Wikipedia:Sockpuppet investigations/TomPhan/Archive

Report date May 15 2009, 22:09 (UTC)

 * Suspected sockpuppets
 * (blocked)
 * (blocked)
 * (blocked)
 * (Blocked)
 * (Blocked)
 * (Blocked)
 * (blocked)
 * (blocked)
 * (Blocked, 1 edit - to RfA)
 * (Blocked, tenuous connection)
 * (Blocked, stale)
 * (Blocked, 1 edit - to RfA)
 * All blocked.  Sy  n 21:44, 26 May 2009 (UTC)
 * Annotation of blocking made after closure. — BQZip01 —  talk 02:20, 2 June 2009 (UTC)
 * Newly added


 * (added 02:01, 25 May 2009 (UTC), no result as of this time)


 * Evidence submitted by User:BQZip01

This user has been stalking me for about a year and has accused me (with no evidence whatsoever) of felonies (in this case murder) and left death threats. Initially blocked, this user has made a persistent effort to get around the indef block through TOR node usage, bypassing semi-protected pages (namely my talk and user pages) by creating accounts that make benign edits, waiting four days, and then (no longer a "new user") attacking me in various places. He has gotten involved in at least 2 of my RfAs and, in my most recent, made at least 3 contributions under different names/IPs. I also realize that the given IPs will likely not be blocked (however one appears to be registered to a Sprint account and may provide more information...), but they do show a pattern of behavior and (aside from TOR node edits) are geographically centered.

Given the run of IPs and their locations, I believe it to be likely that this person used to live in Katy, Texas or the Houston Metro area and recently moved to the Baltimore/Washington D.C. area.

On a related note, I understand the blocking of IP accounts for actions of more than a year ago would be futile, but properly labeling them as sockpuppet accounts shows the extent of the problem. — BQZip01 — talk 04:48, 16 May 2009 (UTC)


 * One more comment, the death threats and accusations of murder have been oversighted. — BQZip01 —  talk 23:16, 15 May 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.

There is no evidence whatsoever, behavioral or otherwise, that I am involved in all this mumbo jumbo! please remove me from that list. this is all crazy paranoia Notice this edit where the user removed the admission that I am probably not a sockpuppet. Arma virumque cano (talk) 15:48, 17 May 2009 (UTC)
 * I said "perhaps not" and others agree that your existence as a sockpuppet is also probable. Your edits started at WT:RfA and you went straight into other areas as well with justifications galore. IMHO, you are certainly a veteran user and not the rookie you claim to be; this could simply be a place to create a "good hand" account. If you are not related to the account in question, then the checkuser should quickly verify it. If you have anther account (as you claim), you should also let us know which one it is. — BQZip01 —  talk 21:40, 17 May 2009 (UTC)

I had one from about a year ago but i forgot the name hence this account Arma virumque cano (talk) 02:42, 18 May 2009 (UTC)


 * Fair enough. If that's the case, the checkuser will quickly eliminate you. Please realize that, if you aren't the person in question, this isn't directed at you. Please don't take it personally. I unequivocally advocate NO action be taken until a checkuser is completed. — BQZip01 —  talk 20:48, 18 May 2009 (UTC)


 * Comments by other users
 * Wow. This is a much bigger issue than what was so quickly dismissed by opposing eitors at BQ's recent RFA. No one should have to deal with death threats simply because they are an admitted United States military officer who edited Wikipedia. If Wikipedia becomes known as a site that allows such, I shudder to think what kind of precedent that would create. This should be nipped in the bud as quickly as possible. With haste. Great haste.  Schmidt,  MICHAEL Q. 23:05, 15 May 2009 (UTC)


 * It should be noted that User:Arma virumque cano has since been blocked as a sockpuppet, per the user's talk page. - ALLST✰R ▼ echo wuz here @ 19:21, 25 May 2009 (UTC)

Also F: User has made death threats and continues to cause disruption. It should be noted that the vote stacking occurred in a previous RfA (not my most recent). However, the same user contributed at least 3 different times to the most recent RfA under different names. Due to the number of different users, it is extremely hard to differentiate between legitimate users and sockpuppets and a checkuser is needed to separate the wheat from the chaff. Requested by — BQZip01 —  talk 22:09, 15 May 2009 (UTC)
 * CheckUser requests

Additional information needed: Please provide a code letter. SPCUClerkbot (talk) 22:09, 15 May 2009 (UTC)
 * Clerk, patrolling admin and checkuser comments


 * for CU attention. Nathan  T (formerly Avruch) 22:42, 15 May 2009 (UTC)


 * : Purpose of a CU check in this instance would be to confirm that the blocked accounts are related to the pattern of harassment seen previously, to block the unblocked accounts if its determined they are linked, check for sleepers and a potential rangeblock - serious pattern of harassment involved here. Nathan  T 17:15, 22 May 2009 (UTC)


 * I've also blocked Janice.morency, IdaliaBanash, and 73_86_Hike. Got a list of IPs to check for proxies, but not able to do so at this moment; more later if I find anything interesting. – Luna Santin  (talk) 19:58, 22 May 2009 (UTC)
 * You state you've blocked them here, but not on their pages, block history, or at the top. Please clarify. I guess you have. My mistake. I probably checked right after you put this on here before the blocks were enacted.
 * Also, up top I think the pattern of behavior bears out that some of these are at least sockpuppets, if not meatpuppets, even if the checkuser doesn't pan out/isn't applied (this does NOT apply to Arma virumque cano).
 * Thank you for such prompt attention. — BQZip01 —  talk 19:58, 23 May 2009 (UTC)


 * Assuming that Luna didn't find anything else worth reporting when he checked the IPs. The outstanding accounts still need to be blocked. Note that the Jdecker account was added after the check was performed. Nathan  T 15:34, 25 May 2009 (UTC)

Remaining accounts blocked. Peter Symonds ( talk ) 21:55, 26 May 2009 (UTC)
 * Conclusions

Report date June 7 2009, 18:27 (UTC)

 * Suspected sockpuppets
 * Used to circumvent a block and harass User:MichaelQSchmidt on Michael Q. Schmidt
 * TOR Node used to circumvent a block (exact same verbiage as previous entries)
 * I thought this was a TOR node at first, but with the more recent edits from the same area, I'm not so sure now. In any case, it was used to circumvent a block and continue to report to WP:ANI
 * Used to make questions in my most recent RfA, but the questions bordered on stuff like "When are you going to stop beating your wife?" (this is a paraphrase to demonstrate the point; he did not ask this specific question, but made loaded statements/questions.)
 * Used to delete a perfectly useful image only because I was in it
 * TOR node used to circumvent a block and revert any edit I made
 * Used to circumvent a block and add me to a list of his sockpuppet accounts.
 * Used to delete a perfectly useful image only because I was in it
 * Confirmed TOR node; no longer TOR apparently used to revert any changes I make
 * Used to test page protection on my talk page; use caution: may be an IANA.org IP address being used as a TOR node. There are some potential problems if you decide to block this address.
 * Comment Actually, the 173/8 space was allocated to ARIN in Feb-2008 and 173.96/11 is Sprint PCS. For some reason, our whois link is not up-to-date. Franamax (talk) 20:10, 16 May 2009 (UTC)
 * Tweakies. Works now (or the servers are grinding to a halt, one or the other :). Franamax (talk) 20:32, 16 May 2009 (UTC)
 * Can't it be both? — BQZip01 —  talk 21:41, 17 May 2009 (UTC)
 * Used to circumvent a block and add me to a list of his sockpuppet accounts.
 * Used to delete a perfectly useful image only because I was in it
 * Confirmed TOR node; no longer TOR apparently used to revert any changes I make
 * Used to test page protection on my talk page; use caution: may be an IANA.org IP address being used as a TOR node. There are some potential problems if you decide to block this address.
 * Comment Actually, the 173/8 space was allocated to ARIN in Feb-2008 and 173.96/11 is Sprint PCS. For some reason, our whois link is not up-to-date. Franamax (talk) 20:10, 16 May 2009 (UTC)
 * Tweakies. Works now (or the servers are grinding to a halt, one or the other :). Franamax (talk) 20:32, 16 May 2009 (UTC)
 * Can't it be both? — BQZip01 —  talk 21:41, 17 May 2009 (UTC)
 * Comment Actually, the 173/8 space was allocated to ARIN in Feb-2008 and 173.96/11 is Sprint PCS. For some reason, our whois link is not up-to-date. Franamax (talk) 20:10, 16 May 2009 (UTC)
 * Tweakies. Works now (or the servers are grinding to a halt, one or the other :). Franamax (talk) 20:32, 16 May 2009 (UTC)
 * Can't it be both? — BQZip01 —  talk 21:41, 17 May 2009 (UTC)


 * Used to circumvent a block and continue to report to WP:ANI
 * Used to circumvent a block
 * Used to circumvent a block and, again, another one from Virginia
 * Used to circumvent a block
 * Used to circumvent a block and, again, another one from Virginia
 * Used to circumvent a block and, again, another one from Virginia


 * Evidence submitted by BQZip01

See user contributions (generally minimal and evident of a pattern) and comments below each.


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users

It should be noted that I believe one IP address was a block evasion designed to influence an RfA (mine). Others have had similar motives. This was requested previously with the last WP:SPI report, but none of the IPs appear to have been checked. So this is a second request. Requested by — BQZip01 —  talk 18:27, 7 June 2009 (UTC)
 * CheckUser requests

Most of the IPs have stale edits. The only possible IPs that could be checked are : Of these IPs, their edits are a few months in the past and given the wide range of IPs that have edited, it's likely that TomPhan has already changed IPs and there would be no benefit to blocking the IPs. Also, checkuser logs are only visible to a checkuser, so a check may have already been performed during the previous case by Luna Santin. Icestorm815 •  Talk  19:11, 8 June 2009 (UTC)
 * Clerk, patrolling admin and checkuser comments
 * Conclusions

Report date June 11 2009, 01:31 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by BQZip01

Same pattern of behavior intending to disrupt. Their first edit is to a disambiguation page related to previous discussions. — BQZip01 — talk 01:31, 11 June 2009 (UTC)
 * Shows significant familiarity with Wikipedia (edit summary and mentioning MOS) from the first edit then goes to other disambiguation pages; edit summaries in all. Other possible sockpuppeteers mentioned by another user on WP:ANI. — BQZip01 —  talk 15:27, 11 June 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * I am not sure why my user page 'links here'. but this seems very serious.  I am only trying to edit, not cause any problems.  My IP address is: 12.50.75.194.  Please tell me how I can clear this up.  This does not seem like a friendly enviroment.  I cannot contact the editor here on his talk page.  I do not have an 'edit this page' button when there to discuss this with him.  BQZip01 what is the issue?  It seems like no one else can edit on the 'BQ' page. Grandma Dottie (talk) 10:23, 11 June 2009 (UTC)
 * Logged out to confirm my IP address. On reflection, maybe this site is not for me if my editing here is going to cause so much controversy.  Investigate as you wish, I think I will find another site to help out at. 12.50.75.194 (talk) 10:26, 11 June 2009 (UTC)


 * Comments by other users
 * User:Grandma Dottie has been blocked pending the outcome of the checkuser off of this case . Except, checkuser has been declined for lack of evidence. And now, the bringer of this SSI is stating innocence has to be proved by checkuser before the user can be unblocked . One of two things should happen; either User:Grandma Dottie gets unblocked now, or the checkuser is done anyway despite the lack of evidence. --Hammersoft (talk) 20:02, 11 June 2009 (UTC)
 * I never said that "innocence must be proved by checkuser before the user can be unblocked", that was a paraphrase of what the blocking admin stated; it was a condition of the block in the first place. — BQZip01 —  talk 20:38, 11 June 2009 (UTC)
 * I have been caught in the wide net of the accuser's witch hunt here. This is not the first time the accuser has gone on such an unfounded witch hunt and would like for it to be noted here.  It seems this person's logic is that innocence must be proven by everyone in the community. ThreeE (talk) 20:25, 11 June 2009 (UTC)
 * Your name is not noted at the top. — BQZip01 —  talk 20:40, 11 June 2009 (UTC)

Requested by — BQZip01 —  talk 01:31, 11 June 2009 (UTC)
 * CheckUser requests


 * Clerk, patrolling admin and checkuser comments


 * : Appears to be insufficient evidence to warrant a checkuser at this time. Nathan  T 02:53, 11 June 2009 (UTC)
 * I disagree, but your call. Please transfer to sockpuppet investigations. — BQZip01 —  talk 14:53, 11 June 2009 (UTC)
 * if CU is declined, the case is automatically placed in the ordinary Sockpuppet queue. It might assist if you could provide diffs which suggest that demonstrate. At present, the sum total of the "evidence" is an assertion that the account is being disruptive in the same way as the master, and the fact that the new accounts first edit was to a page that you had been in dispute with the master about. Is any new account that edits that page a sock?? Mayalld (talk) 14:58, 11 June 2009 (UTC)
 * The previous cases where I brought up IPs were archived upon being declined for a checkuser (see archives)
 * I believe the previous cases clearly show a pattern of behavior. If that is all that is required, I'll be happy to amend or resubmit, please recommend which option is preferable. — BQZip01 —  talk 15:24, 11 June 2009 (UTC)
 * Sorry, but that just isn't how to present an SPI case. It is very possible that the evidence is there to be found, but vaguely pointing to prior cases and contributions histories, and making claims that are not substantiated by diffs does not amount to evidence. It amounts to an allegation. Without evidence, cases don't progress. Mayalld (talk) 15:31, 11 June 2009 (UTC)
 * It was enough the last time I submitted a case, but I'd be happy to provide more info. Would it be better just to open another case, re-present it up top, or put it down here? — BQZip01 —  talk 18:03, 11 June 2009 (UTC)
 * On the first case, the allegation was made that you were being stalked, and that death threats were being made. Such cases are rightly taken very seriously, and clerks/CUs will make a special effort to get the case sorted even if you omit to get all the necessary information in place. Here, there is no such allegation, and I really don't think it is asking too much to expect that you spend the time to draw together the evidence for an admin to review, rather than expecting the reviewing admin to go out hunting for the evidence. Mayalld (talk) 18:54, 11 June 2009 (UTC)
 * I guess I could have been more clear. Where do you want me to put the information? — BQZip01 —  talk 19:40, 11 June 2009 (UTC)


 * : I definitely agree with Mayalld about the need for some significant evidence prior to a CU (significant as opposed to none or evidence which does not signify a connection). On the other hand, since this account has actually been blocked in the absence of such evidence (aside from a comment that reflects prior knowledge of a sockfarm, and an edit to the page BQ) I've decided to endorse the CU request so that the block can be substantiated. Nathan  T 20:16, 11 June 2009 (UTC)


 * Conclusions
 * - I've unblocked User:Grandma Dottie because the CU evidence suggests she is unrelated to the other party. Jdecker2010 is . -- Versa geek  20:38, 11 June 2009 (UTC)
 *  Sy  n 20:58, 11 June 2009 (UTC)


 * Note after closure User:Grandma Dottie was later found to be a sockpuppet of User:ThreeE: Sockpuppet_investigations/Grandma_Dottie/Archive — BQZip01 —  talk 15:29, 12 October 2009 (UTC)

Report date October 12 2009, 13:45 (UTC)

 * Suspected sockpuppets


 * Evidence submitted by BQZip01

Summary: disruptive behavior consistent with previous harassment (previous death threats, accusations of various felonies, etc have been oversighted). Previous sockpuppets also "dogpiled" on any opposition to my edits. This is not to say that I have any specific issue, other than disagreement, with any other registered user. Though their edits were the same, these edits were an attempt to bypass WP:3rr/harrass me personally=disruptive.

Most recent activity is IP vandalism/sockpuppetry attempting to diverge a previous discussion. Attempts to discuss the matter have simply been ignored and erased. I believe these IPs to be sockpuppets of a prolific sockpuppeteer attempting to get me blocked for WP:3rr. This fits previous modus operandi of this user: using multiple IP addresses to simply contravene any changes I make:. Please also note that these are the sole changes in Wikipedia by either of these IP addresses, they demonstrate a significant knowledge of policy/guidelines in their edit summaries, and they both originate in Reston, VA off of a Sprint account, the same as previous attempts of IP sockpuppetry. A request for semi-protection of the page has also been filed in conjunction with this request. — BQZip01 — talk 13:45, 12 October 2009 (UTC)


 * Comments by accused parties    See Defending yourself against claims.


 * Comments by other users


 * Clerk, patrolling admin and checkuser comments


 * Mind outlining what you'd like to see from this case? Doesn't look like a rangeblock would be that helpful, and I sort of doubt that VPP is going to be semiprotected (certainly not for long). RBI might be the only workable long-term method for handling IP edits that are suspected to be from TomPhan. Nathan  T 20:49, 13 October 2009 (UTC)

I placed a short block on 70.4.68.37; the other one I've left alone as these IPs are quickly being reassigned. I also don't think there can be much else done here as rangeblocking is out of the question. MuZemike 20:57, 13 October 2009 (UTC)
 * Conclusions

Evidence submitted by BQZip01
Fits the usual pattern to a "T": disrupt a targeted individual with multiple accounts and a few minimal edits to other pages to deflect blame. Note the clear understanding of WP policy, edit summary usage, "undo" usage, etc:

Other related edits by the same person:

All I am asking for is a finding that this user is the same as the others so his/her inflamatory/unhelpful comments can be appropriately removed (de facto banned users are not allowed to contribute) and IP talk pages appropriately annotated as a source of sockpuppeteering, but any blocks of the IPs are worthless and I would oppose them as they could impact legit users; an indef block of Textpro would be appropriate. A checkuser is a waste of time as this person clearly appears to be hopping IPs (another trait). — BQZip01 — talk 07:52, 29 December 2009 (UTC)

Comments by accused parties
See Defending yourself against claims.

Conclusions
Blocked and tagged. –MuZemike 20:21, 2 January 2010 (UTC)