| IP address |
user |
talk |
edits |
log |
scan |
block |
Notes
|
| 207.157.9.133
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
User:207.157.9.133 (
Special:Contributions/207.157.9.133 |
Special:Blockip/207.157.9.133) is listed on the NJABL list (
http://www.njabl.org/cgi-bin/lookup.cgi?query=207.157.9.133) for the following types of proxies which I checked when they vandalized
Louisiana: Open proxy.
ClueBot 14:02, 7 September 2007 (UTC)
reply
- A lot of open ports, but none are standard proxy ones. —
Crazytales
talk/
desk 15:14, 9 September 2007 (UTC)
reply
-
 Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 219.95.168.126
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
User:219.95.168.126 (
Special:Contributions/219.95.168.126 |
Special:Blockip/219.95.168.126) is listed on the NJABL list (
http://www.njabl.org/cgi-bin/lookup.cgi?query=219.95.168.126) for the following types of proxies which I checked when they vandalized
Hygiene: Open proxy.
ClueBot 13:06, 7 September 2007 (UTC)
reply
- Open on 21, 23, and 80. I can't telnet to it. It would appear that the ports are open for a cable modem's webmin interface. —
Crazytales
talk/
desk 15:14, 9 September 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 65.64.97.1
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
User:65.64.97.1 (
Special:Contributions/65.64.97.1 |
Special:Blockip/65.64.97.1) is listed on the NJABL list (
http://www.njabl.org/cgi-bin/lookup.cgi?query=65.64.97.1) for the following types of proxies which I checked when they vandalized
Zircon: Open proxy.
ClueBot 00:56, 6 September 2007 (UTC)
reply
- Only open port is 22, for SSH. I'm not trying to bruteforce it. —
Crazytales
talk/
desk 15:14, 9 September 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 199.60.112.15
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
User:199.60.112.15 (
Special:Contributions/199.60.112.15 |
Special:Blockip/199.60.112.15) is listed on the AHBL list (
http://www.ahbl.org/tools/lookup.php?ip=199.60.112.15) for the following types of proxies which I checked when they vandalized
Best Buy: DDoS Drone.
ClueBot 21:12, 5 September 2007 (UTC)
reply
- Registers to Future Shop in Canada, which is owned by Best Buy. Bored employee is my diagnosis.—
Crazytales
talk/
desk 01:56, 9 September 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 88.86.31.1
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
ISP based in Syria, DNS seems to resolve to Jordan? --
Avi 19:16, 4 September 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 160.94.148.235
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Part of a series of IPs who added the same spam link over 15 minutes or so, some of which have already been blocked as proxies. Located on a variety of different continents, so proxies are even more likely. See
WT:WPSPAM#http://spam.drug3k.com.
MER-C 09:01, 13 August 2007 (UTC)
reply
- Appears to be the University of Minnesota's mail server. A whole mess of open ports, including 5900. —
Crazytales
(t.) 16:05, 17 August 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 129.170.61.29
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Part of a series of IPs who added the same spam link over 15 minutes or so, some of which have already been blocked as proxies. Located on a variety of different continents, so proxies are even more likely. See
WT:WPSPAM#http://spam.drug3k.com.
MER-C 09:01, 13 August 2007 (UTC)
reply
- A Dartmouth University webserver. No proxy. —
Crazytales
talk/
desk 21:23, 8 September 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 219.74.20.128
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
No description given, also no proxy. —
Crazytales (public computer)
(talk)
(main) 16:31, 20 August 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 68.199.178.194
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
One of 13 IPs making a coordinated attack on Meta pages within a few minutes of each other. IPs are registered to ISPs on different continents, making an open proxy a likely explanation. --
A. B.
(talk) 13:18, 21 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 68.225.178.219
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
One of 13 IPs making a coordinated attack on Meta pages within a few minutes of each other. IPs are registered to ISPs on different continents, making an open proxy a likely explanation. --
A. B.
(talk) 13:18, 21 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 69.246.169.86
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
One of 13 IPs making a coordinated attack on Meta pages within a few minutes of each other. IPs are registered to ISPs on different continents, making an open proxy a likely explanation. --
A. B.
(talk) 13:18, 21 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 70.107.121.32
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
One of 13 IPs making a coordinated attack on Meta pages within a few minutes of each other. IPs are registered to ISPs on different continents, making an open proxy a likely explanation. --
A. B.
(talk) 13:18, 21 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 72.196.209.51
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
One of 13 IPs making a coordinated attack on Meta pages within a few minutes of each other. IPs are registered to ISPs on different continents, making an open proxy a likely explanation. --
A. B.
(talk) 13:18, 21 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 74.130.197.99
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
One of 13 IPs making a coordinated attack on Meta pages within a few minutes of each other. IPs are registered to ISPs on different continents, making an open proxy a likely explanation.
Blacklisted by SORBS. --
A. B.
(talk) 13:18, 21 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 85.8.2.168
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
One of 13 IPs making a coordinated attack on Meta pages within a few minutes of each other. IPs are registered to ISPs on different continents, making an open proxy a likely explanation. --
A. B.
(talk) 13:18, 21 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 219.64.185.7
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Please see
Administrators' noticeboard/Incidents for details. —
N96 (
talk) 05:43, 17 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 125.99.225.216
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Please refer case to 219.64.185.7. —
N96 (
talk) 05:46, 17 June 2007 (UTC)
reply
- Hathway broadband IP, Mumbai India. No rDNS. —
Crazytales
(talk)
(alt) 17:47, 18 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 219.64.148.125
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Please refer case to 219.64.185.7. —
N96 (
talk) 05:51, 17 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 125.16.143.133
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Please refer case to 219.64.185.7. —
N96 (
talk) 05:53, 17 June 2007 (UTC)
reply
- Bharti Infotel IP, Mumbai India. No rDNS. —
Crazytales
(talk)
(alt) 17:47, 18 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 124.125.229.94
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Please refer case to 219.64.185.7. —
N96 (
talk) 05:53, 17 June 2007 (UTC)
reply
- Reliance Infocomm broadband IP, Mumbai India. No rDNS. —
Crazytales
(talk)
(alt) 17:47, 18 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 219.64.151.135
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Please refer case to 219.64.185.7. —
N96 (
talk) 05:54, 17 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 219.64.66.150
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Please refer case to 219.64.185.7. —
N96 (
talk) 16:44, 17 June 2007 (UTC)
reply
- All the 219.64.0.0/16 ip's are from the same dynamic dialup ISP, Videsh Sanghar Nigam ltd, Mumbai India. All except 219.64.151.135 have multiple RBL listings, leading me to think it's a dynamic proxy. A 219.64.0.0/16 range block should take care of it. —
Crazytales
(talk)
(alt) 17:47, 18 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 203.221.6.70
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
And the three below (82.0.115.196, 200.126.74.123, 75.167.157.106). I just don't trust this. On commons
http://commons.wikimedia.org/?title=User:MiLoXo&action=edit user MiLoXo this afternoon uploaded a handfull of pictures, and now these 4 totally unrelated IPs are suddenly adding the pictures to documents on en.wikipedia. These pages are under monitor by an IRC-bot I am running because they are under a continuous attact by sockpuppets of
user:JB196 (
Wikipedia:Long_term_abuse/JB196). --
Dirk Beetstra
T
C 17:04, 11 June 2007 (UTC)
reply
- Australian IP. —
Crazytales (public computer)
(talk)
(main) 12:28, 13 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 82.0.115.196
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
See 203.221.6.70, above. --
Dirk Beetstra
T
C 17:04, 11 June 2007 (UTC)
reply
- British IP. —
Crazytales (public computer)
(talk)
(main) 12:28, 13 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 200.126.74.123
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
See 203.221.6.70, above. --
Dirk Beetstra
T
C 17:04, 11 June 2007 (UTC)
reply
- Multiple RBL records point to it being an open proxy or compromised system. Chilean IP. —
Crazytales (public computer)
(talk)
(main) 12:23, 13 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 75.167.157.106
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
See 203.221.6.70, above. --
Dirk Beetstra
T
C 17:04, 11 June 2007 (UTC)
reply
- IP from Colorado. —
Crazytales (public computer)
(talk)
(main) 12:28, 13 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 67.85.129.5
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
cross-wiki vandalbot similar to the recently blocked 69.201.128.247. Spams pages with names like "w/w/" (If cross-wiki search function doesn't work, see this
example.) --
A. B.
(talk) 02:15, 10 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 87.117.196.237
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Unblocked IP for an Anonymous Web Proxy (
[1]).
Madmikeuk needs more cowbell. 13:22, 4 June 2007 (UTC)
reply
- Already blocked within 87.117.192.0/18 range. —
Centrx→
talk • 04:47, 5 June 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 74.228.91.7
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
As with the reports below, this IP relates to the same incidents where a number of IP addresses apparently from different parts of the world have been adding the same nonsense to articles relating to Jerry Falwell and Baptists. Several turned out to be open proxies. If this one isn't, then he's spoofing the IP from somewhere, just like he did for 72.20.2.30 below. See edit history for
In Touch Ministries for an example of identical vandal edits from different IP addresses. And in
this edit he boasts about being able to spoof any address. =
Axlq 06:57, 18 May 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 87.244.80.169
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Reported as a possible sockpuppet, but the suspected sockmaster is not in the same /8.
Jesse Viviano 14:36, 16 May 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 62.3.32.55
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Used by banned user Artaxiad who used a lot of proxies, I blocked it but got an e-mail requesting unblocking saying it was in Saudi Arabia (but whois says UK?). Unblocked pending verification.
Thatcher131 12:55, 16 May 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 85.214.40.81
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Bizzare that a computer called extreesports.net, making edits to
Scotch Plains, NJ, registers to
Berlin,
Germany
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 82.168.59.236
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Block-evading, open proxy using sockpuppeteer/vandal Burak18.
A
ecis
Brievenbus 22:42, 13 May 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 193.69.167.130
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Block-evading, open proxy using sockpuppeteer/vandal Burak18.
A
ecis
Brievenbus 22:42, 13 May 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 203.218.106.196
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Same as below. --
Consumed Crustacean (
talk) 07:51, 12 May 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 58.10.68.149
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Same as below. --
Consumed Crustacean (
talk) 02:33, 12 May 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 124.120.219.177
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Same as below. --
Consumed Crustacean (
talk) 02:33, 12 May 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 61.91.220.151
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
IP-switching political vandal. --
Consumed Crustacean (
talk) 02:29, 12 May 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 124.120.222.189
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
IP-switching political vandal --
Consumed Crustacean (
talk) 02:27, 12 May 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 58.10.167.79
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
IP-switching political vandal --
Consumed Crustacean (
talk) 02:27, 12 May 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 64.5.146.13
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
IP is registered to a PBS TV station in Virginia. Recent
edits and vandalism seem a little suspicious.
Mr.Z-man
talk
¢ 23:48, 7 May 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 207.144.70.66
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Loads of vandalism is coming from this address, and the Composite Block List thinks that this IP is an open proxy.
Jesse Viviano 22:00, 27 April 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
| 216.86.146.184
|
user
|
talk
|
edits
|
log
|
RBL-
google-
whois
|
block-
log |
Web proxy-
[2].
Nwwaew (
Talk Page) (
Contribs) (
E-mail me) 18:52, 26 July 2007 (UTC)
reply
- Already blocked. —
Crazytales
talk/
desk 21:23, 8 September 2007 (UTC)
reply
-
Clerk note: Report page has been deleted.
ClueBot IV 02:00, 13 September 2007 (UTC)
reply
|
