Wikipedia:Sockpuppet investigations/Phillip Pham/Archive

02 March 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Behavioural - defending articles that his logged-in account has just been blocked for. Andy Dingley (talk) 23:40, 2 March 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * and sent to the main queue - CheckUsers will almost never publicly connect an account with an IP. Callanecc (talk • contribs • logs) 11:53, 3 March 2015 (UTC)

03 March 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Recreation of previously deleted material Declan Clam (talk) 19:12, 3 March 2015 (UTC)
 * Johensonthe3rd
 * More disruption on his little garden of Disney parade articles, particularly on disrupting deletion requests. Andy Dingley (talk) 23:16, 3 March 2015 (UTC)

04 March 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Andy Dingley (talk) 02:02, 4 March 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

08 March 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Phillip Pham made a bunch of edits adding incorrect information to articles about shows at Disney parks:. He also created and removed a speedy deletion tag from it here. A few IPv6 addresses, 2602:306:8B2C:5350:D90A:2939:CBEF:AFEB, 2602:306:8B2C:5350:5059:F8CA:8E9E:7E9F, and 2602:306:8B2C:5350:B062:CB83:FB24:9A83, also tried removing the same tag. Those IP addresses, as well as a whole series of IPv6 addresses begining with 2602:306:8B2C:5350 have exclusively been adding incorrect information to a series of articles on Disney park entertainment. I won't post all the diffs, as it's literally almost every single edit by those IP addresses. A rangeblock may be in order, as every IP in the 2602:306:8B2C:5350::/64 range that has edited on Wikipedia matches this pattern of vandalism. Ahecht (TALK PAGE ) 20:55, 8 March 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I've blocked the /64. Closing, since that seems to resolve the issue. HJ Mitchell  &#124;  Penny for your thoughts?  16:46, 9 March 2015 (UTC)

15 March 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same pattern of vandalism. These edits by 104.178.197.53 match the similar edits made by socks of Phillip Pham to the same article (indicating that a now-ended fireworks show is still running):. Ahecht (TALK PAGE ) 19:33, 15 March 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
I blocked the IP for one month. I cobbled together a tag and a comment for the master's user page as that account has been globally locked. Closing.--Bbb23 (talk) 22:04, 15 March 2015 (UTC)

17 March 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same pattern of edits to Believe... There's Magic in the Stars (this edit request on the talk page) and Steve Davison (adding a fake My Little Pony themed show here). Ahecht (TALK PAGE ) 21:29, 17 March 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Blocked one month. Behaviorally obvious and same location in Texas as other IPs. Closing.--Bbb23 (talk) 04:48, 18 March 2015 (UTC)

13 April 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same exact pattern of edits to Believe... There's Magic in the Stars, Main Street Electrical Parade , and Light Magic. IPv4 addresses have same location in Texas as other IPs, IPv6 addresses are in the same /64 subnet as previous socks, which means that it is likely a single user. Ahecht (TALK PAGE ) 19:08, 13 April 2015 (UTC)

It looks like the rangeblock that User:HJ Mitchell put on 2602:306:8b2c:5350:0:0:0:0/64, which has apparently expired, needs to be reinstated. --Ahecht (TALK PAGE ) 22:05, 16 April 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Looks like Philip Pham to me when looking at the edit pattern and articles targeted. Hg  andVenus  07:40, 16 April 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * has blocked 2602:306:8b2c:5350::/64 (which is the IPv6 range I originally blocked as mentioned above), and I've blocked 24.153.175.240/28 for a week. That one can easily be extended if necessary—/28 is a very small range, so collateral damage is likely to minimal. HJ Mitchell  &#124;  Penny for your thoughts?  21:42, 17 April 2015 (UTC)
 * It looks like everything has been addressed here. Mike V • Talk 01:47, 21 April 2015 (UTC)

29 April 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same pattern of disruptive edits -- adding information about an old fireworks show, "Believe... There's Magic in the Stars", being shown in 2015 and making up a "My Little Pony" fireworks show:. --Ahecht (TALK PAGE ) 17:18, 29 April 2015 (UTC) Ahecht (TALK PAGE ) 17:18, 29 April 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I've issued a 1 week anon only range block for 24.153.128.0/17. Mike V • Talk 20:49, 29 April 2015 (UTC)

21 May 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same pattern of edits adding false information to Disneyland articles, especially relating to fireworks and parades, and now branching out to fake attractions. Ahecht (TALK PAGE ) 17:33, 21 May 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Duck given the behavioral and geographical/IP match. Blocked. Abecedare (talk) 18:09, 21 May 2015 (UTC)

28 May 2015

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

24.153.175.249 has same pattern of edits adding false information claiming that the defunct fireworks show "Believe... There's Magic in the Stars" is still running and admits to being Phillip Pham. 24.153.175.242 and 24.153.175.248 have also been previously been used by Phillip Pham and both edited User:Phillip Pham today. 24.153.175.240/28 was blocked by User:HJ Mitchell earlier this month, and it looks like that block needs to be extended. Ahecht (<span style="color:#FFF;background:#00f;display:inline-block;padding:1px 1px 0;vertical-align:-0.3em;line-height:1;font-size:62.5%;text-align:center;">TALK PAGE ) 18:13, 28 May 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Blocked. Didn't bother to tag IP given that the user changes IP so often and this page already has a record of the IP for future match. Abecedare (talk) 18:28, 28 May 2015 (UTC)


 * Amend: Rangeblocked 24.153.175.240/28 for a month given that the master has been using this narrow range since mid-April and besides the IPs noted above they have also used
 * etc. Abecedare (talk) 18:40, 28 May 2015 (UTC)
 * etc. Abecedare (talk) 18:40, 28 May 2015 (UTC)
 * etc. Abecedare (talk) 18:40, 28 May 2015 (UTC)
 * etc. Abecedare (talk) 18:40, 28 May 2015 (UTC)

27 August 2015

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Obvious name similarities, edited at Disney's Fantillusion, a previous sock target. Requesting CU for sleepers. <span style="color:forestgreen;font-family:Georgia,serif">Conifer (<span style="color:forestgreen;font-family:Georgia,serif">talk ) 01:21, 27 August 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I've declined the CU request as I see no basis for suspecting sleepers based on previous history in the archives.--Bbb23 (talk) 01:41, 27 August 2015 (UTC)
 * . Please, indef this obvious sock.  Vanjagenije  (talk)  21:18, 28 August 2015 (UTC)


 * Blocked and tagged.-- Jezebel's Ponyo bons mots 21:36, 28 August 2015 (UTC)