Wikipedia:Sockpuppet investigations/Mahmoud Fayed/Archive

21 November 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Both editors' only contributions to Wikipedia have been to write about the work of Mahmoud Samir Fayed ("MSF"). User:Mahmoud Fayed wrote an article about his own PWCT language in 2008, which was deleted; User:Msfclipper registered recently to write an article on the same subject, in the same month that Fayed promoted PWCT in the TIOBE index - Msfclipper's original article was written at length with no sources, and included an uploaded photo of Fayed with OTRS permission. User:Mahmoud Fayed has now returned to Wikipedia after a five year absence, and his edits are starting to overlap with User:Msfclipper - this article's history shows User:Mahmoud Fayed making half an hour of edits bracketed by only a few minutes on either side by User:Msfclipper, who made no other edits during this period.

User:Msfclipper also appears to have been editing as User:212.57.215.5, the IP address speedying Msfclipper's work as "author requests deletion" and Msfclipper resigning 212.57's comments as his own. This is most likely accidental and has been largely benign, but he has now used the IP address to make an argument in an AfD that User:Msfclipper has also commented on. --McGeddon (talk) 11:10, 21 November 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * He's not exactly trying to hide, since his real name is in both accounts' usernames. The logged-out edits are probably accidental. Nothing really needs doing. Reaper Eternal (talk) 13:13, 25 November 2013 (UTC)
 * WP:ILLEGIT allows multiple accounts to edit the same page if they are "clearly linked legitimate alternative accounts", but the usernames seem oblique enough to be deniable, there is no statement on either user page that the accounts are linked, and neither user has responded to this sockpuppet concern or even mentioned the other account. If these are controlled by the same person, his editing pattern could be read as a (briefly successful!) attempt to avoid WP:SCRUTINY, with User:Msfclipper being registered in November 2013 to have two more goes at creating the article which User:Mahmoud Fayed had failed to in 2008, using two fresh, unconnected title variants. --McGeddon (talk) 13:53, 25 November 2013 (UTC)
 * True, but I think the warnings he's received are probably enough for now. Mark Arsten (talk) 17:00, 25 November 2013 (UTC)

20 April 2014

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:212.57.215.13 and User:Msfclipper were both blocked last week for promoting Mahmoud Fayed's "PWCT" language at Visual programming language; the latter for being block evasion of the former. (A previous sockpuppet investigation concluded that User:Mahmoud Fayed and User:Msfclipper were both operated by the same person, but that the investigation itself was "probably enough" to warn them and there was no need to block either account.)

User:Tweetyusa registered two hours after Msfclipper's block and removed some other languages from that page, and then - two days later - added PWCT back to the list as a minor edit, and created an article about it at Pwct (apparently using an unnecessary lowercase acronym to avoid the PWCT page which had already been deleted multiple times). Given that Fayed has used similarly evasive article titles in the past to presumably avoid triggering watchlists, this seems likely to be another sockpuppet account. McGeddon (talk) 19:08, 20 April 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Per above. King of &hearts;   &diams;   &clubs;  &spades; 04:22, 22 April 2014 (UTC)
 * ✅. Courcelles 21:03, 22 April 2014 (UTC)
 * Socks indef blocked, master blocked for one week. Tiptoety  talk 18:09, 23 April 2014 (UTC)

26 April 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Recreating PWCT (programming language) deleted at AFDs Articles for deletion/PWCT and Articles for deletion/PWCT (programming language). (He created multiple pages, trying to escape the AFD.) Msnicki (talk) 17:20, 26 April 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Suspected sock indef'd and Mahmoud Fayed blocked 1 month. Closing. Callanecc (talk • contribs • logs) 13:44, 7 May 2014 (UTC)

04 December 2014

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same pattern of behavior as before. Single-purpose accounts that exist primarily to edit Supernova (programming language) and Articles for deletion/Supernova (programming language) (2nd nomination); note that Supernova is part of the PWCT project that was the center of attention of the previous SPI. Similarly formatted user pages to each other. Similarly formatted comments on the AfD including two of them with the somewhat unusual feature of including references within the AfD. Specifically: IbnNile has five edits, the first to a user page, two to Supernova, two to the AfD. AndreLuiz19 has four edits, the first to a user page, one to Supernova, two to the AfD. Progmatwo has four edits, the first to a user page, one to an unrelated software article, one to Supernova, one to the AfD. And Rorman68 (I think the oldest of this set) has 25 edits, the second to a user page, 20 to Supernova or its talk page, three to unrelated software articles, and one to the AfD. Presumably these pass the duck test but given the past history of sockpuppetry I think a checkuser could be helpful in uncovering any possible sleeper accounts. David Eppstein (talk) 03:09, 4 December 2014 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * Support blocks. It's a WP:DUCK and if  David Eppstein hadn't beaten me to it, I was planning to report these new sockpuppets myself.  Also, please note that HSPLNPL is yet another sock that just appeared and which I will add to the list above.  Msnicki (talk) 03:56, 4 December 2014 (UTC)
 * Note: User:Mahmoud Fayed himself suddenly woke up after six months of inactivity in order to remove a sockpuppeteer notice from his user page, twelve hours after the first of these SPA accounts became active. --McGeddon (talk) 15:28, 5 December 2014 (UTC)
 * Support&mdash;Looks pretty straightforward. Lesser Cartographies (talk) 15:30, 6 December 2014 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * All listed accounts, including the master are, editing from a shared network. Use behavoir to confirm before issuing blocks. -- DQ   (ʞlɐʇ)  04:51, 5 December 2014 (UTC)
 * The behavioral evidence seems very straight forward. I've blocked all the socks and issued an indefinite block for the master account. Mike V  •  Talk  21:38, 9 December 2014 (UTC)