Wikipedia:Sockpuppet investigations/Muhafiz-e-Pakistan/Archive

Muhafiz-e-Pakistan (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

• NameIsShaheer (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: originally filed under this user)

• Muhafiz-e-Pakistan (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • SPI Tools

The sock added the exact same material as the master (Master1, M2, M3, Sock) with highly similar edit summaries (M3 and Sock).

The sock also became active in niche articles backing the master (Sindhudesh (M, S), Sindhi language (M, S), Las Bela (princely state) (M, S)).

The interaction-timeline makes this amply clear especially with the sock becoming active in articles when the master got blocked.

Also requesting a CU to check for other socks especially considering the fact that the sock has enagaged in WP:HOAX creations (AfD). Gotitbro (talk) 04:38, 6 September 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

@Girth Summit: Since suspected master and another sock are currently blocked, Muhafiz-e-Pakistan has already started restoring their edits on Sindhis,[1][2][3] and is edit warring to restore them.[4]

Muhafiz-e-Pakistan, just like NameIsShaheer, leaves messages on user talk page whenever he gets reverted on Sindhis.[5][6]

Both edited Iranian peoples#Demographics with similarly descriptive edit summaries.[7][8] Aman Kumar Goel ^(Talk) 17:38, 6 September 2022 (UTC)[reply]

• I've taken a look at this, and it's definitely  Possible: the geolocations are very similar, and the user agents are identical (but very common). They're using different IP ranges however;  Behavioural evidence needs evaluation. Girth Summit _(blether) 14:02, 6 September 2022 (UTC)[reply]
• I do not find the behavioral evidence very convincing here. The strongest point is the use of a single source from the Tribune, but its use by multiple editors on a prominent page is not that surprising given that it was published on 26 August. Furthermore, the alleged sock's English is somewhat more fluent than that of the master. I am not personally willing to block on this evidence, another admin may see it differently. That said, the alleged sock has been remarkably disruptive in several areas, and may well find themselves indeffed sooner than later. Vanamonde (Talk) 03:38, 23 October 2022 (UTC)[reply]
• @Girth Summit: I see you blocked Muhafiz-e-Pakistan as a sock of Cyber.Eyes.2005, so I'm thinking merge this report to Wikipedia:Sockpuppet investigations/Cyber.Eyes.2005 and close it, if that makes sense to you. -- RoySmith (talk) 14:25, 24 October 2022 (UTC)[reply]

  Hi RoySmith - if you look at my comments at that case, I'm considering whether MeP needs their own separate case - it looked more like MEAT than SOCK to CyberEyes. I might take another quick look at this though, hang on. Girth Summit _(blether) 14:29, 24 October 2022 (UTC)[reply]

  OK, yeah - I don't think NameisSaheer and Muhafiz-e-Pakistan are the same, and I don't think they're CyberEyes either. Feel free to move/merge as you see best. Girth Summit _(blether) 14:40, 24 October 2022 (UTC)[reply]

  OK, I'll just close this and leave it under this title. -- RoySmith (talk) 15:10, 24 October 2022 (UTC)[reply]

  Let me try that again. I'm going to move it to Wikipedia:Sockpuppet investigations/Muhafiz-e-Pakistan. I think I got that right this time :-) -- RoySmith (talk) 15:13, 24 October 2022 (UTC)[reply]

• Just noting
  • محفوظ ہمارے زبان (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  as a previously tagged sock. -- RoySmith (talk) 15:17, 24 October 2022 (UTC)[reply]

• Cyber.Eyes.2005 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: originally filed under this user)

• محفوظ ہمارے زبان (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Recreated Gawar people with similar content as it previously had when Quotennial (confirmed sock) created it a few days ago. Cannot compare as I do not have access to deleted content. (t · c) buidhe 07:02, 23 October 2022 (UTC)[reply]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  In progress - Girth Summit _(blether) 11:44, 23 October 2022 (UTC)[reply]
• This is not what I expected at first. All of محفوظ ہمارے زبان's contributions are coming from a single IP, which geolocates to a different country (and continent) from Cyber.Eyes.2005. There is a single other account that has used that IP, within a minute of محفوظ ہمارے زبان: Muhafiz-e-Pakistan. I would call those two accounts  Confirmed. Muhafiz-e-Pakistan is currently indef p-blocked for disruptive editing, and so using undisclosed alt accounts is a pretty dubious idea (and a CLEANSTART isn't legitimate while there is an active sanction in place); I see that both Muhafiz-e-Pakistan and محفوظ ہمارے زبان editing the same articles, and also editing while logged out at the same articles, so I am going to block both for deceptive behaviour. I've run a check on Muhafiz-e-Pakistan, and they appear to have changed location - almost all of their edits prior to this week have come from the same country that Cyber.Eyes.2005 edits from. However, it's a large country, and they consistently geolocate to a very different part of it - I think they're likely a different person from Cyber.Eyes.2005. Girth Summit _(blether) 11:55, 23 October 2022 (UTC)[reply]
•  Clerk assistance requested: - please consider what best to do with this report (close, split it out into a separate report etc) based on my comments above. I'll also note that the current version of Gawar people is substantially different from the deleted version. The similar dates are suspicious though - it's entirely possible that Cyber.Eyes.2005 and Muhafiz-e-Pakistan are different people, but are coordinating their editing - I see them editing several similar articles such as Palula people. Some behavioural investigation may be useful. Girth Summit _(blether) 12:02, 23 October 2022 (UTC)[reply]
•  Clerk note: If splited, please, consider splitting Wikipedia:Sockpuppet investigations/NameIsShaheer#06 September 2022 first. MarioGom (talk) 12:27, 23 October 2022 (UTC)[reply]
• Moved, closing. MarioGom (talk) 16:42, 24 October 2022 (UTC)[reply]