List of IPs for (obviously) the same editor; this list would be useful in crafting an appropriate range block if/when one of the IPs is blocked.

IP list

edit
    • Note: All times PST = UTC-8

January 2012

edit

(partial)

  • 99.190.83.211 22:17, January 12, 2012 to 00:51, January 13, 2012
  • 99.181.131.215 15:01, January 13, 2012 to 16:59, January 13, 2012
  • 99.19.45.64 18:46, January 13, 2012 to 21:29, January 13, 2012
  • 99.181.145.153 19:40, January 14, 2012 to 20:35, January 14, 2012
  • 99.181.133.228 22:21, January 14, 2012 to 23:36, January 14, 2012
  • 99.181.130.94 16:02, January 15, 2012 to 17:10, January 15, 2012
  • 99.181.138.52 18:15, January 15, 2012 to 21:29, January 15, 2012
  • 97.87.28.188 [1] 13:59, January 16, 2012 to 16:06, January 16, 2012
  • 99.109.127.44 [2] 17:54, January 16, 2012 to 18:15, January 16, 2012
  • 99.35.12.102 18:47, January 16, 2012 to 19:26, January 16, 2012
  • 99.181.142.231 20:24, January 16, 2012 to 00:53, January 17, 2012
  • 99.190.80.205 01:21, January 17, 2012 to 01:36, January 17, 2012
  • 99.181.153.4 06:28, January 17, 2012 to 06:47, January 17, 2012
  • 99.181.157.73 [3]18:01, January 17, 2012 to 18:59, January 17, 2012
  • 99.190.83.253 20:38, January 17, 2012 to 20:44, January 17, 2012
  • 99.181.154.161 21:33, January 18, 2012 to 23:08, January 18, 2012
  • 99.181.149.83 16:15, January 19, 2012 to 17:17, January 19, 2012
  • 99.35.14.75 18:40, January 19, 2012 to 20:28, January 19, 2012
  • 99.35.12.129 01:45, January 20, 2012 to 03:25, January 20, 2012
  • 99.181.144.253 16:23, January 21, 2012 to 18:43, January 21, 2012
  • 99.181.143.48 19:32, January 21, 2012 to 20:18, January 21, 2012
  • 99.181.130.36 20:53, January 21, 2012 to 20:56, January 21, 2012
  • 99.181.132.130 21:29, January 21, 2012 to 21:51, January 21, 2012
  • 99.56.122.90 01:30, January 22, 2012 to 01:38, January 22, 2012
  • 99.181.138.35 17:01, January 22, 2012 to 17:08, January 22, 2012
  • 99.181.155.14 18:16, January 22, 2012 to 22:00, January 22, 2012
  • 99.181.138.196 00:05, January 23, 2012 to 00:16, January 23, 2012
  • 99.181.133.141 01:41, January 23, 2012 to 02:48, January 23, 2012
  • 99.181.152.120 15:32, January 23, 2012 to 16:32, January 23, 2012
  • 99.190.83.66 18:26, January 23, 2012 to 20:38, January 23, 2012
  • 99.190.86.184 21:47, January 23, 2012 to 23:24, January 23, 2012
  • 99.19.46.245 23:57, January 23, 2012 to 00:18, January 24, 2012
  • 97.87.29.188 [1] 12:06, January 24, 2012 to 13:55, January 24, 2012
  • 99.181.135.113 [3]17:22, January 24, 2012 to 18:45, January 24, 2012
  • 99.181.134.88 22:38, January 24, 2012 to 00:52, January 25, 2012
  • 99.181.149.86 19:35, January 25, 2012 to 20:40, January 25, 2012
  • 99.35.14.94 21:32, January 25, 2012 to 00:30, January 26, 2012
  • 99.19.45.13 [2]19:13, January 26, 2012 to 00:26, January 27, 2012
  • 97.87.29.188 [1] 12:57, January 27, 2012 to 14:42, January 27, 2012
  • 99.190.87.151 16:19, January 27, 2012 to 20:58, January 27, 2012
  • 99.19.46.200 21:53, January 27, 2012 to 00:41, January 28, 2012
  • 99.181.159.67 16:46, January 28, 2012 to 18:29, January 28, 2012
  • 64.27.194.74 [4]13:20, January 30, 2012 to 14:03, January 30, 2012
  • 216.250.156.66 [4] 14:22, January 30, 2012 to 15:14, January 30, 2012
  • 97.87.29.188 [1]16:52, January 30, 2012 to 17:50, January 30, 2012
  • 99.35.12.74 19:14, January 30, 2012 to 23:46, January 30, 2012 **
  • 99.35.13.185 [5]00:51, January 31, 2012 to 01:38, January 31, 2012
  • 97.87.29.188 [1] 16:07, January 31, 2012 to 17:50, January 31, 2012 [6][7]
    • Note all the following through the end of March are technically block evasion, and can be reverted as such
      • Block extended through 02:10, March 16, 2012. for some of the block evasion below.
    • Note 2: I've attempted to tag all those IPs which were stopped by a block with the tag < ref name = stopped />; so for the 99.* below were caught over 30 minutes after the last edit. All editors are welcome to add entries or notes to this list, but please sign your additions.

February 2012

edit

March 2012

edit

April 2012

edit

May 2012

edit

...OK, what happenbed to the rest of them in May

<<<<<<<< May 15, 2012, 3-month block of IP 97.87.29.188

June 2012

edit

All are block evasion, since for the entire month at least one of the IP addresses of this sock was blocked.


July 2012

edit

All are block evasion, since for the entire month at least one of the IP addresses of this sock was blocked.

not fully checked (and won't be, for a few days)

August 2012

edit

All are block evasion, since for the entire month at least one of the IP addresses of this sock was blocked.

  • 99.112.215.152 02:22, August 1, 2012 to 02:38, August 1, 2012
  • 99.119.130.123 12:07, August 1, 2012 to 13:06, August 1, 2012
  • 99.181.138.194 18:00, August 1, 2012 to 18:24, August 1, 2012
  • 99.109.124.96 20:02, August 1, 2012 to 20:48, August 1, 2012
  • 108.73.112.111 21:17, August 1, 2012 to 21:25, August 1, 2012
  • All times for here on out UTC, to accomodate NewsAndEventsGuy

<<August 2, 2012 at 18:42. Start of one-month soft block on IP range as result of ANI proceeding UPDATE: Clock restarted and extended to 3 months on Aug 23 NewsAndEventsGuy (talk) 11:47, 3 August 2012 (UTC)

<< Aug 15, 2012, at ____, server-programmed expiration of 3-month block of IP 97.87.29.188 (UTC)

<< Aug 20, 2012, at 22:23 Second ANI complaint

This editor has been disruptive over a very long time period. Looking at the editing histories of the various IP addresses used, it seems that most of them have been used exclusively or almost exclusively by this person, so I do not think there is a great risk of collateral damage. I have placed range blocks on recently used ranges (99.181.128.0/19 3 months, 108.73.112.0/22 2012 2 months, 108.195.136.0/22 1 month). 97.87.29.188 appears to be a library IP address, but the substantial majority of edits for at least the last two years have clearly been from this person, and virtually all of the few edits that I have seen that don't seem to come from this person have been vandalism or other unconstructive editing (as is often the case with library editing), so I have blocked it for a year. JamesBWatson (talk) 18:58, 24 August 2012 (UTC)

<< Aug 23, 2012, at ____, start of 3-month block of IP range 99.181.128.0/19 (Block was already in effect. Clock restarted, time extended, and alternative IP ranges added)

<< Aug 24, 2012, at ____, start of 1-month block of IP range 108.195.136.0/22

<< Aug 24, 2012, at ____, start of 2-month block of IP range 108.73.112.0/22

<< Aug 24, 2012, at ____, start of 12-month block of IP 97.87.29.188 (This is a new and extended block. The IP was used for this behavior right after a 3 month block expired a few days ago) NewsAndEventsGuy (talk) 05:30, 26 August 2012 (UTC)

  • 99.112.214.75 02:34, August 27, 2012 to 02:34, August 27 just a single test edit on user talk page "hello" (UTC)
  • 99.119.130.95 05:27, August 27, 2012 to 07:11, August 27, 2012 [8][6] (UTC)

September 2012

edit

All are block evasion, since for the entire month at least one of the IP addresses of this sock was blocked.

  • 64.27.194.74 18:35, September 6, 2012 to 19:30, September 6, 2012 (UTC)
  • 97.86.80.98 21:27, September 6, 2012 to 21:32, September 6, 2012 (UTC)
  • 99.109.127.145 03:11, September 8, 2012 to 04:22, September 8, 2012 (UTC)
  • 97.86.80.98 18:58, September 11, 2012, to 19:20, September 11, 2012 (UTC)
  • 141.218.36.99 20:25, September 11, 2012 to 21:02, September 11, 2012 (UTC)[8]
  • 141.218.36.44 20:39, September 19, 2012 to 22:58 September 19, 2012 (UTC)[8]
<< 14:10, 20 September 2012, start of 3-month block of 141.218.36.44 (talk · contribs · deleted contribs · page moves · block user · block log)
<< 14:35, 20 September 2012, start of 3-month block of 141.218.36.99 (talk · contribs · deleted contribs · page moves · block user · block log)
<< 14:56, 20 September 2012, start of 3-month block of 99.109.127.145 (talk · contribs · deleted contribs · page moves · block user · block log)
<< Sept 24, 2012, at ____, server-programmed expiration of 1-month block of IP range 108.195.136.0/22 [17] (This footnote added by NewsAndEventsGuy (talk) 01:03, 27 August 2012 (UTC))

October 2012

edit

All are block evasion, since for the entire month at least one of the IP addresses of this sock was blocked.

Florida

  • 209.26.129.210 19:16, 4 October 2012 to 19:58, 4 October 2012 (UTC)
  • 209.26.202.234 21:57, 4 October, 2012 to 22:42, 4 October, 2012 (UTC)[18]
  • 209.26.202.234 19:12, 5 October, 2012 to 20:00, 5 October, 2012 (UTC)[18]
  • 64.45.193.210 15:51, 6 October, 2012 to 16:35, 6 October, 2012 (UTC)[8][6] Was stopped with block but started a new IP later the same day
  • 209.26.222.162 17:33, 6 October, 2012 to 17:52, 6 October, 2012 (UTC)[8][6] Was stopped with block but started a new IP later the same day
  • 209.26.201.250 18:57, 6 October 2012 to 19:45, 6 October 2012 (UTC)
  • 209.26.129.210 20:55, 10 October 2012 to 21:31, 10 October 2012 (UTC)
  • 209.26.222.162 18:05, 15 October, 2012 to 18:57, 15 October, 2012 (UTC)[8][6] Was stopped with block but started a new IP later the same day
  • 209.26.202.234 20:16 15 October, 2012 to 21:05, 15 October, 2012 (UTC)[18]
  • 64.45.193.210 21:52, 15 October, 2012 to 22:40, 15 October, 2012 (UTC)[8][6]
  • 209.26.129.210 22:08, 16 October 2012 to 22:45, 16 October 2012 (UTC)
<< Oct 24, 2012, at ____, server-programmed expiration of 2-month block of IP range 108.73.112.0/22 [17]

Indiana -- Layover between FL and MI?

November 2012

edit

All are block evasion, since for the entire month at least one of the IP addresses of this sock was blocked.

Michigan -- Apparently he had to go back to vote

  • 99.109.125.89 02:00, 2 November 2012 to 03:44, 2 November 2012 (UTC)[8][6]
  • 99.112.214.140 02:41, 6 November 2012 to 03:35, 6 November 2012 (UTC)[8][6] Started a new IP later the same day
  • 99.109.127.49 04:34, 6 November 2012 to 04:34, 6 November 2012 (UTC)[8][6] Started a new IP later the same day
  • 64.27.194.74 21:01, 6 November 2012 to 21:51, 6 November 2012 (UTC)
  • 99.119.128.154 03:28, 7 November 2012 to 03:30, to 7 November 2012 (UTC)
  • 108.195.138.6 05:02, 7 November 2012 to 06:39, 7 November 2012 (UTC)[8]
  • 99.109.127.40 04:59, 8 November 2012 to 05:29, 8 November 2012 (UTC)
  • 216.250.156.66 22:04, 13 November 2012 to 22:04, 13 November 2012 (UTC)
  • 99.112.213.81 05:21, 16 November 2012 to 07:59, 16 November 2012 (UTC)
  • 99.119.129.59 23:04, 21 November 2012 to 23:26, 21 November 2012(UTC)[8][6]
  • 99.119.130.238 01:58, 22 November 2012 to 02:02, 22 November 2012 [8] Started a new IP later the same day
  • 108.195.136.121 02:48, 22 November 2012, to 02:57, 22 November 2012 (UTC)[8][6] Started a new IP later the same day
  • 99.112.212.9 03:14, 22 November 2012 to 03:24, to 22 November 2012 (UTC)
<<<<< Nov 23, 2012, at ____, server-programmed expiration of 3-month block of IP range 99.181.128.0/19 [17]
  • 99.181.131.219 03:23, 24 November 2012 to 04:39, 24 November 2012 (UTC)[8][6] Started a new IP later the same day
<< 04:39, 24 November 2012, start of 3-month block of 99.181.131.219 (talk · contribs · deleted contribs · page moves · block user · block log)
  • 99.181.159.214 00:52, 25 November 2012, to 02:39, 25 November 2012 (UTC)[8] Started a new IP later the same day
  • 108.73.115.198 06:32, 25 November 2012, to 08:18, 25 November 2012(UTC)[8] Started a new IP later the same day
  • 99.181.134.50 09:13, 25 November 2012, to 09:52, 25 November 2012 (UTC)[8][6] Started a new IP later the same day
<<10:03, 25 November 2012, start of 3-month block of 99.181.134.50 (talk · contribs · deleted contribs · page moves · block user · block log)
<< 10:30, 25 November 2012, start of 3-month block of 99.119.128.139 (talk · contribs · deleted contribs · page moves · block user · block log)
<< 11:15, 25 November 2012, start of 3-month block of 99.181.159.214 (talk · contribs · deleted contribs · page moves · block user · block log)
<< 11:37, 25 November 2012, start of 6-month rangeblock of 99.181.128.0/19
<< 12:20, 25 November 2012, start of 1-month block of 108.73.115.198 (talk · contribs · deleted contribs · page moves · block user · block log)
<< 15:11, 25 November 2012, start of 3-month rangeblock of 108.195.136.0/23
<< 15:14, 25 November 2012, start of 2-week rangeblock of 108.73.112.0/22
<< 08:22, 26 November 2012, start of 3-month block of 99.109.127.240 (talk · contribs · deleted contribs · page moves · block user · block log)
<< 22:55, 26 November 2012, start of 3-month block of 64.27.194.74 (talk · contribs · deleted contribs · page moves · block user · block log)

December 2012

edit

(Times in UTC)

<< 10:21, 1 December 2012, start of 3-month block of 108.195.138.226 (talk · contribs · deleted contribs · page moves · block user · block log)
<< 10:44, 1 December 2012, start of 2-month block of 216.250.156.66 (talk · contribs · deleted contribs · page moves · block user · block log)

En route to NW FL again (see Oct 12)

<< 15:14, 09 December 2012, server-programmed expiration of 2-week rangeblock of 108.73.112.0/22[17]
<<11:17, 10 December 2012, , start of 1-week block of 168.13.6.2 (talk · contribs · deleted contribs · page moves · block user · block log)
<<11:17, 17 December 2012, end of server-programmed end of 1-week block of 168.13.6.2 (talk · contribs · deleted contribs · page moves · block user · block log)

NW Florida

  • 70.168.88.100 22:04, 18 December 2012, to 00:57, 19 December 2012
<< 14:10, 20 December 2012, server-programmed expiration of 3-month block of 141.218.36.44 (talk · contribs · deleted contribs · page moves · block user · block log)[17]
<< 14:35, 20 December 2012, server-programmed expiration of 3-month block of 141.218.36.99 (talk · contribs · deleted contribs · page moves · block user · block log)[17]
<< 14:56, 20 December 2012, server-programmed expiration of 3-month block of 99.109.127.145 (talk · contribs · deleted contribs · page moves · block user · block log)[17]
<< 12:20, 25 December 2012, server-programmed expiration of 1-month block of 108.73.115.198 (talk · contribs · deleted contribs · page moves · block user · block log)[17]


January 2013

edit

(Times in UTC)

  • 24.73.43.20

February 2013

edit

March 2013

edit

..... As of March 13 there are a bunch more..... we just haven't been logging them here. NewsAndEventsGuy (talk) 03:24, 13 March 2013 (UTC)

April 2013

edit

(a few more just those I left in my edit window) — Arthur Rubin (talk) 16:45, 11 May 2013 (UTC)

May 2013

edit

July 2013

edit

September 2013

edit

Future dates

edit

Note to IP per WP:GAMING resumption of blockable behavior just after your blocks expire is grounds for simply reinstating the blocks. NewsAndEventsGuy (talk) 19:43, 9 February 2013 (UTC)

<< 10:21, 1 February 2013, server-programmed expiration of 2-month block of 108.195.138.226 (talk · contribs · deleted contribs · page moves · block user · block log)[17]
<< 10:44, 1 February 2013, server-programmed expiration of 2-month block of 216.250.156.66 (talk · contribs · deleted contribs · page moves · block user · block log)[17]
<< 04:39, 24 February 2013, server-programmed expiration of 3-month block of 99.181.131.219 (talk · contribs · deleted contribs · page moves · block user · block log)[17]
<< 10:03, 25 February 2013, server-programmed expiration of 3-month block of 99.181.134.50 (talk · contribs · deleted contribs · page moves · block user · block log)[17]
<< 10:30, 25 February 2013, server-programmed expiration of 3-month block of 99.119.128.139 (talk · contribs · deleted contribs · page moves · block user · block log)[17]
<< 11:15, 25 February 2013, server-programmed expiration of 3-month block of 99.181.159.214 (talk · contribs · deleted contribs · page moves · block user · block log)[17]
<< 15:11, 25 February 2013, server-programmed expiration of 3-month rangeblock of 108.195.136.0/23[17]
<< 08:22, 26 February 2013, server-programmed expiration of 3-month block of 99.109.127.240 (talk · contribs · deleted contribs · page moves · block user · block log)[17]
<< 22:55, 26 February 2013, server-programmed expiration of 3-month block of 64.27.194.74 (talk · contribs · deleted contribs · page moves · block user · block log)[17]
<< 11:37, 25 May 2013, server-programmed expiration of 6-month rangeblock of 99.181.128.0/19[17]
<< ____, 24 August 2013, server-programmed expiration of 12-month block of 97.87.29.188 (talk · contribs · deleted contribs · page moves · block user · block log)[17]

Prevention ideas

edit

This sock strews external links in three places (A) article space, (B) article talk pages, and (C) edit summaries. Anyone can revert the first two, but edit summary abuse can only be combated by admins thru a cumbersome procedure. Is edit summary abuse a big deal? Yes for two reasons. First, it makes other editors watchlists very hard to use efficiently. Second, this IP probably glories in seeing their links appear in version histories which perpetuates this particular form of external link spam.

IDEAS

A. revert revert revert
B. Maintain blocks by telling the server the clock was reset (thru the IPs own actions) before the server erroneously thinks they have expired
C. Use range blocks
D POLICY PROPOSAL (still in prelim development) Prevent IP editors from engaging in edit summary link-abuse by preventing IPs from (1) using forward slashes and (2) using more than a single wikilink

Other ideas? NewsAndEventsGuy (talk) 13:55, 21 December 2012 (UTC)

I like the idea of preventing edit summary link spam. 1) the regex might need to be more than "/" - seems restrictive and doesn't cover domain names...how about "http://" "https://" "www." ".com" for starters. So a separate EXT link blacklist (cf spam blacklist) just for edit summaries. Do we need EXT in edit summaries generally? Widefox; talk 08:45, 30 July 2013 (UTC)
I'm thrilled to see someone else taking an interest, but I'm not enough of a computer geek to have any idea what you just said. But if it works without an unacceptable amount of collateral damage, than I agree - whatever you said  :) .... NewsAndEventsGuy (talk) 15:13, 30 July 2013 (UTC)
I use external links in edit summaries, about 1 in 100, but I've definitely done so. It sounds like this page is particularly about linkspam and/or SEO ... so rather than block *ALL* external links in edit-summaries, I would instead suggest a more cautious approach, of having a 'tripwire' type of abusefilter that does a "Tag: external link in edit summary" (which can later be reviewed en masse in semi-automated fashion), plus a separate and distinct 'enforcer' type of abusefilter that does a "Disallow: external link in edit summary that has been blacklisted please see WP:ELNOSUMMARY to request delist". (Or whatever helpdoc-shortcut makes the most sense.) Anyways, agree with the suggestion by User:Widefox that a separate blacklist is probably the way to go, and that idea#D restriction to simply the slash character is way too draconian for the tripwire.  ;-)     Assuming the tripwire is only going to tag (rather than disallow), it makes sense that the tripwire-abusefilter should apply to all editors, whether anons or admins. That will also give us a better picture of how often legitimate EL usage in edit-summaries actually occurs, once the tripwire-abusefilter has been tagging for a few months. I would also think that that blacklist-abusefilter ought to apply to all editors, not just anons... if the URL is on the linkspam blacklist, there seems little reason why even an admin would want to use it in their editsummary. Maybe there is some kind of metausage I'm missing here (e.g. edit-summary: "the http://www.spamsite.com sockfarm has returned" that an admin might conceivably leave on a talkpage?) Anyways, I think that linkspam in edit-summaries is difficult enough to revert (need revdel or similar level of cumbersome-ness), and easy enough to blacklist (we already have existing infrastructure for maintaining and enforcing such things), that it makes sense to put some abusefilter regex into place that builds a tripwire-database of potentially-worrisome incidents, and then another enforcer-abusefilter in place that keeps blacklisted URLs from being linkspammed into edit-summaries. Ping User:NewsAndEventsGuy, suggest you propose this somewhere that it can get broader feedback-slash-input. 75.108.94.227 (talk) 01:45, 8 September 2015 (UTC)
Ooo, this was a while ago, is this a pressing need as two years gone by?....EXT links with WP domains seem too useful (e.g. diffs) but otherwise 1. keeping it simple and rejecting all other EXT seems restrictive but possible, but 2. tripwire sounds OK. Widefox; talk 07:35, 8 September 2015 (UTC)
I'm retired at least until late summer 2016 and am posting only to respond to the ping and Widefox' comment. There is no such thing as "no longer a problem" with the IP who is the main focus of this page. Several eds have tracked this over several years, and the guy sometimes retreats and then fires back up again. US election cycle seems to be one main factor. So brace yourselves, we haven't seen the last of him. That said, even when he stopped posting links in ed sums the IP still spammed the links in other ways. So it might be pointless to sweat and grunt thru adoption of a policy about ed sums just for this LTA user, since the user has other arrows in their quiver. Back to watch mode. NewsAndEventsGuy (talk) 14:24, 12 September 2015 (UTC)

Notes

edit
  1. ^ a b c d e f g h i j k l m n o Stable IP; time range only includes most recent run
  2. ^ a b c d e IP has 1 previous edit as same person
  3. ^ a b IP has 1 previous edit, probably not the same person
  4. ^ a b c d e f g h i j k l previous edits, last batch clearly the same
  5. ^ a b c d e 2 previous edits, probably not the same person
  6. ^ a b c d e f g h i j k l m n o p q r s t u v w x y z aa ab ac ad ae af stopped by block
  7. ^ Blocked for the month of February 2012
  8. ^ a b c d e f g h i j k l m n o p q r s t u v w x y z aa ab ac ad ae af ag ah ai aj ak al am an ao ap aq ar as at au Blocked
  9. ^ 3 previous edits, same editor
  10. ^ a b c d e f g h one edit, probably same editor
  11. ^ Already listed above
  12. ^ a b 2 previous edits by the same editor
  13. ^ Previously stable, but now a clear vandal
  14. ^ Blocked for 3 months
  15. ^ Five previous edits, probably not the same person.
  16. ^ Resumed from this IP (or IP range) just after block expired
  17. ^ a b c d e f g h i j k l m n o p q r s Reminder, per WP:ILLEGIT, "in the case of sanctions, bans, or blocks, evasion causes the timer to restart". An admin still has to push buttons to tell the server that the timer has restarted, but my reading of that policy is that clock-restart happens automatically when the user performs an act of block evasion, and not merely from the admin's button-pushing. Also, gaming the system by simply repeating the behavior as soon as a block expires is grounds for renewed blocking
  18. ^ a b c d e f Some different edits as recent is July 2012
  19. ^ Some different edits as recent as January 2012
  20. ^ a b c d e f g h i j k l m Blocked, not checked whether it was stopped