Jump to content

Wikipedia:WikiProject on open proxies/Requests/Archives/10

Add links
From Wikipedia, the free encyclopedia


202.51.179.154

– This proxy check request is closed and will soon be archived by a bot.

202.51.179.154 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS.--Jezebel'sPonyobons mots 17:01, 2 October 2012 (UTC)

It's an open proxy on port 8080, and the requester very probably knows this. -- zzuuzz (talk) 17:54, 2 October 2012 (UTC)
Thank you for the quick response - I've declined the unblock accordingly. --Jezebel'sPonyobons mots 22:31, 2 October 2012 (UTC)
Inconclusive – Um, are you sure? hash.es hasn't been able to proxy successfully since September 13th, and I can't proxy successfully now. If the requester says he or she has fixed his wireless router, I'd give him or her the benefit of the doubt at this time and unblock. — madman 03:18, 3 October 2012 (UTC)
IP is an open proxy I'm with zzuuzz here. I was unequivocally able to proxy using it. There's some interesting stuff going on to mess with proxy checking though, but WP:BEANS..... Sailsbystars (talk) 04:13, 3 October 2012 (UTC)
Interesting. Will look into it some more then, when I have time; all I was getting was 404s. In any case, closing as unblock has been declined and thanks for the second opinion! — madman 06:18, 3 October 2012 (UTC)

68.230.147.10

– This proxy check request is closed and will soon be archived by a bot.

68.230.147.10 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS. Note this IP was blocked back in 2006 and the unblock request comes from a valid .edu email account.--Jezebel'sPonyobons mots 23:20, 3 October 2012 (UTC)

Not currently an open proxy No current proxy on previous port... there was apparently one on port 7212 once upon a time. Other common proxy ports also check out negative. This is an indef block on an ip in a dynamic range from ancient times. We don't do those anymore. The block should almost certainly be removed. Sailsbystars (talk) 02:25, 4 October 2012 (UTC)
Unblocked. -- zzuuzz (talk) 07:24, 4 October 2012 (UTC)
Thanks all, IP has been notified. --Jezebel'sPonyobons mots 17:00, 4 October 2012 (UTC)

174.36.207.11

– This proxy check request is closed and will soon be archived by a bot.

174.36.207.11 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

School located in the middle of a blocked range says they're neither dynamic nor a proxy. Daniel Case (talk) 15:26, 4 October 2012 (UTC)

108.220.9.38

– This proxy check request is closed and will soon be archived by a bot.

108.220.9.38 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Please note that I've already blocked the IP. The purpose of this report is to find out if the IP was editing from an open proxy. Please see this discussion.--Bbb23 (talk) 14:40, 8 October 2012 (UTC)

Reason: Suspicious edits

Not currently an open proxy This one just looks like a regular IP. Nothing at all on standard proxy ports. Month long block evasion block is about all that can be done. Sailsbystars (talk) 05:25, 9 October 2012 (UTC)

87.97.157.121

– This proxy check request is closed and will soon be archived by a bot.

87.97.157.121 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Please note that I've already blocked the IP. The purpose of this report is to find out if the IP was editing from an open proxy. Please see this discussion.--Bbb23 (talk) 14:42, 8 October 2012 (UTC)

Reason: Suspicious edits

This IP (from Bulgaria) vandalised a few minutes after identical vandalism had resulted in the blocking of an IP from the USA. You'll notice that the IP's last edit summary confesses to being an open proxy. I blocked it accordingly, but after I blocked it I learned that indef blocks for proxies are no longer considered good practice. Since ProcseeBot issues blocks of varying lengths, I'm not sure how long the block should be. If you're an admin, please block it properly; if you're not, just give me some advice and I'll obey. Nyttend (talk) 18:41, 8 October 2012 (UTC)

It looks to me like this is a small business or home computer that's been misconfigured. I get some verrrrry suspicious behavior on port 80, but can't confirm the proxy for sure. The range looks reasonably dynamic so a three month block I think would be about right. Sailsbystars (talk) 05:14, 9 October 2012 (UTC)
  • Not currently an open proxy as of this testing. It is an active terminal server so it could be switched on I suppose, and with a web server to dish up some stats but nothing particularly worrisome with port 80. Technically on a /24 but is actually part of 87.97.144.0/20, which is listed in several places for spam and abuse. Dennis Brown - 2¢ © Join WER 23:37, 11 October 2012 (UTC)
  • Rechecked, same conclusion. Now nrpe is active. Looks like a testing box. Not a clerk but closing. Dennis Brown - 2¢ © Join WER 14:27, 24 October 2012 (UTC)

208.87.137.231

– This proxy check request is closed and will soon be archived by a bot.

208.87.137.231 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

History of bad edits, http://whatismyipaddress.com/ip/208.87.137.231 says "Static IP" and "Confirmed proxy server". I've blocked the IP for vandalism  Ronhjones  (Talk) 20:55, 8 October 2012 (UTC)

Treat as a schoolblock sort of deal. This looks like an exit server from Webroot which sounds from their product description like it provides VPN-like services..... so not an open proxy, but will have heavier than normal traffic for an IP address (and thus vandalism). The existing block is probably about right. Sailsbystars (talk) 05:41, 9 October 2012 (UTC)
Other IPs in the same Webroot range (208.87.136.0/22) were not exactly constructive contributors either [1] [2] although they are stale by now. Tijfo098 (talk) 11:40, 18 October 2012 (UTC)

187.121.196.86

– This proxy check request is closed and will soon be archived by a bot.

187.121.196.86 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits

IP is an open proxy, blocked. Materialscientist (talk) 23:35, 9 October 2012 (UTC)

178.254.135.157

– This proxy check request is closed and will soon be archived by a bot.

178.254.135.157 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: !votes at ANI  little green rosetta(talk)
central scrutinizer  20:49, 9 October 2012 (UTC)

IP is an open proxy, blocked. Materialscientist (talk) 23:36, 9 October 2012 (UTC)

Lots of dragons

Every IP in Category:Suspected Wikipedia sockpuppets of Zrdragon12 seems to be a commercial proxy or VPN service. They should probably be blocked for longer. Someone should also check if range blocks are possible. Tijfo098 (talk) 00:27, 12 October 2012 (UTC)

Direct access to any of these IPs leads to www.privateinternetaccess.com, a VPN, i.e. technically this is an "open proxy" that should be hardblocked for years, as demonstrated by Zrdragon12. I am just not sure about ranges. Suggestions? Materialscientist (talk) 03:27, 12 October 2012 (UTC)
Nothing to see here, except some more likely proxies to investigate....
The following discussion has been closed. Please do not modify it.
They do seem to have a vast range.68.68.22.151 (talk) 06:26, 12 October 2012 (UTC)
I could carry on for years but hey I will let you off as I have better things to do. That you people support letting edit warriors off with no punishment as in User:TheTimesAreAChanging is a disgrace. I suggest that an admin with at least some morals investigate that guys account and see what he has been doing for years. An even worse culprit is of course his tag team partner User:Nguyen1310 who is one of the most biased editors on here,his edits speak for themselves,there is nothing good about them. He runs a campaign against communism/Vietnam,he deletes sources material all the time that does not agree with his biased version of events and also insults people and lies about them.This guy needs investigating for sure.Anyway I am sure none of you will do squat and are happy that wikipedia is considered a joke. Have a nice day.77.247.182.241 (talk) 06:36, 12 October 2012 (UTC)
Tell me about it. My ISP has several /13 although I'm nice and an I don't change my IP every few minutes (although I could). I don't understand why you have to edit war with Nguyen1310. His sources are usually weak, and even then they don't always support the material he's citing them for. You could use the normal WP:DR process to get it sorted out. Tijfo098 (talk) 09:28, 12 October 2012 (UTC)
Look who's talking, the person who lies, spreads his propaganda, removes sourced content that's critical of his communists, edit wars and blindlessly reverts other users' edits out of personal dislike and goes on numerous insult and personal attack and stalking campaigns, blames others for doing these things even though they are the only ones doing it. I don't run any "campaign" against communism or against my own homeland (why would anyone attack their own country, that part just exhibits a low level of intelligence), nor do I even have to. You, dragon, are THE most aggressive and THE most biased editor i've ever seen on here. Weak??? Not supporting the material??? I don't think so. Nguyen1310 (talk) 20:03, 12 October 2012 (UTC)

So, I have zero experience in determining an appropriate range, so I can't help there, but am I correct in understanding that it is safe to block any IP's clearly used by this user for a year as being an open proxy? If so, is it still essentially not worth my time to go back thru the list because the range is large, or they're unlikely to come back to it, or something? --Floquenbeam (talk) 17:37, 15 October 2012 (UTC)

Yes, safe to block most IPs used by this user as an open proxy for a year (n.b. there's a possibility that a proxy might be on a dynamic range, which would suggest more like a 2-3 month block, but with this type of proxy it's highly unlikely). When we're talking about ranges, we're not talking about a single range, but rather the hosting ranges for each proxy, which usually have a rule of where there's one, there's more than one. Checking ranges takes a fair bit of time, hence why no one's gotten around to it..... Sailsbystars (talk) 17:50, 15 October 2012 (UTC)
OK, thanks, I'll go ahead and do that, there's less than a dozen I think. And I think you know this, but just to make sure I was clear, I certainly didn't mean to imply criticism of the lack of further response, so I'm sorry if it sounded that way. Since it's all 100% over my head, I would never dream of criticizing anyone helping out here. --Floquenbeam (talk) 17:58, 15 October 2012 (UTC)
If go to the whois info, it will usually tell you the range. E.g. [3] is a /22. What this VPN company does though is rent IP space from various other ISP or from data centers worldwide, which makes it a bit more challenging to deal with. Luckily the subnets they rent are small, in the /20 - /22 range. It also looks like they have no ranges from ISPs which sell to household consumers, so the collateral damage from blocking those ranges appears limited to web hosting companies and similar "rackspace" clients, which aren't usually of much concern for Wikipedia. Tijfo098 (talk) 02:22, 16 October 2012 (UTC)
I'm sorry; if any of that made sense to me, I'd do something about it. But I'm afraid you're dealing with an idiot here. --Floquenbeam (talk) 02:25, 16 October 2012 (UTC)
You should get one of the leet admins from Category:Wikipedia administrators willing to make range blocks to do it then. I've asked User:PeterSymonds to help. Tijfo098 (talk) 01:25, 17 October 2012 (UTC)
If you only want to block the ranges used by Zrdragon12 that shouldn't be too difficult. In each case we should figure out how wide the range is. There should be some confirmation that each one is part of a VPN. It looks like Zrdragon12 is using about four ranges. Whois shows that his 68.68 edits are coming from the 68.68.16.0/20 range operated by Bluemile Inc. Per http://www.bluemilecloud.com they seem to be a web host. Can Sailsbystars (or one of the WP:OP regulars) confirm that being a web host is still enough to justify a hard block? Here are the range contributions for 68.68.16.0/20. EdJohnston (talk) 04:56, 17 October 2012 (UTC)
Please read the 1st comment of Materialscientist. Some (possibly all) IPs in those ranges are rented out to this privateinternetaccess.com commercial VPN provider. The latter company does this on purpose, i.e. it uses geographically dispersed IP ranges rented from various other "rackspace" companies, such as the webhosting one you mentioned (which also offers various cloud computing services). The reason to block these ranges is that they are potentially used by this almost-open proxy VPN (it costs a few dollars a month). It's indeed possible that we block some web hosting company as collateral damage, but being owned by a web hosting company is not the reason for the proposed block. The reason is that it's a VPN used by a pretty disruptive user (~50 reverts in a day at one point). Tijfo098 (talk) 05:10, 17 October 2012 (UTC)
Let me clarify my comment: those IPs may be hardblocked individually as open proxies at any time, but this would achieve very little - Zrdragon12 (or whoever) obviously dispose them off at will. The goal is to find the ranges used by www.privateinternetaccess.com. I merely compared their rdns with Category:Suspected Wikipedia sockpuppets of Zrdragon12, realized that I have no idea of their IP ranges, and wrote my note above, hoping someone would be kind enough to map their IPs :-). Overlaps with webhosts do not bother me - webhosts don't count as a collateral in such cases, unless http://toolserver.org/~helloannyong/range clearly shows some unrelated busy traffic. Materialscientist (talk) 05:38, 17 October 2012 (UTC)
On which range? Like I said, these are geographically dispersed on purpose. Tijfo098 (talk) 08:01, 17 October 2012 (UTC)
All ranges used by privateinternetaccess.com :-), or at least some reasonable coverage of their IPs. Category:Suspected Wikipedia sockpuppets of Zrdragon12 is likely just the tip of the iceberg. Materialscientist (talk) 08:31, 17 October 2012 (UTC)
Hmm, do you have some examples? It it possible that Zrdragon12 has been socking on a more massive scale? The blocking admin said Zrdragon looked like a throwaway account created to edit war and get other editors blocked. Tijfo098 (talk) 09:06, 17 October 2012 (UTC)
Given the baiting to edit war this looks like him too; also admin shopping: [4]. This matches Zrdragon12's MO to "get everyone blocked" because he doesn't care; he just switches IP with a click. Oh, and 23.29.124.109 is an off-shore data center in Costa Rica. I think a CU for "sleeper"/alternate accounts on these ranges is justified at this point. Tijfo098 (talk) 09:21, 17 October 2012 (UTC)
Oh, and abuse from this VPN has been going on for at least a year [5] and Special:Contributions/31.7.59.229, although that guy might not be Z. Something must be done. Tijfo098 (talk) 09:50, 17 October 2012 (UTC)
Per Materialscientist, we should be blocking all the ranges listed in the 'Route' column of this summary, to be sure that we cover privateinternetaccess.com. After doing that, we then proceed to the other suspected socks of Zrdragon12 to see what VPN they use? EdJohnston (talk) 13:10, 17 October 2012 (UTC)
None of 199.21.149.243, 31.7.56.170, 23.29.113.66 or 5.63.144.28 is covered by any range in that robtex.com page (which seems to be just the DNS RR of privateinternetaccess.com), but if put any one of these four IPs in your web browser, e.g. http://199.21.149.243/, it will redirect to privateinternetaccess.com. It's more failsafe to take ranges from the whois info of the addresses that were used by Zrdragon because privateinternetaccess.com obviously rents addresses/servers from others on which they install their VPN exit nodes. See [6] for a web-based whois tool; it's actually linked at the bottom of every Special/Contributions page for IPs :-) Tijfo098 (talk) 03:32, 18 October 2012 (UTC)

Contribs/Collateral damage check

I'm listing here the links using helloannyong's tool (Materialscientist indicated) for browsing the contribs (Beware that Overlordq's range check summary contribs tool [7] returns fewer results for most of these; it seems to list only recent contribs, although how recent, it doesn't say.)

The WP:TLDR version: I think all of them can be blocked without losing any sleep over it. Tijfo098 (talk) 07:17, 18 October 2012 (UTC)

The discussion above for #208.87.137.231 indicates that one year is sort-of standard block for VPN exit nodes. Tijfo098 (talk) 11:36, 18 October 2012 (UTC)

 Done I've blocked 'em all for a year. Salvio seems to have got the quick CU request you posted. Let me know if there['s anything else on this one. Elen of the Roads (talk) 23:03, 18 October 2012 (UTC)

211.75.73.36

– This proxy check request is closed and will soon be archived by a bot.

211.75.73.36 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Blocked as sock for one month, but is it an open proxy? Hash.es says yes (on port 8000) but that's from 2010. It now runs some "WebSTAR Server Suite" which apparently has "Proxy Server (HTTP)" as a feature. Presumably it was misconfigured. Tijfo098 (talk) 05:58, 18 October 2012 (UTC)

IP is an open proxy. Works with me on 8000, just not 100% of the time. Materialscientist (talk) 08:52, 19 October 2012 (UTC)
Yeah, the box is pretty loaded. Even its main web page can take a few seconds to send/display. I guess after two years it became well-known... Tijfo098 (talk) 09:20, 19 October 2012 (UTC)

110.232.42.150

– This proxy check request is closed and will soon be archived by a bot.

110.232.42.150 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock at User talk:110.232.42.150

1 year proxy block from 12 September 2012 by NawlinWiki. This is a Chinese IP address, and from what the user says, this may be a proxy used to bypass the Great Firewall, though whatismyipaddress.com does not detect a proxy server at this IP. JamesBWatson (talk) 10:00, 26 September 2012 (UTC)

Definitely a well-secured host, possibly (per the unblock request) behind the Great Firewall with an endpoint outside the Great Firewall. Also definitely a history of abuse; unsure whether the address is dynamic or static. But there's no open proxy that I can see, at least from this endpoint. — madman 17:50, 27 September 2012 (UTC)


50.117.72.254

– This proxy check request is closed and will soon be archived by a bot.

50.117.72.254 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS.--Jezebel'sPonyobons mots 18:24, 18 October 2012 (UTC)

Was recently reported for spamming so we can assume it's a compromised computer. Tijfo098 (talk) 23:41, 18 October 2012 (UTC)
Also, plenty of vandalism coming from the range [13] [14] [15] and spam too [16] [17], so I wouldn't bother to unblock. Tijfo098 (talk) 18:08, 19 October 2012 (UTC)

85.19.187.21

– This proxy check request is closed and will soon be archived by a bot.

85.19.187.21 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Is this an open proxy? Raised on WP:AN by Drmies. Secretlondon (talk) 22:36, 18 October 2012 (UTC) Reason: Suspicious edits

More likely a bored employee of the Bergen Kommune. (Or someone letting their kids surf on their computer at work. Maybe they have a public library?) Tijfo098 (talk) 23:29, 18 October 2012 (UTC)
Might have been a misconfigured PC in the past, but seems like a shared community IP now. I've changed to anonblock. Materialscientist (talk) 05:35, 20 October 2012 (UTC)

85.214.231.59

– This proxy check request is closed and will soon be archived by a bot.

85.214.231.59 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. This IP address is part of this rangeblock. Salvio Let's talk about it! 14:34, 19 October 2012 (UTC)

Registration hasn't changed. It still belongs to http://strato.de Strato AG. They rent VPSs among other things. At 0 euro intro price, it looks like a cheap way to set up a proxy/VPN. It may not be a completely open though. Their web page and our article say it no longer offers DSL services, just webhosting-related services. That IP is registered as name server and mail server for a dozen of domains, which is an odd choice for anyone to use as means of editing wikipedia. It could be a techie wanting to edit from work, but it could be a compromised box as well. Actually, one of the domains using it as NS is http://hotel-madz.com/, which offers a hotspot, so it might have something to do with that too. Tijfo098 (talk) 15:17, 19 October 2012 (UTC)
And it looks like my intuition about the hotel business was correct. There's another IP from the same range which requested unblock: [18] saying it's a hotel. And apparently a techie too [19]. There were some disruptive edits from the range in 2009 though [20]. Perhaps a soft-unblock like it was done here is the way to go. 15:41, 19 October 2012 (UTC)
Thanks for the reply; I'll follow your suggestion for the moment, softblocking. Other admins disagreeing are welcome to revert. Cheers. Salvio Let's talk about it! 19:23, 20 October 2012 (UTC)

199.119.76.22

– This proxy check request is closed and will soon be archived by a bot.

199.119.76.22 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

ANI mud-thrower. IP listed on two blacklists on Robtex. http://whatismyipaddress.com/ip/199.119.76.22 says confirmed proxy. Tijfo098 (talk) 13:21, 20 October 2012 (UTC)

IP is an open proxy, blocked. Materialscientist (talk) 13:28, 20 October 2012 (UTC)

199.119.76.111

– This proxy check request is closed and will soon be archived by a bot.

199.119.76.111 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Another one from the same range, which is reported as open proxy [21]. (Also runs a world-exposed squid on 3128.) This one hasn't been obviously disruptive though. Tijfo098 (talk) 14:27, 20 October 2012 (UTC)

IP is an open proxy, blocked, thanks. Materialscientist (talk) 22:30, 20 October 2012 (UTC)
I just found out that this is one of the exit points of GTunnel. Tijfo098 (talk) 14:00, 24 October 2012 (UTC)


184.106.81.13

– This proxy check request is closed and will soon be archived by a bot.

184.106.81.13 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. Unblock request on User talk:184.106.81.13 "it is not clear why this has been blocked. It is not an open proxy. Please speedily unblock."  Ronhjones  (Talk) 02:03, 29 October 2012 (UTC)

  • Perchance, two private websites are hosted on 184.106.81.13,[22] which is owned by Rackspace, a firm that has a background with us on open proxies.
And that would be me. This IP came up in Wikipedia:Sockpuppet investigations/Leontopodium alpinum - I blocked the IP because it was Rackspace. I would be keen to find out if the IP requestiong an unblock is a party to the SPI. --Elen of the Roads (talk) 00:21, 3 November 2012 (UTC)
I posted on the IP's talk, trying to learn if they were using a VPN. I found the answer unsatisfactory, so I recommend that we leave the IP blocked. EdJohnston (talk) 05:54, 6 November 2012 (UTC)


95.142.164.78

– This proxy check request is closed and will soon be archived by a bot.

95.142.164.78 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Geolocate page states "Confirmed proxy server". IP making same abusive and disruptive edits as already-blocked proxies 88.65.233.219 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan and 202.127.28.67 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Reason: Disruptive edits

RolandR (talk) 11:06, 2 November 2012 (UTC)

First and third are confirmed and blocked open proxies; second made no edits, Google does suggest it is/was an open proxy, but I can't connect through it right now. Materialscientist (talk) 11:35, 2 November 2012 (UTC)
Sorry, second should have been 188.65.233.219 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan RolandR (talk) 20:54, 2 November 2012 (UTC)
Elokid already blocked it as an open proxy, and it seems it is. Materialscientist (talk) 22:27, 2 November 2012 (UTC)


66.68.58.92

– This proxy check request is closed and will soon be archived by a bot.

66.68.58.92 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #4607. This IP has been blocked as a proxy since 2006. --Jezebel'sPonyobons mots 18:04, 6 November 2012 (UTC)

I see no evidence it is currently active, thus unblocked. Feel free to reblock if I missed someting. Materialscientist (talk) 22:46, 6 November 2012 (UTC)
Thanks for checking, I've notified the IP user that the block has been lifted. --Jezebel'sPonyobons mots 23:59, 6 November 2012 (UTC)

117.239.112.50

– This proxy check request is closed and will soon be archived by a bot.

117.239.112.50 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Unblock request #4588 submitted via UTRS. --Jezebel'sPonyobons mots 18:07, 6 November 2012 (UTC)

Negative. IP is an active open proxy that was operated for quite some time. Materialscientist (talk) 22:40, 6 November 2012 (UTC)
Ok, unblock declined. --Jezebel'sPonyobons mots 00:01, 7 November 2012 (UTC)

59.92.47.201

– This proxy check request is closed and will soon be archived by a bot.

59.92.47.201 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS. Note the IP has been blocked as an open proxy since 2007.--Jezebel'sPonyobons mots 22:27, 7 November 2012 (UTC)

Same as above, I see no evidence it is currently active, thus unblocked. Feel free to reblock if I missed something. Materialscientist (talk) 22:31, 7 November 2012 (UTC)
The IP has been advised of the unblock. --Jezebel'sPonyobons mots 18:47, 8 November 2012 (UTC)


110.34.0.242

– This proxy check request is closed and will soon be archived by a bot.

110.34.0.242 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: requested unblock by Mustapha mansuri (talk · contribs). One-year block from 24 Jan 2012 by ProcseeBot ({{blocked proxy}} <!-- 116.66.197.49:8080 -->). IP geolocates to Kathmandu. JohnCD (talk) 17:43, 15 November 2012 (UTC)

Likely this PC (or its proxy server) were misconfigured/infected in the past. If no other notes, I think it is safe to unblock. Materialscientist (talk) 22:58, 15 November 2012 (UTC)
Thank you. I have unblocked, though I see ProcseeBot has blocked this IP twice before for short periods in July 2010 and March 2011, so there may be a recurring problem. Is there any advice we can give the PC owner? JohnCD (talk) 09:55, 16 November 2012 (UTC)
I won't, because I doubt the wikieditor has full control over the server configuration. If this proxy reactivates, the ProcseeBot bot or admins will reblock it for longer. Materialscientist (talk) 10:21, 16 November 2012 (UTC)
OK, thanks. JohnCD (talk) 10:30, 16 November 2012 (UTC)

66.56.129.202

– This proxy check request is closed and will soon be archived by a bot.

66.56.129.202 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #4843.--Jezebel'sPonyobons mots 19:39, 19 November 2012 (UTC)

Unblocked. Frankly, I don't understand why it was indefblocked in 2006, maybe some logs had been reset since then. Materialscientist (talk) 22:30, 19 November 2012 (UTC)
Unlock confirmed to the IP at UTRS. --Jezebel'sPonyobons mots 03:45, 21 November 2012 (UTC)

189.90.241.170

– This proxy check request is closed and will soon be archived by a bot.

189.90.241.170 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Apparent static proxy (see [23]), currently blocked for abuse, previously blocked as an open proxy. JoeSperrazza (talk) 17:35, 20 November 2012 (UTC)

IP is an open proxy, blocked, thanks. Materialscientist (talk) 22:17, 20 November 2012 (UTC)

109.163.233.205

– This proxy check request is closed and will soon be archived by a bot.

109.163.233.205 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #4925. The editor states they are editing from a cybercafe. Note it is blocked globally. --Jezebel'sPonyobons mots 18:44, 21 November 2012 (UTC)

It is an exit of a tor (which you can see by clicking "tor" above). Tors are equivalent to open proxies for us, thus decline. Materialscientist (talk) 22:35, 21 November 2012 (UTC)
Noted and unblock declined.--Jezebel'sPonyobons mots 18:20, 22 November 2012 (UTC)

68.71.49.183

– This proxy check request is closed and will soon be archived by a bot.

68.71.49.183 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Resolves to http://firecooler.info which describes itself as "a page for bypassing Internet censorship." --Biker Biker (talk) 14:01, 23 October 2012 (UTC)

IP is an open proxy, blocked, thanks. Materialscientist (talk) 22:18, 23 October 2012 (UTC)

202.168.253.162

– This proxy check request is closed and will soon be archived by a bot.

202.168.253.162 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock by Interlingua. עוד מישהו Od Mishehu 09:57, 24 October 2012 (UTC)

This IP was surely an open proxy in September. Its port doesn't work with me right now, but this might be temporal inactivity, and we'll have to wait a few days to confirm that. You can consider granting WP:IPBE to the user. Materialscientist (talk) 10:08, 24 October 2012 (UTC)
IP is listed in numerous blacklists as a source of spam. It looks like it (was) a compromised box. It's currently up, responds to ping. It might have been cleaned. Tijfo098 (talk) 10:11, 24 October 2012 (UTC)
The again, it might be only temporary: "In the past 86.1 days, it has been listed 18 times for a total of 37.4 days" [24]. Tijfo098 (talk) 10:24, 24 October 2012 (UTC)
By the way, Interlingua says xe were using http://ultrasurf.us/ (Ultrasurf) at one point. Tijfo098 (talk) 10:38, 24 October 2012 (UTC)
From the sole independent paper on Ultrasurf: "Upon exit, the Ultrasurf client will close the local proxy and may attempt to set the local registry settings back to a non-proxied state. In the event of a crash the system may be left in a proxied state without a functional or running proxy. This state is not uncommon and such registry changes are non-trivial forensic markers." Tijfo098 (talk) 13:29, 24 October 2012 (UTC)

220.255.1.105

– This proxy check request is closed and will soon be archived by a bot.

220.255.1.105 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

I haven't been involved with reporting proxies before and I am not sure whether this requires action. Please advise so I know what to do next time.

This address has been the source of some vandalism, but it also appears to be the source of some legitimate edits.

whatismyipaddress.com says that this IP address is a known proxy server[25] in Singapore and is on the following blacklists:[26]
pbl.spamhaus.org
xbl.spamhaus.org
zen.spamhaus.org
dnsbl.tornevall.org

I believe that being on xbl.spamhaus.org (Spamhaus Exploits Block List) means that this is a hijacked PC's infected by 3rd party exploits. --Guy Macon (talk) 20:54, 28 October 2012 (UTC)

  • SingNet. There's been a thread on the checkusers mailing list about SingNet, so I guess it will get dealt with there. --Elen of the Roads (talk) 00:55, 3 November 2012 (UTC)
    • SingNet proxies are notoriously difficult to block due to way the IPs change. Most of the caching proxies have served as exits for open proxies at some point. The proxies are not very stable either, so aren't generally a long term problem. Some one might want to see about XFF. -- zzuuzz (talk) 23:12, 13 December 2012 (UTC)

74.52.95.202

– This proxy check request is closed and will soon be archived by a bot.

74.52.95.202 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS; note it is part of a range that was blocked as a proxy back in 2007. --Jezebel'sPonyobons mots 19:16, 29 October 2012 (UTC)

Any luck checking this? The user's unblock request is still on hold pending review here. --Jezebel'sPonyobons mots 17:59, 4 November 2012 (UTC)
The block is at 74.52.0.0/16 (block range · block log (global) · WHOIS (partial)). I have asked Ryulong if he wants to comment here. The Planet Internet Services is a web host. Unless the IP can explain why he has a special need to edit from here (for example he could be on a VPN) I wouldn't favor an unblock. EdJohnston (talk) 15:48, 29 November 2012 (UTC)
There's no real need to edit through a dedicated server or cloud computing IP address, but I'm not an admin anymore so I can't do anything about it.—Ryulong (琉竜) 16:49, 29 November 2012 (UTC)
The IP notes in their unblock request "I use this IP range since I live overseas in a country with a communist regime that occasionally blocks Wikipedia".--Jezebel'sPonyobons mots 18:07, 29 November 2012 (UTC)
In that case you might consider if you are confident enough to recommend IP block exemption for this person. You have the ability to talk to them off-wiki through UTRS. Perhaps they have a previous editing record they can point to? EdJohnston (talk) 18:39, 29 November 2012 (UTC)

67.152.84.98

– This proxy check request is closed and will soon be archived by a bot.

67.152.84.98 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Please look at the IP and range to see if a {{webhostblock}} should be applied. Thank you. If you have a sec please poke me at my talk when done. thanx again. Mlpearc (powwow) 02:32, 4 November 2012 (UTC)

Adding to the reason, this was a request that I made at another venue with the statement: "This range does have a certain webhost part to it. The specific IP likely belongs to a webhost section of the ip." If someone could give me a second opinion, that would be great. Thanks. -- DQ (ʞlɐʇ) 04:00, 16 November 2012 (UTC)
  • That is actually part of a larger /14. Even just testing the /16 leaves us with 65k addresses to check. I can probably write a script that is more selective in looking at ports, so I'm not making anyone mad for hammering their ports, but it will be less accurate and would take a while to run. Dennis Brown - 2¢ © Join WER 03:16, 11 December 2012 (UTC)
  • Spot checking several /24s on this network finds nothing has changed and a number of open proxies and misconfigured systems still exist. I would still consider this a risk, and continuing the block shouldn't have any collateral damage. Dennis Brown - 2¢ © Join WER 13:57, 12 December 2012 (UTC)

93.186.23.81

– This proxy check request is closed and will soon be archived by a bot.

93.186.23.81 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: This IP is blocked as a proxy on other Wikipedias. --SMS Talk 20:13, 21 November 2012 (UTC)

Can this request be handled please. There is a request on ACC related to it. Thanks --SMS Talk 18:17, 29 November 2012 (UTC)
Resolves as 93-186-23-81.rdns.blackberry.net. Doesn't look like an open proxy on this end. Dennis Brown - 2¢ © Join WER 18:43, 29 November 2012 (UTC)
Thanks Dennis! this request may now be archived. --SMS Talk 20:18, 30 November 2012 (UTC)

80.58.250.90

– This proxy check request is closed and will soon be archived by a bot.

80.58.250.90 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #4949.--Jezebel'sPonyobons mots 18:40, 22 November 2012 (UTC)

I don't see a proxy there right away, but Elockid is a checkuser, and for some reasons blocked it as a /25 range. Better ask him. Materialscientist (talk) 00:02, 23 November 2012 (UTC)
This was previously a proxy. I'll take a look see once I'm done with damage control. Elockid (Talk) 14:51, 26 November 2012 (UTC)
I've unblocked it for now. We can reblock the range later if any abuse continues. Elockid (Talk) 15:00, 26 November 2012 (UTC)
The editor has been advised of the unblock. --Jezebel'sPonyobons mots 18:09, 27 November 2012 (UTC)

59.93.255.199

– This proxy check request is closed and will soon be archived by a bot.

59.93.255.199 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #4988.--Jezebel'sPonyobons mots 17:19, 25 November 2012 (UTC)

Unblocked. Dynamic IPs should never be indeffed. The IP is blackilsted in many lists, but I see no evidence it is currently an open proxy - likely past echoes. Materialscientist (talk) 23:08, 25 November 2012 (UTC)
The editor has been advised of the unblock. --Jezebel'sPonyobons mots 18:11, 27 November 2012 (UTC)

173.58.60.101

– This proxy check request is closed and will soon be archived by a bot.

173.58.60.101 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

This was initially listed at Wikipedia:Sockpuppet investigations/173.58.60.101, but it appears to be a webhost and is blacklisted in several spam lists. I don't know how to check for a webhost, so I'm reporting it here. Reaper Eternal (talk) 14:47, 26 November 2012 (UTC)

84.45.47.130

– This proxy check request is closed and will soon be archived by a bot.

84.45.47.130 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #5000.--Jezebel'sPonyobons mots 18:15, 27 November 2012 (UTC)

162.96.105.84

– This proxy check request is closed and will soon be archived by a bot.

162.96.105.84 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #5060. Note the IP is blocked globally. --Jezebel'sPonyobons mots 19:34, 28 November 2012 (UTC)

Unblocked locally because I do not see a proxy there, looks like a hospital, might have been misconfigured or behave like a proxy, who knows - reblock if you see more. Materialscientist (talk) 22:56, 28 November 2012 (UTC)
The IP has been informed of the unblock.--Jezebel'sPonyobons mots 18:12, 29 November 2012 (UTC)

74.192.248.248

– This proxy check request is closed and will soon be archived by a bot.

74.192.248.248 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock (UTRS #5082). The IP has been blocked since 2009. --Jezebel'sPonyobons mots 19:04, 29 November 2012 (UTC)

Unblocked - looks like the proxy is gone from that IP. Materialscientist (talk) 23:05, 29 November 2012 (UTC)
The IP has been notified of the unblock. Thank you! --Jezebel'sPonyobons mots 17:58, 30 November 2012 (UTC)

54.243.127.144

– This proxy check request is closed and will soon be archived by a bot.

54.243.127.144 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Says they're not an open proxy. Daniel Case (talk) 19:33, 29 November 2012 (UTC)
I can't connect through it right now, but it was an open proxy a couple of days ago, thus I'd hesitate to unblock (at least right now, without an explanation what was going on there). Materialscientist (talk) 23:02, 29 November 2012 (UTC)
IP is an open proxy Well, I can now connect to it, so it's settled. JamesBWatson (talk) 11:08, 30 November 2012 (UTC)

210.212.231.226

– This proxy check request is closed and will soon be archived by a bot.

210.212.231.226 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Not sure if its a proxy. Showed as Confirmed Proxy server here. Thanks. Suraj T 10:04, 4 December 2012 (UTC) Reason: Suspicious edits

187.54.119.98

– This proxy check request is closed and will soon be archived by a bot.

187.54.119.98 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #5321.--Jezebel'sPonyobons mots 17:17, 10 December 2012 (UTC)

Unblocked. Looks like the proxy is gone, 9 days left until block expiry anyway. That said, proxies from Brazil are very volatile, and anything can happen with this IP in the near future. Materialscientist (talk) 01:38, 11 December 2012 (UTC)
Thank you for checking - the IP editor has been notified. --Jezebel'sPonyobons mots 02:48, 11 December 2012 (UTC)

134.146.0.54

– This proxy check request is closed and will soon be archived by a bot.

134.146.0.54 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #5530. Note this indefinitely blocked as a proxy in 2007.--Jezebel'sPonyobons mots 01:00, 11 December 2012 (UTC)

Unblocked. It has been blocked in 2007-2009 here and on French wiki, thus I trust there was something bad about this IP, but I don't see anything concerning right now. It was blocked as "anonblock" anyway, thus we can always reblock judging by edits (there were none as I can see, and it is too old for CU anyway). Materialscientist (talk) 01:35, 11 December 2012 (UTC)
The IP has been informed of the unblock. Thank you for checking. --Jezebel'sPonyobons mots 02:51, 11 December 2012 (UTC)

69.147.251.50

– This proxy check request is closed and will soon be archived by a bot.

69.147.251.50 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS.--Jezebel'sPonyobons mots 17:55, 17 December 2012 (UTC)

Rangeblocked by zzuuzz as ubiquityservers.com (provider of cloud services; also rangeblocked globally). He might wish to comment. I would hesitate to unblock. Materialscientist (talk) 22:31, 17 December 2012 (UTC)
I'm not in a position to look too closely. This host is a squid proxy for biscience.com, which looks like a commercial VPN service. I doubt it would be properly open, but these anonymising VPNs are the reason the range was blocked. You might want to look at IPBE. -- zzuuzz (talk) 07:11, 18 December 2012 (UTC)

201.73.81.142

– This proxy check request is closed and will soon be archived by a bot.

201.73.81.142 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

See User talk:Acassis - user says the server was misconfigured but has now been sorted out. JohnCD (talk) 18:04, 19 December 2012 (UTC)

58.137.183.91

– This proxy check request is closed and will soon be archived by a bot.

58.137.183.91 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

User at the IP is requesting unblock. I can see a ton of sites that list this as an open proxy, but most identify it as down for some time. My own scan shows nothing on the port ProcseeBot identified (8080), but there are other ports open, including a pptp open port on 1723. Would like someone with more than amateur expertise to review. Kuru (talk) 14:44, 23 December 2012 (UTC)

Reason: Requested unblock.

I "connected" through 8080. There are connection issues, which might trip your scanner (timeout). Materialscientist (talk) 23:20, 23 December 2012 (UTC)
Yes, there is something odd with 8080 (I got a timeout and a closed port on a scanner, but connected with a proxychecker tool); I confirm 8291. Hashes confirms 8080 up to November with availability of 99%. My guess is their have closed 8080 recently and I'm seeing some echo. Materialscientist (talk) 00:25, 24 December 2012 (UTC)

108.34.241.91

– This proxy check request is closed and will soon be archived by a bot.

108.34.241.91 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Says in their unblock request that they've fixed this. Daniel Case (talk) 15:37, 25 December 2012 (UTC)

 Confirmed no longer open proxy. Unblocked. (X! · talk)  · @256  ·  05:08, 26 December 2012 (UTC)

66.135.39.230

– This proxy check request is closed and will soon be archived by a bot.

66.135.39.230 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock on talk page - There is no reason at all why this IP address should be blocked. It is not and never has been an open proxy or similar.  Ronhjones  (Talk) 00:44, 27 December 2012 (UTC)

Unblock denied, appears to be a webhost, which doesn't need to be unblocked anyway. (X! · talk)  · @190  ·  03:34, 31 December 2012 (UTC)

178.170.124.210

– This proxy check request is closed and will soon be archived by a bot.

178.170.124.210 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Trolling message left on my user talk page by a registered user trying to anonymize his editing using hyperion.neuron-network.fr Mathsci (talk) 02:44, 31 December 2012 (UTC)

Per http://178.170.124.210/ this is a Tor exit, thus blocked. Materialscientist (talk) 03:07, 31 December 2012 (UTC)

85.112.95.8

– This proxy check request is closed and will soon be archived by a bot.

85.112.95.8 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits; Geolocate indicates suspected proxy server. JFHJr (㊟) 15:38, 20 October 2012 (UTC)

Only the one edit. Geolocate is not a good source on whether something is an open proxy. Secretlondon (talk) 18:50, 23 October 2012 (UTC)

202.94.66.28

– This proxy check request is closed and will soon be archived by a bot.

202.94.66.28 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #4642. --Jezebel'sPonyobons mots 18:16, 7 November 2012 (UTC)

I've checked the blocking handle 49.236.215.58:8080, and it leads to another IP (which I've blocked). It was a zombie proxy (infected/miconfigured PC) recently. I can't tell for sure about now. Materialscientist (talk) 22:41, 7 November 2012 (UTC)
Should I decline the unblock request as a precaution?--Jezebel'sPonyobons mots 18:47, 8 November 2012 (UTC)
Checked today, block was for 8080 but now 3128 operational but not open proxy and resolves to proxy0.classic.com.np. I don't see anything in Wayback for the parent company and there is a lot of info missing on their website. Dennis Brown - 2¢ © Join WER 13:38, 22 December 2012 (UTC)

180.183.136.245

– This proxy check request is closed and will soon be archived by a bot.

180.183.136.245 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Request on IP talk page  Ronhjones  (Talk) 16:24, 2 December 2012 (UTC) Reason: Requested unblock.

There is plenty of evidence that this IP address was in use as an open proxy within the last few weeks, such as [27], [28], [29], [30], [31]. However, I can't connect to it now. JamesBWatson (talk) 21:14, 2 December 2012 (UTC)
Not currently an open proxy Well, looks like it was a proxy in November, but no longer. The procseebot block has expired, so I'm going to close this one with no action needed. Sailsbystars (talk) 23:53, 13 January 2013 (UTC)

72.52.96.29

– This proxy check request is closed and will soon be archived by a bot.

72.52.96.29 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Recent vandal edits and blocked as an open proxy on German Wikipedia. According to Whois the IP belongs to Hurricane Electric Internet Services which offers web hosting. Callanecc (talk • contribs • logs) 10:08, 20 December 2012 (UTC)

Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:WikiProject_on_open_proxies/Requests/Archives/10&oldid=1140564445"