Wikipedia:WikiProject on open proxies/Requests/Archives/15
 | This is an archive of past discussions about Wikipedia:WikiProject on open proxies. Do not edit the contents of this page. If you wish to start a new discussion or revive an old one, please do so on the current main page. |
182.50.66.67
– This proxy check request is closed and will soon be archived by a bot.
- 182.50.66.67 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Requested unblock. Block ID #4575939. See User talk:Tolly4bolly. JohnCD (talk) 15:30, 1 January 2014 (UTC)
- Only had a quick look. This user should probably get IPBE until this is looked into further. ping MS. -- zzuuzz (talk) 16:02, 1 January 2014 (UTC)
- Both done (IPBE and ping MS). JohnCD (talk) 17:19, 1 January 2014 (UTC)
88.190.201.82
A user has requested a proxy check. A proxy checker will shortly look into the case.
- 88.190.201.82 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Requested unblock at User talk:ProgVal. Callanecc (talk • contribs • logs) 12:55, 5 January 2014 (UTC)
- IP softblocked. -- zzuuzz (talk) 14:55, 5 January 2014 (UTC)
- However the user is still complaining of a block. -- zzuuzz (talk) 08:52, 6 January 2014 (UTC)
67.142.167.21
– This proxy check request is closed and will soon be archived by a bot.
- 67.142.167.21 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Dynamic address claims block message said it was proxy. Daniel Case (talk) 04:44, 6 January 2014 (UTC)
- It appears to be normal satellite Internet. They can sometimes act openly, but I don't think this is. It was used by the same user for over a year, three or four years ago before it was blocked. It is credible that this is a different user requesting unblock, although it's not possible to say if the IP is still available to the original user. -- zzuuzz (talk) 08:52, 6 January 2014 (UTC)
- Considering (a) what zzuuzz has said, (b) the fact that the problem was several years ago, (c) the fact that there has been no significant problematic editing recently from other IP addresses in a range covering this IP address, and (d) the fact that what the user requesting the unblock says seems to make sense, I will unblock. JamesBWatson (talk) 09:07, 6 January 2014 (UTC)
- It appears to be normal satellite Internet. They can sometimes act openly, but I don't think this is. It was used by the same user for over a year, three or four years ago before it was blocked. It is credible that this is a different user requesting unblock, although it's not possible to say if the IP is still available to the original user. -- zzuuzz (talk) 08:52, 6 January 2014 (UTC)
5.199.136.210
– This proxy check request is closed and will soon be archived by a bot.
- 5.199.136.210 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Another sock of Wikinger (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log), notorious connoisseur of open proxies. Favonian (talk) 17:16, 6 January 2014 (UTC)
Confirmed as an open web proxy (German-webproxy.de) and blocked for three years. JamesBWatson (talk) 20:54, 6 January 2014 (UTC)
65.111.165.156
– This proxy check request is closed and will soon be archived by a bot.
- 65.111.165.156 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Requested unblock at User_talk:Jonheese Ronhjones (Talk) 21:09, 9 January 2014 (UTC)
- IPBE was given. Now moot. Sailsbystars (talk) 02:05, 14 February 2014 (UTC)
196.45.51.39
– This proxy check request is closed and will soon be archived by a bot.
- 196.45.51.39 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Requested unblock via UTRS. Note that the user has not denied using an open proxy, however as it is a bot block I thought it prudent to double check. --Jezebel'sPonyobons mots 17:59, 10 January 2014 (UTC)
- As the blocking bot specified, this IP does act as an open proxy (mikrotik proxy), but it is not much of an anonymizer :-). Still, better keep blocked. Materialscientist (talk) 00:49, 11 January 2014 (UTC)
- Noted and declined accordingly. Thanks, --Jezebel'sPonyobons mots 20:17, 16 January 2014 (UTC)
41.87.202.2
– This proxy check request is closed and will soon be archived by a bot.
- 41.87.202.2 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
See User talk:Abu Shawka. This is an established editor (over 3 yrs, 5,000 edits, no blocks) - any objection to IPBE if there is a problem with the IP? JohnCD (talk) 17:37, 16 January 2014 (UTC)
- I went ahead and re-instated IPBE for Abu Shawka. 41.87.202.2 is a vulnerable IP, which seems to be hijacked as an exit port (of an open proxy) from time to time. Materialscientist (talk) 00:32, 17 January 2014 (UTC)
74.206.99.126
– This proxy check request is closed and will soon be archived by a bot.
- 74.206.99.126 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Fenn14craig2394 (talk · contribs) says this, their corporate IP is in the middle of a rangeblock, but as far as they know they're not open. Daniel Case (talk) 19:17, 18 January 2014 (UTC)
- Unblock request was declined in January, and there seems to have been no further request. The editor who uses the pseudonym "JamesBWatson" (talk) 21:07, 19 March 2014 (UTC)
80.187.100.175
– This proxy check request is closed and will soon be archived by a bot.
- 80.187.100.175 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: IP used to troll. GabeMc (talk|contribs) 19:01, 26 January 2014 (UTC)
- That is really not a reason to suspect an open proxy. A very quick check provides no evidence whatever to suggest one, either. JamesBWatson (talk) 10:32, 30 January 2014 (UTC)
140.203.12.4
– This proxy check request is closed and will soon be archived by a bot.
- 140.203.12.4 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Requested unblock at User talk:Jakub Bialek. The IP address was blocked as an open proxy on 15 August 2006 by Alex Bakharev. It is clear from mentions on web sites that this was an open proxy, but I can find no evidence that it still is. However, I would be grateful if someone with more knowledge of proxies than me could check. JamesBWatson (talk) 14:15, 27 January 2014 (UTC)
- University LAN IP. Should be unblocked immediately. --Bigpoliticsfan (talk) 15:58, 27 January 2014 (UTC)
- This site says that it is still a confirmed proxy server. De728631 (talk) 16:33, 27 January 2014 (UTC)
- FYI: whatismyipaddress.com's proxy and static/dynamic notes should be ignored as they are frequently wrong. —DoRD (talk) 21:25, 27 January 2014 (UTC)
- This site says that it is still a confirmed proxy server. De728631 (talk) 16:33, 27 January 2014 (UTC)
- Also, even if it is correct, it only says that it's a proxy server, not that it's an open proxy. This is probably a proxy accessible only to computers on the University network, not to the general public, in which case it isn't an open proxy. JamesBWatson (talk) 09:46, 28 January 2014 (UTC)
50.160.177.172
– This proxy check request is closed and will soon be archived by a bot.
- 50.160.177.172 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
This IP has been accused of trying to reset a user password without permission [1]. DoRD has already run a checkuser but referred me over here. According to http://whatismyipaddress.com/blacklist-check the IP is blacklisted by Spamhaus and a few others so perhaps there's something about it. De728631 (talk) 15:38, 27 January 2014 (UTC)
- I can see no evidence of an open proxy, but I aslo don't see that it makes any difference whether there is one or not. Whether the IP address is hosting an open proxy or not, clearly it has to be blocked in view of the attempts to break into an account. The fact that it is blacklisted on at least 78 anti-spam databases confirms that. Everything I can see suggests a static IP allocation, too. The only question is for how long it should be blocked. For now I have blocked it for three months. For now, I will leave this report open, in case anyone else has anything different to add. JamesBWatson (talk) 09:52, 30 January 2014 (UTC)
- The only thing I have to add is that CheckUser doesn't provide any useful information beyond confirming that five password reset attempts were made between December 26 and January 26. —DoRD (talk) 17:39, 30 January 2014 (UTC)
- No evidence of proxy, so break in block is sufficient... Sailsbystars (talk) 02:15, 14 February 2014 (UTC)
166.147.123.18
– This proxy check request is closed and will soon be archived by a bot.
- 166.147.123.18 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan User says they want to create an account. Daniel Case (talk) 17:28, 29 January 2014 (UTC)
- I can see no evidence that this is currently an open proxy, but perhaps someone with more knowledge of proxies can check. JamesBWatson (talk) 09:41, 30 January 2014 (UTC)
- Unblocked on 10 February 2014 by Slakr. The editor who uses the pseudonym "JamesBWatson" (talk) 21:02, 19 March 2014 (UTC)
190.38.52.157
– This proxy check request is closed and will soon be archived by a bot.
- 190.38.52.157 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan User says they are not running a proxy. Daniel Case (talk) 17:17, 30 January 2014 (UTC)
- This IP address is listed on several lists of free proxies from December 2013, so presumably it was hosting an open proxy then (on port 8080). However, I am now unable to either connect to the proxy or find any open ports. My inclination is to unblock, but I will wait for a while to see if anyone with more knowledge of proxies than myself can reach a more certain conclusion. JamesBWatson (talk) 15:43, 1 February 2014 (UTC)
- In the absence of further help, I have again checked, and failed to find evidence that the IP address is still running an open proxy, so I have unblocked. If anyone else can find such evidence, though, then it should be blocked again. JamesBWatson (talk) 16:00, 6 February 2014 (UTC)
199.117.152.254
– This proxy check request is closed and will soon be archived by a bot.
- 199.117.152.254 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- Requesting unblock via UTRS #10034.--Jezebel'sPonyobons mots 18:20, 5 February 2014 (UTC)
- Still Awaiting confirmation...Sailsbystars?...Materialscientist?...--Jezebel'sPonyobons mots 22:39, 13 February 2014 (UTC)
- I didn't and don't see an open proxy on this IP, but this is just me. Materialscientist (talk) 22:46, 13 February 2014 (UTC)
Not currently an open proxy Not a proxy. It looks like a bunch of IPs geolocating to the same area making vandaltastic edits to the same article (Lily, Kentucky). Semi the article, unblock the IPs (see article history... whole bunch of proxy blocks that seem to be erroneous). If I were a betting person, I'd bet it's a bunch of bored school kids... or a single bored kid with a lot of free time on his or her hands... No evidence of a proxy. Sailsbystars (talk) 02:03, 14 February 2014 (UTC)
- Unblocked, semiprotected. Materialscientist (talk) 02:35, 14 February 2014 (UTC)
- Gotta love those echo notifications! Cheers to you both, --Jezebel'sPonyobons mots 18:13, 14 February 2014 (UTC)
- Unblocked, semiprotected. Materialscientist (talk) 02:35, 14 February 2014 (UTC)
209.97.203.60
– This proxy check request is closed and will soon be archived by a bot.
- 209.97.203.60 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
IP has been previously blocked multiple times as an open proxy. I blocked it for a week for privacy reasons but I'm not sure how to check to see if it is an open proxy still. -- John Reaves 16:15, 6 February 2014 (UTC)
- Verified, re-blocked, thanks. Materialscientist (talk) 23:08, 6 February 2014 (UTC)
107.150.5.192
– This proxy check request is closed and will soon be archived by a bot.
- 107.150.5.192 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
See http://whois.webrankstats.com/whois/chito.se : http://chito.se Reason: Vandalism Blackberry Sorbet (talk • contribs) 17:51, 22 February 2014 (UTC)
- Already verified and blocked as open proxy. Materialscientist (talk) 23:14, 22 February 2014 (UTC)
91.141.1.184
– This proxy check request is closed and will soon be archived by a bot.
- 91.141.1.184 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: This IP is Austrian, but put in some sexual vandalism in what appears to be Ukrainian at Yulia Tymoshenko. Jesse Viviano (talk) 01:04, 24 February 2014 (UTC)
Inconclusive This is a weirdo. It's kinda in a blocklist for being a mass spamming IP infected with malware. On the other hand, it's a cell IP and the malware is windows desktop flavored (maybe it was a surface or something?). Anyway, the host is down now and I suspect the IP range is pretty dynamic. I don't think it makes sense for a proxyblock unless the same IP comes back with the same vandalism.... Sailsbystars (talk) 05:39, 26 February 2014 (UTC)
- In the absence of any evidence that this is an open proxy, there is nothing to do here. The editor who uses the pseudonym "JamesBWatson" (talk) 20:30, 19 March 2014 (UTC)
72.52.91.19
– This proxy check request is closed and will soon be archived by a bot.
- 72.52.91.19 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits German vandal on 79.194.242.30. Suddenly same edits on 72.52.91.19 - http://whois.domaintools.com/72.52.91.19 says "tor-exit-node.7by7.de" Ronhjones (Talk) 20:40, 2 March 2014 (UTC)
- I have confirmed that this is a Tor exit node, and blocked the IP address for a year. The editor who uses the pseudonym "JamesBWatson" (talk) 20:34, 19 March 2014 (UTC)
67.202.75.53
– This proxy check request is closed and will soon be archived by a bot.
- 67.202.75.53 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Requested unblock via UTRS. This is part of a range blocked locally and globally (https://en.wikipedia.org/w/index.php?title=Special:BlockList&ip=67.202.75.53). Note the user claims this is their work address.--Jezebel'sPonyobons mots 21:54, 14 March 2014 (UTC)
- This is a proxy that requires a username and password to use it. I have no way of telling whether usernames are issued to the public or only to employees of a company, or what, but it certainly seems plausible that the IP address is the user's work address. If it were left to me, I would say there is no evidence that the proxy is an open one, and so I would be willing to unblock, but I will leave this case open in case someone else can give a more definite answer. The editor who uses the pseudonym "JamesBWatson" (talk) 20:50, 19 March 2014 (UTC)
- Elockid, would you like to comment? --Jezebel'sPonyobons mots 21:10, 19 March 2014 (UTC)
- It's common for spammers to heavily abuse networks like these. In many instances, a number of spamfarms with numerous sleepers and a number of accounts globally locked for crosswiki spamming are found. I'm pretty sure that many go undetected and due to the limitations of CU, we won't be able to block these spamfarms. I'm not going to state the limitations publicly since crosswiki spamming is a major resource hog. As indicated by the global block, it appears that there are spammers also abusing this range. Regarding my block, this network was abused by someone trying to evade their block. Really though, unless the company is willing to stop hosting spammers (there's other shady stuff that are hosted with this company), I don't think that we should unblock this network at this time. Elockid (Talk) 21:50, 19 March 2014 (UTC)
- Whois on 67.202.75.53 gives us:
- Steadfast Networks STEADFAST-3 (NET-67-202-64-0-1) 67.202.64.0 - 67.202.127.255
- ZSCALER, INC. STEADFAST-ZSCALER-CHICAGO (NET-67-202-75-0-1) 67.202.75.0 - 67.202.75.255
- www.steadfast.net appears to be a hosting company, so the tag {{webhostblock}} looks correct. Web hosts are treated the same as open proxies by our usual practice. It's hard to see a good reason to make an exception, especially when we believe (per Elockid's comment above, and per Vituzzu's block reason) that the company hosts spammers. EdJohnston (talk) 23:05, 19 March 2014 (UTC)
- Whois on 67.202.75.53 gives us:
- It's common for spammers to heavily abuse networks like these. In many instances, a number of spamfarms with numerous sleepers and a number of accounts globally locked for crosswiki spamming are found. I'm pretty sure that many go undetected and due to the limitations of CU, we won't be able to block these spamfarms. I'm not going to state the limitations publicly since crosswiki spamming is a major resource hog. As indicated by the global block, it appears that there are spammers also abusing this range. Regarding my block, this network was abused by someone trying to evade their block. Really though, unless the company is willing to stop hosting spammers (there's other shady stuff that are hosted with this company), I don't think that we should unblock this network at this time. Elockid (Talk) 21:50, 19 March 2014 (UTC)
- Elockid, would you like to comment? --Jezebel'sPonyobons mots 21:10, 19 March 2014 (UTC)
- On the basis of what Elockid and EdJohnston have said, I would say this is a case for declining the unblock request. In any case, I doubt that there is any more to be added, so I am closing the case. The editor who uses the pseudonym "JamesBWatson" (talk) 11:29, 20 March 2014 (UTC)
- I'm a bit late to this party and see it's already closed, but I just thought I'd point it's a Zscaler proxy which basically performs a man in the middle attack on all SSL traffic. So even in the absence of spam/open proxy issues, it's debatable if we should allow editing from a security stand point.... See e.g. here for an earlier example. Sailsbystars (talk) 00:36, 21 March 2014 (UTC)
85.214.221.228
– This proxy check request is closed and will soon be archived by a bot.
- 85.214.221.228 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Unblock request says it's not an OP, with some technical explanations. Daniel Case (talk) 20:54, 19 March 2014 (UTC)
- It's a webhost offering free intro dedicated and virtual servers. I think the block should stay and the user should disable their proxy if they want to edit wikipedia.... they don't ::need:: to edit wikipedia from that IP and the reasons for the block are still legit. Another option: they can always register an account, since the IP is only softblocked... Sailsbystars (talk) 00:21, 21 March 2014 (UTC)
221.192.133.39
– This proxy check request is closed and will soon be archived by a bot.
- 221.192.133.39 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
I have just blocked this IP 3 days for vandalism, but I see that on 6 Dec 2103 ProcseeBot blocked it for 60 days as a proxy, so I wonder if it should be checked again. JohnCD (talk) 16:32, 20 March 2014 (UTC)
- Verified an open proxy on port 80, already blocked. Materialscientist (talk) 23:24, 20 March 2014 (UTC)
108.222.191.13
– This proxy check request is closed and will soon be archived by a bot.
- 108.222.191.13 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Request for unblock on IP talk page. Ronhjones (Talk) 20:46, 27 March 2014 (UTC)
- Unblocked. I guess they've changed something at the server since 14 March. Materialscientist (talk) 21:39, 27 March 2014 (UTC)