Wikipedia:Sockpuppet investigations/NormalguyfromUK/Archive

Suspected sockpuppets
Sock recreating the deleted works of the master. UtherSRG (talk) 15:34, 23 June 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ Courcelles (talk) 02:31, 26 June 2023 (UTC)
 * . Also throwing in as another ✅ sock. Closing.  --Blablubbs (talk) 09:51, 28 June 2023 (UTC)

Suspected sockpuppets
obvious behavioral sock - early edit overlap on obscure article after sockmaster blocked https://sigma.toolforge.org/editorinteract.py?users=Andrewtopg&users=NormalguyfromUK&users=&startdate=&enddate=&ns=&server=enwiki https://en.wikipedia.org/w/index.php?title=East_German_uprising_of_1953&diff=prev&oldid=1161263064 is a INFOBOX edit which is NormalguyfromUK's favourite gnoming.

creation of tendentious Albanian article https://en.wikipedia.org/w/index.php?title=Draft:Operation_Breakthrough_(Military_Invasion)&action=history with magic instant editing of a draft article from (these socks/meat puppets usually claim to be following each other so they find drafts, but there's no excuse for Based.shqiptar.frompirok to have found this so quickly)

Immediate alibi/ Excuse set up for meat puppetry/IP sharing - https://en.wikipedia.org/w/index.php?title=User_talk:Andrewtopg&diff=prev&oldid=1161439034 Awlof (talk) 20:41, 23 June 2023 (UTC)


 * In addition to the extremely obvious naming similarities, has now recreated as draft 1949_Anglo-American_invasion_of_Communist_Albania https://en.wikipedia.org/w/index.php?title=Draft:1949_Anglo%E2%80%93American_invasion_of_Communist_Albania&action=history. This is 's preferred name for Operation Valuable and some of the last actions of NGfUK were undiscussed moves of that page https://en.wikipedia.org/w/index.php?title=Operation_Valuable&diff=prev&oldid=1160443046 to the title now being created, as well as earlier undicsussed moves to this title in March https://en.wikipedia.org/w/index.php?title=Operation_Valuable&diff=prev&oldid=1147547886
 * There are large cut and pastes being made into the draft from Operation Valuable source- https://en.wikipedia.org/w/index.php?title=Draft:1949_Anglo%E2%80%93American_invasion_of_Communist_Albania&diff=prev&oldid=1163993258
 * There are the same extremely obscure additions being made to the new infobox - https://en.wikipedia.org/w/index.php?title=Draft:1949_Anglo%E2%80%93American_invasion_of_Communist_Albania&diff=prev&oldid=1163996942 -  that NGfUK was making to Operation Valuable back in March  https://en.wikipedia.org/w/index.php?title=Operation_Valuable&diff=prev&oldid=1147352075 Guavausher (talk) 17:05, 7 July 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


 * the behavioural evidence here and below suggest he definitely is. Proxies/meatpuppetry. 37.245.41.140 (talk) 05:30, 10 July 2023 (UTC)
 * Special:Contributions/37.245.41.140 is an IP sock of User:Orchomen. Mztourist (talk) 06:55, 10 July 2023 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * The CU data indicates that Based.shqiptar.frompirok is ❌ RoySmith (talk) 12:30, 9 July 2023 (UTC)
 * Closing per evidence below. Ivanvector (Talk/Edits) 17:08, 3 August 2023 (UTC)

Suspected sockpuppets

 * ( original case name)

Hello. I'm not completely sure which account is the sockmaster but I am confident all three are run by the same individual. Fantasticer was indefinitely banned today. I had reverted an edit this user made earlier today as it was an unsourced addition and came with an oddly threatening edit summary. Three hours later, AcEagle12 restored the edit albeit with "sources" but then promptly self-reverted with another strange edit summary. Both accounts have edited exclusively on the same topics.

NormalguyfromUK (originally Albanian 7) was indefinitely banned a few weeks ago. This user's first block was on 30 January 2023. The AcEagle12 account was created on that day and edited the same talkpage.

NormalguyfromUK and Fantasticer are already indefinitely blocked but AcEagle12 is not and is now apparently going to be more active, given today's edits including the creation of a sandbox. I'm not sure whether or not CheckUser is needed here.

Thank you. -- Local hero talk 17:12, 7 July 2023 (UTC) -- Local hero  talk 17:12, 7 July 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - Please move to Sockpuppet investigations/NormalguyfromUK, which is currently active. Bbb23 (talk) 15:16, 8 July 2023 (UTC)
 * Moved.  qedk ( t  愛  c ) 12:26, 9 July 2023 (UTC)
 * The CU data indicates both of these are ❌, but I wouldn't be shocked if there were proxies in use to obscure the true identity. RoySmith (talk) 12:42, 9 July 2023 (UTC)
 * Closing per subsequent investigations. Ivanvector (Talk/Edits) 17:09, 3 August 2023 (UTC)

Suspected sockpuppets
New account immediately editing Albanian People's Army and adding obscure Albanian sources and  the usual greater glory of Albania POV

This page is a favourite of NormalguyfromUK and the Based.shqiptar.frompirok sock. https://en.wikipedia.org/w/index.php?title=Albanian_People%27s_Army&action=history.

Like both NormalguyfromUK and Based.shqiptar.frompirok, GokuRose likes to use "improved/improvement" in edit summaries

GokuRose
 * https://en.wikipedia.org/w/index.php?title=Melissa_Mars&diff=prev&oldid=1164093078
 * https://en.wikipedia.org/w/index.php?title=Anastas_Ngjela&diff=prev&oldid=1163430371

NGfUK
 * https://en.wikipedia.org/w/index.php?title=Battle_of_Mashkullor%C3%AB&diff=prev&oldid=1156535551
 * https://en.wikipedia.org/w/index.php?title=Battle_of_Mashkullor%C3%AB&diff=prev&oldid=1156530700
 * https://en.wikipedia.org/w/index.php?title=Albania%E2%80%93Yugoslav_aircraft_incident_(1967)&diff=prev&oldid=1155069304

BShfP
 * https://en.wikipedia.org/w/index.php?title=Battle_of_Mashkullor%C3%AB&diff=prev&oldid=1156530700
 * https://en.wikipedia.org/w/index.php?title=Albanian%E2%80%93Ottoman_Wars_(1432%E2%80%931479)&diff=prev&oldid=1123973119

On wikimedia commons GokuRose uploaded this file at 17.11 on 7 July *https://commons.wikimedia.org/wiki/File:Collage_from_the_1949_Anglo_American_invasion_of_Communist_Albania.jpg
 * https://commons.wikimedia.org/wiki/Special:Contributions/GokuRose

Only five minutes later At 17.16 on 7 July Based.shqiptar.frompirok added the file to their current recreation of NormalguyfromUK's repeated attempted page move at 1949 Anglo–American invasion of Communist Albania
 * https://en.wikipedia.org/w/index.php?title=Draft:1949_Anglo%E2%80%93American_invasion_of_Communist_Albania&diff=prev&oldid=1164033961 Guavausher (talk) 12:44, 8 July 2023 (UTC)
 * I would like to point out 1 of your arguments, 1) I mostly edit Wiki articles/drafts about the Albanian People's Army and that I add " Based.shqiptar.frompirok (talk) 13:16, 10 July 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * GokuRose is ✅ See 23 June 2023 for Based.shqiptar.frompirok RoySmith (talk) 12:32, 9 July 2023 (UTC)

Suspected sockpuppets
Confirmed. Split from Sockpuppet investigations/Illyrian5999 (Special:Permalink/1160612526). MarioGom (talk) 22:22, 12 July 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Suspected sockpuppets
Let me start by saying that User:KleovoulosT was indefinitely blocked some days ago, on 14 July. Now, the account was created on 12 June 2023 (CA), which is only a week after User:NormalguyfromUK was caught socking. Even though not much time has elapsed, three more accounts have been confirmed as sockpuppets of User:NormalguyfromUK since then, which shows that they continue to be active. User:KleovoulosT doesn't have many contributions (only 12), but the few they have are in the same topic area as those of User:NormalguyfromUK; namely military incidents involving ethnic Albanians. Furthermore, they were both interested in the casualties of the 2022–2023 North Kosovo crisis; see diff1 and diff2. If there is indeed a relationship, i don't think CU will provide certain confirmation, because it has already been used a number of times since 12 June; however, i don't know exactly how the tool works, and whether an account could pass undetected in the case that special focus wasn't given by the checkuser.

User:Illirus was created six days ago, on 13 July (CA), and has been editing in the same topic area as User:NormalguyfromUK. Their very first edit was to revert (diff) an IP's contribution from the beginning of the month (diff), by reinstating the phrase "Many were killed or captured" in an infobox of Albanian–Yugoslav conflict; the phrase was originally added by User:NormalguyfromUK when they created the article (diff). Even though only six days have elapsed since the creation of User:Illirus, there is already overlap in eight pages that were also edited by User:NormalguyfromUK. Even more interesting, 18 out of the 26 total edits made by User:Illirus are in those eight pages. Demetrios1993 (talk) 02:07, 19 July 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * is oversight-blocked - I'm not party to the reason for the block, but I don't see any technical connection between them and the accounts in this case. is ✅ to, who is in turn ✅ to NormalguyfromUK. Blocking both. Girth Summit  (blether)  12:40, 19 July 2023 (UTC)

Suspected sockpuppets
User:Based_Person was created on 20 July (CA), which is exactly one day after the last sockpuppets of User:NormalguyfromUK were blocked; see the case from 19 July 2023. User:Based_Person is active in the same topic area that User:NormalguyfromUK (and former socks) was active, and even though only 11 days have elapsed since the creation of the account, their activity overlaps in 14 pages with that of User:NormalguyfromUK. It's actually 15 pages, if we also include an additional page edited by User:Illirus ; the last confirmed sockpuppet of User:NormalguyfromUK. Demetrios1993 (talk) 02:32, 1 August 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - Looks likely to me.  qedk ( t  愛  c ) 16:23, 1 August 2023 (UTC)
 * Technically, and also ❌ to Based.shqiptar.frompirok who was identified in an earlier investigation, despite the username similarity. Geolocation is inconsistent, but Based Person consistently locates within one country while Illirus et. al. are never in that country, but bounce around throughout countries which surround it. I doubt that this shows intentional obfuscation, but technical data does not rule out meatpuppetry. However:
 * is ✅ to . This account is.
 * -- Ivanvector (Talk/Edits) 17:02, 3 August 2023 (UTC)
 * I think there's enough here to say their behaviour makes it suspected enough to block and have done so. Courcelles (talk) 20:05, 4 August 2023 (UTC)
 * Tagged as suspected. Case closed. Courcelles (talk) 20:06, 4 August 2023 (UTC)

Suspected sockpuppets
The account was created recently on 4 August. Immediately after creation, they started editing Albanian-topic area articles (1 and 2), compatible with the sockmaster's area of interest. They also edited the article Anglo–American invasion of Communist Albania, where two blocked socks of NormalguyfromUK have also edited (Llaberia and Illirus). For me, this does not appear to be a coincidence, since the article in question (then still a draft) was not edited for almost a month (look at the gap here). With this in mind, I'd like administrators to also take note of Based.shqiptar.frompirok's behavior, since he also "coincidentally" returned to editing the article (draft) on 6 August, the same day that Christopherschweinsteiger started editing it (3). The editor is also promoting the same narrative that NormalguyfromUK was promoting about Operation Valuable (4 and 5). Thank you. EDIT: It wouldn't hurt to include this here too: Between 2000-01-01 and 2023-08-08 on en.wikipedia.org User:NormalguyfromUK (talk | contribs) and User:Christopherschweinsteiger (talk | contribs) both made edits to some pages in common. You can see a chronological list of all their edits on the Interaction Timeline or a table view on the Interaction Analyser. StephenMacky1 (talk) 14:43, 8 August 2023 (UTC)


 * The reason for my lack of editing on the page is because I was focused on other pages like the 2001 insurgency in Macedonia, Liberation of Tepelena, National Liberation Army (Macedonia), Battle of Tetovo and others. + You need to remember its summer break so I have other real life things to take care of. I have that page (Anglo–American invasion of Communist Albania) on my watch list so every time someone edits it I get a notification so when Christopherschweinsteiger edited the page I remembered it and started to edit on it again. Based.shqiptar.frompirok (talk) 15:24, 8 August 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ Blocked and tagged Courcelles (talk) 14:51, 8 August 2023 (UTC)
 * Noting that Based.shqiptar.frompirok did not show up when I checked this sock, and I've not checked them directly. Courcelles (talk) 15:46, 8 August 2023 (UTC)

Suspected sockpuppets
Checked while investigating a report at WP:RFPP. That's a lowercase L, by the way. See below. Ivanvector (Talk/Edits) 18:56, 11 August 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Based Person l is ✅ to, but still technically to other accounts in this case. Based on behaviour I'd say this is a second group related to the same sockmaster, and I'll leave it up to the clerks to determine if this should be a new case or kept with this one.
 * These accounts are ✅ to each other and very to the Based Person group:
 * All of the accounts are blocked without tags. Ivanvector (Talk/Edits) 18:56, 11 August 2023 (UTC)
 * Struck part of my comment above, per new findings below. Ivanvector (Talk/Edits) 21:59, 11 August 2023 (UTC)
 * All of the accounts are blocked without tags. Ivanvector (Talk/Edits) 18:56, 11 August 2023 (UTC)
 * Struck part of my comment above, per new findings below. Ivanvector (Talk/Edits) 21:59, 11 August 2023 (UTC)
 * Struck part of my comment above, per new findings below. Ivanvector (Talk/Edits) 21:59, 11 August 2023 (UTC)

Suspected sockpuppets
Another new account, which was created on 9 August. Immediately after creation, they have only edited one Albanian-topic area article (diff). However like another NormalguyfromUK's sock Christopherschweinsteiger (diff), he's also promoting the same narrative about Operation Valuable and trying to influence the consensus in a deletion discussion (diff). StephenMacky1 (talk) 20:04, 11 August 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Was already checking this related to something else. El Mangupo is ✅ to Pringlesringles. Also, El Mangupo is ✅ to who in turn is  to the "Based Person" group above, so you can forget what I said about them possibly being separate cases. Ivanvector (Talk/Edits) 21:59, 11 August 2023 (UTC)

Suspected sockpuppets
Self-explanatory. Restoring NormalguyfromUK's desired version on Operation Valuable and making silly personal attacks (diff 1) and (diff 2). StephenMacky1 (talk) 16:56, 16 August 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - Courcelles (talk) 17:39, 16 August 2023 (UTC)
 * Already blocked, I’ve semied the two articles. But we don’t connect IPs and accounts. Case closed. Courcelles (talk) 17:40, 16 August 2023 (UTC)

Suspected sockpuppets
Hello. I had some suspicions about the editor before, but I decided to wait and assume good faith, then I encountered this. Looks like there will be another attempt to create a POV fork article of the Operation Valuable and the editor is promoting the same narrative as NormalguyfromUK regarding this. They have also restored the POV fork article Battle of Vidohovë (created by NormalguyfromUK) on the Albanian People's Army article (diff). Apart from that, they show interest in the Albanian topic area much like NormalguyfromUK (see 1, 2 and 3). StephenMacky1 (talk) 15:05, 22 August 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * You might wish to look at this. The suspected sock filed a report on August 15 at Sockpuppet investigations/Orchomen, and there's also User talk:Courcelles.--Bbb23 (talk) 15:19, 22 August 2023 (UTC)
 * Thanks for the ping, but I may need to leave this for somebody else. I know it's shocking, but my attention these days has turned to content creation.  I'm working through the backlog of articles I've written but needed a bit of work to send to WP:GAN, and perhaps a WP:FA. RoySmith (talk) 15:32, 22 August 2023 (UTC)
 * ✅, blocked and tagged. Leaving this open in case RoySmith thinks anything else needs doing in light of the links above. Girth Summit  (blether)  15:30, 22 August 2023 (UTC)
 * Not really. I suspect we haven't see the last of this, however. RoySmith (talk) 16:18, 22 August 2023 (UTC)

Suspected sockpuppets
User:Elbasan.patriot was created just a few hours ago (CA); the last sock of User:NormalguyfromUK was blocked a few days ago, on 22 August (here). There is already overlap in three articles, where they made four out of their five edits. There are obvious similarities if you compare their contributions. As an example, both User:NormalguyfromUK (diff1, diff2) and User:Elbasan.patriot (diff) tried to present 3,000 casualties for Nazi Germany, in the article Liberation of Tirana. Demetrios1993 (talk) 03:30, 26 August 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * CU data isn't entirely conclusive, but they look very similar in several ways - coupled with behaviour, blocking and tagging as proven.  Girth Summit  (blether)  13:38, 26 August 2023 (UTC)

Suspected sockpuppets
Truth T restoring  NormalguyfromUK edits:

TT - NgfUK also very similar edit summaries

Repeated addition of the same list of battles to infobox by all three accounts TT NgfUK Bsfp

TT and NgfUK repeatedly making the same unsupported changes to result parameter

https://sigma.toolforge.org/timeline.py?page=Albanian_revolt_of_1911&users=Truth+t&users=NormalguyfromUK&server=enwiki

TT NgfUK

Result fiddling in favour of the Illyrians forces

TT NgfUK

TT also uses one of Bsfp's favourite formats here - trying to add the 'initial victory' idea for the Albanians to an infobox result parameter that should just be Albanian defeat

Truth T restoring Bsfp edits

Insisting on Mehmed II as a commander TT Bsfp

Insistence on a commander in the Greek WoI being Albanian https://sigma.toolforge.org/timeline.py?page=Markos_Botsaris&users=Based.shqiptar.frompirok&users=Truth+t&server=enwiki Also here's NgfUK making the similar changes to the name - https://en.wikipedia.org/w/index.php?diff=prev&oldid=1137822586 37.245.46.162 (talk) 14:09, 29 August 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


 * Not unrelated to Truth t though, which he clearly is as presented here ( and behaviourally all the time) 31.218.19.163 (talk) 15:18, 29 August 2023 (UTC)

It is hilarious because this SPI itself is a block evasion. The 2 IPs are both User:Orchomen. Orchomen, just like the IPs, edited from the UAE and reported and had conflicts with NormalguyfromUK. Ktrimi991 (talk) 16:41, 29 August 2023 (UTC)
 * Comment by Ktrimi991:

Clerk, CheckUser, and/or patrolling admin comments
I've removed Based.shqiptar.frompirok who was found unrelated (see archive).--Bbb23 (talk) 14:22, 29 August 2023 (UTC)
 * - Requesting CU to confirm and look for others. Also a new account,, who looks very similar. Bbb23 (talk) 15:43, 29 August 2023 (UTC)
 * Thanks,, I figured the IPs were someone else but was too lazy to figure out who; they're now both blocked, although Orchomen does a lot of IP-hopping. Leaving the CU request in place, though.--Bbb23 (talk) 17:44, 29 August 2023 (UTC)
 * Montesoße is ✅.  appears to be unrelated. RoySmith (talk) 01:29, 30 August 2023 (UTC)

Suspected sockpuppets
Obvious sock of NGfUK, almost exclusicely editing some of the sockmasters favourite articles- https://sigma.toolforge.org/editorinteract.py?users=NormalguyfromUK&users=Nizyos&users=&startdate=&enddate=&ns=&server=enwiki

making very similar infobox changes -  https://sigma.toolforge.org/timeline.py?page=Albanian_People%27s_Army&users=Nizyos&users=NormalguyfromUK&server=enwiki 2.48.56.94 (talk) 10:30, 19 September 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Here he is making one of NGfUK's favourite gnoming activities - adding Albanian emblems to infoboxes - on an NGfUK created article that's otherwise only had maningful edits to the content by  NGfUK and his socks. https://en.wikipedia.org/w/index.php?title=Anastas_Ngjela&diff=prev&oldid=1176243351176.204.115.35 (talk) 05:09, 21 September 2023 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ RoySmith (talk) 17:52, 28 September 2023 (UTC)

Suspected sockpuppets
Restoring word for word edits of Nizyos, a recently blocked sock


 * Openheimer - https://en.wikipedia.org/w/index.php?title=Kadri_Hazbiu&diff=prev&oldid=1180418478
 * Nizyos - https://en.wikipedia.org/w/index.php?title=Kadri_Hazbiu&diff=prev&oldid=1175994428

Making result fiddles to Infoboxes - a fabvourite NgfUK activity - https://en.wikipedia.org/w/index.php?title=Operation_%22Edelweiss%22&diff=prev&oldid=1180568749 37.245.43.164 (talk) 09:14, 19 October 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * I'd call this on a combination of the technical and behavioral data. RoySmith (talk) 21:06, 23 October 2023 (UTC)

Suspected sockpuppets
Probable sleeper account. Clear naming similarities, mainly interested in editing infoboxes for the greater glory of Albania/the KLA per NgfUK's normal MO,


 * https://sigma.toolforge.org/timeline.py?page=Battle_of_Tetovo&users=NormalguyfromUK&users=Albanianguy123&server=enwiki
 * https://sigma.toolforge.org/timeline.py?page=Battle_of_Ko%C5%A1are&users=NormalguyfromUK&users=Albanianguy123&server=enwiki

and the creation of content fork pages about Albanian battles 2.49.39.17 (talk) 04:47, 27 October 2023 (UTC) 2.49.39.17 (talk) 04:54, 27 October 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments
Another filing by an now-blocked IP.--Bbb23 (talk) 13:35, 27 October 2023 (UTC)
 * From the CU data, it's, maybe even . Tagging as suspected largely on the strength of the behavioral evidence. RoySmith (talk) 14:34, 27 October 2023 (UTC)

Suspected sockpuppets
Hello. Looks like the sockpuppet tale continues. Promoting the same dubious narrative about Operation Valuable. They also restored an image collage which was created by a sockpuppet of theirs. StephenMacky1 (talk) 16:59, 29 October 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * , blocking as proven RoySmith (talk) 13:14, 30 October 2023 (UTC)
 * PS, I semi-protected a few of the recent targets. RoySmith (talk) 13:17, 30 October 2023 (UTC)

Suspected sockpuppets
Another clear behavioral sock. This one is restoring old "supported by" KLA and Bulgaria 2001 insurgency in Macedonia edits the NgfUK edit warred over back in January this year

https://sigma.toolforge.org/timeline.py?page=2001_insurgency_in_Macedonia&users=NormalguyfromUK&users=%D9%84%D9%87%D8%AB%D8%B3%D9%86&server=enwiki


 * لهثسن - https://en.wikipedia.org/w/index.php?diff=prev&oldid=1182039542
 * NgfUK - https://en.wikipedia.org/w/index.php?diff=prev&oldid=1136052153 - https://en.wikipedia.org/w/index.php?diff=prev&oldid=1136052153

Also extensively making NgfUK's usual favourite edits to add flags/shields to infoboxes


 * لهثسن https://en.wikipedia.org/w/index.php?title=Northern_war_in_Ukraine&diff=prev&oldid=1182454310
 * https://en.wikipedia.org/w/index.php?title=July_26_Baku_Coup_d%27%C3%A9tat&diff=prev&oldid=1179807211
 * https://en.wikipedia.org/w/index.php?diff=prev&oldid=1136356109
 * https://en.wikipedia.org/w/index.php?title=Spartacist_uprising&diff=prev&oldid=1179690782

etc etc

Fiddling with result parameters as usual
 * https://en.wikipedia.org/w/index.php?title=Battle_of_Aghdam&diff=prev&oldid=1179990240
 * https://en.wikipedia.org/w/index.php?title=Silesian_Uprisings&diff=prev&oldid=1179690985
 * https://en.wikipedia.org/w/index.php?title=Capture_of_Trabzon_(1918)&diff=prev&oldid=1179758692

etc etc 176.204.85.88 (talk) 10:34, 1 November 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

User:لهثسن also reverted redirect at Second Battle of Sadakhlo, created by blocked sock User:Nugoooo:. Strong edit overlap with Nugoooo: Wikishovel (talk) 11:14, 1 November 2023 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * The following are ✅ to each other:
 * LewonK on YT is clearly somebody's sock - they gamed ACPERM to create new pages in violation of an ARBAA2 ECP restriction, and were blocked twice for it. The other accounts were made to evade those blocks and have engaged in the same behaviour; all are . This group is to this case: they geolocate to the same general area but use different devices from previously flagged NgfUK socks. . Ivanvector (Talk/Edits) 14:02, 2 November 2023 (UTC)
 * I think those rightfully belong here. Closing without taggs.  Vanjagenije  (talk)  01:20, 13 November 2023 (UTC)
 * LewonK on YT is clearly somebody's sock - they gamed ACPERM to create new pages in violation of an ARBAA2 ECP restriction, and were blocked twice for it. The other accounts were made to evade those blocks and have engaged in the same behaviour; all are . This group is to this case: they geolocate to the same general area but use different devices from previously flagged NgfUK socks. . Ivanvector (Talk/Edits) 14:02, 2 November 2023 (UTC)
 * I think those rightfully belong here. Closing without taggs.  Vanjagenije  (talk)  01:20, 13 November 2023 (UTC)
 * LewonK on YT is clearly somebody's sock - they gamed ACPERM to create new pages in violation of an ARBAA2 ECP restriction, and were blocked twice for it. The other accounts were made to evade those blocks and have engaged in the same behaviour; all are . This group is to this case: they geolocate to the same general area but use different devices from previously flagged NgfUK socks. . Ivanvector (Talk/Edits) 14:02, 2 November 2023 (UTC)
 * I think those rightfully belong here. Closing without taggs.  Vanjagenije  (talk)  01:20, 13 November 2023 (UTC)

Suspected sockpuppets
Possible sockpuppet of the blocked editor due to the same POV additions. See 1 and 2. StephenMacky1 (talk) 15:04, 4 February 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I don't know if User:Nysreti1 is a sockpuppet of NormalguyfromUK or not, but I believe that the activity of numerous recently-created accounts in, just in the past two weeks, justifies a CU check; I have been monitoring the page for some time now, and this is not normal activity. I am specifically referring to the following four red-linked accounts; though, there is also some IP activity that might be related: Maybe User:Nysreti1 is unrelated to NormalguyfromUK, and the three other accounts are associated with the former; theirs is the only account out of the four, whose timespan exceeds two weeks, being six months old. Besides the dates of their creation, compare the contributions of the four users, who all seem to focus on the aforementioned page; almost exclusively. Demetrios1993 (talk) 14:04, 10 February 2024 (UTC)
 * Comment by Demetrios1993
 * User:Nysreti1 (created on 11 August 2023)
 * User:Illyriandibra1912 (created on 26 January 2024)
 * User:AlbaScot (created on 30 January 2024)
 * User:Spongy mysophyll productions (created on 9 February 2024)

Clerk, CheckUser, and/or patrolling admin comments

 * - This is messy. I would call ✅ to, who has a separate SPI at Sockpuppet_investigations/Albanianhistorian123, should probably be merged. As best as I can tell, the other accounts named above are all ❌ to each other. There is considerable logged-out editing, but not obviously intentional. Nysreti has also created two accounts that have no edits;  and . I'm undecided as to what to do with them, so I'm going to leave this out for another admin or CU. There's slight technical overlap between a couple of these, but I need to return to those some other time. Vanamonde93 (talk) 01:16, 13 February 2024 (UTC)
 * Instead of moving this section to Albanianhistorian123 I've filed a new one with just AlbaScot. Changing the case status to checked. 0x Deadbeef →∞ (talk to me) 11:43, 21 February 2024 (UTC)
 * The Wordsmith Talk to me 03:03, 5 March 2024 (UTC)

Suspected sockpuppets
A random IP (5.38.104.105) has been mass reverting those two accounts' edits as being NormalguyfromUK socks, and I'm not familiar with this case but I can see the section above me has one of the accounts I'm reporting already. Requesting CU for those two accounts.  Liliana UwU  (talk / contributions) 03:44, 11 February 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * AlbaScot and Azphalt appear to be technically ❌. I have not looked extensively into the behavior but I don't see anything at the moment which would justify a behavioral block either. Vanamonde93 (talk) 00:23, 13 February 2024 (UTC)
 * See comment in previous section. Vanamonde93 (talk) 01:17, 13 February 2024 (UTC)
 * Insufficient behavioral evidence to justify a block. The Wordsmith Talk to me 03:04, 5 March 2024 (UTC)

Suspected sockpuppets
These three are CU-confirmed with each other (and blocked for their disruption), and they are likely socks of our guy. Drmies (talk) 03:59, 2 March 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Accounts tagged. The Wordsmith Talk to me 03:08, 5 March 2024 (UTC)

Suspected sockpuppets
Recreating articles created by other socks, account was created shortly after the last cleanup. Yamla (talk) 21:15, 18 March 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * ❌, as far as the technical evidence is possible of showing. Closing with no action. --Yamla (talk) 21:19, 18 March 2024 (UTC)

Suspected sockpuppets
This account appears to be related to User:Based Person, a sock of NormalguyfromUK. See Based Person vs Based guyy for example. The numerous obscure article overlaps, similarity in gnoming and user names could all just be a huge coincidence/misunderstanding, and this is the kind of potential socking situation that I normally ignore. But my concern is that they are making edits (and edit warring) in the contentious WP:ARBPIA topic area, and that topic area in particular should not have any editors willing to use deception. Hence the SPI report. Sean.hoyland (talk) 04:25, 9 April 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * CU data isn't conclusive, but it is certainly possible; the level of article overlap is also alarming. Blocking as suspected, requesting lock, closing.  Girth Summit  (blether)  16:38, 11 April 2024 (UTC)

Suspected sockpuppets
Hello. Based guyy was recently blocked as a sockpuppet. I think the editor is evading their block through this account (see 1 and 2 for comparison). The editor is also editing Israeli-Palestinian conflict articles, which is also what interested Based guyy before the block. StephenMacky1 (talk) 17:12, 16 April 2024 (UTC)

Comments by other users
Like StephenMacky1, and, I also think it's likely to be another sock. See User_talk:Sean.hoyland. Sean.hoyland (talk) 17:37, 16 April 2024 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Random editorr is ✅ to, behavior is also ducky. Blocking, closing, requesting g-lock. Vanamonde93 (talk) 18:05, 16 April 2024 (UTC)

Suspected sockpuppets
Clearly Basedguyy evading block and editing articles about military conflicts (especially Macedonian and Israeli-Palestinian conflict ones). StephenMacky1 (talk) 11:47, 6 June 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * No need for CU here, this is too obvious. I'll block and tag. --Yamla (talk) 12:24, 6 June 2024 (UTC)

Suspected sockpuppets
Possible sock. Requesting CU just in case. My suspicion relies on the username (which reads like a confession) and having a personal issue with me (see diff). It's uncommon for an editor to have an issue with me. StephenMacky1 (talk) 22:01, 14 June 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Helloimhim is ✅ to, and there's substantial evidence of intentional logged out editing as well. I'd say this is fairly likely to the master based on behavior, but I don't see a slam-dunk technical link. Vanamonde93 (talk) 04:15, 15 June 2024 (UTC)
 * The SandDoctor Talk 05:26, 15 June 2024 (UTC)