Wikipedia:WikiProject on open proxies/Inconclusive

{| class="wikitable sortable" ! IP address !! user !! talk !! edits !! log !! scan !! block !! Notes || User:203.214.46.35 (Special:Contributions/203.214.46.35 | Special:Blockip/203.214.46.35) is listed on the DSBL list (http://dsbl.org/listing?203.214.46.35) for the following types of proxies which I checked when they vandalized Steven Seagal: Open Proxy. ClueBot 22:09, 6 September 2007 (UTC)
 * OSCAR service open on 5190. Not sure of the significance of this. &mdash;Crazytales talk/desk 15:14, 9 September 2007 (UTC)

|| Porn spamming/vandalism at Hymn to Liberty - Mike Rosoft 09:08, 6 September 2007 (UTC)
 * Open on 8080, but I get server timeouts. &mdash;Crazytales talk/desk 15:14, 9 September 2007 (UTC)

|| Google turns up stale open proxy lists with this IP but not recent lists. Resurgent insurgent 15:49, 29 August 2007 (UTC)
 * Running a proxy on 8080, but authentication required. &mdash;Crazytales (t.) 01:04, 31 August 2007 (UTC)

|| One of two IPs used to add long soapboing commentries to Misandry. This one is from Mexico-- Cailil  talk 23:17, 15 August 2007 (UTC)
 * Port 5900 is open (VNC); horrible security practice. I don't have a VNC client at my disposal now though, so I can't say whether it's open or not. &mdash;Crazytales (t.) 15:45, 17 August 2007 (UTC)

|| Chinese IP making similar arguments to an indef blocked editor and his meatpuppets. My comment to the IP was followed up by a reply that was easily identified as a Chinese open proxy, but I'm not sure about this one.--Isotope23 talk 20:35, 13 August 2007 (UTC)
 * Whole mess of open ports, but I wasn't able to connect on any. &mdash; Crazytales (public computer) (talk) (main) 16:01, 20 August 2007 (UTC)

|| Part of a series of IPs who added the same spam link over 15 minutes or so, some of which have already been blocked as proxies. Located on a variety of different continents, so proxies are even more likely. See WT:WPSPAM. MER-C 09:01, 13 August 2007 (UTC)
 * Japanese web server; may be someone with access to it. &mdash; Crazytales (public computer) (talk) (main) 16:01, 20 August 2007 (UTC)

|| : ClueBot IV 19:40, 23 October 2007 (UTC)
 * Lots of services running, but all secure. AmiDaniel (talk) 00:24, 24 October 2007 (UTC)

|| Again, lots of services running, but all secure. AmiDaniel (talk) 00:24, 24 October 2007 (UTC)


 * ClueBot IV 01:58, 25 October 2007 (UTC)

|| AmiDaniel (talk) 00:24, 24 October 2007 (UTC)


 * ClueBot IV 01:58, 25 October 2007 (UTC)

|| : ClueBot IV 19:17, 23 October 2007 (UTC)


 * AmiDaniel (talk) 00:24, 24 October 2007 (UTC)

|| Reported on WP:ANI. Dean Wormer 03:52, 22 October 2007 (UTC)
 * ClueBot IV 04:21, 22 October 2007 (UTC)


 * AmiDaniel (talk) 00:43, 24 October 2007 (UTC)

|| Reported on WP:ANI. Dean Wormer 03:46, 22 October 2007 (UTC)
 * ClueBot IV 03:53, 22 October 2007 (UTC)
 * AmiDaniel (talk) 00:43, 24 October 2007 (UTC)

|| Another test. -- Avi 21:18, 17 October 2007 (UTC)
 * ClueBot IV 21:26, 17 October 2007 (UTC)
 * No open ports - host down at time of scan. Suggest scanning again in a day or so.  -- Cobi(t 02:07, 18 October 2007 (UTC)

|| -- Avi 21:01, 17 October 2007 (UTC)
 * ClueBot IV 21:06, 17 October 2007 (UTC)
 * No open ports - host down at time of scan. Suggest scanning again in a day or so.  -- Cobi(t 02:07, 18 October 2007 (UTC)

|| Funny issues with hostname resolution. -- Avi 20:34, 15 October 2007 (UTC)
 * ClueBot IV 20:42, 15 October 2007 (UTC)
 * No open ports - host down at time of scan. Suggest scanning again in a day or so.  -- Cobi(t 02:07, 18 October 2007 (UTC)

|| Apparent sock puppet of banned American user User:Polygamistx4 using an Australian IP address. - Jehochman Talk 05:03, 15 October 2007 (UTC)
 * ClueBot IV 05:11, 15 October 2007 (UTC)
 * No open ports - host down at time of scan. Suggest scanning again in a day or so.  -- Cobi(t 02:07, 18 October 2007 (UTC)

|| Edits look like a proxy ... if you google this IP, it apparently is being used for spam, so it is probably a compromised machine of some kind. -- B 15:33, 5 October 2007 (UTC)


 * ClueBot IV 15:44, 5 October 2007 (UTC)
 * -The edits, google hits, and WHOIS (Sound of Hope Radio Network?) do seem suspicious and port 80 appears to be an open HTTP port, however, I have yet to be able to connect through it. Perhaps part of a Botnet? Mr.  Z- man  21:38, 8 October 2007 (UTC)

|| I found the following types of open proxies on User:70.89.86.6 (Special:Contributions/70.89.86.6 | Special:Blockip/70.89.86.6) which I checked when they vandalized Paris: HTTP. ClueBot 16:30, 3 October 2007 (UTC)
 * ClueBot IV 16:38, 3 October 2007 (UTC)
 * It appears that this host is now offline or is firewalling my IP address. ClueBot IV's assessment may be wrong.  -- Cobi(t 16:41, 3 October 2007 (UTC)

C:\Program Files\Nmap>nmap -P0 -A -p 8080 70.89.86.6

Starting Nmap 4.20 ( http://insecure.org ) at 2007-10-03 13:04 Eastern Daylight Time Warning: OS detection for 70.89.86.6 will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port Warning: OS detection will be MUCH less reliable because we did not find at lea st 1 open and 1 closed TCP port Interesting ports on 70-89-86-6-smc-jax-fl.hfc.comcastbusiness.net (70.89.86.6):

PORT    STATE    SERVICE    VERSION 8080/tcp filtered http-proxy Device type: switch|broadband router|printer|load balancer|general purpose|route r Running: Bay Networks embedded, Billion embedded, Canon embedded, Cisco embedded , Linux 2.4.X|2.6.X, Microsoft Windows 2003/.NET|NT/2K/XP, RiverStone embedded, Sun Solaris 8 Too many fingerprints match this host to give specific OS details

OS and Service detection performed. Please report any incorrect results at http: //insecure.org/nmap/submit/. Nmap finished: 1 IP address (1 host up) scanned in 7.387 seconds
 * If it was an open proxy it's closed/filtered now. Mr.  Z- man  17:16, 3 October 2007 (UTC)
 * It's open now (blocked). -- zzuuzz (talk) 10:15, 5 October 2007 (UTC)

|| I found the following types of open proxies on User:206.57.118.34 (Special:Contributions/206.57.118.34 | Special:Blockip/206.57.118.34) which I checked when they vandalized Venice, Los Angeles, California: HTTPGET. ClueBot 01:13, 31 October 2007 (UTC)
 * ClueBot IV 18:21, 2 November 2007 (UTC)
 * (blocked) -- zzuuzz (talk) 21:16, 29 November 2007 (UTC)

|| I found the following types of open proxies on User:211.242.42.53 (Special:Contributions/211.242.42.53 | Special:Blockip/211.242.42.53) which I checked when they vandalized Eduardo Quisumbing: HTTPGET. ClueBot 00:26, 27 October 2007 (UTC)
 * ClueBot IV 00:37, 27 October 2007 (UTC)
 * (blocked) -- zzuuzz (talk) 21:16, 29 November 2007 (UTC)

|| I found the following types of open proxies on User:67.99.204.254 (Special:Contributions/67.99.204.254 | Special:Blockip/67.99.204.254) which I checked when they vandalized .co: HTTPPOST. ClueBot 08:50, 26 October 2007 (UTC)
 * ClueBot IV 08:59, 26 October 2007 (UTC)
 * (blocked) -- zzuuzz (talk) 21:16, 29 November 2007 (UTC)

|| Reported on WP:ANI. Dean Wormer 03:50, 22 October 2007 (UTC)
 * ClueBot IV 04:21, 22 October 2007 (UTC)
 * (blocked) -- zzuuzz (talk) 21:16, 29 November 2007 (UTC)

|| Spamming XRumer on Talk:Bulletin board system by asking for a link to it. Believe this is an XRumer proxy. -Jéské ( Blah v^_^v ) 23:26, 26 November 2007 (UTC)
 * ClueBot IV (talk) 23:40, 26 November 2007 (UTC)
 * I'd already blocked this as a XRumer proxy. Port 8888 is open, others are filtered. -- zzuuzz (talk) 21:44, 29 November 2007 (UTC)

|| participated in a user page attack --Oxymoron83 23:05, 23 November 2007 (UTC)
 * ClueBot IV (talk) 23:22, 23 November 2007 (UTC)
 * port 8000 appears open but I can't connect through it. Seems to be an exploited webserver or private proxy. -- zzuuzz (talk) 15:26, 1 December 2007 (UTC)

|| Anonymizer proxy; see User:The Evil Spartan/Suspected sock puppets/Scibaby. The Evil Spartan (talk) 03:43, 9 December 2007 (UTC)
 * Note: Anonymizer proxies are usually undetectable by portscans, per personal experience. Nwwaew (Talk Page) (Contribs) (E-mail me) 15:02, 9 December 2007 (UTC)
 * &mdash; No open ports. -- Cobi(t 17:59, 17 December 2007 (UTC)

|| Anonymizer proxy; see User:The Evil Spartan/Suspected sock puppets/Scibaby. The Evil Spartan (talk) 03:43, 9 December 2007 (UTC)
 * Note: Anonymizer proxies are usually undetectable by portscans, per personal experience. Nwwaew (Talk Page) (Contribs) (E-mail me) 15:02, 9 December 2007 (UTC)
 * - Host is down. -- Cobi(t 08:28, 19 December 2007 (UTC)

|| Anonymizer proxy; see User:The Evil Spartan/Suspected sock puppets/Scibaby. The Evil Spartan (talk) 03:43, 9 December 2007 (UTC)
 * Note: Anonymizer proxies are usually undetectable by portscans, per personal experience. Nwwaew (Talk Page) (Contribs) (E-mail me) 15:02, 9 December 2007 (UTC)
 * - Host is down. -- Cobi(t 08:28, 19 December 2007 (UTC)

|| Anonymizer proxy; see User:The Evil Spartan/Suspected sock puppets/Scibaby. The Evil Spartan (talk) 03:43, 9 December 2007 (UTC)
 * Note: Anonymizer proxies are usually undetectable by portscans, per personal experience. Nwwaew (Talk Page) (Contribs) (E-mail me) 15:02, 9 December 2007 (UTC)
 * - Host is down. -- Cobi(t 08:28, 19 December 2007 (UTC)

|| Anonymizer proxy; see User:The Evil Spartan/Suspected sock puppets/Scibaby. The Evil Spartan (talk) 03:43, 9 December 2007 (UTC)
 * Note: Anonymizer proxies are usually undetectable by portscans, per personal experience. Nwwaew (Talk Page) (Contribs) (E-mail me) 15:02, 9 December 2007 (UTC)
 * - Host is down. -- Cobi(t 08:28, 19 December 2007 (UTC)

|| Anonymizer proxy; see User:The Evil Spartan/Suspected sock puppets/Scibaby. The Evil Spartan (talk) 03:43, 9 December 2007 (UTC)
 * Note: Anonymizer proxies are usually undetectable by portscans, per personal experience. Nwwaew (Talk Page) (Contribs) (E-mail me) 15:02, 9 December 2007 (UTC)
 * - Host is down. -- Cobi(t 08:28, 19 December 2007 (UTC)

|| Found unblocked whilst using Tor.  Oc t  ane  [ improve me ] 16.12.07 1621 (UTC)
 * ClueBot IV (talk) 08:33, 19 December 2007 (UTC)
 * - Host down. -- Cobi(t 02:09, 23 December 2007 (UTC)

|| User:88.65.234.90 (Special:Contributions/88.65.234.90 | Special:Blockip/88.65.234.90) this IP has done nothing but vandalize articles and has not contributed nothing to wikipedia. Ireland101 (talk) 00:27, 24 December 2007 (UTC)
 * ClueBot IV (talk) 08:46, 24 December 2007 (UTC)
 * - Host down. -- Cobi(t 08:47, 24 December 2007 (UTC)

|| User:84.129.3.18 (Special:Contributions/84.129.3.18 | Special:Blockip/84.129.3.18) is listed on the AHBL (TOR) list (http://www.ahbl.org/tools/lookup.php?ip=84.129.3.18) for the following types of proxies which I checked when they vandalized January 10:. ClueBot (talk) 06:05, 9 January 2008 (UTC)
 * No longer on the list, though could be Tor back on Jan 9. --WinHunter (talk) 00:28, 12 January 2008 (UTC)

|| Used to edit war at Bates method --Calton | Talk 14:49, 2 January 2008 (UTC)
 * - Host is down. -- Cobi(t 05:32, 12 January 2008 (UTC)

|| Used to edit war at Bates method --Calton | Talk 14:49, 2 January 2008 (UTC)
 * - Host is down. -- Cobi(t 05:33, 12 January 2008 (UTC)

|| Used to edit war at Bates method --Calton | Talk 14:49, 2 January 2008 (UTC)
 * ClueBot IV (talk) 06:36, 12 January 2008 (UTC)
 * - Host is down. -- Cobi(t 08:22, 12 January 2008 (UTC)

|| Used to edit war at Bates method --Calton | Talk 14:49, 2 January 2008 (UTC)
 * ClueBot IV (talk) 06:36, 12 January 2008 (UTC)
 * - Host is down. -- Cobi(t 08:22, 12 January 2008 (UTC)

|| Used to edit war at Bates method --Calton | Talk 14:49, 2 January 2008 (UTC)
 * ClueBot IV (talk) 06:36, 12 January 2008 (UTC)
 * - Host is down. -- Cobi(t 08:22, 12 January 2008 (UTC)

|| Tor node, used to edit war on List of fictional ducks --Calton | Talk 13:23, 2 January 2008 (UTC)
 * ClueBot IV (talk) 06:36, 12 January 2008 (UTC)
 * - Host is down. -- Cobi(t 08:22, 12 January 2008 (UTC)

|| Used for fiddling about with Bates method. Reported by Calton | Talk 00:51, 2 January 2008 (UTC)
 * ClueBot IV (talk) 06:36, 12 January 2008 (UTC)
 * - Host is down. -- Cobi(t 08:22, 12 January 2008 (UTC)

|| Used to edit war at Bates method --Calton | Talk 14:49, 2 January 2008 (UTC)
 * ClueBot IV (talk) 06:36, 12 January 2008 (UTC)
 * - Host is down. -- Cobi(t 08:30, 12 January 2008 (UTC)

|| Used to edit war at Bates method --Calton | Talk 14:49, 2 January 2008 (UTC)
 * ClueBot IV (talk) 06:36, 12 January 2008 (UTC)
 * - Host is down. -- Cobi(t 08:30, 12 January 2008 (UTC)

|| Used to edit war at Bates method --Calton | Talk 14:49, 2 January 2008 (UTC)
 * ClueBot IV (talk) 06:36, 12 January 2008 (UTC)
 * - Host is down. -- Cobi(t 08:30, 12 January 2008 (UTC)

|| Used to edit war at Bates method --Calton | Talk 14:49, 2 January 2008 (UTC)
 * ClueBot IV (talk) 06:36, 12 January 2008 (UTC)
 * - Host is down. -- Cobi(t 08:30, 12 January 2008 (UTC)

|| Used to edit war at Bates method --Calton | Talk 14:49, 2 January 2008 (UTC)
 * ClueBot IV (talk) 06:36, 12 January 2008 (UTC)
 * - Host is down. -- Cobi(t 08:30, 12 January 2008 (UTC)

|| Used to edit war at Bates method --Calton | Talk 14:49, 2 January 2008 (UTC)
 * ClueBot IV (talk) 06:36, 12 January 2008 (UTC)
 * - Host is down. -- Cobi(t 08:30, 12 January 2008 (UTC)

|| The very same reason as the right below Special:Contributions/124.87.134.96's case.--Appletrees (talk) 14:32, 22 January 2008 (UTC)


 * ClueBot IV (talk) 14:42, 22 January 2008 (UTC)
 * - host is down. -- Cobi(t 01:21, 25 January 2008 (UTC)

|| Per their interests and writing style, I believe they're using open proxies not to reveal his real ip address of Special:Contributions/219.66.40.104 who is banned for his vandalism and registered to SoftBank Telecom of Japan.--Appletrees (talk) 14:32, 22 January 2008 (UTC)


 * ClueBot IV (talk) 14:42, 22 January 2008 (UTC)
 * - host is down. -- Cobi(t 01:21, 25 January 2008 (UTC)

|| I found the following types of open proxies on User:137.101.132.114 (Special:Contributions/137.101.132.114 | Special:Blockip/137.101.132.114) which I checked when they vandalized Electronic design automation: HTTPGET. ClueBot (talk) 08:49, 28 January 2008 (UTC)
 * ClueBot IV (talk) 08:54, 28 January 2008 (UTC)
 * - Host up, has HTTP-proxy on port 80, but I'm unable to connect through it. Mr.  Z- man  01:17, 29 January 2008 (UTC)

|| Offensive edit summary from this IP suggests this is a proxy (or that someone wants us to think it is). When I tried to navigate to this hostname, "xyhd.tv", I got a warning about "Proxy/Hacking content" or some such (right now I'm editing from behind a firewall). I'm not really sure how one would go about further checking a given IP, but ahbl.org did not indicate this is a proxy. Gyrofrog (talk) 18:23, 8 February 2008 (UTC)
 * P.S. FWIW, the Portuguese Wikipedia blocked this IP as a proxy . -- Gyrofrog (talk) 18:26, 8 February 2008 (UTC)
 * ClueBot IV (talk) 18:33, 8 February 2008 (UTC)
 * Appears to be a default installation of the Apache web server. It's highly likely that the server has been exploited to be used as a proxy. A portscan reveals several ports open, but all the ports return to the Apache default installation page. Nwwaew (Talk Page) (Contribs) (E-mail me) 21:36, 8 February 2008 (UTC)
 * - No open proxy found, likely hacked though. Recommend block.  -- Cobi(t 01:06, 9 February 2008 (UTC)
 * - I found a CGI proxy here. Nwwaew (Talk Page) (Contribs) (E-mail me) 01:39, 9 February 2008 (UTC)

|| User:222.221.254.164 listed on My-Proxy - Public Proxy List 1 Calvin 1998   Talk   Contribs  04:58, 6 February 2008 (UTC)
 * ClueBot IV (talk) 05:03, 6 February 2008 (UTC)
 * - Host is down. -- Cobi(t 01:06, 9 February 2008 (UTC)

|| Massive parades of moving articles to other name were held on ethnic groups related articles. I think the anon looks suspicious per his or her comments. --Appletrees (talk) 12:55, 5 February 2008 (UTC)
 * ClueBot IV (talk) 13:01, 5 February 2008 (UTC)
 * - Though, user is from Korea. -- Cobi(t 01:06, 9 February 2008 (UTC)

|| This IP writes political rants or smears about something in New Jersey, but this IP is in Europe. Jesse Viviano (talk) 16:33, 25 February 2008 (UTC)
 * ClueBot IV (talk) 16:40, 25 February 2008 (UTC)
 * - Not an open proxy, but might be a trojan. Host is a Windows computer.  -- Cobi(t 06:09, 29 February 2008 (UTC)

|| Possible OP. Stale, but according to rfcu result, the use were supposed to be other place.--Appletrees (talk) 15:19, 19 February 2008 (UTC)


 * ClueBot IV (talk) 15:23, 19 February 2008 (UTC)
 * - Not a proxy, but there is a VNC server running on that computer. I am not going to try to brute force it, though.  -- Cobi(t 06:09, 29 February 2008 (UTC)

|| After a sock ip, of the banned user User:Azukimonaka's blanking cited information, this British anon did the same thing. I think the ip is a possible op. --Appletrees (talk) 13:47, 17 February 2008 (UTC)
 * ClueBot IV (talk) 13:55, 17 February 2008 (UTC)
 * - There is a remote management console running over telnet on port 23, however, I tried a few default usernames/passwords, but none of them worked. It may have been brute forced, though.  -- Cobi(t 06:09, 29 February 2008 (UTC)

|| CGI proxy here. Nwwaew (Talk Page) (Contribs) (E-mail me) 01:03, 17 February 2008 (UTC)
 * ClueBot IV (talk) 01:10, 17 February 2008 (UTC)
 * - Host is down. -- Cobi(t 06:09, 29 February 2008 (UTC)

|| One of a series of Thai IP addresses involved in a revert-war on Master of Business Administration. Each revert comes from a separate Thai IP address used for a single purpose.
 * ClueBot IV (talk) 19:40, 29 February 2008 (UTC)
 * - Host is down. -- Cobi(t 19:52, 29 February 2008 (UTC)

|| One of a series of Thai IP addresses involved in a revert-war on Master of Business Administration. Each revert comes from a separate Thai IP address used for a single purpose.
 * ClueBot IV (talk) 19:40, 29 February 2008 (UTC)
 * - Host is down. -- Cobi(t 19:52, 29 February 2008 (UTC)

|| One of a series of Thai IP addresses involved in a revert-war on Master of Business Administration. Each revert comes from a separate Thai IP address used for a single purpose.


 * ClueBot IV (talk) 19:40, 29 February 2008 (UTC)
 * - Host is down. -- Cobi(t 19:52, 29 February 2008 (UTC)

|| Open proxy- found using WP:OPD. Calvin 1998  Talk   Contribs  04:03, 22 February 2008 (UTC)
 * ClueBot IV (talk) 04:19, 22 February 2008 (UTC)
 * - CISCO router, though I don't see any signs of it being a proxy. -- Cobi(t 06:09, 29 February 2008 (UTC)

|| User:69.66.231.1 (Special:Contributions/69.66.231.1 | Special:Blockip/69.66.231.1) is listed on the AHBL (TOR) list (http://www.ahbl.org/tools/lookup.php?ip=69.66.231.1) for the following types of proxies which I checked when they vandalized Snipe:. ClueBot (talk) 23:15, 10 March 2008 (UTC)


 * ClueBot IV (talk) 23:19, 10 March 2008 (UTC)
 * - AHBL claims is TOR, Kewlio says no, ClueBot IV says no. Leaning toward  Calvin 1998   Talk   Contribs  23:26, 10 March 2008 (UTC)

|| User:71.181.254.157 (Special:Contributions/71.181.254.157 | Special:Blockip/71.181.254.157) is listed on the sectoor (TOR) list (http://www.sectoor.de/tor.php?ip=71.181.254.157) for the following types of proxies which I checked when they vandalized Melodifestivalen:. ClueBot (talk) 23:53, 12 March 2008 (UTC)


 * ClueBot IV (talk) 23:58, 12 March 2008 (UTC)
 * - Kewlio=No TOR, Sectoor=Subnet is TOR, AHBL TORbl=No TOR. Calvin 1998   Talk   Contribs  00:56, 13 March 2008 (UTC)

|| 205.144.62.1 is blacklisted at ahbl.org: "The machine on this IP address has an insecure proxy, or could possibly be infected with a virus or trojan." Gyrofrog (talk) 18:38, 8 March 2008 (UTC)
 * ClueBot IV (talk) 21:18, 8 March 2008 (UTC)
 * . No open ports, but zombie computers can evade portscans. Nwwaew (Talk Page) (Contribs) (E-mail me) 23:34, 13 March 2008 (UTC)

|| Open proxy. See Kokarako Gumango (talk) 03:06, 20 March 2008 (UTC)
 * requires authentication. -- zzuuzz (talk) 15:42, 20 March 2008 (UTC)

|| Tor exit node Momusufan (talk) 04:29, 17 March 2008 (UTC)
 * TOR Calvin 1998 (t-c) 04:40, 17 March 2008 (UTC)
 * , purports to block access to Wikipedia on 66.230.200.100 and 66.230.200.219. Does anyone know all the IPs? -- zzuuzz (talk) 22:10, 17 March 2008 (UTC)

|| User:69.121.76.46 (Special:Contributions/69.121.76.46 | Special:Blockip/69.121.76.46) is listed on the sectoor (TOR) list (http://www.sectoor.de/tor.php?ip=69.121.76.46) for the following types of proxies which I checked when they vandalized Romanticism:. ClueBot (talk) 00:06, 17 March 2008 (UTC)
 * ClueBot IV (talk) 00:12, 17 March 2008 (UTC)
 * - subnet is TOR, and you can't block only a subnet. Calvin 1998 (t-c) 01:36, 17 March 2008 (UTC)

|| Singapore, open port 80, used by alleged sockpuppet of editor from somewhere else. If not open proxy, possible commercial proxy service? Thatcher 16:07, 29 March 2008 (UTC)
 * ClueBot IV (talk) 16:15, 29 March 2008 (UTC)
 * - appears maybe to be open on HTTP port 80. Another portscan would be nice. Calvin 1998 (t-c) 17:51, 29 March 2008 (UTC)
 * Looks like a router. Port 80 requires a username and password, so no go there. I'm not seeing any proxies at the moment. Nwwaew (Talk Page) (Contribs) (E-mail me) 21:33, 29 March 2008 (UTC)

|| I found the following types of open proxies on User:217.199.117.106 (Special:Contributions/217.199.117.106 | Special:Blockip/217.199.117.106) which I checked when they vandalized Virginia Tech massacre: HTTPGET. ClueBot (talk) 00:58, 16 April 2008 (UTC)
 * ClueBot IV (talk) 01:03, 16 April 2008 (UTC)
 * - I couldn't connect to ports 80, 8080, 3128, and 6667. Can someone run a portscan on this IP, and re-check it? I can't find any proxies on it myself, but that doesn't mean there aren't any. I Googled the IP, and it came up on proxy lists for port 8080- maybe the host is down right now? Nwwaew (Talk Page) (Contribs) (E-mail me) 21:02, 16 April 2008 (UTC)

|| I found the following types of open proxies on User:217.199.117.106 (Special:Contributions/217.199.117.106 | Special:Blockip/217.199.117.106) which I checked when they vandalized Virginia Tech massacre: HTTPGET. ClueBot (talk) 00:58, 16 April 2008 (UTC)
 * ClueBot IV (talk) 01:03, 16 April 2008 (UTC)
 * - I couldn't connect to ports 80, 8080, 3128, and 6667. Can someone run a portscan on this IP, and re-check it? I can't find any proxies on it myself, but that doesn't mean there aren't any. I Googled the IP, and it came up on proxy lists for port 8080- maybe the host is down right now? Nwwaew (Talk Page) (Contribs) (E-mail me) 21:02, 16 April 2008 (UTC)

|| User:92.232.228.56 (Special:Contributions/92.232.228.56 | Special:Blockip/92.232.228.56) is listed on the sectoor (TOR) list (http://www.sectoor.de/tor.php?ip=92.232.228.56) for the following types of proxies which I checked when they vandalized Avram Grant:. ClueBot (talk) 13:38, 19 April 2008 (UTC)
 * ClueBot IV (talk) 13:43, 19 April 2008 (UTC)
 * - TOR checks come up negative. Needs further testing. Calvin 1998 (t-c) 18:16, 19 April 2008 (UTC)

|| User:160.36.249.159 (Special:Contributions/160.36.249.159 | Special:Blockip/160.36.249.159) is listed on the sectoor (TOR) list (http://www.sectoor.de/tor.php?ip=160.36.249.159) for the following types of proxies which I checked when they vandalized Montreal Canadiens:. ClueBot (talk) 20:57, 19 April 2008 (UTC)
 * ClueBot IV (talk) 21:04, 19 April 2008 (UTC)
 * - ClueBot checked SECTOOR, but I just followed the link and it's not listed, so someone with Tor should check this one. Calvin 1998 (t-c) 17:15, 20 April 2008 (UTC)

|| User:160.36.249.159 (Special:Contributions/160.36.249.159 | Special:Blockip/160.36.249.159) is listed on the sectoor (TOR) list (http://www.sectoor.de/tor.php?ip=160.36.249.159) for the following types of proxies which I checked when they vandalized Montreal Canadiens:. ClueBot (talk) 20:57, 19 April 2008 (UTC)
 * ClueBot IV (talk) 21:04, 19 April 2008 (UTC)
 * - ClueBot checked SECTOOR, but I just followed the link and it's not listed, so someone with Tor should check this one. Calvin 1998 (t-c) 17:15, 20 April 2008 (UTC)

|| User:92.232.228.56 (Special:Contributions/92.232.228.56 | Special:Blockip/92.232.228.56) is listed on the sectoor (TOR) list (http://www.sectoor.de/tor.php?ip=92.232.228.56) for the following types of proxies which I checked when they vandalized Avram Grant:. ClueBot (talk) 13:38, 19 April 2008 (UTC)
 * ClueBot IV (talk) 13:43, 19 April 2008 (UTC)
 * - TOR checks come up negative. Needs further testing. Calvin 1998 (t-c) 18:16, 19 April 2008 (UTC)
 * Reposted after being archived by ClueBot IV. Calvin 1998 (t-c) 06:26, 21 April 2008 (UTC)

|| User:160.36.249.159 (Special:Contributions/160.36.249.159 | Special:Blockip/160.36.249.159) is listed on the sectoor (TOR) list (http://www.sectoor.de/tor.php?ip=160.36.249.159) for the following types of proxies which I checked when they vandalized Montreal Canadiens:. ClueBot (talk) 20:57, 19 April 2008 (UTC)
 * ClueBot IV (talk) 21:04, 19 April 2008 (UTC)
 * - ClueBot checked SECTOOR, but I just followed the link and it's not listed, so someone with Tor should check this one. Calvin 1998 (t-c) 17:15, 20 April 2008 (UTC)

|| User:84.142.72.30 (Special:Contributions/84.142.72.30 | Special:Blockip/84.142.72.30) is listed on the sectoor (TOR) list (http://www.sectoor.de/tor.php?ip=84.142.72.30) for the following types of proxies which I checked when they vandalized Beaune:. ClueBot (talk) 09:22, 15 April 2008 (UTC)
 * ClueBot IV (talk) 09:26, 15 April 2008 (UTC)
 * TOR check shows nothing, further investigation needed.  Soxred93 | talk bot 05:27, 21 April 2008 (UTC)

|| User:217.88.166.132 (Special:Contributions/217.88.166.132 | Special:Blockip/217.88.166.132) is listed on the sectoor (TOR) list (http://www.sectoor.de/tor.php?ip=217.88.166.132) for the following types of proxies which I checked when they vandalized KAT-TUN:. ClueBot (talk) 11:34, 21 April 2008 (UTC)


 * ClueBot IV (talk) 11:41, 21 April 2008 (UTC)
 * TOR check comes up negative, further investigation needed.  Soxred93 | talk bot 15:14, 21 April 2008 (UTC)

|| User:85.216.5.136 (Special:Contributions/85.216.5.136 | Special:Blockip/85.216.5.136) is listed on the AHBL (TOR) list (http://www.ahbl.org/tools/lookup.php?ip=85.216.5.136) for the following types of proxies which I checked when they vandalized Vehicle registration plates of New Jersey: Tor exit server. ClueBot (talk) 19:26, 20 April 2008 (UTC)
 * ClueBot IV (talk) 19:42, 20 April 2008 (UTC)
 * - Was Tor when it was reported and ClueBot IV checked. Not Tor when I checked, though. Calvin 1998 (t-c) 03:23, 23 April 2008 (UTC)

|| User:85.216.5.136 (Special:Contributions/85.216.5.136 | Special:Blockip/85.216.5.136) is listed on the AHBL (TOR) list (http://www.ahbl.org/tools/lookup.php?ip=85.216.5.136) for the following types of proxies which I checked when they vandalized Vehicle registration plates of New Jersey: Tor exit server. ClueBot (talk) 19:26, 20 April 2008 (UTC)
 * ClueBot IV (talk) 19:42, 20 April 2008 (UTC)
 * - Was Tor when it was reported and ClueBot IV checked. Not Tor when I checked, though. Calvin 1998 (t-c) 03:23, 23 April 2008 (UTC)

|| Used by ref desk spammer. Seraphim&hearts; Whipp  15:35, 22 June 2008 (UTC)


 * ClueBot IV (talk) 15:45, 22 June 2008 (UTC)
 * The refdesk spammer uses open proxies, and this was one. It's an exit IP which appears to change every day or two within a small range - currently exits on 203.162.3.159, entry at 203.162.163.78:80 and 203.162.163.80:80. Probably worth blocking for a month or three but likely to cause collateral. -- zzuuzz (talk) 15:52, 22 June 2008 (UTC)

|| See Administrators' noticeboard/Incidents. Orlady (talk) 04:48, 21 May 2008 (UTC)
 * ClueBot IV (talk) 05:27, 21 May 2008 (UTC)
 * , was an open proxy, seems to be down now. -- zzuuzz (talk) 11:40, 22 June 2008 (UTC)

|| See Administrators' noticeboard/Incidents. Orlady (talk) 04:48, 21 May 2008 (UTC)
 * ClueBot IV (talk) 05:27, 21 May 2008 (UTC)
 * , was an open proxy, seems to be down now. -- zzuuzz (talk) 11:40, 22 June 2008 (UTC)

|| See Administrators' noticeboard/Incidents. Orlady (talk) 04:48, 21 May 2008 (UTC)
 * ClueBot IV (talk) 05:27, 21 May 2008 (UTC)
 * , was an open proxy exit, dynamic IP, seems to be down now. -- zzuuzz (talk) 11:40, 22 June 2008 (UTC)

|| See Administrators' noticeboard/Incidents. Orlady (talk) 04:48, 21 May 2008 (UTC)
 * ClueBot IV (talk) 05:27, 21 May 2008 (UTC)
 * , was an open proxy, seems to be down now. -- zzuuzz (talk) 11:40, 22 June 2008 (UTC)

|| I found the following types of open proxies on User:201.11.157.84 (Special:Contributions/201.11.157.84 | Special:Blockip/201.11.157.84) which I checked when they vandalized Sigma Chi: HTTPGET. ClueBot (talk) 22:32, 20 May 2008 (UTC)
 * ClueBot IV (talk) 22:38, 20 May 2008 (UTC)
 * port 3128 was an open proxy, seems to be down now. -- zzuuzz (talk) 11:40, 22 June 2008 (UTC)

|| I found the following types of open proxies on User:189.17.195.243 (Special:Contributions/189.17.195.243 | Special:Blockip/189.17.195.243) which I checked when they vandalized Tim Tebow: HTTPGET. ClueBot (talk) 20:41, 20 May 2008 (UTC)
 * ClueBot IV (talk) 22:04, 20 May 2008 (UTC)
 * , was an open proxy, seems to be down now. -- zzuuzz (talk) 11:40, 22 June 2008 (UTC)

|| I found the following types of open proxies on User:125.243.237.2 (Special:Contributions/125.243.237.2 | Special:Blockip/125.243.237.2) which I checked when they vandalized The Legend of Zelda: Majora's Mask: HTTPPOST. ClueBot (talk) 20:40, 20 May 2008 (UTC)
 * ClueBot IV (talk) 22:04, 20 May 2008 (UTC)
 * port 8080 was an open proxy, seems to be down now. -- zzuuzz (talk) 11:40, 22 June 2008 (UTC)

|| SPA commenter at Articles for deletion/New Rochelle (Zip-Code Areas), New York. See Administrators' noticeboard/Incidents. Orlady (talk) 04:53, 21 May 2008 (UTC)
 * ClueBot IV (talk) 05:35, 21 May 2008 (UTC)
 * I ran a portscan myself, and http port 8080 seems to be open.

8080/tcp open   http-proxy I then attempted connecting through it in Firefox, but it seems to be down. Can someone investigate? Calvin 1998 (t-c) 06:12, 21 May 2008 (UTC)
 * -- zzuuzz (talk) 11:33, 23 June 2008 (UTC)

|| See Administrators' noticeboard/Incidents. Orlady (talk) 04:48, 21 May 2008 (UTC)
 * ClueBot IV (talk) 05:27, 21 May 2008 (UTC)

I looked at the links in the scan report, and I see that this IP is listed on at least 3 blacklist sites: NAJBL, NoMoreFunn, and spamhaus.org (XBL). Does that situation have any relationship to the apparent ability of a North American user to use this Chinese IP? Orlady (talk) 16:25, 21 May 2008 (UTC)
 * Though I know little about open proxies, the 2,710 Google results for this address, plus the mentions of spam, suggest some notoriety. EdJohnston (talk) 18:17, 21 May 2008 (UTC)
 * Nmap shows it's open HTTP port 80, but I tried to connect to the Internet via this IP and I get a blocked message in Chinese. I don't think this proxy works... Calvin 1998 (t-c) 21:30, 21 May 2008 (UTC)
 * was an open proxy port 8080, seems to be down now. -- zzuuzz (talk) 11:33, 23 June 2008 (UTC)

|| See Administrators' noticeboard/Incidents. Orlady (talk) 04:48, 21 May 2008 (UTC)
 * ClueBot IV (talk) 05:27, 21 May 2008 (UTC)

The first link in the scan report, NJABL, indicates that this IP is listed as an open proxy. Does that have any relevance to Wikipedia's determination? Orlady (talk) 16:30, 21 May 2008 (UTC)
 * A Nmap returns all ports "filtered", but I get a timeout error when attempting to use HTTP port 80 on this IP. Someone else check this one. Calvin 1998 (t-c) 21:30, 21 May 2008 (UTC)
 * , no ports open, looks like an exit IP for an open proxy. -- zzuuzz (talk) 11:33, 23 June 2008 (UTC)

|| See Administrators' noticeboard/Incidents. Orlady (talk) 04:48, 21 May 2008 (UTC)
 * ClueBot IV (talk) 05:27, 21 May 2008 (UTC)
 * Same result as above. Calvin 1998 (t-c) 21:30, 21 May 2008 (UTC)
 * , no ports open, looks like an exit IP for an open proxy. -- zzuuzz (talk) 11:33, 23 June 2008 (UTC)

|| Blocked 2 weeks for disruptive editing, should be checked as proxy given who we suspect this is GRBerry 21:28, 6 August 2008 (UTC)
 * ClueBot IV (talk) 21:41, 6 August 2008 (UTC)
 * At first, I thought it was from one of these sites, but they lead to a different IP. Spellcast (talk) 15:17, 11 August 2008 (UTC)
 * I tried to do a nmap scan on this but the ports were filtered so I can't say this is an open proxy. -- 'Kanonkas' :  Talk  21:46, 12 August 2008 (UTC)
 * The same with me. PeterSymonds (talk)  08:44, 17 August 2008 (UTC)

|| Port 80? --Oxymoron83 08:45, 13 December 2008 (UTC)
 * I can connect, but it's not sending any pages through. X clamation point  20:21, 13 December 2008 (UTC)

|| Port 80? --Oxymoron83 08:45, 13 December 2008 (UTC)
 * Formerly an open proxy, but it is refusing connections now. 209.222.133.187/28 is a whole range of proxies, but they al are resuzing connections. X clamation point  22:58, 15 December 2008 (UTC)

|| Port 80? --Oxymoron83 08:45, 13 December 2008 (UTC)
 * Formerly an open proxy, but it is refusing connections now. X clamation point  22:58, 15 December 2008 (UTC)

|| Over the last year, I've noticed that I warn an inordinate amount of one time anon users for vandalism from IPs belonging to the "Province of British Columbia".this edit suggests that is because they are open proxies. T L Miles (talk) 20:58, 21 April 2009 (UTC)
 * Only thing open was an Apple VNC port, somebody might test that. Q  T C 01:05, 22 April 2009 (UTC)
 * . No HTTP proxy and the edit doesn't match an open VNC either. These are usually school IPs btw. -- zzuuzz (talk) 10:35, 28 April 2009 (UTC)