27 June 2020. Northern Escapee had AfC rights, so that could use following up on. Closing. Thanks, Spicy (talk) 17:27, 17 October 2021 (UTC)

----

• {{checkuser|1=Botti12|master name={{#titleparts:{{SUBPAGENAME}}}}}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&users={{urlencode:Botti12}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&user={{urlencode:Botti12}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

After Northern Escapee's block, Botti12 resumed the pro-Qatar editing of Northern Escapee (this is a very characteristic pattern of edits outsourced to various sockfarms: Ugbedeg, Bennet43, Radovicdarko538). Prior to the Qatar-focused editing, the gaming behavior was very similar to Northern Escapee. Botti12 has a user page interestingly similar to Veteran Fellow {{oldid2|1050007038}}{{oldid2|959330860}}. Timecard is consistent (same timezone at least). Edit summary style is very similar, although it's not a particularly unique one. Requesting CU for a sleeper check, since I'm pretty sure there's a few more. MarioGom (talk) 22:17, 18 December 2021 (UTC)

• I think the new accounts are the same person as previous socks here. At least Zatito ({{diff2|1015997982}}{{diff2|1040722955}}) and Penafresh ({{diff2|976487847}}{{diff2|974306630}}, {{diff2|976492111}}{{diff2|973718581}}). MarioGom (talk) 14:00, 20 December 2021 (UTC)
• :So is Emmywandy ({{diff2|1050753903}}{{diff2|1050256526}}). MarioGom (talk) 14:05, 20 December 2021 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Please see Wikipedia:Sockpuppet investigations/Luciapop where {{u|MarioGom}} has suggested that these SPIs are linked. This may mean a further detailed investigation to determine whethwer their thoughts are correct. Fiddle^Timtrent Faddle^Talk to me 21:27, 20 December 2021 (UTC)

• {{Endorse}} - there are enough similarities here to be suspicious; please compare to previous accounts and check for others (if feasible, I gather that the data is messy). Thanks, Spicy (talk) 19:19, 19 December 2021 (UTC)
• {{Inprogress}} - Girth Summit _(blether) 09:12, 20 December 2021 (UTC)
• I'm not seeing anything that links back to Ugbedeg; however, there is overlap with the accounts listed at Wikipedia:Sockpuppet investigations/Ifeomanwaka. {{noping|Emmywandy}} also cropped up - technically, there isn't enough to say they're confirmed, but taking behaviour into account I'm convinced they're the same person. Blocking without tags. Girth Summit _(blether) 10:37, 20 December 2021 (UTC)
• Just blocked
• {{checkuser|Zatito}}
• {{checkuser|Khatoto}}
• {{checkuser|Penafresh}}
• all clearly related to Emmywandy, probably worth a check, but I don't have time to dive into it right now, so I'll leave it at this note. --Blablubbs (talk) 11:34, 20 December 2021 (UTC)
• {{checkuser|Supazapi}}
• too. I'm pretty certain these are all Ugbedeg. --Blablubbs (talk) 14:37, 20 December 2021 (UTC)
• {{relisted}} - for another check on the accounts found by Blablubbs, plus{{pb}}
• {{checkuser|Luciapop}}{{pb}}per {{u|MarioGom}}'s comments at WP:Sockpuppet investigations/Luciapop: {{tq|As far as I can tell, Luciapop is a sock of Ugbedeg (SPI). Similar AFC grinding, created :it:Alessio Sundas (agente calciatori) which is a common target of Ugbedeg in enwiki, accepted two spam drafts related to Sundas at AFC (Miami Magic FC Academy, American Group Sports Management), accepted spam article Kyle Anfenee which was created just days after Draft:Kyle Anfernee (by Ugbedeg) was deleted, same timezone and fairly similar timecard.}}{{pb}}All of these accounts have a similar edit summary pattern and userpage style, and the accounts listed by Blablubbs are spamming the same websites. Thanks, Spicy (talk) 23:33, 20 December 2021 (UTC)
• {{Inprogress}} - -- RoySmith (talk) 17:20, 22 December 2021 (UTC)
• Based on CU data, Botti12, Zatito, Khatoto, Penafresh, Supazapi, and Luciapop are all {{likely}} {{behav}} to each other. In various combinations, they overlap on two different IPv4 /16 ranges, both of which geolocate to the same country. The UA's all match plus/minus minor version upgrades, but it's a very common UA, which is why I'm stopping at likely. I can't tie that group back to Ugbedeg, however. The only non-stale account I found in the archives is {{noping|Northern Escapee}} which I'd have to call {{unlikely}} to the Botti12 group. The SPI got a little confusing, so let me know if I've missed anything and I can go take another look. -- RoySmith (talk) 18:17, 22 December 2021 (UTC)
• Thanks. {{awaitingadmin}} - please indef Luciapop per the CU results and behavioural evidence documented here, [https://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/Luciapop here] and [https://en.wikipedia.org/wiki/Wikipedia:Administrators'_noticeboard#UPE_with_an_autopatrolled_and_AfC_reviewer_rights here]. There are clear behavioural links between this group and previous Ugbedeg socks, regardless of the CU results. I think what we are looking at is a different operator working for the same UPE farm. Thanks, Spicy (talk) 00:48, 23 December 2021 (UTC)
• {{yo|Spicy}} {{sblock}}, I'll leave the rest to you. --Blablubbs (talk) 11:56, 24 December 2021 (UTC)
• Thanks. I tagged these accounts as suspected to Ugbedeg per the behavioural analysis above. Closing. Spicy (talk) 12:53, 24 December 2021 (UTC)

----

• {{checkuser|1=Luciapop}} ({{clerknote}} originally filed under this user)
• {{checkuser|1=Awwakko|master name={{#titleparts:{{SUBPAGENAME}}}}}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&users={{urlencode:Awwakko}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&user={{urlencode:Awwakko}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

See [https://en.wikipedia.org/wiki/Wikipedia:Administrators%27_noticeboard#UPE_with_an_autopatrolled_and_AfC_reviewer_rights this], for backstory. Now, the suspected sock master registered here roughly [https://en.m.wikipedia.org/w/index.php?title=User:Luciapop&oldid=1001812837 11 months ago] almost the same time the suspected sock arrived 11 months ago as well. The suspected sock master created the promotional non notable possible undisclosed paid article titled Victory Obasi on [https://en.wikipedia.org/w/index.php?title=Victory_Obasi&oldid=1022960356 May 13 2021] & on [https://en.wikipedia.org/wiki/Special:MobileDiff/1023449048?diffmode=source May 16] the suspected sock begins to work tirelessly on the article, see [https://en.wikipedia.org/wiki/Special:MobileDiff/1023449612?diffmode=source this], [https://en.wikipedia.org/wiki/Special:MobileDiff/1023450107?diffmode=source this], [https://en.wikipedia.org/wiki/Special:MobileDiff/1023450229?diffmode=source this], [https://en.wikipedia.org/wiki/Special:MobileDiff/1023450456?diffmode=source this], [https://en.wikipedia.org/wiki/Special:MobileDiff/1023455154?diffmode=source this] for example. It is so disturbing, It is Almost as though the sock master forgot they were signed into a different account. I believe this to be sock puppetry or in the very least off wiki meat puppetry. Celestina007 (talk) 20:46, 19 December 2021 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• As an ordinary editor I would agree that CU is likely to be useful here. There is a large swathe of likely UPE from the alleged sockmaster, yet they are not always the only editor of the great number of articles they have created. I'm not sure if two editors' antennae are sufficient to encourage a clerk to endorce a CU. Fiddle^Timtrent Faddle^Talk to me 21:06, 19 December 2021 (UTC)
• As far as I can tell, Luciapop is a sock of Ugbedeg (SPI). Similar AFC grinding, created :it:Alessio Sundas (agente calciatori) which is a common target of Ugbedeg in enwiki, accepted two spam drafts related to Sundas at AFC (Miami Magic FC Academy, American Group Sports Management), accepted spam article Kyle Anfenee which was created just days after Draft:Kyle Anfernee (by Ugbedeg) was deleted, same timezone and fairly similar timecard. MarioGom (talk) 14:21, 20 December 2021 (UTC)

:* {{u|MarioGom}} Spot on! I was connecting the dots yesterday and reached to almost same conclusion that they are related to Ugbedeg. General observation: Awwakko are probably stale, so it would better to compare checkuser data here with Ugbedeg SPI. Additionally, add User:Willy Bond (registered in February 2021) to this SPI who expanded the article Luciapop started, Karl Toriola, and among other common behaviors like usage of tools early on and visual editing. 86.98.143.217 (talk) 21:31, 20 December 2021 (UTC)

• Additional evidence: User:Zatito (a sock of Ugbedeg) edited Tayo Amusan (an article which was started by Luciapop). User:Botti12 (another sock of Ugbedeg) expanded spam Kabiru Rabiu (on 8 September 2021) and Luciapop accepts the article (on 10 September 2021), successfully finishing paid job. 86.98.143.217 (talk) 21:44, 20 December 2021 (UTC)

• {{onhold}} - pending outcome of WP:Sockpuppet investigations/Ugbedeg. Thanks, Spicy (talk) 23:35, 20 December 2021 (UTC)
• Merged case from Wikipedia:Sockpuppet investigations/Luciapop. Spicy (talk) 12:55, 24 December 2021 (UTC)
• Luciapop has been blocked as an Ugbedeg sock. It's certainly possible that Awwakko was a sock of Luciapop/Ugbedeg, but I think the behavioural evidence falls just under the threshold needed for a block. Since they haven't edited in half a year and the article they worked on is on track to be deleted at AfD, I don't think a block would affect the ultimate outcome anyway. They can be re-reported if they start editing again. Thanks, Spicy (talk) 13:07, 24 December 2021 (UTC)

----

• {{checkuser|1=Cambodier|master name={{#titleparts:{{SUBPAGENAME}}}}}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&users={{urlencode:Cambodier}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&user={{urlencode:Cambodier}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

Coherent timecard, same edit summary style (e.g. {{diff2|987234346}}{{diff2|967726163}}), same interest in Alessio Sundas and Valentina Sassi [https://commons.wikimedia.org/w/index.php?title=File:Valentina_Sassi.jpg&oldid=435952607] as previous socks, signed up in 2020-7 like many other accounts here. MarioGom (talk) 16:32, 6 January 2022 (UTC)

:Requested CU for a sleeper check. MarioGom (talk) 16:38, 6 January 2022 (UTC)

::Lowquit matches Botti12 behavior: random gnoming then flip to pro-Qatar. MarioGom (talk) 16:50, 6 January 2022 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{Inprogress}} - -- TNT (talk • she/her) 16:42, 6 January 2022 (UTC)
• {{noping|Cambodier}} is {{confirmed}} to:
• {{checkuser|Lowquit}}
• {{checkuser|Zatito}}
• and {{likely}} to {{noping|Luciapop}} (prev. blocked sock) -- TNT (talk • she/her) 16:48, 6 January 2022 (UTC)
• :Blocked, tagged, closing. MER-C 18:06, 6 January 2022 (UTC)

----

• {{checkuser|1=Annie Kingdom}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

For the record. --Blablubbs (talk) 19:19, 8 January 2022 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Gaming techniques and linguistic hints line up (BEANS!). {{bnt}}, closing. --Blablubbs (talk) 19:20, 8 January 2022 (UTC)

----

• {{checkuser|1=Ojnist}} ({{clerknote}} original case name)
• {{checkuser|1=Jidano|master name={{#titleparts:{{SUBPAGENAME}}}}}}

• Tools: [https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&users={{urlencode:Jidano}} Editor interaction utility] • [https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}&user={{urlencode:Jidano}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{#titleparts:{{SUBPAGENAME}}}}}}.html User compare report] Auto-generated every hour.

It appears that Ojnist (a sleeper account created more than a year prior to its first edit) and Jidano—both of which are prolific new accounts that have made approximately 500 edits each since January, with detailed knowledge of Wikipedia functionality—are part of a network of sock- or meatpuppets with a likely conflict of interest. Admittedly, this might seem like an odd case to bring to SPI, because my thesis is that there are likely more throwaway accounts involved and that whoever is behind this activity knows what they are doing and tries to avoid any obvious appearance of coordination. I really only have one diff in which they slipped up, but consider the circumstances: Jidano essentially deletes and rewrites Qatar and state-sponsored terrorism from scratch, moving it to Qatar Counter Terrorism in the process. Obviously, Jidano does this over the course of many, many edits to conceal the scope of the deletions, falsely alleging that citations are [https://en.wikipedia.org/w/index.php?title=Qatar_Counter_Terrorism&diff=1069598022&oldid=1069597883 "made up"] or [https://en.wikipedia.org/w/index.php?title=Qatar_Counter_Terrorism&diff=1069602214&oldid=1069602041 "fake"] when in fact the full citations were listed in the bibliography, even [https://en.wikipedia.org/w/index.php?title=Qatar_Counter_Terrorism&diff=1069600454&oldid=1069600154 reverting himself] at one point just to keep page watchers off-guard. Regarding the page move, Jidano explained: [https://en.wikipedia.org/w/index.php?title=Qatar_Counter_Terrorism&diff=1069607572&oldid=1069606640 "the content of the page under the previous name were not supported by almost all cited sources. Following extensive clean up of unsupported claims, it is necessary to change name to reflect content of the page"]. I suspect that whoever operates these accounts mistakenly used Ojnist (which had been active for less than one month at this point) to make a [https://en.wikipedia.org/w/index.php?title=State-sponsored_terrorism&diff=1070784259&oldid=1069751520 corresponding change] to the Qatar section of State-sponsored terrorism, referencing the recent move and incorporating large swathes of identical text/sources to those used by Jidano at the main article. TheTimesAreAChanging (talk) 22:02, 14 February 2022 (UTC)

I don't know if Mr J Stone is connected to Ojnist and Jidano, but at a minimum Mr J Stone has socked in collaboration with IP 45.90.248.125 at Human rights in Qatar ([https://en.wikipedia.org/w/index.php?title=Human_rights_in_Qatar&diff=1067830235&oldid=1064503792], [https://en.wikipedia.org/w/index.php?title=Human_rights_in_Qatar&diff=1069249105&oldid=1067830235], [https://en.wikipedia.org/w/index.php?title=Human_rights_in_Qatar&diff=1069815673&oldid=1069372371], [https://en.wikipedia.org/w/index.php?title=Human_rights_in_Qatar&diff=1073176059&oldid=1069815673])—this is a WP:DUCK observation given that we cannot link IPs to named accounts—and IP 45.90.248.125 has also socked in collaboration with Ojnist at Politics of Qatar ([https://en.wikipedia.org/w/index.php?title=Politics_of_Qatar&diff=1069256658&oldid=1057198310], [https://en.wikipedia.org/w/index.php?title=Politics_of_Qatar&diff=1072764168&oldid=1069256658]). No matter the edit, they all vaguely claim to be {{tq|"verifying information"}}: [https://en.wikipedia.org/w/index.php?title=Politics_of_Qatar&diff=1069256658&oldid=1057198310 "{{No citation found and Information couldn't be verified}}"] (45.90.248.125); [https://en.wikipedia.org/w/index.php?title=Politics_of_Qatar&diff=1072764168&oldid=1069256658 "updated verified information which was before an irrelevant edit mentioned under Foreign Relations category"] (Ojnist); [https://en.wikipedia.org/w/index.php?title=Human_rights_in_Qatar&diff=1073176059&oldid=1069815673 "unverified information was removed where in neutrality was also disputed, updated new and verified information from ILO.org"] (Mr J Stone). Seems very sus, as the kids say.TheTimesAreAChanging (talk) 19:42, 21 February 2022 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Please, see Wikipedia:Sockpuppet investigations/Ugbedeg/Archive, in particular Lowquit and Botti12, for possible older accounts. MarioGom (talk) 14:22, 15 February 2022 (UTC)
• Also see {{checkuser|1=Mr J Stone|master name={{#titleparts:{{SUBPAGENAME}}}}}}. MarioGom (talk) 14:27, 15 February 2022 (UTC)

Here's why I think these 3 accounts are part of the UPE sockfarm at Wikipedia:Sockpuppet investigations/Ugbedeg/Archive:

1. Article overlap on Qatar-related topics, pushing pro-Qatar POV as previous socks. See, for example, {{EIA|Ojnist|Mr J Stone|Jidano|Botti12|Lowquit|Northern Escapee}}, also see State-sponsored terrorism history for overlap between Ojnist and Northern Escappee (missed by EIA, maybe because of revdel?).
2. Activity initiated soon after Botti12 block on 2021-12-20: Mr J Stone (2021-12-27), Jidano (2021-12-29); and after Lowquit block on 2022-01-06): Ojnist (2022-01-12).
3. Sharp day alternation, see [https://spi-tools.toolforge.org/spi/timeline/Ojnist?users=Mr%20J%20Stone&users=Jidano&users=Ojnist consolidated contributions], in particular, dates of changes between accounts.
4. Loosely similar timecards.
5. Similar edit summary style for Jidano and Ojnist (see collapsed info below). I would highlight {{tq|there are sources now}} and {{tq|toning down}}.
6. Mr J Stone used a different summary style, with the braces quirk pointed out by Oshwah. This slipped into Ojnist once {{diff2|1070784259}}. This happened after a few days where Ojnist didn't edit, Mr J Stone edited, and the first Ojnist edit after that happened to use that edit summary quirk.

{{cot|Jidano edit summary exact matches}}

• {{tq|birth date}} (Jidano/{{diff2|1063429483}}, Supazapi/{{diff2|1054968991}})
• {{tq|correction}} (Northern Escapee/{{diff2|983609245}}, Supazapi/{{diff2|1055223402}}, Ojnist/{{diff2|1068432172}}, Botti12/{{diff2|1050422601}}, Ugbedeg/{{diff2|959709235}}, Jidano/{{diff2|1068593724}})
• {{tq|highlight}} (Botti12/{{diff2|1043132218}}, Jidano/{{diff2|1063428652}})
• {{tq|nationality}} (Ojnist/{{diff2|1066184343}}, Jidano/{{diff2|1063429632}})
• {{tq|question mark}} (Ojnist/{{diff2|1069013032}}, Jidano/{{diff2|1068586317}})
• {{tq|removing tag}} (Northern Escapee/{{diff2|1004186984}}, Jidano/{{diff2|1069607849}})
• {{tq|removing template}} (Northern Escapee/{{diff2|1004570573}}, Jidano/{{diff2|1070248841}})
• {{tq|renaming section}} (Lowquit/{{diff2|1060412007}}, Jidano/{{diff2|1069604587}})
• {{tq|rephrased}} (Ojnist/{{diff2|1069093986}}, Jidano/{{diff2|1069271188}})
• {{tq|source}} (Khatoto/{{diff2|1044481229}}, Africa1900/{{diff2|945337160}}, Penafresh/{{diff2|976910773}}, Supazapi/{{diff2|1057242233}}, Ojnist/{{diff2|1069111946}}, Jidano/{{diff2|1068636048}}, Luciapop/{{diff2|1006508797}})
• {{tq|spelling}} (Jidano/{{diff2|1070402646}}, Zatito/{{diff2|1057462401}})
• {{tq|there are sources now}} (Ojnist/{{diff2|1066600886}}, Jidano/{{diff2|1070626410}}, Supazapi/{{diff2|1055893583}})
• {{tq|toning down}} (Jidano/{{diff2|1069891775}}, Northern Escapee/{{diff2|1004355434}}, Luciapop/{{diff2|1037375737}})

{{cob}}

{{cot|Ojnist edit summary exact matches}}

• {{tq|career section}} (Ojnist/{{diff2|1069060190}}, Supazapi/{{diff2|1055199185}})
• {{tq|clean up}} (Ojnist/{{diff2|1065357683}}, Ugbedeg/{{diff2|940581342}}, Luciapop/{{diff2|1019985797}})
• {{tq|correcting grammar}} (Ojnist/{{diff2|1069007774}}, Supazapi/{{diff2|1055185340}})
• {{tq|correction}} (Northern Escapee/{{diff2|983609245}}, Supazapi/{{diff2|1055223402}}, Ojnist/{{diff2|1068432172}}, Botti12/{{diff2|1050422601}}, Ugbedeg/{{diff2|959709235}}, Jidano/{{diff2|1068593724}})
• {{tq|fm}} (Ojnist/{{diff2|1068259233}}, Botti12/{{diff2|1049567117}})
• {{tq|minor}} (Ojnist/{{diff2|1068264688}}, Emmywandy/{{diff2|1050535921}}, Zatito/{{diff2|1016495927}})
• {{tq|nationality}} (Ojnist/{{diff2|1066184343}}, Jidano/{{diff2|1063429632}})
• {{tq|new source}} (Khatoto/{{diff2|1041084035}}, Ojnist/{{diff2|1069006402}}, Luciapop/{{diff2|1006509064}}, Supazapi/{{diff2|1055175572}})
• {{tq|paraphrasing}} (Ojnist/{{diff2|1065167846}}, Supazapi/{{diff2|1055310254}})
• {{tq|question mark}} (Ojnist/{{diff2|1069013032}}, Jidano/{{diff2|1068586317}})
• {{tq|rephrased}} (Ojnist/{{diff2|1069093986}}, Jidano/{{diff2|1069271188}})
• {{tq|source}} (Khatoto/{{diff2|1044481229}}, Africa1900/{{diff2|945337160}}, Penafresh/{{diff2|976910773}}, Supazapi/{{diff2|1057242233}}, Ojnist/{{diff2|1069111946}}, Jidano/{{diff2|1068636048}}, Luciapop/{{diff2|1006508797}})
• {{tq|there are sources now}} (Ojnist/{{diff2|1066600886}}, Jidano/{{diff2|1070626410}}, Supazapi/{{diff2|1055893583}})

{{cob}}

--MarioGom (talk) 16:45, 17 February 2022 (UTC)

:Also see edit summaries by {{checkuser|1=Lowquit|master name={{#titleparts:{{SUBPAGENAME}}}}}}. MarioGom (talk) 00:50, 19 February 2022 (UTC)

::See {{checkip|45.90.248.125}} which seems to be the same person loutsocking (see edit summaries), and overlaps with Lowquit, Mr J Stone ([https://en.wikipedia.org/w/index.php?title=Human_rights_in_Qatar&action=history]), and Ojnist ([https://en.wikipedia.org/w/index.php?title=Politics_of_Qatar&action=history]). MarioGom (talk) 13:48, 19 February 2022 (UTC)

• I'll just add this as a comment rather than a "CU decision". I read through the evidence and I did some looking around in regards to these users and their edits and behaviors. After having done so, I honestly don't feel that there's enough convincing evidence here that demonstrates or argues, to a high level of certainty, that sock or meat puppetry is likely occurring here. I understand that there may be issues in terms of conflict of interest as well as issues of trust when it comes to the legitimacy of {{noping|Jidano}}'s edits, as stated in the evidence above (where the user apparently removes content stating that the citations used are not legitimate, when this may not be the case). I have no comment in regards to whether or not this is actually the case.

:However, these issues and suspicions are irrelevant and not within the scope of this noticeboard. This noticeboard's purpose is to review evidence, investigate, and use the information found in order to determine if sock puppetry or meat puppetry is likely occurring. In the end, the evidence presented only points to one diff ([https://en.wikipedia.org/w/index.php?title=State-sponsored_terrorism&diff=1070784259&oldid=1069751520 here]) by {{noping|Ojnist}} inferring that this edit might be connected to {{noping|Jidano}} because of a recent move, and that references to the same publishers were cited (which, for the most part, are commonly referenced publishers).

:That being said, there is one thing that I found that does raise an eyebrow. The edit summary used in the diff above ("{{ updated information with verified sources}}") is not only very habitually unique in that the summary text is surrounded by two brackets on each side, but is habitually identical to all of the edit summaries that {{noping|Mr J Stone}} included with their edits.

:My thought is that, sure - something not-so-legitimate may definitely be going on here, but I just don't have enough evidence presented here that I believe is to a level of certainty that justifies my use of the checkuser tools to investigate further. If another checkuser feels differently and proceeds, do me a solid (if you don't mind). :-) Respond here, ping me, let me know, and give me your input and thoughts as to why. If I missed something or didn't give information or details enough weight, I'd like to know and learn from it. :-) Thanks - ~Oshwah~^{(talk) (contribs)} 02:54, 16 February 2022 (UTC)

• {{u|Oshwah}}, I read through {{u|MarioGom}}'s commendably detailed notes above, and was persuaded that a possible connection with Ugbedeg was worth investigating. Feel free to e-mail me if you want a more fulsome discussion about exactly why, I don't want to give too much away here. Having investigated, I am confident enough to say that Ojnist and Jidano are {{confirmed}} to one another, and also to {{noping|Lowquit}} and to {{noping|Cambodier}}.
• {{Clerk Request}} - please merge this into an appropriate case, and consider what tags to apply - the connection I made was to Lowquit/Cambodia, who are only suspected to {{noping|Ugbedeg}}. Thanks Girth Summit _(blether) 16:16, 21 February 2022 (UTC)
• Following addition comments above, I checked {{noping|Mr J Stone}} - they are {{confirmed}} to {{noping|Botti12}}, blocking. Girth Summit _(blether) 08:15, 22 February 2022 (UTC)
• Merged to Ugbedeg, tagged them all as suspected. Closing. --Blablubbs (talk) 13:38, 25 February 2022 (UTC)

----

{{sock list|1=EricaHMcroy|2=GregMHopper|tools_link=yes}}

I am pretty certain EricaHMcroy and GregMHopper are the same: Similar username, newly created, doing the same conflict of interest edit of removing information that bad reflects on the company: [https://en.wikipedia.org/w/index.php?title=Henley_%26_Partners&diff=prev&oldid=1082466361 EHM] vs. [https://en.wikipedia.org/w/index.php?title=Henley_%26_Partners&diff=prev&oldid=1082111731 GMH], both using a minor edit flag and the visual editor.

CU to confirm and to see if there is something wider going on. User:Blablubbs has flagged the page for UPE. There is also an active disclosed paid editor on the page (Sarah Nicklin).

I am filing under this case (and not a new GregMHopper), because [https://en.wikipedia.org/wiki/Special:Contributions/Salbador7070 Salbador7070], blocked as part of the Ugbedeg case, was active on this page and also used the visual editor to blank out material. Pikavoom ^Talk 10:22, 13 April 2022 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• The two accounts are {{possible}}, and even that might be a bit generous given the wildly different devices. -- Amanda (she/her) 15:28, 13 April 2022 (UTC)
• I've blocked both accounts for UPE which seems the most likely explanation. Closing. Callanecc (talk • contribs • logs) 11:09, 22 April 2022 (UTC)

----

{{sock list|1=Lucasanco|tools_link=yes}}

The usual pro-Qatar editing by this sockfarm, focused on Human rights in Qatar, 2022 FIFA World Cup controversies, etc. Similar timecard. Some of its recent distinctive edit summary quirks (e.g. {{diff2|1062268138}}{{diff2|1077233981}}). Requesting checkuser since it was effective for 14 February 2022 report. Also, I'll remind that this sockfarm seems to work on the same Qatari op as Bennet43 SPI and Radovicdarko538 SPI. While I think they are different groups with the same client, comparing checkuser data against the others may still be useful, in particular for Bennet43. MarioGom (talk) 17:09, 17 April 2022 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{Inprogress}} - -- RoySmith (talk) 01:07, 18 April 2022 (UTC)
• Lucasanco appears to be {{unrelated}} to the accounts from 13 April 2022 or anything else I could find. -- RoySmith (talk) 01:09, 18 April 2022 (UTC)
• Nothing more to do given the CU result. Closing. Callanecc (talk • contribs • logs) 11:05, 22 April 2022 (UTC)

----

{{sock list|1=Acroobootic|2=Louis Versace|3=DaliaDalila|tools_link=yes}}

Pro-Qatar editing on previous sock target Qatar Charity. For those that know the dictatorship playbook, [https://en.wikipedia.org/w/index.php?title=Qatar_Charity&diff=prev&oldid=1095574040] sets off alarm bells. Louis Versace added for Parcos, quickly followed up by Acroobootic. MER-C 06:15, 2 July 2022 (UTC)

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Checkusers might want to compare to Bennet43 too, since that's another pro-Qatar UPE sockfarm that has some similarities too. MarioGom (talk) 11:30, 2 July 2022 (UTC)

• Took a look. CU data for Ugbedeg is a tangled mess and it probably has more than one group involved. Acroobootic and DaliaDalila are on the same wide, busy range with the same very common UA, and log data puts suspected past Ugbedeg socks {{checkuser|Ojnist}} and {{checkuser|Jidano}} on the same range. My gut says they aren't using proxies, but I can't give you a firm answer either way. Louis Versace is in a different country. GeneralNotability (talk) 14:08, 2 July 2022 (UTC)
• {{awaitingadmin}} - please indef Acroobootic and DaliaDalila as suspected per the CU results and behaviour. I don't think Louis Versace is an Ugbedeg sock, but their editing pattern screams UPE. I won't formally request a block for that in my capacity as a non-admin clerk, but the reviewing admin may wish to take that into consideration. Thanks, Spicy (talk) 01:36, 3 July 2022 (UTC)
• {{bnt}}. I concur Versace is probably someone else, but I don't have the mental bandwidth to look into a UPE block right now. Closing. --Blablubbs (talk) 06:14, 3 July 2022 (UTC)

----

{{sock list|1=Asema1957|tools_link=yes}}

In the initial activity period in 2020, edit summary style was similar to Beinos' (e.g. {{diff2|969071357}}{{diff2|976755751}}) and created SocialCred (this sockfarm is known for UPE). Then in 2022 switched to similar Twinkle grinding as other socks (see {{diff2|1091748723}}{{diff2|1050508740}}{{diff2|1049570001}}) mixed with pro-Qatar posting as others in the archives. Timecards are a good match too. Requesting CheckUser since this is a particularly prolific UPE sockfarm, and checks have occasionally been useful. MarioGom (talk) 18:40, 30 October 2022 (UTC)

:Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{Inprogress}}. --Blablubbs (talk) 20:16, 30 October 2022 (UTC)
• Asema1957 is {{possible}} to the archive. That's good enough for me given behaviour, so I have {{bnt}} as suspected. I made a limited attempt to look for others and found no accounts that looked behaviourally related. Closing. --Blablubbs (talk) 20:36, 30 October 2022 (UTC)

----

{{sock list|1=Abinsoo|tools_link=yes}}

Abinsoo signed up on 2021-11-13 00:29:44, Jidano on 2021-11-13 00:36:09. The account warmed up with the same kind of gnoming (hotcat: {{diff2|992853935}}{{diff2|1080780873}}, {{diff2|990592891}}{{diff2|1081137757}}, {{diff2|987162215}}{{diff2|1078832482}}; shortdesc: {{diff2|1013572593}}{{diff2|1078834849}}, {{diff2|994345747}}{{diff2|1081399867}}), then moved to the pro-Qatar edits that are now common among accounts of this sockfarm. Timecard is a decent match too. MarioGom (talk) 13:53, 20 February 2023 (UTC)

:Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{Inprogress}}. I'll sweep for sleepers. --Blablubbs (talk) 15:27, 20 February 2023 (UTC)
• {{nosleepers}}. From a technical perspective, I'd say they look a touch more like Bennet43 than Ugbedeg; either way, it seems plainly apparent that they belong to one of these coordinating sockfarms that swarm Qatar-related issues, and they are most definitely trying to evade CU. {{sblock}}. --Blablubbs (talk) 15:37, 20 February 2023 (UTC)
• Thank you. I'll review the archives again. It is possible that we have mixed some Bennet43 accounts into this case since the 18 December 2021 report or so. MarioGom (talk) 15:57, 20 February 2023 (UTC)
• Just for the record, I think that Ojnist (tagged as Ugbedeg), Minasta and Zanaika (tagged as Bennet43) are the same person. Ojnist and Jidano are CU-confirmed and also good behavioral match. And Abinsoo is a good match to Jidano. Unfortunately, I didn't figure out how to untangle both cases, so I'll leave this without tags for the time being. Closing. MarioGom (talk) 18:05, 20 February 2023 (UTC)

----

{{sock list|1=Booberring|2=Atigat|tools_link=yes}}

Same modus operandi as {{checkuser|Soheelmoon}}:

• Both gamed autopatrolled perm. Soheelmoon did a bunch of creations between 10 March 2021 and 26 February 2022 focusing on biographies with easy to pass notability criteria [https://en.wikipedia.org/w/index.php?title=Special:Contributions&end=&namespace=0&newOnly=1&start=&tagfilter=&target=Soheelmoon&offset=&limit=500], then they requested autopatrolled on 27 February 2022 {{diff2|1074273529}} and never created an article again. Likewise, Booberring created many articles between 22 July 2023 and 29 September 2023 [https://en.wikipedia.org/w/index.php?title=Special%3AContributions&target=Booberring&namespace=0&tagfilter=&newOnly=1&start=&end=&limit=500], requested autopatrolled on 30 September 2023 {{diff2|1177903268}} and never created any more articles.
• During their autopatrolled gaming, they added references in their articles that did not support the preceding text. It appears as if references were just selected from Google search and then placed randomly. You can check my {{tl|Failed verification}} marks in their articles, but here's some samples for Soheelmoon {{diff2|1190007900}} and Booberring {{diff2|1190001196}}[https://en.wikipedia.org/w/index.php?title=Nathalie_Castillo&diff=1190001670&oldid=1177868170].
• After some time, both switched their interests to the Qatar-aligned edits that are already common in Ugbedeg and Bennet43 sockfarms. See Soheelmoon {{diff2|1168019720}}{{diff2|1168019720}}{{diff2|1161987592}}{{diff2|1161985569}} and Booberring {{diff2|1188594138}}{{diff2|1189821902}}.
• Timecards are somewhat similar [https://xtools.wmcloud.org/ec-timecard/en.wikipedia.org/Soheelmoon][https://xtools.wmcloud.org/ec-timecard/en.wikipedia.org/Booberring]. MarioGom (talk) 16:16, 15 December 2023 (UTC)

:* Added Atigat, with a similar biography creation spree [https://en.wikipedia.org/w/index.php?title=Special%3AContributions&target=Atigat&namespace=0&tagfilter=&newOnly=1&start=&end=&limit=500] followed by the usual Qatarposting. MarioGom (talk) 21:44, 15 December 2023 (UTC)

:Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{Requestandendorse}}, since there might be comparable data in cuwiki, and also it is likely there are other active socks involved in autopatrolled or new page reviewer gaming. MarioGom (talk) 16:17, 15 December 2023 (UTC)
• This is a terrible range. I do have one clear and confirmed connection on them, but I don't know how related to this specific SPI it is (there are a few different SPIs associated with it). A more experienced COI/spam hunter CU should probably look at this case. Izno (talk) 00:07, 16 December 2023 (UTC)
• :For what it's worth, any connection to Bennet43 SPI or Radovicdarko538 SPI is probably worth mentioning, since these 3 sockfarms share a major client (the Qatari one) and they might have been mixed up at some point. MarioGom (talk) 00:36, 16 December 2023 (UTC)
• ::I bumped into neither of those two. Izno (talk) 01:20, 16 December 2023 (UTC)
• I'm handing this and 18 December 2023 both here. I'd say all three are {{possible}}. Booberring matches an IP range we've seen before for this sockfarm, but it's in a large country where IP allocations are known to be confusing. Atigat and CrutialEditor are both making extensive use of proxies; if I shake the teacup in exactly the right way and squint at the leaves, I can convince myself it's similar to a proxy use pattern we've seen before, but I think you're going to have to go mostly on behavior for all three. RoySmith (talk) 22:44, 18 December 2023 (UTC)
• The Booberring range match works for me. I think behavioral evidence alone is enough, so even a weak technical match makes it even less likely the connections are a coincidence. For Atigat and CrucialEditor, I'll take the proxy use as an additional similarity to this sockfarm. {{awaitingadmin}} - please, indef the three accounts as suspected to the master. Thank you. MarioGom (talk) 21:29, 21 December 2023 (UTC)
• {{Btc}} Izno (talk) 23:27, 21 December 2023 (UTC)

----

{{sock list|1=CrucialEditor|tools_link=yes}}

• Interest in Valentina Sassi {{diff2|1161991486}} like previous socks [https://en.wikipedia.org/w/index.php?title=Valentina_Sassi&action=history&offset=&limit=500].
• Later switch to Qatarposting (see recent edits, and compare to the previous report).
• Same timezone as others, mostly weekdays.
• Nice timeline line up with socks in the above report and Soheelmoon: [https://spi-tools.toolforge.org/spi/timeline/Ugbedeg?users=Soheelmoon&users=Atigat&users=Booberring&users=CrucialEditor] MarioGom (talk) 16:11, 18 December 2023 (UTC)

:Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{Requestandendorse}}, please, compare to the above report and previous socks. Thank you. MarioGom (talk) 16:12, 18 December 2023 (UTC)
• See 15 December 2023 RoySmith (talk) 22:45, 18 December 2023 (UTC)
• {{awaitingadmin}} see the previous report. MarioGom (talk) 21:30, 21 December 2023 (UTC)
• And here. Izno (talk) 23:28, 21 December 2023 (UTC)

----

{{sock list|1=Lokotim|2=TunGunPun|tools_link=yes}}

Given the sockpuppetry at Qatari soft power and its AFD, I had a look to users on Wikipedia:Articles for deletion/Qatari soft power (2nd nomination). At least these two are related to this sockfarm:

• TunGunPun signed up on 2023-02-10 06:11:21, while previous blocked sock Atigat signed up on 2023-02-10 06:16:09, ~5 minutes later. Behavior matches previous socks: NPOL (or similar easy notability) article creation, and then flipping to pro-Qatar edits.
• Lokotim first edit was on Alessio Sundas on wikidata ([https://www.wikidata.org/w/index.php?diff=1254336814]), an article created and extensively edited by Ugbedeg socks. MarioGom (talk) 13:50, 24 March 2024 (UTC)

:Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• {{Requestandendorse}} - especially for sleeper check, since there seems to be a handful of other active accounts. MarioGom (talk) 13:51, 24 March 2024 (UTC)

These are {{technically indistinguishable}} from one another:

:{{sock list|Tapmani|TunGunPun|Lagdo22|Cossyno|Lalyon|Sarokhi|Suntoloo Panoom|CreamyP|Lokotim}}

• Note that the nature of the data makes spurious connections very possible so behaviour should be analyzed before blocking. Cossyno, Sarokhi and Lalyon are particularly interesting from a behavioural perspective.
• It's certainly {{possible}} that these accounts belong to Ugbedeg, but I can't say any more or less than that. Spicy (talk) 02:52, 25 March 2024 (UTC)

:@Spicy: I looked over behaviour for all of these and technical data for a handful of them yesterday, and I'd say it's exceedingly likely that they're connected. I think CU blocks are probably preferable here but I'm hesitant to do it myself because I've not checked all of them{{snd}}would you like to do the honours? --Blablubbs (talk) 10:56, 1 April 2024 (UTC)

• Thanks, Blablubbs. I've blocked the accounts. Additional information is available to CUs [https://checkuser.wikimedia.org/w/index.php?oldid=52212 here]. Spicy (talk) 10:17, 3 April 2024 (UTC)

----

{{sock list|1=ItsMeGabeProductions|tools_link=yes}}

[https://sigma.toolforge.org/editorinteract.py?users=Ugbedeg&users=ItsMeGabeProductions&users=CreamyP&users=Lalyon editor interaction] with CreamyP, and similar AFC Grinding. -- Aunva6^{talk - contribs} 19:20, 15 April 2024 (UTC)

:Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• In comparison to the CU wiki info on Ugbedeg, ItsMeGabeProductions is {{unrelated}}. Closing with no further action.-- Ponyo^{bons mots} 21:12, 24 April 2024 (UTC)

----