Wikipedia:WikiProject on open proxies/Requests/Archives/11

From Wikipedia, the free encyclopedia
Jump to: navigation, search


111.161.30.218

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

111.161.30.218 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Appears to be an open proxy from China. The sole edit is to troll around WP:ARBR&I in a creepy and disruptive way that is typical of the banned user Echigo mole, who has used anonymising proxies in the past. Mathsci (talk) 03:27, 17 February 2013 (UTC)

I also found this identification as a proxy on the web.[1] Mathsci (talk) 07:56, 17 February 2013 (UTC)
I did discover that the IP 111.161.30.230 is a proxy on port 80/tcp. I scanned the ports with nmap having found it on this list. [2] Mathsci (talk) 09:54, 18 February 2013 (UTC)
Thanks. It exits on 113.25.65.103, which I've blocked. You'll find 111.161.30.230 as a proxy on Google but hardly 113.25.65.103. This is a usual problem with tunnel proxies, i.e. 111.161.30.218 might be one (exit port), but without knowing the entry it is hard to tell for sure. Materialscientist (talk) 10:06, 18 February 2013 (UTC)
Inconclusive There's some evidence on the internets that this IP was in fact a proxy. However, right now it's coming back that the IP address is down. So I'll check again to see if the host is up later. n.b. to myself this is coming from a pretty darn quiet range, and the edits that exist are looking like a non-proxy-hosting range... Sailsbystars (talk) 07:02, 17 February 2013 (UTC)
Well, it's still down to me but it's obviously still getting used and FP@S has blocked it... it's certainly passes the WP:DUCK test, but the exact mechanism is elusive (possibly an exit server of some source). If it comes back after FP's block expires, it's probably worth blocking for a month or two, but no longer because it appears to be a fairly dynamic range. Sailsbystars (talk) 18:14, 17 February 2013 (UTC)
Given the rate that this is spewing spam, I think we can safely declare it a proxy and put it away for a year even if we can't figure out the tunnel entrance. Given the additional proxies on the range above, we might want to rangeblock 111.161.30.0/24 as well, as the collateral damage is minimal but the potential for disruption is high. Sailsbystars (talk) 23:01, 18 February 2013 (UTC)
I've blocked 111.161.30.218 per the off-wiki spambot activity, but not the range - it's just me, I don't mind anyone blocking it. Materialscientist (talk) 13:06, 26 February 2013 (UTC)

216.191.214.90

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

216.191.214.90 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Possible proxy, harassing a user. Could you check it out please? I have blocked 48 hr for personal attacks. Thank you. - Dianna (talk) 23:20, 24 February 2013 (UTC)

Hardly. Only one open port, and not proxy-like. Allstream Corp., clean blacklist. We can never be 100% sure that an IP was not an open proxy when you blocked it though. Materialscientist (talk) 10:00, 25 February 2013 (UTC)
Thanks for your help. -- Dianna (talk) 15:23, 25 February 2013 (UTC)

206.47.78.150

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

206.47.78.150 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: This IP has been blocked in the past as a proxy (it seems the entry point could be 206.47.78.149:80). The IP is being used at present for trolling on an arbcom case page. Mathsci (talk) 23:20, 25 February 2013 (UTC)

 Unlikely IP is an open proxyHost not up/all ports closed, looks like a cell network. In fact it comes from the same provider as 204.101.237.139, which was also trolling the same arbcom pages. I think you have a good case for sockpuppetry/avoiding scrutiny, but it doesn't look like proxies. Probably too much range for an anon rangeblock... Sailsbystars (talk) 01:11, 26 February 2013 (UTC)
Oh, and PS, Open proxy isn't necessarily grounds for an instant revert. I asked about it a while ago and there was no consensus (although also not a terribly large amount of input). Sailsbystars (talk) 01:22, 26 February 2013 (UTC)
I reverted. But on the evidence talk page this user, using the 2nd IP, was already asked by a clerk to use their main registered account.[3] Their contribution was later hatted by AGK. Mathsci (talk) 01:30, 26 February 2013 (UTC)

194.146.198.70

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

194.146.198.70 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

This IP appears to be an open proxy. GabeMc (talk|contribs) 00:46, 27 February 2013 (UTC)

Blocked as tor. Materialscientist (talk) 01:00, 27 February 2013 (UTC)

209.226.201.228

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

209.226.201.228 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

This IP appears to be an open proxy. GabeMc (talk|contribs) 01:12, 27 February 2013 (UTC)

I see no evidence of an open proxy. Toronto Airport PC - more likely a public terminal. Materialscientist (talk) 01:17, 27 February 2013 (UTC)

168.94.245.6

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

168.94.245.6 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Unblock request on talkpage claims that this IP is not a proxy. Yunshui  08:02, 27 February 2013 (UTC) Reason: Requested unblock.

 Unlikely IP is an open proxy Not seeing a proxy or any strong evidence for proxy (not open on standard proxy ports), but I would ping Elen (the blocking admin) before an unblock because the block is a bit irregular (several weeks after most recent activity). Sailsbystars (talk) 08:12, 27 February 2013 (UTC)
Unblocked after consultation with Elen. Closing.... Sailsbystars (talk) 01:52, 10 April 2013 (UTC)

202.105.113.132

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

202.105.113.132 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: The SPI clerk Spitfire confirmed that this was an open proxy on 8080.[4] It is currently being used by a newly created account PsychKitten, that appears to have been created to bypass a block of an IP range by Future Perfect at Sunrise. Mathsci (talk) 15:10, 27 February 2013 (UTC)

IP is an open proxy Yup, Spitfire has that one right. I'd give it a six monther... Sailsbystars (talk) 04:49, 28 February 2013 (UTC)
Blocked for 2 years, because of stable open-proxy port (see block log). Materialscientist (talk) 09:29, 28 February 2013 (UTC)

91.121.166.108

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

91.121.166.108 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits

Thank you - MrX 03:41, 28 February 2013 (UTC)

Nuke from orbit the entire range 91.121.0.0/16 for two years or more. This particular hosting provider (OVH) has a long history of wikitrouble. I didn't even bother checking. In fact the whole range used to be blocked. It appears the trouble hasn't ceased, ergo, someone needs to set us up the block. Sailsbystars (talk) 04:37, 28 February 2013 (UTC)
Nuked. We might get something like User_talk:91.121.6.61 in the future, but the range is rotten, 91.121.0.0/19 was indeffed previously. Materialscientist (talk) 09:41, 28 February 2013 (UTC)

200.79.224.72

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

200.79.224.72 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

This IP appears to be an open proxy. GabeMc (talk|contribs) 23:02, 1 March 2013 (UTC)

 Unlikely IP is an open proxy This does not seem to be a proxy. I note that 200.79.224.71 was also used for similarly disruptive edits a few months ago. Possibly an internet cafe on a dynamic range. Not closing the case yet because it could also be a Tor node but it's not up at all right now. Sailsbystars (talk) 01:39, 5 March 2013 (UTC)
I got nuthin... marking closed. Sailsbystars (talk) 02:06, 10 April 2013 (UTC)

199.58.84.20

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

199.58.84.20 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Requested unblock per UTRS #6803. King of ♠ 11:22, 4 March 2013 (UTC)

Inconclusive Soooooo.... this is a complicated case. The IP in question seems to belong to a quite legitimate and useful closed-proxy type service. Unfortunately, that IP is smack in the middle of a range full of nastiness. So, we can't really unblock the range. So, if this is an experienced editor, they might have reason to request WP:IPBE (although it appears the criteria for that right are getting stricter after it was recently mis-used). If it's not, then the best solution is for them to disable the proxy service. Sailsbystars (talk) 01:31, 5 March 2013 (UTC)
Can we reduce the range to a soft block? (Also, they claim to not be using a proxy.) -- King of ♠ 21:40, 5 March 2013 (UTC)
IP is an open proxy Unequivocally a free (aka open) proxy program. Your unblock requester is at best unaware of their internet connection, and at worst actively trying to deceive you. Sailsbystars (talk) 04:18, 6 March 2013 (UTC)

208.38.59.163

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

208.38.59.163 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits

Thank you - MrX 02:21, 7 March 2013 (UTC)

I don't see any sign of an open proxy on this IP. Materialscientist (talk) 10:57, 7 March 2013 (UTC)
Concur, closing. Sailsbystars (talk) 02:09, 10 April 2013 (UTC)

178.254.20.37

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

178.254.20.37 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Apparent open proxy. GabeMc (talk|contribs) 09:09, 8 March 2013 (UTC) Reason: Suspicious edits

IP is an open proxy Tor node, 6 month block warranted. Sailsbystars (talk) 15:12, 8 March 2013 (UTC)
Blocked, thanks. Materialscientist (talk) 23:44, 8 March 2013 (UTC)
Thank you both for all your hard work protecting the project! GabeMc (talk|contribs) 22:16, 9 March 2013 (UTC)

31.7.56.0/21

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

31.7.56.0/21 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

See unblock request at User talk:Siriusly55. JohnCD (talk) 20:23, 10 March 2013 (UTC)

  • Resolved - user says: "skype can be very slow here so about 10 days ago I went through a proxy and it seems to have stayed on... I honestly had no idea it was still connected to the proxy in the background - please do accept my apologies." JohnCD (talk) 10:10, 11 March 2013 (UTC)

83.34.172.50

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

83.34.172.50 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

An apparent dynamic proxy used for obscene edits. GabeMc (talk|contribs) 22:41, 10 March 2013 (UTC) Reason: Suspicious edits

I don't see a proxy mechanism at this IP. Materialscientist (talk) 02:21, 11 March 2013 (UTC)

72.160.98.133

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

72.160.98.133 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Blocked as probable open proxy in 2006, but Timbabcock (talk) says it has been allocated to him as a static address. JohnCD (talk) 08:59, 12 March 2013 (UTC)

Not an open proxy They speak truly, unblock should be given post-haste. Sailsbystars (talk) 15:39, 12 March 2013 (UTC)
Thank you. I have unblocked the IP. JohnCD (talk) 15:54, 12 March 2013 (UTC)

64.138.212.37

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

64.138.212.37 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

IP used for vandalism only. GabeMc (talk|contribs) 06:19, 14 March 2013 (UTC) Reason: Suspicious edits

Why this report? I see nothing suspicious (proxy-wise) with this IP. Materialscientist (talk) 08:50, 14 March 2013 (UTC)
Not an open proxy Indeed, no evidence that it's a proxy.... looks like your run of the mill IP, possibly a school. Checked a few standard proxy ports and found nada, in addition to the circumstantial evidence against. Sailsbystars (talk) 14:52, 14 March 2013 (UTC)
According to this site its a confirmed proxy server. http://whatismyipaddress.com/ip/64.138.212.37 GabeMc (talk|contribs) 00:35, 16 March 2013 (UTC)
We don't know how those sites verify proxies, and how often do they update their results, i.e. this may only be a weak hint, not an evidence. Materialscientist (talk) 00:44, 16 March 2013 (UTC)
Oh, okay, thanks for your time. I wish I had better tools to help me identify them, sorry if I wasted your time. Cheers! GabeMc (talk|contribs) 01:00, 16 March 2013 (UTC)

46.20.33.103

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

46.20.33.103 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Obvious proxy, Netco solutions. http://www.netcosolutions.com/ GabeMc (talk|contribs) 02:51, 15 March 2013 (UTC) Reason: Suspicious edits

 Likely IP is an open proxy 2 year block needed on 46.20.33.0/25, as apparently netcosolutions is a front company for an ever-problematic proxy service called... well, I think linking to it would get caught up in the spam filter, but I can provide info by email if any passing admin needs more assurances. Sailsbystars (talk) 06:56, 15 March 2013 (UTC)
Concur. Blocked. Materialscientist (talk) 08:46, 15 March 2013 (UTC)

80.83.21.2

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

80.83.21.2 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits Thank you - MrX 18:17, 16 March 2013 (UTC)

Not an open proxy Not an open proxy or tor node. Sailsbystars (talk) 22:11, 16 March 2013 (UTC)

207.195.240.33

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

207.195.240.33 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits found as a part of a sleeper sock investigation, related to the stalker Runtshit, that has struck recently.

URL: 207.195.240.33, previous block due to anonymizer.com


This IP reverted about 16 edits in a row in an automated fashion, then has been silent since 2006. In range of known stalker (Runtshit)

DIFF

Patriot1010 (talk) 20:04, 23 March 2013 (UTC)

Stale IP with no sign of an open proxy. Materialscientist (talk) 23:03, 23 March 2013 (UTC)
Indeed - that is why they call them sleepers!Patriot1010 (talk) 23:21, 23 March 2013 (UTC)
Sleeppers are IPs or accounts ready for action. This one is not. Materialscientist (talk) 23:26, 23 March 2013 (UTC)
Nah, with vpns and 8 websites like this one, one could use one IP a year and not have to use it again for 8 years. Blocking this obvious one cuts a year off of the rotation. What you are talking about is exactly what a sleeper wants you to believe.....Patriot1010 (talk) 02:31, 24 March 2013 (UTC)
You seem quite knowledgeable in this topic. Could you please provide the mechanism and entry port for this supposed proxy? That would be very helpful. Cheers. Materialscientist (talk) 03:14, 24 March 2013 (UTC)
I am not sure of he technical name, but this ip traces to an ip - then gets redirected to other site (spoof - redirected?) - but from the other direction, does not get redirected to the spoof site and goes straight to wikipedia. Notice the robotex says the ip is not defined, and the google link for this address states proxy. Patriot1010 (talk) 15:51, 25 March 2013 (UTC)
Hmm, this IP is apparently in range of 207.195.240.0/20 which is supposedly blockedSpecial:BlockList/207.195.240.33...yet when you use OverlordQ's tools with this IP

http://toolserver.org/~overlordq/cgi-bin/rangecheck.cgi?lang=en&family=wikipedia&ip=207.195.240.0%2F20

you have about 50 ips back there with a few hundred edits.... of course they are ALL from 2006 like the ip I have............who was it that said "Stale IP with no sign of an open proxy" don't need a block? Oh! That was Materialscientist a couple days ago. And these seem as if they are parked, and "ready for action" Wonder who said that too.
But here's the thing I don't get: If the IP I have is from 2006, and ALL the IPs behind the blocked IP of 207.195.240.0/20 are from 2006, it is within range of the IP I have........Why is 207.195.240.0/20 blocked indefinitely I wonder and the one I found will not be considered.......hmmm...........Patriot1010 (talk) 21:53, 26 March 2013 (UTC)

──────────────────────────────────────────────────────────────────────────────────────────────────── You've just explained why it won't be considered: it's within the range of blocked IPs. It's already blocked. You are asking us to consider whether we should block an IP address because you suspect it to be a proxy, when the whole range was blocked in 2008 for that very reason, and has remained blocked ever since. Case closed. WilliamH (talk) 22:31, 26 March 2013 (UTC)

I'm formally marking this as closed, for basically what WilliamH said. However, an aside is that we don't do indef rangeblocks anymore, and this has been blocked for long enough that the block should be reviewed at some point in the near future and removed or replaced with a more definite block. Sailsbystars (talk) 22:36, 26 March 2013 (UTC)

112.213.97.69

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

112.213.97.69 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Last in a series of open proxies used by Akuri (talk · contribs · logs · block log) prior to the creation of his account. Previous IPs were blocked as open proxies by Elockid. Mathsci (talk) 11:11, 26 March 2013 (UTC)

Verified, blocked, thanks. Materialscientist (talk) 11:37, 26 March 2013 (UTC)

156.144.250.239

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

156.144.250.239 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits Thank you - MrX 15:34, 26 March 2013 (UTC)

IP is a static address assigned to a company in Indiana; request for proxy check should be closed as frivolous.

--184.6.222.14 (talk) 00:42, 6 April 2013 (UTC)

Not gonna label frivolous, but yeah, it looks like a corporate gateway with no evidence of an open proxy, so I'll close.... thanks for reminding me this was still open. Sailsbystars (talk) 03:49, 6 April 2013 (UTC)

85.17.143.185

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

85.17.143.185 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Per UTRS #7182. King of ♠ 23:14, 26 March 2013 (UTC)

Haven't completed a check yet, but I'd lean towards a declined request because it's actually blocked globally (so we can't do anything here anyways) and the particular owner it belongs to is notorious for proxy-hosting.... Sailsbystars (talk) 18:04, 27 March 2013 (UTC)
This IP is definitely a proxy server. The server is up and appears to be running a proxy on 8088. It's unclear whether the proxy is open or not. I was able to connect to wikipedia using it, but then it req'd user name and password. So, it's possible this is a closed proxy rather than an open one. However, given that it's in a range of nastiness and blocked globally, there's nothing more to be done here. Sailsbystars (talk) 07:18, 28 March 2013 (UTC)

83.149.2.85

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

83.149.2.85 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

This is a returning user 84.52.101.196 (talk · contribs), and will be blocked anyway, but curious if this is an open proxy. Geolocate calls it a proxy, but it has said strange things before. Someguy1221 (talk) 22:28, 27 March 2013 (UTC)

Not an open proxy Yeah, this is another case of "random sites on the internet aren't always right about proxies." In this case it looks to be a Russian cell network, which seems to be entirely consistent with the editting POV.... Sailsbystars (talk) 07:02, 28 March 2013 (UTC)

207.195.240.0/20

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

207.195.240.1 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

This IP range is not a proxy, it is a customer-route-object- to Global-Tac http://route.robtex.com/207.195.240.0-20---customer-route-object-global-tac-24731.html

It USED to be affiliated with Anonomizer.com, but since then has been changed. Please note the latest change, with ticket number.Robtex Link

AS53559 Customer Route Object - Global TAC (24731) changed: routing(at)americanis.net 20110302 #23:58:35Z descr: Customer Route Object - Global TAC (24731) mnt-by: MAINT-ADN-WEST source: RADB warning: RIPE flags used with a traditional server.

Also if you note, the little circle is NOT filled in for Global TAC, which indicates an anonymous proxy. Thus, this IP range is NOT an anonymous proxy, it is a customer care route for a US Business locate here, in my home country, the U.S.A.!

This makes sense, since the block was from waaay back in 2008, and there were edits from 2006.Overlord Tools IP range Let Freedom of Speech ring once again in the U.S.A.! Patriot1010 (talk) 17:04, 28 March 2013 (UTC)


Reason: Requested unblock.

sooooo..... the block expires in a few months anyway. Why the urgency for unblocking right now? You haven't made clear the reason for filing this request other than "the ownership of this block has changed." Sailsbystars (talk) 17:33, 28 March 2013 (UTC)
Why not? Please ask Deskana for details. Thank you. Patriot1010 (talk) 17:42, 28 March 2013 (UTC)
I'm sorry, this IP listed above said it went to ), but a simple google search states it goes to https://www.google.com/search?q=207.195.240.1 with the first hit stating "Feb 8, 2007 – 207.195.240.1 Owner is Global Tac, LLC USA. 207.195.240.1 is in USA. Ip Lookup Location More IP Information for 207.195.240.1 on Myip.ms." Wow that's weird - this IP was always going to Global Tec! At least since 2007 - funny the block was in 2008.......hmmm......that's oddPatriot1010 (talk) 19:06, 28 March 2013 (UTC)
Wait, a few requests above this you requested that this IP be blocked. Now you're requesting that it be unblocked? I really don't think you understand what your'e talking about... The owner of the block rents out individual hosts, to other companies such as anonymizer.com. So the owner in the whois was never anonymizer.com. Also, please only edit one request for the same range at a time.... Sailsbystars (talk) 19:44, 28 March 2013 (UTC)

86.188.224.210

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

86.188.224.210 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP


User:Owen2kuk(User Owen2kuk) had to revert 3 edits from this IP DIFF: http://en.wikipedia.org/w/index.php?title=Royston,_Hertfordshire&curid=279710&diff=547614813&oldid=547585335 .Upon checking OverlordQ tools, this IP - this IP is really a spoof. The actual IP range is from 86.0.1.89, and according to ip.robtex.com, is on 5 blacklists for spamming (http://ip.robtex.com/86.0.1.89.html#blacklists ). Also according to OverlordQ tools, the actual IP has many ips behind it. Furthermore, the IP has a pointer to a legitimate website (http://ip.robtex.com/86.0.1.89.html#graph) but it actually goes to ip 86.0.0.0/16, with routes of 86.0.0.0/11, 86.0.0.0/13, 86.0.0.0/14, and appears to currently route to 86.0.0.0/15. Therefore, I recommend a block to 86.0.0.0/15 also, and will reference this record. The web-proxy is coming from the website http://bgp.he.net/ip/86.0.1.89#_rbl, indicated below. I included all the urls and will record this finding on my talk page for record. http://bgp.he.net/ip/86.0.1.89#_rbl Reason: Suspicious edits

Not an open proxy No, not even close. I'm afraid you're spewing gobbledygook. For further reading: CIDR notation. Sailsbystars (talk) 15:22, 29 March 2013 (UTC)

178.63.0.0/16

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

178.63.0.0/16 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Blocked with no edit or user reference, and Hetzner Online AG is not an open proxy.

Reason: Requested unblock.Patriot1010 (talk) 05:26, 31 March 2013 (UTC)

It took me all of three seconds to find a active tor node in the range. Do you have the rangecontrib checking javascript enabled? Sailsbystars (talk) 06:50, 31 March 2013 (UTC)
Hmm have a link for that? I just use OverlordQ tools. For example - this range has 2 edits, one from 178.0.0.104 and one from 178.0.1.71....so if this range has been blocked since 2008 - how was IP 178.0.1.71 able to post on 15 MAR 2013? Wow that is unusual. http://en.wikipedia.org/w/index.php?title=The_Music_Never_Stopped&diff=prev&oldid=544496339 . (Sorry for not making a DIFF - things seem to change day by day). Patriot1010 (talk) 03:00, 2 April 2013 (UTC)
Here Ill put the little line noted in the history: 23:35, 15 March 2013‎ 178.0.0.104 (talk)‎ . . (3,863 bytes) (+30)‎ . . (linking the essay to the book it is from)...because you know, that IP range is in rolandr.nl, here is the robtx records, available to the public of course http://dns.robtex.com/rolandr.nl.html#records. It might be related to my sockpuppet investigation.Patriot1010 (talk) 03:04, 2 April 2013 (UTC)

──────────────────────────────────────────────────────────────────────────────────────────────────── Because neither 178.0.0.104 or 178.0.1.71 is within the range of 178.63.0.0/16. Sailsbystars pointed you to CIDR notation on your last report. You really need to read up on networking before you make any more reports. -- Gogo Dodo (talk) 03:25, 2 April 2013 (UTC)

194.176.105.135

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

194.176.105.135 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Corporate proxy server. Suspicious POV edits from this IP suggest that it may also be an open proxy being used by blocked or banned editors to edit war in controversial articles such as Uganda Anti-Homosexuality Bill, Talk:LGBT rights by country or territory and Ex-gay movement. - MrX 20:09, 2 April 2013 (UTC)

The IP is currently blocked, so no check is needed.

--184.6.222.14 (talk) 20:45, 2 April 2013 (UTC)

The IP was blocked for vandalism. It should should still be checked to determine if it is an open proxy. - MrX 20:56, 2 April 2013 (UTC)
Inconclusive The ip in question is listed as an open proxy in some sources, but it won't proxy for me in the alleged fashion. It seems to be a gateway server for a major UK hospital and medschool so there would be a lot of people routed through this IP.... Sailsbystars (talk) 05:10, 4 April 2013 (UTC)

83.110.250.156

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

83.110.250.156 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits A editor has been using a long list of open proxies to make edits to push POV at Richard Stallman. Semi protection for a week did not help. An other IP connected to this is 183.179.29.128 and is listed on [5]. 83.110.250.156 is listed on [6]. Belorn (talk) 08:40, 3 April 2013 (UTC)

IP is an open proxy https proxy via 195.229.69.170:80. Probably needs about a 2-6 month block... range looks pretty dynamic. Sailsbystars (talk) 13:44, 3 April 2013 (UTC)
Blocked, thanks. Materialscientist (talk) 13:51, 3 April 2013 (UTC)

201.130.178.219

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

201.130.178.219 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Voted at ANI with no other contribs in 5 years. IP is listed in quite a few black lists. Possibly a compromised computer. Tijfo098 (talk) 23:18, 27 October 2012 (UTC)

Hitting it on port 80 turned up a Nomadix AG 3100 hotspot hardware, so that may be all there is to it. Tijfo098 (talk) 23:20, 27 October 2012 (UTC)

  • There are no registered editors on that range, but this is obviously a sock. I would have thought that makes it more likely there's something hinky with the IP. --Elen of the Roads (talk) 00:08, 3 November 2012 (UTC)
  • Closing as stale. Dennis Brown - © Join WER 18:25, 18 April 2013 (UTC)

207.179.9.4

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

207.179.9.4 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Requested unblock. Request for unblock on talk page - "Please unblock our IP, issues with open proxy have been resolved"  Ronhjones  (Talk) 00:25, 11 December 2012 (UTC)

This IP is blocked as /19 range, indefinitely. It belongs to virtela.net, which specializes in cloud and VPN services; thus while indefblocks are almost never warranted, I would hesitate to unblock - even if this particular IP is currently clean for proxies, we can never be sure about the future and about the range.
I'm also not sure how to understand the comment "issues with open proxy have been resolved" - who said there was a proxy on this IP? These IPs are likely managed separately, thus resolved where? Materialscientist (talk) 00:46, 11 December 2012 (UTC)
My experience with these types of ranges have been mainly the piles of COI editors, with legitimate uses being rare. I would agree with the hesitation. Dennis Brown - © Join WER 14:17, 12 December 2012 (UTC)
This IP is IMO the office IP for extremenetworks, not an open or cloud proxy, and if this can be shown to be the case - best by email - would normally be afforded a softblock. -- zzuuzz (talk) 23:03, 13 December 2012 (UTC)
  • Closing as no new developments and every option has already been discussed. Dennis Brown - © Join WER 18:32, 18 April 2013 (UTC)

190.107.140.76

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

190.107.140.76 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Unblock request at UTRS #7338. King of ♠ 20:55, 10 April 2013 (UTC)

 Likely IP is an open proxy I can't get it to proxy for me right now, but there is ample evidence this was VERY recently an open proxy and has been an open proxy for several months.... without strong evidence to the contrary, I don't see any reason to unblock. Sailsbystars (talk) 21:24, 10 April 2013 (UTC)
What about a softblock? The WHOIS returns Honduras which matches the information given by the requester, so he's probably not using a proxy himself. Could it be that the person running the proxy noticed our block and changed their IP address, causing the old IP to be assigned to a different person? -- King of ♠ 21:38, 10 April 2013 (UTC)
Yes, I saw the whois info. There are several possible scenarios:
      • There was a proxy there, but it has moved to another IP and an innocent user is caught in the block (happens not infrequently, but unusual for just 1 day after a block)
      • There is a proxy there and there is also an innocent user whose IP is affected (this is rare, but has happened before in the case of malware on the users' computer)
      • There is a proxy there and the request is not genuine
Right now I don't have enough evidence to distinguish between these three scenarios. However, given that it was blocked a day ago, the blocking admin may be able to distinguish between the first and the rest of the scenarios. Sailsbystars (talk) 21:56, 10 April 2013 (UTC)
  • This IP was used by a spambot in a posting attempt at 01:36, April 9, 2013, and was caught by edit filter 271. I routinely block all of those as proxies. I'm fine with changing it to a softblock if that's what others want. NawlinWiki (talk) 02:23, 11 April 2013 (UTC)
It's pretty clear it was a wide-open proxy for a long time (at least October until two days ago). It's not every IP that returns 50,000 results for this search. Hence why your block was definitely spot on. The question is whether the proxy has closed/is intermittent/has moved. If it were fewer hits or over a narrower time period I'd say go ahead and softblock, but this one looks both popular and long-lived. I guess you didn't actually try to use it then? My attempts to do so have sort of, but not entirely failed.... Sailsbystars (talk) 03:09, 11 April 2013 (UTC)
I'm not very experienced in open proxies, so could you tell me, given an IP address, how would one go about attempting to connect to it? -- King of ♠ 03:38, 11 April 2013 (UTC)
Sorry, by you I meant Nawlin.... was hoping he had proof so that it might make me feel better about my intrasingence. But if you want to know the way to "check" a known proxy... it depends on browser. This page gives a good quick and dirty overview. In this case, rather than getting "refused" or "not responding" (what happens when there's definitely not a proxy) when I try to connect on port 1080 (the listed proxy port for this IP), I get a blank page instead. You want to be careful though to use private browsing or equivalent, because I wouldn't trust a proxy not to try to steal your login credentials. Sailsbystars (talk) 03:47, 11 April 2013 (UTC)
OK, so when I try to connect to various proxies in Google Chrome, one of three things occurs: 1) Instant reject. Happened for 0.12.34.56:8080 (something I made up and presume to not exist) and 190.107.140.76:8080 (the current IP on a different port). 2) Hangs for a long time before giving up. Happened for 190.107.140.76:1080 (the one in question) as well as 64.2.184.130:8080 and 98.119.193.126:8080 (which I sampled from Special:Log/block and presume are not open proxies since all they did was simple, uncoordinated vandalism). 3) Connects. Happened for 203.162.144.83:3128 (recently blocked by ProcseeBot). -- King of ♠ 05:02, 11 April 2013 (UTC)
I've just confirmed this to be open. In your browser enter it as a SOCKS4 or SOCKS4a host, port 1080, and leave the HTTP proxy empty. Personally, even though there are some open proxies I do softblock, I would probably not softblock this IP. If you think you've really found someone editing from Honduras I would use IPBE instead (with a checkuser if circumstances are not obvious). I'm inclined to think it could be a genuinely shared IP with a risk of a genuine user being affected. But it is also certainly an open proxy, and quite a stable one by the looks of it. -- zzuuzz (talk) 07:32, 11 April 2013 (UTC)
OK, I replied to them to that effect. This can be closed now. -- King of ♠ 07:39, 11 April 2013 (UTC)
Ahhhhhh, yes, got it to proxy now. Didn't notice it was listed as the SOCKS proxy. Thanks for the checking and explanation, zzuuzz! Closing now. Sailsbystars (talk) 08:41, 11 April 2013 (UTC)

2.176.0.0 to 2.176.253.255

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

2.176.43.62 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP (2.176.0.0 to 2.176.253.255)

Reason: Suspicious edits : this is IP rang use from 1 user with 6 Sp and ip rang=(2.176.0.0 to 2.176.253.255) 1 and 2 - he is chang ip and use any user name and sp - Confirmed Lavasooni = Akhshurush -- he is back with IP and new id - he is trolls , not have way for blocked ip (2.176.0.0 to 2.176.253.255) he,s edit not for Improving the wiki , he is saboteur and Indecency User , thanks dear

Not an open proxy No evidence of a proxy, and furthermore, we won't block that range here because there would be too much collateral damage. Sailsbystars (talk) 16:23, 11 April 2013 (UTC)

206.71.149.10

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

206.71.149.10 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Requested unblock at User talk:RobertMfromLI. This is a range block placed on 206.71.144.0/20 by Kanonkas, dating from 12 April 2009, and due to expire on 12 April 2014. I have found a number of IP addresses in this range that are open proxies, but no evidence that this one is. The user suggests that a smaller range block may be suitable, and it looks to me as though that may well be a good suggestion, but I would be very grateful if someone with more knowledge of proxies than me could have a look at it. JamesBWatson (talk) 20:59, 17 April 2013 (UTC)

DoRD granted them WP:IPBE that resolved the matter. This particular IP has an open pptp port (1723), i.e., it is not necessarily an open proxy, but may be used as one. Materialscientist (talk) 08:34, 18 April 2013 (UTC)

212.118.224.153

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

212.118.224.153 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

I belive this is an open proxy. It is currently blocked for three months. It is my work computer address so I was quite concerned when I had messages (I do not log on when looking things up) and the company IT expert said this was some sort of routing protoocol. So if someone can please have a look and get the thing permanenlt closed I'd be grateful.--Davidvaughanwells (talk) 12:22, 18 April 2013 (UTC)

This is a proxy, but seems like a closed proxy to me (maybe it was open not long ago). Materialscientist (talk) 14:27, 18 April 2013 (UTC)
Looking closely, it does seem to be a legitimate closed proxy, using many different ports, seemingly serving more than one company. Dennis Brown - © Join WER 18:46, 18 April 2013 (UTC)
It's a closed proxy. We even have a wiki article on the company that runs it and what kind of proxy it is (corporate filter). So the usual thing here is to anon block (it's basically a school ip). However, having read the article on the service... I'm a little concerned about the fact that it forges certificates and basically sniffs the password information from users. I'm wondering if maybe it should be hardblocked for security concerns? Sailsbystars (talk) 22:40, 18 April 2013 (UTC)
Yes, I think that allowing edits from such a source is highly dubious. I have hard-blocked the IP address for a year. If anyone thinks I am wrong, please feel free to revert. JamesBWatson (talk) 20:56, 24 April 2013 (UTC)
I left a note explaining the hardblock at the bottom of the page. If someone winds up undoing the block at some point, this seems worth starting a chat over at WP:VPT. Sailsbystars (talk) 06:08, 1 May 2013 (UTC)

64.34.51.92

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

64.34.51.92 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

64.34.51.92 is not an open proxy, could you remove from the list? Stephanwehner (talk) 05:52, 18 April 2013 (UTC)

So this is not actually blocked here, but rather at metawiki, so nothing we can do here. This particular IP is caught up in a recent /16 rangeblock on the hosting company (Peer1). Any user wishing to edit from that range should disable their proxy to edit. I doubt the block can be tweaked to allow edits from that particular IP. The particular IP here does not seem to be an open proxy. Sailsbystars (talk) 15:04, 18 April 2013 (UTC)

54.225.81.59

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

54.225.81.59 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Akuri editing using amazon proxy to evade range block by Timotheus Canens. Mathsci (talk) 15:13, 19 April 2013 (UTC)

IP is an open proxy, also confirmed open on port 80. Blocked. -- zzuuzz (talk) 18:36, 19 April 2013 (UTC)

198.22.122.0/24

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

198.22.122.0/24 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

This IP range in not an open proxy. Best Buy would not allow their IPs or machines to be remotely accessed. If the range needs to be blocked it should be block with "anon only" allowing logged in users to edit. — Preceding unsigned comment added by 174.252.17.175 (talkcontribs) Reason: Requested unblock.

Per User talk:198.22.122.160, this is now a CheckUser block due to abusive editing by registered accounts using the range. You would need to appeal to a CheckUser, however per User talk:198.22.122.158, there is probably not much probability of an unblock. This is out of WP:OP's hands, not that we would be likely to unblock the range either. -- zzuuzz (talk) 18:23, 19 April 2013 (UTC)
This is troubling indeed, as this is Best Buy Corporate servers which according to PlotIP "This suggests that the IP address is being used by a server (rather than an end user) to vend web pages or other on-line content." Source Of course the various edits from 2008 can be found with Overlord Tools for this range. Contributions of range 198.22.122.0/24. My quest to unravel the mystery of the serial Sockpuppeteer Runtshit and his many aliases has led me to this IP as well, and it is obviously some sort of spoof or redirect - as any simple map plot trace of ips in this range, (in this case IP 198.22.122.160, which goes to Great Britain, then back to the USA). Due to the recent terrorist attacks, I have sent this information to public affairs at Best Buy Corporate to confirm or deny the assumption that the measly 255 ips are used for all of Best Buy stores (wouldn't even cover Texas lol), as well as the FBI. We shall unravel this great mystery!Patriot1010 (talk) 04:37, 20 April 2013 (UTC)
Nice work zzuuzz - This is an IP phone range, using a tether - that is why Whois comes up blank - its not registered, not a network range.
There is an epic 102 page thread about a user in this IP range, who also happened to work at Best Buy (so there is that connection), - dating back from 2008 about an individual who somehow used multiple IP ranges and phone numbers to scam people buying car parts.
This individual lives in the Boston Area, or possibly NY.
A summary of that whole ordeal is here:
http://honda-tech.com/showthread.php?t=2310534
Also the blocked IP user 198.22.122.160 mentioned in this post used an IP tether via landline IP phones in one case to Framingham, MA......This can be found using the google link in the block template of the range or the blocked users, and adding the search term "Phone" (I won't post the phone number, the reader has sufficient information to do that on their own, and is publically available) - but this is why they are showing up as socks - Patriot1010 (talk) 18:45, 21 April 2013 (UTC)

168.94.0.0/16

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

168.94.0.0/16 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

This is not an open proxy. Reason: Requested unblock. — Preceding unsigned comment added by 209.2.61.8 (talkcontribs)

Request for proxy check should be declined on procedural grounds - see report directly above yours. --184.6.222.14 (talk) 19:11, 20 April 2013 (UTC)
Symbol declined.svg Declined Yes, again the unblock is declined on the grounds of recent abuse, as mentioned by quite a few CheckUsers this is effectively now a CheckUser block. We could probably have an interesting discussion about how apparently publicly available terminals fall within the open proxy policy, which I would suggest in this case they do, but it would be moot due to the recent abuse. (see also original discussion) -- zzuuzz (talk) 19:41, 20 April 2013 (UTC)

192.210.137.161

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

192.210.137.161 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

This IP is a cell phone IP, and as zzuuzz has found, and in this recent case with User Niemti wth ip 192.210.137.161http://en.wikipedia.org/wiki/User:94.246.154.130 - Users are using cell phones to make anonymous IP edits when they should be using their username. When a username is blocked, the ip is not blocked sometimes when cell phones are used.

In this case with IP 192.210.137.161 - while it is attached to a username (and the username is locked), it does not come from an ISP - but a nokia cell phone with a nokia operating system: Source SOURCE 19 Apr, Fri, 08:31:28 192.210.137.161 - No country, Nokia Phone, Nokie operating system.

Reason: Cell Phone IP to a registered Username. Please specifically block the IP 192.210.137.161 Patriot1010 (talk) 17:40, 22 April 2013 (UTC)

This IP is already both range blocked and directly blocked (click on the current blocks link above). It is a web proxy (click on the HTTP link) usable by virtually any person or device with an Internet connection. -- zzuuzz (talk) 18:07, 22 April 2013 (UTC)

198.228.228.29

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

198.228.228.29 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Requested unblock at User talk:198.228.228.29. The block was placed on 18 February 2013 by Toddst1, giving {{blocked proxy}} as the reason. The unblock request says "I am not an open proxy". The IP address is certainly running a proxy server, but I can find no evidence that it is an open proxy. JamesBWatson (talk) 12:42, 23 April 2013 (UTC)

I don't see an open proxy on this IP or its range and would unblock it. It is a hopper though. Materialscientist (talk) 12:53, 23 April 2013 (UTC)
It is a cellular network IP address used by multiple people DIFF IPs that trace back to this IP - Is there a WP: something for cell proxies? Patriot1010 (talk) 16:02, 23 April 2013 (UTC)
AT&T Wireless to be exact (comes up on the Google link) in Kansas. From Google link abovePatriot1010 (talk) 16:15, 23 April 2013 (UTC)
Not an open proxy It's actually a dynamic dynamic range (not a typo!). It's a mobile range temporarily leased to AT&T and could readily be leased to someone else. It's actually owned by this group. So I would recommend an unblock or certainly a reduction in block length from the current 7 years. Closed on all standard proxy ports. Sailsbystars (talk) 17:59, 23 April 2013 (UTC)
YesY Unblocked. ​—DoRD (talk)​ 18:36, 23 April 2013 (UTC)
Now caught up in a rangeblock for disruptive editing. Nothing more to do here. Marking as closed. Sailsbystars (talk) 05:39, 1 May 2013 (UTC)

173.164.206.181

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

173.164.206.181 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Per UTRS #7459, user believes that he is running a Tor relay node, not a Tor exit node, and has provided [7] as evidence. I know this is not a local block (it's an automatic TorBlock), but I'm hoping people here would know how to deal with this kind of situation. -- King of ♠ 18:12, 24 April 2013 (UTC)

I can pretty much confirm this is the case, though the descriptor ('Tor directory listing') was last updated only 12 hours ago - if it was an exit before that time and the exit was recently removed, it may not have got through to Wikipedia's cached directory yet (in which case try again tomorrow). Otherwise, other than a bug report, I understand IPBE is the only remedy. -- zzuuzz (talk) 18:59, 24 April 2013 (UTC)
For future reference, do I understand correctly that the torblocks like this one are hard-coded by the mediawiki software? I.e. they can't be directly altered one way or another by admins? Sailsbystars (talk) 19:41, 24 April 2013 (UTC)
It may be possible to unblock Torblocked IPs by adding them to MediaWiki:Autoblock whitelist. I have never checked. I'm not aware of any other option, including an unblock or a softblock (IPBE would still be preferable to a softblock). I get the impression there have been some very recent changes to the TorBlock config, ie apart from this IP it's now finally working again. -- zzuuzz (talk) 20:47, 24 April 2013 (UTC)
I just got two more UTRS requests with the exact same problem; see Wikipedia:Village pump (technical)#TorBlock problems. -- King of ♠ 05:10, 28 April 2013 (UTC)
Deferred to bugzilla:47626, now marked as resolved fixed. IP is also no longer torblocked. -- zzuuzz (talk) 08:57, 6 May 2013 (UTC)

131.239.63.5

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

131.239.63.5 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

This is not an open proxy. — Preceding unsigned comment added by 174.252.18.2 (talkcontribs) Reason: Requested unblock.

X mark.svg Not done This is not a proxy block. Checkuser blocks are appealed to WP:ARBCOM via email. Sailsbystars (talk) 16:26, 25 April 2013 (UTC)

2001:DA8:203:503:D6AE:52FF:FE7B:19FC

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

2001:DA8:203:503:D6AE:52FF:FE7B:19FC - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: I asked Sailbystars about this ipv6 address which appears to be an open proxy. He suggested making a report here. This ipv6 is being used by a problematic user Akuri (talk · contribs · deleted contribs · logs · edit filter log · block user · block log), who has edited from IP ranges blocked by Future Perfect at Sunrise and then by the arbitrator/checkuser Timotheus Canens. Mathsci (talk) 19:21, 26 April 2013 (UTC)

I can't confirm it, however  It looks like a duck to me. The range is blocked as an open proxy on frwiki[8] (I think that's automated) and the IP is blocked directly as a spambot on wikidata[9]. It certainly smells like an anonymising proxy. -- zzuuzz (talk) 20:25, 26 April 2013 (UTC)
It looks like a university's primitive web server for some kind of coding contest. I'd bet dollars to donuts it's improperly set up and functioning as a proxy.... Sailsbystars (talk) 04:11, 27 April 2013 (UTC)
IP is an open proxy Damn. I was right. But I really hope we don't have too many more of these things for a while because only a small subset of my available OS/browser combos let me do this..... So would the appropriate rangeblock for the single user then be 2001:DA8:203:503::/64? Probably for about 6 months since hopefully the university's IT office will start inquiring about why their network is grinding to a halt. Sailsbystars (talk) 04:39, 27 April 2013 (UTC)
Materialscientist blocked the ipv6 for 6 months. I don't know about the range. Thanks to all, Mathsci (talk) 05:22, 28 April 2013 (UTC)
From my experience, they're currently being pretty wasteful so a /64 range may very well be one user. -- King of ♠ 05:40, 28 April 2013 (UTC)
Indeed... that's why I suggested the /64, but in this case I suspect we can get away with the single IP block given that this is something that will hopefully be fixed quickly and that the networking situation is fairly static. Also given that this is one of our first IPv6 proxy blocks, it will be instructive to see if this proxy reappears elsewhere in the /64 range, which is why I'm not overly set on the rangeblock. Sailsbystars (talk) 15:58, 28 April 2013 (UTC)

162.78.70.124

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

162.78.70.124 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

School IP says they're not a proxy. Daniel Case (talk) 16:58, 1 May 2013 (UTC)

It's not hardblocked anyways, so I changed the reason to {{schoolblock}}. It's possible that the blocking admin accidentally selected the wrong option since they're right next to each other on the drop-down. -- King of ♠ 21:02, 1 May 2013 (UTC)
Not an open proxy I'll second that assessment. Checked a handful of proxy ports just to be sure. Sailsbystars (talk) 02:28, 3 May 2013 (UTC)

IP 65.49.14.94

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

65.49.14.94 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Requested unblock; claims they are a school caught in the 65.49.14.0/24 proxy range block.--Jezebel'sPonyobons mots 21:59, 2 May 2013 (UTC)

Can't do an extensive check right now, but a very cursory study of info on the range indicates that there's good reason to inspect very closely before unblocking. Sailsbystars (talk) 22:29, 2 May 2013 (UTC)
IP is an open proxy Wide open proxy. I claim the requester is full of it. There is at least one, if not two (hell, maybe even three!) proxy services routed through that IP range. Sailsbystars (talk) 02:09, 3 May 2013 (UTC)
Thank you Sailsbystars, the unblock will certainly be declined. --Jezebel'sPonyobons mots 19:59, 3 May 2013 (UTC)

188.142.108.23

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

188.142.108.23 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Another open proxy being used by the registered user Akuri when logged off. Mathsci (talk) 00:34, 3 May 2013 (UTC)

Confirmed, blocked, thanks. Materialscientist (talk) 00:37, 3 May 2013 (UTC)

186.227.61.51

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

186.227.61.51 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Exactly the same as last time, same user but this time from Rio. Thanks in advance, Mathsci (talk) 07:40, 3 May 2013 (UTC)

Confirmed, blocked, thanks. Materialscientist (talk) 08:14, 3 May 2013 (UTC)

216.151.31.21

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

216.151.31.21 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

<Apparently an open proxy user IP: 216.151.31.21 presents unsubstantiated accusations about a person unrelated to the discussion in anyway, who is probably anaware of the fact, just because user IP: 216.151.31.21 for some reason believes another user in the discussion to be a person this proxy user is obsessed with; visible on: [[10]]> Reason: Suspicious edits

Procedural close as this can be dealt with in the request regarding ExpressVPN just above. -- zzuuzz (talk) 08:54, 6 May 2013 (UTC)

202.94.66.28

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

202.94.66.28 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Requested unblock via UTRS #4642. --Jezebel'sPonyobons mots 18:16, 7 November 2012 (UTC)

I've checked the blocking handle 49.236.215.58:8080, and it leads to another IP (which I've blocked). It was a zombie proxy (infected/miconfigured PC) recently. I can't tell for sure about now. Materialscientist (talk) 22:41, 7 November 2012 (UTC)
Should I decline the unblock request as a precaution?--Jezebel'sPonyobons mots 18:47, 8 November 2012 (UTC)
Checked today, block was for 8080 but now 3128 operational but not open proxy and resolves to proxy0.classic.com.np. I don't see anything in Wayback for the parent company and there is a lot of info missing on their website. Dennis Brown - © Join WER 13:38, 22 December 2012 (UTC)
  • Closed as stale. Checked again, it is at least a closed proxy, and getting some weird responses from other ports. Dennis Brown - © Join WER 00:57, 8 May 2013 (UTC)

95.211.99.0/16

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

95.211.99.73 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Unblock request at UTRS #7268. The user claims to be using a closed VPN. Could this range be reduced to a softblock, while individually hardblocking known problematic IPs? King of ♠ 22:25, 11 April 2013 (UTC)

Range is unequivocally an open proxy; unblock request should be declined on procedural grounds.

--184.6.222.14 (talk) 23:22, 11 April 2013 (UTC)

How do you check whether an entire range is an open proxy? -- King of ♠ 23:31, 11 April 2013 (UTC)
You don't, but checking for contributions from the range and block logs of the most active IPs is usually instructive. Haven't looked into this request yet, but the hosting provider here is one a handful I'd consider dismissing the unblock request out of hand.... Sailsbystars (talk) 00:37, 12 April 2013 (UTC)
IP is an open proxy Anyway, this particular ip is nl3.ibvpn.com, a website which offers free vpn preview, which not an open-proxy per se, it offers free anon access to wikipedia, which is close enough. There's also at least one open proxy on the /24, so a partial unblock would be difficult. Sailsbystars (talk) 16:56, 12 April 2013 (UTC)

Expressvpn

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

216.151.31.117 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
216.151.31.21 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
96.44.187.200 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP


Looks like an open proxy.

Inconclusive 216.151.31.0/24 belongs to a VPN service expressvpn, but for once it looks like it doesn't have any trial plan and it costs real $ so I don't believe it counts as open and thus is not blockable. Sailsbystars (talk) 02:21, 3 May 2013 (UTC)
96.44.187.192/27 belongs to the same service. It doesn't look like something we can block as a proxy, but we can probably block it like a corporate or school network if there's a high level of vandalism. Sailsbystars (talk) 02:35, 3 May 2013 (UTC)
There isn't a high level of vandalism, nor indeed any vandalism at all. This report was created by a persistent disruptive editor in an attempt to get a block on someone who had been opposing his/her disruptive editing. JamesBWatson (talk) 10:06, 9 May 2013 (UTC)
Indeed, didn't look like terribly disruptive editting to me either, so I'll mark this as closed. Sailsbystars (talk) 13:57, 9 May 2013 (UTC)

203.202.234.243

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

203.202.234.243 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

WHOIS reports this as a confirmed proxy server.[11] - being used to edit war in unsourced information originally added by 116.87.96.48 (talk · contribs) and also geolocating to Singapore. Dougweller (talk) 05:27, 6 May 2013 (UTC)

Reason: Suspicious edits

This is a proxy, with several open tcp ports, but I don't see where it is open for http access. Materialscientist (talk) 05:40, 6 May 2013 (UTC)
Thanks, but I don't understand this. So there are some conditions where editing with a proxy server is legitimate? It's obviously the same editor as the other IP. Dougweller (talk) 07:32, 6 May 2013 (UTC)
Editing with a closed proxy is OK. In any case, Singapore IPs should almost never be hardblocked. -- King of ♠ 07:46, 6 May 2013 (UTC)
(ec) Both IPs are from Singapore, so this is hopping. WP:NOP only concerns proxies that can be used by any outsider, not closed proxies. Note that we do treat some "closed" proxies as "open". A typical example would be a VPN service with a free trial. I don't see such access to this IP right away. If you wait a bit, you might get more feedback from other editors.
I agree with King of Hearts, because Singapore wikieditors typically use highly dynamic and well-managed ISPs, yet I do recall seeing blatant open proxies from Singapore too (which should be hardblocked). Materialscientist (talk) 07:52, 6 May 2013 (UTC)
Singaporean open proxies also famously involve exit servers, but I can't see much evidence of that here. It is a Zscaler proxy which have notorious security issues, but again I can't see any problems here. It is a bit weird it belongs to autodesk; it's possibly the user's employer using it for filtering. Being relatively static (used only by the same person in the last few weeks and possibly longer) also suggests it's not an open proxy. -- zzuuzz (talk) 08:24, 6 May 2013 (UTC)
Thanks. I've learned something new! Dougweller (talk) 10:32, 6 May 2013 (UTC)
Ugh, zscaler. Yeah, not open, but we should probably have a discussion about the security issues on VPT at some point. I don't think there's any action to take at this point, so I'll mark it as closed. Sailsbystars (talk) 02:24, 7 May 2013 (UTC)

31.24.33.221

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

31.24.33.221 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits. Editing pattern very similar to a that of an indef blocked user who has used socks in the past. - MrX 10:40, 6 May 2013 (UTC)

 Likely IP is an open proxy It's open on one of the standard proxy posts (8080), but I can't get it to proxy. Materialscientist has already blocked it for a year, so nothing more to do here. Sailsbystars (talk) 02:16, 7 May 2013 (UTC)

125.18.106.50

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

125.18.106.50 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits. Appeared to vote delete at an AFD, has not edited the article nor any articles related to it. Accorrding to this it is a proxy. Darkness Shines (talk) 13:36, 9 May 2013 (UTC)

Not an open proxy Doesn't look like a proxy to me. Not open on any standard proxy ports, and unfortunately whatismyip frequently seems to get proxies wrong. Sailsbystars (talk) 13:55, 9 May 2013 (UTC)