Wikipedia:Sockpuppet investigations/TronFactor/Archive

Suspected sockpuppets

 * ( original case name)

This group created the Qatari soft power article and, in a very short timeframe, they added snippets linking to it from a large number of articles. These snippets are very similar to each other, use the same sources, same formatting and editing style, etc. They also follow a strongly sequential editing pattern across accounts. The IPs are mostly German (many of them verified as residential proxies from the Nimbleway network), except 212.116.163.235 which is an Israeli IP that doesn't look like a proxy.Qatari soft power was created by Ghalbeyakh on 13:28, 28 January 2024‎. From that day to 1 February 2024, the mentioned snippets were added by Ghalbeyakh themselves, Abu1ameen , Huda-omr , Akarout , Sockuptery , 212.116.163.235 , 87.162.158.45 , 93.230.148.209 , 46.90.155.9 , Ahmed1715e , TronFactor , 176.95.251.35 , Cococ2001 , Yyahmedsakr , 94.134.177.232 , 92.116.234.244 , 79.196.105.205 , 46.223.162.248 , Asaad583832shingali , Amshal , PrasanthS05 .Medellinir !voted keep at Articles for deletion/Qatari soft power , and use the same type of (not so common) gnoming on the same day in the past as Ghalbeyakh .See also the overlaps on Empire State Building and World Athletics Championships. Also the way they often add the same info in lede and body, sometimes in the same edit, and the same kind of cross-referencing.To get a better grasp of the overall picture, I'd recommend looking at the consolidated timeline at spi-tools or sandals. MarioGom (talk) 16:50, 3 February 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I will note that Qatari soft power would be quite impressive for a new editor; as noted here. Not impossible, but very hard to make from start-to-finish if one is truly new. — Red-tailed hawk  (nest) 22:50, 3 February 2024 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - I'm requesting a check for the registered accounts. Please, keep in mind there seems to be a lot of residential proxy use (Nimbleway network). Also timing of some contribs make me think there's possibly more than one editor (but tightly coordinated). MarioGom (talk) 16:52, 3 February 2024 (UTC)
 * - Marking since this may take a little while. Vanamonde93 (talk) 22:30, 3 February 2024 (UTC)
 * That was a few hours of my life...There's broadly three categories here. The first is a large group all ✅ to each other. These are:, , , , , , , , , , , and . I have indeffed these based on CU data.
 * Then there's, who I would call to the rest, but is ✅ to : also indeffed.
 * The remaining named accounts are highly suspicious; there's lots of proxy use, and they may be exclusively editing from proxies; the behavioral overlap is strong; and there's some technical similarity too, so I'd call them as well. I have blocked these, but I suspect that the named master (and possibly others) is a hijacked account; so requesting clerk assistance with tagging and possibly renaming.
 * however, I saw considerable evidence of deliberately logged-out editing, so someone should check behavior on the IPs keeping in mind that behavioral overlap is likely not coincidental. That won't be me, this has already taken longer than I expected. Vanamonde93 (talk) 05:54, 4 February 2024 (UTC)
 * Moved the case to TronFactor, which is the globally oldest confirmed account. Behaviorally, I think Cococ2001 and TronFactor were already socks of each other in 2014. So it is hard for me to assess whether there is account hijacking or just warming up of sleepers of a sockfarm possibly larger than the one reported here. I'll keep it this way at the moment. I will tag the confirmed group as confirmed to TronFactor, and the rest of the group as proven to it. MarioGom (talk) 09:14, 4 February 2024 (UTC)
 * Current G5/REVERTBAN time is 22:31, 30 January 2024 (Sockuptery). MarioGom (talk) 09:21, 4 February 2024 (UTC)
 * . MarioGom (talk) 09:46, 4 February 2024 (UTC)
 * - I'd suggest giving a short (1-2 weeks?) hardblock to all IPs mentioned in this case. Hard because they are probably used by registered accounts, short because given it's residential proxies, they will rotate quickly. I would also include which overlaps in topic and it's part of the same proxy network (Nimbleway). MarioGom (talk) 14:00, 4 February 2024 (UTC)
 * Given the nature of these proxies, there is probably no point in blocking them anymore. Closing. MarioGom (talk) 15:25, 23 February 2024 (UTC)

Suspected sockpuppets
Just like previous accounts, these 3 have tells of being old inactive accounts that were recently compromised. Luckyali11 and Amr Hamed promoted the website shameqatar.com and one day later Iamjosemom also added a link to the website, concealed as a revert. Just like itsinyourhands24.com, which was being promoted by the previous batch, it is a recently registered website, and there's quite a few tells about both websites being run by the same actor. Like the previous batch with Qatari soft power, Iamjosemom created Qatar role in the Israel–Hamas war in one go, in a way that is quite implausible for an otherwise inexperienced user. MarioGom (talk) 15:34, 23 February 2024 (UTC)


 * Also note the overlap at Moza bint Nasser. MarioGom (talk) 15:40, 23 February 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * and beware residential proxies. MarioGom (talk) 15:35, 23 February 2024 (UTC)
 * Unsurprisingly, everyone's on proxies.
 * ✅ to each other, likely compromise attempts observed:


 * Separately ✅ to each other:


 * Nominally but the cave paint looks similar:

I'll block and request a lock for the unblocked accounts. Closing. Thanks, Spicy (talk) 18:12, 23 February 2024 (UTC)

Suspected sockpuppets
The username and topic area are an all-but-certain link to a previous sock,. Sable232 (talk) 21:27, 18 March 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked, tagged, global lock requested, closing. Bbb23 (talk) 00:55, 19 March 2024 (UTC)
 * Not sure what went wrong, but the block and tag didn't go through, although the global lock request did, so I'm blocking and tagging (again). Bbb23 (talk) 00:58, 19 March 2024 (UTC)
 * , I was looking at this just as you blocked. This sockmaster is known to compromise accounts, and if you look at Iamjosemom's contributions, the abrupt switch from cars to Qatar politics strongly suggests this possibility. They also claimed to be compromised on UTRS in a manner that seems sincere to me. From a technical perspective, Iamjosemon's data is consistent with the data for Iamjosemom prior to February, i.e., prior to the likely compromise of the account. I don't believe this account is being operated by the sockmaster. Spicy (talk) 01:14, 19 March 2024 (UTC)
 * I'm not sure I follow, but I assume if there's something you wish to change about the block, tag, and glock request, you will.--Bbb23 (talk) 01:24, 19 March 2024 (UTC)
 * To be clear, I think that Iamjosemom was compromised by the sockmaster, and Iamjosemon is an account created by the original operator of that account, prior to the compromise. I see it's now  been locked but hopefully this is taken into account if they appeal.  Spicy (talk) 01:04, 20 March 2024 (UTC)

Suspected sockpuppets
See below. Moneytrees🏝️(Talk) 03:38, 1 May 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * A private tip indicated this was a return of TronFactor, and the dormant account suddenly shifting from Pakistan to Qatar politics falls along the MO of account compromises. . Moneytrees🏝️(Talk) 03:38, 1 May 2024 (UTC)

Suspected sockpuppets

 * ( original case name)

Indicates similar edit patterns to volleyball related articles.  98𝚃𝙸𝙶𝙴𝚁𝙸𝚄𝚂  •  [𝚃𝙰𝙻𝙺]   13:19, 3 June 2024 (UTC)

Comments by other users

 * Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

 * - Please move to Sockpuppet investigations/TronFactor. Bbb23 (talk) 14:02, 3 June 2024 (UTC)
 * Merge done. Please note that many of the accounts in this SPI are compromised, so behavioural evidence needs to be interpreted with care. In this case, the Qatar-related edits by Cococ2001 were likely carried out by the sockmaster after compromising the account, but the volleyball edits were probably performed by the original operator of the account, i.e. not the actual target of the block. So it's debatable whether the edits from this IP, if we assume they are the same person, should be treated as block evasion. Spicy (talk) 16:58, 8 June 2024 (UTC)
 * IP seems inactive now, likely rotated. Not much point in blocking at this point even if it was evasion. Closing case. The Wordsmith Talk to me 04:39, 12 July 2024 (UTC)