Wikipedia:WikiProject on open proxies/Requests

217.115.10.133

A user has requested a proxy check. A proxy checker will shortly look into the case. 217.115.10.133 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Blocked same as above, but seems to be a tor exit node (see whois info and https://www.ccc.de/anonymizer/). Tijfo098 (talk) 06:02, 18 October 2012 (UTC)

Blocked as tor. This is a small part of a wide tor project resolving to anonymizer.ccc.de, anonymizer.hamburg.ccc.de, torXX.anonymizer.ccc.de (where XX is a number from 1 to at least 33), etc., i.e., again, the tip of an iceberg. Materialscientist (talk) 05:54, 20 October 2012 (UTC)

Indeed. A few random tests:

• tor5.anonymizer.ccc.de -> 80.237.226.75
• tor10.anonymizer.ccc.de -> 62.113.219.3
• tor15.anonymizer.ccc.de -> not registered
• tor20.anonymizer.ccc.de -> 31.172.30.3
• tor25.anonymizer.ccc.de -> not registered
• tor30.anonymizer.ccc.de -> 77.244.254.230

They belong to various IPSs, but all are rented out to "Chaos Computer Club e.V." Tijfo098 (talk) 06:17, 20 October 2012 (UTC)

It's a bit more tricky: you can type the url into robtext and get their ranges, but those ranges are shared and the tor takes only a small part. For example, for 217.115.10.133, only 3 nearby IPs (trial-and-error check, not 100% sure) clearly relate to tor33.anonymizer.ccc.de, many others from the range belong to something else. And as usual, such shared ranges often host other semilegal services. Materialscientist (talk) 06:21, 20 October 2012 (UTC)

The whois info in this case is more helpful: 217.115.10.128 - 217.115.10.143 (a /28 it would seem) are all registered to CCC.de, although this is indeed less than the whole 217.115.0.0/20 Netsign PA Route. So you could issue a more discerning range block to the CCC /28. In the 80.237.226.72 - 80.237.226.79 case it's a /29 that is leased by CCC (out of the whole /17 route). If we go by the 80.237 precedent, the tor node(s) are eventually moved around the range(s) CCC rents. And it looks like the same R&I banned user was the sole editor from both of these. Tijfo098 (talk) 06:59, 20 October 2012 (UTC)

Known CCC.de ranges

• 80.237.226.72/29
• 62.113.219.0/29
• 31.172.30.0/29
• 77.244.254.224/29
• 217.115.10.128/28

Tijfo098 (talk) 07:07, 20 October 2012 (UTC)

Thanks. /29 contains only 6 IPs. If you check them individually in [1] you'll find that most of them (if not all) are already blocked one way or another, or don't clearly belong to the targeted tor. Materialscientist (talk) 07:17, 20 October 2012 (UTC)

Which ones do not? Tijfo098 (talk) 07:21, 20 October 2012 (UTC)

I judge that by robtex, which shows a different server for some nearby IPs in the range. Those tors usually take about 4 IPs/range, but ranges are many. Off course, we can always rangeblock a wider range if it is inactive, but then we might get justified unblock requests. Materialscientist (talk) 07:32, 20 October 2012 (UTC)

It looks to me like the only controversy here is over the 217.115.10.135 - 217.115.10.142 range (because you blocked the lower IPs of the last /28 I listed above) The 135-142 range is listed as allocated to CCC.de in whois, but none of those IPs respond to ping (unlike the lower IPs), so it looks like there's simply no hardware behind them, just yet. Tijfo098 (talk) 08:11, 20 October 2012 (UTC)

201.130.178.219

A user has requested a proxy check. A proxy checker will shortly look into the case. 201.130.178.219 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Voted at ANI with no other contribs in 5 years. IP is listed in quite a few black lists. Possibly a compromised computer. Tijfo098 (talk) 23:18, 27 October 2012 (UTC)

Hitting it on port 80 turned up a Nomadix AG 3100 hotspot hardware, so that may be all there is to it. Tijfo098 (talk) 23:20, 27 October 2012 (UTC)

• There are no registered editors on that range, but this is obviously a sock. I would have thought that makes it more likely there's something hinky with the IP. --Elen of the Roads (talk) 00:08, 3 November 2012 (UTC)

202.94.66.28

A user has requested a proxy check. A proxy checker will shortly look into the case. 202.94.66.28 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #4642. --Jezebel'sPonyo^{bons mots} 18:16, 7 November 2012 (UTC)

I've checked the blocking handle 49.236.215.58:8080, and it leads to another IP (which I've blocked). It was a zombie proxy (infected/miconfigured PC) recently. I can't tell for sure about now. Materialscientist (talk) 22:41, 7 November 2012 (UTC)

Should I decline the unblock request as a precaution?--Jezebel'sPonyo^{bons mots} 18:47, 8 November 2012 (UTC)

Checked today, block was for 8080 but now 3128 operational but not open proxy and resolves to proxy0.classic.com.np. I don't see anything in Wayback for the parent company and there is a lot of info missing on their website. Dennis Brown - 2¢ © Join WER 13:38, 22 December 2012 (UTC)

Talk:Irgun

A user has requested a proxy check. A proxy checker will shortly look into the case. 95.142.164.78 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan - currently blocked as an open proxy 24.205.56.131 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 142.165.235.51 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 173.62.39.33 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 189.4.11.131 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 174.92.139.121 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan - currently blocked as an open proxy

Unregistered user using Wikipedia for personal attacks and political propaganda. Two of the addresses used have been blocked as open proxies. - Mike Rosoft (talk) 06:36, 9 November 2012 (UTC)

• A quick check didn't find anything unusual for the unblocked IPs. The last IP also looked clean. The first is an obvious open proxy. Dennis Brown - 2¢ © Join WER 14:35, 12 December 2012 (UTC)

67.142.168.22 et al

A user has requested a proxy check. A proxy checker will shortly look into the case. 67.142.168.22 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 67.142.168.23 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 67.142.168.25 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 67.142.168.27 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

All 3 4 IPs' geolocation data says "Confirmed proxy server". This, combined with several suspicious edits seem to suggest that something else is in play here.—Ryulong (琉竜) 20:42, 9 November 2012 (UTC)

• The range 67.142.168.16/28 has been blocked by User:Coren - "Webhost/server farm hosting proxies". - Mike Rosoft (talk) 20:57, 24 November 2012 (UTC)
  • Being a confirmed proxy server isn't a problem by itself. This is a very odd range to have for farming, owned by DirecPC. Dennis Brown - 2¢ © Join WER 14:43, 12 December 2012 (UTC)

207.179.9.4

A user has requested a proxy check. A proxy checker will shortly look into the case. 207.179.9.4 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. Request for unblock on talk page - "Please unblock our IP, issues with open proxy have been resolved"  Ronhjones  ^(Talk) 00:25, 11 December 2012 (UTC)

This IP is blocked as /19 range, indefinitely. It belongs to virtela.net, which specializes in cloud and VPN services; thus while indefblocks are almost never warranted, I would hesitate to unblock - even if this particular IP is currently clean for proxies, we can never be sure about the future and about the range.

I'm also not sure how to understand the comment "issues with open proxy have been resolved" - who said there was a proxy on this IP? These IPs are likely managed separately, thus resolved where? Materialscientist (talk) 00:46, 11 December 2012 (UTC)

My experience with these types of ranges have been mainly the piles of COI editors, with legitimate uses being rare. I would agree with the hesitation. Dennis Brown - 2¢ © Join WER 14:17, 12 December 2012 (UTC)

This IP is IMO the office IP for extremenetworks, not an open or cloud proxy, and if this can be shown to be the case - best by email - would normally be afforded a softblock. -- zzuuzz ^(talk) 23:03, 13 December 2012 (UTC)

72.52.96.29

– This proxy check request is closed and will soon be archived by a bot. 72.52.96.29 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Recent vandal edits and blocked as an open proxy on German Wikipedia. According to Whois the IP belongs to Hurricane Electric Internet Services which offers web hosting. Callanecc (talk • contribs • logs) 10:08, 20 December 2012 (UTC)

• Host is up but I don't see any ports open at this given moment in time. Dennis Brown - 2¢ © Join WER 23:42, 23 December 2012 (UTC)

• Checkuser data confirms that this IP and all nearby addresses are anonymising proxies. I have therefore blocked 72.52.64.0/18 for 1 year. AGK [•] 20:13, 16 February 2013 (UTC)

166.137.156.0/26

– This proxy check request is closed and will soon be archived by a bot. 166.137.156.0/26 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Range is being used by blocked sockmaster User:Marburg72; geolocation tools indicate this range may be an open proxy. Edits are at 166.137.156.22 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan and 166.137.156.32 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan. Thank you. -- Dianna (talk) 15:20, 4 January 2013 (UTC)

 Unlikely IP is an open proxy Not open proxies. These are highly dynamic cell network ranges for AT&T.... the only thing that makes me not rule out a proxy entirely is that the hostname seems to have "server" in it, but there doesn't seem to be any evidence of an actual server running.... Sailsbystars (talk) 05:38, 5 February 2013 (UTC)

204.101.237.139

A user has requested a proxy check. A proxy checker will shortly look into the case. 204.101.237.139 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open proxy being used to make trolling remarks in a current arbcom case. Mathsci (talk) 17:07, 25 January 2013 (UTC)

 Unlikely IP is an open proxy I looked into this a bit on my own before it popped up here. I really don't think this is a proxy.... looks much more like someone editing through their mobile phone. Is there any evidence this is a proxy other than behavioral? Sailsbystars (talk) 17:21, 25 January 2013 (UTC)

It is listed as a "confirmed proxy server" here,[2] the "whois" tool on the special contributions page. Mathsci (talk) 18:07, 25 January 2013 (UTC)

Yeah that website's so called "confirmed proxy servers" frequently aren't.... I don't know what their algorithm is, but it's not very good.... Sailsbystars (talk) 18:19, 25 January 2013 (UTC)

203.174.79.131

A user has requested a proxy check. A proxy checker will shortly look into the case. 203.174.79.131 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan I got one of those "somebody tried to get your password" media wiki emails, and it said this IP was the source of the request Trying, however incompetently, to hack an admin account seems pretty abusive to me, the geolocation says this is a confirmed proxy server in Japan. Beeblebrox (talk) 16:57, 31 January 2013 (UTC)

Inconclusive Something is very fishy with this IP. It comes from an electric power company in Japan.... it's clearly some sort of gateway server, but it's not obviously open. Sailsbystars (talk) 05:22, 5 February 2013 (UTC)

201.18.231.46

A user has requested a proxy check. A proxy checker will shortly look into the case. 201.18.231.46 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits (tendentious edits/vandalism)

Already blocked by Elockid as an open proxy (I haven't checked it). Materialscientist (talk) 00:34, 7 February 2013 (UTC)

62.212.82.105

– This proxy check request is closed and will soon be archived by a bot. 62.212.82.105 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #6364. The IP is part of this rangeblock and claims they need unblocking to work on a tutorial assignment. --Jezebel'sPonyo^{bons mots} 00:23, 9 February 2013 (UTC)

Why not create them an account? Materialscientist (talk) 00:27, 9 February 2013 (UTC)

I could provide them IPBE but that's generally only extended to trusted users. The UTRS set-up is pretty basic for these requests, they go into the proxy check holding queue until a check is run via WP:OPP to see if the proxy block is still necessary. If the block is necessary and the request has come from someone meeting IPBE criteria then we can discuss exemption with the user. --Jezebel'sPonyo^{bons mots} 00:44, 9 February 2013 (UTC)

This webhosting range has a long echo of past proxies, and some are still active (http://prx.centrump2p.com/english/, etc). They are mostly in the 62.212.7x.xxx range, thus narrowing the block from 62.212.64.0/19 to 62.212.64.0/20 is an option open for discussion. Two worrying things are (i) the reporting IP 62.212.82.105 itself has the 8080 port open, which looks like a trace of past or future proxy, (ii) tutorial assignment on en.wiki from the Netherlands sounds slightly odd to me. Materialscientist (talk) 06:23, 9 February 2013 (UTC)

There are a few things that don't quite add up with the unblock reuqest; I'd rather play it safe than sorry so I've declined to unblock.--Jezebel'sPonyo^{bons mots} 20:36, 11 February 2013 (UTC)

217.174.249.169

– This proxy check request is closed and will soon be archived by a bot. 217.174.249.169 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock (note the range has been blocked globally since June 2012).--Jezebel'sPonyo^{bons mots} 00:40, 9 February 2013 (UTC)

I would decline - there are active proxies in the range (e.g. http://cooloo.org, though it currently exits at another IP); 217.174.249.169 itself is a multisite webhost, i.e. can turn into an open proxy anytime. Just my opinion. (I'll comment on 62.212.82.105 above later today). Materialscientist (talk) 01:55, 9 February 2013 (UTC)

Noted and declined. --Jezebel'sPonyo^{bons mots} 20:37, 11 February 2013 (UTC)

192.20.246.138

– This proxy check request is closed and will soon be archived by a bot. 192.20.246.138 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock via UTRS #6490.--Jezebel'sPonyo^{bons mots} 20:44, 11 February 2013 (UTC)

Decline - still an open proxy on the same port (used by the blocking bot). Materialscientist (talk) 22:52, 11 February 2013 (UTC)

63.226.155.173

– This proxy check request is closed and will soon be archived by a bot. 63.226.155.173 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock at User talk:63.226.155.173 The person requesting an unblock says that the IP address is no longer hosting a proxy, and from what I have been able to find it looks at though that may well be true, but I would be grateful if someone more knowledgeable about proxies could give a second opinion.

Block log entry: 06:05, 22 December 2012 Materialscientist (talk | contribs | block) blocked 63.226.155.173 (talk) (account creation blocked) with an expiry time of 1 year ({{blocked proxy}}: http://63.226.155.173/p/)

JamesBWatson (talk) 22:05, 12 February 2013 (UTC)

The proxy is gone, thus it's Ok with me to unblock. There are a couple of open ports, but I don't see a proxy there. Materialscientist (talk) 22:49, 12 February 2013 (UTC)

Thanks. Unblocked. JamesBWatson (talk) 11:01, 13 February 2013 (UTC)

2.133.93.162

– This proxy check request is closed and will soon be archived by a bot. 2.133.93.162 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits - MrX 18:20, 16 February 2013 (UTC)

IP is an open proxy Confirmed open proxy on port 9090, needs block of order months to a year (unclear how dynamic the address is). Sailsbystars (talk) 18:13, 16 February 2013 (UTC)

Open proxy blocked for 1 year. AGK [•] 20:03, 16 February 2013 (UTC)

111.161.30.218

– A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below. 111.161.30.218 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Appears to be an open proxy from China. The sole edit is to troll around WP:ARBR&I in a creepy and disruptive way that is typical of the banned user Echigo mole, who has used anonymising proxies in the past. Mathsci (talk) 03:27, 17 February 2013 (UTC)

I also found this identification as a proxy on the web.[3] Mathsci (talk) 07:56, 17 February 2013 (UTC)

I did discover that the IP 111.161.30.230 is a proxy on port 80/tcp. I scanned the ports with nmap having found it on this list. [4] Mathsci (talk) 09:54, 18 February 2013 (UTC)

Thanks. It exits on 113.25.65.103, which I've blocked. You'll find 111.161.30.230 as a proxy on Google but hardly 113.25.65.103. This is a usual problem with tunnel proxies, i.e. 111.161.30.218 might be one (exit port), but without knowing the entry it is hard to tell for sure. Materialscientist (talk) 10:06, 18 February 2013 (UTC)

Inconclusive There's some evidence on the internets that this IP was in fact a proxy. However, right now it's coming back that the IP address is down. So I'll check again to see if the host is up later. n.b. to myself this is coming from a pretty darn quiet range, and the edits that exist are looking like a non-proxy-hosting range... Sailsbystars (talk) 07:02, 17 February 2013 (UTC)

Well, it's still down to me but it's obviously still getting used and FP@S has blocked it... it's certainly passes the WP:DUCK test, but the exact mechanism is elusive (possibly an exit server of some source). If it comes back after FP's block expires, it's probably worth blocking for a month or two, but no longer because it appears to be a fairly dynamic range. Sailsbystars (talk) 18:14, 17 February 2013 (UTC)

Given the rate that this is spewing spam, I think we can safely declare it a proxy and put it away for a year even if we can't figure out the tunnel entrance. Given the additional proxies on the range above, we might want to rangeblock 111.161.30.0/24 as well, as the collateral damage is minimal but the potential for disruption is high. Sailsbystars (talk) 23:01, 18 February 2013 (UTC)

85.24.184.185

– This proxy check request is closed and will soon be archived by a bot. 85.24.184.185 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Available tools show this is likely an open proxy. Thanks. -- Dianna (talk) 15:21, 17 February 2013 (UTC)

IP is an open proxy Confirmed Tor exit node. Needs a month or two of blocking. Sailsbystars (talk) 18:31, 17 February 2013 (UTC)

Open proxy blocked for three months. -- Dianna (talk) 21:32, 17 February 2013 (UTC)

216.81.94.75

– This proxy check request is closed and will soon be archived by a bot. 216.81.94.75 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

- MrX 21:02, 17 February 2013 (UTC)

Reason: Suspicious edits

Closed without checking. Sensitive IP address (belongs to DHS). Strong hints of COI, but if you want this blocked you're going to have to talk to the Foundation. And need a helluva lot more specific evidence. Sailsbystars (talk) 21:57, 17 February 2013 (UTC)

I understand. I was not aware of those exceptions. - MrX 23:41, 17 February 2013 (UTC)

27.114.168.177

– A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below. 27.114.168.177 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Requesting verification of a Procseebot block, given that one of the users affected by this proxy block is currently requesting an unblock and claims not to be aware of any proxy. Can't see evidence either way, myself, but then I don't know too much about proxies. Yunshui 雲‍水 10:19, 18 February 2013 (UTC) Reason: Requested unblock.

Not currently an open proxy It's safe to unblock. It was a proxy when blocked, but no longer (probably has changed IPs and/or been closed). Sailsbystars (talk) 15:49, 18 February 2013 (UTC)

Concur and unblocked. Materialscientist (talk) 23:02, 18 February 2013 (UTC)

‎88.159.134.224

A user has requested a proxy check. A proxy checker will shortly look into the case. 88.159.134.224 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Appears to be listed as an http proxy on internet[5] and there is a response when 88.159.134.224:80 is placed in browser window. IP is edit warring on Race and intelligence. Mathsci (talk) 05:50, 20 February 2013 (UTC)

201.76.185.214

A user has requested a proxy check. A proxy checker will shortly look into the case. [[User:|]] · contribs · block · log · stalk · Robtex · whois · Google

Reason: Admits in their first edit[6] that they are using a proxy server. The user is evading scrutiny because the VPN range 101.0.71.0/24 they previously used had been blocked after problemtic editing.[7] Mathsci (talk) 06:15, 20 February 2013 (UTC)