Wikipedia:WikiProject on open proxies/Archives/2011/November

64.20.37.186

{{proxycheckstatus}}

64.20.37.186 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Requesting unblock at User talk:M0z  Ronhjones  ^(Talk) 22:46, 24 October 2011 (UTC) Reason: Requested unblock.

Clearly a web server from the whois and IP hasn't come back to his TP yet. -- DQ (t) (e) 21:09, 28 October 2011 (UTC)

80.73.144.3

{{proxycheckstatus}}

80.73.144.3 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock.

We are an nonprofit governmental ISP providing services to all public schools in the Region of Murcia (Spain). Our customers navigate through a proxy, but it is NOT an open proxy. We have logs of all their actions, as required by Spanish Law. Our proxies IPs are 80.73.144.1, 80.73.144.2, 80.73.144.3 and 80.73.144.4.

This is not a proxy block, the block template has seem to have been confusing again. -- DQ (t) (e) 21:13, 28 October 2011 (UTC)

I can find no block of any sort affecting any of these IP addresses. JamesBWatson (talk) 09:41, 31 October 2011 (UTC)

It's probably the block on the Spanish Wikipedia. Block messages (like at m:WM:OP/H) sometimes redirect people to here. It doesn't seem to be open, let's check it out further and see if es admins will unblock it. -- zzuuzz ^(talk) 12:39, 31 October 2011 (UTC)

69.162.158.160

{{proxycheckstatus}}

69.162.158.160 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. Port 111 is open, but all others appear closed. Hersfold ^(t/a/c) 17:36, 30 October 2011 (UTC)

It seems this may possibly be (or have been) a honeypot, rather than an open proxy. JamesBWatson (talk) 09:54, 31 October 2011 (UTC)

Well, it's a dodgy IP, belonging to a colo provider, sat in a server farm. It's possible it's a cloud platform or VM, but I'm not sure it's an open proxy as such. -- zzuuzz ^(talk) 12:32, 31 October 2011 (UTC)

I've been scanning the IP for the past few hours and looking around, it's clearly down and per zzuuzz i'm going to say that this guy is  Unlikely IP is an open proxy. -- DQ (t) (e) 06:01, 8 November 2011 (UTC)

143.89.156.21

{{proxycheckstatus}}

143.89.156.21 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: unblock-en-l. Interesting results...but X11 stuff that I was never sure on in the first place, plus several MS ports. -- DQ (t) (e) 03:27, 31 October 2011 (UTC)

Oh that again (202.40.139.109). It was open last month, I can't verify it this time, but the proxy port seems to still be open. I'd be inclined to softblock that IP for the duration. -- zzuuzz ^(talk) 12:52, 31 October 2011 (UTC)

Currently not blocked anymore. -- DQ (t) (e) 06:03, 8 November 2011 (UTC)

115.66.148.15

{{proxycheckstatus}}

220.255.2.140 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock (on unblock-en-l). Can't check into this second. -- DQ (t) (e) 21:57, 7 November 2011 (UTC)

I'm not seeing any blocks, autoblocks, rangeblocks, global blocks, or anything on unblock-en-l. Could you check it's the right IP? -- zzuuzz ^(talk) 22:38, 7 November 2011 (UTC)

I have no clue where that one came from....fix to the correct one >_> Sorry -- DQ (t) (e) 02:16, 8 November 2011 (UTC)

Considering the last active time was 12/11/2011 01:28:53 i'm going to hold on giving results. -- DQ (t) (e) 13:40, 12 November 2011 (UTC)

Inconclusive, after running checks and knowing SingNet, chances are it's gone for now. Unblocked. -- zzuuzz ^(talk) 10:47, 19 November 2011 (UTC)

115.64.203.53

{{proxycheckstatus}}

115.64.203.53 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

User says a previous transparent proxy may have been picked up, but is no more. Daniel Case (talk) 06:03, 20 November 2011 (UTC)

It looks to me as though this is not an open proxy, but it would be good if someone more knowledgeable in the area could double check. JamesBWatson (talk) 17:04, 20 November 2011 (UTC)

Not currently an open proxy, unblocked. -- zzuuzz ^(talk) 20:31, 20 November 2011 (UTC)

196.12.10.5

{{proxycheckstatus}}

196.12.10.5 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock at User talk:Sinisterstuf. Looks to me like a closed college proxy, not an open proxy. JamesBWatson (talk) 11:43, 22 November 2011 (UTC)

Not currently an open proxy, unblocked. -- zzuuzz ^(talk) 11:54, 22 November 2011 (UTC)

203.110.246.22

{{proxycheckstatus}}

203.110.246.22 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

User:Jpmeena requesting unblock, and they don't have enough edits yet for me to feel comfortable granting IPBE (IP itself has been blocked for about four years). Daniel Case (talk) 20:35, 25 November 2011 (UTC)

 Inconclusive, not the most illustrious IP security history in the world, but it doesn't seem to be currently open, and seems more likely to be creating collateral than anything else. Unblocked. -- zzuuzz ^(talk) 11:42, 26 November 2011 (UTC)

82.139.104.33

{{proxycheckstatus}}

82.139.104.33 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Blocked as a Tor node; they say it's not. Daniel Case (talk) 05:12, 29 November 2011 (UTC)

IP is an open proxy, confirmed as Tor, unblock declined. -- zzuuzz ^(talk) 07:28, 29 November 2011 (UTC)

208.110.220.133

A user has requested a proxy check. A proxy checker will shortly look into the case.

208.110.220.133 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

• This IP was anon-blocked two months as a proxy per a 3RR complaint. Discussion ensued here as to the quality of my evidence, so I'm happy to have it further reviewed. A longer block would be justified if the evidence is good.

• Since the 3RR complaint, I found nmap saying this IP is running Squid. It reports it as a potentially open proxy. Opening it in my browser on http://208.110.220.133:8080 gives a holding page which says that it can't go any further and won't access the general web. Nmap calls it 'mta02.nationspetroleum.com' but a ping of that server under its own name resolves to a different IP which does not respond to ping. This site is provided with a Comcast business service. My guess is that it's an inadequately secured web server machine that won't proxy at this exact moment. This seems enough for a one-year hard block, especially since DeltaQuad *did* activate it as a web proxy on 8080. EdJohnston (talk) 04:33, 12 November 2011 (UTC)

• Still {{proxycheck}}, although slow on 8080. Ed, I forgot to say you need to *configure* your web browser to use this port to connect to the internet, and that's what I meant by plugging it in. -- DQ (t) (e) 13:22, 12 November 2011 (UTC)

• I was finally able to activate it as a proxy on 8080, though it was very slow. Hardblocked for one year. EdJohnston (talk) 17:18, 13 November 2011 (UTC)

209.141.60.77

– This proxy check request is closed and will soon be archived by a bot.

209.141.60.77 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Per this request on an SPI case, it seems that the IP is some kind of open proxy. — HelloAnnyong ^{(say whaaat?!)} 02:51, 16 November 2011 (UTC)

{{proxycheck}}, rangeblocked. -- zzuuzz ^(talk) 08:33, 16 November 2011 (UTC)

46.166.128.110

– This proxy check request is closed and will soon be archived by a bot.

46.166.128.110 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: A specific blocked user, Chaosname, seems to be IP hopping, and this is the user's latest one. עוד מישהו Od Mishehu 12:47, 17 November 2011 (UTC)

{{proxycheck}} VPS proxies, rangeblocked 46.166.128.0/18. -- zzuuzz ^(talk) 14:17, 17 November 2011 (UTC)

216.59.0.178

– This proxy check request is closed and will soon be archived by a bot.

216.59.0.178 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: used by vandal who frequently uses open proxies. --GenericBob (talk) 21:28, 22 November 2011 (UTC)

{{proxycheck}}, rangeblocked 216.59.0.160/27 thanks. -- zzuuzz ^(talk) 21:37, 22 November 2011 (UTC)

94.249.191.207

– This proxy check request is closed and will soon be archived by a bot.

94.249.191.207 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Used by long-term proxy abuser Escapeeyes.

{{proxycheck}}. Blocked by zzuuzz as open proxy (verified). Materialscientist (talk) 09:42, 26 November 2011 (UTC)

217.117.28.186

– This proxy check request is closed and will soon be archived by a bot.

217.117.28.186 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: ...and Escapeeyes again.

Blocked 217.117.16.0/20, per robtex and editing evidence. Haven't verified actual proxy port. Materialscientist (talk) 09:42, 26 November 2011 (UTC)

{{proxycheck}} that'll be confirmed as xeronet-proxy.info. -- zzuuzz ^(talk) 22:06, 26 November 2011 (UTC)

89.248.164.42

– This proxy check request is closed and will soon be archived by a bot.

89.248.164.42 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Escapeeyes again. Attempted nslookup on this IP but got "server couldn't find" errors.

Blocked 89.248.160.0/21, per robtex and editing evidence. Haven't verified actual proxy port. Materialscientist (talk) 09:42, 26 November 2011 (UTC)

{{proxycheck}} that'll be confirmed as zuntro.com. -- zzuuzz ^(talk) 22:06, 26 November 2011 (UTC)

72.29.78.155

– This proxy check request is closed and will soon be archived by a bot.

72.29.78.155 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Escapeeyes again, following her usual pattern. --GenericBob (talk) 08:43, 26 November 2011 (UTC)

{{proxycheck}} (several verified open proxy servers on this ip). zzuuzz has previously blocked 72.29.67.172, which sits on the same ISP, and I wonder if we should block 72.29.64.0/19? Materialscientist (talk) 09:42, 26 November 2011 (UTC)

Yep, I'm never entirely sure about that range either, though I'm leaning towards reblocking it. 72.29.65.254 (talk · contribs) is the cause of the previous unblock (see archive and archive) and it, or its contemporary equivalent or range, should be softblocked. -- zzuuzz ^(talk) 11:31, 26 November 2011 (UTC)

...and rangeblocked. -- zzuuzz ^(talk) 22:06, 26 November 2011 (UTC)

178.209.46.143

– This proxy check request is closed and will soon be archived by a bot.

178.209.46.143 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: This IP address was aparently used by Yourname, who has previously used open proxies. עוד מישהו Od Mishehu 13:41, 28 November 2011 (UTC)

{{proxycheck}}, blocked, rangeblocked. -- zzuuzz ^(talk) 13:48, 28 November 2011 (UTC)

218.102.20.53

– This proxy check request is closed and will soon be archived by a bot.

218.102.20.53 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits The IP made this edit today. This is exactly the same as an edit made by IP 76.212.14.56 a few days back. The 76.212.*.* is the community banned /indef blocked editor Naadapriya. He has the habit of disrupting the page in question and this new IP from a completely different geographical location has made exactly the same edit as him, i suspect 218.102.20.53 is a open proxy being used by him.--Sodabottle (talk) 14:32, 12 November 2011 (UTC)

I did a little bit of poking into this particular IP, and can find no particular evidence that it is a proxy. It looks like it belongs to a residential/mobile ISP. It's also closed on all the common proxy ports, so I would lean towards not being a proxy. Sailsbystars (talk) 17:15, 13 November 2011 (UTC)

{{proxycheck}} possibly has been a Tor exit node in the past, but no current indications that it's open. -- zzuuzz ^(talk) 10:42, 19 November 2011 (UTC)