User:ClueBot IV/WPA/Closed

This is a partial archive of WP:OP. {| class="wikitable sortable" ! IP address !! user !! talk !! edits !! log !! scan !! block !! Notes || Because I am really lazy, and this needs to be rechecked (probably reassigned). I wonder how fast this bot is. Prodego talk  17:24, 3 November 2007 (UTC)


 * ClueBot IV 17:29, 3 November 2007 (UTC)
 * Well, I checked it myself. Oddly the results don't match, (especially the DNSBL lookup). However, it isn't an open proxy 'anymore' by my check either. That said, something is messed up here, unless I am missing something. Prodego  talk  17:41, 3 November 2007 (UTC)

|| An rDNS lookup shows that this host's name is "nas17.2in1.Level3.net". Is this a compromised NAS? Jesse Viviano 03:00, 29 October 2007 (UTC)
 * ClueBot IV 03:07, 29 October 2007 (UTC)
 * Seems to be an infrastructure IP of some sort. Nothing interesting turned up in the scan. – Crazytales   talk / desk  04:47, 2 November 2007 (UTC)

|| User:83.8.48.164 (Special:Contributions/83.8.48.164 | Special:Blockip/83.8.48.164) is listed on the AHBL (TOR) list (http://www.ahbl.org/tools/lookup.php?ip=83.8.48.164) for the following types of proxies which I checked when they vandalized Arachnophobia: Tor exit server. ClueBot 05:29, 28 October 2007 (UTC)
 * ClueBot IV 05:36, 28 October 2007 (UTC)
 * Not a Tor server according to IPpages. Also nthing intersting turned up in the scan. – Crazytales   talk / desk  02:58, 4 November 2007 (UTC)

|| Avisonet. -- Avi 16:57, 24 October 2007 (UTC)
 * ClueBot IV 01:58, 25 October 2007 (UTC)
 * - An ISP proxy, but not open. Mr.  Z- man  05:54, 28 October 2007 (UTC)

|| Running the same filteriing software as 208.108.95.6, I'm suspecting its open on 8080, which is the proxy port for the filtering software. Nwwaew (Talk Page) (Contribs) (E-mail me) 13:28, 24 October 2007 (UTC)
 * No open ports, 8080 is closed. Mr.  Z- man  17:30, 24 October 2007 (UTC)
 * It is running an http proxy on 8080 and a squid on 3128, but both ports are filtered, and the connection is refused when I attempt to connect to them. So, I confirm Z-man's assessment. (Just thought I'd toss this in since I already checked the host following a request on my talk page.) AmiDaniel (talk) 18:09, 24 October 2007 (UTC)

|| Same as 210.213.70.246 - no RDNS. -Jéské ( Blah v^_^v ) 19:03, 22 October 2007 (UTC)
 * ClueBot IV 19:11, 22 October 2007 (UTC)
 * normal dynamic IP -- zzuuzz (talk) 19:18, 22 October 2007 (UTC)

|| Checked it after protecting Catholic Church (disambiguation); couldn't get a reverse DNS. -Jéské ( Blah v^_^v ) 19:00, 22 October 2007 (UTC)
 * ClueBot IV 19:11, 22 October 2007 (UTC)
 * normal dynamic IP -- zzuuzz (talk) 19:18, 22 October 2007 (UTC)

|| Porn linkspamming, see WT:WPSPAM. MER-C 08:58, 17 October 2007 (UTC)
 * ClueBot IV 17:13, 17 October 2007 (UTC)
 * Some weird ports open, but none of them are open proxies. At least not any kind I am familiar with.  Could be a zombie/Trojan horse, but ...  -- Cobi(t 02:07, 18 October 2007 (UTC)

|| Confirmation requested as I am behind corporate firewall. C:\Program Files\Nmap>nmap -F -P0 203.130.242.203

Starting Nmap 4.20 ( http://insecure.org ) at 2007-10-15 13:12 Eastern Daylight Time Interesting ports on 203.130.242.203: Not shown: 1169 filtered ports, 84 closed ports PORT  STATE SERVICE 22/tcp open ssh 53/tcp open domain 80/tcp open http

Nmap finished: 1 IP address (1 host up) scanned in 118.609 seconds -- Avi 17:17, 15 October 2007 (UTC)
 * ClueBot IV 17:25, 15 October 2007 (UTC)
 * Closed squid proxy, but not an open proxy. -- Cobi(t 02:07, 18 October 2007 (UTC)

|| Mostly vandalism from this IP, edit history from makes it obvious this user is the same as. Unless he got from Utah to Amsterdam in five minutes, this is an open proxy. -- B 22:10, 14 October 2007 (UTC)
 * ClueBot IV 02:48, 15 October 2007 (UTC)
 * At least, it isn't open. ClueBot IV found nothing, despite finding ports open.  -- Cobi(t 02:07, 18 October 2007 (UTC)

|| Open proxy found through proxy dot orgSee contribs Thedjatclubrock :) (T/C) 14:55, 14 October 2007 (UTC)
 * ClueBot IV 15:01, 14 October 2007 (UTC)
 * According to ClueBot IV's report (above), this is not an open proxy. -- Cobi(t 02:07, 18 October 2007 (UTC)

|| User:89.179.40.179 (Special:Contributions/89.179.40.179 | Special:Blockip/89.179.40.179) is listed on the AHBL (TOR) list (http://www.ahbl.org/tools/lookup.php?ip=89.179.40.179) for the following types of proxies which I checked when they vandalized Amir Ghalenoei: Tor exit server. ClueBot 04:30, 14 October 2007 (UTC)
 * ClueBot IV 04:39, 14 October 2007 (UTC)
 * According to this, it is not a tor exit node. -- Cobi(t 02:07, 18 October 2007 (UTC)

|| I found the following types of open proxies on User:147.197.215.15 (Special:Contributions/147.197.215.15 | Special:Blockip/147.197.215.15) which I checked when they vandalized Fernand Léger: HTTP. ClueBot 19:03, 10 October 2007 (UTC)
 * ClueBot IV 19:08, 10 October 2007 (UTC)
 * proxy on port 8080 requires authentication. -- zzuuzz (talk) 19:16, 10 October 2007 (UTC)

|| not listed on blocklists but domain name is proxy05-out.spidernet.net DenizTC 12:19, 9 October 2007 (UTC)
 * ClueBot IV 12:24, 9 October 2007 (UTC)
 * (not an open one at least). Mr.  Z- man  00:28, 11 October 2007 (UTC)

|| uceprotect, sorbs, moensted, from germany DenizTC 22:09, 8 October 2007 (UTC)
 * ClueBot IV 22:22, 8 October 2007 (UTC)
 * At least it doesn't appear to be a proxy. -- Cobi(t 07:13, 13 October 2007 (UTC)

|| sorbs vandal DenizTC 21:58, 8 October 2007 (UTC)
 * ClueBot IV 22:13, 8 October 2007 (UTC)
 * At least it doesn't appear to be a proxy. -- Cobi(t 07:13, 13 October 2007 (UTC)

|| sorbs DenizTC 21:52, 8 October 2007 (UTC)
 * ClueBot IV 22:13, 8 October 2007 (UTC)
 * At least it doesn't appear to be a proxy. -- Cobi(t 07:13, 13 October 2007 (UTC)

|| same as below DenizTC 21:58, 8 October 2007 (UTC)
 * ClueBot IV 21:55, 8 October 2007 (UTC)
 * At least it doesn't appear to be a proxy. -- Cobi(t 07:13, 13 October 2007 (UTC)

|| same as below DenizTC 21:58, 8 October 2007 (UTC)
 * ClueBot IV 22:13, 8 October 2007 (UTC)
 * At least it doesn't appear to be a proxy. -- Cobi(t 07:13, 13 October 2007 (UTC)

|| another vandal on sorbs DenizTC 21:29, 8 October 2007 (UTC)
 * ClueBot IV 21:55, 8 October 2007 (UTC)
 * At least it doesn't appear to be a proxy. -- Cobi(t 07:13, 13 October 2007 (UTC)

|| blanking vandal, blacklisted on sorbs and moensted
 * ClueBot IV 21:23, 8 October 2007 (UTC)
 * At least it doesn't appear to be a proxy. -- Cobi(t 07:13, 13 October 2007 (UTC)

|| vandalized Turkish language. a traceroute is blocked by the firewall. DenizTC 09:56, 5 October 2007 (UTC)
 * ClueBot IV 10:04, 5 October 2007 (UTC)
 * -- zzuuzz (talk) 15:38, 5 October 2007 (UTC)

|| C:\Program Files\Nmap>nmap -F -P0 213.212.1.52

Starting Nmap 4.20 ( http://insecure.org ) at 2007-10-01 12:16 Eastern Daylight Time Interesting ports on 213.212.1.52: Not shown: 1253 filtered ports PORT   STATE SERVICE 22/tcp open  ssh 443/tcp open https Nmap finished: 1 IP address (1 host up) scanned in 49.151 seconds

Posting for confirmation. Note, port 80 is left out as that always shows up as open for me due to firewall issues. -- Avi 16:25, 1 October 2007 (UTC)


 * ClueBot IV 16:33, 1 October 2007 (UTC)
 * See ClueBot IV's report. -- Cobi(t 19:12, 1 October 2007 (UTC)