Wikipedia:WikiProject on open proxies/Requests/Archives/9

70.125.85.158

– This proxy check request is closed and will soon be archived by a bot.

70.125.85.158 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS (#2349).--Jezebel'sPonyo^{bons mots} 00:21, 3 July 2012 (UTC)

Not currently an open proxy Used to be, I can't get anything now. No indication that it's been open since the 5th June. -- DQ (ʞlɐʇ) 01:51, 3 July 2012 (UTC)

The praxy is dead sine 2012-06-07 03:02:42, see [1]--Shizhao (talk) 06:17, 3 July 2012 (UTC)

Thanks all - IP unblocked. --Jezebel'sPonyo^{bons mots} 04:22, 4 July 2012 (UTC)

202.137.28.114

– This proxy check request is closed and will soon be archived by a bot. 202.137.28.114 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Although I am not experienced in reporting proxies, I assume that this Ip user is using a proxy.--Nmate (talk) 08:15, 3 July 2012 (UTC)

Confirmed and blocked. Materialscientist (talk) 08:36, 3 July 2012 (UTC)

129.110.5.90

– This proxy check request is closed and will soon be archived by a bot.

129.110.5.90 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Although I am not experienced in reporting proxies, I assume that this Ip user is using a proxy.--Nmate (talk) 08:20, 3 July 2012 (UTC)

Looks like it was open just a few days ago, but right this second I don't see anything. It does belong to the University of Texas, so i'm going to put this on hold, pending recheck. -- DQ (ʞlɐʇ) 14:53, 3 July 2012 (UTC)

Inconclusive. This looks like it's intended to be a streaming server/VoIP server for the University, and these services are not accessible from the outside; however, there are also indications this may be a compromised machine in a botnet, which we can't definitively confirm from the outside either. If there are any disruptive contributions from this IP address in the future, I would anon-block for a couple months. — madman 01:17, 22 July 2012 (UTC)

78.47.154.66

– This proxy check request is closed and will soon be archived by a bot.

78.47.154.66 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: The block log of the Ip user shows that this is a proxy.--Nmate (talk) 08:26, 3 July 2012 (UTC)

 Possible IP is an open proxy, and on a webhost. I have blocked the individual IP for 2 months. -- DQ (ʞlɐʇ) 13:57, 6 July 2012 (UTC)

67.23.168.142

– This proxy check request is closed and will soon be archived by a bot.

67.23.168.142 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edit: template vandalism. Geolocation service reports the IP as an open proxy. --- Dianna (talk) 19:56, 4 July 2012 (UTC)

Webhost, blocked on the /19. -- DQ (ʞlɐʇ) 13:49, 6 July 2012 (UTC)

2A02:2F02:8027:F002:0:0:BC18:2089

– This proxy check request is closed and will soon be archived by a bot.

2A02:2F02:8027:F002:0:0:BC18:2089 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · geo · rangeblocks · spur · shodan

Reason: Very strange Ip address.--Nmate (talk) 07:48, 6 July 2012 (UTC)

 Declined to run a check See IPv6. Materialscientist (talk) 07:58, 6 July 2012 (UTC)

204.93.60.20

– This proxy check request is closed and will soon be archived by a bot.

204.93.60.20 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

User is not directly blocked, here is their unblock rationale: I just tried to edit and found this IP address blocked. I am currently using a library computer, that I mostly use, to view and edit wiki pages. The reason provided is that this IP is an Open Proxy however seeing that I have been using this computer for a while now without any incidences I asked the librarian for information regarding previous users and his log showed that none accessed the internet while they were using it. As per the guidelines, we scanned the computer with Kaspersky PURE 2012 but found no malware. I may well be wrong, but is Spellcast right in the action taken?204.93.60.20 (talk) 11:35, 7 July 2012 (UTC)

Beeblebrox (talk) 19:39, 7 July 2012 (UTC)

Reason: Requested unblock.

I'll respond to this tomorrow. -- DQ (ʞlɐʇ) 03:06, 11 July 2012 (UTC)

Not currently an open proxy – There is no evidence that there is or ever has been an open proxy at this address. The block comment is "AnchorFree, Inc." but the IP address is not assigned to AnchorFree; it's currently assigned to Giglinx. Giglinx is a colocation provider but it also leases lines, and it is presumably the ISP for this library. I am now investigating other addresses within the network blocks that are blocked locally and globally so they can be modified. — madman 16:27, 17 July 2012 (UTC)

AnchorFree, Inc. has the following netblocks assigned to it: 64.55.144.0/22, 74.115.0.0/21, and 199.255.208.0/21. I'm going to try to contact both blocking administrators as the local block comment doesn't accord with the block, and I'd prefer the global block be refined rather than remove it locally. — madman 16:37, 17 July 2012 (UTC)

Hmm, I know that a nearby IP, 204.93.60.222, is definitely a Hotspot Shield proxy from AnchorFree because I tweaked around the program just then and managed to get that as one of the rotating IPs. After finding a confirmed IP, I go to the IP's WHOIS page. When you find one IP this program uses, it's often (if not always) part of a larger range that the company has purchased from a hosting service. According to WHOIS, 204.93.60.222 falls under the CIDR IP block of 204.93.60.0/24, which 204.93.60.20 is apart of. I scanned 204.93.60.20 and 204.93.60.222 with nmap and they both have about a dozen of the same port numbers open. While that doesn't necessarily prove it's an open proxy, the fact that about a dozen of same ports are open on both IPs seems a bit suspicious to me. Anyway, it's possible that the Hotspot Shield could be operating from a much narrower range within the /24, so I've granted the unblock. However, I'll be keeping a lookout on the IPs the Hotspot Shield gives. Spellcast (talk) 17:05, 20 July 2012 (UTC)

Thanks for your unblock and such a detailed explanation of your rationale! I will also keep an eye on contributions from this range; your points are well taken. Cheers! — madman 00:16, 22 July 2012 (UTC)

Unblocking locally as there's been no response whatsoever from the blocking steward or on the Stewards' noticeboard. — madman 04:41, 4 August 2012 (UTC)

213.98.51.34

– This proxy check request is closed and will soon be archived by a bot.

213.98.51.34 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

This IP resolves to a login page that looks like a login page for a proxy server. The editor using this IP address has been making abusive edits and also appears to be making edits from another suspected proxy IP, 83.61.20.30.

Here are some diffs of edits coming from these IPs: [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]

Goodsdrew (talk) 15:39, 11 July 2012 (UTC)

Reason: Suspicious edits

 Unlikely IP is an open proxy at this time. Looks like a FreeBSD box running as a firewall and router, forwarding some ports such as 3333 to hosts on the local network. It looks like there may have been a Squid proxy at port 3128 for some time but if so, that port is now closed. No administration necessary at this time; blocked due to meatpuppeting behavior. — madman 01:27, 22 July 2012 (UTC)

83.61.20.30

– This proxy check request is closed and will soon be archived by a bot.

83.61.20.30 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

This IP resolves to a login page that looks like a login page for a proxy server. The editor using this IP address has been making abusive edits and also appears to be making edits from another suspected proxy IP, 213.98.51.34.

Here are some diffs of edits coming from these IPs:

Goodsdrew (talk) 15:39, 11 July 2012 (UTC)

Reason: Suspicious edits

Not currently an open proxy Appears that IPs are both on dynamic ranges belonging to the same ISP from spain. Website login is for personal firewall software, which is perfectly consistent with a normal user rather than a proxy. Sailsbystars (talk) 16:15, 11 July 2012 (UTC)

212.118.224.156

– This proxy check request is closed and will soon be archived by a bot.

212.118.224.156 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Apparently an open proxy on port 80. UTRS ticket number 2526: "The IP address (212.118.224.156) I am connecting from is owned by Zscaler (http://www.zscaler.com) which is a company that provides a cloud-based web security product for businesses. Their proxy can only be used if your actual IP address is verified in their system and you have a paid subscription for the service, so I don't think it should be classed as open proxy?"--v/r - TP 19:17, 13 July 2012 (UTC)

It is still an anonymizer (which is blocked globally). In my practice, some block evaders are prepared to spend time and money on such routes (e.g. using non-free proxies), thus I would keep it blocked, but this is just my opinion. Materialscientist (talk) 01:38, 14 July 2012 (UTC)

As far as I can see, that is an open proxy, i.e. a proxy that anyone can use. The fact that you have to register and pay money to do so makes no difference that, as far as I can see, is in any way relevant in the terms of Wikipedia's open proxy policy. JamesBWatson (talk) 08:51, 18 July 2012 (UTC)

IP is an open proxy — madman 00:20, 22 July 2012 (UTC)

210.253.96.152

– This proxy check request is closed and will soon be archived by a bot.

210.253.96.152 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Spam-bot tripping edit filter repeatedly. This IP was blocked as a proxy back in October 2010, for two months. Why 2 months? Due to the edit-filter tripping, I have blocked for 72 hours but would like to have this re-checked as an open proxy due to the prior expired block. ~Amatulić (talk) 20:20, 13 July 2012 (UTC)

IP is a stable open proxy, blocked for 2 years; 2 months because the block was issued by a bot. Many proxies are very volatile. Materialscientist (talk) 01:30, 14 July 2012 (UTC)

117.205.135.115

– This proxy check request is closed and will soon be archived by a bot.

117.205.135.115 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Previously blocked as a proxy in March 2011, currently blocked 1 week for block-evasion spamming. Please check if this is still an open proxy. I have also range-blocked the /20 range this IP address occupies for block-evasion spamming. You may want to check if the other 4 IP addresses listed in the report at MediaWiki talk:Spam-blacklist#latestmoviez.com are also open proxies, given that one of them has been in the past. ~Amatulić (talk) 20:27, 13 July 2012 (UTC)

I couldn't verify any of these IPs as proxies, though there is a solid evidence some of them were. I think this is just an abused range (where users setup proxies at will, but they don't last long) that needs to be kept under anonblock, not hardblock. Materialscientist (talk) 01:25, 14 July 2012 (UTC)

Not currently an open proxy — madman 01:50, 22 July 2012 (UTC)

222.127.21.70

– This proxy check request is closed and will soon be archived by a bot.

222.127.21.70 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Geolocate service indicates "confirmed proxy server" Elizium23 (talk) 12:42, 20 July 2012 (UTC)

Not currently an open proxy. That Web site's data is notoriously unreliable when it comes to proxy servers, and I see no evidence in the editing history or in scan results that indicates this is an open proxy. A previously compromised machine or a spammer, maybe. — madman 02:06, 22 July 2012 (UTC)

187.122.136.167

– This proxy check request is closed and will soon be archived by a bot.

187.122.136.167 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

ProcseeBot blocked 187.122.136.167 on 9 June 2012 for 2 months (blocked proxy: port 3128).

An unblock request at User talk:Lguipontes refers to a ProcseeBot block on an unspecified IP address in the range 187.122.0.0/16, but it must be this one. The IP address certainly was running an open proxy: numerous web pages list it as a proxy, such as [12] [13] [14] [15] [16] [17]. However, I can find no evidence that the proxy is still operating.

Reason: Requested unblock.

JamesBWatson (talk) 12:47, 20 July 2012 (UTC)

 Unlikely IP is an open proxy. However, I wouldn't unblock the contributor until a checkuser or someone from UTRS confirms this is the correct address for the contributor. — madman 02:11, 22 July 2012 (UTC)

Not currently an open proxy Unblocked by MuZemike. JamesBWatson (talk) 08:23, 23 July 2012 (UTC)

221.120.115.125

– This proxy check request is closed and will soon be archived by a bot.

221.120.115.125 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits [18]. Most likely banned user Mikemikev (talk · contribs). Geolocate reports the address as a confirmed proxy server. — ArtifexMayhem (talk) 23:03, 20 July 2012 (UTC)

Inconclusive. I don't see evidence that this is a proxy, but I agree that behavioral evidence indicates continued sockpuppeting by Mikemikev (talk · contribs). If disruptive contributions continue, I'd simply apply the duck test. — madman 02:28, 22 July 2012 (UTC)

213.5.65.26

– This proxy check request is closed and will soon be archived by a bot.

213.5.65.26 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Ip editing article targeted by prolific Sockpuppet. See Wikipedia:Long-term abuse/An-Apple-A-NY-Day

Whois shows this ip belongs to dedicated and VPS hosting. Fasttimes68 (talk) 01:30, 22 July 2012 (UTC)

 Likely IP is an open proxy; have blocked editing by anonymous users for six months. — madman 02:41, 22 July 2012 (UTC)

214.26.214.163

– This proxy check request is closed and will soon be archived by a bot.

214.26.214.163 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Appears to be Mikemikev using an open proxy to edit Talk:Race and intelligence. Mathsci (talk) 08:50, 23 July 2012 (UTC)

Not currently an open proxy – Given the host name (bjocproxywccp2.afghan.swa.ds.army.mil) (!), it may be a proxy (or a machine behind the proxy may have been compromised), but it's not open at the moment. — madman 04:48, 4 August 2012 (UTC)

221.120.115.125

– This proxy check request is closed and will soon be archived by a bot.

221.120.115.125 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Appears to be Mikemikev using an open proxy to edit Talk:Race and intelligence. Mathsci (talk) 08:52, 23 July 2012 (UTC)

 Possible IP is an open proxy. I'd lean towards "likely", as there's no reason a Web server should be running in an ISP's dynamic range. Mikemikev doesn't appear to be active at this address anymore, but I'll block for a month or so. — madman 04:56, 4 August 2012 (UTC)

212.118.232.104

– This proxy check request is closed and will soon be archived by a bot.

212.118.232.104 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

This editor [[19]] appears to be using an anonymous/open proxy.

I would hazard a guess that these IPs, also proxies, are the same editor, possibly a blocked editor. User:Irvine22 springs to mind, but I could be mistaken.

1. http://en.wikipedia.org/wiki/Special:Contributions/212.118.232.108

2. http://en.wikipedia.org/wiki/Special:Contributions/212.118.232.112

Sheodred (talk) 14:27, 25 July 2012 (UTC)

Open proxy blocked anonymous users from 212.118.232.0/24 as endpoints of AnchorFree. — madman 20:08, 4 August 2012 (UTC)

199.119.201.93

– This proxy check request is closed and will soon be archived by a bot.

199.119.201.93 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

I have reverted the IP's two edits as unhelpful. whatismyipaddress.com reports the IP as an open proxy:

• http://whatismyipaddress.com/ip/199.119.201.93

-- Petri Krohn (talk) 23:21, 25 July 2012 (UTC)

 Declined to run a check. I have blocked anonymous users from 199.119.200.0/21 as a Web hosting range. — madman 20:13, 4 August 2012 (UTC)

182.71.134.190

– This proxy check request is closed and will soon be archived by a bot.

182.71.134.190 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #2845. Was blocked as a proxy by Procseebot in January 2012. Can you check this is still valid? Secretlondon (talk) 04:51, 2 August 2012 (UTC)

There was a proxy on this IP, but looks like it is gone. Materialscientist (talk) 05:02, 2 August 2012 (UTC)

Not currently an open proxy — madman 20:18, 4 August 2012 (UTC)

70.160.99.196

– This proxy check request is closed and will soon be archived by a bot.

70.160.99.196 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Was blocked as a proxy in 2006! We've had an unblock appeal - UTRS #2458. Can someone check whether this is still valid? Thanks Secretlondon (talk) 20:26, 2 August 2012 (UTC)

Not currently an open proxy – Good lord, a dynamic IP address should never have been blocked for so long. Unblocked. — madman 20:21, 4 August 2012 (UTC)

85.17.23.156

– This proxy check request is closed and will soon be archived by a bot.

85.17.23.156 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock - UTRS ticket #2869. Part of rangeblock 85.17.0.0/16 described as (per sailbystars) which doesn't help say why it was blocked. Webhosting? It's not really an open proxy though, is it? Can someone check the status of this? Thanks. Secretlondon (talk) 23:37, 2 August 2012 (UTC)

Not currently an open proxy – That entire range does belong to LeaseWeb, then is further subdivided for some of its customers. I have changed to an {{anonblock}}. — madman 20:28, 4 August 2012 (UTC)

My apologies, I was looking at the wrong scan results for this one last night; IP is an open proxy for the faceless.me network. I don't think LeaseWeb's entire range should be hard blocked, but I am hard blocking 85.17.22.0/23 and 85.17.24.0/23, this subdivided range. — madman 23:56, 5 August 2012 (UTC)

66.90.65.250

– This proxy check request is closed and will soon be archived by a bot.

66.90.65.250 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Requesting unblock; claims it's a private proxy and not open. Daniel Case (talk) 04:13, 4 August 2012 (UTC)

This IP is blocked as part of the 66.90.64.0/18 range that contains many dozens of active open proxies (Googling "proxy 66.90." would give a rough idea). This IP itself is on a hosting server, i.e. can turn into an open proxy any time. Unblocking this range means opening a can of worms - better ask that editor to request an account. Materialscientist (talk) 04:33, 4 August 2012 (UTC)

That particular address is Not currently an open proxy; I will leave administration up to Materialscientist (talk · contribs) as he's more familiar with the range. I'm not sure that requesting an account would help, as it's a hard block? I think the contributor would have to request an account and then request IPBE for that account. — madman 20:39, 4 August 2012 (UTC)

Correct, and this is what I meant. It is a nuisance, but I think it is justified, given the potential danger related to this IP range and a single character of this request (there were more in the past, all declined, and some obviously came with bad intents [20]). Materialscientist (talk) 23:43, 4 August 2012 (UTC)

Same scanning problem as I had with the above address last night. IP is an open proxy, albeit a paid one. IPBE should not be granted absent exceptional circumstances. — madman 00:03, 6 August 2012 (UTC)

166.147.120.16/28

– This proxy check request is closed and will soon be archived by a bot.

166.147.120.16/28 · contribs · block · log · stalk · Robtex · whois · Google

Reason: This range contains sixteen IPs, and the three I checked are identified as open proxies by our geolocation tool. -- Dianna (talk) 23:28, 4 August 2012 (UTC)

Not currently an open proxy as far as I can tell. Geolocation tools are notoriously unreliable at detecting open proxies; this is not their purpose. Thanks, — madman 01:35, 6 August 2012 (UTC)

65.49.14.83

– This proxy check request is closed and will soon be archived by a bot.

65.49.14.83 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. UTRS #2481. Blocked as Freegate in 2009, requester describes their connection as 'public internet'.Secretlondon (talk) 01:17, 8 August 2012 (UTC)

IP is an open proxy – Confirmed as UltraSurf. Range should remain hard blocked. — madman 15:09, 10 August 2012 (UTC)

65.49.2.27

– This proxy check request is closed and will soon be archived by a bot.

65.49.2.27 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. UTRS #2521. Blocked in 2009 as Freegate. Requester claims this IP belongs to a school. Secretlondon (talk) 01:22, 8 August 2012 (UTC)

 Likely IP is an open proxy – Registered to the same organization as the above range. Possibly UltraVPN, but I can't confirm that right now. I would not unblock as I find it exceedingly unlikely that the IP belongs to a school. I haven't seen anything hosted by this organization that is legitimate. — madman 15:23, 10 August 2012 (UTC)

198.168.27.224

– This proxy check request is closed and will soon be archived by a bot.

198.168.27.224 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. Several UTRS tickets including #2619. Blocked in February as a proxy. The appeals (and WHOIS backs up) say it belongs to the National Library in Quebec. Secretlondon (talk) 01:27, 8 August 2012 (UTC)

Not an open proxy as I can tell. The IP was blocked per edit filter log. Maybe NawlinWiki saw something in that code (in filter log) that was identical to some sock and blocked it per duck test. I'll ask him. Materialscientist (talk) 03:44, 8 August 2012 (UTC)

It's the blocking of logged in editors that's the problem here, really. I'm happy to treat this like a school and stop anon edits. Secretlondon (talk) 04:32, 8 August 2012 (UTC)

That's fine with me, Secret - I think the problem with this one was its use by banned User:Ananny. NawlinWiki (talk) 14:46, 8 August 2012 (UTC)

Not currently an open proxy – Administration taken care of above (switched to anon. block). — madman 17:23, 10 August 2012 (UTC)

220.255.2.172

– This proxy check request is closed and will soon be archived by a bot.

220.255.2.172 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. More from the UTRS proxy backlog - #2641. User said that changed ISP and got hit with the block. Blocked globally as an open proxy. Secretlondon (talk) 01:33, 8 August 2012 (UTC)

There was a zombie proxy on this IP in 2011, but not anymore; zzuuzz unblocked it here in Dec 2011, and I agree with that. The global block is likely set because Google lists the IP as potential proxy. Materialscientist (talk) 03:32, 8 August 2012 (UTC)

Not currently an open proxy – Looks like a caching proxy for an ISP that may have once accidentally been open, but if so this has been fixed. I have removed the global block locally; if there are any disruptive contributions, I think it'd be reasonable to anon. block the address. — madman 17:29, 10 August 2012 (UTC)

202.156.13.10

– This proxy check request is closed and will soon be archived by a bot.

202.156.13.10 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. UTRS #2977. Blocked as a proxy in June. StarHub ISP which has caching proxies. Secretlondon (talk) 01:53, 8 August 2012 (UTC)

A scanner can check this, but it does look like there was a zombie proxy on 80/8080 ports there in 2011, but not anymore. Materialscientist (talk) 03:28, 8 August 2012 (UTC)

Not currently an open proxy – SwiftCache proxy for StarHub; not open. — madman 17:40, 10 August 2012 (UTC)

Unblocked. — madman 19:44, 9 September 2012 (UTC)

93.186.31.82

– This proxy check request is closed and will soon be archived by a bot.

93.186.31.82 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. UTRS #2925. Blocked globally as an open proxy. Blackberry IP range? Secretlondon (talk) 02:35, 8 August 2012 (UTC)

Not currently an open proxy – Yes, Blackberry IP range, and zero evidence of open proxies. As above, I have removed the global block locally, and if there are any disruptive contributions, I think it'd be not only reasonable but wise to anon. block the range. — madman 17:48, 10 August 2012 (UTC)

129.194.8.73

– This proxy check request is closed and will soon be archived by a bot.

129.194.8.73 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Unblock request via UTRS (#3023). The blocked editor notes that they are attempting to edit from the University of Geneva.--Jezebel'sPonyo^{bons mots} 19:49, 9 August 2012 (UTC) Reason: Requested unblock.

There surely was an exit of a tunnel proxy on this IP on 5 August, and maybe even 8 August according to hash.es (129.194.55.134:3128). All signs indicate this was an infection of a university PC, which was probably cleaned up, but maybe better leave it for a couple of days (entry or exit PC might be switched off right now, or entry has hopped). Materialscientist (talk) 22:44, 9 August 2012 (UTC)

Not currently an open proxy – Looks like a caching proxy for the university that may have accidentally been left open but is now closed. (It could have also been a machine behind the proxy, but I think misconfiguration is more likely.) As it's a Cisco network device, and not an end user's device, I think it's likely to stay closed, but I would also leave on hold a few days just to be sure. — madman 17:57, 10 August 2012 (UTC)

Should be safe to unblock. — madman 04:09, 21 August 2012 (UTC)

65.49.14.10

– This proxy check request is closed and will soon be archived by a bot.

65.49.14.10 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. UTRS #3003. Blocked as freegate in 2009. Claims to be a school. Secretlondon (talk) 11:24, 10 August 2012 (UTC)

IP is an open proxy – I was given this IP today through UltraSurf, so I find that claim dubious. — madman 17:50, 10 August 2012 (UTC)

Thanks. It could be that some schools in the middle east are using ultrasurf, but yes I agree. Secretlondon (talk) 20:28, 10 August 2012 (UTC)

IP129.78.32.97

– This proxy check request is closed and will soon be archived by a bot.

129.78.32.97 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Appears to be used by blocked editor User:Karmaisking. Abuse to other editors and edit-warring on the Austrian School. TFD (talk) 03:15, 12 August 2012 (UTC)

This is a university IP and a proxy, but there is no sign of an open proxy. Wikipedia:Sockpuppet investigations/Karmaisking/Archive indicates that Karmaisking operated from Australia. While there is no contradiction to this IP being used by Karmaisking, I would leave this to someone more familiar with the case. Note that the user already hopped to 129.78.32.24 (talk · contribs) (same university) Materialscientist (talk) 03:41, 12 August 2012 (UTC)

IP196.46.71.251

– This proxy check request is closed and will soon be archived by a bot.

196.46.71.251 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock.

The proxy bot says this IP was an open-proxy exit from 41.56.217.123:3128 some time between 3 June 2010 and 30 July 2012. Has.es say it was an exit from 196.214.135.36:9000 until 27 July with a 66.8% availability. The block log [21] says the proxy was on and off for years. The IP is from African Network Information Center, which has a poor reputation in my practice (see also this). This suggests the problem might be with the provider. Nevertheless, the IP doesn't seem safe to unblock - just my opinion though. Materialscientist (talk) 07:12, 19 August 2012 (UTC)

Not currently an open proxy at the moment; up to reviewing admin whether to unblock or not. (I think I'd keep it blocked but change to anon. only, but then it expires soon anyway.) — madman 04:15, 21 August 2012 (UTC)

Block expired, no subsequent unusual activity, closing request. Sailsbystars (talk) 21:05, 2 October 2012 (UTC)

208.53.158.136

– This proxy check request is closed and will soon be archived by a bot.

208.53.158.136 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. UTRS #3261. Blocked in 2008 with an indef proxy block. Reason: AS30058 / FDCservers.net 208.53.128.0/18. Still valid? Secretlondon (talk) 20:29, 23 August 2012 (UTC)

 Unlikely IP is an open proxy Hosting site, appears to currently belong to closed proxy services, although domain names make it appear to have been an open proxy in the past. I spot checked a few other IPs on the range... and they seem to give a similar tale (long-dead proxies, last active circa 2009). Given that we don't indef-block IPs anymore and that it's been almost 4 years, I would lean towards an unblock, with an eye towards re-blocking with a finite term if any new open proxies emerge. Sailsbystars (talk) 22:37, 23 August 2012 (UTC)

This is a hosting range, which hosted proxies like [22] (yes those are dead). A direct access to http://208.53.158.136 leads to a VPN tunnel site. Who would be editing from such an IP? (just a quick thought - haven't looked deeper into this). Materialscientist (talk) 22:39, 23 August 2012 (UTC)

I dunno, I'm tempted to sign up for one of those services right now since I'm connected to the internet via sketchy public wifi where everyone can sniff my packets. Which is why I use the secure server for editing WP, but not every website on the internet has that option.... This VPN is particularly encouraging since they don't offer a free trial, which is the problem with most VPN providers and wikipedia (free trial=open proxy).Sailsbystars (talk) 22:52, 23 August 2012 (UTC)

In general, being a legitimate anonymizer is not relevant to being free of charge. For example, I saw paid open-proxy IPs from newipnow editing WP. Materialscientist (talk) 23:00, 23 August 2012 (UTC)

Indeed, VPN services available to the general public (paid or unpaid) are considered an open proxy. — madman 00:27, 24 August 2012 (UTC)

The unblock request is unhelpful, as they generally are (it blames having had a virus in the past for being blocked). I'll happily tell them they can't edit from a VPN but I'd like to know what to do with the block. Is the whole range now VPNs? Even then, what should the indef be turned into? Secretlondon (talk) 23:42, 23 August 2012 (UTC)

No, the whole range is webhosts of one kind or another. The particular IP here is that of a VPN provider. Generally the practice on such ranges is to rangeblock for a few years when evil occurs. This range has been blocked for several years and it's evils are not apparent. I would lean towards an unblock, but bear in mind WP:ROPE and anon-block at the first hint of trouble. Sailsbystars (talk) 23:56, 23 August 2012 (UTC)

I generally lean toward anon. blocking hosting ranges and having users who wish to contribute request accounts. That said, if this IP is a VPN endpoint (I haven't checked), it quite simply may not be used to contribute to Wikipedia absent extraordinary circumstances that would merit an IPBE. — madman 00:27, 24 August 2012 (UTC)

What do we need to progress with this case? I think we are looking at changing the range block to an anon block of 2(?) years. We need to work out whether the IP address is a VPN exit node. If it is we proxy block? How can we work out whether it's a VPN exit node? Secretlondon (talk) 17:07, 25 August 2012 (UTC)

It's almost certainly a VPN exit node. Anon-block the range for 2 years would certainly be a reasonable course of action. There's just no standard procedure for a.) VPNs (at least previously I thought we didn't block them unless they were "open" in some way such as having a free trial, as they are not explicitly mentioned in the policy at WP:PROXY) or b.) indef-blocked ranges (we don't do them anymore, but there's no uniform standard for what to do with them now....). Sailsbystars (talk) 03:01, 26 August 2012 (UTC)

I have changed the block to a one-year {{Webhostblock}} and am closing. Account creation is currently blocked but users with existing accounts may edit and new accounts can be granted at account creators' discretion (preferably with a checkuser). Thanks, — madman 04:11, 19 September 2012 (UTC)

202.169.48.7

– This proxy check request is closed and will soon be archived by a bot.

202.169.48.7 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

According to [23], it is a proxy. Furthermore, it is likely that the banned User:Iaaasi has edited Wikipedia over this IP.--Nmate (talk) 10:23, 24 August 2012 (UTC)

IP is an open proxy, so blocked. Materialscientist (talk) 10:33, 24 August 2012 (UTC)

190.163.14.118

– This proxy check request is closed and will soon be archived by a bot.

190.163.14.118 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. UTRS #3298. They claim they've stopped running a tor exit node as they didn't realise it would stop them editing. Is it still a Tor exit node? Secretlondon (talk) 17:03, 25 August 2012 (UTC)

Not currently an open proxy – It is not currently a Tor exit node. — madman 01:14, 29 August 2012 (UTC)

94.56.129.24

– This proxy check request is closed and will soon be archived by a bot.

94.56.129.24 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, spambots sockpuppets. Port 8080. Thanks. 94.56.129.24 (talk) 20:57, 28 August 2012 (UTC)

IP is an open proxy. Thus blocked. Materialscientist (talk) 22:30, 28 August 2012 (UTC)

78.40.152.129

– This proxy check request is closed and will soon be archived by a bot.

78.40.152.129 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Used by User:Dalai_lama_ding_dong his scope is Jewish religious topics and WP:ARBPIA area.--Shrike (talk)/WP:RX 12:27, 1 September 2012 (UTC)

This say its confirmed proxy server [24] --Shrike (talk)/WP:RX 12:30, 1 September 2012 (UTC)

Not currently an open proxy from what I can tell at the moment. It may say that because Nomad Digital provides passenger wi-fi on trains and the like, so it's a shared address to be sure. WhatIsMyIPAddress is a decidedly unreliable source when it comes to proxy verification. — madman 18:20, 1 September 2012 (UTC)

199.58.84.0/26

– This proxy check request is closed and will soon be archived by a bot.

199.58.84.9 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. All of 199.58.84.0/26 was indef soft blocked in July 2012 as a proxy - no details given. Actual proxies? Secretlondon (talk) 20:01, 1 September 2012 (UTC)

Definitely not standard application of such blocks, i'm going to go drop a note to Coren. Left a note on the UTRS request for you. -- DQ (ʞlɐʇ) 00:58, 2 September 2012 (UTC)

 Declined to run a check – I don't see why not. The range is assigned to SpotFlux. It should be soft blocked at the least. — madman 02:40, 2 September 2012 (UTC) Oh. I agree that it shouldn't have been indeffed, but I don't think a couple years would be unreasonable. — madman 02:41, 2 September 2012 (UTC)

I have changed the block to two years and am closing as in my opinion, unblock should be declined. This is an open proxy service. Cheers, — madman 04:07, 19 September 2012 (UTC)

94.72.252.104

– This proxy check request is closed and will soon be archived by a bot.

94.72.252.104 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. UTRS #3425. User says it belongs to Derbyshire County Council. Was blocked in April for three years as a proxy. I suspect if it is a proxy it's not an open one. Secretlondon (talk) 20:24, 4 September 2012 (UTC)

Not an open proxy as far as I can tell. This is again a behavioral block based on the edit filter log. In such cases, ask the blocking admin - xe knows much more about the target. This will help in un/reblocking. Materialscientist (talk) 22:13, 4 September 2012 (UTC)

The three entries in the edit filter log are pretty tame. I think this is another mis-tagging of an IP as an 'open proxy'. I've asked the blocking admin for more info. Secretlondon (talk) 22:29, 4 September 2012 (UTC)

No info available - can someone look at this? Secretlondon (talk) 20:52, 1 October 2012 (UTC)

Unblocked. -- zzuuzz ^(talk) 17:57, 2 October 2012 (UTC)

198.144.107.187

– This proxy check request is closed and will soon be archived by a bot.

198.144.107.187 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: block evasion; see edits. Different geographic location than previously blocked sockmaster. Already blocked but may need to be extended if proxy. --Kinu ^t/_c 16:56, 5 September 2012 (UTC)

Editing style (including replying to comments made on a blocked IP's talk page as if s/he were the person using the blocked IP) and wording shows that this is the same person as the other IP address, but one's in Turkey and the other in the USA, and they edited just a few minutes apart. Nyttend (talk) 22:09, 5 September 2012 (UTC)

Not currently an open proxy but is in a hosting range; 198.144.106.0/23 could safely be anon. blocked for a year or more. — madman 00:29, 7 September 2012 (UTC)

The other IP is below Secretlondon (talk) 22:25, 5 September 2012 (UTC)

88.251.95.84 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Also Not currently an open proxy though in a pretty abusive range. — madman 00:52, 7 September 2012 (UTC)

82.113.122.166

– This proxy check request is closed and will soon be archived by a bot.

82.113.122.166 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock at User talk:Richiez. The user states that this is a large mobile operator with NAT, and not an open proxy. It looks to me as though he/she is probably right, and I can find no evidence of an open proxy, but perhaps someone with more knowledge of such issues can look at it to make sure. I will also contact the blocking admin. JamesBWatson (talk) 14:39, 6 September 2012 (UTC)

• I've changed the block to allow registered users, and new account creation, but still blocking anon contribs, so that fixes the current user. Same for 89.204.136.52 which is identical and done at the same time. I was mistaken it wasn't open, it appears, but there is still abuse coming from anon users on those two IPs, which this solution should fix. I will leave anything else to your capable hands if you think it needs complete unblocking. A ping on my talk page regardless of outcome is appreciated. Dennis Brown - 2¢ © Join WER 14:57, 6 September 2012 (UTC)
• I've removed the block; this is not AFAICT a proxy; 82.113.96.0/19 is a major German mobile ISP's IP range, and blocks should be avoided. Two users out of 25m subscribers on a randomly-assigned IP block is pretty much nothing. James F. (talk) 15:05, 6 September 2012 (UTC)

211.154.83.36

– This proxy check request is closed and will soon be archived by a bot.

211.154.83.36 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, spambots, etc. Port 80... 78.146.252.101 (talk) 22:22, 7 September 2012 (UTC)

IP is an open proxy, thus blocked, thanks. Materialscientist (talk) 22:53, 7 September 2012 (UTC)

64.59.*

– This proxy check request is closed and will soon be archived by a bot.

Malicious editing from several IP sockpuppets in this range; see WP:ANI as well as 64.59.93.82 64.59.94.18 64.59.80.114 64.59.82.146. This is a proxy service offered by Privacy Partners, which offers a free trial. We know at least those four addresses were involved, which correspond to these IP blocks:

• Privacy Partners, LLC NET-64-59-93-80-28 (NET-64-59-93-80-1) 64.59.93.80 - 64.59.93.95
• Privacy Partners, LLC NET-64-59-80-112-28 (NET-64-59-80-112-1) 64.59.80.112 - 64.59.80.127
• Privacy Partners, LLC NET-64-59-82-144-28 (NET-64-59-82-144-1) 64.59.82.144 - 64.59.82.159
• Privacy Partners, LLC NET-64-59-94-16-28 (NET-64-59-94-16-1) 64.59.94.16 - 64.59.94.31

Offhand, I don't know whether there are any other IP blocks owned by them. Kerfuffler (talk) 05:00, 9 September 2012 (UTC)

Open proxy blocked – In fact, they have twenty-eight non-contiguous /28 ranges. I wonder if I can sue them for giving me carpal tunnel. Probably not. — madman 19:40, 9 September 2012 (UTC)

130.65.109.101

– This proxy check request is closed and will soon be archived by a bot.

130.65.109.101 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: i don't really know what is going on here, this IP is involved in a content dispute, is making weird legalistic remarks and commenting about IPs in their range actually being hijacked by China or something. I can't really make any sense of it but they seem to be suggesting they may be editing from an open proxy. Or they may just be trying to irritate the other user who checked their IP to see where it geolocated to. Beeblebrox (talk) 21:20, 10 September 2012 (UTC)

San Jose State University, Not currently an open proxy but likely a dynamic address. — madman 00:06, 11 September 2012 (UTC)

195.254.135.153

– This proxy check request is closed and will soon be archived by a bot.

195.254.135.153 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Edits from multiple unique IPs which appear to be from the same user - see this ANI thread. — Mr. Stradivarius ^{(have a chat)} 03:55, 17 September 2012 (UTC)

Not currently an open proxy according to technical evidence; however, I have {{Webhostblocked}} 195.254.134.0/23 for a year. — madman 22:51, 17 September 2012 (UTC)

38.78.194.6

– This proxy check request is closed and will soon be archived by a bot.

38.78.194.6 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Related to the AN/I case above, but this is very clearly an open proxy according to the geolocation data.[25][26] Seeing as most anonymous proxies used for abuse get blocked for a year or more, 31 hours seems a bit light. Or is it? Doc talk 05:06, 17 September 2012 (UTC) Reason: Suspicious edits

Not currently an open proxy according to technical evidence; unfortunately, the two sites to which you link aren't particularly reliable at identifying open proxies or keeping their data up to date. It's possible this is a particularly dynamic range. I'm not sure there's much more we can do at this time unless there's more abuse. — madman 22:58, 17 September 2012 (UTC)

Well, it's been blocked for a year by another admin, so either the technical evidence is off or the block extension was correct. Cheers :> Doc talk 23:03, 17 September 2012 (UTC)

I'll go ahead and close then as administration is complete. It's perfectly possible T. Canens may have found some evidence I couldn't; like CU, anything we can find's going to be imperfect and definitive statements are necessarily flawed. This is definitely an IP in a range with a history of abuse. Cheers! — madman 23:25, 17 September 2012 (UTC)

However some people do block things as proxies that are not. Secretlondon (talk) 23:27, 17 September 2012 (UTC)

Both of you know a ton more about this stuff than I do (I learn as I go), but I'm curious: why does this IP not have a country according to the two sites I listed? Other open proxies on this board list a country of origin (again, according to those sites), so why is this one listed as a completely anonymous, "nationless" proxy? Doc talk 23:34, 17 September 2012 (UTC)

The range is assigned to Cogent Communications, which services 34 countries. Unfortunately ISPs are not required to subdivide their ranges geographically/provide geographic information on all their ranges (as to be fair, this could be logistically impossible depending on their network infrastructure) so there's no source of authoritative information in that regard. — madman 23:39, 17 September 2012 (UTC)

That makes sense - thanks! Doc talk 23:45, 17 September 2012 (UTC)

66.135.122.10

– This proxy check request is closed and will soon be archived by a bot.

66.135.122.10 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. עוד מישהו Od Mishehu 18:21, 19 September 2012 (UTC)

Not currently an open proxy. It's an SSL VPN, but presumably restricted to employees only. Cheers, — madman 03:56, 20 September 2012 (UTC)

213.17.209.114

– This proxy check request is closed and will soon be archived by a bot.

213.17.209.114 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

See also 117.13.123.208 (talk · contribs · WHOIS) and 42.62.5.115 (talk · contribs · WHOIS). I'm not sure whether these are open proxies, but they have all made edits identical to some by 213.174.100.39 (talk · contribs · WHOIS) and 193.93.228.47 (talk · contribs · WHOIS), which are both blocked proxies.

See six reverted edits with identical edit summary (SUBJ1) at WikiProject Linguistcs.

Reason: Suspicious edits

All blocked as open proxies - some verified, some blocked per behavioral evidence + google hints. Materialscientist (talk) 01:36, 23 September 2012 (UTC)

82.137.200.44

– This proxy check request is closed and will soon be archived by a bot.

82.137.200.44 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. UTRS #3401. User is in Syria and says they are not using a proxy service. Was blocked in March 2012 by procseebot with the message blocked proxy 91.144.16.107:80. Secretlondon (talk) 14:56, 2 September 2012 (UTC)

Inconclusive It's not a proxy as detailed in the block log. However, it is open on one of the standard proxy ports (8080). I can't get it to proxy, personally, but it's concerning enough that I would be hesitant to unblock. I'm a bit surprised that procseebot blocked it for a year... most procseebot blocks are only 3 months. Sailsbystars (talk) 12:59, 5 September 2012 (UTC)

Hmm, I cannot verify this... neither IP responds at all to requests from me on port 8080, nor any other common proxying ports. --Chris (talk) 14:56, 5 September 2012 (UTC)

Can I get a third opinion? Secretlondon (talk) 23:28, 17 September 2012 (UTC)

My results agree with Chris's and I'm going to call Not currently an open proxy on this one. It's possible Sailsbystar's result was an aberration. — madman 04:05, 19 September 2012 (UTC)