Jump to content

Wikipedia:Abuse response/Grawp IPs

Add links
From Wikipedia, the free encyclopedia
This is an archived case at Abuse Response.
The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes.
You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.


IPs

[edit]

ATTENTION: Any IP striked out has either been reported or rejected. GO-PCHS-NJROTC (talk) 02:48, 19 April 2008 (UTC)[reply]

All of these IPs are suspected to have been used by Grawp (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log), a serial vandal and sockpuppeteer.--Urban Rose 15:57, 13 April 2008 (UTC)[reply]

Discussion

[edit]

Whoa! Was there a checkuser involved here? That's a lot of IPs in a lot of different ranges! If that's all the same person, those IPs are all zombie computers and should be blocked for at least one year (except the dynamic ones). Yes, they most surely need to be reported if they are zombies, they're probably sending a ton of email spam too. So, was there a checkuser? GO-PCHS-NJROTC (talk) 22:24, 15 April 2008 (UTC)[reply]

I'll might take this one on tomarrow if I can remember to. If someone else desires to investigate and/or make contact, feel free. GO-PCHS-NJROTC (talk) 02:23, 16 April 2008 (UTC)[reply]

Accepted for investigation by GO-PCHS-NJROTC (talk) 12:20, 16 April 2008 (UTC)[reply]

Just to note, open proxies are not necessarily zombie computers. I suggest running all the IP addresses through a port scanner (like Nmap), and check for proxies. Nwwaew (Talk Page) (Contribs) (E-mail me) 02:16, 19 April 2008 (UTC)[reply]
Okay, that sounds sensible. GO-PCHS-NJROTC (talk) 03:01, 19 April 2008 (UTC)[reply]
Added another IP that attacked Jack Merridew's Indonesian-Wikipedia userpage ([1]); as Grawp has attacked Merridew in the past I have little reason to believe it isn't him. -Jéské (v^_^v E pluribus unum) 17:43, 5 May 2008 (UTC)[reply]
I won't be portscanning any of those since portscanning violates my ISP's AUP except when express permission is given by the party being portscanned. I don't want Grawp to get me disconnected; my mother would (not literally, it's just a figure of speech) kill me. If anyone else wants to scan the IPs, please do so and post the results here. GO-PCHS-NJROTC (Messages) 20:50, 2 June 2008 (UTC)[reply]

Have you finished the investigation? if so ill contact the ISP but ill report as serpate IP with a suspected link Prom3th3an (talk) 08:14, 29 May 2008 (UTC)[reply]

I've finished the investigation. Although there are some ISPs that show up more than once here, each of these IPs are on different networks for the most part. The contactor pretty much has to investigate for him/herself in this case. The ones crossed out have already been reported. Have fun (if you can)! GO-PCHS-NJROTC (Messages) 20:44, 2 June 2008 (UTC)[reply]
Are we sure grawp uses all these IPs, cause some of them a quite geograpahicaly distant from each other   «l| Ψrom3th3ăn ™ |l»  12:32, 4 June 2008 (UTC)[reply]
I was wondering that myself. I'm guessing that A. these are all open proxies or zombies B. these are all copy cats. GO-PCHS-NJROTC (Messages) 02:01, 12 June 2008 (UTC)[reply]
Have they been reported for open proxy checking? if not i think we should. I cannot see an ISP taking action agaisnt a proxysite..... and most proxy sites wont co-operate. thoughts?   «l| Ψrom3th3ăn ™|l»  (talk) 08:55, 14 June 2008 (UTC)[reply]
Another thing of concern is 134.139.148.150 is the California State University, Long Beach. The chances of grawp using that are extremly low (unless he goes to that uni). If they are copycats they must be treated seperatly   «l| Ψrom3th3ăn ™|l»  (talk) 08:57, 14 June 2008 (UTC)[reply]
If they're zombies that are infected with a virus, they might not be all that easy to detect as open proxies. ISPs will certainly take action if we are talking about a computer participating in a bot net due to a virus; the majority of all actions taken by ISP abuse departments have to do with spam bots, and the accounts reported are hardly ever that of the actual spammer. ISPs don't terminate accounts because of zombie viruses; they warn and suspend (termination is indef, suspension is temporary). If Grawp is a hacker that is infecting computers with a virus, then Wiki vandalism may not be his only specialty. GO-PCHS-NJROTC (Messages) 16:42, 15 June 2008 (UTC)[reply]
This still doesnt sit well, i dont think we have enough to tie all these Ip's together   «l| Ψrom3th3ăn ™|l»  (talk) 11:42, 3 July 2008 (UTC)[reply]

Major vandalism over at CreationWiki by user Grawp with IP 71.107.163.121. Not sure if it is the same guy. --Tony. —Preceding unsigned comment added by 76.104.136.65 (talk • contribs) at 02:24, 30 July 2008 (UTC)[reply]

It seems that our friend has discovered CreationWiki [2]. The address is indefblocked there [3], but I see no edits or log entries [4]. Is that IP blocked because it was the address Grawp used?
On the English Wikipedia, this address was used to remove NFimageoveruse tags from articles (see edits). One of those articles is Monsters of Final Fantasy‎. Grawp is known to have an interest in Final Fantasy (see Ageslimit account). Note that the edits were done on March 27 and 29, and that the user made a (third) unblock request on April 26. Unless the user left his/her computer on and connected for almost a month, I doubt this IP is dynamically assigned. Then again, a large part of the activity comes from 71.107.*.* addresses. They might be assigned to a group of public computers? Cheers, Face 09:53, 30 July 2008 (UTC)[reply]
Please note that this case was unoffically declared stale, due to the fact that Grawp is like smoke, all of these IP adresses are no doubt open proxies and are untouchable. Might I suggest you don't waste your time.
Heres the real deal "Grawp" is someone who posts on 4chan.com and asks people to edit pages. More often than not he will edit a page and then post a link to the edit history page and ask users to click "save page". SO those arent zombies or proxies, they are just many users following one guy who's spamming this stuff — Preceding unsigned comment added by 76.94.85.147 (talk • contribs) 19:33, August 15, 2008
That's only the tip of the iceberg, 76. -Jéské (v^_^v Bodging WP edit by edit) 20:16, 19 August 2008 (UTC)[reply]
To Face: Actually, now that you bring up Final Fantasy, another user came to me with evidence that suggests we know Grawp and have known him for years. -Jéské (v^_^v Bodging WP edit by edit) 20:19, 19 August 2008 (UTC)[reply]
because most of those IP's are dynamic and probably stale. Whats was the they are geographically sparse. We have nothing that links the IPS together except similar vandalism (AKA Grawp Vandalism) and when not united together most have only been blocked for 3-4 times which is hardly sufficent to get an ISP to act.   «l| Ψrom3th3ăn ™|l»  (talk) 01:04, 23 August 2008 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Abuse_response/Grawp_IPs&oldid=1144114932"