Zscout370 deadminned, Per Arbcom Options

[Bob Boy]

In the Luna_Santin IRC log, Dmcdevit says it was Steve and James, with Blnguyen joining the conversation later.

Who are Steve and James?

[Derktar]

In the Luna_Santin IRC log, Dmcdevit says it was Steve and James, with Blnguyen joining the conversation later.

Who are Steve and James?

James is probably Jdforrester aka James F, I am unsure who Steve is though.

[Rootology]

I Steve Uninvited Company? He's been a decided fool of late.

[Bob Boy]

Looks like SlimVirgin came back and tried to change her vote several times at Dmcdevit's steward candidacy page - first as 67.18.187.114, and then as herself. She got reverted.

http://meta.wikimedia.org/w/index.php?titl...&action=history

[Piperdown]

Looks like SlimVirgin came back and tried to change her vote several times at Dmcdevit's steward candidacy page - first as 67.18.187.114, and then as herself. She got reverted.

http://meta.wikimedia.org/w/index.php?titl...&action=history

yup, the ol' forgot to log-in IP slip-up.

http://meta.wikimedia.org/w/index.php?titl...ev&oldid=795550

Revision as of 01:06, 17 December 2007 (edit) (undo)
67.18.187.114 (Talk)
(struck my oppose)

:#<s>'''Oppose'''. I'd like to see more of a separation of powers on Wikimedia, so I wouldn't support anyone still on the ArbCom mailing list for stewardship. [[User:SlimVirgin|SlimVirgin]] ^{<font color="Purple">[[User_talk:SlimVirgin|(talk)]]</font>} 08:55, 16 December 2007 (UTC)</s>

is that an open proxy?



This post has been edited by Piperdown: Mon 17th December 2007, 3:51am

[Moulton]

Is 67.18.187.114 an open proxy?

The IP has no reverse DNS lookup. Traceroute runs out of steam at vl1.car01.dllstx2.theplanet.com. That would be a router in Dallas TX.

[Robster]

Is 67.18.187.114 an open proxy?

The IP has no reverse DNS lookup. Traceroute runs out of steam at vl1.car01.dllstx2.theplanet.com. That would be a router in Dallas TX.

Geobytes puts it in Rhome, TX (northwest of the Metroplex).

Other services locate it in New York or Dallas, and give the ISP as "LAYERED TECHNOLOGIES INC. ", located in Dallas.

However, Layered Technologies bills itself as "The leading provider of next generation, self-managed
utility computing and hosting solutions." -- a server farm. I suspect users could be just about anywhere, alas.

[tarantino]

Is 67.18.187.114 an open proxy?

The IP has no reverse DNS lookup. Traceroute runs out of steam at vl1.car01.dllstx2.theplanet.com. That would be a router in Dallas TX.

Most of the other domains on that cnet have an rdns along the lines of *.members.linode.com. Linode is described as a provider of highly customizable Linux virtual servers. The next number up, 67.18.187.115=obfuscated.us, and port 80 shows an Apache test page. The only other numbers on the cnet with no rdns are .2, .3 and .4 .

[Rootology]

That's without a question a proxy server. Either open or not, Slim is obfuscating her IP address presence for editing now. Probably to not geolocate her to Swalwall, Alberta anymore.

Looky here:

http://www.google.com/search?q=67.18.187.114

Who is tonedalesports.com?

http://whois.domaintools.com/tonedalesports.com

Whois Record for Tonedalesports.com
( Tone Dale Sports )
Click to Edit

Front Page Information
Website Title: Index of /
Title Relevancy 100%
AboutUs: Wiki article on Tonedalesports.com
SEO Score: 57%
Terms: 34 (Unique: 29, Linked: 10)
Images: 5 (Alt tags missing: 0)
Links: 8 (Internal: 8, Outbound: 0)
Indexed Data
Registry Data
ICANN Registrar: TUCOWS INC.
Created: 2006-09-20
Expires: 2008-09-20
Registrar Status: clientTransferProhibited
Registrar Status: clientUpdateProhibited
Name Server: NS.123-REG.CO.UK (has 345,865 domains)
Name Server: NS2.123-REG.CO.UK
Whois Server: whois.tucows.com
Server Data
Server Type: Apache/1.3.29 (Unix) PHP/4.3.4 mod_ssl/2.8.16 OpenSSL/0.9.7d
IP Address: 89.107.23.82 [Whois] [Reverse-Ip] [Ping] [DNS Lookup] [Traceroute]
IP Location United Kingdom - United Kingdom - The Uk Grid Network Ltd
Response Code: 200
Blacklist Status: Clear
Domain Status: Registered And Active Website
DomainTools Exclusive
Registrant Search: "Tonedale" owns about 1 other domains
Email Search: is associated with about 2 domains
is associated with about 458,377 domains
Registrar History: 1 registrar
IP History: 2 changes on 3 unique name servers over 1 years.
Whois History: 1 record has been archived since 2007-11-21.
Reverse IP: 41 other sites hosted on this server.
Monitor Domain: [Monitor this domain] Set Free Alerts on tonedalesports.com
Free Tool: Download DomainTools
Whois Record

Registrant:
Tonedale
P O Box 142
Telford, Shropshire TF2 8WX
GB

Domain name: TONEDALESPORTS.COM

Administrative Contact:
Kent, Paul
P O Box 142
Telford, Shropshire TF2 8WX
GB
+44.8454309399
Technical Contact:
Technical, PIPEX
Portland Street
Beeston
Nottingham, Nottinghamshire NG9 2LP
UK
+44.1159170000 Fax: +44.1158770213

Registration Service Provider:
PIPEX Communications Uk Ltd,
+44.115-917-0000
http://www.123-reg.co.uk/


I wouldn't post all that, but that's a Slim IP through a proxy, and clearly not an open proxy or else we'd see more hits. In case there is any significance to this site, as the only record on Google, I wanted to toss it out.

This post has been edited by Rootology: Mon 17th December 2007, 7:48am

[Moulton]

On Dec 7th (Pearl Harbor Day), 67.18.187.114 paid a visit to this blog post...

67.18.187.114 - - [07/Dec/2007:22:39:37 -0500]
"GET /media/MoultonLava.jpg HTTP/1.0" 200 0 "-"
"Mozilla/5.0 (Windows; U; Windows NT 5.1 compatible; en-US; rv:1.8.1.8)
Gecko/20071008 Firefox/2.0.0.8"

Make of it what you will.

This post has been edited by Somey: Mon 17th December 2007, 5:10pm

[guy]

#'''Support'''. I've struck my oppose, which was on the grounds that people shouldn't be stewards or bureaucrats while on the ArbCom or its mailing list. However, I've only recently decided to start opposing for this reason, and given that Dmcdevit is under pressure for other reasons, this doesn't seem like a good place to start. [[User:SlimVirgin|SlimVirgin]] ^{<font color="Purple">[[User_talk:SlimVirgin|(talk)]]</font>} 01:09, 17 December 2007 (UTC)

67.18.187.114 doesn't seem to be blocked on Wikipedia.

[Moulton]

tonedalesports.com seems to be some kind of anonymizing proxy running on a server leased from connexinet.co.uk, but oddly enough the user/usage logs for it are readable by the public and listed in Google.

IP 67.18.187.114 is listed as one of the clients using tonedalesports.com.

Other than the usage logs, there aren't any conventional pages on that site, so users are probably accessing it with some kind of .cgi script or preconfigured Apache redirect that provides the proxy function.

The single biggest referrer site is a search engine blog site called seblogs.net. However, I have not found the embedded code that links to tonedalesports.

On further investigation...

That hosting service has installed a general purpose web log analyzer called AWStats (Advanced Web Statistics). But the installed version is an older version (v. 5.5) which has a known and published vulnerability...

A security hole was found in October 2004 in old AWStats versions (from 5.0 to 6.3) when AWStats is used as a CGI:
A remote user can execute arbitrary commands on your server using permissions of your web server user (in most cases user "nobody" or "wwwroot").

All those users are evidently exploiting the hole in awstats.cgi to hijack that host for unauthorized purposes. Of all the clients, the one leased to tonedalesports.com is the favorite, because that customer never built any web site pages and hence left it unattended.

This post has been edited by Moulton: Mon 17th December 2007, 3:23pm

[Somey]

Make of it what you will.

Slimmy has been using one or more private proxy servers based in Texas and the UK for months, probably well over a year even. One can hardly blame her, I suppose... Gary Weiss uses at least one of the same hosting companies - she probably learned about setting it up from him. I believe Wordbomb has claimed that Weiss also uses one in Vancouver, BC or thereabouts, but beyond that I'd prefer not to go...

We're getting totally off-topic here, are we not? Or is that just me?

[Rootology]

Demonstrated open proxy:

67.18.187.114

By policy, this is required to be blocked on Wikipedia.

Maybe someone should force their hands by using the exploit to "decorate" articles from this IP.

[Moulton]

That host is running the Secure Shell Demon, but not much else on standard port numbers.

[Poetlister]

Demonstrated open proxy:

67.18.187.114

By policy, this is required to be blocked on Wikipedia.

I don't think that blocking it would make any difference. Admins can edit from blocked IPs I think.

[michael]

I Steve Uninvited Company? He's been a decided fool of late.

In the meta board elections, UninvitedCompany said his real name was Steve Dunlop. The name Steve Dunlop was also mentioned in a Signpost article when the three new members of the ombudsman committee were announced, as UninvitedCo and two others had been serving.

[Moulton]

UninvitedCompany was the first person on ArbCom to summarily reject my RfAr case on whether the admins had departed from the norms of due process and due diligence in a Kafkaesque manner. His comment reveals he didn't even bother to read what the RfAr was about.

[GlassBeadGame]

That host is running the Secure Shell Demon, but not much else on standard port numbers.

You scanned his ports?

[Moulton]

That host is running the Secure Shell Demon, but not much else on standard port numbers.

You scanned his ports?

No, I just made a quick manual check for half a dozen common ports. Secure Shell was the only one that answered.