Liborbital

Liborbital (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

15 August 2017

Suspected sockpuppets

Zuckerden is a semi-disclosed paid editor [1]. In the last week, HelgaStick has !voted keep at two AFDs of articles created by Zuckerden: [2] [3] and also removed a PROD: [4]. These are almost the only deletions that the user has been involved in, so it seems very unlikely to have occurred by chance.

This page move by Zuckerden of a draft also looks as suspicious and as if the MemeGeen was created as a sock but then the page was accidentally moved by Zuckerden. SmartSE (talk) 18:22, 15 August 2017 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

I found the way that Zuckerden and MemeGeen were supporting each other to be suspicious, and particularly deceptive if they're related accounts, so I set out to just check those accounts alone and give HelgaStick the benefit of the doubt. Sadly, I stumbled upon something else in the process.  Confirmed that the following accounts are related:

Given that one of the accounts has a paid editing disclosure, I think this user has not behaved egregiously, but it's getting very close to that. I'd be inclined not to block them, but to warn them to stick to two accounts, one for personal contributions and one for paid editing, and abandon the other accounts. I'll let the closing administrator decide on that. --Deskana (talk) 11:23, 18 August 2017 (UTC)[reply]

  • Using multiple accounts for undisclosed paid editing and also to try and avoid articles being deleted is extremely egregious behaviour. I am indeffing them all. SmartSE (talk) 12:13, 18 August 2017 (UTC)[reply]

This case is being reviewed by Sro23 as part of the clerk training process. Please allow them to process the entire case without interference, and pose any questions or concerns either on their Talk page or on this page if more appropriate.

19 August 2017

Suspected sockpuppets


2 accounts involved at a clear paid-for article and their contributions both involve adding advertising, here and here therefore chances they are either one person or otherwise still involved. SwisterTwister talk 04:14, 19 August 2017 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

23 September 2017

Suspected sockpuppets


Tarja Kardash, with a short contribution history started this month, restored the content originally added by the sockmaster Liborbital to the article Eric D. Goodman and added wikilinks to that article in several other articles (Goodman's high school, etc.). The activity strongly suggests a undisclosed paid editor. ~Anachronist (talk) 00:19, 23 September 2017 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

14 October 2017

Suspected sockpuppets


Mfarazbaig first edits indicate they are not a new account.[7][8] They than removed the paid editing tag on this article.[9] which was created by one of the prior socks in this edit.[10] Many of Mf's other edits are obviously paid aswell. Doc James (talk · contribs · email) 14:13, 14 October 2017 (UTC) Doc James (talk · contribs · email) 14:13, 14 October 2017 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

Red X Unrelated to the master but  Likely to RetroHunk (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). Also, there is IP socking done by Mfarazbaig to edit war which caused page protections. Mfarazbaig is also fond of open proxies.
 — Berean Hunter (talk) 00:23, 15 October 2017 (UTC)[reply]

The first uploaded images used in Dom Marcell and also drafted the article. The second also drafted that article in their sandbox.
This user is also suspicious - they added a photo to Mary Cruz that was uploaded by a different user on commons the day before. SmartSE (talk) 07:51, 16 October 2017 (UTC)[reply]
  • Thanks. Orange U-turn doesn't look like a paid editor but behaviourally matches MeemSupreem.  Blocked but awaiting tags
  • Kindadella doesn't much like UPE either apart from the image addition I noted above and behavioually looks quite different to MeemSupreem.
  • Despite the lack of technical evidence, Joe Gurstein and Bcarere are clearly related to RetroHunk via Dom Marcell.  Blocked but awaiting tags SmartSE (talk) 20:54, 16 October 2017 (UTC)[reply]

From several busy ranges:

  • Zalam4u edits where clearly refspam (I've reverted).  Blocked but awaiting tags
  • Some of Albert Dawkins' edits are clearly UPE e.g. Samir Tabar and Pixhug. { Blocked but awaiting tags
  • Boiseldas hasn't made any edits but given the technical evidence  Blocked but awaiting tags
  • Olavhenri  Blocked and tagged fits UPE and Rob Shanahan is already tagged as COI/UPE by @Bilby and Rentier:. That article was previously created by  Stale Jcpc63752
  • CoolbreezeCalmwaves looks ok to me.
  • Jdsak made edits to Moeen Nizami working closely with Taha7867382 and F2016119046. That article has some signs of COI.
  • Atif.s.awan created User:Atif.s.awan/sandbox which could be COI, but off-wiki info suggests that it is unlikely that they are related to this sockfarm.
  • Nauman147 is another refspammer (reverted).  Blocked but awaiting tags
  • Atiqnagra looks ok. Only edits are about a deceased actor
  • Dudacastro created what appeared to be an autobio at Duda Castro but was also created by Razziaftab and Umersharif905 a few days beforehand. That doesn't look professional and presumably they used a proxy afterWikipedia:Sockpuppet_investigations/Razziaftab/Archive.
  • Jiskani Baloch doesn't look like UPE.
  • The Shoaibmanzoor accounts haven't made any edits.
  • Mian shahzad hasn't edited but SerialAgent was blocked for refspamming.  Blocked but awaiting tags
  • Concur about KylieTastics. Blocked per the username policy SmartSE (talk) 22:20, 16 October 2017 (UTC)[reply]
  • I'm happy to keep all of the UPE accounts listed under Liborbital as they match behaviourally. SmartSE (talk) 22:28, 16 October 2017 (UTC)[reply]
Hmmm..I think CoolbreezeCalmwaves may be more promotional than their userpage implies:
What do you think?
 — Berean Hunter (talk) 00:55, 17 October 2017 (UTC)[reply]
Yes I agree based on that analysis. So  Blocked but awaiting tags
Looking through those I noticed this edit to the CEO of Tasting Table followed up a few months later by these edits by Prof.Marlin (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki). Their article creations also seem to fit the UPE bill especially Mark Moses (CEO Coach). SmartSE (talk) 20:01, 17 October 2017 (UTC)[reply]
  • @Berean Hunter: Woops sorry about that. So should they all be tagged as only suspected to this master considering the lack of direct technical evidence? Boiseldas is now blocked - it was getting late! Are there any good tools for blocking and tagging? I use twinkle sometimes but it is quite clunky and slow still. (I did have a look at you .js but couldn't find any). SmartSE (talk) 20:01, 17 October 2017 (UTC)[reply]
  • @Smartse: the one that would be tagged to the master as confirmed would be Orange U-turn. Any others that are confirmed would be tagged to the accounts that they were confirmed to...each other. The clerks that action this case should help sort it. Did you look here? I don't use the monobook skin. There are a few in there that might help but the clerk script has a couple of buttons that you shouldn't push like endorsing a CU request. You should consider these:
  • Mark-blocked script.js
  • spihelper.js
  • massblock.js
  • For the last two, I believe you would need to discuss with Timotheus Canens. I'm not sure if anyone outside of clerks and CUs are using this.
  • ...and these two lines which could be useful to you,
  • maxUsersCUStaleness = 100;
  • mw.loader.load("/w/index.php?title=User:Writ Keeper/Scripts/cuStaleness.js&action=raw&ctype=text/javascript");
     — Berean Hunter (talk) 21:08, 17 October 2017 (UTC)[reply]
  • @Berean Hunter: Did you notice my request RE Prof.Marlin above? I've removed the tags now and will leave it to the clerks although the following that I listed at COIN should help.
These are all connected either technically or behaviourally to each other and via Tarja Kardash to the master.
There aren't any direct links that I can see between those and these though, which themselves are linked technically or behaviourally and to the master via Mfarazbaig
SmartSE (talk) 23:22, 19 October 2017 (UTC)[reply]

24 October 2017

Suspected sockpuppets

Since getting blocked on Mfarazbaig, he is socking with IP. Restored an edit[19] originally by Mfarazbaig[20], edit warring on 2016–17 Kashmir unrest,[21][22] Mfarazbaig had added Pakistan WP banner on Talk:Indian mathematics[23] and IP removed WP India banner on a related article Mathematics article Talk:Bakhshali_manuscript.[24] Removing material that concerns Pakistan on Persecution of Hindus[25][26] like Mfarazbaig.[27][28] Capitals00 (talk) 08:08, 24 October 2017 (UTC)[reply]

@Berean Hunter: had said that Mfarazbaig has used IP to edit war.[29] Seems like I have found the IP address and upon further investigation, this new edit by IP[30] is clear copy of Mfarazbaig's edit.[31] WP:DUCK.

Mfarazbaig: "unreliable defence.pk reference"[32]
45.116.233.7: "defence.pk is an online forum. Fails WP:RS"[33] Capitals00 (talk) 08:19, 24 October 2017 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

31 October 2017

Suspected sockpuppets

[35][36][37] Obviously a WP:DUCK. Since Mfarazbaig is using a different ISP now,[38] please range block this as well. Thanks, —MBlaze Lightning T 11:54, 31 October 2017 (UTC)[reply]

Pinging @Berean Hunter: —MBlaze Lightning T 11:54, 31 October 2017 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

15 November 2017

Suspected sockpuppets

Created Peach & Lily (beauty brand) a recreation of Special:Undelete/Peach & Lily that was created by  Stale Jcpc63752. Tarja Kardash !voted in a recent AFD about Peach & Lily's founder. SmartSE (talk) 19:56, 15 November 2017 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

@Smartse::--Tarja is already blocked as a sock-puppet of this very farm about a month ago.Are you sure about putting him in the suspected list?Regards:)Winged Blades Godric 06:20, 22 November 2017 (UTC)[reply]
@Winged Blades of Godric: IIRC tarja wasn't confirmed to the master and nobody has resolved how this should be split up. I listed them again here as the CU should compare tarja to the newer account. SmartSE (talk) 14:07, 22 November 2017 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

30 November 2017

Suspected sockpuppets


New account, that restored[39] originally composed by Mfarazbaig.[40] Capitals00 (talk) 10:22, 30 November 2017 (UTC)[reply]

@GeneralizationsAreBad: This is a WP:DUCK case. Max Cooper is abusing the IP 39.50.205.191 to edit war with @Adamgerber80: on dozens of articles. Same was done by Mfarazbaig. That he went to edit war with his IP[41] to put his edits back[42] and his IP, and used same[43] edit summary as Max Cooper.[44]

Abuse of IP (39.50.205.191) by Max Cooper:-

Mfarazbaig was also obsessed with putting WikiProject Pakistan on talk pages.[53](edit summary: WP Pakistan) while the IP's edit summary is: WP:PAK[54] Capitals00 (talk) 12:53, 4 December 2017 (UTC)[reply]

Disruption from this account is still widespread[55][56][57] and GeneralizationsAreBad is away till 20 December. @Smartse: can you block this account instead? Capitals00 (talk) 10:52, 10 December 2017 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Plus, the suspected sock has the same habit of undoing an edit without using the default undo message.[65][66][67] —MBL Talk 05:55, 11 December 2017 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

08 January 2018

Suspected sockpuppets

Has similar edits to sock Albert Dawkins on the Pakistani passport page. Also, continues to undo edits without a pro Pakistani tilt as other socks like Max Cooper and Mfarazbaig Adamgerber80 (talk) 16:08, 8 January 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

18 January 2018

Suspected sockpuppets

Same edits as Max Cooper of adding other scripts and removing Hindi scripts. The diff of the edits are here [68],[69]. Adamgerber80 (talk) 11:11, 18 January 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

10 February 2018

Suspected sockpuppets

Same IP frequently being abused by Mfarazbaig. Edits are [70][71] same as those made by Mfarazbaig with his IP, for removing mention of India.[72]

Similar interest in opinions of Pervez Hoodbhoy.[73][74] D4iNa4 (talk) 18:50, 10 February 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

21 February 2018

Suspected sockpuppets

Same as previous IPs. Disrupted a template [75] recently that was previously edited by one of the sock account.[76] D4iNa4 (talk) 15:12, 21 February 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

02 March 2018

Suspected sockpuppets

[77][78] Still evading his block. —MBL talk 05:55, 2 March 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

05 March 2018

Suspected sockpuppets

Same IP as usual. Calling others edits a vandalism [79][80] when requesting page protection. Interest in antisemitism in Pakistan.[81][82] Capitals00 (talk) 08:27, 5 March 2018 (UTC)[reply]

Now socking with [83] like previous IPs.[84][85] Capitals00 (talk) 08:01, 7 March 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Now socking as 39.48.235.240 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log). —MBL talk 07:10, 6 March 2018 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

19 March 2018

Suspected sockpuppets

Now socking on 2018 Sukma attack (edit | talk | history | links | watch | logs). —MBL talk 05:31, 19 March 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


24 March 2018

Suspected sockpuppets

Same obsession of opposing/supporting attack-related articles for news,[88][89][90][91] created 2018 Sukma attack[92] and now raises an issue related to this article on ANI.[93] D4iNa4 (talk) 11:30, 24 March 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

IP edits too old. Closing.--Bbb23 (talk) 13:24, 27 March 2018 (UTC)[reply]

23 April 2018

Suspected sockpuppets

@Berean Hunter and Smartse: This account came out of nowhere to engage in edit war on Insurgency in Balochistan.[94] It looks like a sock of Mfarazbaig.

Same style of adding sources.[95][96]

Obsessing over Wikipedia talk:In the news/Recurring items[97][98] concerning sports and also articles about incidents in India,[99][100] and then trying to get these incidents-related articles passed on Wikipedia:In the news/Candidates.[101][102] Capitals00 (talk) 09:36, 23 April 2018 (UTC)[reply]

Has shown his opposition against "T20" cricket on WP:ITN,[103] like Mfarazbaig.[104]

Mfarazbaig's sock Albert Dawkins: "get consensus before addition" [112]

Similar votes in WP:ITN/C:

File complaint against multiple editors in ANI after failing to get his version accepted.[116][117] Capitals00 (talk) 13:22, 26 April 2018 (UTC)[reply]

"Support as a updater. It received global news coverage. --Uncle Sargam (talk) 08:42, 7 April 2018 (UTC)"[119]

Clear WP:DUCK. Capitals00 (talk) 17:26, 27 April 2018 (UTC)[reply]

The SPI has already become stale and the disruption continues. @Ponyo, Doc James, and MER-C: any of you are still active on this SPI? Capitals00 (talk) 14:12, 10 May 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Bbb23, for the record, Berean Hunter ran a check on Mfarazbaig on 5 March,[126] so I don't think this could be stale. In any case, this is pretty much an open-and-shut case. Not long ago, Mfarazbaig had reported Capitals00, me, D4iNa4 and Adamgerber80 at WP:ANI for reverting his edits on 2018 Sukma attack (edit | talk | history | links | watch | logs), an article that he created, via an IP address, 58.27.134.33 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log), alleging that we were acting in "collusion".[127] Now this new sock filed a frivolous complaint at WP:ANI against Capitals00, me and Raymond3023 for "edit warring" on Insurgency in Balochistan, saying "These editors seem to gang up and censor anything they dont like by reverting contributions made by others. There definitely is a pattern that seems fishy."[128]
Also note that Uncle Sargam puts two dashes in a row (--) before signing his comment, just like the master and past confirmed socks.[129][130] MBlaze Lightning talk 02:02, 25 April 2018 (UTC)[reply]
I can point out many editors who insert two dashes before their signatures. Just one look at my recent interactions reveal that Bbb23 and NadirAli insert two dashes before their signatures and there are many many other editors who do that. That is again the type of evidence, I call trivial. Sheriff | ☎ 911 | 13:18, 25 April 2018 (UTC)[reply]
Arent the two dashes inserted by default?? Unless you force a hyphen or something else in your signature, the default signature carries two dashes.—TripWire________ʞlɐʇ 13:41, 25 April 2018 (UTC)[reply]
  1. Summary terms such as “ref added”, “ref fix”, “cleanup” and “no source” are universal terms and used by many editors
  2. The other evidence regarding asking for consensus is trivial as well, I ask for the consensus all the time and many other editors do as well
  3. Votes presented as similar are not similar at all, they are for completely different pages with different topics so there are two differentiating factors in there, one being a different page, second being different topic, for example, here are the links given by filer as evidence (I just added the page titles for clarity): Uncle Sargam (April 2018 caste protests in India), Mfarazbaig (Monarch Airlines)
  4. Filing complaints on ANI is not a smoking gun either, done by many, as a matter of fact, there are 10-20 complaints open at ANI every day. Sheriff | ☎ 911 | 16:05, 26 April 2018 (UTC)[reply]

(a) "Same style of adding sources." - I see that Mfarazbaig would even put square brackets within refs to link news sources which I don't. e.g. [138] [139] [140]

(b) "Obsessing over Wikipedia talk:In the news/Recurring items concerning sports and also articles about incidents in India" - According to filer I have an obsession over ITNR concerning sports but I don't see myself commenting on a Suggestion to add: Other multi-national Olympic-style sporting events, which was up there during the same time. And the suggestion of me having obsession over "incidents in India" is trivial. It seems the filer is going to accuse anyone editing articles about "incidents in India".

(c) "Has shown his opposition against "T20" cricket on WP:ITN" - This accusation is as dumb as it gets. Fact is I opposed the Proposed Addition: Domestic Football Leagues.

(d) "cleanup" - My edit summary was cleanup while Mfarazbaig's was Cleanup. with a capital C and a full stop.

(e) "no source" - My summary is no source. Mfarazbaig's is WP:OR, no source. Again the usage of full stop.

This investigation was filed on lies and deceit. And if any admin is taking any of this seriously, tag me here so I can debunk the rest. --Uncle Sargam (talk) 05:56, 11 May 2018 (UTC)[reply]

@Bbb23: It seems to me that the evidence is too strong for the report to be closed as no action. The account is continuously engaging in a pattern of disruptive editing that is same as the master. --1990'sguy (talk) 18:25, 19 May 2018 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

28 April 2018

Suspected sockpuppets

Adding these to the archive. I was notified of this at WT:ITN with this edit. – Muboshgu (talk) 05:58, 28 April 2018 (UTC) – Muboshgu (talk) 05:58, 28 April 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

Closing.--Bbb23 (talk) 07:00, 28 April 2018 (UTC)[reply]

22 May 2018

Suspected sockpuppets


Much evidence against Uncle Sargam being associated with this sock farm had been already added here earlier, (archive) hence I am not going to rehash it.

Similarities in the selection of their usernames speaks volumes. Uncle and Auntie are both terms used for defining second-degree relatives. Other than this, "Uncle Sargam" and "Auntie Agni" are names of two different Pakistani characters.

Same isolated votes on AfD of 2016 Indian Line of Control strike. Both wants article to be "Redirect" or "merge" with both citing "WP:CFORK" and "WP:POVFORK".[141][142]

Contributions on WP:ITN about the incidents involving fatalities are same,[143][144][145] as well as Pakistani individuals,[146] like recently blocked sock IP of the sockmaster.[147] 1990'sguy (talk) 23:50, 22 May 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

Uncle Sargam and Auntie Agni are  Technically indistinguishable from each other. Blocked without tags.--Bbb23 (talk) 00:53, 23 May 2018 (UTC)[reply]

03 July 2018

Suspected sockpuppets


Created hardly 14 days ago and shows same traits as Mfarazbaig.

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • I'm changing my finding. I ran a check against this user on June 20, and I stupidly neglected to update the check now before posting the above finding. Based on the updated check, I understand why you found it  Inconclusive, but personally I would find it a bit better than  Unlikely. Two of the user agents, as far as I know (and I go way back on this case), have never been used before, and the other is so common I have trouble hanging my hat on it even when it matches another user.--Bbb23 (talk) 22:54, 7 July 2018 (UTC)[reply]
Yeah. To summarise, I think the outcome of our investigation is that checkuser can neither prove nor disprove this allegation. --Deskana (talk) 15:54, 8 July 2018 (UTC)[reply]
@MBlaze Lightning: as a courtesy, I'm providing you the definition of "inconclusive" from Wiktionary: Not conclusive, not leading to a conclusion. Your interpretation of this as "possible" (for which checkusers have a different ((possible)) flag available) is wrong: there simply can be no conclusion made. That's what it means.
I have to agree with the checkusers here, the behavioural evidence presented does not conclusively demonstrate a connection, and technical results are of no help. Closing with no action. Ivanvector (Talk/Edits) 18:26, 14 August 2018 (UTC)[reply]

21 July 2018

Suspected sockpuppets

Alleges people of socking or meat puppetry [160][161] like months ago he did.[162][163]

Son of Kolachi jumped to restore edits of above IPs.[164][165] Mfarazbaig and Son of Kolachi edit wars and tells others to "raise them on talk page"[166] or "take it to the talkpage"[167]

Notify @Accesscrawl and DBigXray: so that they can familiarize themselves. Sdmarathe (talk) 20:52, 21 July 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Thanks I know now that those IPs are socks. As already in above SPI, the use of dawn.com as a source and writing the reference similarly is clearly WP:DUCK:
((cite news |title=Court hands life sentence to PML-N's Hanif Abbasi in ephedrine quota case |url=https://www.dawn.com/news/1421583/court-hands-life-sentence-to-pml-ns-hanif-abbasi-in-ephedrine-quota-case |accessdate=21 July 2018 |work=Dawn |date=21 July 2018)) [169]
((cite news|title=Ajoka Theatre's Madeeha Gauhar passes away|url=https://images.dawn.com/news/1179932|accessdate=25 April 2018|work=Dawn|date=25 April 2018)) [170]
Clearly not a new editor, account is being used to evade scrutiny and edit war, a block for this disruption is justified. Accesscrawl (talk) 06:32, 22 July 2018 (UTC)[reply]
  • This looks like a lure. I have no doubt after that report that Son of Kolachi is a bad hand account. Accesscrawl (talk) 09:23, 22 July 2018 (UTC)[reply]
  • Yes. name itself Quacks.
  • Kolachi is old name for Karachi. where these IPs geolocate to. Liborbital and Mfarazbaig used IPs from the same location. The IP range is similar.
  • IPs throws allegations of Sock / meat[171] explained by the Filer above.
  • He may be using proxy or may be we are looking at meat puppets--DBigXray 11:30, 22 July 2018 (UTC)[reply]
  • Hello can an admin take a look at the behavioral evidence that i placed above after the CU response. this is clearly an old timer based on his coments and edit summaries. --DBigXray 21:21, 2 August 2018 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

Red X Unrelated. no No comment with respect to IP address(es).--Bbb23 (talk) 00:22, 22 July 2018 (UTC)[reply]

24 July 2018

Suspected sockpuppets

This IP popped up at WP:ITN/C today to make a nomination regarding the Pakistani general election (diff). The ITN edits are a dead giveaway, given the master's addiction to ITN/C (1, 2, 3 4), which is no secret. It is also the same IP that asked SheriffIsInTown to make edits for him in March,[172] since he finds the said user to be loyal to him. Finally, the IP geolocate to the same location and is in the same range as previously blocked IPs (e.g., see #24_October_2017) The quacking is loud enough, in my opinion, to block the IP. MBlaze Lightning talk 15:14, 24 July 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

The IP's edits are too old. Closing.--Bbb23 (talk) 15:47, 3 August 2018 (UTC)[reply]

12 October 2018

Suspected sockpuppets

These IPs popped up after User:Son of Kolachi was blocked yesterday. Trying to make disruption on atleast three BLPs - which I often edit - after I refused to entertain his request [173].. the listed IPs geolocate to the same location and is in the same range as previously blocked IPs.

Berean Hunter blocked 2 ranges of this sockfarm very recently (122.8.0.0/16 and 39.57.128.0/17) this could be the reason why this sock has now has switched to a new range. Saqib (talk) 14:16, 12 October 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

25 October 2018

Suspected sockpuppets

39.38.37.97 (talk · contribs · WHOIS) created Shahid Shafaat (who is also blocked for block evasion) and 122.8.37.164 (talk · contribs · WHOIS) continues to remove g5 tagging. Both ips are in the same range as past blocked (ranges and individual ips) of Liborbital. Praxidicae (talk) 14:43, 25 October 2018 (UTC)[reply]

See also this hilarious claim they "know this ip". Praxidicae (talk) 14:44, 25 October 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

30 October 2018

Suspected sockpuppets

This IP in the same range as past blocked of Liborbital and co. Requesting undeletion of BLPs Wikipedia:Requests_for_undeletion#Sana_Sarfaraz and edit warring at Sana Sarfaraz. Saqib (talk) 05:54, 30 October 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments


04 November 2018

Suspected sockpuppets

Had been blocked before too by Bbb23. Same geolocation as all other recently blocked IP addresses. Criticizes reading ability of others during edit war.[174][175] Contributions on ITN,[176] like other blocked IPs, [177] and accounts[178][179] sounds same. Also check the edits from March 2018,[180] when he was using his other recently blocked range (39.48..) to restore edits of this reported IP (58.27.134.133).[181] Capitals00 (talk) 17:59, 4 November 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

21 November 2018

Suspected sockpuppets

Created hardly a week ago and shows same traits as Mfarazbaig. Saqib (talk) 18:29, 21 November 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

Mahzain is very  Likely to Son of Kolachi (talk · contribs · count). Blocked, tagged, closing.--Bbb23 (talk) 22:44, 21 November 2018 (UTC)[reply]

01 December 2018

Suspected sockpuppets

Same geolocation as all other recently blocked IP addresses and shows same traits as Liborbital. Edit warring and creating BLPs on non-notable person.Saqib (talk) 08:05, 1 December 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

09 December 2018

Suspected sockpuppets

Shows same traits Liborbital.. Hardly a month old account with 50 or so edit yet interest in "In the news", and request for undeletion. Saqib (talk) 08:30, 9 December 2018 (UTC)[reply]

As @D4iNa4: noted here, Liborbital & co. has "obsession of opposing/supporting attack-related articles for news" - [182]. Liborbital's socks often make undeletion request [183] - which is not normal for a newbie. [184].
And now The Donkey King has began participating in AfD's [185], [186]. Only an experienced user would do this [187] [188]. --Saqib (talk) 10:25, 10 December 2018 (UTC)[reply]
@DeltaQuad: See above. --Saqib (talk) 15:36, 12 December 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

10 January 2019

Suspected sockpuppets


Registered after the last sock had been blocked. Updated the article[189] created by Son of Kolachi.[190] Restored content[191] which was added by Mfarazbaig.[192] D4iNa4 (talk) 17:01, 10 January 2019 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

 Confirmed to previous socks.  Blocked without tags. Closing.--Bbb23 (talk) 18:53, 12 January 2019 (UTC)[reply]

07 February 2019

Suspected sockpuppets

Registered after the last sock had been blocked. Shows same traits sa Liborbital.. following my contributions (hounding) and editing my drafts [193] Saqib (talk) 15:35, 7 February 2019 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Saqib Hey bro, i guess there has been a confusion. I recently saw your contribution and got impressed with number of article you have written. That's why i intended to assist you in a draft over 'Jehan Ara'. In case if you feel, i should have assisted with some protocol, do let me know, i am always ready to learn. when in doubt, i ask (talk) 09:07, 8 February 2019 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

Credauth and Mike Foxtrot Bravo (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) are  Likely to the master.
 — Berean Hunter (talk) 13:29, 8 February 2019 (UTC)[reply]

Add Born in Riyadh (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) to the  Confirmed list.
 — Berean Hunter (talk) 21:29, 8 February 2019 (UTC)[reply]

21 February 2019

Suspected sockpuppets


Makes "new article" on Indian and Pakistan news events [194][195][196] and appears active on Portal:Current events.[197][198] ML talk 09:01, 21 February 2019 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

 Confirmed, blocked, tagged, closing.--Bbb23 (talk) 13:36, 21 February 2019 (UTC)[reply]

08 March 2019

Suspected sockpuppets

Showing same traits as Liborbital.. adding OR to Pakistani bios despite warning. Saqib (talk) 12:31, 8 March 2019 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

This case is being reviewed by Cabayi as part of the clerk training process. Please allow Cabayi to process the entire case without interference, and pose any questions or concerns either on Cabayi's Talk page or on this page if more appropriate.

Blocking random stale IPs on a mobile phone network isn't going to be productive. Nothing to be done. Closing. Cabayi (talk) 09:24, 11 March 2019 (UTC)[reply]

29 November 2019

Suspected sockpuppets

New user with same sort of obsession with ITN[199][200], Quetta Gladiators,[201][202] updates on Mohammad Asif (snooker player).[203][204]

Using the named IP to evade 3RR.[205][206] D4iNa4 (talk) 03:31, 29 November 2019 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

23 January 2020

Suspected sockpuppets


New user, reactivated after Bigfoot Yeti got blocked as a sock with same sort of obsession with ITN,[207][208] Naseem Shah,[209][210] Template:Terrorist attacks in Pakistan.[211][212] D4iNa4 (talk) 04:34, 23 January 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

01 February 2020

Suspected sockpuppets

The user is editing on the same pages with similar agenda. Störm (talk) 14:10, 1 February 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

05 February 2020

Suspected sockpuppets

Reinstated content previously created by the former sock Credauth (talk · contribs · deleted contribs · logs · filter log · block user · block log).

Edit warred with Harshil169.

Pinging DBigXray for any additional comments. Kautilya3 (talk) 22:14, 5 February 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

22 June 2020

Suspected sockpuppets


Same dawn.com spam[213][214] like all other socks in the archive,[215][216] and the usual habit of WP:STONEWALLING by reverting on a page he hasn't even edited before.[217][218][219][220] Azuredivay (talk) 01:09, 22 June 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

30 June 2020

Suspected sockpuppets


Same spam of dawn.com[221][222] edits about recent pakistani affairs,[223][224] and attempting to create anti-indian pages/redirects.[225][226] Azuredivay (talk) 17:09, 30 June 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

01 July 2020

Suspected sockpuppets

IP socking by the sockpuppeteer. Exact same disruptive addition of content [despite explained removals by multiple users] with the same meaningless edit summaries (update, restore). Master, IP1, IP2, IP3 (same edits or edit summaries); Master, IP1 (same edit summaries); Master, IP4 (similar edits); IP2, IP5 (exact same edits); IP6, IP7 (same edit summaries). Clearly not a case of mistaken logout sine the IPs have been working in tandem with the main sockpuppeteer and each other on multiple articles.

And clearly not a new inexperienced account either: has created Talk pages, with WP projects to boot, edited templates and created dubious disamb pages. Might be a sock of another master (the range has been used by at-least one other LTA abuser in the past WP:LTA/SAMI). Gotitbro (talk) 03:00, 1 July 2020 (UTC)[reply]

Added other IPs who have similar editing patterns or edited the same articles as the master. Gotitbro (talk) 03:17, 1 July 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments


01 July 2020

Suspected sockpuppets

Exact same reinsertion of content as by previous socks and IPs. Prev sock, Current sock; Prev sock, IP sock, current sock.

Also tagged as likely in the previous checkuser. Gotitbro (talk) 19:02, 1 July 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

01 July 2020

Suspected sockpuppets

Exact same reinsertion of content as previous IP socks in the same range. Prev IP1, Current IP; Prev IP2, Current IP.

@Mz7: we need a larger range block here, the socking is getting ridiculous here. Gotitbro (talk) 21:25, 1 July 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

11 August 2020

Suspected sockpuppets

Admits on his userpage that he is using multiple accounts but has not named any accounts.[227] See WP:SCRUTINY.

Came back after the last 2 week range block was made on him. Made his first main page edit to conflict with Gotitbro (who reported him most in the recent times),[228] then started edit warring him across many articles.[229][230][231] Aman Kumar Goel (Talk) 06:33, 11 August 2020 (UTC)[reply]

@Callanecc: are you around? Aman Kumar Goel (Talk) 06:33, 16 August 2020 (UTC)[reply]

Comment I used to have a previous account, but I am not him. It's a clean start that's why i do not want to declare anything previous. But I want to declare that my previous account was not under any scrutiny, sanctions or block. Consider WP:AGF, that's all i have to say. Islam Treasure66 (talk) 07:24, 16 August 2020 (UTC)[reply]

Comment. The filer has failed to "explain how the accounts are being used abusively". Moreover, the comparisons made are merely superficial & hilarious at best. Please note that my account is active since May 2019 and I use it from multiple locations. --Invisible Lad (talk) 16:19, 17 August 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

PS, if confirmed, this would be the new master. -- RoySmith (talk) 16:29, 11 August 2020 (UTC)[reply]

20 September 2020

Suspected sockpuppets


Abusing this range once again just like he did weeks ago.[236] Wareon (talk) 16:11, 20 September 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

06 October 2020

Suspected sockpuppets


Same misleading and dodgy edit summaries for restoring problematic articles:[237][238]

Alleging same opponents of edit warring while himself avoiding any use of talk page:[239][240] Wareon (talk) 09:50, 6 October 2020 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

22 August 2021

Suspected sockpuppets


Same interests as earlier socks,[241][242], [243][244], [245][246] dawn.com use,[247][248] comes back to create/update page about a recent terrorist attack in Pakistan.[249][250] Aman Kumar Goel (Talk) 17:43, 22 August 2021 (UTC)[reply]

@RoySmith: I think possible certainly means more than just same location and ISP. I have more evidence but I would rather wait more. Let me know if it would be alright to re-file should more evidence emerge. Aman Kumar Goel (Talk) 01:35, 7 September 2021 (UTC)[reply]
If you've got additional evidence, you could just add it to this report if you get there before it is archived. If you need a little time, let me know and I'll place this on hold. Or, if you prefer to wait and gather better evidence, you can certainly just file a new report at some future date. -- RoySmith (talk) 01:58, 7 September 2021 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

09 April 2023

Suspected sockpuppets

@Callanecc and RoySmith: Same obsession with:-

 Looks like a duck to me. Capitals00 (talk) 07:06, 9 April 2023 (UTC)[reply]

@RoySmith: This sock has only 135 edits. His another tendency is to create articles on latest tragedies or riots in Indian and Pakistan,[262][263] [264][265][266] and cites "LONGQUOTE".[267][268] [269] May I know if this behavioral evidence is enough for block? Capitals00 (talk) 16:07, 9 April 2023 (UTC)[reply]
@Capitals00 I'm going to leave this for somebody else to take a look at. The problem is, the sorts of things you're describing are popular editing topics for a lot of people, so it's easy to misidentify socks in this area. -- RoySmith (talk) 16:28, 9 April 2023 (UTC)[reply]

Alright. Some more striking similarities:-

@RoySmith: That depends. Another SPI I filed today had swift action.[278] I edited this SPI after nearly a week today because things are getting worse and this sock is doing his best to influence consensus discussions that have time limit. Capitals00 (talk) 14:23, 18 April 2023 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
Global ongoing events can be of interest to many editors. The major earthquake in Turkey was a recent tragedy. While, Abrar Ahmed recently made a debut in cricket (the most popular sport in South Asia). Similarly Sudan conflict is ongoing military event. Apart from that there are other editors who have restored the same content or "voted" on both the discussions. These recent filings are just another attempt of HARASSING editors who disagree with you. SPIs shouldn't be used for FISHING. War Wounded (talk) 15:11, 21 April 2023 (UTC)[reply]
How you found this SPI given we never interacted? Why you are acting like all other socks of this SPI?[291] Capitals00 (talk) 15:40, 21 April 2023 (UTC)[reply]
The same way you filed the SPI superficially even without any interaction. P.S. It is no rocket science to know this, when you link someone's account, they will get a ping notification. Now, explain your position. War Wounded (talk) 17:34, 21 April 2023 (UTC)[reply]
No you don't get ping from that. I don't have to interact you to file SPI. Like all other previous socks, you learned about this SPI due to your own habit of keeping a watch here if someone has finally caught your new socks. Capitals00 (talk) 20:56, 21 April 2023 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

Ivanvector's analysis

This report and this case in general have a lot working against it. Some thoughts in no particular order:

  • The filers' behaviour hinders investigations here. There seems to be a tendency of SPI reports in this contentious topic to hold back some evidence to be disclosed only after some conclusions have already been stated, and that includes adding more accounts after a check has been run. This isn't helpful: if you're discovering more evidence after initial filing then do what you need to do, but if you have it and just aren't writing it here for some reason (to be dramatic? I don't know) you're just disrupting the process. Make your case and let the clerks evaluate it.
  • Consider forming your reports as though they're going to be reviewed based on behaviour alone; don't rely on checkuser to make your case for you. For one thing CU just isn't very helpful here (here as in this geographic region): the networks are astoundingly large and false technical connections are common, and geolocation is accurate to within about 2,000 kilometers (entirely unhelpful, in other words). If a clerk feels it would be helpful they will request it, but these reports tend to end up judged on behaviour anyway. Requesting CU also works against you because of the phenomenon that cases with a status of checked languish in the queue forever; that has been the topic of several discussions but it still happens.
  • There is another tendency of filers in this contentious topic to forumshop new accounts through multiple SPIs if the first doesn't result in a block. As a result there is a ton of confusion in our CU records about which account is whose sock, and there are numerous accounts blocked as "probably somebody's sock" who for one don't help with future investigations, and two are likely innocent.
  • That tendency, plus the tendency to blanket reports with late evidence, and the tendency of that evidence to be throwing mud at the wall to see what sticks, also leads to scope creep in the cases and obfuscates future behavioural analysis. Liborbital was originally a paid editing and refspamming case, back in 2017. I have notes from 2018-19 where I was comparing this case to Pakistanpedia, which was exclusively an edit-for-hire case (I didn't find any definitive connections and believe them to be separate, FTR). It evolved seemingly spontaneously in late 2017 into a case of ARBIPA POV pushing with no indication of paid editing at all - that's a wild swing in behaviour for any connections to have been made, but also leads to the situation now where the behavioural profile is too vague and generic to make any connections. As RoySmith aptly put it, "the sorts of things you're describing are popular editing topics for a lot of people". In the past I've referred to this as accusing two fish of sockpuppetry because of a common interest in water.
  • The swing I referred to above happened when a certain group of editors began filing reports here. I and several other clerks observed two groups of editors on either side of the ARBIPA-defined conflict working together to file retaliatory reports against their opponents; see the last archived report in Wikipedia:Sockpuppet investigations/Capitals00 for example (don't read into that case, there was never any finding). Some of them also sock-tagged the subjects of their reports themselves before any conclusions were formed, which led to more confusion down the road.
  • What we're left with here is checkuser data that is inconsistent, and a behavioural profile that any new user in India or Pakistan is likely to fit at least somewhat. In other words, what am I comparing this to?

That said, let's take a look at the evidence presented here:

  • New users tinkering with flags in infoboxes is not evidence of sockpuppetry; in fact it's strong evidence of a genuinely new user. You can click "recent changes" pretty well any time of any day and find at least one edit that is adding or removing flags from an infobox.
  • ITN nominations would be a good indicator if there was a trend in the nominations. Of these: two are significant events in cricket and one is a political event; they're also months apart. This case and related cases are physically located in a region that has been in political turmoil for hundreds of years, with a population of nearly 2 billion people, and cricket is an incredibly popular sport in the region. The likelihood of any two users having common political and sporting interests here is so high as to be expected. This doesn't demonstrate a connection.
  • "Kashmir Intifada": again, politics. These edits are six years apart but rely on the same sources - this is worth a closer look. It was added in Aug 2017 and stayed in the article largely unchanged for five years while the article continued to be edited by numerous editors I would consider experts in this topic, which suggests to me it was warranted and had consensus. It was removed by an editor who had no other edits to the page, and only removed the word, not the sources. When Oriental Aristocrat added it back six months later, a reasonable explanation is that they were correcting the lede to match the sources (which were sources for "intifada", while "insurgency" had and continues to have no sources inline), but they did not add the sources. All things considered I don't see this as evidence of socking.

On the evidence added later:

  • "Azad Kashmir": I think the filer is mistaken here. Oriental Aristocrat removed the Devanagari script, and called it "non-native" as the sock had in the past edit, but OA didn't do anything with the description of the region at all.
  • "New article" edit summary when creating an article: well, yes, that's what edit summaries are for. The fact that two of the articles are about current-at-the-time political events (both described as riots) is interesting, but there is a subtle difference in the edit summary despite being incredibly generic otherwise. The page about the public fountain isn't very useful in this analysis.
  • WP:IDONTLIKEIT in disputes with other users: so common as to be irrelevant, and OA used a different shortcut from the blocked sock anyway.

And on the comparison with War Wounded:

  • First of all, ((sock list)) calls ((checkuser)), which I'm fairly sure does generate a ping if you also sign the edit (I'll test this and report back). War Wounded coming to the page after being pinged wouldn't be surprising.
  • Turkey-Syria earthquake response: this is an article outside the ARPIPA scope; the two users added information to the same section a month apart, and both without an edit summary. Would two Pakistani editors both be interested in their country's response to a foreign disaster? Perhaps. The information they added was not similar, otherwise. They also formatted their refs differently and used opposite date formats, which could be intentional obfuscation, but we'll come back to that.
  • Abrar Ahmed (Pakistani cricketer): these edits were two days apart and added different categories, but the article was under rapid expansion at the time as the cricketer was in the news. Again, editors in this region with an interest in cricket are a dime a dozen - this is probably coincidence.
  • Insurgency in Khyber Pakhtunkhwa: these edits are the first that are really indicative of sockpuppetry, as Oriental Aristocrat appears to be directly restoring War Wounded's edit, and this time the date formats match. But, as Vanamonde observed when similar evidence was provided at Wikipedia:Sockpuppet investigations/Oriental Aristocrat, this article is a magnet for POV pushers, and these reverts are part of a slow-motion edit war that has been going on for a long time before either of these editors were involved.
  • Vote stacking: this is the first evidence that seems related to the Liborbital profile, prior to its scope being vaguely expanded to include basically everything. However, I don't see the evidence for vote-stacking in the Pakistani Taliban move discussion: there were numerous editors supporting the move. In the Hindu terrorism move review I see numerous editors on both sides who have probably been canvassed; I would suspect War Wounded of being related to one of the IPs, but I don't see the evidence of coordination with Oriental Aristocrat specifically. Numerous editors are making the same arguments on all sides of that discussion.
  • Ref and date formatting: I mentioned this in a comment above. War Wounded consistently uses dmy format ([292], [293], [294]) while Oriental Aristocrat ([295] dmy, [296] mixed, [297] mdy) is not consistent. WW also consistently formats their refs with full spaces on both sides of the horizontal bar, while OA inserts the parameter immediately after the bar. This suggests two separate users.
  • Another indicator we can look at is their interests outside of the interests we know they have in common, which we also expect most people in their region to have in common. War Wounded has made a lot of gnomish edits to pages and categories on regions within Pakistan, Pakistani film topics (especially biographies), Pakistani police, and Pakistani municipal/utility companies. Oriental Aristocrat makes more substantive edits on Indian culture topics, local geographic features (especially rivers), and recently has created articles on Pakistani mountaineers and an elephant. These aren't similar.
  • Gotitbro's "clearly not new users" comment: there are currently 1.2 million pages in the Wikipedia namespace and just under 1,000 in the Help namespace, which together provide a detailed and thorough guide to everything you might need to know and everything you might want to do on Wikipedia; indeed we have one of the most comprehensive user guides of any collaborative project that has ever existed. Anyone can look up any part of it at any time, and we repeatedly encourage new users to read the most important pages. Knowing how to do things is not, in and of itself, evidence of sockpuppetry. No evidence was provided at all, but especially not for the allegation that the two accounts are editing niche topics in common (politics and cricket are not niche, as I've described elsewhere).
  • Previous CU result: the closeness in the account creation times may be indicative, but they are outside the CU retention window. The previous checks were run by Blablubbs, not Mz7, and their checks didn't leave enough info in the logs to be useful now, unfortunately.
More