Wikipedia:Open proxies noticeboard/Requests

222.166.181.231

A user has requested a proxy check. A proxy checker will shortly look into the case. 222.166.181.0/24 · contribs · block · log · stalk · Robtex · whois · Google Though their specific statements about 222.166.181.43 to 22.166.181.159, 222.166.181.43 to 22.166.181.231

Requests through unblock-en for clearance or to grant IP-exemption for account. — billinghurst sDrewth 14:34, 23 January 2012 (UTC)[reply]

Reason: Requested unblock.

I saw the statement on the list and according to the block logs I think those all should be 222 for the first octet. But looking into. -- DQ (ʞlɐʇ) 17:31, 23 January 2012 (UTC)[reply]

Unlikely IP is an open proxy Right now i'm not seeing it for all 222s. There was one minor piece of evidence that was odd, but nothing to indicate anything I can go on. -- DQ (ʞlɐʇ) 21:08, 25 January 2012 (UTC)[reply]

Can this be closed? Billinghurst (talk · contribs) should be IP-block exempt as an admin, so I don't know that any administration is needed. — madman 04:45, 6 February 2012 (UTC)[reply]

68.190.12.40

A user has requested a proxy check. A proxy checker will shortly look into the case. 68.190.12.40 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 70.170.64.3 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 50.40.100.87 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 69.127.154.215 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 71.175.183.150 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Beetstra and XLinkBot are having a little battle with a morphing set of domains, and a few IP addresses. Needing to determine whether it is corrupted, open, owned. Have a series that belong to same case. There are more. however, this should give a good indication of whether it is open proxy abuse. Thanks. — billinghurst sDrewth 03:45, 26 January 2012 (UTC)[reply]

Reason: Requested block.

Here is some info on your hosts:

68.190.12.40 (talk · contribs · WHOIS) -

Possible IP is an open proxy - Charter Communications, normal ISP - I can`t activate a proxy, but there is definitely something suspicious here that`s not normal for an ISP. Possible that a login is required, but I can`t even find that.

70.170.64.3 (talk · contribs · WHOIS) -

Not currently an open proxy - Cox Communications, normal ISP

50.40.100.87 (talk · contribs · WHOIS) - This is not an open proxy, but it sure looks like a closed proxy. Possible peer to peer service active - Frontier Communications, normal ISP

69.127.154.215 (talk · contribs · WHOIS) -

Not currently an open proxy - CSC Holdings

71.175.183.150 (talk · contribs · WHOIS) -

Not currently an open proxy - Verizon Online, normal ISP

This looks like you've got someone who has access to multiple computers across the United States or a peer-to-peer network, but no open proxies to report as far as I see. -- DQ (ʞlɐʇ) 04:37, 26 January 2012 (UTC)[reply]

106.187.43.220

A user has requested a proxy check. A proxy checker will shortly look into the case. 106.187.43.220 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Reason: Requested an unblock. Claims the open proxy was a misconfiguration and has since closed the open squid on port 3128.--v/r - T P 13:39, 29 January 2012 (UTC)[reply]

He's cleared up the proxy on 3128, but it doesn't explain why he's editing from a webhost. I'm going to unblock because it's not being used abusively as far as I can tell, but please do watch the source that this came from carefully. If it's from unblock-en-l, offer to create him an account. -- DQ (ʞlɐʇ) 15:12, 29 January 2012 (UTC)[reply]

182.50.64.71

– A proxy checker has placed this case on hold pending further information or developments. 182.50.64.71 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock.

Unblock-en-l. -- DQ (ʞlɐʇ) 21:05, 5 February 2012 (UTC)[reply]
- Likely IP is an open proxy – I can't connect through port 80 as ProcseeBot indicated and confirm it, but it looks like an ISP proxy, one that's in half a dozen blacklists for link spamming, in some cases advertising child pornography. And ProcseeBot did flag it relatively recently. I wouldn't recommend unblock, maybe account creation and a change to softblock. (Not IPBE as I don't know that there's a history of positive contributions.) — madman 15:33, 6 February 2012 (UTC)[reply]
  - I should note that nmap doesn't return anything at all. There is either no computer with this IP or it's dropping all incoming traffic. Further, stopforumspam has seen no activity in 17 days, and when there was activity there were spans of no activity only lasting a day or two. This proxy may have been taken down. I'd suggest we look at it again in a week or two. --Chris (talk) 17:04, 7 February 2012 (UTC)[reply]
    - Switched to softblock, recheck down the road. I have to agree that this is too likely to not be one, but WP:AGF. -- DQ (ʞlɐʇ) 21:37, 8 February 2012 (UTC)[reply]

50.22.226.81

A user has requested a proxy check. A proxy checker will shortly look into the case. 50.22.226.81 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Suspected proxy once more of Escapeeyes, who now is insulting Purrum as some of her other favourite targets have been recently protected.

Reason: Suspicious edits

Confirmed this IP and blocked for 6 months. Materialscientist (talk) 08:52, 6 February 2012 (UTC)[reply]

76.118.180.210

A user has requested a proxy check. A proxy checker will shortly look into the case. 76.118.180.210 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits The IP is clearly a sock of someone - see unblock request decline.

I looked up the ip on http://whatismyipaddress.com/blacklist-check: both The Spamhaus Project and Spam and Open Relay Blocking System came back red for that IP. The IP was already blocked for other disruption at that point. Several adjustments to the block were made, but I ultimately restored the original disruption block, questioning the results from the blacklist check. This seems like a better route to verify the existance of an open relay/proxy. Toddst1 (talk) 23:07, 7 February 2012 (UTC)[reply]

Not currently an open proxy, or at least this is not the entry point. --Chris (talk) 23:49, 7 February 2012 (UTC)[reply]

Not currently an open proxy I'm not seeing it here either. -- DQ (ʞlɐʇ) 22:01, 8 February 2012 (UTC)[reply]

Webhost vandal

A user has requested a proxy check. A proxy checker will shortly look into the case.

79.170.95.63 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Vandalising Canadian websites from an IP that seems to resolve to Rotterdam, the Netherlands. Possible proxy. Vale of Glamorgan (talk) 01:09, 8 February 2012 (UTC)[reply]

Not currently an open proxy. Most ports were filtered by a firewall, but port 8080 was closed. This may indicate that a proxy was previously running, but I cannot verify that one is any longer. --Chris (talk) 04:37, 8 February 2012 (UTC)[reply]

90.156.197.86 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits

Moscow IP has just made identical edit as suspected Rotterdam proxy (immediately above). Vale of Glamorgan (talk) 01:47, 8 February 2012 (UTC)[reply]

Not currently an open proxy. --Chris (talk) 04:48, 8 February 2012 (UTC)[reply]

77.79.4.145 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Same edit as Rotterdam and Moscow but now it's from Lithuania. Vale of Glamorgan (talk) 02:25, 8 February 2012 (UTC)[reply]

Not currently an open proxy. --Chris (talk) 05:27, 8 February 2012 (UTC)[reply]

Merged. For the record, all there all are rangeblocked because they are webhosts. -- DQ (ʞlɐʇ) 00:14, 9 February 2012 (UTC)[reply]

81.98.21.251

A user has requested a proxy check. A proxy checker will shortly look into the case. 81.98.21.251 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

User claims that the tool used delivers a lot of false poses that would lead us to block his entire range (However, there may be a subtext to this. See this recent AN/I thread. Daniel Case (talk) 03:35, 8 February 2012 (UTC)[reply]

Not currently an open proxy. --Chris (talk) 05:37, 8 February 2012 (UTC)[reply]

68.71.39.10

– This proxy check request is closed and will soon be archived by a bot. 68.71.39.10 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Geolocate indicates name of registered organization is Peacefire, typing IP directly into the address bar leads to a Peacfire Circumventor Site. RA0808 ^talk _contribs 05:37, 17 February 2012 (UTC)[reply]

Open proxy blocked. --Chris (talk) 05:41, 17 February 2012 (UTC)[reply]

Multiple proxies

All these IP addresses are already rangeblocked since 2008/2010. Use "current blocks" link at the bottom of IP contribs page. — AlexSm 20:06, 26 February 2012 (UTC)[reply]

Declined to run a check – Indeed, they're all indefinitely blocked (and all but the last two are blocked globally). — madman 22:25, 26 February 2012 (UTC)[reply]

85.194.127.10

– This proxy check request is closed and will soon be archived by a bot. 85.194.127.10 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Unblock request from the mailinglist. The block is a five year block from 2009, it might be time for a re-check. Martijn Hoekstra (talk) 18:38, 26 February 2012 (UTC) Reason: Requested unblock.[reply]

Not currently an open proxy – Well, it is a proxy, but its policy does not permit access to enwiki (at least from my IP...). Therefore, I've unblocked, but the IP should be reblocked if there are indications it does permit open access to enwiki from elsewhere (I'm assuming it does provide some access to the requester; otherwise, unblocking is not going to particularly help him/her. If not, he/she may have to discuss getting access to enwiki with his/her network administrator.) — madman 22:37, 26 February 2012 (UTC)[reply]

217.64.30.8

– This proxy check request is closed and will soon be archived by a bot. 217.64.30.8 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Edit warrior from Azerbaijan who feels like spamming all kinds of comment sections and email spamming[1] or an open proxy. You decide! Hipocrite (talk) 14:10, 2 March 2012 (UTC)[reply]

Reason: Suspicious edits

Looks like an open proxy, but I was only able to fetch Google's homepage before the proxy started lagging too much, so I cannot verify the exit point. I will keep trying. (This IP has been blocked as an open proxy before.) --Chris (talk) 15:24, 2 March 2012 (UTC)[reply]

Open proxy blocked. --Chris (talk) 15:29, 2 March 2012 (UTC)[reply]

217.13.197.5

– This proxy check request is closed and will soon be archived by a bot. 217.13.197.5 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Abusive edits

OverlordQ's Tor Checker, Geolocate, and Robtex all indicate that this is a TOR exit node. RA0808 ^talk _contribs 18:02, 2 March 2012 (UTC)[reply]

Open proxy blocked as a Tor node. --Chris (talk) 18:14, 2 March 2012 (UTC)[reply]

210.55.215.173

– This proxy check request is closed and will soon be archived by a bot. 210.55.215.173 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: The account is currently blocked, but we have received no less than 9 clearly distinct unblock requests from the unblock mailinglist. This indicates there might be some proxy editing going on. Martijn Hoekstra (talk) 13:48, 6 March 2012 (UTC)[reply]

Declined to run a check. The block message is quite clear already; this is an ISP proxy that is used by many subscribers. --Chris (talk) 15:21, 6 March 2012 (UTC)[reply]

And you placed the block anyway... I'm confused what you're looking for here. :) --Chris (talk) 15:25, 6 March 2012 (UTC)[reply]

Seems like it's indeed a closed proxy: hence my change of the block message. Note that the only change I made to to block is the messsage, not that I blocked the IP. Martijn Hoekstra (talk) 19:02, 25 March 2012 (UTC)[reply]

202.189.69.150

A user has requested a proxy check. A proxy checker will shortly look into the case. 202.189.69.150 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

This is a Tor exit, but the block also blocks authenticated users who are obviously not anonymous!

Reason: Requested unblock. — Preceding unsigned comment added by Bgcaus (talk • contribs)

I'm not sure we have the technical ability to circumvent the torblock extension, do we? --Chris (talk) 22:22, 11 March 2012 (UTC)[reply]

61.18.170.84

– This proxy check request is closed and will soon be archived by a bot. 61.18.170.84 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Says it's merely a dynamic IP, not a proxy. Daniel Case (talk) 16:27, 10 March 2012 (UTC)[reply]

It was blocked as 61.10.75.133:8909, i.e. a tunnel proxy, which was surely working in October 2011. I can not connect through it now and think this was just an infected residential PC, but would leave it for some time (that PC might be switched off right now). The unblock request came from IP 61.18.170.150 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan, which also shows up as "proxy" on google as 61.18.170.150:8909, but this might also be a past echo. Materialscientist (talk) 06:06, 11 March 2012 (UTC)[reply]

Not currently an open proxy. The entry point cited in the block message is now returning 403 Forbidden errors for all proxy requests. Accordingly, I have unblocked this IP. --Chris (talk) 12:44, 12 March 2012 (UTC)[reply]

173.245.64.124

– This proxy check request is closed and will soon be archived by a bot. 173.245.64.124 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan User says that while block message says they may be running an open proxy, they are not. Daniel Case (talk) 18:42, 11 March 2012 (UTC)[reply]

IP is an open proxy. This is an exit point for Hotspot Shield. I will advise the user to disable this software. --Chris (talk) 22:24, 11 March 2012 (UTC)[reply]

173.234.211.214

A user has requested a proxy check. A proxy checker will shortly look into the case. 173.234.211.214 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Requested on mailinglist. This is a global block

Not currently an open proxy – This is, however, a hosted server; take that as you will. — madman 13:39, 12 March 2012 (UTC)[reply]

See this context as well. --Chris (talk) 13:51, 12 March 2012 (UTC)[reply]

If the intent was to block the hosting facility, I think NETBLK-UBIQUITY-LOS-ANGELES-173-234-208-0 (173.234.208.0 - 173.234.211.255) should have been blocked and not necessarily NETBLK-NOBIS-TECHNOLOGY-GROUP-08 (173.234.0.0 - 173.234.255.255). — madman 15:35, 12 March 2012 (UTC)[reply]

There is no reason to assume that this specific IP address requesting unblock was the one that triggered the block initially. Looking at the block itself in the absence of any unblock request, it's not immediately apparent which addresses were running open proxies. --Chris (talk) 16:46, 12 March 2012 (UTC)[reply]

Well, in the discussion to which you linked, Vituzzu mentioned a large hosting facility, and it seemed likely to me that Ubiquity was that facility (it's apparently the only facility major enough to be listed on Nobis Technology's Web site). If it was another facility I'd prefer that that facility's netblock be blocked more specifically too. I'm just thinking in terms of collateral damage and blocking as a preventative measure. But your point is well taken so it's kind of a moot point, I suppose. — madman 17:59, 12 March 2012 (UTC)[reply]

83.170.106.45

A user has requested a proxy check. A proxy checker will shortly look into the case.

83.170.106.45 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
My block

Hi, would one of the more experienced admins please look over this proxy block? It was clearly being used for sockpuppetry, and appears to be the server "ems23.your-freedom.de" via the port 53379. Thanks! Reaper Eternal (talk) 14:20, 13 March 2012 (UTC)[reply]

I'm running a thorough check right now, but my initial impression is that the open proxy was taken down and has been replaced by a closed proxy. However, it looks like this closed proxy may be shared by many, many subscribers... and I suspect that the primary reasons someone might want to subscribe to this service and edit Wikipedia through it are probably not benevolent. --Chris (talk) 14:25, 13 March 2012 (UTC)[reply]

Not currently an open proxy. --Chris (talk) 15:34, 13 March 2012 (UTC)[reply]

Hmm...okay. Should the block be reduced to a week then (due to the abuse of puppets)? Reaper Eternal (talk) 15:58, 13 March 2012 (UTC)[reply]

That's probably reasonable. If abuse continues, treat it like any other shared IP. --Chris (talk) 20:22, 13 March 2012 (UTC)[reply]

61.18.170.68

A user has requested a proxy check. A proxy checker will shortly look into the case. 61.18.170.68 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock at User talk:61.18.170.68. Blocked at 06:33, 14 October 2011 by ProcseeBot. Block reason is {{blocked proxy}} . Unblock request reason is "Dynamic IP of the second largest ISP in Hong Kong. Not a proxy server." I have not been able to confirm that either 61.10.194.136 or 61.18.170.68 is currently a proxy, but would appreciate a check from someone more knowledgeable about proxies than me. JamesBWatson (talk) 20:34, 13 March 2012 (UTC)[reply]

I am still working on this. The scan is going slower than I initially thought, since the stealth SYN scan is causing my router to reboot every hour or so when it exhausts kernel memory trying to maintain the TCP sessions table. :( --Chris (talk) 15:23, 14 March 2012 (UTC)[reply]

My scan turned up nothing, so I think

Not currently an open proxy. (Can't be 100% sure, but without positive proof...) --Chris (talk) 02:37, 15 March 2012 (UTC)[reply]

I'll check myself if you'd like a second opinion; at the very least for administration I would say to treat this as a shared IP. I highly suspect that it is a zombie computer as it's a well-documented, major source of spam. — madman 12:46, 15 March 2012 (UTC)[reply]

Newipnow.com

They updated their IP list. I have blocked the IPs themself but will have no time (and technical ability) to check for rangeblocks [2] for the next day or so (those IPs usually sit within hosting ranges). If you can, please check. Materialscientist (talk) 22:48, 13 March 2012 (UTC)[reply]

184.107.58.144 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
193.28.228.75 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
199.192.231.250 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
69.194.229.67 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
69.73.148.16 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
216.75.62.2 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
93.114.46.214 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

FYI, Special:BlockList will find rangeblocks when you enter an IP. For example, the first IP listed is part of a rangeblock. --Chris (talk) 00:34, 14 March 2012 (UTC)[reply]

(Palmface) just forgot to check in rush - removed rangeblocked IPs. Materialscientist (talk) 00:52, 14 March 2012 (UTC)[reply]

I have also blocked

69.194.225.91 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

and

108.163.219.164 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

which are also newipnow.com proxies. I see that Materialscientist has blocked all the IP addresses he/she has listed and also two more (184.107.58.144, 173.248.191.250), almost all for 6 months. I would think that longer blocks would be in order. (Other IPs from the same proxy server have been blocked for substantially longer. For example, 64.15.147.205 has been blocked by Zzuuzz for 5 years.) My inclination is to increase the block lengths, but I will wait to see if anyone else disagrees. JamesBWatson (talk) 09:13, 14 March 2012 (UTC)[reply]

Longer blocks are normally issued for IP ranges, because the proxy IP might change over time - this is what you see in Zzuuzz's blocks; they also target a provider, not just one webportal like newipnow. In my experience, newipnow changes about a half of their proxy IPs (they offer a choice of a dozen) within about half a year, but a few IPs might stay longer. Materialscientist (talk) 09:25, 14 March 2012 (UTC)[reply]

Thanks for clarifying things, as you evidently know more far about this than I do. However, the particular block I mentioned is not a range block, nor is any nearby IP blocked. (The same also applies to 199.58.161.130, blocked by Bsadowski1 for 2 years.) JamesBWatson (talk) 13:22, 14 March 2012 (UTC)[reply]

218.208.97.226 et al.

A user has requested a proxy check. A proxy checker will shortly look into the case. 218.208.97.226 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 86.70.49.140 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 113.105.88.196 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 122.11.46.113 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 188.153.130.130 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Vandal targetting 2012 Midi-Pyrénées shootings [then my talk page after I protected the article] and using Wikipedia as a soapbox. 218.208.97.226 has been blocked as an open proxy in the past. - Mike Rosoft (talk) 13:38, 24 March 2012 (UTC) Reason: Suspicious edits[reply]

Judging from Robtex and behavior, they look like tunnel proxies, except for 113.105.88.196, which is "usual", direct proxy (blocked as such). I can't connect to 218.208.97.226 right now. Materialscientist (talk) 14:28, 24 March 2012 (UTC)[reply]

Add to that:

221.194.177.166 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
113.10.171.83 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Mike Rosoft (talk) 16:01, 25 March 2012 (UTC)[reply]

These two are regular proxies, reblocked as such. Materialscientist (talk) 22:44, 25 March 2012 (UTC)[reply]

User:67.15.34.252

– This proxy check request is closed and will soon be archived by a bot. 67.15.34.252 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Admission by zh:User:67.15.34.252, by zh:User:Tomchiukc and by zh:User:Gzdavidwong at zh:User:67.15.34.252 ([3]) ([4]). 77.86.113.133 (talk) 15:08, 26 March 2012 (UTC)[reply]

Declined to run a check It's a webhost, and with no recent edits since two years ago, i'm not willing to block it. -- DQ (ʞlɐʇ) 08:02, 4 April 2012 (UTC)[reply]

1.64.162.247

A user has requested a proxy check. A proxy checker will shortly look into the case. 1.64.162.247 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits — Preceding unsigned comment added by Billinghurst (talk • contribs)

Hey Billinghurst, I don't see any edits...do we have the right IP? -- DQ (ʞlɐʇ) 08:04, 4 April 2012 (UTC)[reply]

142.68.169.0

A user has requested a proxy check. A proxy checker will shortly look into the case. 142.68.169.0 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Reason: Blocked indef in 2008. Is this still an open proxy? T. Canens (talk) 08:11, 4 April 2012 (UTC)[reply]

Not currently an open proxy – Dynamic address assigned to Bell Alliant; no consistent history of bad behavior on- or off-wiki. — madman 14:43, 5 April 2012 (UTC)[reply]

144.132.145.68

A user has requested a proxy check. A proxy checker will shortly look into the case. 144.132.145.68 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: a hardblocked user is requesting a check to insure that this is actually an open proxy. $Salvio$ ^{Let's talk about it!} 13:22, 5 April 2012 (UTC)[reply]

Unlikely IP is an open proxy – It doesn't look like it is now, though it certainly looks like it was recently. — madman 15:00, 5 April 2012 (UTC)[reply]

I have just unblocked the IP. Thanks.

Salvio

^{Let's talk about it!} 17:37, 5 April 2012 (UTC)[reply]

202.156.11.12

A user has requested a proxy check. A proxy checker will shortly look into the case. 202.156.11.12 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Geolocate says it is a proxy.--Metallurgist (talk) 19:58, 5 April 2012 (UTC)[reply]

According to hash.es, this was an entry point (202.156.11.12:80) of a tunnel proxy (exiting elsewhere), which is worrying; and proxy bot blocked this IP in 2010 and 2011, meaning it surely was a proxy. However, I can't connect through this IP now. In my experience, Singapore users/addresses are very volatile. I don't think this is an open proxy at this time. DeltaQuad unblocked it as a proxy in 2011 here. Materialscientist (talk) 22:46, 5 April 2012 (UTC)[reply]

180.149.10.82

A user has requested a proxy check. A proxy checker will shortly look into the case. 180.149.10.82 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. $Salvio$ ^{Let's talk about it!} 16:09, 6 April 2012 (UTC)[reply]

Not a valid one right now, though it is on a shared range of an ISP/webhost, would not hesitate to reblock on suspicious edits. So unblocked. -- DQ (ʞlɐʇ) 01:39, 11 April 2012 (UTC)[reply]

206.253.165.78

A user has requested a proxy check. A proxy checker will shortly look into the case. 206.253.165.78 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Located on a blocked range. They claim it's a VPN. Daniel Case (talk) 16:01, 9 April 2012 (UTC)[reply]

VPN or not, it's still a webhost, which means the user can ask for an account, and provide a valid reason for needing a proxy (confidentially if needed), and get a CU done for an IPBE if the reason is legit. I understand that it might just be one IP and one user on this range, but we have no single IP whitelist. -- DQ (ʞlɐʇ) 01:46, 11 April 2012 (UTC)[reply]

64.251.21.76

A user has requested a proxy check. A proxy checker will shortly look into the case. 64.251.21.76 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: repeated YouTube spam RA0808 ^talk _contribs 00:36, 10 April 2012 (UTC)[reply]

Webhost, where a proxy used to exist, but has been gone for about a month now. /19 gone. -- DQ (ʞlɐʇ) 01:54, 11 April 2012 (UTC)[reply]

202.171.168.146

A user has requested a proxy check. A proxy checker will shortly look into the case. 202.171.168.146 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Now blocked for edit warring at English Defence League per this 3RR complaint. The same IP was blocked earlier by Procseebot, and a Google search for the IP suggests it has operated as an open proxy on port 8080. If it's confirmed as a proxy, this would justify a longer block. EdJohnston (talk) 21:36, 11 April 2012 (UTC)[reply]

Can't connect to its stated port 8080 right now. Wireless provider, not necessarily a proxy - might have been an infected zombie computer. Materialscientist (talk) 13:16, 12 April 2012 (UTC)[reply]

The IP was included in an open proxy list here, published on 26 November 2011. http://202.171.168.146/ opens up a login page for a MicroTik router. I tried logging in at the MicroTik prompt with no password but it doesn't work. EdJohnston (talk) 16:11, 12 April 2012 (UTC)[reply]

177.36.244.41

A user has requested a proxy check. A proxy checker will shortly look into the case. 177.36.244.41 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: This edit reintroduced vandalism previously added by 132.204.239.254 (talk · contribs · WHOIS) and 132.207.222.136 (talk · contribs · WHOIS). Both of these are registered to universities in Montréal, whereas the reported IP is Brazilean. Could be a case of meat puppetry (or international travelling), but robtex reports the IP as blacklisted by CNET. Not sure about the ramifications of that information, though. Favonian (talk) 10:02, 12 April 2012 (UTC)[reply]

The last sentence in this message from the miscreant does rather indicate that proxies are involved. Favonian (talk) 16:37, 12 April 2012 (UTC)[reply]

Sounds like a duck quacking into a megaphone to me. Those Brazilian proxies though, they're usually so dynamic they're gone tomorrow. My guess would be a month tops. -- zzuuzz ^(talk) 17:12, 12 April 2012 (UTC)[reply]

176.227.192.0/20

– This proxy check request is closed and will soon be archived by a bot. Need advice (go ahead and block if ..) on 176.227.192.0/20 (talk · contribs). Behavior-wise, there is a strong evidence for a proxy of some kind [5]. The host is redstation.co.uk. Materialscientist (talk) 13:37, 12 April 2012 (UTC)[reply]

Not yet looked too close at those contribs. I've seen a few very similar just recently. These types of IP are normally used by desktop/browser apps, like 'hide my ip' or whatever. There may be a legit user or two in the hosting range, at least at some point, and these VPN ranges are normally fairly small, like /27s, but scattered about a bit. hth. -- zzuuzz ^(talk) 17:39, 12 April 2012 (UTC)[reply]

I looked at the contribs, and the fact that it was a webhost, and found that the edits were not being useful (especially with the tp spamming) so i've nuked the /19 as I normally do for webhosts. People that need an account for a legit reason on a webhost, can talk to a CU. -- DQ (ʞlɐʇ) 22:51, 12 April 2012 (UTC)[reply]

83.170.106.45

– This proxy check request is closed and will soon be archived by a bot. 83.170.106.45 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reasons: Tor node [6]; blocked for abusive edits [7], [8]. See talk page history [9] for list of warnings and blanking of those warnings. JoeSperrazza (talk) 16:11, 12 April 2012 (UTC)[reply]

IP is an open proxy - Also mentioned above, funnily enough. I've reblocked it for two years. Not currently Tor, but part of a free anonymity service. -- zzuuzz ^(talk) 16:57, 12 April 2012 (UTC)[reply]

202.75.53.200

I thought this had already been blocked as an open proxy?[10] Is still allowed to clear the talk page? And it no longer says blocked when I look at contributions[11] According to this [12] it is a confirmed proxy server. 18:01, 12 April 2012 (UTC) Darkness Shines (talk) 18:01, 12 April 2012 (UTC)[reply]

It's the same network as the IP just above. We should probably try and round up the rest and see what's occurring. -- zzuuzz ^(talk) 18:49, 12 April 2012 (UTC)[reply]

This is what is going on [13] A well known sockpuppeter. Darkness Shines (talk) 18:52, 12 April 2012 (UTC)[reply]

118.112.185.66

– This proxy check request is closed and will soon be archived by a bot. 118.112.185.66 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Confirmed proxy. Hipocrite (talk) 19:57, 12 April 2012 (UTC)[reply]

Reason: Suspicious edits

Blocked by zzuuzz. Materialscientist (talk) 01:24, 13 April 2012 (UTC)[reply]

83.170.102.172

A user has requested a proxy check. A proxy checker will shortly look into the case. 83.170.102.172 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: yesteday, another IP editor made a similar edit to Darkness Shines' talk page; it turned out that the IP was an open proxy. I suspect this one could be too. $Salvio$ ^{Let's talk about it!} 10:08, 13 April 2012 (UTC)[reply]

I've hardblocked 83.170.64.0/18 for 3 years because per robtex the range belongs to http://your-freedom.de, and rangecontribs [14] do indicate abuse. Feel free to modify/question the block. Materialscientist (talk) 10:36, 13 April 2012 (UTC)[reply]

Many thanks, it's appreciated.

Salvio

^{Let's talk about it!} 10:46, 13 April 2012 (UTC)[reply]

109.73.64.0/20

A user has requested a proxy check. A proxy checker will shortly look into the case. 109.73.64.0/20 · contribs · block · log · stalk · Robtex · whois · Google 31.193.133.0/24 · contribs · block · log · stalk · Robtex · whois · Google Reason: Suspicious edits lol. Needs checking out and/or some range blocking methinks. -- zzuuzz ^(talk) 18:12, 13 April 2012 (UTC)[reply]

94.46.15.160

– This proxy check request is closed and will soon be archived by a bot. 94.46.15.160 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Appears to be an open proxy. User has previously added identical edits [15] on User talk:Erikvcl as two other blocked proxies (193.224.193.153,[16] 41.35.45.197[17]). One of the blocking admins recognized the edits as those of a banned user. Mathsci (talk) 04:19, 14 April 2012 (UTC)[reply]

IP is an open proxy. Blocked as such. Materialscientist (talk) 04:40, 14 April 2012 (UTC)[reply]

62.212.72.240

– This proxy check request is closed and will soon be archived by a bot. 62.212.72.240 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

This IP was used recently in an edit war, it says Here that it is a confirmed proxy server. Darkness Shines (talk) 12:03, 17 April 2012 (UTC)[reply]

IP is an open proxy Confirmed open proxy. Anonymizing program with free service available. Hostname is ems27.your-freedom.de. Sailsbystars (talk) 11:54, 24 April 2012 (UTC)[reply]

Already done nuked 62.212.64.0/19 the other day per an SPI. -- DQ (ʞlɐʇ) 01:12, 25 April 2012 (UTC)[reply]

50.22.206.179

A user has requested a proxy check. A proxy checker will shortly look into the case. 50.22.206.179 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Port 8080. Hipocrite (talk) 14:48, 23 April 2012 (UTC)[reply]

Reason: Suspicious edits

24.26.21.241

A user has requested a proxy check. A proxy checker will shortly look into the case. 24.26.21.241 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. Cheers. $Salvio$ ^{Let's talk about it!} 09:45, 28 April 2012 (UTC)[reply]

Not currently an open proxy -- DQ (ʞlɐʇ) 10:48, 28 April 2012 (UTC)[reply]

Thanks! I'm about to unblock.

Salvio

^{Let's talk about it!} 11:08, 28 April 2012 (UTC)[reply]

210.55.215.173

A user has requested a proxy check. A proxy checker will shortly look into the case. 210.55.215.173 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Unblock requested via UTRS by IP 122.61.132.202. --Jezebel'sPonyo^{bons mots} 03:30, 1 May 2012 (UTC)[reply]

184.105.146.8

A user has requested a proxy check. A proxy checker will shortly look into the case. 184.105.146.8 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock (UTRS ticket #886).--Jezebel'sPonyo^{bons mots} 03:35, 1 May 2012 (UTC)[reply]

IP is an open proxy. I would politely decline. Materialscientist (talk) 11:24, 1 May 2012 (UTC)[reply]

46.185.160.11

A user has requested a proxy check. A proxy checker will shortly look into the case. [[User:|]] · contribs · block · log · stalk · Robtex · whois · Google

Reason: Suspicious edits perisitent vandalism. The user Historyfeelings has bee blocked. Now his using the an ip address to do the same vandalism. Soufray (talk) 00:22, 7 May 2012 (UTC)[reply]