Wikipedia:Sockpuppet investigations/Ufufcguc/Archive

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

I think this one is fairly clear. I noticed Nbmmplo making edits on Republic of Ireland that Ufufcguc had also made. Looking closer I ran an interaction report, and well I think it pretty much speaks for itself. See here. So many edits to the same areas, even the same page move of Eurozone to Euro area made by both accounts. (here and here. Both adding the same kind of information to Netherlands here and here. Both are obsessed with the Euro and minute changes to populations numbers. I don't think I really need to go on with this one. Pretty obvious, and I just wanted to do it by the book. Canterbury Tail talk 02:16, 14 November 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Master is . TonyBallioni (talk) 03:54, 14 November 2018 (UTC)
 * Nbmmplo has been blocked as another admin as a sock. Case closed. Courcelles (talk) 20:06, 29 November 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

The first and second IP were being used today. Also numerous other dynamic IP numbers geolocating to the same area and Orange Polska network. Same patterns and articles as the master and sock ; adding/changing population statistic numbers and other information without sources, some are correct but in many cases with obviously false numbers. No edit summaries or user interactions. Examples:


 * Special:Diff/874753009/prev (first IP sock, today, changes to a number that contradicts the existing source)
 * Special:Diff/867552603/867944492 (sock Nbmmplo, same article last month, changes to a number that contradicts existing source)
 * Special:Diff/768603869/773832504 (master Ufufcguc, last year, same article, number contradicts source) IamNotU (talk) 21:14, 21 December 2018 (UTC)

I've added two more IPs, both used today (23 December), 83.30.196.235 and later 83.27.220.86. Because they change IPs so often, I suppose not much can be done in the way of blocking, but I've already been reverting some of their edits as obvious sock puppetry and block evasion, so I wanted to get confirmation here on the basis of WP:DUCK about that, thanks.

Here is some additional evidence tying them (and a long string of related IPs at the same location and network) to the previous sock Nbmmplo, and to the master (editing in the same articles, and similarly "obsessed with the Euro and minute changes to populations numbers" as described by in the previous investigation.) For example in Time in Europe:
 * Special:Diff/865340425/867954119 - Nbmmplo sock, 9 November, edits in the "Use" section, it gets reverted.
 * Special:Diff/869165781/871345239 - 83.30.230.4, 30 November - 1 December, makes nearly the same edit, and continues working on it.
 * Special:Diff/871541540/871675901 - 83.27.87.140, the next day, 2 December, same section, adds a new section "differences between major cities".
 * Various other dynamic IPs, from the same location and network, work on the same sections through December, including:
 * Special:Diff/874287916/875059439 - 83.30.196.235, today, 23 December, editing the "differences between cities" section.
 * Special:Diff/875077855/875084447 - 83.27.220.86, today, 23 December, reinstates the section after I removed it, and acknowledges they are the same person that has been editing it.

These last two IPs have today also edited the same "List of European countries by population" article I noted that the master and previous sock account had, making the same kind of edits:


 * Special:Diff/874921267/875060842 - 83.30.196.235, changes various population statistic numbers. The values for at least five countries are changed without any changes to the citations.
 * Special:Diff/875080632/875084901 - 83.27.220.86, reinstates the edit after I reverted it.

Also in "Sport in Europe":
 * Special:Diff/850934860/850935302 - master edits the caption of the lead photo, adding "stadium in Spain".
 * Special:Diff/864637826/865568841 - sock Nbmmplo edits the same caption, adding "biggest stadium in Europe".
 * Special:Diff/849400146/849407631 - master creates a dubious list of "Most popular clubs in Europe (some clubs in whole world)", and begins to add many names.
 * Special:Diff/852699724/852984755, Special:Diff/863030854/864637826 IPs (editing while logged out) work on the list.
 * Special:Diff/875059711/875060198, Special:Diff/875078337/875081060 - today, the same 83.30.196.235 and later 83.27.220.86 as above, both edit the list.

In "Culture of Europe":
 * Special:Diff/868523420/868628141 - sock Nbmmplo makes an inexplicable/vandalism edit, adding the number "20" to a caption. It gets reverted.
 * Special:Diff/868694234/868723759 - 83.30.237.2 late the same day reinstates it.
 * Half a dozen other IPs over the next weeks edit war and repeatedly reinstate it, until the page is protected for vandalism.

There's much more evidence, if required... --IamNotU (talk) 20:24, 23 December 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * Comment Yeah not more more to add here. The user has been block evading from these IP ranges for the last month and a half. Ufufcguc has these main areas of editing. Country population statistics, the Euro and anything related to it, time zones, European countries, modern music in European countries and tall buildings, again European based. The socks are pretty obvious, which is why I didn't hesitate to block them previously and revert. It's now coming to the point where we may just need an official site ban of this editor, and a range block most likely. Canterbury Tail talk 20:44, 23 December 2018 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Procedural close. IPs are all and have not edited in over a month.  The SandDoctor  Talk 15:36, 25 January 2019 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Also several IPs in the same range recently. Geolocates to same network and area as previous IP socks. Similar vandalism mixed with neutral-appearing edits (that are not necessarily helpful), in same articles such as Culture of Europe, Sport in Europe, Bundesliga ("20 teams":, ), articles about car manufacturers, fake edits to population numbers {, ) etc. Not sure if blocking is possible, but at least wanted to confirm that it's the same person.

Looking a bit more, it looks like most or even all edits from the whole range Special:Contributions/2A01:111F:E1A:A400:60CE:5589:6601:AFD8/32 might be theirs? Thousands of edits in the last months... and the 83.* range in the same location is still active, see Special:Contributions/83.26.219.128 and nearby IP numbers. --IamNotU (talk) 20:57, 21 April 2019 (UTC) IamNotU (talk) 20:57, 21 April 2019 (UTC)
 * You probably want Special:Contributions/2A01:111F:E1A:A400::/64 ST47 (talk) 21:31, 24 April 2019 (UTC)
 * Thanks... I haven't quite figured out how to calculate ranges properly yet... --IamNotU (talk) 11:54, 25 April 2019 (UTC)

Some additional info: I added a couple of other recent IPs in sequential order, for comparison. For example, 2A01:111F:E1A:A400:5C6E:C58A:502E:344A is obviously the same person as the current one:, ; , and the previous one: ,. They also repeat an idiosyncratic habit of Ufufcguc/Nbmmplo, randomly adding the number "20": - see Nbmmplo's edit in Culture of Europe:  followed many repetitions by 83.27.*.* IPs in that article.

There are many other similarities, it's very easy to string together the IPs and see that they're the same person as each other and as Ufufcguc, and the 83.xxx IPs that geolocate to the same place, network, and times. Many edits appear neutral but most are disruptive or outright vandalism. In the past they (as 83.30.178.87) actually said that they like to make serious edits, but also "play" and make joke edits and vandalism, and don't seem to understand why that's a problem, and feel they've been blocked because the admins are prejudiced against them - see User talk:IamNotU.

2A01:111F:E1A:A400:60CE:5589:6601:AFD8 has been editing for a week now, and is still active, making disruptive edits like this: (which is a repeat of an edit by 83.26.219.128: ). So maybe worth a block? --IamNotU (talk) 12:21, 25 April 2019 (UTC)

Fyi, right after the one-week block of the first IP, they were back on a new IP, 2A01:111F:E1A:A400:F88C:87D1:2579:5FD7 to undo my revert, and also on 83.26.251.171, here:.

I've been going back through the 2A01:111F:E1A:A400::/64 edits, I've got as far as the end of March so far, and all edits on that range are obviously theirs. Going further back, judging by the article names it looks like everything is theirs back to January 30, and there are no edits on that range before then.

Currently 83.26.251.171 and previously 83.26.219.128 (not very many edits) from February to mid-April is obviously them, but there are some others like 83.26.223.16 / 83.26.243.40 (someone from Krakow who edits womens' tennis articles) that look different. Prior to that they also show up on some 83.30.xxx.xxx in January, eg. 83.30.204.147, 83.30.200.124, 83.30.175.51, 83.30.230.155, 83.30.4.242, and 83.30.178.87.

--IamNotU (talk) 12:42, 26 April 2019 (UTC)

I've added a new IP above, 31.0.32.94, which just appeared today, from a different network. Repeating/reinstating the same edits and old habits. Removing circulation info from media articles:, ; changing population figures (here reverting the population of Poland to last year's): , ; edits to the Culture of Europe article, and currency articles. Again obviously the same person. I guess I'll go ahead and revert them as a sock. --IamNotU (talk) 20:19, 26 April 2019 (UTC)

, they've been continuing to edit the same articles from several IPs within that 2A01:111F:E1A:A400::/64 range for the past few days. As far as I can see they're the only one editing logged out from there. I don't know how much a rangeblock would slow them down, as they sometimes come in on IPV4 numbers from the same network/location, not sure how that all works... --IamNotU (talk) 20:54, 29 April 2019 (UTC)
 * Thanks! The most recent IPV4 on the same Orange Polska network and location that I know of is 83.26.251.171, last seen on the 25th. --IamNotU (talk) 21:52, 29 April 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The only currently active IP has been blocked for 1 week by another admin. If disruption continues, we can consider a rangeblock depending on whether the disruption comes from inside or outside this /64. ST47 (talk) 02:54, 26 April 2019 (UTC)
 * 2A01:111F:E1A:A400::/64 for three months and 31.0.32.94 for one month, for evasion of Canterbury's block here. Were there any other IPv4 IPs that you saw? ST47 (talk) 21:20, 29 April 2019 (UTC)
 * I think that it's safe to close this now. If the Orange IPv4 address comes active again, it should be blocked, though. —DoRD (talk)​ 23:54, 1 May 2019 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Edits to similar set of topics and articles as Ufufcguc, Nbmmplo, and IPs ( 2A01:111F:E1A:A400::/64 and 2A01:111F:C24:5D00::/64, and many in 83.27.0.0/16 and 83.30.0.0/16) including the euro currency, music in the Culture of Europe article, minute unsourced/false changes to population and area figures, claims about regions where languages are spoken, adding inexplicable random numbers to articles, etc. Often disruptive/vandal edits are mixed in with seemingly-helpful edits, and sometimes vandalism is self-reverted. Examples:
 * Falsely changing the number of teams in the German Bundesliga to 20:
 * Xqq1238:
 * Ufufcguc:
 * Edit-warring by multiple IPs:, ,
 * Xqq1238's edit was self-reverted, which they have also done before, e.g.: ,
 * The change is a blatant prank/vandalism, see:, ,
 * Unsourced changes to the area figure for the country of Germany:
 * Xqq1238: ,
 * Ufufcguc: (see  where they admit it was vandalism)
 * IP socks:, , , etc.
 * Note several other unsourced changes by Xqq1238 to area figures in List of European countries by area, where there have also been dozens of edits by previous IP socks:, , etc.
 * Adding random numbers:
 * Xqq1238, to euro currency articles, then self-reverting:, ,.
 * Nbmmplo, to Culture of Europe:, also numerous IPs e.g. (see previous report).
 * IP sock:, self-reverting:
 * Adding musicians to Culture of Europe, for example:
 * Xqq1238: including "Bonez MC"
 * Ufufcguc:
 * Nbmmplo: (including "Bonez MC"),, , etc.
 * Many edits by sock IPs.
 * Similar edits in Economy of Europe:, ,.
 * Repeatedly adding Romania and Tunisia as places where Italian is spoken:, , , , etc.

-- IamNotU (talk) 14:46, 20 July 2019 (UTC)

Update: the user is continuing to make similar edits, in some cases disruptive, including edits about news websites and radio stations in Culture of Europe, small/unsourced changes to population and area figures, Euro currency, etc., for example:
 * Continuing an edit war in Template:Airports in Germany of obvious IPs that were blocked as socks (see the previous report):
 * Special:Contributions/2A01:111F:E1A:A400:ED97:2B1A:A1A3:9725:
 * Special:Contributions/2A01:111F:E1A:A400:CD8C:4EE3:4E3A:6776:
 * Xqq1238:
 * Fiddling with frequently/infrequently-used notes and coins in Euro (see also numerous other edits there):
 * Ufufcguc:
 * Obvious/blocked IP socks:, , , , , ,
 * Xqq1238:
 * Continuing to edit war over an unsourced change to the area figure for Germany (see above):, ,
 * Adjusting the population figure of Finland (see also similar changes in Netherlands):
 * Ufufcguc:
 * Nbmmplo:
 * Xqq1238:
 * Ongoing edits to List of European countries by area, including fiddling with the total area of Europe:
 * Obvious sock Special:Contributions/83.27.110.198:
 * Blocked as socks:, , ,
 * Xqq1238:
 * Changing population figures in Single Euro Payments Area:
 * Ufufcguc:
 * Obvious socks: ,
 * Xqq1238:

--IamNotU (talk) 11:56, 30 July 2019 (UTC)


 * I've just added Special:Contributions/2A01:111F:E1A:A400::/64 above. This was already blocked last time for three months. Looks like they started editing from there again right after the block expired. They may have stopped editing from Xqq1238 since this report: Administrators' noticeboard/Incidents. As of today, they're continuing to edit logged out from the IP range.
 * For example, here they are making the same unsourced changes to population figures in Germanic languages:
 * Xqq1238: ,
 * IPs: ,
 * And continuing with repeatedly inserting the same unsourced figure for the area of Germany (see above):


 * --IamNotU (talk) 10:54, 9 August 2019 (UTC)


 * Added also Special:Contributions/83.26.245.52, same old thing on IPv4, see previous reports. Repeating the same unsourced figure for the area of Germany: . --IamNotU (talk) 00:32, 10 August 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. NinjaRobotPirate (talk) 19:24, 20 August 2019 (UTC)