Wikipedia:Sockpuppet investigations/TronFactor/Archive


TronFactor

03 February 2024

Suspected sockpuppets

This group created the Qatari soft power article and, in a very short timeframe, they added snippets linking to it from a large number of articles. These snippets are very similar to each other, use the same sources, same formatting and editing style, etc. They also follow a strongly sequential editing pattern across accounts. The IPs are mostly German (many of them verified as residential proxies from the Nimbleway network), except 212.116.163.235 which is an Israeli IP that doesn't look like a proxy.

Qatari soft power was created by Ghalbeyakh on 13:28, 28 January 2024‎. From that day to 1 February 2024, the mentioned snippets were added by Ghalbeyakh themselves [1][2], Abu1ameen [3][4][5], Huda-omr [6][7][8][9], Akarout [10][11][12][13], Sockuptery [14][15][16], 212.116.163.235 [17], 87.162.158.45 [18], 93.230.148.209 [19], 46.90.155.9 [20], Ahmed1715e [21], TronFactor [22][23][24], 176.95.251.35 [25], Cococ2001 [26][27][28][29], Yyahmedsakr [30][31], 94.134.177.232 [32], 92.116.234.244 [33], 79.196.105.205 [34], 46.223.162.248 [35], Asaad583832shingali [36], Amshal [37][38], PrasanthS05 [39][40].

Medellinir !voted keep at Wikipedia:Articles for deletion/Qatari soft power [41], and use the same type of (not so common) gnoming on the same day in the past as Ghalbeyakh [42][43].

See also the overlaps on Empire State Building and World Athletics Championships. Also the way they often add the same info in lede and body, sometimes in the same edit, and the same kind of cross-referencing.

To get a better grasp of the overall picture, I'd recommend looking at the consolidated timeline at spi-tools or sandals. MarioGom (talk) 16:50, 3 February 2024 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I will note that Qatari soft power would be quite impressive for a new editor; as noted here. Not impossible, but very hard to make from start-to-finish if one is truly new. — Red-tailed hawk (nest) 22:50, 3 February 2024 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

23 February 2024

Suspected sockpuppets

Just like previous accounts, these 3 have tells of being old inactive accounts that were recently compromised. Luckyali11 and Amr Hamed promoted the website shameqatar.com [44][45] and one day later Iamjosemom also added a link to the website, concealed as a revert [46]. Just like itsinyourhands24.com, which was being promoted by the previous batch, it is a recently registered website, and there's quite a few tells about both websites being run by the same actor. Like the previous batch with Qatari soft power, Iamjosemom created Qatar role in the Israel–Hamas war in one go, in a way that is quite implausible for an otherwise inexperienced user. MarioGom (talk) 15:34, 23 February 2024 (UTC)[reply]

Also note the overlap at Moza bint Nasser. MarioGom (talk) 15:40, 23 February 2024 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • Separately  Confirmed to each other:
  • Nominally  Inconclusive but the cave paint looks similar:

I'll block and request a lock for the unblocked accounts. Closing. Thanks, Spicy (talk) 18:12, 23 February 2024 (UTC)[reply]

18 March 2024

Suspected sockpuppets

The username and topic area are an all-but-certain link to a previous sock, Iamjosemom (talk · contribs · deleted contribs · logs · filter log · block user · block log). Sable232 (talk) 21:27, 18 March 2024 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • Blocked, tagged, global lock requested, closing. Bbb23 (talk) 00:55, 19 March 2024 (UTC)[reply]
  • Not sure what went wrong, but the block and tag didn't go through, although the global lock request did, so I'm blocking and tagging (again). Bbb23 (talk) 00:58, 19 March 2024 (UTC)[reply]
  • Bbb23, I was looking at this just as you blocked. This sockmaster is known to compromise accounts, and if you look at Iamjosemom's contributions, the abrupt switch from cars to Qatar politics strongly suggests this possibility. They also claimed to be compromised on UTRS in a manner that seems sincere to me. From a technical perspective, Iamjosemon's data is consistent with the data for Iamjosemom prior to February, i.e., prior to the likely compromise of the account. I don't believe this account is being operated by the sockmaster. Spicy (talk) 01:14, 19 March 2024 (UTC)[reply]
  • To be clear, I think that Iamjosemom was compromised by the sockmaster, and Iamjosemon is an account created by the original operator of that account, prior to the compromise. I see it's now been locked but hopefully this is taken into account if they appeal. Spicy (talk) 01:04, 20 March 2024 (UTC)[reply]

1 May 2024

Suspected sockpuppets

See below. Moneytrees🏝️(Talk) 03:38, 1 May 2024 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

03 June 2024

Suspected sockpuppets

Indicates similar edit patterns to volleyball related articles. 98𝚃𝙸𝙶𝙴𝚁𝙸𝚄𝚂 • [𝚃𝙰𝙻𝙺] 13:19, 3 June 2024 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  •  Clerk assistance requested: - Please move to Wikipedia:Sockpuppet investigations/TronFactor. Bbb23 (talk) 14:02, 3 June 2024 (UTC)[reply]
  • Merge done. Please note that many of the accounts in this SPI are compromised, so behavioural evidence needs to be interpreted with care. In this case, the Qatar-related edits by Cococ2001 were likely carried out by the sockmaster after compromising the account, but the volleyball edits were probably performed by the original operator of the account, i.e. not the actual target of the block. So it's debatable whether the edits from this IP, if we assume they are the same person, should be treated as block evasion. Spicy (talk) 16:58, 8 June 2024 (UTC)[reply]
  • IP seems inactive now, likely rotated. Not much point in blocking at this point even if it was evasion. Closing case. The WordsmithTalk to me 04:39, 12 July 2024 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/TronFactor/Archive&oldid=1234197557"
Uses material from the Wikipedia article Wikipedia:Sockpuppet investigations/TronFactor/Archive, released under the CC BY-SA 4.0 license.