Wikipedia:Abuse response/217.87.x.x

This is an archived case at Abuse Response.
	The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes. You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.

Apparently the same person keeps on coming back to vandalise and be disruptive using this ISP. When one IP is blocked the user gets another dynamic IP.

To block this range, block 217.87.64.0/18 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · block user · block log)
217.87.98.171 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.99.127 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
218.87.59.247 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.61.227 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.125.17 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.59.247 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.61.227 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.98.171 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.99.127 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.125.17 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.65.147 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.88.179 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.122.179 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.77.88 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.76.64 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) IP Blocked and certain edits completely removed due to abusing my real life name.
217.87.126.186 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.66.230 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.83.146 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.75.168 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.112.155 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.87.123.75 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
This is from a different range:
- 217.237.150.208 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
- 217.237.149.145 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
And the user has woken up again:
- 217.87.74.150 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
- 217.87.77.57 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)

Accepted for investigation by GO-PCHS-NJROTC (talk) 00:14, 27 March 2008 (UTC). GO-PCHS-NJROTC WILL NOT BE THE CONTACTOR IN THIS CASE.[reply]

How to contact T COM

It's simple really, just go to their webform at http://www.t-com.de/ip-abuse. GO-PCHS-NJROTC (talk) 00:16, 27 March 2008 (UTC)[reply]

INVESTIGATION COMPLETE, PROCEED TO CONTACT

Ok, since its simple ill take it on Prom3th3an (talk) 10:46, 1 April 2008 (UTC)[reply]

Contact Log

Pending Prom3th3an (talk) 10:46, 1 April 2008 (UTC)[reply]

Status / Outcome

In contact stage, pending first contact Prom3th3an (talk) 10:46, 1 April 2008 (UTC)[reply]

I don't know if anyone is pursuing contacting the ISP, but I have blocked the range for two weeks. --B (talk) 22:41, 2 May 2008 (UTC)[reply]

I am «l| Ψrom3th3ăn ™ |l» 01:32, 8 June 2008 (UTC)[reply]

Now the same one is in the 217.237.xxx.xxx. range again

217.237.151.117 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.237.150.117 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.237.150.118 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.237.149.206 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.237.148.25 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.237.149.208 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)

--Francis Schonken (talk) 19:17, 7 June 2008 (UTC)[reply]

217.237.151.145 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)
217.237.149.144 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)

- Adolphus79 (talk) 19:20, 7 June 2008 (UTC)[reply]

Concerning 217.87.x.x

Hi,

Excuse me writing here. I'm quite new to wikipedia and registered only for the purpose of communicating with you. I hope this is the right place. I've just been surfing around on wp and got the new message warning leading me to this link. And then I got there. I am in the 217.87.*.*-range, too. It's one of the huge ranges of the biggest German isp - tcom fka. Deutsche Telekom. The 217.237.150.11* range is the range of a public proxy any tcom customer may use (www-proxy.t-online.de). I often use this proxy for speed reasons, and that's basically the reason I got the new message warning and now write here.. The last digit of the ip usually varies, depending on where the abuser lives. Every larger node usually has 3 different possible last digits afaik. The ip can even vary on every refresh. In my area the ip varies from 217.237.150.116 - 217.237.150.118.

To make a long story short: the proxy is transparent, so why not look up and log the abusers real ip? Blocking the whole range would not be a good solution - please only punish those who deserve to be punished. I often have to use this proxy and people like this guy annoy me, as they abuse two systems that are intended to have a good purpose - what a scumbag :(

Once you have this guy's real ip in your logs, you might consider contacting the tcom security team directly with hard evidence at:
phone: +49 180 5334332
fax-no: +49 180 5334252
e-mail: [email protected]
They are usually very friendly and they help unbureaucratically and fast if you provide hard evidence (timestamped logs).

Kind regards & keep me posted,

--Testomaximo (talk) 21:05, 7 June 2008 (UTC)[reply]
Moved here by «l| Ψrom3th3ăn ™ |l» 01:35, 8 June 2008 (UTC)[reply]

Maybe a checkuser can answer on this ... I know (well, am 99% sure anyway) that they can look up the underlying IP address for a transparent proxy, but I'm not sure if there is a way within mediawiki to block the underlying IP and stop it from using transparent proxies. Normally, open proxies (and that's essentially what this is) are just blocked so there's no need to block an underlying IP. But this is above my pay grade, so I don't know what is technically possible for a checkuser to do. --B (talk) 01:40, 8 June 2008 (UTC)[reply]

If these proxies are indeed open proxies, then they should be reported on Wikipedia:WikiProject on open proxies for blocking. Some proxies are legitimate if not open to the world, however, but I have reported this range of IP addresses for checking just in case. =Axlq 04:27, 8 June 2008 (UTC)[reply]

Its sounds like its an ISP proxy, in that case we cant block it..... «l| Ψrom3th3ăn ™ |l» 16:30, 8 June 2008 (UTC)[reply]

Sorry that my expression open proxy led to a false assumption. The proxy is an ISP proxy and may only be used by t-com customers, which are quite a few, though. Any news so far? --Testomaximo (talk) 22:54, 16 June 2008 (UTC)[reply]

checkuser comment

Correct, the 217.237 numbers are a transparent proxy and they do forward the original IP address of the editor. However, the wikimedia software does not consider them a trusted proxy. If it did, the edits would appear to come from the original IP, and a block on the original IP would stop the user whether he edited directly or from the proxy. However, since the proxy is not trusted, the editor can appear to come from two different IP addresses depending on whether he uses the proxy. See Wikipedia:WikiProject on XFFs for more info. I have blocked anonymous editing for one month from the 217.237 proxies; all the recent anonymous edits are this person. The edit summaries of Sept 4 are quite violent. If you can get the German authorities interested in a complaint, they can make a legal request to the Foundation office to disclose the originating IP address. Thatcher 01:08, 9 September 2008 (UTC)[reply]

217.237.xxx.xxx

Wikipedia:Manual of Style (dates and numbers)

Wikipedia Talk:Manual of Style (dates and numbers)

Power Macintosh 5500

18:43, June 10, 2008 Special:Contributions/217.237.148.103
17:08, June 10, 2008 Special:Contributions/217.237.150.207
13:08, June 10, 2008 Special:Contributions/217.237.148.105
05:14, June 10, 2008 Special:Contributions/217.237.148.103

Macintosh Quadra 950

User talk:Fnagaton

Wikipedia:Requests for comment/Greg L

12:22, June 8, 2008 Special:Contributions/217.237.149.208
16:11, June 7, 2008 Special:Contributions/217.237.151.117

217.87.xxx.xxx

Wikipedia Talk: Manual of Style (dates and numbers)

Wikipedia:Requests for comment/Greg L

217.227.xxx.xxx

Wikipedia talk:Manual of Style (dates and numbers)

18:47, May 7, 2008 Special:Contributions/217.227.222.52

More abuse

Some of these listed will probably be deletd due to their abusive content. [1] [2] [3] [4] Fnag aton 03:06, 4 September 2008 (UTC)[reply]

Reattempting Contact

 Since it has been a while since anyone from Wikipedia:Abuse reports has sent an abuse report to the responsible organization, I'm going to send another email to notify them of the abuse. If you need to contact me, please message me on my talk page. Thanks.

Update

I've closed all requests that have this template, because a second attempt was done to contact the responsible organizations. The results were overall positive, as I did receive some replies that indicated that the responsible organization was going to look into the issue. The reports that were sent to ISPs all received automated responses, also promising to look into every case. Netalarm 15:28, 21 July 2009 (UTC) Netalarm 04:36, 19 July 2009 (UTC)[reply]