Wikipedia:Sockpuppet investigations/Mhsohaib/Archive

Add links
From Wikipedia, the free encyclopedia


Mhsohaib

Mhsohaib (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

04 November 2017[edit]

Suspected sockpuppets[edit]


I contacted There'sNoTime privately for a check on these two accounts based on behavioral evidence found in expired PRODs and drafts from Nassermh they were the same account as مرتضى يوسف, which I'll show below. When I went through to tag the articles as G5, I found that there were a signfificantly more articles than I expected, so I'm creating this case to link the two CU blocked accounts to the named master on-wiki behaviorally.

All three accounts focus on football clubs and players from Arabic-speaking regions. The editor compare utility shows significant interaction between all three accounts[1]. There are also several templates where all three users are essentially the only editors in recent history: [2], [3], [4], [5].

Nassermh also took to converting draftied articles by to the article mainspace as can be seen at: [6] and [7] (second diff has odd history because of histmerge that was needed for attribution after draftifying a second time). Both of these drafts were created by the named master and draftified in October by Boleyn, and then recreated identical to the drafts in mainspace by Nassermh, who then blanked then redirected the drafts. The master is stale, but given the CU blocks of the two accounts, this screams like a duck quaking into a megaphone to me.

As I mentioned above, I'm creating this SPI to make the behavioral link on-wiki given the large amount of G5s TonyBallioni (talk) 20:52, 4 November 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

This case is being reviewed by Sir Sputnik as part of the clerk training process. Please allow them to process the entire case without interference, and pose any questions or concerns either on their Talk page or on this page if more appropriate.

  • Given the evidence above and a few other quirks of their editing, this looks pretty clear cut to me. Since everyone's already blocked there's nothing left to do here. Closing and tagging. Sir Sputnik (talk) 21:36, 4 November 2017 (UTC)[reply]

14 November 2017[edit]

Suspected sockpuppets[edit]

I've duck blocked both of these accounts: returning to the G5'd templates that only they have edited recently Return to G5'd template: [8],

Return to template heavily edited by other socks:[9], [10], [11].

Requesting CU here to see if there is anything that can be done about blocking the underlying range of these accounts and those in the archive and/or if other accounts are out there. A range block would probably be ideal if we don't have collateral damage, as these socks pop up every few days after the last one was blocked. TonyBallioni (talk) 17:19, 14 November 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

20 December 2017[edit]

Suspected sockpuppets[edit]

Obvious DUCK. Recreated Fahad Al-Jumaiah, which was originally created by the CU confirmed sock Fedaamofeed (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki).

Requesting CU to look for other accounts as this user normally recreates an account immediately after autoblock wears off, and this account is a relatively new one compared to the last block. TonyBallioni (talk) 14:46, 20 December 2017 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Don't forget Abdullah Majrashi (footballer, born 1997) which was recently g5'd as well... CHRISSYMAD ❯❯❯¯\_(ツ)_/¯ 15:07, 20 December 2017 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

09 January 2018[edit]

Suspected sockpuppets[edit]

This account was actually one of my original guesses for the masters of the two accounts of the Arab soccer sock, but it was stale when I asked TNT for a check.

This account was blocked in July for 6 months. It's first edit after coming back was to recreate Ibrahim Sharahili, one of the articles that another sock had created.

I'd duck, but the only thing stopping me is that I believe both the master and this account are active on the Arabic Wikipedia where both were unblocked, so technical evidence could help to confirm. TonyBallioni (talk) 19:48, 9 January 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

This case is being reviewed by Sir Sputnik as part of the clerk training process. Please allow them to process the entire case without interference, and pose any questions or concerns either on their Talk page or on this page if more appropriate.

  • No sleepers our other accounts found. You are going to have to work with behavioral evidence --Guerillero | Parlez Moi 03:48, 10 January 2018 (UTC)[reply]
  • Primefac, can you assist with the behavioral evaluation here. I was pretty convinced in October that they were the same, but could use a second pair of eyes comparing against the archive. The first unblocked edit being an Arab-soccer-sock recreation is a bit much for me, but I'm not doing a unilateral block here with a CU saying to go behaviorally here. TonyBallioni (talk) 03:55, 10 January 2018 (UTC)[reply]
    • Never mind, they've gone ahead and recreated Abdullah Majrashi (footballer, born 1997), Majed Kanabah, and Luiz Paulo Daniel Barbosa since the CU results came in. If 4/5 of the first edits after becoming unblocked are recreation of the Arab soccer sock articles, I'm fine with calling this a duck and blocking on my own. This account is  Blocked but awaiting tags.  Clerk assistance requested: GeneralizationsAreBad can you or another admin clerk please move this to the new master, and retag the old accounts? They also both seem to have been active on ar.wp, but the Arabic script account hasn't editted since July. Not sure if it's worth informing them or getting ajr to lock one of the accounts. TonyBallioni (talk) 11:56, 10 January 2018 (UTC)[reply]
  •  Done. As for a global lock, I'm inclined to say no, absent clear evidence of abuse on the other project, and that will be difficult to find given the language barrier. If there is a problem, it's probably best left to local admins. Tagging and closing. Sir Sputnik (talk) 15:49, 10 January 2018 (UTC)[reply]

14 January 2018[edit]

Suspected sockpuppets[edit]

Duck blocked the block evading IP for 3 months. Contributions show contributions that are almost exclusively the same as this sock family. Only filing the SPI for record keeping purposes. TonyBallioni (talk) 15:26, 14 January 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  IP blocked for three months per above. Behavioral evidence already assessed before filing the SPI. Closing. TonyBallioni (talk) 15:27, 14 January 2018 (UTC)[reply]

22 January 2018[edit]

Suspected sockpuppets[edit]

Both blocked, simply filing to update the SPI. Focus on the same templates, articles, etc. that are essentially only edited by this sockmaster. TonyBallioni (talk) 16:10, 22 January 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Account blocked and tagged per above. IP blocked for 3 months. Closing. TonyBallioni (talk) 16:10, 22 January 2018 (UTC)[reply]

13 March 2018[edit]

Suspected sockpuppets[edit]

Obvious sock is obvious. See contribs: only edits are intersects with previously blocked socks on Arab football articles. Already blocked and tagged. Filing for the record. TonyBallioni (talk) 15:20, 13 March 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

03 April 2018[edit]

Suspected sockpuppets[edit]

See deleted contributions and the page history of deleted pages. Obvious sock mass recreating previously created articles by this master. Already blocked, tagged, and creations G5'd. Filing for the record since there were a fair amount of G5s this time around. TonyBallioni (talk) 22:08, 3 April 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

01 September 2018[edit]

Suspected sockpuppets[edit]

Recreation of Muhannad Fallatah with identical prose to the previously deleted article for this master. Also recreated Ahmed Al-Fiqi which was originally created by another sock of this master. Asking for a CU because the account was a sleeper, he has had sleepers in the past, and this has cross-wiki implications with ar.wiki so I want to be sure. Last confirmed sock is Abdulhamidmido (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) TonyBallioni (talk) 14:17, 1 September 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  •  Comment: the user blocked now in arwiki as a confirmed sock for Mhsohaib (same IP range, same UAs & same behavior). I put a note for other arwiki CUs about this new sock in CUwiki to decide "if" they agree to take strict step with the user --Alaa :)..! 07:18, 2 September 2018 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Blocked and tagged I also talked to Courcelles about the en.wiki data on this, which was based on older data than the ar.wiki users have, but did not rule out socking here (he can comment further if he likes). Given then behavioral overlap, the en.wiki findings, and the stronger findings on the user's home project, I'm blocking. TonyBallioni (talk) 07:21, 2 September 2018 (UTC)[reply]

05 October 2018[edit]

Suspected sockpuppets[edit]

Just noting that I've blocked the above range per DUCK. Filing for the record. TonyBallioni (talk) 00:50, 5 October 2018 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments[edit]

23 July 2021[edit]

Suspected sockpuppets[edit]


This started with my question at GiantSnowman's Talk page: User talk:GiantSnowman#New user. As you can see, Struway2 led me to look at the contributions of Lilianasri, who stopped editing a short time after Margheret began editing. I also noticed the last entry in the archive Special:Contributions/62.149.77.128/27. The IPs in that range have been engaged in block evasion for a long time, that last edit that I can see being on July 14, 2021 (I don't know if there's any way to see deleted contributions of IP ranges).

The interaction between the named accounts above, previous socks, and the IPs in that range makes this a duck case. Some examples:

  1. the edit history at 2019–20 Saudi Second Division (includes Margheret; Lilianasri; previously blocked socks User:Dyalafamhi, User:Tash-natasha, and User:Losail; and IPs);
  2. the edit history at deleted Carlos Geovane (includes Lilianasri and Nawafmashea);
  3. the edit history at deleted Francisco Pereira de Freitas Junior (includes Liliananasri and previously blocked sock Dyalafamhi);
  4. the edit history at Abdulrahman Al-Hurib (includes Margheret, Nawafmashea, previous sock User:مرتضى يوسف, the master, and the IPs)
  5. the edit history at Abdullah Al-Shammeri (footballer, born 1993) (includes Margheret, Lilianasri, the master, and the IPs)

As for behavior, all of these accounts create new footballer articles, new club articles, and categories. All of them also move articles without discussion.

I am requesting a CU to confirm the two non-stale accounts, Margheret and Liliansri, and to look for any sleepers. It sounds like the CU logs will also be of assistance in connecting the non-stale accounts to previous socks. In the meantime, I will block Margheret, the current account, without tags to prevent further block evasion and disruption. Bbb23 (talk) 17:54, 23 July 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • Blocked Margheret without tags. Bbb23 (talk) 17:55, 23 July 2021 (UTC)[reply]
  • Margheret and Lilianasri are  Confirmed to each other, and they are from relatively similar geolocations to previous socks of Mhsohaib.  Blocked and tagged: I'll leave the stale accounts alone for the time being—if they return to activity, they can be reported here again. Closing. Mz7 (talk) 23:44, 29 July 2021 (UTC)[reply]

28 September 2021[edit]

Suspected sockpuppets[edit]

This account was created very shortly after the previous batch of socks were blocked. The behaviour is exactly the same as before in that their interest is almost solely on Middle Eastern footballers with a strong focus on Saudi Arabia. As with all of the previous socks, they perform multiple page moves without consensus such as [12] [13]

Just look at their user contributions, they've done loads of random page moves. User:GiantSnowman and User:Struway2 looked into the previous socks so I'd be interested to see if they found any other similarities.

Please check for sleepers. Spiderone(Talk to Spider) 08:30, 28 September 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

This case is being reviewed by Tamzin as part of her training as a clerk. Please allow her to process the entire case without interference. You may pose any questions or concerns either on her talk page or on this page.

15 November 2021[edit]

Suspected sockpuppets[edit]


Mhsohaib is a prolific block evader who starts up accounts now and then. I actually liked some of his work on Tunisian footballers, but the accounts that made these edits were indefinitely blocked and the page creations G5 deleted. Specifically, User:Tabarjal shows a very similar editing pattern to User:Lilianasri, concentrating mainly on stubs for football clubs on the Saudi Arabia third tier. Many of Lilianasri's G5 deleted contributions are now recreated under slightly different names. One example is Radwa Club, now incarnated as Radwa FC. Another example is Jarash Club, now surfacing as Jerash Club. As to the contents, the stubs are short and contain some peculiarities. One example is the capitalisation of "City", also present in the deleted articles. The article text is the same and the exact same sources are used, Koora and saff, which are formatted in the same way.

Granted, some pages also contain differences, such as Sajir Club and Sajir FC. Also, the user denies the connection to blocked accounts. I still think the similarities are so blatant that at least a check is in order. Geschichte (talk) 11:04, 15 November 2021 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

This case is being reviewed by Tamzin as part of their training as a clerk. Please allow them to process the entire case without interference. You may pose any questions or concerns either on their talk page or on this page.

  • @Geschichte: I don't see any possible good-faith explanation for the amount of similarity you're describing, especially if they're claiming to have no connection to Mhsohaib. Having confirmed that the Radwa versions are as similar as you say, I'm comfortable ruling this a duck. Pink clock Awaiting administrative action: Please block Tabarjal indefinitely as a proven sock of Mhsohaib. -- Tamzin[cetacean needed] (she/they) 18:08, 15 November 2021 (UTC)[reply]
  •  Blocked and tagged, closing. --Blablubbs (talk) 18:21, 15 November 2021 (UTC)[reply]

12 January 2022[edit]

Suspected sockpuppets[edit]

As with all previous socks, this 'new' account only edits Middle Eastern football, with a strong focus on Saudi Arabia. All of the new articles created follow the same format that the other socks used and will likely need WP:G5 again if this tests positive for being another sock. Also see multiple attempts to move pages without any consensus [16] [17] [18]. As with previous socks, there is also a lack of communication on their own talk page, even when questioned by Geschichte. Spiderone(Talk to Spider) 10:18, 12 January 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  In progress - -- RoySmith (talk) 23:32, 13 January 2022 (UTC)[reply]
  •  Confirmed to Tabarjal from the archive. Based on some notes in cuwiki and the logs, those two are  Highly likely to Mhsohaib. I'm going to tag as proven, and retag Tabarjal as proven. -- RoySmith (talk) 23:57, 13 January 2022 (UTC)[reply]

22 May 2022[edit]

Suspected sockpuppets[edit]

I'm convinced that this is Mhsohaib again. Behaviour is identical to all previous socks and area of interest is exactly the same. Creates articles like Mohammed Fraih and Faisal Al-Ghamdi in exactly the same way as previous socks.

Other factors:

  • As with all previous socks, repeatedly performs page moves without any comment and without any consensus. [19] [20] [21]
  • No user page. None of the other socks, to my knowledge, ever created one either.
  • Main focus is editing and creating stubs relating to Saudi football

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • I just filed the same suspicion, but with new evidence, but then reverted when I saw this open. The suspected account here recreated just now articles deleted due to G5 that Gulfup made. In particular see these logs: Ali Al-Jassem and Ammar Bo Essa. I think this is a smoking gun, why would a new account recreate two sock articles? Pikavoom Talk 10:58, 31 May 2022 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  Clerk endorsed - Based on the above report. Acknowledging that the archive is stale so this will be reliant on CUWiki notes (mentioned previously) and log data. --Jack Frost (talk) 03:26, 23 May 2022 (UTC)[reply]
  •  In progress - Salvio 07:45, 23 May 2022 (UTC)[reply]
  • All previous known socks are  Stale; however, there are some notes on CU-wiki, on the basis of which I can say that Jaberissa is  Possilikely (a mix between possible and likely).  Behavioural evidence needs evaluation. Incidentally,  No sleepers immediately visible Salvio 08:18, 23 May 2022 (UTC)[reply]
  • Pink clock Awaiting administrative action - the behavioural evidence is convincing. Please indef Jaberissa as a proven sock. Thanks, Spicy (talk) 18:10, 31 May 2022 (UTC)[reply]
  •  Blocked and tagged. Closing. --Blablubbs (talk) 10:12, 1 June 2022 (UTC)[reply]

16 June 2022[edit]

Suspected sockpuppets[edit]

Username matches pattern previously found (Firstlastnumbers). Communicative on their talk page. All edits are to middle-eastern footballers. First contribution is to a stub, then long gaps before substantial contributions recently. AfD struck rationale is under article created by different account: [22]. Iseult Δx parlez moi 06:40, 16 June 2022 (UTC)[reply]

Noornasser2019 fits the username pattern and has created multiple articles previously G5'd as creations of Losail: Mubarak Hassan, Ali Yaqoub, Rashid Lahi, for three. Iseult Δx parlez moi 23:16, 16 June 2022 (UTC)[reply]

Added Motuca; I'll acknowledge that this is more of a stretch, but they've recreated several articles previously G5'd (Losail), and maintain a consistent interest in these stubs, a pattern also mentioned below by Pika. Iseult Δx parlez moi 17:53, 17 June 2022 (UTC)[reply]

@Tamzin:, how recent is "recently"? I show User:Dyalafamhi and User:Lilianasri as responsive on their talks (see history) as early as 2020. Iseult Δx parlez moi 19:47, 17 June 2022 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

  • Noornasser2019 might be them, though the username doesn't match most of the socks who do not have number suffixes, it does match User:Alarabi2020 for example. However, the account has been abandoned for two years, the only practical consequence would be G5ing articles without substantial contributions by non-socks. Most two year old articles have such substantial contributions, but in this case I went through them and saw that many do not. I also came upon sock Lilianasri moving them around as in here and here. Lilianasri also moved some of Mhsohaib's creations around as here, here, and here. There's a lot of overlap between Lilianasri and Noornasser2019, and while the club page overlap is expected on topic overlap, the overlap on individual bios that have very few contributions by others, is not so easy to explain. I think I convinced myself typing and exploring this that they are related, and that it would be possible to G5 a non-trivial number of pages, though whether it would be worthwhile to G5 two year old pages is debatable. Pikavoom Talk 09:07, 17 June 2022 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • I'm unsure on both of these. Noornasser seems a lot like Mhsohaib, but I'm also not sure how to distinguish Mhsohaib from someone adding lots of articles about Middle Eastern footballers in good faith, and such editors surely do exist. I'd endorse a check, but the account is stale, and I'm not sure if we can get to a finding of socking on behavioral evidence alone. (Usually with a stale sock like this I'd say it doesn't matter, but here, it does to an extent, since it would affect some articles' G5 eligibility.) As to Khaledahmed, I lean to this being a coincidence. Their English skills are noticeably worse than that of previous Mhsohaib sox. As such, I'm not sure I can endorse based just on shared interests. Note also that until recently Mhsohaib sox were characteristically silent, not responsive.
    Would appreciate thoughts from anyone else. -- Tamzin[cetacean needed] (she/they) 02:07, 17 June 2022 (UTC)[reply]
  • See also Wikipedia:Sockpuppet_investigations/Khaledahmed1992. Spicy (talk) 12:52, 22 June 2022 (UTC)[reply]
  • As noted in Wikipedia:Sockpuppet investigations/Khaledahmed1992, Khaledahmed1992 is Red X Unrelated. As the other two accounts are long stale, closing with no action. -- RoySmith (talk) 13:55, 22 June 2022 (UTC)[reply]

11 July 2023[edit]

Suspected sockpuppets[edit]

If you look at the overlap and recreation of Ahmed Al-Mohanadi that was previously created by Mhsohaib, it seems very ducky. APK whisper in my ear 10:06, 11 July 2023 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
  • Comment - I think that Qautro is an even clearer match due to the sole interest in editing Saudi football and unexplained page moves. Spiderone(Talk to Spider) 08:25, 5 August 2023 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments[edit]

  • I don't think this kind of overlap or the re-creation of a single article about a football player is enough. no Closing without action. MarioGom (talk) 20:56, 25 August 2023 (UTC)[reply]

12 January 2024[edit]

Suspected sockpuppets[edit]

Same story as above: focus on Middle Eastern football, especially Saudi Arabia; significant overlap with the master; recreation of previous G5'd pages, e.g. Mishari Al-Qahtani; contentious page moves. – Joe (talk) 12:27, 12 January 2024 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

12 January 2024[edit]

Suspected sockpuppets[edit]

Again, focus on Middle Eastern football, significant overlap of articles as seen at https://sigma.toolforge.org/editorinteract.py?users=Mhsohaib&users=89.237.148.254 Duck?

Also edits to blocked sock Qautro created articles, on e.g. Mohammed Al-Khaibari.

Suggest looking for sleepers too. Kj cheetham (talk) 16:23, 12 January 2024 (UTC)[reply]

Comments by other users[edit]

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments[edit]

  •  In progress - there's a bit of a farm here, some blocked, some not, give me a minute to go down some rabbit holes. Girth Summit (blether) 11:35, 13 January 2024 (UTC)[reply]
  • I would revise my last statement somewhat - but Nu Ygieller is using some busy IPs, which a number of sock accounts have also used recently, but they don't look like those accounts, or Mhsohaib/Qautro (who operate out of different IPs). I think it likely that Nu Ygieller is someone else; I'll leave this open for someone else to make a determination about whether the reported IP needs to be long-term blocked (policy prohibits me from saying whether or not that IP is Mhsohaib/Qautro). Girth Summit (blether) 11:51, 13 January 2024 (UTC)[reply]
  • information Administrator note IP already blocked, nothing more to do here. The WordsmithTalk to me 20:15, 4 March 2024 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Mhsohaib/Archive&oldid=1212002425"