Wikipedia:WikiProject on open proxies/Archives/Inconclusive/2011/April

189.17.136.67

189.17.136.67 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Was recently blocked for 2 months (1/15 - 3/15) as a proxy by ProcseeBot (see block log). Shortly after the block expired, began disruptive editing.

Reason: 1RR violation and race baiting on Gilad Shalit. Tzu Zha Men (talk) 00:54, 22 March 2011 (UTC)

Inconclusive... can't even figure out if it's a hosting or service provider. The owner of the block is a person, not a corporation (if I can follow the Brazilian whois properly). Not still open on the original port at least, so not obviously still a proxy... Sailsbystars (talk) 01:36, 22 March 2011 (UTC)

{{inconclusive}}, however I've blocked it because  Looks like a duck to me. -- zzuuzz ^(talk) 15:41, 26 March 2011 (UTC)

175.100.127.94

175.100.127.94 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

175.100.127.94 has made a series of semi-trolling comments (arguing the UN is not a reliable source)[1] to Wikipedia talk:WikiProject Feminism in relation to the Feminist movement article, as well as adding OR to that article[2][3].
This IP is arguing for edits on the basis of original research[4][5][6][7] and making comments that are wild accusations of bad faith directed at the wikiproject as a whole (after a simple policy position was explained), and directly about another editor.[8]
There is an ongoing issue of meat-puppetry relating to articles on feminism from online forums - this may or may not be interrelated.

• The fist red flag about this IP's behaviour is that it highly unusual for a new user to make their first edits on a project talk page.
• Secondly, the IP is cambodian but writes in perfect American-English.
• Third the timing of the edits on WP is between 22:00 and 01:00 UTC which correlate to 3-7 am, Cambodian time.
• A final red flag is the appearence of this IP on two blacklists: Project Honey Pot[9] and LashBack[10]

Thanks for taking the time to read this--Cailil ^talk 14:00, 26 March 2011 (UTC)

Reason: Suspicious edits

I don't see this IP's contributions as showing a lot of bad faith, but this Honeypot report suggests that the machine has been a source of dictionary attacks. It is possible this person is unaware they are editing from a compromised machine. Another person in the same discussion at WikiProject Feminism is editing from 175.100.127.66. Googling that IP leads to the Facebook page of a young woman in Cambodia, who is a recent college graduate. That IP is also a source of free MP3 files, which is fishy. Could this be one or more (fairly) innocent people whose machines got compromised and taken into a botnet? If a block is found necessary, I suggest that the range 175.100.127.0/24 may need to be included. I will leave a note for both IPs that they are being discussed here, and warn them about edit warring. EdJohnston (talk) 16:41, 26 March 2011 (UTC)

{{Inconclusive}} as host is down for now. I will keep an eye out a little while longer. -- DQ (t) (e) 22:19, 26 March 2011 (UTC)

Dear friends at Wikipedia, interesting to see this pop up. I hope this is a chance to call for help in relation to the editors at Project Feminism. They continue to insist on allowing a quote from an old UNIFEM website, which claims that "women do 66% of the world's work", although to date there is no source for that claim. The editors appear to be biased as they will not allow a statement that, the UN Women "does not provide any support for the statement". I am arguing that UN Women is an unreliable source when discussing global figures of women's work- i.e. as a percentage of the whole, because they have no empirical data, nor can they cite any source which has empirical data, to back up this claim.

As regards the following points:

• The fist red flag about this IP's behaviour is that it highly unusual for a new user to make their first edits on a project talk page.

I did and have in fact made several edits on the material in question.

• Secondly, the IP is cambodian but writes in perfect American-English.

There are foriegners from European, north American and other countries who live in southeast asia, no? perhaps you know one of them? Very good that you caught the quality of my English!

• Third the timing of the edits on WP is between 22:00 and 01:00 UTC which correlate to 3-7 am, Cambodian time.

Some of my edits a few days ago were at that time, when I stayed up rather late. May latest edits were around 2 in the afternoon. Care to check?

I have no idea what you are talking about that my machine is compromised. Can you explain? I think that after I read this project honey pot, that part of my IP is random, so it matches some of those other files, but its actually randomly assigned. Wikipedia has a cookie so it always shows up as the same number IP. I suggest that this conflict at Project Feminism be made into a "request for comment". I cannot accept the site to say that 66% of the world's work is done by women, when there is no substantiation of that claim. It amounts to discrimination against men, to without evidence, allow such a claim to be printed in the web page. I challenge the previous poster to justify their claim that including the phrase "but UN Women did not provide evidence to support such claims" (or other similar variations as can be negotiatied), is "original research". I feel more like the tactics of these editors is like social control. 175.100.127.94 (talk) 22:46, 26 March 2011 (UTC)

Thanks for replying. Here are some issues:

1. Could your computer have been compromised by a virus attack? You can see the evidence at Project Honeypot which shows 13 fake emails being sent out from your machine. We will wait for others to comment.
2. You are commenting here as *.94. Do you believe that the edits by IP 175.100.127.66 are also your work?
3. Are you actually a Cambodian geologist? You don't have to answer, but if you do so it might simplify our work here.
4. How will agreement be found about those percentages in Feminist movement? Here you must wait to persuade the others on that talk page. If you keep restoring your preferred version you may be blocked for edit warring. Thanks, EdJohnston (talk) 02:02, 27 March 2011 (UTC)

re:1 yes its possible my computer could have been compromised by a virus attack. Or its possikle that it was another person using the same ISP who was temporarily assigned an IP which I have now been temporarily assigned.

Edits by .66 are also my work. This is clear evidence that my IP changes when I reconnect to the internet.

I am not a Cambodian geologist. Is that from the Facebook recall?  : )

As I see they have not responded to my concerns about this page. To me this is not only a matter of fact but a matter of discrimination. Because claiming that men do only 34% of the work vis a vis women's 66%, is essentially discriminatory if it is not true, and could lead to discriminatory attitudes towards men. Further to me, my recent edit, which showed the data more clearly, by explaining that the work was being compared as a comparison of percentages GREATER THAN 100, is actually better because it was clearer re the HDR 04 data. However, it was deleted by Trekphiler. See I continue to assert that the top section describing the HDR 04 data is MORE CLEAR, MORE ACCURATE representation of the data. Maybe you have some ideas how to resolve this conflict? 175.100.127.94 (talk) 07:21, 27 March 2011 (UTC)

• Thanks for looking it to this Ed and DQ. If you do a whois on 175.100.127.66 it shows up as an 'assigned nonportable' ip. I have no idea if that confirms what this person is saying or not. I agree that it is intirely possible this person is completely innocent but when Robtex is showing 19 blacklistings for *.94[11] and 18 for *.66[12], I tend to worry.
  A note to the IP user. Please read WP:5. Don't edit war, don't insert or argue for original research and please assume good faith by not accusing others of having agendas or in any other way writing about what you assume may be their motivations--Cailil ^talk 17:56, 27 March 2011 (UTC)

Seeing the above evidence, I recommend that we block the range 175.100.127.0/24 for three months anon-only, since we know there are a number of compromised machines in that range. Use WP:ACC if your IP is blocked and you wish to create an account. EdJohnston (talk) 18:43, 27 March 2011 (UTC)