Wikipedia:WikiProject on open proxies/Requests/Archives/12

194.176.105.135

– This proxy check request is closed and will soon be archived by a bot.

194.176.105.135 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Corporate proxy server. Suspicious POV edits from this IP suggest that it may also be an open proxy being used by blocked or banned editors to edit war in controversial articles such as Uganda Anti-Homosexuality Bill, Talk:LGBT rights by country or territory and Ex-gay movement. - MrX 20:09, 2 April 2013 (UTC)

The IP is currently blocked, so no check is needed.

--184.6.222.14 (talk) 20:45, 2 April 2013 (UTC)

The IP was blocked for vandalism. It should should still be checked to determine if it is an open proxy. - MrX 20:56, 2 April 2013 (UTC)

Inconclusive The ip in question is listed as an open proxy in some sources, but it won't proxy for me in the alleged fashion. It seems to be a gateway server for a major UK hospital and medschool so there would be a lot of people routed through this IP.... Sailsbystars (talk) 05:10, 4 April 2013 (UTC)

83.110.250.156

– This proxy check request is closed and will soon be archived by a bot.

83.110.250.156 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits A editor has been using a long list of open proxies to make edits to push POV at Richard Stallman. Semi protection for a week did not help. An other IP connected to this is 183.179.29.128 and is listed on [1]. 83.110.250.156 is listed on [2]. Belorn (talk) 08:40, 3 April 2013 (UTC)

IP is an open proxy https proxy via 195.229.69.170:80. Probably needs about a 2-6 month block... range looks pretty dynamic. Sailsbystars (talk) 13:44, 3 April 2013 (UTC)

Blocked, thanks. Materialscientist (talk) 13:51, 3 April 2013 (UTC)

201.130.178.219

– This proxy check request is closed and will soon be archived by a bot.

201.130.178.219 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Voted at ANI with no other contribs in 5 years. IP is listed in quite a few black lists. Possibly a compromised computer. Tijfo098 (talk) 23:18, 27 October 2012 (UTC)

Hitting it on port 80 turned up a Nomadix AG 3100 hotspot hardware, so that may be all there is to it. Tijfo098 (talk) 23:20, 27 October 2012 (UTC)

• There are no registered editors on that range, but this is obviously a sock. I would have thought that makes it more likely there's something hinky with the IP. --Elen of the Roads (talk) 00:08, 3 November 2012 (UTC)
• Closing as stale. Dennis Brown - 2¢ © Join WER 18:25, 18 April 2013 (UTC)

207.179.9.4

– This proxy check request is closed and will soon be archived by a bot.

207.179.9.4 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. Request for unblock on talk page - "Please unblock our IP, issues with open proxy have been resolved"  Ronhjones  ^(Talk) 00:25, 11 December 2012 (UTC)

This IP is blocked as /19 range, indefinitely. It belongs to virtela.net, which specializes in cloud and VPN services; thus while indefblocks are almost never warranted, I would hesitate to unblock - even if this particular IP is currently clean for proxies, we can never be sure about the future and about the range.

I'm also not sure how to understand the comment "issues with open proxy have been resolved" - who said there was a proxy on this IP? These IPs are likely managed separately, thus resolved where? Materialscientist (talk) 00:46, 11 December 2012 (UTC)

My experience with these types of ranges have been mainly the piles of COI editors, with legitimate uses being rare. I would agree with the hesitation. Dennis Brown - 2¢ © Join WER 14:17, 12 December 2012 (UTC)

This IP is IMO the office IP for extremenetworks, not an open or cloud proxy, and if this can be shown to be the case - best by email - would normally be afforded a softblock. -- zzuuzz ^(talk) 23:03, 13 December 2012 (UTC)

• Closing as no new developments and every option has already been discussed. Dennis Brown - 2¢ © Join WER 18:32, 18 April 2013 (UTC)

190.107.140.76

– This proxy check request is closed and will soon be archived by a bot.

190.107.140.76 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Unblock request at UTRS #7338. King of ♥ ♦ ♣ ♠ 20:55, 10 April 2013 (UTC)

 Likely IP is an open proxy I can't get it to proxy for me right now, but there is ample evidence this was VERY recently an open proxy and has been an open proxy for several months.... without strong evidence to the contrary, I don't see any reason to unblock. Sailsbystars (talk) 21:24, 10 April 2013 (UTC)

What about a softblock? The WHOIS returns Honduras which matches the information given by the requester, so he's probably not using a proxy himself. Could it be that the person running the proxy noticed our block and changed their IP address, causing the old IP to be assigned to a different person? -- King of ♥ ♦ ♣ ♠ 21:38, 10 April 2013 (UTC)

Yes, I saw the whois info. There are several possible scenarios:

• • • There was a proxy there, but it has moved to another IP and an innocent user is caught in the block (happens not infrequently, but unusual for just 1 day after a block)
    • There is a proxy there and there is also an innocent user whose IP is affected (this is rare, but has happened before in the case of malware on the users' computer)
    • There is a proxy there and the request is not genuine

Right now I don't have enough evidence to distinguish between these three scenarios. However, given that it was blocked a day ago, the blocking admin may be able to distinguish between the first and the rest of the scenarios. Sailsbystars (talk) 21:56, 10 April 2013 (UTC)

• This IP was used by a spambot in a posting attempt at 01:36, April 9, 2013, and was caught by edit filter 271. I routinely block all of those as proxies. I'm fine with changing it to a softblock if that's what others want. NawlinWiki (talk) 02:23, 11 April 2013 (UTC)

It's pretty clear it was a wide-open proxy for a long time (at least October until two days ago). It's not every IP that returns 50,000 results for this search. Hence why your block was definitely spot on. The question is whether the proxy has closed/is intermittent/has moved. If it were fewer hits or over a narrower time period I'd say go ahead and softblock, but this one looks both popular and long-lived. I guess you didn't actually try to use it then? My attempts to do so have sort of, but not entirely failed.... Sailsbystars (talk) 03:09, 11 April 2013 (UTC)

I'm not very experienced in open proxies, so could you tell me, given an IP address, how would one go about attempting to connect to it? -- King of ♥ ♦ ♣ ♠ 03:38, 11 April 2013 (UTC)

Sorry, by you I meant Nawlin.... was hoping he had proof so that it might make me feel better about my intrasingence. But if you want to know the way to "check" a known proxy... it depends on browser. This page gives a good quick and dirty overview. In this case, rather than getting "refused" or "not responding" (what happens when there's definitely not a proxy) when I try to connect on port 1080 (the listed proxy port for this IP), I get a blank page instead. You want to be careful though to use private browsing or equivalent, because I wouldn't trust a proxy not to try to steal your login credentials. Sailsbystars (talk) 03:47, 11 April 2013 (UTC)

OK, so when I try to connect to various proxies in Google Chrome, one of three things occurs: 1) Instant reject. Happened for 0.12.34.56:8080 (something I made up and presume to not exist) and 190.107.140.76:8080 (the current IP on a different port). 2) Hangs for a long time before giving up. Happened for 190.107.140.76:1080 (the one in question) as well as 64.2.184.130:8080 and 98.119.193.126:8080 (which I sampled from Special:Log/block and presume are not open proxies since all they did was simple, uncoordinated vandalism). 3) Connects. Happened for 203.162.144.83:3128 (recently blocked by ProcseeBot). -- King of ♥ ♦ ♣ ♠ 05:02, 11 April 2013 (UTC)

I've just confirmed this to be open. In your browser enter it as a SOCKS4 or SOCKS4a host, port 1080, and leave the HTTP proxy empty. Personally, even though there are some open proxies I do softblock, I would probably not softblock this IP. If you think you've really found someone editing from Honduras I would use IPBE instead (with a checkuser if circumstances are not obvious). I'm inclined to think it could be a genuinely shared IP with a risk of a genuine user being affected. But it is also certainly an open proxy, and quite a stable one by the looks of it. -- zzuuzz ^(talk) 07:32, 11 April 2013 (UTC)

OK, I replied to them to that effect. This can be closed now. -- King of ♥ ♦ ♣ ♠ 07:39, 11 April 2013 (UTC)

Ahhhhhh, yes, got it to proxy now. Didn't notice it was listed as the SOCKS proxy. Thanks for the checking and explanation, zzuuzz! Closing now. Sailsbystars (talk) 08:41, 11 April 2013 (UTC)

2.176.0.0 to 2.176.253.255

– This proxy check request is closed and will soon be archived by a bot.

2.176.43.62 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan (2.176.0.0 to 2.176.253.255)

Reason: Suspicious edits : this is IP rang use from 1 user with 6 Sp and ip rang=(2.176.0.0 to 2.176.253.255) 1 and 2 - he is chang ip and use any user name and sp - Confirmed Lavasooni = Akhshurush -- he is back with IP and new id - he is trolls , not have way for blocked ip (2.176.0.0 to 2.176.253.255) he,s edit not for Improving the wiki , he is saboteur and Indecency User , thanks dear

Not currently an open proxy No evidence of a proxy, and furthermore, we won't block that range here because there would be too much collateral damage. Sailsbystars (talk) 16:23, 11 April 2013 (UTC)

• Closed for lack of any open proxy evidence. Have to use WP:AIV and WP:RFPP to deal with user. Dennis Brown - 2¢ © Join WER 18:50, 18 April 2013 (UTC)

206.71.149.10

– This proxy check request is closed and will soon be archived by a bot.

206.71.149.10 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock at User talk:RobertMfromLI. This is a range block placed on 206.71.144.0/20 by Kanonkas, dating from 12 April 2009, and due to expire on 12 April 2014. I have found a number of IP addresses in this range that are open proxies, but no evidence that this one is. The user suggests that a smaller range block may be suitable, and it looks to me as though that may well be a good suggestion, but I would be very grateful if someone with more knowledge of proxies than me could have a look at it. JamesBWatson (talk) 20:59, 17 April 2013 (UTC)

DoRD granted them WP:IPBE that resolved the matter. This particular IP has an open pptp port (1723), i.e., it is not necessarily an open proxy, but may be used as one. Materialscientist (talk) 08:34, 18 April 2013 (UTC)

212.118.224.153

– This proxy check request is closed and will soon be archived by a bot.

212.118.224.153 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

I belive this is an open proxy. It is currently blocked for three months. It is my work computer address so I was quite concerned when I had messages (I do not log on when looking things up) and the company IT expert said this was some sort of routing protoocol. So if someone can please have a look and get the thing permanenlt closed I'd be grateful.--Davidvaughanwells (talk) 12:22, 18 April 2013 (UTC)

This is a proxy, but seems like a closed proxy to me (maybe it was open not long ago). Materialscientist (talk) 14:27, 18 April 2013 (UTC)

Looking closely, it does seem to be a legitimate closed proxy, using many different ports, seemingly serving more than one company. Dennis Brown - 2¢ © Join WER 18:46, 18 April 2013 (UTC)

It's a closed proxy. We even have a wiki article on the company that runs it and what kind of proxy it is (corporate filter). So the usual thing here is to anon block (it's basically a school ip). However, having read the article on the service... I'm a little concerned about the fact that it forges certificates and basically sniffs the password information from users. I'm wondering if maybe it should be hardblocked for security concerns? Sailsbystars (talk) 22:40, 18 April 2013 (UTC)

Yes, I think that allowing edits from such a source is highly dubious. I have hard-blocked the IP address for a year. If anyone thinks I am wrong, please feel free to revert. JamesBWatson (talk) 20:56, 24 April 2013 (UTC)

I left a note explaining the hardblock at the bottom of the page. If someone winds up undoing the block at some point, this seems worth starting a chat over at WP:VPT. Sailsbystars (talk) 06:08, 1 May 2013 (UTC)

64.34.51.92

– This proxy check request is closed and will soon be archived by a bot.

64.34.51.92 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

64.34.51.92 is not an open proxy, could you remove from the list? Stephanwehner (talk) 05:52, 18 April 2013 (UTC)

So this is not actually blocked here, but rather at metawiki, so nothing we can do here. This particular IP is caught up in a recent /16 rangeblock on the hosting company (Peer1). Any user wishing to edit from that range should disable their proxy to edit. I doubt the block can be tweaked to allow edits from that particular IP. The particular IP here does not seem to be an open proxy. Sailsbystars (talk) 15:04, 18 April 2013 (UTC)

54.225.81.59

– This proxy check request is closed and will soon be archived by a bot.

54.225.81.59 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Akuri editing using amazon proxy to evade range block by Timotheus Canens. Mathsci (talk) 15:13, 19 April 2013 (UTC)

IP is an open proxy, also confirmed open on port 80. Blocked. -- zzuuzz ^(talk) 18:36, 19 April 2013 (UTC)

198.22.122.0/24

– This proxy check request is closed and will soon be archived by a bot.

198.22.122.0/24 · contribs · block · log · stalk · Robtex · whois · Google

This IP range in not an open proxy. Best Buy would not allow their IPs or machines to be remotely accessed. If the range needs to be blocked it should be block with "anon only" allowing logged in users to edit. — Preceding unsigned comment added by 174.252.17.175 (talk • contribs) Reason: Requested unblock.

Per User talk:198.22.122.160, this is now a CheckUser block due to abusive editing by registered accounts using the range. You would need to appeal to a CheckUser, however per User talk:198.22.122.158, there is probably not much probability of an unblock. This is out of WP:OP's hands, not that we would be likely to unblock the range either. -- zzuuzz ^(talk) 18:23, 19 April 2013 (UTC)

This is troubling indeed, as this is Best Buy Corporate servers which according to PlotIP "This suggests that the IP address is being used by a server (rather than an end user) to vend web pages or other on-line content." Source Of course the various edits from 2008 can be found with Overlord Tools for this range. Contributions of range 198.22.122.0/24. My quest to unravel the mystery of the serial Sockpuppeteer Runtshit and his many aliases has led me to this IP as well, and it is obviously some sort of spoof or redirect - as any simple map plot trace of ips in this range, (in this case IP 198.22.122.160, which goes to Great Britain, then back to the USA). Due to the recent terrorist attacks, I have sent this information to public affairs at Best Buy Corporate to confirm or deny the assumption that the measly 255 ips are used for all of Best Buy stores (wouldn't even cover Texas lol), as well as the FBI. We shall unravel this great mystery!Patriot1010 (talk) 04:37, 20 April 2013 (UTC)

Nice work zzuuzz - This is an IP phone range, using a tether - that is why Whois comes up blank - its not registered, not a network range.

There is an epic 102 page thread about a user in this IP range, who also happened to work at Best Buy (so there is that connection), - dating back from 2008 about an individual who somehow used multiple IP ranges and phone numbers to scam people buying car parts.

This individual lives in the Boston Area, or possibly NY.

A summary of that whole ordeal is here:

http://honda-tech.com/showthread.php?t=2310534

Also the blocked IP user 198.22.122.160 mentioned in this post used an IP tether via landline IP phones in one case to Framingham, MA......This can be found using the google link in the block template of the range or the blocked users, and adding the search term "Phone" (I won't post the phone number, the reader has sufficient information to do that on their own, and is publically available) - but this is why they are showing up as socks - Patriot1010 (talk) 18:45, 21 April 2013 (UTC)

168.94.0.0/16

– This proxy check request is closed and will soon be archived by a bot.

168.94.0.0/16 · contribs · block · log · stalk · Robtex · whois · Google

This is not an open proxy. Reason: Requested unblock. — Preceding unsigned comment added by 209.2.61.8 (talk • contribs)

Request for proxy check should be declined on procedural grounds - see report directly above yours. --184.6.222.14 (talk) 19:11, 20 April 2013 (UTC)

 Declined Yes, again the unblock is declined on the grounds of recent abuse, as mentioned by quite a few CheckUsers this is effectively now a CheckUser block. We could probably have an interesting discussion about how apparently publicly available terminals fall within the open proxy policy, which I would suggest in this case they do, but it would be moot due to the recent abuse. (see also original discussion) -- zzuuzz ^(talk) 19:41, 20 April 2013 (UTC)

192.210.137.161

– This proxy check request is closed and will soon be archived by a bot.

192.210.137.161 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

This IP is a cell phone IP, and as zzuuzz has found, and in this recent case with User Niemti wth ip 192.210.137.161http://en.wikipedia.org/wiki/User:94.246.154.130 - Users are using cell phones to make anonymous IP edits when they should be using their username. When a username is blocked, the ip is not blocked sometimes when cell phones are used.

In this case with IP 192.210.137.161 - while it is attached to a username (and the username is locked), it does not come from an ISP - but a nokia cell phone with a nokia operating system: Source SOURCE 19 Apr, Fri, 08:31:28 192.210.137.161 - No country, Nokia Phone, Nokie operating system.

Reason: Cell Phone IP to a registered Username. Please specifically block the IP 192.210.137.161 Patriot1010 (talk) 17:40, 22 April 2013 (UTC)

This IP is already both range blocked and directly blocked (click on the current blocks link above). It is a web proxy (click on the HTTP link) usable by virtually any person or device with an Internet connection. -- zzuuzz ^(talk) 18:07, 22 April 2013 (UTC)

198.228.228.29

– This proxy check request is closed and will soon be archived by a bot.

198.228.228.29 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock at User talk:198.228.228.29. The block was placed on 18 February 2013 by Toddst1, giving {{blocked proxy}} as the reason. The unblock request says "I am not an open proxy". The IP address is certainly running a proxy server, but I can find no evidence that it is an open proxy. JamesBWatson (talk) 12:42, 23 April 2013 (UTC)

I don't see an open proxy on this IP or its range and would unblock it. It is a hopper though. Materialscientist (talk) 12:53, 23 April 2013 (UTC)

It is a cellular network IP address used by multiple people DIFF IPs that trace back to this IP - Is there a WP: something for cell proxies? Patriot1010 (talk) 16:02, 23 April 2013 (UTC)

AT&T Wireless to be exact (comes up on the Google link) in Kansas. From Google link abovePatriot1010 (talk) 16:15, 23 April 2013 (UTC)

Not currently an open proxy It's actually a dynamic dynamic range (not a typo!). It's a mobile range temporarily leased to AT&T and could readily be leased to someone else. It's actually owned by this group. So I would recommend an unblock or certainly a reduction in block length from the current 7 years. Closed on all standard proxy ports. Sailsbystars (talk) 17:59, 23 April 2013 (UTC)

Y Unblocked. ​—DoRD (talk)​ 18:36, 23 April 2013 (UTC)

Now caught up in a rangeblock for disruptive editing. Nothing more to do here. Marking as closed. Sailsbystars (talk) 05:39, 1 May 2013 (UTC)

173.164.206.181

– This proxy check request is closed and will soon be archived by a bot.

173.164.206.181 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Per UTRS #7459, user believes that he is running a Tor relay node, not a Tor exit node, and has provided [3] as evidence. I know this is not a local block (it's an automatic TorBlock), but I'm hoping people here would know how to deal with this kind of situation. -- King of ♥ ♦ ♣ ♠ 18:12, 24 April 2013 (UTC)

I can pretty much confirm this is the case, though the descriptor ('Tor directory listing') was last updated only 12 hours ago - if it was an exit before that time and the exit was recently removed, it may not have got through to Wikipedia's cached directory yet (in which case try again tomorrow). Otherwise, other than a bug report, I understand IPBE is the only remedy. -- zzuuzz ^(talk) 18:59, 24 April 2013 (UTC)

For future reference, do I understand correctly that the torblocks like this one are hard-coded by the mediawiki software? I.e. they can't be directly altered one way or another by admins? Sailsbystars (talk) 19:41, 24 April 2013 (UTC)

It may be possible to unblock Torblocked IPs by adding them to MediaWiki:Autoblock whitelist. I have never checked. I'm not aware of any other option, including an unblock or a softblock (IPBE would still be preferable to a softblock). I get the impression there have been some very recent changes to the TorBlock config, ie apart from this IP it's now finally working again. -- zzuuzz ^(talk) 20:47, 24 April 2013 (UTC)

I just got two more UTRS requests with the exact same problem; see Wikipedia:Village pump (technical)#TorBlock problems. -- King of ♥ ♦ ♣ ♠ 05:10, 28 April 2013 (UTC)

Deferred to bugzilla:47626, now marked as resolved fixed. IP is also no longer torblocked. -- zzuuzz ^(talk) 08:57, 6 May 2013 (UTC)

131.239.63.5

– This proxy check request is closed and will soon be archived by a bot.

131.239.63.5 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

This is not an open proxy. — Preceding unsigned comment added by 174.252.18.2 (talk • contribs) Reason: Requested unblock.

 Not done This is not a proxy block. Checkuser blocks are appealed to WP:ARBCOM via email. Sailsbystars (talk) 16:26, 25 April 2013 (UTC)

2001:DA8:203:503:D6AE:52FF:FE7B:19FC

– This proxy check request is closed and will soon be archived by a bot.

2001:DA8:203:503:D6AE:52FF:FE7B:19FC · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · geo · rangeblocks · spur · shodan

Reason: I asked Sailbystars about this ipv6 address which appears to be an open proxy. He suggested making a report here. This ipv6 is being used by a problematic user Akuri (talk · contribs · deleted contribs · logs · filter log · block user · block log), who has edited from IP ranges blocked by Future Perfect at Sunrise and then by the arbitrator/checkuser Timotheus Canens. Mathsci (talk) 19:21, 26 April 2013 (UTC)

I can't confirm it, however  Looks like a duck to me. The range is blocked as an open proxy on frwiki[4] (I think that's automated) and the IP is blocked directly as a spambot on wikidata[5]. It certainly smells like an anonymising proxy. -- zzuuzz ^(talk) 20:25, 26 April 2013 (UTC)

It looks like a university's primitive web server for some kind of coding contest. I'd bet dollars to donuts it's improperly set up and functioning as a proxy.... Sailsbystars (talk) 04:11, 27 April 2013 (UTC)

IP is an open proxy Damn. I was right. But I really hope we don't have too many more of these things for a while because only a small subset of my available OS/browser combos let me do this..... So would the appropriate rangeblock for the single user then be 2001:DA8:203:503::/64? Probably for about 6 months since hopefully the university's IT office will start inquiring about why their network is grinding to a halt. Sailsbystars (talk) 04:39, 27 April 2013 (UTC)

Materialscientist blocked the ipv6 for 6 months. I don't know about the range. Thanks to all, Mathsci (talk) 05:22, 28 April 2013 (UTC)

From my experience, they're currently being pretty wasteful so a /64 range may very well be one user. -- King of ♥ ♦ ♣ ♠ 05:40, 28 April 2013 (UTC)

Indeed... that's why I suggested the /64, but in this case I suspect we can get away with the single IP block given that this is something that will hopefully be fixed quickly and that the networking situation is fairly static. Also given that this is one of our first IPv6 proxy blocks, it will be instructive to see if this proxy reappears elsewhere in the /64 range, which is why I'm not overly set on the rangeblock. Sailsbystars (talk) 15:58, 28 April 2013 (UTC)

95.211.99.0/16

– This proxy check request is closed and will soon be archived by a bot.

95.211.99.73 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Unblock request at UTRS #7268. The user claims to be using a closed VPN. Could this range be reduced to a softblock, while individually hardblocking known problematic IPs? King of ♥ ♦ ♣ ♠ 22:25, 11 April 2013 (UTC)

Range is unequivocally an open proxy; unblock request should be declined on procedural grounds.

--184.6.222.14 (talk) 23:22, 11 April 2013 (UTC)

How do you check whether an entire range is an open proxy? -- King of ♥ ♦ ♣ ♠ 23:31, 11 April 2013 (UTC)

You don't, but checking for contributions from the range and block logs of the most active IPs is usually instructive. Haven't looked into this request yet, but the hosting provider here is one a handful I'd consider dismissing the unblock request out of hand.... Sailsbystars (talk) 00:37, 12 April 2013 (UTC)

IP is an open proxy Anyway, this particular ip is nl3.ibvpn.com, a website which offers free vpn preview, which not an open-proxy per se, it offers free anon access to wikipedia, which is close enough. There's also at least one open proxy on the /24, so a partial unblock would be difficult. Sailsbystars (talk) 16:56, 12 April 2013 (UTC)

162.78.70.124

– This proxy check request is closed and will soon be archived by a bot.

162.78.70.124 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

School IP says they're not a proxy. Daniel Case (talk) 16:58, 1 May 2013 (UTC)

It's not hardblocked anyways, so I changed the reason to {{schoolblock}}. It's possible that the blocking admin accidentally selected the wrong option since they're right next to each other on the drop-down. -- King of ♥ ♦ ♣ ♠ 21:02, 1 May 2013 (UTC)

Not currently an open proxy I'll second that assessment. Checked a handful of proxy ports just to be sure. Sailsbystars (talk) 02:28, 3 May 2013 (UTC)

IP 65.49.14.94

– This proxy check request is closed and will soon be archived by a bot.

65.49.14.94 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock; claims they are a school caught in the 65.49.14.0/24 proxy range block.--Jezebel'sPonyo^{bons mots} 21:59, 2 May 2013 (UTC)

Can't do an extensive check right now, but a very cursory study of info on the range indicates that there's good reason to inspect very closely before unblocking. Sailsbystars (talk) 22:29, 2 May 2013 (UTC)

IP is an open proxy Wide open proxy. I claim the requester is full of it. There is at least one, if not two (hell, maybe even three!) proxy services routed through that IP range. Sailsbystars (talk) 02:09, 3 May 2013 (UTC)

Thank you Sailsbystars, the unblock will certainly be declined. --Jezebel'sPonyo^{bons mots} 19:59, 3 May 2013 (UTC)

188.142.108.23

– This proxy check request is closed and will soon be archived by a bot.

188.142.108.23 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Another open proxy being used by the registered user Akuri when logged off. Mathsci (talk) 00:34, 3 May 2013 (UTC)

Confirmed, blocked, thanks. Materialscientist (talk) 00:37, 3 May 2013 (UTC)

186.227.61.51

– This proxy check request is closed and will soon be archived by a bot.

186.227.61.51 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Exactly the same as last time, same user but this time from Rio. Thanks in advance, Mathsci (talk) 07:40, 3 May 2013 (UTC)

Confirmed, blocked, thanks. Materialscientist (talk) 08:14, 3 May 2013 (UTC)

216.151.31.21

– This proxy check request is closed and will soon be archived by a bot.

216.151.31.21 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

<Apparently an open proxy user IP: 216.151.31.21 presents unsubstantiated accusations about a person unrelated to the discussion in anyway, who is probably anaware of the fact, just because user IP: 216.151.31.21 for some reason believes another user in the discussion to be a person this proxy user is obsessed with; visible on: [[6]]> Reason: Suspicious edits

Procedural close as this can be dealt with in the request regarding ExpressVPN just above. -- zzuuzz ^(talk) 08:54, 6 May 2013 (UTC)

Expressvpn

– This proxy check request is closed and will soon be archived by a bot.

216.151.31.117 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

216.151.31.21 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

96.44.187.200 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Looks like an open proxy.

Inconclusive 216.151.31.0/24 belongs to a VPN service expressvpn, but for once it looks like it doesn't have any trial plan and it costs real $ so I don't believe it counts as open and thus is not blockable. Sailsbystars (talk) 02:21, 3 May 2013 (UTC)

96.44.187.192/27 belongs to the same service. It doesn't look like something we can block as a proxy, but we can probably block it like a corporate or school network if there's a high level of vandalism. Sailsbystars (talk) 02:35, 3 May 2013 (UTC)

There isn't a high level of vandalism, nor indeed any vandalism at all. This report was created by a persistent disruptive editor in an attempt to get a block on someone who had been opposing his/her disruptive editing. JamesBWatson (talk) 10:06, 9 May 2013 (UTC)

Indeed, didn't look like terribly disruptive editting to me either, so I'll mark this as closed. Sailsbystars (talk) 13:57, 9 May 2013 (UTC)

203.202.234.243

– This proxy check request is closed and will soon be archived by a bot.

203.202.234.243 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

WHOIS reports this as a confirmed proxy server.[7] - being used to edit war in unsourced information originally added by 116.87.96.48 (talk · contribs) and also geolocating to Singapore. Dougweller (talk) 05:27, 6 May 2013 (UTC)

Reason: Suspicious edits

This is a proxy, with several open tcp ports, but I don't see where it is open for http access. Materialscientist (talk) 05:40, 6 May 2013 (UTC)

Thanks, but I don't understand this. So there are some conditions where editing with a proxy server is legitimate? It's obviously the same editor as the other IP. Dougweller (talk) 07:32, 6 May 2013 (UTC)

Editing with a closed proxy is OK. In any case, Singapore IPs should almost never be hardblocked. -- King of ♥ ♦ ♣ ♠ 07:46, 6 May 2013 (UTC)

(ec) Both IPs are from Singapore, so this is hopping. WP:NOP only concerns proxies that can be used by any outsider, not closed proxies. Note that we do treat some "closed" proxies as "open". A typical example would be a VPN service with a free trial. I don't see such access to this IP right away. If you wait a bit, you might get more feedback from other editors.

I agree with King of Hearts, because Singapore wikieditors typically use highly dynamic and well-managed ISPs, yet I do recall seeing blatant open proxies from Singapore too (which should be hardblocked). Materialscientist (talk) 07:52, 6 May 2013 (UTC)

Singaporean open proxies also famously involve exit servers, but I can't see much evidence of that here. It is a Zscaler proxy which have notorious security issues, but again I can't see any problems here. It is a bit weird it belongs to autodesk; it's possibly the user's employer using it for filtering. Being relatively static (used only by the same person in the last few weeks and possibly longer) also suggests it's not an open proxy. -- zzuuzz ^(talk) 08:24, 6 May 2013 (UTC)

Thanks. I've learned something new! Dougweller (talk) 10:32, 6 May 2013 (UTC)

Ugh, zscaler. Yeah, not open, but we should probably have a discussion about the security issues on VPT at some point. I don't think there's any action to take at this point, so I'll mark it as closed. Sailsbystars (talk) 02:24, 7 May 2013 (UTC)

31.24.33.221

– This proxy check request is closed and will soon be archived by a bot.

31.24.33.221 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Editing pattern very similar to a that of an indef blocked user who has used socks in the past. - MrX 10:40, 6 May 2013 (UTC)

 Likely IP is an open proxy It's open on one of the standard proxy posts (8080), but I can't get it to proxy. Materialscientist has already blocked it for a year, so nothing more to do here. Sailsbystars (talk) 02:16, 7 May 2013 (UTC)

125.18.106.50

– This proxy check request is closed and will soon be archived by a bot.

125.18.106.50 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Appeared to vote delete at an AFD, has not edited the article nor any articles related to it. Accorrding to this it is a proxy. Darkness Shines (talk) 13:36, 9 May 2013 (UTC)

Not currently an open proxy Doesn't look like a proxy to me. Not open on any standard proxy ports, and unfortunately whatismyip frequently seems to get proxies wrong. Sailsbystars (talk) 13:55, 9 May 2013 (UTC)

206.190.158.72

– This proxy check request is closed and will soon be archived by a bot.

206.190.158.72 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Suspicious edits. This edit is obviously a sock. WhatismyIP says this is a Network sharing device or proxy server and has recently been reported for spamming on forums[8]. Darkness Shines (talk) 17:17, 12 May 2013 (UTC)

See nearby and likely related address http://206.190.158.74/ (anonymoX). There's probably a small range block to be had here. -- zzuuzz ^(talk) 17:38, 12 May 2013 (UTC)

I make it 206.190.158.64/28 - now rangeblocked. -- zzuuzz ^(talk) 17:52, 12 May 2013 (UTC)

85.237.212.232

– This proxy check request is closed and will soon be archived by a bot.

85.237.212.232 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

85.237.212.218 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Confirmed proxy according to WhatismIP + is reported as a proxy on IP Tracker Darkness Shines (talk) 19:10, 12 May 2013 (UTC)

Added another IP, same reason as before. Darkness Shines (talk) 19:42, 12 May 2013 (UTC)

Just a placeholder note that I've started looking into this. It's not clear to me whether there's a proxy or not as it's sort of unclear whether it's a corporate network or a hosting network. I'll try to look at it in some more detail tomorrow. Sailsbystars (talk) 06:49, 13 May 2013 (UTC)

See this -- zzuuzz ^(talk) 18:03, 13 May 2013 (UTC)

• This IP address is used by www.hotspotshield.com, which provides a publicly available VPN, effectively an open proxy. JamesBWatson (talk) 10:32, 18 June 2013 (UTC)

97.73.64.144

– This proxy check request is closed and will soon be archived by a bot.

97.73.64.144 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. this says it is a confirmed proxy server. Geraldo Perez (talk) 20:46, 13 May 2013 (UTC)

Looks like a corporate gateway per WHOIS; request for proxy check should be closed as frivolous.

--184.6.222.14 (talk) 21:03, 13 May 2013 (UTC)

• Confirmed proxy server is not the same as Open proxy server. I don't see any ports open doing a quick check. Dennis Brown - 2¢ - © - @ - Join WER 04:59, 16 May 2013 (UTC)

Not currently an open proxy Actually, I think this is a satellite internet IP.... regardless, not a proxy. The only suspicious thing I see is that it has above average activity levels.... Sailsbystars (talk) 07:40, 16 May 2013 (UTC)

125.71.207.194

– This proxy check request is closed and will soon be archived by a bot.

125.71.207.194 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Trolling edits typical of a banned user known for using open proxies in the past. Mathsci (talk) 16:35, 14 May 2013 (UTC)

IP is an open proxy port 1337, blocked. -- zzuuzz ^(talk) 17:03, 14 May 2013 (UTC)

201.220.215.14

– This proxy check request is closed and will soon be archived by a bot.

201.220.215.14 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Frequent vandal, now blocked - http://whatismyipaddress.com/ip/201.220.215.14 says Confirmed proxy server  Ronhjones  ^(Talk) 23:03, 15 May 2013 (UTC)

A quick Robtex search and a contribution search both suggest this is not an open proxy; request for check should be closed. --184.6.222.14 (talk) 23:22, 15 May 2013 (UTC)

• Checking the mostly commonly used ports finds nothing. Only blocked for vandalism, nothing to escalate for. Being a "Confirmed proxy server" isn't the same as being an Open proxy server. Most closed proxies are perfectly fine and allowed here. Dennis Brown - 2¢ - © - @ - Join WER 04:56, 16 May 2013 (UTC)

I seem to recall seeing a similar request a while back (Cuban medical facility), but can't seem to find it in the archives. Apparently individuals associated with the cuban health system like to mess with en-wiki. Sailsbystars (talk) 07:51, 16 May 2013 (UTC)

198.199.67.23

– This proxy check request is closed and will soon be archived by a bot.

198.199.67.23 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

198.199.68.73 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Just posted to Sandsteins talkpage and appears to be trolling, whatismyip says Network sharing device or proxy server. Darkness Shines (talk) 16:48, 16 May 2013 (UTC)

IP is an open proxy Wiiiiiiiiiiiiiiiiide open proxy (us-do-vpn-20130407-4.tunnelbear.com). Not sure about what range to block, but the ip should be blocked for at least a year. Sailsbystars (talk) 17:03, 16 May 2013 (UTC)

Done, thanks. 198.199.64.0/18 seems to be all cloud hosting, but no other edits I could see. 198.199.67.138 seems to be another tunnelbear exit, also blocked. -- zzuuzz ^(talk) 17:54, 16 May 2013 (UTC)

I softblocked the range, while any more individual IPs that come up can be hardblocked. -- King of ♥ ♦ ♣ ♠ 18:02, 16 May 2013 (UTC)

(ec)Sorry but another one just popped up on Sandsteins page again, have added it above. Same tunnelbear thing you mentioned. Darkness Shines (talk) 17:56, 16 May 2013 (UTC)

Beat you to it :p -- zzuuzz ^(talk) 17:58, 16 May 2013 (UTC)

65.49.2.181

– This proxy check request is closed and will soon be archived by a bot.

65.49.2.181 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS (part of this range block from 2009).--Jezebel'sPonyo^{bons mots} 17:21, 22 May 2013 (UTC)

IP belongs to Hurricane Electric - I'm not an admin but if I were I would decline the unblock request out of hand. --184.6.222.14 (talk) 19:27, 22 May 2013 (UTC)

It does seem nothing has changed in the intervening years, that it still belongs to the same anonymiser company, and is being used abusively around the web. There seems to be no reason to lift this block, and it's quite likely the user knows that they're using an open anonymising proxy, sorry, "anti-censorship software". -- zzuuzz ^(talk) 20:09, 22 May 2013 (UTC)

Thanks all - unblock declined. --Jezebel'sPonyo^{bons mots} 20:15, 22 May 2013 (UTC)

208.95.137.219

– This proxy check request is closed and will soon be archived by a bot.

208.95.137.219 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

• An apparently open corporate proxy. GabeMc ^{(talk|contribs)} 00:08, 28 May 2013 (UTC)

Reason: Suspicious edits

Only one edit so far, which is not indicative of an open proxy.

--Bigpoliticsfan (talk) 18:48, 28 May 2013 (UTC)

Hmmmm ... never saw someone with four lifetime edits defending an open proxy here before. The number of edits is irrelevant: if they are editing on an open corporate proxy they will be blocked. GabeMc ^{(talk|contribs)} 00:00, 29 May 2013 (UTC)

 Unlikely IP is an open proxy That's certainly a duckish thing I agree, however the IP does not have any technical evidence of being a proxy. Not open on standard proxy ports and appears to actually be part of a dynamic range. Sailsbystars (talk) 14:41, 31 May 2013 (UTC)

180.74.251.22

A user has requested a proxy check. A proxy checker will shortly look into the case.

180.74.251.22 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

• An apparently open corporate proxy. GabeMc ^{(talk|contribs)} 00:16, 28 May 2013 (UTC)

Reason: Suspicious edits

Inconclusive It's some sort of router, but that's about all I can say. The editing pattern at Led Zepplin is deeply suspicious and certainly looks like proxies. But I can't figure out how any of the IPs there are being used to proxy. Curiosity-raising ports are 2601, 5060, 6789, and 9999. 2601 is a zebra routing protocol, but I don't think that can be used as an open proxy. Sailsbystars (talk) 15:50, 31 May 2013 (UTC)

• I'm only showing 2601 and 5060 today, and I'm getting odd timeouts, so it does look suspicious to me as well. If it was active with those edits, I would be tempted to duck block it. Dennis Brown | 2¢ | WER 22:52, 3 July 2013 (UTC)

118.175.184.102

– This proxy check request is closed and will soon be archived by a bot.

118.175.184.102 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

A user has been making unblcok requests at User talk:203.81.67.249 and User talk:203.81.67.254, both of which are blocked by Zzuuz as open proxies. It is clear from comments at User talk:203.81.67.254 that the user has moved from this range of IP addresses to 118.175.184.102 to avoid the proxy blocks. 118.175.184.102 is itself a proxy, and a spam source, confirmed by http://whatismyipaddress.com/ip/203.81.67.254. However, I do not have evidence whether it is an open proxy or not, but from the circumstances it seems likely. I wonder if someone with more knowledge of how to check these issues than me can look into it. JamesBWatson (talk) 15:32, 30 May 2013 (UTC)

 Unlikely IP is an open proxy The behavior is a bit odd, but there's no technical evidence for a proxy and it's not open on any of the standard proxy ports. Sailsbystars (talk) 16:06, 31 May 2013 (UTC)

OK. Thanks. JamesBWatson (talk) 09:35, 18 June 2013 (UTC)

137.132.250.13

– This proxy check request is closed and will soon be archived by a bot.

137.132.250.13 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

IP owner is requesting recheck via UTRS.—Kww(talk) 16:51, 31 May 2013 (UTC)

Not currently an open proxy Not a proxy anymore. Once was a proxy in June-July 2009.... No longer open on the previously listed proxy ports. DQ's block log links to a domain linking the ip to proxying, but the domain may be stale from the 2009 proxy period. Might want to check with DQ in case there's something I've missed, (since he's still around and reasonably active) but I'd personally lead towards reducing it to a softblock for schoolip vandalism.... Sailsbystars (talk) 18:21, 31 May 2013 (UTC)

Unblocked by DQ. Sailsbystars (talk) 06:50, 4 June 2013 (UTC)

111.92.101.191

– This proxy check request is closed and will soon be archived by a bot.

111.92.101.191 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS.--Jezebel'sPonyo^{bons mots} 20:51, 31 May 2013 (UTC)

Not currently an open proxy Proxy no longer active, safe to unblock. Sailsbystars (talk) 01:21, 1 June 2013 (UTC)

Unblocked. The port listed by the blocking bot is not functional anymore (and this and other ports are filtered on that IP now). Materialscientist (talk) 05:05, 1 June 2013 (UTC)

67.142.174.26

– This proxy check request is closed and will soon be archived by a bot.

67.142.174.26 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #7901.--Jezebel'sPonyo^{bons mots} 19:37, 6 June 2013 (UTC)

Not currently an open proxy This looks likely to be a closed a caching proxy for a satellite ISP. No evidence of open proxy. Should be unblocked immediately. Sailsbystars (talk) 00:52, 7 June 2013 (UTC)

 Done JamesBWatson (talk) 15:15, 7 June 2013 (UTC)

80.235.50.15

– This proxy check request is closed and will soon be archived by a bot.

80.235.50.15 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. Note that this an indefinite proxy block from 2006, so even without the unblock request it still would require review. --Jezebel'sPonyo^{bons mots} 20:32, 11 June 2013 (UTC)

Unblocked - I see no sign of an open proxy there now. Materialscientist (talk) 22:15, 11 June 2013 (UTC)

157.92.4.71

– This proxy check request is closed and will soon be archived by a bot.

157.92.4.71 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: The Proxy IP is edit warring and inserting a nationalistic pov. Likely an old/banned user.--Supreme Deliciousness (talk) 09:31, 12 June 2013 (UTC)

University IP. I see no sign of an open proxy. Materialscientist (talk) 09:36, 12 June 2013 (UTC)

I too can see no evidence of an open proxy. Neither edit warring nor inserting a nationalist point of view is evidence of an open proxy: both of those can just as easily be done without using open proxies. JamesBWatson (talk) 09:15, 18 June 2013 (UTC)

83.170.64.0/19

– This proxy check request is closed and will soon be archived by a bot.

83.170.64.0/19 · contribs · block · log · stalk · Robtex · whois · Google

See User talk:Bigpresh. Range was blocked as an open proxy in Dec. 2011. JohnCD (talk) 17:05, 27 March 2013 (UTC)

I'm at work now so I can't do any serious checking. I was involved in the original block and there were definitely strong reasons to consider it a proxy at the time discussion 2 discussion 1. However, if they're now serious about nuking proxies on their net, that can only be a plus. Sailsbystars (talk) 17:51, 27 March 2013 (UTC)

I'm going to leave a note on the user's talk page. Sailsbystars (talk) 07:25, 28 March 2013 (UTC)

Query: has anyone else heard more from this user? My conversation on the user page hasn't gotten a response, nor have I heard anything via email? Sailsbystars (talk) 02:24, 10 April 2013 (UTC)

No response... no action.... Sailsbystars (talk) 01:04, 2 April 2014 (UTC)

62.84.94.6

– This proxy check request is closed and will soon be archived by a bot.

62.84.94.6 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Currently anonblocked, and confirmed proxy which is already blocked on commons, arwiki, frwiki, and ruwiki. FunPika 12:31, 10 April 2013 (UTC)

Inconclusive - It's in several proxy lists, but it resolves to cachebox.lynx.net.lb, which implies that its a caching proxy for a specific ISP, not an open proxy that anyone can abuse. I found one alleged proxy mechanism, but it didn't work for me. The anonblock seems to be the appropriate solution here. The RU wiki proxy listed entrance server for this IP (62.84.73.100) seemed to work but didn't actually change my IP. Sailsbystars (talk) 17:51, 10 April 2013 (UTC)

• Only 8082 looks possible, and that isn't an open port at the time I checked. Dennis Brown - 2¢ © Join WER 18:35, 18 April 2013 (UTC)
  • Checked again today, same thing. Dennis Brown - 2¢ © Join WER 00:48, 8 May 2013 (UTC)
    • Per what Sailsbystars said, the current block seems appropriate - closing. -- zzuuzz ^(talk) 09:30, 11 May 2013 (UTC)

Tor nodes

– This proxy check request is closed and will soon be archived by a bot.

96.44.189.98 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: List of Tor nodes, can someone look and make sure all of these are blocked? I'm finding some are unblocked. -- DQ (ʞlɐʇ) 02:02, 2 May 2013 (UTC)

So what exactly counts as unblocked? If something is globally blocked, but only anon-blocked here should we tweak it to full local block? (e.g. [9]) Sailsbystars (talk) 02:33, 7 May 2013 (UTC)

212.233.251.7

– This proxy check request is closed and will soon be archived by a bot.

212.233.251.7 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

This IP is asking to be unblocked. The range 212.233.251.0/24 was blocked by Materialscientist on 7 Oct 2012 with reason "blocked proxy: bgvpn.net". JohnCD (talk) 20:16, 17 June 2013 (UTC)

Decline: bgvpn.net currently exits at this particular IP. Materialscientist (talk) 22:09, 17 June 2013 (UTC)

An open proxy, as shown by these two edits: [10] [11]. JamesBWatson (talk) 09:33, 18 June 2013 (UTC)

218.22.21.3

– This proxy check request is closed and will soon be archived by a bot.

218.22.21.3 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Chinese university IP says it's just shared, not open. Daniel Case (talk) 16:58, 18 June 2013 (UTC)

Unblocked. The entry port 159.226.71.138:1170 now exits at 222.195.73.119, also a Chinese university IP. The pattern of open ports is vastly different between these IPs though, i.e., it seems 218.22.21.3 has been taken care of locally. Materialscientist (talk) 22:35, 18 June 2013 (UTC)

Reblocked. Whatever the situation was when Materialscientist checked in June, the proxy is back to being open now. I have just edited from it to confirm that it is. JamesBWatson (talk) 10:24, 23 July 2013 (UTC)

189.1.128.130

– This proxy check request is closed and will soon be archived by a bot.

189.1.128.130 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

This appears to be an open proxy, currently being used to blank various bits of sourced content. Mathsci (talk) 04:38, 19 June 2013 (UTC)

IP is a static address assigned to an internet service provider.

--Bigpoliticsfan (talk) 11:56, 19 June 2013 (UTC)

Sorry, I would prefer comments from someone with experience here, not from a recently created account. Thanks, Mathsci (talk) 18:23, 19 June 2013 (UTC)

A quick look shows this is a caching proxy from a brazilian dial-up ISP (aside: Netscape still exists?!!?!?!?!! Brings back memories....). Can't check now if it's misconfigured, but I or someone else should look into that later today. I'd lean toward unlikely based on circumstantial evidence. Sailsbystars (talk) 18:48, 19 June 2013 (UTC)

Not currently an open proxy Yeah, it's not open on any standard proxy ports and the circumstantial evidence is consistent a caching proxy for a dial-up ISP. Sailsbystars (talk) 03:33, 20 June 2013 (UTC)

166.147.72.145

– This proxy check request is closed and will soon be archived by a bot.

166.147.72.145 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

166.147.72.177 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Vandalism and other disruptive editing from this IP address. - MrX 17:55, 25 June 2013 (UTC)

• Adding 166.147.72.177 (talk · contribs) - MrX 18:50, 25 June 2013 (UTC)

Not currently an open proxy ATT cell IPs (which is why there are so many). No recent disruption. Ergo, nothing more to do here. If there's a persistent problem the range may be anon-blocked. Sailsbystars (talk) 19:16, 25 June 2013 (UTC)