TronFactor (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• Huda-omr (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: original case name)

• TronFactor (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Cococ2001 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Amshal (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Abu1ameen (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Akarout (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Yyahmedsakr (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Medellinir (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Ahmed1715e (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• PrasanthS05 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Asaad583832shingali (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Sockuptery (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Ghalbeyakh (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• 93.230.148.209 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 92.116.234.244 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 91.89.117.160 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 87.162.158.45 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 46.90.155.9 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 176.95.251.35 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 94.134.177.232 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 212.116.163.235 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 46.223.162.248 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 79.196.105.205 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• TonykaCommie (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Negromono (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Eaepe (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• A.AlHaddadi (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• CarmelKalfa (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Elmaidandz (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Pakieditor (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

This group created the Qatari soft power article and, in a very short timeframe, they added snippets linking to it from a large number of articles. These snippets are very similar to each other, use the same sources, same formatting and editing style, etc. They also follow a strongly sequential editing pattern across accounts. The IPs are mostly German (many of them verified as residential proxies from the Nimbleway network), except 212.116.163.235 which is an Israeli IP that doesn't look like a proxy.

Qatari soft power was created by Ghalbeyakh on 13:28, 28 January 2024‎. From that day to 1 February 2024, the mentioned snippets were added by Ghalbeyakh themselves [1][2], Abu1ameen [3][4][5], Huda-omr [6][7][8][9], Akarout [10][11][12][13], Sockuptery [14][15][16], 212.116.163.235 [17], 87.162.158.45 [18], 93.230.148.209 [19], 46.90.155.9 [20], Ahmed1715e [21], TronFactor [22][23][24], 176.95.251.35 [25], Cococ2001 [26][27][28][29], Yyahmedsakr [30][31], 94.134.177.232 [32], 92.116.234.244 [33], 79.196.105.205 [34], 46.223.162.248 [35], Asaad583832shingali [36], Amshal [37][38], PrasanthS05 [39][40].

Medellinir !voted keep at Wikipedia:Articles for deletion/Qatari soft power [41], and use the same type of (not so common) gnoming on the same day in the past as Ghalbeyakh [42][43].

See also the overlaps on Empire State Building and World Athletics Championships. Also the way they often add the same info in lede and body, sometimes in the same edit, and the same kind of cross-referencing.

To get a better grasp of the overall picture, I'd recommend looking at the consolidated timeline at spi-tools or sandals. MarioGom (talk) 16:50, 3 February 2024 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I will note that Qatari soft power would be quite impressive for a new editor; as noted here. Not impossible, but very hard to make from start-to-finish if one is truly new. — Red-tailed hawk _(nest) 22:50, 3 February 2024 (UTC)[reply]

• CheckUser requested and endorsed by clerk - I'm requesting a check for the registered accounts. Please, keep in mind there seems to be a lot of residential proxy use (Nimbleway network). Also timing of some contribs make me think there's possibly more than one editor (but tightly coordinated). MarioGom (talk) 16:52, 3 February 2024 (UTC)[reply]
•  In progress - Marking since this may take a little while. Vanamonde93 (talk) 22:30, 3 February 2024 (UTC)[reply]
• That was a few hours of my life...There's broadly three categories here. The first is a large group all  Confirmed to each other. These are: TronFactor, Akarout, Abu1ameen, Elmaidandz, Pakieditor, Asaad583832shingali, PrasanthS05, TonykaCommie, Ahmed1715e, Negromono, Eaepe, and A.AlHaddadi. I have indeffed these based on CU data.
• Then there's Amshal, who I would call  Possilikely (a mix between possible and likely) to the rest, but is  Confirmed to CarmelKalfa: also indeffed.
• The remaining named accounts are highly suspicious; there's lots of proxy use, and they may be exclusively editing from proxies; the behavioral overlap is strong; and there's some technical similarity too, so I'd call them  Likely as well. I have blocked these, but I suspect that the named master (and possibly others) is a hijacked account; so requesting clerk assistance with tagging and possibly renaming.
•  No comment with respect to IP address(es): however, I saw considerable evidence of deliberately logged-out editing, so someone should check behavior on the IPs keeping in mind that behavioral overlap is likely not coincidental. That won't be me, this has already taken longer than I expected. Vanamonde93 (talk) 05:54, 4 February 2024 (UTC)[reply]
• Moved the case to TronFactor, which is the globally oldest confirmed account. Behaviorally, I think Cococ2001 and TronFactor were already socks of each other in 2014. So it is hard for me to assess whether there is account hijacking or just warming up of sleepers of a sockfarm possibly larger than the one reported here. I'll keep it this way at the moment. I will tag the confirmed group as confirmed to TronFactor, and the rest of the group as proven to it. MarioGom (talk) 09:14, 4 February 2024 (UTC)[reply]
• Current G5/REVERTBAN time is 22:31, 30 January 2024 (Sockuptery). MarioGom (talk) 09:21, 4 February 2024 (UTC)[reply]
•  Tagged. MarioGom (talk) 09:46, 4 February 2024 (UTC)[reply]
•  Awaiting administrative action - I'd suggest giving a short (1-2 weeks?) hardblock to all IPs mentioned in this case. Hard because they are probably used by registered accounts, short because given it's residential proxies, they will rotate quickly. I would also include 158.181.68.255 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log)) which overlaps in topic and it's part of the same proxy network (Nimbleway). MarioGom (talk) 14:00, 4 February 2024 (UTC)[reply]
• Given the nature of these proxies, there is probably no point in blocking them anymore. Closing. MarioGom (talk) 15:25, 23 February 2024 (UTC)[reply]

• Luckyali11 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Amr Hamed (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Iamjosemom (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Just like previous accounts, these 3 have tells of being old inactive accounts that were recently compromised. Luckyali11 and Amr Hamed promoted the website shameqatar.com [44][45] and one day later Iamjosemom also added a link to the website, concealed as a revert [46]. Just like itsinyourhands24.com, which was being promoted by the previous batch, it is a recently registered website, and there's quite a few tells about both websites being run by the same actor. Like the previous batch with Qatari soft power, Iamjosemom created Qatar role in the Israel–Hamas war in one go, in a way that is quite implausible for an otherwise inexperienced user. MarioGom (talk) 15:34, 23 February 2024 (UTC)[reply]

Also note the overlap at Moza bint Nasser. MarioGom (talk) 15:40, 23 February 2024 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• CheckUser requested and endorsed by clerk and beware residential proxies. MarioGom (talk) 15:35, 23 February 2024 (UTC)[reply]
• Unsurprisingly, everyone's on proxies.
•  Confirmed to each other, likely compromise attempts observed:

• Afghahawhhj (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Luckyali11 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• Separately  Confirmed to each other:

• Ghalbeyakh (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Iamjosemom (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• Nominally  Inconclusive but the cave paint looks similar:

• Amr Hamed (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

I'll block and request a lock for the unblocked accounts. Closing. Thanks, Spicy (talk) 18:12, 23 February 2024 (UTC)[reply]

• Iamjosemon (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

The username and topic area are an all-but-certain link to a previous sock, Iamjosemom (talk · contribs · deleted contribs · logs · filter log · block user · block log). Sable232 (talk) 21:27, 18 March 2024 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Blocked, tagged, global lock requested, closing. Bbb23 (talk) 00:55, 19 March 2024 (UTC)[reply]
• Not sure what went wrong, but the block and tag didn't go through, although the global lock request did, so I'm blocking and tagging (again). Bbb23 (talk) 00:58, 19 March 2024 (UTC)[reply]
• Bbb23, I was looking at this just as you blocked. This sockmaster is known to compromise accounts, and if you look at Iamjosemom's contributions, the abrupt switch from cars to Qatar politics strongly suggests this possibility. They also claimed to be compromised on UTRS in a manner that seems sincere to me. From a technical perspective, Iamjosemon's data is consistent with the data for Iamjosemom prior to February, i.e., prior to the likely compromise of the account. I don't believe this account is being operated by the sockmaster. Spicy (talk) 01:14, 19 March 2024 (UTC)[reply]

• @Spicy: I'm not sure I follow, but I assume if there's something you wish to change about the block, tag, and glock request, you will.--Bbb23 (talk) 01:24, 19 March 2024 (UTC)[reply]

• To be clear, I think that Iamjosemom was compromised by the sockmaster, and Iamjosemon is an account created by the original operator of that account, prior to the compromise. I see it's now been locked but hopefully this is taken into account if they appeal. Spicy (talk) 01:04, 20 March 2024 (UTC)[reply]

• Plutonics (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

See below. Moneytrees🏝️(Talk) 03:38, 1 May 2024 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• A private tip indicated this was a return of TronFactor, and the dormant account suddenly shifting from Pakistan to Qatar politics falls along the MO of account compromises.  Blocked and tagged. Moneytrees🏝️(Talk) 03:38, 1 May 2024 (UTC)[reply]

• Cococ2001 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: original case name)

• 42.116.174.210 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

Indicates similar edit patterns to volleyball related articles. 98𝚃𝙸𝙶𝙴𝚁𝙸𝚄𝚂 • [𝚃𝙰𝙻𝙺] 13:19, 3 June 2024 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Clerk assistance requested: - Please move to Wikipedia:Sockpuppet investigations/TronFactor. Bbb23 (talk) 14:02, 3 June 2024 (UTC)[reply]
• Merge done. Please note that many of the accounts in this SPI are compromised, so behavioural evidence needs to be interpreted with care. In this case, the Qatar-related edits by Cococ2001 were likely carried out by the sockmaster after compromising the account, but the volleyball edits were probably performed by the original operator of the account, i.e. not the actual target of the block. So it's debatable whether the edits from this IP, if we assume they are the same person, should be treated as block evasion. Spicy (talk) 16:58, 8 June 2024 (UTC)[reply]
• IP seems inactive now, likely rotated. Not much point in blocking at this point even if it was evasion. Closing case. The Wordsmith^{Talk to me} 04:39, 12 July 2024 (UTC)[reply]