Wikipedia:Sockpuppet investigations/Najaf ali bhayo/Archive

11 March 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Quack quack quack. If not sock then meat, and user was only disruptive at any rate. Ian.thomson (talk) 15:14, 11 March 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - - SIGMATHOPSIS is actually older account (the master), and Farhad Uddin was registered after SIGMATHOPSIS got blocked (possible block evasion). They blanked the same page, and have similar interest, but I don't see a duck. SU is needed.  Vanjagenije   (talk)  18:22, 11 March 2015 (UTC)
 * ✅ that, , and  belong to the same person. - Mailer Diablo 08:47, 12 March 2015 (UTC)
 * I moved the case to the name of the oldest account. Admin is needed to block Farhad Uddin indefinitely for block evasion.  Vanjagenije  (talk)  10:33, 12 March 2015 (UTC)


 * I've reblocked the account and tagged them all. Mike V • Talk 23:35, 12 March 2015 (UTC)

04 May 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:Farhad Uddin (a confirmed sock) wanted to change Booni to Bune, copying and pasting the Booni material into Bune when his socks couldn't accomplish moves or redirects. The IP tried redirecting Booni to Bune city, another attempt by Farhad Uddin to rename Booni. The IP continued the edit war by SMITHOPSIS. While the transitive property doesn't automatically apply to IP addresses, the similarity between "SMITHOPSIS" and "SIGMATHOPSIS" (another confirmed sock, and the focus on Booni and Chitral are telling. Ian.thomson (talk) 05:02, 4 May 2015 (UTC)
 * Actually, I think it's safe to assume that all of the IP addresses listed here are used by Najaf ali bhayo. Ian.thomson (talk) 05:03, 4 May 2015 (UTC)
 * Added User:Sibghat Chaudhary because their vandalism of Booni is in line with attempts to retitle the article. Ian.thomson (talk) 06:43, 4 May 2015 (UTC)
 * Indef'ed. DMacks (talk) 17:35, 7 May 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Closing as account has been blocked by .-- Jezebel's Ponyo bons mots 21:20, 29 May 2015 (UTC)

22 May 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Usual vandalism of Booni in line with other socks. Ian.thomson (talk) 16:06, 22 May 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Also vandalising Arandu and Arundu like the IPs above did. Joseph2302 (talk) 16:14, 22 May 2015 (UTC)
 * Indef'ed. DMacks (talk) 06:38, 26 May 2015 (UTC)

Another one just popped up... ...obvious sock is obvious, blocked just as obviously. And just leaked out, which is close to another IP mentioned earlier. DMacks (talk) 19:21, 26 May 2015 (UTC) This implies they're almost certainly the sock trying to frequent a page they've vandalised many times before.


 * I've blocked PSEUDO Mr.X, but looking at the situation, I'm seeing obvious IP socking all over 42.83.86.0/24. Unfortunately, there would be a moderate amount of collateral damage. On the fence about range blocking. You can review the last ~6 days of contributions here if you have the CIDR widget enabled.  Monty  845  15:29, 28 May 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * The accounts noted here are blocked. I've cobbled together a short-term range block to (hopefully) help alleviate the immediate disruption.-- Jezebel's Ponyo bons mots 21:25, 29 May 2015 (UTC)

29 May 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Obvious, by name to one of the other socks, PSEUDO Mr.X. Feeble request to edit is the same as this from the previous sock. Cyphoidbomb (talk) 18:23, 29 May 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I've blocked,  and  as they are confirmed against blocked account .-- Jezebel's Ponyo bons mots  21:19, 29 May 2015 (UTC)
 * Closing the case.  Vanjagenije  (talk)  22:05, 29 May 2015 (UTC)

08 June 2015

 * Suspected sockpuppets


 * (newest)
 * (already blocked)
 * (newest)
 * (already blocked)
 * (already blocked)


 * User compare report Auto-generated every hour.
 * Editor interaction utility

New account is engaging in identical pattern of disruptive edits related to same topic (Pakistani ethnic groups and languages), including restoring edits done by previous sock, pointless edit requests to articles protected because of his own trolling, , , , removing/replacing information that amounts to vandalism , , and creating unwarranted AfD for Saraiki diaspora. —Мандичка YO 😜 22:36, 8 June 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' I indef'ed: Obvious sock is obvious, name-pattern and/or behavior-pattern. IPs are also obvious too. was concerned about collateral for 42.83.86.0/24, but I'm seeing virtually nothing except this sock-fest over the past 18 days. I'm re-blocking it for a week, feel free to adjust if you have additional info). DMacks (talk) 18:33, 9 June 2015 (UTC)
 * Obviously the same person., , , and are some of his other socks which were blocked indefinitely, just recently. The dynamic IP range  etc which vandalized the article Kashkar recently (the article is a low-traffic one, but it picked Najaf ali bhayo's interest somehow, as a result the article is semi-protected from IPs now. It is one of several articles he frequently vandalises by changing content and copy-paste moves etc) apparently belongs to this person. The person has used IPs and three of his socks, , , and , to vandalize Kashkar. The person has also used two of his socks,  and "Malik Mubashir Awan", to vandalize the article Kashmiri diaspora. Now "Malik Mubashir Awan" has to be blocked indefinitely as well like his earlier socks. Khestwol (talk) 10:11, 9 June 2015 (UTC)
 * Strong Recommend: Something must be done so that his frequent registration of new socks is temporarily blocked. Khestwol (talk) 10:55, 9 June 2015 (UTC)
 * I also added "Fahaam Uddin", a new sock I just discovered, above. Khestwol (talk) 12:44, 9 June 2015 (UTC)
 * Thanks, , , and . However, why is the IP still not blocked? He just created a new sockpuppet PolyGamma9 and resumed his disruption like before. Khestwol (talk) 09:27, 10 June 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  19:47, 9 June 2015 (UTC) — Berean Hunter   (talk)  11:20, 10 June 2015 (UTC)
 * I concur that there does not appear to be any collateral damage in the /24 range. In fact, I believe that they are using a wider /22 range. You would get primary block coverage by blocking 42.83.85.0/24 range which would complement your first block. Perhaps easiest to see looking at the edits on March 15 to see that they are hopping both of these ranges.
 * I concur that there does not appear to be any collateral damage in the /24 range. In fact, I believe that they are using a wider /22 range. You would get primary block coverage by blocking 42.83.85.0/24 range which would complement your first block. Perhaps easiest to see looking at the edits on March 15 to see that they are hopping both of these ranges.
 * I've hardblocked 42.83.85.0/24 for a month and indeffed most recent account. It is possible that he has moved into other ranges, I'm going to go ahead and close this. Please refile if he continues.

12 June 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Yet another PolyGamma-themed account. Blank edit requests here at Talk:Khowar language which was also done by PolyGamma9, suspected IP socks, PSEUDO MR.X 2 and so on. Cyphoidbomb (talk) 18:54, 12 June 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  19:52, 12 June 2015 (UTC)
 * Indeffing and closing

13 June 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Another meaningless double edit request at Talk:Khowar language. Cyphoidbomb (talk) 05:35, 13 June 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  13:09, 13 June 2015 (UTC)
 * Hardblocked 2a03:2880:3010:6ff2:face::/64 for a month, indeffed sock, deleted a template he created. Closing.

15 June 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same as usual. Indef'ed as usual. Just adding here for record-keeping. DMacks (talk) 11:52, 15 June 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked and tagged. Closing.  Vanjagenije  (talk)  13:59, 15 June 2015 (UTC)

27 June 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same MO and target-page subjects as usual. Note also these two usernames compared to each other. Indef'ed, just adding for the record here. DMacks (talk) 20:03, 27 June 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Recorded. Closing. Bbb23 (talk) 21:58, 27 June 2015 (UTC)

26 July 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Making POV edits on typical Najaf ali bhayo targets (sample edit: SA RAY GAMMA on Demographics of Afghanistan, an article also edited by Shezad Uddin and other indeffed Najaf socks). POLLY GAMMA~'s first real edit was deleting edit requests on Talk:Khowar language made by Sikander Afghan, a user account that has been indeffed by as a sock, even though it isn't listed in the SPI as far as I can see. Both POLLY GAMMA~ and POLLO PHONICA have made multiple test edits on Kunar, a disambiguation page also edited by SA RAY GAMMA and Salmam Khan, an earlier Najaf sock. Test edits that no doubt have been made to autoconfirm the accounts, showing that Najaf now knows how to bypass semi-protection. All three of the new user accounts also have names that fit Najaf's usual naming pattern.

Request CU check for sleepers since there might very well be more new accounts. Thomas.W talk 14:32, 26 July 2015 (UTC)


 * Added to the list, a user that has made the same kind of edits on the same articles (Arandu, Chitral, Mulkhow etc.) as a number of confirmed Najaf socks. Thomas.W talk 11:18, 30 July 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Wow, that's a lot of socks, and it sounds like he's got a system in place to get these accounts to autoconfirmed status. Is there any benefit to checking for sleepers on a more regular basis? If he's this loaded with socks, then more will come. Is there a way to preemptively deal with this guy? Cyphoidbomb (talk) 15:33, 31 July 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - They are editing various articles, so there might more of them. I'm endorsing a sleepers check.  Vanjagenije  (talk)  09:31, 30 July 2015 (UTC)
 * POLLO PHONICA blocked as an obvious sockpuppet after sitting out the time to become autoconfirmed.  Acroterion   (talk)   03:08, 31 July 2015 (UTC)
 * blocked as an obvious duck. -- Gogo Dodo (talk) 05:38, 31 July 2015 (UTC)
 * ✅, , , , , , , , . , and  are Najaf ali bhayo socks. - Mailer Diablo 13:06, 31 July 2015 (UTC)
 * A rangeblock might not be the best option at this point, and his behaviour is relatively easy to discern. We can do another check at the first signs of any new socks. - Mailer Diablo 12:16, 1 August 2015 (UTC)


 * Accounts tagged, closing. Mike V • Talk 18:14, 1 August 2015 (UTC)

10 August 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Name contains Sigma, as with User:SIGMATHOPSIS. Similar attempts (though piecemeal instead of immediate) to blank huge swaths of the Buni article and change the placename language to Urdu, as SMITHOPSIS and others have tried. Ian.thomson (talk) 17:06, 10 August 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Blocked this duck. Also, I noticed: had been blocked a while ago but not tagged or listed here. DMacks (talk) 17:16, 10 August 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Socks already blocked and tagged. Closing the case.  Vanjagenije  (talk)  14:34, 11 August 2015 (UTC)

11 August 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

EISIGMA4 is duck for topic/article-target, edit-pattern, and username; blocked and tagged. PALI is weaker overlap on specific articles, medium match on username, and strong on edit-pattern. This is getting out of hand, involving many articles, multiple users created at a time and sleepers. Can we please get some rangeblock assistance? DMacks (talk) 14:49, 11 August 2015 (UTC)

And: another in the family of greek-letter names. This one and PALI MAZI both do WP:C&P to change spellings or for some unusual concept of political jurisdiction (compare Mastuj Tehsil↔Mastuj vs Khowar language ↔Khowar).

Another greek-name (editor has an affinity for them, not just letters). As for central target demonstrating overlap, the history of Gurjar from late-July/early-August is a good set of tag-teaming and EW of multiple newly-reported ones and some old ones. The general topic is Afghanistan language/ethnicity changes with long-term edit-warring against sources (including for spellings and various jurisdictional issues)...articles get protected, then they move on to others. In the set of reports a few weeks ago, recommended asking for more CU attention including possibly looking for rangeblocks. DMacks (talk) 16:24, 13 August 2015 (UTC)

Some here were actually just entries in another larger and obvious pool: Some were already blocked in their own right or as a small sock pool by another editor. But all have the pattern (which also matches others in this SPI) of autoconfirm-busting by editing their own page, then making same types of language/ethnicity changes to various Afghanistan-related articles. And "Sigma" is one of the name-patterns we already have in this sock history. DMacks (talk) 15:42, 13 August 2015 (UTC)
 * EISIGMA1 does not exist (cut'n'paste over-zealous). DMacks (talk) 07:33, 17 August 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * .&#32;In order to facilitate and expedite your request, please provide diffs to support your case. Please give two or more diffs meeting the following format:
 * 1) At least one diff is from the sockmaster (or an account already blocked as a confirmed sockpuppet of the sockmaster), showing the behaviour characteristic of the sockmaster.
 * 2) At least one diff per suspected sockpuppet, showing the suspected sockpuppet emulating the behaviour of the sockmaster given in the first diff.
 * 3) In situations where it is not immediately obvious from the diffs what the characteristic behaviour is, a short explanation must be provided. Around one sentence is enough for this.  Vanjagenije   (talk)  21:16, 11 August 2015 (UTC)
 * Why haven't you blocked PALI MAZI if you think it's a sock?  Vanjagenije  (talk)  00:49, 17 August 2015 (UTC)
 * Hmm, thanks for the reminder. Must have gotten distracted. DMacks (talk) 07:33, 17 August 2015 (UTC)
 * Everybody is blocked here (except EISIGMA1 sho is non-existing). Closing the case.  Vanjagenije  (talk)  08:05, 17 August 2015 (UTC)
 * No comment on CU possibilities, neither my request nor an actual CU's note that he thought it would be useful? DMacks (talk) 08:13, 17 August 2015 (UTC)


 * IS it possible to block the IP (or IP range)?
 * Thanks! I think I had also mis-set a status flag when I responded to some previous query and left the SPI in limbo. And there's so many overlapping sets of reports too:( Such is the ways of the socks... DMacks (talk) 08:35, 17 August 2015 (UTC)


 * It's a small range, but the potential collateral is extensive. The following accounts also turned up in my check and have been blocked and are a technical match:


 * I didn't tag them however as I'm not familiar with the sockmaster and a behavioural review would be helpful.-- Jezebel's Ponyo bons mots 21:47, 19 August 2015 (UTC)
 * Only one of those three is blocked.  Vanjagenije  (talk)  21:52, 19 August 2015 (UTC)
 * Thanks, I checked the boxes but hadn't hit save in the CU tool. Done now.-- Jezebel's Ponyo bons mots 21:56, 19 August 2015 (UTC)
 * Closing the case.  Vanjagenije  (talk)  15:47, 28 August 2015 (UTC)

28 August 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Apparently the only people who edit at Khowar language are socks of Najaf ali bhayo and the people who revert him. TROPOES, POLO PHONIKA, AlphaOmega321, as has Abrahamic Faith (singular "Faith"), 2000.dll, DMacks1.

The account DMacks1 was created as an impostor of admin DMacks. Abrahamian Faith was created as an impostor of editor Abrahamian Faiths. 2000.dll was likely created as an impostor of Dl2000. This demonstrates pernicious editing. The singular "Faith" account jumped into filing a pernicious sockpuppet report four days after he started editing, which demonstrates that he's been around the block. Note also in his edit history some ballsy page moving for socks of Najaf. Note in DMacks1's edit history the flagging of other accounts as socks of Najaf.

Please also note that they are all editing at Pakistan-related articles, including 2000.dll Thanks. Cyphoidbomb (talk) 15:10, 28 August 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ✅:
 * Blocked one, tagged all, closing.--Bbb23 (talk) 04:51, 29 August 2015 (UTC)
 * Blocked one, tagged all, closing.--Bbb23 (talk) 04:51, 29 August 2015 (UTC)
 * Blocked one, tagged all, closing.--Bbb23 (talk) 04:51, 29 August 2015 (UTC)
 * Blocked one, tagged all, closing.--Bbb23 (talk) 04:51, 29 August 2015 (UTC)
 * Blocked one, tagged all, closing.--Bbb23 (talk) 04:51, 29 August 2015 (UTC)

29 August 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

I'm not really sure if I should report this or not, but this IP recently tried to contest a block at User:Giannis Paros. I'd almost not report it since it was just an unblock request, but this SPI has a lot of evidence of this user abusing IP addresses in an attempt to evade blocks. I'm less worried about them contesting the block and more about them trying to use this IP address to resume editing on Wikipedia in places other than the userspace. Tokyogirl79 (｡◕‿◕｡)  08:21, 29 August 2015 (UTC)

I'm adding this IP, as they tried to revert the edits at the same page, as well as at User:Malik Mubashir Awan, another sock. I've blocked both IPs for 6 months. Tokyogirl79 (｡◕‿◕｡)  08:38, 29 August 2015 (UTC)



I'll add the others as they appear, although I'm going to block them all for 6 months. I'd support a range block. Tokyogirl79 (｡◕‿◕｡)  09:04, 29 August 2015 (UTC)



This IP blanked portions of this SPI. Tokyogirl79 (｡◕‿◕｡)  09:06, 29 August 2015 (UTC)



I know we've probably already covered this in the range block, but I'm adding this IP for completeness. Disingenuous unblock request here at Abrahamic Faith. Cyphoidbomb (talk) 15:21, 29 August 2015 (UTC)



Yes, they also used another IP for same on my user talk page. — Berean Hunter   (talk)  16:58, 29 August 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Why don't you block the whole IP range if you "support a range block"?  Vanjagenije  (talk)  09:09, 29 August 2015 (UTC)
 * I don't know how to. Tokyogirl79 (｡◕‿◕｡)  09:12, 29 August 2015 (UTC)
 * I also didn't know if it would be proper etiquette to do a range block considering I opened the new SPI. I know I can do DUCK blocks, but range blocks are sort of a different beast. (Also I just don't know how to do those.) Tokyogirl79 (｡◕‿◕｡)  09:13, 29 August 2015 (UTC)
 * I'm calling an admin to explore blocking the 103.228.156.105/24 range for six months (anon only). It seams that most of addresses from this range are used by Najaf ali bhayo.  Vanjagenije  (talk)  10:12, 29 August 2015 (UTC)
 * OK, I've blocked the range for the requested six months. Closing. Favonian (talk) 11:17, 29 August 2015 (UTC)

05 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Here the editor changes the entire lede at Khowar language supported by a questionable reference at ethnologue.com. Similarly, the almost identical edits are made here by suspected sock. Prior to that, the same edits were made by CheckUser confirmed sock 2000.dll. Would like confirmation on these two new accounts. I've blocked the flare-up Leodinas, though. Cyphoidbomb (talk) 04:35, 5 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

05 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Recreation of hoax articles of same imaginary language (I can't provide diffs because the pages have been deleted). Both users added links to the new pages to the Arina article: ,.

New user was created three minutes after sockpuppeteer was indefinitely blocked. Blackguard 16:39, 5 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Both blocked indef, clerk needs to close the case.  RMS52  Talk to me  16:40, 7 September 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked, and now tagged. Closing the case.  Vanjagenije  (talk)  16:50, 7 September 2015 (UTC)

11 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Creating the same hoax stub articles about Arina people and Arina language as User:LAST TIME OF EARTH, who was blocked after three hours of hoaxing a few days ago. McGeddon (talk) 09:01, 11 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Blocked. CambridgeBayWeather, Uqaqtuq (talk), Sunasuttuq 09:50, 11 September 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. Closing.  Vanjagenije  (talk)  19:25, 11 September 2015 (UTC)

12 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

I'm submitting this user based on the continuation with all the Arina-related articles. But this user also created Kohwari Language, which appears to be real, although it also appears to be borrowed from, so it may be a copyvio that needs taking care of. Copying it here could be a ruse to make the user appear serious. —Largo Plazo (talk) 05:03, 12 September 2015 (UTC)



Adding User:Maria Ksena, who joined Wikipedia one full hour after Laura Antonia, undoing attempts to redirect that user's Kohwari Language article to Khowar language, and making unexplained copypaste page moves of various "Khowar" language pages to "Kohwari" (seemingly just searching for the word "Khowar" and making copypaste moves of the few articles with that word). Requesting a checkuser check. --McGeddon (talk) 07:36, 12 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

These accounts may be actually related to Sockpuppet investigations/Najaf ali bhayo - the archive there shows some similarly clumsy copypaste-and-redirect moving and a lot of Khowar-related edits. --McGeddon (talk) 08:40, 12 September 2015 (UTC)
 * Good eye, . I thought the same thing because of the creation of Khowari Language, which seemed to be an attempt to escape the scrutiny the Najaf socks were getting at Khowar language, one of his favorite haunts. Cyphoidbomb (talk) 15:28, 12 September 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Indeffed Maria Ksena and Laura Antonia per behavioral evidence. CU data are consistent with them being socks, but are obscured by the use of Opera Mini servers (we should ban those some day per WP:OP). Materialscientist (talk) 08:52, 12 September 2015 (UTC)

13 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Raising a bad faith SPI against the same bunch of unconnected vandalism-reverting editors as User:Maria Ksena did around the same time yesterday. McGeddon (talk) 08:53, 13 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Same as above. Materialscientist (talk) 09:29, 13 September 2015 (UTC)
 * The sock is blocked and tagged by Materialscientist. Closing.  Vanjagenije  (talk)  09:30, 13 September 2015 (UTC)

14 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

New user attempting to nominate Khowar language for deletion, just like blocked sock User:PSEUDO Mr.X did last May, and trying to delete the previous AfD-discussion, which was closed as speedy keep. The new user also repeated an edit on Kho people previously made by blocked sock User:Abrahamic Faith. Requesting CU since Najaf seems to have a habit of creating multiple socks. Thomas.W talk 06:41, 14 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅, blocked and tagged. Closing. Callanecc (talk • contribs • logs) 06:55, 14 September 2015 (UTC)

14 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Creating Arnia language ("also called Arina") after the previously-created Arina language was salted. Similar username to recent sock User:Laura Antonia. McGeddon (talk) 07:45, 14 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅, blocked, tagged. Materialscientist (talk) 08:14, 14 September 2015 (UTC)

14 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

New editor whose two edits have been to link to the Arnia language article created hours previously by the previous sock, and to add the deleted-as-block-evasion Template:Chitral District to another article.

Flagging again that this may be the same vandal as Sockpuppet investigations/Najaf ali bhayo: Bhayo's most recent sock User:Be Wolph removed "Arniya" as an alternate spelling of Khowar in a half-hour window between edits by User:Pythagoraso Theorem, who resumed editing (adding "Arnia" to Tirich Mir) ten minutes after Be Wolph was blocked. McGeddon (talk) 08:30, 14 September 2015 (UTC)
 * Technically is same as  from this group. As I mentioned, CU data are muddied here by the use Opera servers, thus multiple editors are technically possible, but, if their target is the same then this multiple socking groups are the same as one sockmaster to me. Materialscientist (talk) 08:42, 14 September 2015 (UTC)
 * So is this worth merging into a single SPI case? --McGeddon (talk) 08:57, 14 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅, blocked, tagged. Materialscientist (talk) 08:34, 14 September 2015 (UTC)

14 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Created Arina Language. Everymorning (talk) 11:34, 14 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅, blocked, tagged. Materialscientist (talk) 11:45, 14 September 2015 (UTC)
 * Closing the case.  Vanjagenije  (talk)  23:02, 14 September 2015 (UTC)

17 September 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

New editor whose first edits were to create a user page with twelve full stops and then delete them one by one before posting a protected edit request at Talk:Khowar language an hour later, suggesting that they were hoping that twelve null edits would be enough to autoconfirm and let them just edit it directly.

Their few subsequent edits have included the creation of Template:Chitral District, a template which was created twice by socks of LAST TIME OF EARTH earlier in the week. McGeddon (talk) 13:59, 17 September 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

And again, this may be the same user as Sockpuppet investigations/Najaf ali bhayo. User:Materialscientist said that two socks, one from each master, were "technically the same" a few days ago - does that mean there was a CU match? --McGeddon (talk) 14:01, 17 September 2015 (UTC)
 * Yes, identical, which is a strong hint, but not a 100% proof in this case (because they edited through a particular web interface). Materialscientist (talk) 23:41, 17 September 2015 (UTC)
 * I was about to file this user under that master as well. There are multiple overlaps in behavior, as others have noted, even if CU doesn't prove it (but if it does confirm, so much the better). DMacks (talk) 14:14, 17 September 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Until we decide whether to merge with Sockpuppet investigations/Najaf ali bhayo.  Vanjagenije  (talk)  09:30, 18 September 2015 (UTC)
 * Do you support merging this case into Sockpuppet investigations/Najaf ali bhayo?  Vanjagenije  (talk)  09:27, 19 September 2015 (UTC)
 * Yes. Materialscientist (talk) 09:40, 19 September 2015 (UTC)


 * Admin action needed - An admin is needed to history-merge this page into Sockpuppet investigations/Najaf ali bhayo.  Vanjagenije  (talk)  19:48, 20 September 2015 (UTC)
 * Archiving for merge. Mike V • Talk 22:04, 23 September 2015 (UTC)

02 October 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Aqib Perwaiz has made unsourced and dubious edits on multiple articles that have previously been edited by several other Najaf socks (sample edits: #1, #2, #3), Ali shahid uddin, who fits the naming pattern of multiple previous Najaf socks, then showed up after Aqib Perwaiz had been reverted a couple of times and had been issued a level-3 warning for unsourced edits, repeating the unexplained redirection of Khoshey people that Aqib Perwaiz had made. Thomas.W talk 09:28, 2 October 2015 (UTC)
 * We now also have Shehzad Ullah, an even more obvious sock, redirecting Template:Chitrali people, just like an earlier sock did. Thomas.W talk 10:08, 2 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Comment: Shehzad Ullah removed content from this SPI here and here.  ~Oshwah~  (talk) (contribs)   10:33, 2 October 2015 (UTC)
 * Cleaned out unnecessary disambiguation and additional vandalism of users above. Should have been reported/blocked for disruptive editing. --JustBerry (talk) 03:04, 3 October 2015 (UTC)
 * See this for similar editing behavior (potential sock). IP may be though (from June 2015). --JustBerry (talk) 03:10, 3 October 2015 (UTC)
 * Obvious socking from editor interaction tool analysis here. --JustBerry (talk) 03:13, 3 October 2015 (UTC)
 * Since the sock-puppetry (socks from this case editing Kho-related articles) appears to be on-going and the page has already been semi-protected for one month twice in the past as shown in the logs, requested indefinite semi protection of Kho_people here. --JustBerry (talk) 03:20, 3 October 2015 (UTC)
 * Looks like the talented took care of this. I semi-protected a related template earlier today (Template:Chitrali people). I was thinking about doing more page protections, but some part of me (based on my extensive experience in anti-vandalism, sockpuppetry cases, etc.) suggests that sometimes it's smart to have a few articles unprotected that, if edited, will really telegraph that it's the problem editor. Protecting smaller, related articles is a good idea especially if they aren't heavily traveled like the Chitrali people template, but if the troll keeps pathologically making the same edit at Article X, restoring contested content over redirect for instance over and over, you know each time that it's him, RBI can be employed, and the other articles are mostly untouched. As a real-life example, water heaters, and boat engines, and some metal coffins, have "sacrificial anodes", i.e. pieces of metal that are designed to corrode, to be sacrificed, so that the rest of the device works properly for longer. Just a thought. :D Cyphoidbomb (talk) 03:54, 3 October 2015 (UTC)
 * I blocked Shehzad Ullah. The other two seem likely socks but I'll let another admin such as the accomplished make a final determination. And I have the same thoughts about sacrificial anodes. Much easier to catch edits that would otherwise go undetected. --Neil N  talk to me</i> 04:04, 3 October 2015 (UTC)
 * Also known as honeypots. They're very useful, and should be watched closely but not protected. Thomas.W talk 09:31, 3 October 2015 (UTC)
 * ✅ Do you mind un-protecting the page per Thomas.W? --JustBerry (talk) 11:54, 3 October 2015 (UTC)
 * It seems as though everything on this category page ("Kho people") was linked back to this SPI case; however, the last article remaining in the category, namely Khoshey_people, appears to have been tagged by the article creator back in March 2012, as this analysis only seems to suggest anti-vandalism reverters reverting changed text back to the original article with the category tagged. Perhaps the user could have gotten the idea of making more articles with Kho people from reading that article - just a vague hypothesis. --JustBerry (talk) 03:39, 3 October 2015 (UTC)
 * Been looking at Koh-related articles. also appears to be POV-pushing and suspected of socking with similar editing behavior. Suspected sock has also been blocked previously for that reason.  sock. Seriously though, I do agree that a check for sleepers does need to be done. I did not put Saladin1987 in the list of socks, as I didn't want to mess with the clerk-endorsed socks, but they'll probably be looked into during the sleeper sweep anyways. Some edit interaction between sock(s) above and this sock here, but it should be noted that there might be some edit interaction with sleepers. --JustBerry (talk) 17:40, 3 October 2015 (UTC)
 * I appreciate your enthusiasm but suggest you leave this to the people here at SPI and find something else to do. Based on behavioural evidence it is IMHO highly unlikely that Saladin1987 is a Najaf sock. Thomas.W talk 18:16, 3 October 2015 (UTC)
 * --JustBerry (talk) 18:18, 3 October 2015 (UTC)

04 October 2015


Evidence for TROPOLIUM is DUCK. If you can't see it, please email me. Compassionate247 was blocked as a sock of Najaf ali bhayo and now Sminthopsis247 emerges also working on Khowar language. Anna Frodesiak (talk) 09:10, 4 October 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Requested CU to check for sleepers. --<b style="color:navy">Neil N </b> <i style="color:blue">talk to me</i> 04:34, 3 October 2015 (UTC)
 * . Archived history shows numerous CU-confirmed socks, but no mention of any check for sleepers, so I believe it's appropriate to do another CU to try to find any sleepers.  —  Rich wales (no relation to Jimbo) 05:34, 3 October 2015 (UTC)

✅ as to the following users:
 * Outcome:

as to the following:

as to:

And finally, the following user is :

No further sleepers found.

-Philippe (talk) 11:00, 4 October 2015 (UTC)
 * All except Saladin1987 now blocked and tagged. Anna Frodesiak (talk) 12:07, 4 October 2015 (UTC)

05 October 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Diffs changing page categories to "Kho people." Already blocked by Materialscientist, logging sock. See this and this for sock evidence; you can see a plethora of diffs in previous cases to compare the adding of "Kho people." JustBerry (talk) 14:48, 5 October 2015 (UTC)
 * Tagged user page. --JustBerry (talk) 14:50, 5 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * And I will remove the tag since Sher Afzal Karim most probably isn't a sock of Najaf ali bhayo. Najaf is pro-Pakistan while this editor is pro-Afghanistan, as can be clearly seen from their edits. I have a good idea about who to pair Sher Afzal Karim with, and will do so in due course, but am in no real hurry to do so since he's blocked. They edit the same topic area and a CU check would probably show that Sher geolocates to the same area as Najaf, but the difference between them, Najaf obviously supporting that Khyber-Paktunkhwa is part of Pakistan and Sher wanting to move all of it to the other side of the border, i.e. Afghanistan, clearly shows they're not the same user. Thomas.W talk 15:43, 5 October 2015 (UTC)
 * Removal of the tag is fine if you wish to contest; however, how do you explain this? If you can categorize that diff with the sock master you intend to move this sock to, then, by all means, feel free to do so. --JustBerry (talk) 16:10, 5 October 2015 (UTC)
 * You can't look at just one single edit, as you do, you have to look at a lot more than that to be able to see a clear pattern, which is what behavioural evidence is about. Thomas.W talk 16:16, 5 October 2015 (UTC)
 * It's not only a single edit - take a look at . Some of the edits look awfully similar to these socks. It seems reasonable to check, unless sleepers have already been dug out and none of the socks from the other case you're referring to relate to this case. --JustBerry (talk) 16:30, 5 October 2015 (UTC)
 * ??? What other case? I haven't mentioned any other case. So why don't you just leave all of this to the people here at SPI, and go do something else? Thomas.W talk 16:36, 5 October 2015 (UTC)
 * Seriously? I filed the case. You had mentioned "I have a good idea about who to pair Sher Afzal Karim with, and will do so in due course, but am in no real hurry to do so since he's blocked." Given the context of your comment, it appears you're talking about matching the sock with another sock master. --JustBerry (talk) 23:39, 6 October 2015 (UTC)

Per this comment by Anna Frodesiak, I've 119.160.66.159 to this list. --JustBerry (talk) 23:44, 6 October 2015 (UTC)
 * Sher Afzal Karim was blocked by Materialscientist after this report at AIV that I made, a report, and a block, that had nothing to do with socking, or Najaf ali bhayo. Thomas.W talk 13:54, 7 October 2015 (UTC)
 * Disband in good-faith. Looks like Thomas.W may be able to pair the suspected sock(s) with a more appropriate master sock - I have found another master sock to better pair the socks with as well. --JustBerry (talk) 01:06, 8 October 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Please stop bickering. As for the template, it doesn't need to be there, so it can stay off. As for the evidence,, you presented no evidence in the form of diffs when you opened this case. Even in your argument, you presented only one diffs Two are required, one showing the suspected puppet and one showing the master or a previously blocked puppet. Don't assume anyone knows the history of this case. Finally, the suspected puppet is no longer blocked. Any additional bickering will be reverted if I see it.--Bbb23 (talk) 23:56, 6 October 2015 (UTC)
 * You have not added evidence per the SPI and my instructions. Instead, you have put in two diffs of only the suspected puppet. In addition, your statement that Materialscientist's block was sock-related is not supported by the block log.--Bbb23 (talk) 13:46, 7 October 2015 (UTC)
 * for lack of evidence., if you wish to open a new case against the user as a possible master, you're free to do so. Closing.--Bbb23 (talk) 21:59, 7 October 2015 (UTC)

10 October 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Thomas.W2 created article titled "Arina Dialect". I proposed that article for deletion (AfD). Thomas.W2 removed the AfD template several times. Than, a brand new editor, Raja Suleman Haider, appears and creates article "Arnia Language" and redirects Arina Dialect to Arnia Language diff. Too much of coincidence.  Vanjagenije  (talk)  08:05, 10 October 2015 (UTC)


 * All of the IPs belong to the same range. They either removed the AfD tag from Arina Dialect, contested its deletion on the talk page or edited each other's comments.

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Looks like I have a new fan. Not sure about the master, though, but I have seen IPs from that range before, including 42.83.86.171 (an old aquaintance, see contribs, who suddenly showed up again yesterday), so I guess I'll have to start digging... Thomas.W talk 14:16, 10 October 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - Endorsing my own request. A range block might also be useful.  Vanjagenije  (talk)  08:06, 10 October 2015 (UTC)
 * Given the impersonation of, this master is more logical as well as technically confirmed.
 * The following accounts are ✅:
 * Blocked and tagged.
 * Sher Afzal Karim is in the archive. I declined the report for lack of evidence. Turns out that, regardless of the correctness of my decision, that 's suspicion was correct. To be clear, I did not run a CU against Sher Afzal Karim, then or now; the account came to my attention when I was checking this report.
 * Range blocks are difficult with this master. However, I am able to range-block a fairly narrow range of IPs. I'm not sure how much good it will do - perhaps a little. Closing.--Bbb23 (talk) 14:16, 10 October 2015 (UTC)
 * Blocked and tagged.
 * Sher Afzal Karim is in the archive. I declined the report for lack of evidence. Turns out that, regardless of the correctness of my decision, that 's suspicion was correct. To be clear, I did not run a CU against Sher Afzal Karim, then or now; the account came to my attention when I was checking this report.
 * Range blocks are difficult with this master. However, I am able to range-block a fairly narrow range of IPs. I'm not sure how much good it will do - perhaps a little. Closing.--Bbb23 (talk) 14:16, 10 October 2015 (UTC)
 * Range blocks are difficult with this master. However, I am able to range-block a fairly narrow range of IPs. I'm not sure how much good it will do - perhaps a little. Closing.--Bbb23 (talk) 14:16, 10 October 2015 (UTC)

11 October 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

The usual Kho/Chitral/Arandu targets. Blocked and tagged, adding here for the record. DMacks (talk) 06:03, 11 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. Closing.  Vanjagenije  (talk)  10:10, 11 October 2015 (UTC)

13 October 2015

 * Suspected sockpuppets

... to


 * User compare report Auto-generated every hour.
 * Editor interaction utility

He's now hopping on a new range, 42.83.85.0/?, instead of the 42.83.86.0/25 he used before (which is under a 3-month block; see earlier reports). Doing similar edits on the same articles previous socks have edited (sample edits #1, #2), switching IP after every edit to make it harder to see what he's doing. Thomas.W talk 10:32, 13 October 2015 (UTC)
 * User Redirect Action, created after I filed this report, is now also doing the same thing: #3. And also changed IPs etc on this SPI while I was adding the name to it... Thomas.W talk 10:45, 13 October 2015 (UTC)
 * He's now also using IPs in the 42.83.86.*-range, outside the blocked range. Thomas.W talk 10:54, 13 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' This isn't the same guy trying to delete Rom Kili? -- Lerd the nerd wiki defender  11:53, 13 October 2015 (UTC)
 * Yes, it's the same guy. Thomas.W talk 12:01, 13 October 2015 (UTC)
 * Thanks that article has now had to be semi protected because of the persistent vandalism and socking-- Lerd the nerd wiki defender  12:05, 13 October 2015 (UTC)

Also:
 * <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   12:14, 13 October 2015 (UTC)
 * <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   12:14, 13 October 2015 (UTC)
 * <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   12:14, 13 October 2015 (UTC)
 * <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   12:14, 13 October 2015 (UTC)
 * <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   12:14, 13 October 2015 (UTC)
 * <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   12:14, 13 October 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * I don't know this case, but indeffed Redirect Action (in passing) and rangeblocked the IPs per request on my talk (disruption, clearly). Materialscientist (talk) 12:33, 13 October 2015 (UTC)

13 October 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Made enough nonsense edits to become autoconfirmed and then started editing Kalash people, an article previously edited by (compare their names),  and other blocked socks, and other protected articles that are among Najaf's favourite targets. Thomas.W talk 17:07, 13 October 2015 (UTC)

Both Μαρινα Χαλαβαζή and Anna Velli 2 posted at my talk one after the other. Similar userpages. Anna Frodesiak (talk) 17:13, 13 October 2015 (UTC)


 * Request CU. Thomas.W talk 17:15, 13 October 2015 (UTC)


 * Μαρινα Χαλαβαζή has been blocked per WP:DUCK, but Anna Velli 2 is still around, so a CU-check would be appreciated. Thomas.W talk 17:26, 13 October 2015 (UTC)

Konstantinos Kalas just disrupted this page and is an obvious sock. Anna Frodesiak (talk) 17:34, 13 October 2015 (UTC)

Some more autoconfirmed-by-nonsense edits to previously targeted articles Chitral and Chitral District from User:ﯽﻧﺎﺘﺴﮐﺮﺗ ﻝﻼﺟ. --McGeddon (talk) 19:02, 13 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The several named-accounts disrupting us now (note: all blocked and tagged) seem to have been created before the range-blocks; CU for (more) sleepers would be quite useful. DMacks (talk) 18:29, 13 October 2015 (UTC)


 * The following accounts are ✅:
 * Blocks and tags as needed. With one exception, these accounts are using a different range from those ranges that have been previously range-blocked. Unfortunately, this "new" range cannot be range-blocked because of collateral damage. Closing.--Bbb23 (talk) 20:23, 13 October 2015 (UTC)
 * Blocks and tags as needed. With one exception, these accounts are using a different range from those ranges that have been previously range-blocked. Unfortunately, this "new" range cannot be range-blocked because of collateral damage. Closing.--Bbb23 (talk) 20:23, 13 October 2015 (UTC)
 * Blocks and tags as needed. With one exception, these accounts are using a different range from those ranges that have been previously range-blocked. Unfortunately, this "new" range cannot be range-blocked because of collateral damage. Closing.--Bbb23 (talk) 20:23, 13 October 2015 (UTC)
 * Blocks and tags as needed. With one exception, these accounts are using a different range from those ranges that have been previously range-blocked. Unfortunately, this "new" range cannot be range-blocked because of collateral damage. Closing.--Bbb23 (talk) 20:23, 13 October 2015 (UTC)
 * Blocks and tags as needed. With one exception, these accounts are using a different range from those ranges that have been previously range-blocked. Unfortunately, this "new" range cannot be range-blocked because of collateral damage. Closing.--Bbb23 (talk) 20:23, 13 October 2015 (UTC)
 * Blocks and tags as needed. With one exception, these accounts are using a different range from those ranges that have been previously range-blocked. Unfortunately, this "new" range cannot be range-blocked because of collateral damage. Closing.--Bbb23 (talk) 20:23, 13 October 2015 (UTC)
 * Blocks and tags as needed. With one exception, these accounts are using a different range from those ranges that have been previously range-blocked. Unfortunately, this "new" range cannot be range-blocked because of collateral damage. Closing.--Bbb23 (talk) 20:23, 13 October 2015 (UTC)
 * Blocks and tags as needed. With one exception, these accounts are using a different range from those ranges that have been previously range-blocked. Unfortunately, this "new" range cannot be range-blocked because of collateral damage. Closing.--Bbb23 (talk) 20:23, 13 October 2015 (UTC)
 * Blocks and tags as needed. With one exception, these accounts are using a different range from those ranges that have been previously range-blocked. Unfortunately, this "new" range cannot be range-blocked because of collateral damage. Closing.--Bbb23 (talk) 20:23, 13 October 2015 (UTC)
 * Blocks and tags as needed. With one exception, these accounts are using a different range from those ranges that have been previously range-blocked. Unfortunately, this "new" range cannot be range-blocked because of collateral damage. Closing.--Bbb23 (talk) 20:23, 13 October 2015 (UTC)
 * Blocks and tags as needed. With one exception, these accounts are using a different range from those ranges that have been previously range-blocked. Unfortunately, this "new" range cannot be range-blocked because of collateral damage. Closing.--Bbb23 (talk) 20:23, 13 October 2015 (UTC)
 * Blocks and tags as needed. With one exception, these accounts are using a different range from those ranges that have been previously range-blocked. Unfortunately, this "new" range cannot be range-blocked because of collateral damage. Closing.--Bbb23 (talk) 20:23, 13 October 2015 (UTC)
 * Blocks and tags as needed. With one exception, these accounts are using a different range from those ranges that have been previously range-blocked. Unfortunately, this "new" range cannot be range-blocked because of collateral damage. Closing.--Bbb23 (talk) 20:23, 13 October 2015 (UTC)

14 October 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Adding this report for the record. Accounts already blocked. Targets similar to other socks:
 * —&thinsp;JJMC89&thinsp; (T·C) 02:45, 14 October 2015 (UTC)
 * —&thinsp;JJMC89&thinsp; (T·C) 02:45, 14 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

16 October 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Doing the usual Najaf stuff on the usual Najaf targets, recreating deleted redirects and adding material previously added by other socks (see contributions; sample edits: recreated List of Kho people, which was previously created by, and recreated Kho cuisine, which was previously created by , both of them blocked Najaf socks). Thomas.W talk 12:24, 16 October 2015 (UTC)
 * The username, Bbdd2, also seems "inspired" by, just like previous confirmed socks and  have had user names heavily "inspired" by my user name... Thomas.W talk 13:02, 16 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * is ✅. Tagged. . I've blocked the IP for 48 hours. Closing.--Bbb23 (talk) 15:09, 16 October 2015 (UTC)

17 October 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Continues redirection of articles related to Chitral, as other socks. <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   02:15, 17 October 2015 (UTC)
 * Then IP #2's first edit is to revert my reversion of #1's edit. <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   02:19, 17 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Both IP's blocked. --<b style="color:navy">Neil N </b> <i style="color:blue">talk to me</i> 02:38, 17 October 2015 (UTC)

17 October 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Created Template:Kho Peoples with a slight variation of the name but the same content as a template that has been created/recreated multiple times by Najaf socks: Template:Kho people. The rest of his edits, including posting on 's talk page, also support that it's a new Najaf sock. Thomas.W talk 16:57, 17 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked per the quacking, closing now as I don't see a reason for a CU request yet. &mdash; Spaceman  Spiff  17:02, 17 October 2015 (UTC)

19 October 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

The IPs listed are those that Najaf has used so far today, 07:50UTC 19 October 2015, (for evidence a quick glance at their contributions should be enough; he seems to be getting more and more frustrated by being constantly reverted so he's now trying to target me, by reverting edits of mine that have nothing to do with him, and then posting on admin talk pages claiming that I'm a vandal, naively believing that getting rid of me would give him free reins...). His edits over the past few days show that he is currently operating on six full consecutive seven /24-nets (i.e. 1,536 1,792 IPs), all belonging to Mobilink Mobile Internet and geolocating to Lahore, Pakistan (119.160.64.0/24 to 119.160.69.0/24, and 119.160.71.0/24; but so far no edits at all on en-WP, not by anyone, from 119.160.70.0/24; the eight /24-nets all belong to Mobilink, and make up 119.160.64.0/21), so this report is filed for the record only, to make it easier to tell if it's Najaf, since there isn't much point in blocking IPs that can be changed every few seconds, other than for perhaps a few hours. Thomas.W talk 07:54, 19 October 2015 (UTC) Added one more /24-net. Thomas.W talk 09:56, 19 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I've range blocked 119.160.64.0/19 for 2 weeks. <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 20:30, 19 October 2015 (UTC)

05 November 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

The name of the user account fits Najaf's "naming convention" (see, and others), edits the usual Najaf targets, articles that have been hit over and over by confirmed Najaf socks, or in other words quacks like a duck, walks like a duck and wags its tail like a duck, It's not a brand new user account, and made a few edits after being created, but has kept a very low profile until now. The IPs also quack like ducks and geolocate to Lahore, Pakistan, just like the IPs that were range-blocked recently because of repeated abuse by Najaf. If diffs are absolutely needed I'll provide them, but I'd rather not spill more beans that I already have, since Najaf, judging by his repeated attempts to blank out portions of SPI reports, keeps track of what happens at SPI. CUs who are familiar with Najaf ought, IMHO, to have no problems seeing the similarities even without specific diffs. Thomas.W talk 10:44, 5 November 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  00:55, 7 November 2015 (UTC)
 * is ✅ and has been blocked and tagged. The IPs are really dynamic, I'm not sure what can be done either than WP:RBI as they pop up and liberal use of semi-protection.-- Jezebel's Ponyo bons mots 22:14, 6 November 2015 (UTC)
 * Closing.

07 November 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

User created on 19 October 2015 repeatedly (#1, #2) reverting on Demographics of Afghanistan to restore edits by IP's previously connected to Najaf (see latest archived report). Krzyhorse222 has also edited multiple other articles in order to seem like a legitimate account, but they're mostly just BS edits, adding grammatical errors (#3), meaningless links (#4, already linked in the lead of the article), etc. They have also issued repeated bogus user warnings to me for reverting them, just like a number of previous Najaf socks have. And these edit on this SPI further confirms my belief that it is Najaf ali bhayo... Thomas.W talk 14:45, 7 November 2015 (UTC)


 * Krzyhorse222 also tried to create a bogus SPI against (#5) on 19 October, their first day here on en-WP, showing it's not a new user, and on their first day also edit-warred to keep a bogus and malformed SPI against  (#6) created by Special:Contributions/2A03:2880:3010:3FF7:FACE:B00C:0:1, an IP that is blocked as a sock of Najaf ali bhayo. Thomas.W talk 16:05, 7 November 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
✅, blocked, tagged, closing.--Bbb23 (talk) 21:47, 7 November 2015 (UTC)

09 December 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Farooq balti is already blocked but is included both for the record and for CU-comparison. Both Farooq balti and Arbab kalash have made the usual Najaf edits on the usual Najaf targets (see for example page history of Khowar language, an article previously hit by dozens of Najaf socks...), as have the IPs. Farooq balti also posted on Ed Johnston's talk page claiming that is a sock of mine, without me having had any interaction with Farooq. The IPs are from well known Najaf IP-ranges (see archive), some of which were rangeblocked a while ago, blocks that have since expired. The IPs have also interacted with both Farooq balti and Arbab kalash. CU is requested since Najaf has a habit of creating sleeper accounts, and also of using multiple accounts in parallell. Thomas.W talk 12:40, 9 December 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  15:33, 9 December 2015 (UTC)
 * - to confirm accounts and flush sleepers. I have hardblocked 119.160.64.0/21 for one year. All anon edits in that range in this search look to be the master.
 * Following are ✅ to Najaf ali bhayo:
 * . All blocked and tagged. Closing. Callanecc (talk • contribs •
 * . All blocked and tagged. Closing. Callanecc (talk • contribs •
 * . All blocked and tagged. Closing. Callanecc (talk • contribs •
 * . All blocked and tagged. Closing. Callanecc (talk • contribs •
 * . All blocked and tagged. Closing. Callanecc (talk • contribs •
 * . All blocked and tagged. Closing. Callanecc (talk • contribs •

11 December 2015

 * Suspected sockpuppets



Identical unresponsive deletion-heavy editwarring as with previous socks of this group at Dardic languages. (I have no opinion on the edits to Punjabis.) Compare e.g. diff 1, diff 2 by this account to diff 3, diff 4 by confirmed socks. -- Trɔpʏliʊm • blah 13:13, 11 December 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. Closing.  Vanjagenije  (talk)  16:40, 11 December 2015 (UTC)

16 February 2016

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Reporting this user as a sock-puppet of User:Krzyhorse222 and User:Najaf ali bhayo. I don't have much of their history at hand as i only interacted with this user on one page and in ANI discussions but i found out that this user is very disruptive. Creates excessive ANI reports and as a matter of fact this user's first edit was an ANI report so definitely something fishy cooking there. Who creates an ANI with their first edit? Then if you see User:Krzyhorse222's first edit here, you can see that he created same userboxes (User WPAfghanistan, User WikiProject Pashtun, User WikiProject Hazara, User wikipedia/Administrator maybe) that User:Krzyhorse22 currently have on their page. All these three users have been active on Afghanistan-related pages. He might have changed his IP but i am 100% positive that this is the same user as User:Krzyhorse222 and User:Najaf ali bhayo. If it is up to me, userboxes similarity should be good enough to block him.  Sh eri ff  |  ☎ 911  | 15:43, 16 February 2016 (UTC)
 * Krzyhorse222 was created by Najaf in October 2015 (more than a year after Krzyhorse22 started editing) as an impersonation account, and their first edits were a frivolous SPI-report against Krzyhorse22 and a couple of other editors, because of Krzyhorse22 reverting Najaf. So there's absolutely nothing that supports your claim about Krzyhorse22 being a sock of Najaf ali bhayo. Thomas.W talk 16:41, 16 February 2016 (UTC)
 * How about opening an ANI with their first edit, here?  Sh eri ff  |  ☎ 911  | 16:50, 16 February 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
. There's no connection between Najaf ali bhayo and Krazyhorse22. Krazyhorse22 has been accused of being a sock of several masters (do a search), and they never go anywhere. Closing.--Bbb23 (talk) 16:03, 16 February 2016 (UTC)

17 February 2016

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Creating the same (apparently hoax) language article as previous socks at Arina dialect, previously created at Arina language until salted. McGeddon (talk) 13:29, 17 February 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.'' I created arina dialect its means never that i am sockpuppet of someone like Najaf ali bhayo najaf created was Arina Language not arina dialectSadanand Sawant (talk)


 * Sockpuppet investigations/McGeddon, started by the sock, continues a long tradition by Najaf socks to create fake/frivolous SPIs against everyone they see as an "enemy"... Thomas.W talk 15:53, 17 February 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * . Blocked and tagged. Closing.  Vanjagenije  (talk)  23:38, 17 February 2016 (UTC)

11 April 2016

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

User:Kratie222 and User:Daud khan 2 created the unsourced Erina language article (currently being AfD'd as a hoax, with these two being the only editors arguing "Keep"), which bears some resemblance to Najaf socks' hoax Arina language articles from last year. The duplicate-content Erina var article history has Kratie222 and Daud each redirecting the article to Burushaski and then undoing the other's redirect.

Kratie222 has already been blocked for disruptive reverting. Several of Kratie222's reverts were reblanking sex-related articles blanked by vandalism-only account User:Afshin Shamshiri a week previously. McGeddon (talk) 15:17, 11 April 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Per presented evidence, specifically the hoax Erina language and the socks' keep arguments at Articles for deletion/Erina language. See also Sockpuppet investigations/Afshin Shamshiri. Thanks and  for filing. Kevin ( aka L235 ·&#32; t ·&#32; c) 15:28, 11 April 2016 (UTC)
 * These three accounts are ✅. I've updated the user page with tags. <b style="color:#151B54">Mike V</b> • <b style="color:#C16C16">Talk</b> 03:10, 15 April 2016 (UTC)

26 April 2016

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Continuing the Arina/Erina language hoax. Created Εrinα language and moved it to Εrina language. In the first title, the fifth letter is (visibly) Greek alpha, and the first letter is (not visibly) upper-case Greek epsilon. In the second title, the fifth letter is "a", but first is still Epsilon, hoping no doubt to avoid its being connected with Erina language which was deleted as a hoax at WP:Articles for deletion/Erina language. It didn't work, and the pages were deleted. Also created Erina people. JohnCD (talk) 16:19, 26 April 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Blocked and tagged per WP:DUCK; leaving open in case anyone thinks a CU check would be worth while. JohnCD (talk) 16:20, 26 April 2016 (UTC)
 * Thanks for the eagle-eyed work, JohnCD. I'd like to request CheckUser because of the deviousness of this attempt. BethNaught (talk) 16:33, 26 April 2016 (UTC)
 * I just declined the unblock request based on the evidence here. <b style="color:DarkTurquoise">HighInBC</b> 16:42, 26 April 2016 (UTC)


 * - Sleepers check needed.  Vanjagenije  (talk)  17:04, 26 April 2016 (UTC)
 * No unblocked sleepers found. &mdash; Coren (talk) 21:29, 26 April 2016 (UTC)
 * There are two possible additional sock accounts here, both previously blocked, and . They are technically a confirmed match, but there is a lot of activity on the range (including by Sockpuppet investigations/LanguageXpert socks), so a behavioral review will be necessary. -- Jezebel's Ponyo bons mots  21:40, 26 April 2016 (UTC)
 * I can't find any behavioral evidence. Case closed.  Vanjagenije  (talk)  13:48, 29 April 2016 (UTC)

23 May 2016

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Creation of a hoax article at Erina language that copies content from another article (in the current case Domaaki language) with the addition of fake references. The same was done in April by two of 's confirmed socks and. This old version of the Erina language article was deleted, but there is evidence in the previous SPI: Sockpuppet investigations/Najaf ali bhayo/Archive and the AfD: Articles for deletion/Erina language. Uanfala (talk) 09:37, 23 May 2016 (UTC)
 * Ducks quack again the way did in February. Uanfala (talk) —Preceding undated comment added 11:56, 24 May 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocking and tagging the sock. Case closed.  Vanjagenije  (talk)  15:32, 24 May 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Hitting the usual targets with the usual edits. The account was created on 28 May and made a couple of fairly uncontroversial (by Najaf's standards) edits then, but didn't become active until today, when they suddenly started on a spree of page moves, both copy-paste moves and normal page moves, turning articles into redirects without moving the content anywhere (i.e. deleting all content) etc etc on articles frequently targeted by Najaf. A CU check is requested since Najaf has a history of using multiple socks in parallell. Thomas.W talk 14:25, 17 June 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * ✅ and  belong to Najaf ali bhayo. - Mailer Diablo 23:24, 17 June 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Case closed.  Vanjagenije  (talk)  09:45, 18 June 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Like previously confirmed socks, this user has created a hoax article, whose title is a variation on Arina language (this time it's Erinaki dialect), copying most of the content from an article about a language of northern Pakistan (this time Maiya language) and throwing in one or two ludicrous claims (this time, that it's a Bactrian language). Uanfala (talk) 19:26, 23 August 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * The page Erinaki dialect linked above has since been deleted. Uanfala (talk) 13:04, 31 August 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Obvious. Indef'ed. DMacks (talk) 13:34, 31 August 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Disruptive editing of Chitral and other articles, per socks of this sockpuppeteer. (Blocked.) <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   13:59, 23 September 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. Closing.  Vanjagenije  (talk)  16:09, 23 September 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

The usual Najaf edits on the usual Najaf targets, such as repeating this edit by CU-confirmed Najaf sock on Chitral District. - Tom &#124; Thomas.W talk 09:33, 28 September 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * . Favonian (talk) 09:38, 28 September 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Showing all signs of being a sock of Najaf ali bhayo, see page history of Tirich Mir (one of their most frequent targets) and their attempts to create bogus SPIs against people who revert them (see Wikipedia talk:Sockpuppet investigations/McGeddon and Sockpuppet investigations/McGeddon). - Tom &#124; Thomas.W talk 13:13, 3 November 2016 (UTC)


 * Note: Please move to Sockpuppet investigations/Najaf ali bhayo, the correct name of the master. - Tom &#124; Thomas.W talk 13:21, 3 November 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The following accounts are ✅ to each other and behaviorally to Najaf:


 * is ✅ from the others but.


 * All confirmed accounts blocked and tagged. Katietalk 14:29, 3 November 2016 (UTC)
 * Case closed.  Vanjagenije  (talk)  14:33, 3 November 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Hitting the usual targets with the usual edits. <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   12:59, 22 November 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * -, please block. Thanks, GABgab 16:34, 22 November 2016 (UTC)
 * . Favonian (talk) 16:38, 22 November 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Usual edits to and undiscussed moves of usual targets of this master. WP:DUCK <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   04:32, 25 November 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Obvious sock is obvious. Indef'ed, obviously. DMacks (talk) 04:44, 25 November 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same bogus edits to same Chitral-related targets. WP:DUCK <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization  Talk   05:58, 29 November 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * IP blocked and tagged, close. - GB fan 15:45, 2 December 2016 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Per DUCK, started Wikipedia:Articles for deletion/Wikipedia:Sockpuppet investigations/Najaf ali bhayo/Archive and Articles for deletion/Sockpuppet investigations/Najaf ali bhayo/Archive. — Sam Sailor 17:39, 16 January 2017 (UTC)
 * Now blocked by, thanks. — Sam Sailor 17:42, 16 January 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * (cf. previous sock: )
 * (cf. a likely previous sock: ). – Uanfala (talk) 12:56, 1 February 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Please block the unblocked accounts. Thanks, GABgab 04:36, 2 February 2017 (UTC)
 * , closing. King of &hearts;   &diams;   &clubs;  &spades; 07:00, 2 February 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

See abuse log and user sandbox, which is basically a copy of the sockmaster's preferred version of Khowar language. Sro23 (talk) 03:57, 13 March 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * Could you also block who created the same user sandbox? Sro23 (talk) 04:09, 13 March 2017 (UTC)
 * , done. --<b style="color:navy">Neil N </b> <i style="color:blue">talk to me</i> 05:08, 13 March 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked <b style="color:navy">Neil N </b> <i style="color:blue">talk to me</i> 04:05, 13 March 2017 (UTC)
 * Adding for the record Administrators' noticeboard/IncidentArchive948, which found that after a longterm block on 2A03:2880::/32 for this sockdrawer had expired, the abuse from anon-IPs reappeared, leading to my reapplying a longterm block on it. See also Administrators' noticeboard/IncidentArchive901, which discusses that previous rangeblock. And finally noting for the record that I have now received email indicating someone from that range is trying to change my WP password. DMacks (talk) 05:19, 13 March 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

The edits carry all signs of being made by Najaf, but what lead me to the account was attempts by a user named Harppen on Meta to get a couple of Najaf socks, Special:Contributions/Deepak Chitrali and Special:Contributions/Sher Aziz, unlocked, and attemps by a user named Sparkle Orakle (who has now been indeffed on Meta) to get me and a couple of other Najaf foes globally blocked (see this older version of the "steward's request" page on Meta; scroll down and you'll find it all). When checking the accounts I found that there is no user named Harppen on Meta, only redirects from that user's user pages to Sparkle Orakle (and the page history shows that the edits signed Harppen were made by Sparkle Orakle, with a fake signature), and when checking the user name Harppen here I found that there is no user named Harppen here either, but just like on Meta there are redirects from their user pages to an existing user, a user named Sparkle Octa, a name that is remarkably similar to the now indeffed user named Sparkle Orakle that Najaf has been using on Meta. Leaving no doubt in my mind about Sparkle Octa also being a Najaf sock... - Tom &#124; Thomas.W talk 11:09, 5 April 2017 (UTC)


 * A bit of digging shows that there has indeed been a user named Harppen both here and on Meta: Harppen here on en:WP was created on 29 September 2016, but was renamed Sparkle Octa on 28 March 2017 09:09UTC, and only eight minutes later, i.e. 09:17UTC 28 March 2017, a new user with the same name, Harppen, was created on Meta, only to be renamed Sparkle Orakle on 4 April 2017. - Tom &#124; Thomas.W talk 11:42, 5 April 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ plus:
 * Blocked, tagged, closing.--Bbb23 (talk) 17:48, 5 April 2017 (UTC)
 * Blocked, tagged, closing.--Bbb23 (talk) 17:48, 5 April 2017 (UTC)
 * Blocked, tagged, closing.--Bbb23 (talk) 17:48, 5 April 2017 (UTC)
 * Blocked, tagged, closing.--Bbb23 (talk) 17:48, 5 April 2017 (UTC)
 * Blocked, tagged, closing.--Bbb23 (talk) 17:48, 5 April 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

The user(Himel Rahmon), blocked earlier for edit warring, is using IPs related to this case for editing.(see here) He has a disruptive behavior and is editing on related topics, like Pakistan, Turks, Afghanistan, Islamic world etc. The other user(Hookahlove), emerged recently also has same editing style and area of interest. Shimlaites (talk) 10:36, 13 April 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Case is poorly substantiated and the nom has been blocked as a sock-puppet. Closing without action. Favonian (talk) 17:21, 17 April 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Recreation of Rehmat Aziz Chitrali Gold Medalist (one of several variations, like Rehmat Aziz Chitrali etc...) and a direct copy of Rachitrali's userpage = some pretty loud quacking. There's also this on my talk... and now this CHRISSY MAD  ❯❯❯  ¯\_(ツ)_/¯  11:33, 8 May 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * This guy is seriously interesting and meanwhile ignorant. Keep on creating socks, autobios and misrepresenting that he's part of WMF staff. . --Saqib (talk) 13:14, 8 May 2017 (UTC)
 * I almost forgot about that... CHRISSY MAD  ❯❯❯  ¯\_(ツ)_/¯  13:18, 8 May 2017 (UTC)
 * about what? --Saqib (talk) 13:20, 8 May 2017 (UTC)
 * His WMF claim! CHRISSY MAD  ❯❯❯  ¯\_(ツ)_/¯  13:20, 8 May 2017 (UTC)
 * He has been doing it for quite a time now. see User_talk:Rachitrali. --Saqib (talk) 13:23, 8 May 2017 (UTC)


 * This guy (Akbaralighazi/Rehmat Aziz Chitrali, see deleted article Rehmat Aziz Chitrali) is a self-proclaimed language expert, lives in Pakistan, has been socking for years, and shares most of the interests that User:LanguageXpert has shown here, so it might be worth a minute or two to check if there's a connection between them, now that we have fresh edits undisputably made by Chitrali... - Tom &#124; Thomas.W talk 14:39, 8 May 2017 (UTC)
 * LanguageXpert edits different articles and has a very different style. – Uanfala (talk) 20:14, 8 May 2017 (UTC)


 * There we go again: . – Uanfala (talk) 09:07, 9 May 2017 (UTC)
 * User:Rachitrali sent me an email and saying that someone is trying to impersonate him by creating usernames related to his name. Does User:Rehmat Aziz Chitrali Gold Medalist and User:Rehmat Aziz Chitrali are confirmed as sock or not? --Saqib (talk) 09:11, 9 May 2017 (UTC)
 * And now there's also . – Uanfala (talk) 09:44, 9 May 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  14:31, 8 May 2017 (UTC) — Berean Hunter   (talk)  20:57, 8 May 2017 (UTC)
 * Indeffing sock used for block evasion.
 * Rehmat Aziz Chitrali is ❌ to LanguageXpert. The following additional accounts are ✅:
 * Blocked, tagged, reclosing.--Bbb23 (talk) 17:00, 8 May 2017 (UTC)
 * Re-opened for now. I intend to comment here with more evidence later but have real life issues to get done before I can.
 * Blocked, tagged, reclosing.--Bbb23 (talk) 17:00, 8 May 2017 (UTC)
 * Re-opened for now. I intend to comment here with more evidence later but have real life issues to get done before I can.
 * Blocked, tagged, reclosing.--Bbb23 (talk) 17:00, 8 May 2017 (UTC)
 * Re-opened for now. I intend to comment here with more evidence later but have real life issues to get done before I can.

— Berean Hunter   (talk)  16:21, 9 May 2017 (UTC)
 * I see some behavioral and subject-interest links to Sockpuppet investigations/Najaf ali bhayo also. DMacks (talk) 02:21, 9 May 2017 (UTC)
 * Najaf ali bhayo has the same interest in Khowar and related languages, but their strong propensity for blatant hoaxing doesn't in my view fit with Rachitrali's good-faith (if sometimes incompetent) editing to these articles. – Uanfala (talk) 08:23, 9 May 2017 (UTC)
 * On the other hand, Rehmat Aziz Chitrali looks to me like Sockpuppet investigations/Sher Aziz. DMacks (talk) 02:24, 9 May 2017 (UTC)
 * is right about this being Najaf. This is not the real Rachitrali. This is a joe job. I indicated a while ago that I knew that Najaf was a catalyst to this case and to a much lesser degree LanguageXpert has been involved. Their socks were active at Commons and elsewhere going after this group. Mostly Najaf. I've been busy and hadn't got to post here before now. Some contribs at meta have disappeared as did a userpage that had been created there. I notice that this account remains unblocked although his contribs are gone. Since I'm not an admin there, I can no longer see them. :) I assume that the admins must have deleted this but I haven't chased that down yet.
 * Also during the night, I received an email from the original Rachitrali account and I'm going to reply here. As you can see, I believe you that the above accounts and most recent activity isn't you. I had re-opened this case so that I could address that. Receiving the email helped confirm what I already suspected and as you can see another admin also suspected Najaf. To address another point in your email, no, we do not supply real names, email addresses, IP addresses, etc. You have indicated that you are trying to locate Najaf's actual residence and go find him. We cannot assist you in that matter.
 * Before User:Rehmat Aziz Chitrali Gold Medalist and User:Rehmat Aziz were added here (by others, not me) I noticed that they had been globally locked on Meta, after complaints from User:Rachitrali (who is blocked only on en-WP) about the accounts not being him, instead being people in Pakistan who are going after him on Wikipedia, and not only en-WP. - Tom &#124; Thomas.W talk 16:43, 9 May 2017 (UTC)
 * This case was split from Akbaralighazi and merged here (see ). Closing.  Vanjagenije  (talk)  23:25, 14 May 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

quack, quack recreations of past sock articles, same general subject area dealing with Kashkar, Kho people/tribe and Chitral. CHRISSY MAD ❯❯❯  ¯\_(ツ)_/¯  11:10, 9 May 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Definitely a sock. Articles deleted, and user blocked. RickinBaltimore (talk) 13:14, 9 May 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Recreation of several similar articles and same subject as last round of socks. See Transformer's creations:
 * Kalash religion
 * Timeline of ancient Kashkar

A sock from the last round: CHRISSY MAD ❯❯❯  ¯\_(ツ)_/¯  12:04, 12 May 2017 (UTC)
 * Timeline of Kashkar
 * Timeline of kashkar
 * Religion of Kalasha

And to make it even easier, they've had their username changed to. CHRISSY MAD ❯❯❯  ¯\_(ツ)_/¯  14:23, 12 May 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * The name change to "Akbar ali ghazi" is so obvious that it has to be a "joe job". See comments about "joe job" in the section above... (... and if I was to bet on who's behind it I'd put my money on Najafalibhayo, based on what I've seen of him and his actions so far) - Tom &#124; Thomas.W talk 14:30, 12 May 2017 (UTC)
 * who is doing joe job here? Am I missing something? --Saqib (talk) 15:58, 12 May 2017 (UTC)
 * The suggestion is that a person or persons unknown might be impersonating Akbaralighazi in order to get them in more trouble. Boing! said Zebedee (talk) 16:00, 12 May 2017 (UTC)
 * Okay. This is what Akbaralighazi (Rehmat Aziz) told me by email, but I really don't believe it to be true. I wonder why someone would do that. What is the benefit of further impersonating Akbaralighazi when Akbaralighazi's bio page along with several articles related to him are deleted and several socks are blocked. What kind of more trouble Akbaralighazi will get, a part from being blocked on Incubator where he's running a wiki and I suspect he using it to promote himself. Why not run a CU and identify the accounts run by that impersonator. --Saqib (talk) 16:23, 12 May 2017 (UTC)
 * Oh, I gave up trying to work out why people do weird things years ago ;-) Boing! said Zebedee (talk) 16:34, 12 May 2017 (UTC)
 * Najaf has done all kinds of weird things, such as trying to reset other editors' passwords, including mine, in the hope that a new password will be sent to him, and trying to get my account globally locked on Meta... - Tom &#124; Thomas.W talk 16:45, 12 May 2017 (UTC)
 * Interesting. is this Najaf and co. comes from Pakistan ? --Saqib (talk) 17:05, 12 May 2017 (UTC)
 * That's the vague impression I got from their English. – Uanfala (talk) 20:16, 12 May 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
Account blocked. Closing.--Bbb23 (talk) 16:48, 12 May 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

All of them are SPAs attempting to get Chitrali deleted, in an afd discussion created by Transformer X. This is a new account by that name created after the previous one changed its user name and was blocked.

Question: Is there a connection to User:Najaf ali bhayo? The history of Chitrali shows it's been edited by Najaf socks, and that SPI mentions a focus on Chitrali and related articles. bonadea contributions talk 08:47, 13 May 2017 (UTC)

Fixing a username - no idea how I missed this, but EISIGMA88 signed using a fake name in the AfD. --bonadea contributions talk 09:49, 13 May 2017 (UTC)
 * Chitral CSX got renamed to EISIGMA88 only this morning . – Uanfala (talk) 09:54, 13 May 2017 (UTC)
 * Thanks! Nice to know I haven't lost it completely :-) (I looked at the user rename log for EISIGMA88 thinking that there might have been a name change, but it's logical that it is Chitral CSX's logs that document the change.)  That also seems like typical behaviour, btw, looking at the previous SPI above. Oh, and the username change went through a minute before this edit. --bonadea contributions talk 10:12, 13 May 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * This is almost certainly Najaf ali bhayo: the current batch of socks are doing largely the same as the previous socks had done (see for an example of a CU-confirmed case). Chitrali's edit history is full of the attempts of Najaf's suspected socks to blank or redirect it. –  Uanfala (talk) 08:58, 13 May 2017 (UTC)
 * I've closed the AfD as "speedy keep as a bad-faith nomination by obvious socks". Boing! said Zebedee (talk) 08:59, 13 May 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ plus:
 * Blocked without tags.
 * I agree that the the Najaf ali bhayo socks are ✅ technically and behaviorally to the socks in this case. As far as I can tell, there is a clear technical line back to Najaf ali bhayo but not in this case. Nonetheless, I think the Najaf ali bhayo case should be merged into this one and all accounts retagged. Akbaralighazi is significantly older than Najaf ali bhayo. Can you please do the merge?--Bbb23 (talk) 17:04, 13 May 2017 (UTC)
 * Vanja, before doing the requested merge, please look 's comments on my Talk page. What he says is something that occurred to me too.--Bbb23 (talk) 17:45, 13 May 2017 (UTC)
 * I split off the May history of Sockpuppet investigations/Akbaralighazi and merged here, per the discussion you linked. Closing now.  Vanjagenije  (talk)  23:31, 14 May 2017 (UTC)
 * Great. Thanks very much.--Bbb23 (talk) 23:48, 14 May 2017 (UTC)
 * I split off the May history of Sockpuppet investigations/Akbaralighazi and merged here, per the discussion you linked. Closing now.  Vanjagenije  (talk)  23:31, 14 May 2017 (UTC)
 * Great. Thanks very much.--Bbb23 (talk) 23:48, 14 May 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Per CU evidence found checking an ACC request. I'd like another CU to take a look at this. To me they appear ✅, but I'm unfamiliar with some of the technical aspects I'm seeing and the behavior of this master. Ks0stm (T•C•G•E) 15:37, 26 May 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * per above. Ks0stm  (T•C•G•E) 15:38, 26 May 2017 (UTC)
 * I suspect this should have been filed at Sockpuppet investigations/Najaf ali bhayo.--Bbb23 (talk) 20:17, 26 May 2017 (UTC)
 * Maybe? I was going off of the block logs of Special:Contributions/History of Baltistan, Special:Contributions/GAGAS00 and Special:Contributions/Rehmat Aziz Chitrali, etc. Ks0stm  (T•C•G•E) 20:28, 26 May 2017 (UTC)
 * Yes, look at the tags on the userpages rather than the block logs. These two cases became entangled and then were separated by a history split.--Bbb23 (talk) 20:48, 26 May 2017 (UTC)
 * Gotcha, will relocate. Ks0stm  (T•C•G•E) 21:16, 26 May 2017 (UTC)


 * ✅, blocked, tagged, closing.--Bbb23 (talk) 22:44, 26 May 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Clear WP:DUCK, see edits to Chitral, Kho people and attempted creation of Kho dialect, an article that has been recreated many times. Sro23 (talk) 20:20, 3 June 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  01:13, 4 June 2017 (UTC)
 * Indeffed, tagging and closing.

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

I am not fully aware of the procedures on enwiki. I only wanted to raise a warning about a suspect case. As a global renamer, I have discarded tens of global renaming requests by sockpuppets of Najaf ali bhayo, and I have learnt to recognize them. XPISTOS, who currently has not edited yet on enwiki but on simplewiki, is asking for a renaming in the exact same terms than previous sockpuppets. Perhaps another global renamer will perform the renaming (the desired username is "Diodere"). I very strongly suspect this account is another sockpuppet. Thank you! Litlok (talk) 08:32, 31 July 2017 (UTC)
 * PS: I have dismissed the request. Litlok (talk) 08:46, 31 July 2017 (UTC)
 * A new request was accepted by Buggia. The new username to keep an eye on is now Arghosia. Litlok (talk) 11:09, 31 July 2017 (UTC)


 * I've found today that requested a rename to Ξodin ; and while reviewing the queue I've found that Xhi Xho was renamed today to  by User:Céréales Killer. I've denied Anna's request. Xhi Xho nor his new username Ξodine seems to be registered on enwiki, but given the similarities on the chosen names and request dates, I'd say  altogether. Please note that  has lodged 11 requests for user rename already since May. Absent a feature to prevent further abuse I'm globally locking that account. -- MarcoAurelio (talk) 11:05, 9 August 2017 (UTC)
 * : EISIGMA10 is also probably another sockpuppet. Litlok (talk) 11:45, 9 August 2017 (UTC)
 * I know, I have rejected his demand twice ;) I am not a number (talk) 11:51, 9 August 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
A big "thank you" to User:Litlok and other global renamers for being aware of and preventing this abusive behavioral pattern! DMacks (talk) 15:16, 31 July 2017 (UTC)

Note that another part of the pattern is to later recreate the old-named account, or rename yet another new/sleeper account to that old account, in a futile attempt to confuse the historical record. DMacks (talk) 15:19, 31 July 2017 (UTC)

— Berean Hunter   (talk)  15:28, 14 August 2017 (UTC)
 * Arghosia and are ✅ matches to  (SUL) who is locked as a sock. ​—DoRD (talk)​ 12:59, 9 August 2017 (UTC)
 * Indeffing socks with tags and closing.

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Edited, then blanked block notice on User:Φαρηαν αδαμ. Only other edit at time of reporting was to blank their talk page. <sub style="border:2.5px solid #16872C;padding:1.3px;"> Vermont &#124; reply here  09:56, 29 March 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I'm a bit late to the party but Φαρηαν αδαμ is the same name as Farhan adam, but written in Greek letters, and IIRC it's not the first time Najaf uses a name more than once, but written in different scripts.. - Tom &#124; Thomas.W talk 12:51, 29 March 2018 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Farhan adam and the following are ✅:
 * The deleted contents of some of these accounts' talk pages is also similar. ​—DoRD (talk)​ 12:02, 29 March 2018 (UTC)
 * Tagged sockpuppets. Closing. Sro23 (talk) 13:36, 29 March 2018 (UTC)
 * The deleted contents of some of these accounts' talk pages is also similar. ​—DoRD (talk)​ 12:02, 29 March 2018 (UTC)
 * Tagged sockpuppets. Closing. Sro23 (talk) 13:36, 29 March 2018 (UTC)
 * The deleted contents of some of these accounts' talk pages is also similar. ​—DoRD (talk)​ 12:02, 29 March 2018 (UTC)
 * Tagged sockpuppets. Closing. Sro23 (talk) 13:36, 29 March 2018 (UTC)
 * Tagged sockpuppets. Closing. Sro23 (talk) 13:36, 29 March 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

I already blocked this account, but please check for sleepers.  Vanjagenije  (talk)  11:40, 15 April 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ plus:
 * Blocked the unblocked accounts. They should be globally locked. ?--Bbb23 (talk) 20:06, 15 April 2018 (UTC)
 * done. Green Giant (talk) 21:11, 15 April 2018 (UTC)
 * Blocked the unblocked accounts. They should be globally locked. ?--Bbb23 (talk) 20:06, 15 April 2018 (UTC)
 * done. Green Giant (talk) 21:11, 15 April 2018 (UTC)


 * Thanks. Closing. Bbb23 (talk) 21:13, 15 April 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Doing nothing but removing sockpuppet tags from user pages of CU-confirmed Najaf socks... - Tom &#124; Thomas.W talk 08:16, 16 May 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I'm not totally familiar at this time, but that's more or less ✅. Two other socks blocked at the same time: and  (several other accounts were already blocked/locked). -- zzuuzz (talk) 09:01, 16 May 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Repeatedly removing the sock tag from the user page of a blocked Najaf sock (Special:Contributions/FOTIA_EINAI_MAI_PAREI...), and then trying to get their user talk page deleted, just like many other Najaf socks have done lately. Would someone also please look at their deleted contributions (Graminas has made 19 edits, but only seven are visible to ordinary peons like me...) in case they have managed to get the user pages of other Najaf socks deleted, in order to remove evidence against him... - Tom &#124; Thomas.W talk 14:26, 2 July 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * . Favonian (talk) 14:48, 2 July 2018 (UTC)


 * Good catch! The deleted edits were to 's user and usertalk. Which indeed (as typical) was the account-name at that time and was then renamed to Graminas. But there were no admin notes on that talk-page prior to the deletion and no other-socks' talkpage games that I see. Graminas is now globally locked. DMacks (talk) 15:04, 2 July 2018 (UTC)

Suspected sockpuppets
Cf. contributions of confirmed sock. <span style="font-family: Gill Sans MT, Arial, Helvetica; font-weight:140;"> General Ization <i style="color: #000666;">Talk </i> 18:51, 13 March 2022 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Tagged as suspected based on editing overlap plus clues from older socks in cuwiki. -- RoySmith (talk) 19:37, 13 March 2022 (UTC)

Suspected sockpuppets

 * (name originally filed)

Chitral view was blocked earlier this year for hijacking pages on Pakistani villages. For example see the history of Raees dynasty, which Chitral view overwrote with information about Qaqlasht, then moved the page to that title. After the move was reverted and a discussion led to a merger, Chitral view overwrote and moved the article again a few more times. In other instances where their hijacking was reverted they would just copy the article to a new title instead and then redirect the original article, requiring a history repair. This account was blocked in February.

Chitral view also edited logged out as 115.186.135.10 (or the IP is a meatpuppet) and the IP continued the same activity after the account was blocked. The IP was blocked in May as a P2P VPN.

Compassionate 247 is a much older account, but had only a single edit years in the past before they started with the same activity in May, just before the IP was blocked. Compassionate also tag-teams with 103.170.179.16. The history of Template:Chitral-Union-Councils is telling for this sockfarm. Ivanvector (Talk/Edits) 13:15, 20 September 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * No CU comment on the IPs, but oddly enough the two accounts are ✅ to very old socks of Sockpuppet investigations/Najaf ali bhayo. Compassionate 247 was created right around the time of the first investigations in that case, and that case was also a sockfarm involved in hijacking articles in this same geographic area..
 * please merge this report per the above. Ivanvector (Talk/Edits) 13:27, 20 September 2023 (UTC)
 * Never mind, did it myself. Ivanvector (Talk/Edits) 16:30, 20 September 2023 (UTC)

Suspected sockpuppets
Reinstated a sock-version of Khot town without comment in Special:Diff/1177659548 <sup style="letter-spacing:-.1em;color:#737373;font-family:monospace">user: A smart kitten <sub style="color:#b842b8;font-family:monospace">meow  19:56, 28 September 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Yup. Blocked for 2 weeks along with a number of other IPs that are probably the same user, and article semiprotected for I haven't decided how long just yet. Ivanvector (Talk/Edits) 20:43, 28 September 2023 (UTC)

Suspected sockpuppets
Obvious - hijacking articles and redirects to create new articles on settlements in Chitral. See below. Ivanvector (Talk/Edits) 16:38, 22 October 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Related XfD's: The ruckus caused by this user also prompted me to create an LTA page for this SPI. –<b style="color:#77b">Laundry</b><b style="color:#fb0">Pizza</b><b style="color:#b00">03</b> ( d c̄ ) 18:14, 22 October 2023 (UTC)
 * Articles for deletion/Laspur
 * Redirects_for_discussion/Log/2023_October_22
 * Redirects_for_discussion/Log/2023_October_22

Clerk, CheckUser, and/or patrolling admin comments

 * ✅ to, who in turn is ✅ to already confirmed sock Compassion 247. . Ivanvector (Talk/Edits) 16:38, 22 October 2023 (UTC)

Suspected sockpuppets
Sleeper created March 2017, made a few edits in April 2017. 25 Oct, a few days after User:Chitral guide was blocked, arises from their slumber and resumes hijacking Chitral-related pages Karimabad, Khyber Pakhtunkhwa, Karimabad, Chitral, Kuh, Chitral, etc. Recreated Darband, Chitral at Darband (town). Same odd page-moving fixation, see recent history of Darband, Khyber Pakhtunkhwa. Strong overlap with User:Chitral guide and User:Chitral view:. Wikishovel (talk) 04:24, 27 October 2023 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
 * I unknowingly created a duplicate report. They continue to move and hijack articles in the Chitral topic area, e.g. . Unsuccessfully requested unprotection for two pages in the topic area. –<b style="color:#77b">Laundry</b><b style="color:#fb0">Pizza</b><b style="color:#b00">03</b> ( d c̄ ) 02:51, 30 October 2023 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * ✅. Ivanvector (Talk/Edits) 19:10, 1 November 2023 (UTC)

Suspected sockpuppets
Obvious block evasion. New account created 2 June. Gamed autoconfirm, then today restored blocked sock User:Anima303's edits at Karimabad, Khyber Pakhtunkhwa:. Moved article Union Council Khot to Meragram, recreated previously G5'd Khot, Khyber Pakhtunkhwa over redirect:, and changed the redirect target from Meragram to Khot, Khyber Pakhtunkhwa:. I flagged up the edits and page moves to the previous deleting admin User:Deb at User talk:Deb, then it became clear (even to me) that this is simply another sock. Wikishovel (talk) 15:41, 17 June 2024 (UTC)
 * Just noticed that this is LTA: do I need to take this to ANI, in the middle of an SPI? Requesting checkuser. Wikishovel (talk) 15:44, 17 June 2024 (UTC)

Comments by other users

 * Looks pretty obvious to me. Deb (talk) 15:44, 17 June 2024 (UTC)
 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Obvious sock is obvious. Indef'ed. This drawer tends to make a buch, so a CU would be useful for sleepers. In the past, we've also used CU-determined range-blocks, so they might find a previous rangeblock for this drawer that has expired and could be renewed (I don't have that hat to know most of the details). DMacks (talk) 16:49, 17 June 2024 (UTC)
 * . Reasonably likely to from the archive though. Tagging and closing.  --Blablubbs (talk) 11:53, 24 June 2024 (UTC)