Wikipedia:WikiProject on open proxies/Requests/Archives/16
 | This page is an archive. Do not edit the contents of this page. Please direct any additional comments to the current main page. |
212.174.190.23
– This proxy check request is closed and will soon be archived by a bot.
- 212.174.190.23 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 212.174.190.24 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits Étienne Dolet (talk) 04:44, 3 April 2014 (UTC)
- [1] Please see the service section. Étienne Dolet (talk) 17:49, 3 April 2014 (UTC)
- Please see the edit notice for this page.... Sailsbystars (talk) 18:34, 3 April 2014 (UTC)
- [1] Please see the service section. Étienne Dolet (talk) 17:49, 3 April 2014 (UTC)
Unlikely IP is an open proxy Looks to be run of the mill nationalism on a modestly dynamic IP range. No Evidence of a proxy found. Sailsbystars (talk) 13:19, 3 April 2014 (UTC)
193.109.199.4
– This proxy check request is closed and will soon be archived by a bot.
- 193.109.199.4 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Confirmed proxie according to this. I believe it is being used by a recently banned editor to sock. Darkness Shines (talk) 10:13, 4 April 2014 (UTC)
Likely IP is an open proxy Some kind of a webhost, all kinds of circumstantial evidence points to proxy. I can't find the exact mechanism but... it should probably be blocked for at least a year. Sailsbystars (talk) 01:39, 10 April 2014 (UTC)- Blocked for 2 years. The editor who uses the pseudonym "JamesBWatson" (talk) 07:50, 16 April 2014 (UTC)
188.24.179.6
– This proxy check request is closed and will soon be archived by a bot.
- 188.24.179.6 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Requested unblock at User talk:Nergaal#?. IP blocked by ProcSeeBot on 6 April. If there is a problem with the IP, is there any reason not to give this user IPBE? They have been here since 2007 and seem to be in good standing. JohnCD (talk) 16:21, 8 April 2014 (UTC)
- That IP has been labeled as an open proxy but it should not be. I am prety sure I've used that IP for many, many years. Nergaal (talk) 16:25, 8 April 2014 (UTC)
- Yeah IPBE seems to be called for here. The proxy was not open when I checked it, but proxybot makes sure the proxy is active when it checks (so it was a proxy a few days ago). There's a chance there was (or is) some sort of malware on a computer connected to the network. Would fit the pattern and evidence. Sailsbystars (talk) 01:22, 10 April 2014 (UTC)
- I went ahead and granted IPBE. Materialscientist (talk) 02:01, 10 April 2014 (UTC)
- Yeah IPBE seems to be called for here. The proxy was not open when I checked it, but proxybot makes sure the proxy is active when it checks (so it was a proxy a few days ago). There's a chance there was (or is) some sort of malware on a computer connected to the network. Would fit the pattern and evidence. Sailsbystars (talk) 01:22, 10 April 2014 (UTC)
212.74.97.221
– This proxy check request is closed and will soon be archived by a bot.
- 212.74.97.221 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits/editing from a confirmed corporate proxy. — Preceding unsigned comment added by GabeMc (talk • contribs)
- Unlikely IP is an open proxy Does not appear to be an open proxy. The only source claiming proxy is the hopelessly useless (for proxy status) whatismyipaddress.com. It looks like a regular broadband ISP IP as far as I can tell, and the host was down when I investigated. Sailsbystars (talk) 04:33, 21 April 2014 (UTC)
178.162.193.199
– This proxy check request is closed and will soon be archived by a bot.
- 178.162.193.199 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Requested unblock via UTRS.--Jezebel'sPonyobons mots 16:38, 24 April 2014 (UTC)
- Part of a VPN service offering a free trial. Also has weird behavior on port 80 (doesn't seem exploitable as an open proxy though). I thought VPN with free trial IPs were generally treated as open proxies, ergo remain blocked. Incidentally the IP is softblocked globally, so if we wait 4 months it will switch from a hard to a soft block on en.wiki when the current en.wiki block expires. Sailsbystars (talk) 04:37, 26 April 2014 (UTC)
- Noted, thank you.--Jezebel'sPonyobons mots 18:13, 28 April 2014 (UTC)
TheREALCableGuy
– This proxy check request is closed and will soon be archived by a bot.
- 178.21.175.159 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 178.21.175.169 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 81.10.82.107 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 94.252.21.225 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: There are suspicions at Wikipedia:Sockpuppet investigations/TheREALCableGuy that some of these may be open proxies. I was not able to find evidence for any of them; maybe people here can do better. -- King of ♥ ♦ ♣ ♠ 06:33, 6 June 2014 (UTC)
- Just close this; I've waited a week waiting for a response and TRCG has moved on to yet another range of IP's. Nate • (chatter) 04:24, 15 June 2014 (UTC)
- The 178's look like a colocation serverfarm, so likely a proxy. The exact mechanism isn't available. The other IPs don't appear to be proxies. Sorry for slow response. Sailsbystars (talk) 05:47, 15 June 2014 (UTC)
IP66.54.67.166
– This proxy check request is closed and will soon be archived by a bot.
- 66.54.67.166 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits
- I did not see any edits from the IP, it has yet to edit anything. 41.58.92.163 (talk) 03:28, 12 June 2014 (UTC)
- Looks like a server for the nokia/Microsoft maps program. Given lack of edits, there's not need to block. Sailsbystars (talk) 06:08, 15 June 2014 (UTC)
148.64.124.142
– This proxy check request is closed and will soon be archived by a bot.
- 148.64.124.142 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Likely proxy-using ref-desk troll we've been having lots of trouble from lately, based on edits. --Jayron32 03:54, 13 June 2014 (UTC)
- Satellite ISP. It might be a caching proxy but it doesn't seem to be an open proxy. Not open on any of the standard proxy ports... I've seen satellite IPs come up here before, but they never seem to be a proxy. Sailsbystars (talk) 06:15, 15 June 2014 (UTC)
216.120.248.30
– This proxy check request is closed and will soon be archived by a bot.
- 216.120.248.30 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Part of an 0/19 range. Says it's a closed proxy he uses himself. Daniel Case (talk) 21:21, 19 June 2014 (UTC)
- Well, the proxy that I found on that range back in 2011 seems to have moved on to another blocked range, but the original range should probably stay blocked. I'd explain that the software only allows rangeblocks, not rangeholes so we can't safely allow one vouched for server to edit from a rotten range (and the ownership of the range is the same as before). The user is welcome to edit wikipedia with his or her proxy disabled, though. Sailsbystars (talk) 02:21, 21 June 2014 (UTC)
- We can make it a soft block and see how that progresses, if problematic, we reblock. The spammers will still be held out as the creation bit will still be on. Remember that we are meant to be looking to let people edit, and to be reasonable in our blocks. — billinghurst sDrewth 07:07, 21 June 2014 (UTC)
- That's true, and I don't object to that interpretation either. There weren't any other edits at all from that range for four years before the block.... IPBE is also an option. But my reading of M:NOP is basically if your webhost isn't blocked carryon. If it is, then meh. Most people seem to forget proxies exist and I don't really think the policy has been vigorously debated in quite some time. Sailsbystars (talk) 13:59, 21 June 2014 (UTC)
- While being reasonable is something we should be as administrators, let me shine a different light on to it. This could be a blocked user who has obtained proxy services from this company, and is playing the innocent game. I know, it's assuming bad faith but time and time again I come across it with CU, and socks turn up. There should be a exceptional circumstance in which he absolutely needs to use a proxy to edit. If not, what is the issue with using a normal IP. Also why we have {{webhostblock}} -- DQ (ʞlɐʇ) 16:53, 23 June 2014 (UTC)
- That's true, and I don't object to that interpretation either. There weren't any other edits at all from that range for four years before the block.... IPBE is also an option. But my reading of M:NOP is basically if your webhost isn't blocked carryon. If it is, then meh. Most people seem to forget proxies exist and I don't really think the policy has been vigorously debated in quite some time. Sailsbystars (talk) 13:59, 21 June 2014 (UTC)
- We can make it a soft block and see how that progresses, if problematic, we reblock. The spammers will still be held out as the creation bit will still be on. Remember that we are meant to be looking to let people edit, and to be reasonable in our blocks. — billinghurst sDrewth 07:07, 21 June 2014 (UTC)
- Well, the proxy that I found on that range back in 2011 seems to have moved on to another blocked range, but the original range should probably stay blocked. I'd explain that the software only allows rangeblocks, not rangeholes so we can't safely allow one vouched for server to edit from a rotten range (and the ownership of the range is the same as before). The user is welcome to edit wikipedia with his or her proxy disabled, though. Sailsbystars (talk) 02:21, 21 June 2014 (UTC)
I asked him this and he says "Because it gives me a stable machine on a stable IP." Daniel Case (talk) 02:13, 26 June 2014 (UTC)
161.112.232.111
– This proxy check request is closed and will soon be archived by a bot.
- 161.112.232.111 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Says servers are a university's that were incorrectly blocked. Daniel Case (talk) 21:50, 24 June 2014 (UTC)
Not currently an open proxy I can verify their statement is accurate. The proxy is closed and legit. Unblock away! Sailsbystars (talk) 06:15, 25 June 2014 (UTC)
- I've unblocked the IP.--Jezebel'sPonyobons mots 18:18, 25 June 2014 (UTC)
175.28.15.91
– This proxy check request is closed and will soon be archived by a bot.
- 175.28.15.91 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: See these recent edits to Wikipedia:Sockpuppet investigations/L'Aquotique ([2], [3]) from impersonating Materialscientist. Additionally, per http://ping.eu/proxy/ 175.28.15.91 (talk · contribs · WHOIS) is a proxy for port 80. JoeSperrazza (talk) 21:20, 25 June 2014 (UTC)
- Confirmed, blocked, thanks. Materialscientist (talk) 21:45, 25 June 2014 (UTC)
190.102.28.173
– This proxy check request is closed and will soon be archived by a bot.
- 190.102.28.173 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 92.46.132.40 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits
See 3RR report closed on 29 June (permalink). The first IP who joined in the edit war, 190.102.28.173 (talk · contribs · deleted contribs · logs · filter log · block user · block log) is advertised on the web as being a proxy server offered by http://letushide.com, though I wasn't able to activate it. The second IP, 92.46.132.40 (talk · contribs · deleted contribs · logs · filter log · block user · block log) is on various anti-spam lists but not widely advertised as a proxy. EdJohnston (talk) 02:25, 30 June 2014 (UTC)
- Verified and blocked 190.102.28.173, but 92.46.132.40 is unlikely. Materialscientist (talk) 04:26, 30 June 2014 (UTC)
IP is an open proxy 92.46.132.40 (talk · contribs · WHOIS) is a wide open proxy, I just left a message as that IP on its talk page. I'd recommend blocking the IP for 3 months or so. Sailsbystars (talk) 05:45, 30 June 2014 (UTC)
- No wait, it's jumping around that son of a bitch. I came out as 92.46.158.203 (talk · contribs · WHOIS). A website listed the original IP as the outlet earlier today. I don't know if we can block the whole range without collateral or if maybe we just want to block the 2 /24s.... it's the same ISP on both ranges... Sailsbystars (talk) 05:49, 30 June 2014 (UTC)
- Looking at 92.46.132.0/24 [4] I only see that one edit, so not sure of the utility of a range block. 190.102.28.173/24 only has a half dozen edits outside of this one IP [5], all from 2012 or older, but not sure any of those were problematic. I'm inclined to not range block unless there is shown to be a larger problem on the range. Suggest leaving open and monitoring these ranges. I would note that .40 does have one port open but it isn't relaying. Dennis Brown | 2¢ | WER 10:40, 24 July 2014 (UTC)
- No wait, it's jumping around that son of a bitch. I came out as 92.46.158.203 (talk · contribs · WHOIS). A website listed the original IP as the outlet earlier today. I don't know if we can block the whole range without collateral or if maybe we just want to block the 2 /24s.... it's the same ISP on both ranges... Sailsbystars (talk) 05:49, 30 June 2014 (UTC)
