The Four Deuces (talk | contribs) |
88.108.218.93 (talk) |
||
Line 195: | Line 195: | ||
:Since I posted, an IP who [http://en.wikipedia.org/w/index.php?title=User_talk:Lothar_von_Richthofen&diff=prev&oldid=412195414 claims to be mark nutley] [http://en.wikipedia.org/w/index.php?title=Left-wing_terrorism&action=historysubmit&diff=413759662&oldid=413704015 has begun to edit the article]. [[User:The Four Deuces|TFD]] ([[User talk:The Four Deuces|talk]]) 21:54, 13 February 2011 (UTC) |
:Since I posted, an IP who [http://en.wikipedia.org/w/index.php?title=User_talk:Lothar_von_Richthofen&diff=prev&oldid=412195414 claims to be mark nutley] [http://en.wikipedia.org/w/index.php?title=Left-wing_terrorism&action=historysubmit&diff=413759662&oldid=413704015 has begun to edit the article]. [[User:The Four Deuces|TFD]] ([[User talk:The Four Deuces|talk]]) 21:54, 13 February 2011 (UTC) |
||
::Yes i did mate, because yourself and siebert were being dicks, you got a guy blocked for following policy when the two of you edit warred unsourced content into an article. Have a nice day :) Mark. |
Revision as of 21:59, 13 February 2011
Suspected open proxies to be checked
74.115.214.158
74.115.214.158 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits. On The Fugitive: Plan B the IP user added the same (possible copyrighted) content as an IP blocked as proxy. TbhotchTalk C. 04:52, 4 November 2010 (UTC)
- This has WP:DUCK written all over it. I'll award a barnstar to anyone who can find how to edit from 74.115.214.152/29. -- zzuuzz (talk) 09:02, 4 November 2010 (UTC)
- In fact, I am already working on it, see User:Petri Krohn/Pink proxy. I know four people who can give you the answer. I have posed the question to one of them. Another is a nice lady in California, who gives away puppies. (Ever wonder how Snoopy lost contact with his siblings?) I do not know If I want to write to her, but will you give me half a barnstar if I give you her email address? In fact most of the information can be reached from the now deleted sock puppet investigation. If you have a look at it, could you please retrieve the IP address of the proxy server in Ghana? -- Petri Krohn (talk) 22:29, 4 November 2010 (UTC)
- Try this: http://www.easy-hide-ip.com/
- In fact I was thinking this might be http://www.hide-ip-soft.com , but this is the information I received from the blocked user. -- Petri Krohn (talk) 03:50, 5 November 2010 (UTC)
The company web site has an image of the user interface. The user gets to choose his IP address from a list. From the small print I can make out these.
- UK
- 81.94.201.0/24 – Gosport, England (Redstation Limited)
81.94.201.83 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 81.94.201.87 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 81.94.201.90 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 93.174.138.0/24 – Derby, England (Node4 UK Hosting)
93.174.138.36 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 93.174.138.245 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 77.245.75.0/24 – Gosport, England (Redstation Limited)
77.245.75.53 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 77.245.75.50 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- USA
- 67.219.51.0/24 Pittsford, New York (Rackwire.com)
67.219.51.110 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 67.219.51.112 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 67.219.51.116 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 67.219.51.124 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 67.219.51.123 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
I do not remember how and from which of the 50 pages I have open I got this from, but it says that 93.174.81.194 is a proxy on port 3128 93.174.81.194 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
This may also be related. Note the interest in Talk:Jessica_(entertainer):
-- Petri Krohn (talk) 04:36, 5 November 2010 (UTC)
- 93.174.81.194 is already blocked as an open proxy on 3128. Sailsbystars (talk • contribs • email) 04:41, 5 November 2010 (UTC)
- Yeah, It seems to be unrelated. I guess it showed up on the Singapore evidence and looked suspicious. -- Petri Krohn (talk) 05:18, 5 November 2010 (UTC)
78.107.237.16
78.107.237.16 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Off-wiki evidence indicates that these proxies have been used to anonymously procure the same or similar services that is being offered for sale through the proxy network i am investigating. I collected the IP addresses in the 70 first Google search results and checked if they had already been blocked, most were blocked as proxies or Tor nodes. These are however unblocked, most seem to be Tor nodes. I will post the Goolgle search string here, unless someone objects. -- Petri Krohn (talk) 23:52, 4 November 2010 (UTC)
As no one objected I will post the Google search string here: "to Earn SG$200/Hour" "IP:" site:sgadsonline.com -- Petri Krohn (talk) 05:33, 5 November 2010 (UTC)
- 69.91.223.154
- 69.91.223.154 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 66.215.42.157
- 66.215.42.157 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 79.88.47.195
- 79.88.47.195 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 80.79.126.30
- 80.79.126.30 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 81.17.91.122
- 81.17.91.122 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 87.89.74.135
- 87.89.74.135 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 88.86.122.153
- 88.86.122.153 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 95.27.150.240
- 95.27.150.240 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 173.193.219.190
- 173.193.219.190 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 173.255.213.207
- 173.255.213.207 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 212.227.101.236
- 212.227.101.236 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 213.112.111.205
- 213.112.111.205 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
92.28.80.16
92.28.80.16 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: A pattern of attacks on User talk:Diannaa, all coming from different IP ranges. Most edits have been oversighted. Self-declared vandal: [1] All the IPs are in different geographic locations, so this is obviously some proxying service. -- Petri Krohn (talk) 00:25, 7 November 2010 (UTC)
46.112.227.105 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 75.89.172.38 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 89.243.224.54 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 142.24.53.213 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 188.33.56.32 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
66.197.250.197
66.197.250.197 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: open proxy. area-53.co.cc/ --Gordonrox24 | Talk 05:48, 2 February 2011 (UTC)
- 85.17.239.31 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan at [2] --Gordonrox24 | Talk 05:54, 2 February 2011 (UTC)
- 97.74.215.130 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan at [3] --Gordonrox24 | Talk 06:01, 2 February 2011 (UTC)
- 66.197.250.197 (talk · contribs · WHOIS) and 97.74.215.130 (talk · contribs · WHOIS) are caught up in indef rangeblocks on their hosting providers from 2008. 85.17.239.31 (talk · contribs · WHOIS) was blocked for five years a few days ago. All are, of course, confirmed. Sailsbystars (talk) 13:05, 2 February 2011 (UTC)
- The above IPs have all been blocked. The site at 85.17.239.31, hidegator.com, actually offers to do proxying for you. A Google search for hidegator.com brings up http://www.robtex.com/ip/85.17.222.10.html, which is incriminating for that IP as well. 85.17.222.10 is currently blocked by Zzuuzz. Since the ISP is a /16 range, and a number from that range are now individually blocked, how about blocking all of 85.17.0.0/16? EdJohnston (talk) 17:04, 2 February 2011 (UTC)
- You will get one seriously pissed off sysadmin from their security department on your case[4][5], but it's something I'd love to do again. :) -- zzuuzz (talk) 17:31, 2 February 2011 (UTC)
- Point taken. EdJohnston (talk) 18:18, 2 February 2011 (UTC)
- You will get one seriously pissed off sysadmin from their security department on your case[4][5], but it's something I'd love to do again. :) -- zzuuzz (talk) 17:31, 2 February 2011 (UTC)
- The above IPs have all been blocked. The site at 85.17.239.31, hidegator.com, actually offers to do proxying for you. A Google search for hidegator.com brings up http://www.robtex.com/ip/85.17.222.10.html, which is incriminating for that IP as well. 85.17.222.10 is currently blocked by Zzuuzz. Since the ISP is a /16 range, and a number from that range are now individually blocked, how about blocking all of 85.17.0.0/16? EdJohnston (talk) 17:04, 2 February 2011 (UTC)
- 66.197.250.197 (talk · contribs · WHOIS) and 97.74.215.130 (talk · contribs · WHOIS) are caught up in indef rangeblocks on their hosting providers from 2008. 85.17.239.31 (talk · contribs · WHOIS) was blocked for five years a few days ago. All are, of course, confirmed. Sailsbystars (talk) 13:05, 2 February 2011 (UTC)
78.159.105.106
78.159.105.106 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
The first IP may be User:Marknutley, who is blocked for using open proxies to evade a block and was recently refused an unblock request by ArbCom. It uses the same writing style and viewpoint. The IP appears on a list at the "Stop spam forum".[6] TFD (talk) 17:03, 13 February 2011 (UTC)
Reason: Suspicious edits
- Query: Is there a second IP you are referring to or just the one? This one doesn't show up in robtex blacklists and isn't open on the standard proxiy ports. There is another IP on the range with similar edits (78.159.105.31 (talk · contribs · WHOIS)), so this looks to me like a normal dynamic range editor. On a note unrelated to proxy/notproxy, the IP originates from Germany, which I don't believe the location of the individual you think this is. Sailsbystars (talk) 18:36, 13 February 2011 (UTC)
- I am not adept in the technical issues. However, there are services that provide users with a variety of IP addresses from around the world, that can hide their location. Here is a link to a previous similar investigation. The editor is obviously not German and uses idiomatic estuary English, e.g., "It is POV due to you and your mate dicking about...." TFD (talk) 19:00, 13 February 2011 (UTC)
- Without knowing the details of this apparent anonymiser application,
Looks like a duck to me -- zzuuzz (talk) 19:02, 13 February 2011 (UTC)
- Without knowing the details of this apparent anonymiser application,
- I am not adept in the technical issues. However, there are services that provide users with a variety of IP addresses from around the world, that can hide their location. Here is a link to a previous similar investigation. The editor is obviously not German and uses idiomatic estuary English, e.g., "It is POV due to you and your mate dicking about...." TFD (talk) 19:00, 13 February 2011 (UTC)
- The IP's tagging of Left-wing terrorism[7][8] is similar to an earlier tagging by mark nutley of Right-wing terrorism: "Certain sections of this article are nowere near neutral, hence the tag. I`ll go through the sources used as the first one i checked did not support the statement it is used for".[9] TFD (talk) 20:54, 13 February 2011 (UTC)
Um - a clear case of "I don't like the edit, therefore will accuse the IP of being a sock" which is all too common. And asserting that Germans can not write English is an absurd source for the assertion that the person is an American who is somehow using a German IP address. Germans write fairly good English as a rule. Collect (talk) 21:40, 13 February 2011 (UTC)
- Since I posted, an IP who claims to be mark nutley has begun to edit the article. TFD (talk) 21:54, 13 February 2011 (UTC)
- Yes i did mate, because yourself and siebert were being dicks, you got a guy blocked for following policy when the two of you edit warred unsourced content into an article. Have a nice day :) Mark.