Wikipedia:Sockpuppet investigations/Ndizzy4glo/Archive

Suspected sockpuppets
Has previously tried creating article under Draft:Ndifreke Ukpong as well as in mainspace Ndifreke Ukpong. I'm not sure if checkuser is required as you can see in the username's that they're most likely the same person. See User:Google4glo and User:Jellux all focused on creating and editing same page and topic. Jamiebuba (talk) 10:22, 27 November 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments
I removed the master from the suspected sock list and added the two users mentioned in the body by the filer.--Bbb23 (talk) 15:03, 27 November 2022 (UTC)
 * See below. Spicy (talk) 18:13, 27 November 2022 (UTC)

Suspected sockpuppets

 * ( originally filed under this user)

See histories of Ukpong, User:Google4glo/sandbox, Draft:Ndifreke Ukpong and this edit trying to hijack Ndifreke_Udo to be about their subject as well as name similarities between and. All focused on the promotion of Ukpong. I know the master is stale, but I think that's the oldest so filing it under that. Feel free to update as needed if there are others. Star  Mississippi  16:02, 27 November 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * , the 4 accounts listed here are pretty clearly related to each other but I don't really see a connection to the master. "Ukpong" seems to be a fairly common Nigerian name and while Ukpong1 engaged in UPE, I don't see that they ever tried to promote Ndifreke Ukpong. Am I missing something? Spicy (talk) 17:15, 27 November 2022 (UTC)
 * No, that was my misreading of the history of Ukpong as far as the master I filed under, which the latter accounts tried to hijack for "their" subject. Apologies (and to @Firefly for the block based on that. I do think the four are acting in concert. Should I refile with Ndizzy4glo as the master or can that be done by a clerk if there's merit? Happy to proceed however is best. Star   Mississippi  18:03, 27 November 2022 (UTC)
 * CU has nothing here unfortunately, these ranges and assignment patterns mean that making sense of things is like trying to read tea leaves. I agree that the accounts are acting in some sort of concert and so I'm reblocking the lot but this time without tags. firefly  ( t · c ) 18:07, 27 November 2022 (UTC)
 * Moving case from Sockpuppet investigations/Ukpong1. Spicy (talk) 18:12, 27 November 2022 (UTC)
 * I've tagged Ndizzy4glo, Jellux, Google4glo and Miracle Etim as suspected to each other based on behaviour. Closing. Thanks, Spicy (talk) 18:14, 27 November 2022 (UTC)

Suspected sockpuppets

 * ( original case name)

Brand new account just happens to find an article that Jellux, one of the recent socks, started. Sleeper check please Star   Mississippi  15:03, 9 December 2022 (UTC). Ugh. Forgot the SPI is Sockpuppet investigations/Ndizzy4glo/Archive. Sorry for making a mess of your cleanup. Star  Mississippi  15:04, 9 December 2022 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Moved the case under Ndizzy4glo since it seems that was where it was intended to be filed. Mz7 (talk) 09:46, 10 December 2022 (UTC)
 * Rock2222 . Because of the highly dynamic nature of the underlying IP address range, a sleeper check is quite difficult here, unfortunately., closing. Mz7 (talk) 09:58, 10 December 2022 (UTC)

Suspected sockpuppets
As background, please see User talk:Girth Summit. I won't repeat what I said there, but I will include this page at wikidata that lists all the Marcyway4 socks. I will also repeat that Sockpuppet investigations/Galantoe000 is implicated in this. I may add additional suspected socks if I find more Marcyway4 socks as I haven't yet gone through the entire list looking for accounts that have also edited at en.wiki. I have found others that are not listed here but haven't included them because they are stale. If a clerk or CheckUser wishes me to add them, I can.

A few more notes. Behavior is tough here because this is all about widespread spam, so the socks don't necessarily promote the same articles. I have blocked Khaddy4 and QDJ22 as socks, but I suspect they are more likely meat puppets, don't know for sure - Khaddy4 is being contentious and less than forthcoming about their behavior. Finally, I'm aware that Ndizzy4glo is not the oldest account, but I had to put this somewhere until it can be sorted out, and Ndizzy4glo has the benefit of being a non-stale Marcyway4 sock at wikidata. Bbb23 (talk) 22:02, 26 February 2023 (UTC)
 * I've added two more to the list: Albakry028 and Bukky658; Bukky's edits appear to be different from what I've seen - in sheer number here and edits at many other projects (if the socks do edit multiple projects, it's usually restricted to wikidata, Commons and en.wiki). I also wanted to add that most of the edits made by these socks at wikidata have been deleted, so I can't look for patterns. One more thing: many of these socks have also been sock-blocked at Commons.--Bbb23 (talk) 23:37, 26 February 2023 (UTC)
 * I've added the following socks to the list: Drayparker89, Eyinjuseun, Jay080, Josiahroberrt, LocomotiveEngine, Luckymiles, Marviie, and Mujeeb6989. I believe I've gone through the entire list, so unless new socks are added at wikidata, I probably am done adding accounts. One final note: there is a strong connection with Nigeria in this farm. Although many of the promotional pages are unrelated to Nigeria, many are, and a lot of the "ordinary" edits by more active socks are to Nigerian articles, including universities and related articles. I believe many of the users claim to be librarians at Nigerian universities.--Bbb23 (talk) 17:11, 27 February 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * I have not looked at all the accounts yet, but note that Minasta is Bennet43 or Ugbedeg (there's some mixed accounts from both cases). Ugbedeg is likely a PR company in Nigeria, while Bennet43 is in a different continent. MarioGom (talk) 23:34, 2 March 2023 (UTC)
 * Permalink to the previous discussion: Special:Permalink/1141767978. MarioGom (talk) 23:40, 2 March 2023 (UTC)
 * , given the previous sockpuppetry blocks at Wikidata. MarioGom (talk) 23:43, 2 March 2023 (UTC)
 * I'll partially retract my endorsement: Marviie, Eyinjuseun, Bukky658, Yahuzaishat are likely editathon particpants sharing some crowded ranges with the others. I don't think these need to be checked.I'm fairly sure most of these accounts are not related to Minasta or Ugbedeg, except LocomotiveEngine. Mujeeb6989 and Yinka Ogunsina could be UPE but not the same sockfarm either. Some of the accounts I didn't mention here could be related to Ndizzy4glo, I'm still not sure. MarioGom (talk) 19:35, 3 March 2023 (UTC)
 * - I'm not sure I have time now to do more than dip my toe in the waters, but I'm taking a look.  Girth Summit  (blether)  15:29, 7 March 2023 (UTC)
 * Editing from the same wide, busy, socky ranges:, , , , , , , , , , , , . The UAs don't tell me much - there's a bunch of different ones in use between the accounts (with some accounts using several UAs). The IPs they're on a really busy, and many (perhaps most) of them are coming from ranges that are blocked for spam. Also, I can say that the following are ✅ to one another:
 * and, sock used to !vote keep in an AfD about an article written by the master - will block.
 * and
 * Looks different:.
 * That's all I can say at this time. I'll leave this open in case someone else wants to take a look. Girth Summit  (blether)  15:57, 7 March 2023 (UTC)
 * I'm not sure if anyone else will look at this or how long we should leave it as is before disposing of it. In the meantime, I believe we should block all of the unblocked accounts GS listed in the "Editing from the same wide" paragraph above without tags, including Marviie, who Mario said was likely participating in editathon, unless Mario strongly believes that that one account should not be blocked. Perhaps Mario could explain why he thinks that; if they were editing in an editathon, it could only have been for a short time multi-year tenure here. Once we're "done" here, we can then create a separate SPI with the oldest account and tag everyone appropriately (mostly confirmed and suspected in my view).--Bbb23 (talk) 17:59, 7 March 2023 (UTC)
 * Oops - I missed that I wasn't supposed to check that one. My bad - or maybe my good? Girth Summit  (blether)  18:01, 7 March 2023 (UTC)
 * Hi - sorry, I left you hanging on this. I wouldn't have any objection to blocking the accounts listed above if you think the behaviour warrants it.  Girth Summit  (blether)  18:22, 12 March 2023 (UTC)
 * The question is do we continue to wait to see if another CheckUser will look at this, or do we end it as I suggested above? I'd prefer to dispose of this in some fashion rather than block and then wait some more.--Bbb23 (talk) 18:30, 12 March 2023 (UTC)
 * I haven't run any additional checks, but I did take a look at the log. I'm relatively familiar with these ranges; there is a huge number of people on them, so the probative value of "same range" is extremely limited in this case. I'm not sure what led to the Wikidata blocks, but after looking through the enwiki edits of some of the accounts, I doubt they're all operated by the same individual (for example, looks to have been created for one-off userspace self-promotion (see their deleted userpage), whereas  has been contributing short articles about administrative units, while  is a suspected sock of the Bennet43 farm, which is presumed to be a UPE operation). I haven't looked super closely, so I'm not claiming that none of these accounts are socks of each other (that may or may not be the case), but I'd advise not overestimating the technical evidence and only blocking accounts where strong behavioural links can be demonstrated. --Blablubbs (talk) 17:04, 13 March 2023 (UTC)
 * I've hesitated responding to your comments because I'm not sure how to do so in a "friendly" manner. This case is not a garden-variety "behavioral evidence needs evaluation" because what constitutes behavioral evidence here, let alone "strong behavioral links", is not clear. So, bottom line, unless you or someone else is going to clarify the standard, this report/case is going to sit here until someone gets tired of seeing it and closes it without further action because I, the only person thus far who seems interested in the problem, don't intend to spend any more of my time on it. These comments are not intended to be disrespectful. As I've told others in the past, particularly at SPI, it's almost always a mistake to invest too much in a project if that project's success depends on the agreement of others.--Bbb23 (talk) 16:15, 16 March 2023 (UTC)
 * @Bbb23; I'm sorry if my comment above is frustrating. I struggled with writing it because I found it hard to provide helpful input without saying things I shouldn't say or running checks I shouldn't run. If it helps, here's some more information:
 * I have run checks on Ndizzy4glo, Minasta, and Khaddy4 over the course of this (and other) investigation(s). These accounts are, in my estimation based on local CU data, shades of and  to each other. I'm not sure what data triggered a "confirmed" finding at d:Wikidata:Requests for checkuser/Case/Marcyway4, but I can say that based on the checks I've run here, I'm fairly confident I could not reproduce that finding on enwiki. This may or may not be a function of the fact that the range is probably significantly busier on enwiki than it is on wikidata. Based on local data I could probably come up with several hundred accounts that have at least an equally strong technical connection to Ndizzy4glo, Minasta, and Khaddy4 as those accounts have to each other.
 * Some of these accounts engage in suspicious (read: spammy) behaviours on enwiki; others do not. Overall, the account list here seems like it could've been constructed by pulling a random sample of the huge range they're on. I don't think I could justify sockblocks based on local behaviour.
 * Most of the accounts have no or few live edits on Wikidata, so there isn't much to work with in terms of cross-wiki behaviour either.
 * Maybe I'm missing something big, either behaviourally, or in terms of CU data; but from what I can see right now, I'm just not seeing the connection.
 * --Blablubbs (talk) 17:03, 16 March 2023 (UTC)
 * From my perspective, the above is a much more satisfying explanation, thank you. So, in your view, should we just close this with no further action? I'd rather that than let it dangle out here waiting for someone else to look at it, which probably will never happen. I hate clutter. :-) --Bbb23 (talk) 17:09, 16 March 2023 (UTC)
 * @Bbb23: Based on the evidence I've seen, that would be my recommendation for now, yes. If or another Wikidata CU is willing to privately share some of the technical data involved, I'd also be happy to take another look to try and figure out what triggered the divergent CU assessments. --Blablubbs (talk) 17:57, 16 March 2023 (UTC)
 * It's worth a shot. You've already pinged Jasper, so I'll ping the others: The only one who's active at en.wiki is Alaa; I didn't look to see how active the others are at wikidata. If you're willing, you could also make a request at checkuser-l. I won't close this until we've given the CheckUsers a chance to respond. Some might contact you privately, of course.--Bbb23 (talk) 18:25, 16 March 2023 (UTC)
 * Update: It's being worked on. I've gone ahead and placed this for the time being. --Blablubbs (talk) 11:34, 21 March 2023 (UTC)
 * Based on off-wiki conversations with Wikidata checkusers, I don't believe that the technical evidence could support any further action on enwiki. Closing. --Blablubbs (talk) 23:31, 28 March 2023 (UTC)

Suspected sockpuppets
Follow up to this discussion where it was crystal clear they were not a new editor. flagged the connection made wherein they're already blocked on WikiData so. Star  Mississippi  18:25, 9 May 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

In the interests of clarity, this account was blocked on Wikidata by an automated filter. I routinely monitor and review such automated blocks. In this case, I used behavioural evidence to confirm it, so this account has not been the subject of a Wikidata checkuser investigation. The two preceding accounts are apparently related via d:Wikidata:Requests for checkuser/Case/Marcyway4. Bovlb (talk) 19:08, 9 May 2024 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
I've looked at this twice, once before commented, and once now, and I still can't figure out how this is directly related to Ndizzy4glo or one of their socks. I saw Bovlb comment it was connected to Rock2222, but how?--Bbb23 (talk) 22:50, 9 May 2024 (UTC)


 * Both users had similar behaviour on Wikidata, specifically in the way they created items on "Ndifreke Ukpong". We have seen some 14 items created for this entity, and dozens of blocks since we created the filter. Bovlb (talk) 00:33, 10 May 2024 (UTC)
 * See also the deletion history of Ndifreke Ukpong. Bovlb (talk) 00:36, 10 May 2024 (UTC)


 * With the dots now connected (thanks), blocked, tagged, closing. Bbb23 (talk) 00:43, 10 May 2024 (UTC)
 * TY! I really wish any of the editor interaction analyzers were admins to "see" deleted edits. Makes it easier to connect some of the dots. Star   Mississippi  00:55, 10 May 2024 (UTC)