Wikipedia:WikiProject on open proxies/Requests/Archives/20

73.39.248.199

– This proxy check request is closed and will soon be archived by a bot.

73.39.248.199 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock for AfroThundr3007730 (talk · contribs). PhilKnight (talk) 16:50, 12 April 2015 (UTC)

I can't determine if it's still completely open, but there's some very fishy things going on with that IP. Reaper Eternal (talk) 16:10, 13 April 2015 (UTC)

http://73.39.248.199 displays a holding page (if you click through all the warnings about bad certificates). I'd recommend a {{webhostblock}}. This IP has been originating Wordpress Viagra spam as recently as March, so if the machine is owned by AfroThundr3007730, he does not keep it well secured. EdJohnston (talk) 20:02, 13 April 2015 (UTC)

Port 8080 is set up as a http proxy (though I couldn't connect with a few attempts), and there are a few other open ports that are commonly used for proxy setting, thus I won't unblock. Materialscientist (talk) 22:26, 13 April 2015 (UTC)

Hi, I may be able to clear up a few questions regarding this IP. It belongs to my router, which has port forwarding set up for multiple services I run for personal use. See here for details regarding what specific services are running. While there are quite a few, I do not host any services that would serve as an open proxy on this IP. Hopefully this clears up some of the confusion. I also have a few questions, which are listed in the relevant section of my talk page. AfroThundr3007730 (talk) 05:12, 15 April 2015 (UTC)

And I'm back again. It seems nobody is willing to outright remove the block. Be that as it may, I still have a few questions on this issue:

1. Is there a way to modify this block to allow logged in users to edit, as in only block the IP edits?
2. Barring that, can an exception be made for a specific user account, namely my own?
3. Can the settings be changed so I can edit more than just my talk page, e.g the rest of my user pages?

It has been extremely annoying trying to get anything done on here, as to modify anything other than my talk page (including to post this comment), I have to tether my laptop through my phone. It's an imperfect solution, of course, as I do not have unlimited data. As I was saying on my talk page, I am also only able to edit User_talk:AfroThundr3007730 and nothing else in my userspace. What needs to happen in order to resolve this? AfroThundr3007730 (talk) 03:11, 22 April 2015 (UTC)

Unblocked. There is no extraneous traffic in recent CU logs. There might have been some email spamming activity routed through this IP, but this, even if correct, is hardly a problem for this wiki. Materialscientist (talk) 03:16, 22 April 2015 (UTC)

Thank You! AfroThundr3007730 (talk) 03:39, 22 April 2015 (UTC)

186.244.253.7

– This proxy check request is closed and will soon be archived by a bot.

186.244.253.7 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. PhilKnight (talk) 22:09, 25 April 2015 (UTC)

Nothing on 8080, or any other open ports I could see. Kuru (talk) 02:10, 28 April 2015 (UTC)

Block has expired; still do not see anything. Closing. Kuru (talk) 03:09, 31 May 2015 (UTC)

152.26.69.36

– This proxy check request is closed and will soon be archived by a bot.

152.26.69.36 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. PhilKnight (talk) 17:27, 27 April 2015 (UTC)

Lots of oddness there. 8080 is still open, and there's some kind of proxy there. I could not connect, however. The IP/port combo shows up on hundreds of proxy lists, some very recent. Kuru (talk) 02:03, 28 April 2015 (UTC)

Note the reverse DNS. I've been trying it, but I believe it may have closed and have unblocked it. It remains under a schoolblock, and no doubt ProcseeBot will catch it if it opens again. -- zzuuzz ^(talk) 19:49, 28 April 2015 (UTC)

Multiple IPs in block/unblock requests

– This proxy check request is closed and will soon be archived by a bot.

87.58.124.203 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

188.228.120.184 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

212.242.162.167 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Several unblock requests popped up that seemed to be from someone editing through a proxy tunnel. They included the message "If you're seeing this message, then this IP should be blocked as an open proxy." Many of the IPs were already covered in range blocks, but the three above were not. I'll scan myself when I get a chance, but I wanted to annotate here for people who are actually good at this. Kuru (talk) 13:31, 2 May 2015 (UTC)

87.58.124.203 and 188.228.120.184 don't seem to have open ports; 212.242.162.167 has 2034/tcp open scoremgr and 2121/tcp open ccproxy-ftp, but I don't know how to connect to those. http://212.242.162.167:2121 says "password required". Materialscientist (talk) 23:09, 2 May 2015 (UTC)

Add me in too. This is Zeke Essiestudy, just to let you know. I'm editing through this link. 107.150.32.226 (talk) 00:52, 4 May 2015 (UTC)

Confirmed that one through the given interface. What did you use to connect to the others? Kuru (talk) 01:08, 4 May 2015 (UTC)

Sorry to say the initial 3 above aren't me, I just decided to use proxy.org, use the "Random proxy" feature, and see if I was able to edit Wikipedia through the proxy instead of seeing seeing a global block + local block notice. I'll tell you if I catch any others. Zeke Essiestudy (talk) 01:12, 4 May 2015 (UTC)

If the IPs offered at proxy.org are currently working proxies, then maybe User:ProcseeBot could add them to its list to be checked. EdJohnston (talk) 02:56, 4 May 2015 (UTC)

Closing this; with no other information on what the entry node is, I can't verify that these are proxies. Kuru (talk) 00:40, 2 June 2015 (UTC)

45.55.180.126

– This proxy check request is closed and will soon be archived by a bot.

45.55.180.126 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Recently used for large-scale harassment of other editors. Hostname cloud.unblockwebsites.ninja — Brianhe (talk) 14:52, 11 May 2015 (UTC)

• It was blocked today on another wiki as a proxy. Ports 80 and 8000 are open amongst other standard ports. zadmin is master login but I don't know how to connect.
   — Berean Hunter (talk) 17:56, 11 May 2015 (UTC)

This site is blocked globally; it's clearly the front end IP for "unblockwebsites.ninja"; a cheesy web proxy site. No need to block locally, really.— Preceding unsigned comment added by Kuru (talk • contribs) 23:04, 30 May 2015‎ (UTC)

43.249.38.98

– This proxy check request is closed and will soon be archived by a bot.

43.249.38.98 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: This Singapore IP reverted at this talk page to restore edit made by an earlier IP from Kolkata, India [1]. Seems like a proxy. Mar4d (talk) 10:25, 12 May 2015 (UTC)

 Unlikely IP is an open proxy. I don't see anything obvious; can't connect to the only open port. Kuru (talk) 02:49, 31 May 2015 (UTC)

94.242.8.71

– This proxy check request is closed and will soon be archived by a bot.

94.242.8.71 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

I've been subject to a fair amount of vandalizing in the past three weeks, and had my talk and userspace pages semi'd for a week. This one's not a vandal, per ser, but appears to be part of the same campaign. Reason: Suspicious edits (including NPA) on my talk page and The Horst Wessel Song

Open proxy blocked. Big fat proxy on 8080; shows up on spam lists as well so likely stable. Now blocked. Kuru (talk) 01:34, 31 May 2015 (UTC)

125.209.88.46

– This proxy check request is closed and will soon be archived by a bot.

125.209.88.46 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Another in the series of IPs harrassing me. (The majority of past ones have been blocked as being open proxies.) Reason: Harrassing edits

Blocked, thanks. Materialscientist (talk) 23:42, 1 June 2015 (UTC)

212.138.92.17

– This proxy check request is closed and will soon be archived by a bot.

212.138.92.17 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Probably the same editor as above. Per geolocate, address has recently beenreported as a spam source. Reason: Suspicious edits

Blocked, thanks. Materialscientist (talk) 00:50, 2 June 2015 (UTC)

168.1.75.61

– This proxy check request is closed and will soon be archived by a bot.

168.1.75.61 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. I saw this IP removing comments at WP:AE. Checking with whois, I saw that this /24 range belongs to Softlayer Hosting. I've imposed a one-month anon-only block of 168.1.75.0/24, marking it as a webhostblock. Would like review here to see if that's correct, and find out if the block should be longer. EdJohnston (talk) 03:30, 18 June 2015 (UTC)

I can't speak to the whole range, but 168.1.75.61:8888 is an Australian exit node for a cheap VPN anonymous proxy service in the US: [2]. Kuru (talk) 11:34, 18 June 2015 (UTC)

Thanks. Since at least one IP in the range is being used as an open proxy (a cheap VPN with no questions asked and no logging), I've upgraded this to a hardblock of the range for one month. EdJohnston (talk) 15:49, 18 June 2015 (UTC)

168.1.99.213

– This proxy check request is closed and will soon be archived by a bot.

168.1.99.213 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. This particular IP is now blocked for evasion, but it drew my attention to the range. The /24 IP range is used mostly for Gamergate-related edits. (See 168.1.99.0/24 (block range · block log (global) · WHOIS (partial))). Since it's operated by Softlayer Hosting, I've issued a two-month {{webhostblock}} of the /24. This is similar to my previous post here about 168.1.75.0/24 (block range · block log (global) · WHOIS (partial)), which is also operated by Softlayer and is already blocked. The larger /16 is a range operated by RIPE in Amsterdam, but only some of the subranges are run by Softlayer. Would appreciate any comments to be sure this block is correct. EdJohnston (talk) 16:27, 18 June 2015 (UTC)

Exact same service as above running on 168.1.99.213:8888. Labs appears to be down (the rangecontributions tool), but I'll poke around at active IPs in the range to see if anything else is running that proxy before closing this. Kuru (talk) 01:19, 19 June 2015 (UTC)

46.60.253.64

– This proxy check request is closed and will soon be archived by a bot.

46.60.253.64 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Hard pressed to find any good edits in the /24 range. Rangeblock-Calculator indicates it's some kind of proxy.

Blocked /24 range for 72 hours. Checking in here to see if it should be extended. --NeilN ^{talk to me} 14:36, 24 June 2015 (UTC)

Not currently an open proxy. Nothing open on that IP. I also checked a few other active IPs on that range; all of them seem to be locked down. These appear to be exit nodes for The Southest Grid For Learning, which is a UK NGO providing broadband to schools. As such, this is a network "proxy" in that multiple schools likely funnel traffic through them, but not an "open" or "webhost" type of proxy. Your approach of treating them like a normal schoolblock seems sufficient. Kuru (talk) 18:21, 24 June 2015 (UTC)

95.141.29.55

– This proxy check request is closed and will soon be archived by a bot.

95.141.29.55 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

This is CyberGhost open proxy. https://de.wikipedia.org/wiki/CyberGhost_VPN

Along with 95.141.29.54, 95.141.29.53, 95.141.29.56 Another range 85.9.20.144/158. They way Tor exit node is blocked. This should also be blocked. Cyberghost allows users to change his location. Reason: Suspicious edits

Clear proxies for the Cyberghostvpn are on 53, 55, and 56. 54 has the same open ports, but the redirect was down. I hard blocked a tiny range (95.141.29.48/28) that should catch all of those. Will look at the other range in a sec. Kuru (talk) 02:33, 26 June 2015 (UTC)

Same as above, clear exit nodes at 144, 146, 158. Hard blocked 85.9.20.144/28. Kuru (talk) 02:37, 26 June 2015 (UTC)

5.254.97.67/109

– This proxy check request is closed and will soon be archived by a bot.

5.254.97.67 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Cyberghost VPN very long range. From 67 to 109 112.79.37.132 (talk) 09:55, 26 June 2015 (UTC)

Already blocked as 5.254.96.0/21 Materialscientist (talk) 10:07, 26 June 2015 (UTC)

This starts as 5.254.97 not 5.254.96

Just passing by. That netmask means your max host address would be 5.254.103.254. The block accounts for the 5.254.97 as well. Unsure what the /109 stands for, that's not a valid netmask. E. Lee (talk) 05:56, 28 June 2015 (UTC)

216.223.27.59

– This proxy check request is closed and will soon be archived by a bot.

216.223.27.59 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: No need for an unblock persay, but was wondering if I could get a proxy check for this IP, which no longer appears to be an open proxy. A quick nmap -p 1-10000 shows no suspicious ports. On behalf of the WP:ACC team, E. Lee (talk) 05:53, 28 June 2015 (UTC)

I don't see a proxy there. Materialscientist (talk) 22:30, 5 July 2015 (UTC)

Same. No obvious open proxy. Voxel.net / Internap is a web host, which is likely what triggered that proxy block. Kuru (talk) 22:40, 5 July 2015 (UTC)