Wikipedia:WikiProject on open proxies/Requests/Archives/19

66.102.6.164


Reason: Suspicious edits Sudden spate of vandalism - short block for that. On checking http://whatismyipaddress.com/ip/66.102.6.164 - says "Suspected proxy server" Ron h jones (Talk) 01:41, 1 January 2015 (UTC)
 * Hard-blocked 66.102.0.0/20 as Google proxy. This page, for example, explains how to user Google services as open proxies. This IP range in particular has been abused in the last few months. Materialscientist (talk) 02:12, 1 January 2015 (UTC)

46.20.37.133


webproxy.yt

Reason: Suspicious edits. Likely using a German proxy for sockpuppetry by a recently blocked user. See contributions at Faithful Word Baptist Church. Than k you.- MrX 22:47, 2 January 2015 (UTC)
 * Blocked, thanks. Materialscientist (talk) 22:52, 2 January 2015 (UTC)

204.93.60.60


Reason: Anonymous proxy per https://www.robtex.com/en/advisory/ip/204/93/60/60/, used here JoeSperrazza (talk) 20:40, 3 January 2015 (UTC)
 * -- zzuuzz (talk) 18:01, 24 January 2015 (UTC)

204.93.60.53


Reason: Anonymous proxy per https://www.robtex.com/en/advisory/ip/204/93/60/53/, used here JoeSperrazza (talk) 20:45, 3 January 2015 (UTC)
 * -- zzuuzz (talk) 18:01, 24 January 2015 (UTC)

15.203.169.105


Reason: Suspicious edits

Bad faith editing on Reformed Presbyterian Church of Scotland; I removed unhelpful content from this page twice (both added by Orange (UK) addresses from Scotland), and the last addition was by this Hewlett Packard address in Switzerland that http://whatismyipaddress.com/ip/15.203.169.105 says is a suspected proxy server. If it's not that, we've got a multinational group of trollers. Nyttend (talk) 15:15, 24 January 2015 (UTC)
 * Though this is a proxy it does not appear to be open. A work IP address, from anywhere in Europe, is likely. -- zzuuzz (talk) 18:06, 24 January 2015 (UTC)
 * zzuuzz, are you the proxy checker (i.e. I should withdraw this request), or are you just guessing, i.e. it should remain open for now? Nyttend (talk) 20:11, 24 January 2015 (UTC)
 * I should leave it open for now or a second opinion, as new revelations can turn up and no one can ever really confirm a proxy IP is closed. I am giving you an educated initial pointer in the meantime. Consider the IP unconfirmed and unblocked unless things change. -- zzuuzz (talk) 20:48, 24 January 2015 (UTC)
 * Okay, thank you. I don't remember previously making any reports here, so I wasn't sure how things worked.  Nyttend (talk) 22:31, 24 January 2015 (UTC)
 * I can find no evidence that it's an open proxy. No ports are open. The editor who uses the pseudonym "JamesBWatson" (talk) 15:40, 5 February 2015 (UTC)

Blocked user allegedly using 36.81.86.109--CU needed


User talk:Riskykurniawan claims to be using this IP address and that it is caught in an open proxy block, although it is not an open proxy. Could a checkuser a) confirm that he's using it and b) see if it's an open proxy? Thanks, Origamiteⓣⓒ 04:08, 26 January 2015 (UTC)

Reason: Requested unblock.
 * (it was one recently), unblocked. -- zzuuzz (talk) 19:58, 26 January 2015 (UTC)

162.119.231.132


Reason: Requested unblock. I understand the need for this process, but I think it is unnecessary at this time for this IP. Please see the user's talk page for details. Thank you. Lightbreather (talk) 18:37, 26 January 2015 (UTC)
 * . Despite the open ports, it doesn't seem to be open. Nor do any others in the range. -- zzuuzz (talk) 19:56, 26 January 2015 (UTC)
 * Can you double check your findings? I was just able to connect and download content through port 443 (HTTPS). Mike V • Talk 20:35, 26 January 2015 (UTC)
 * Yes, but it does not change your IP address to 162.119.231.132 ? -- zzuuzz (talk) 20:42, 26 January 2015 (UTC)
 * Closeing as stale. 443 is no longer open, and I couldn't connect to any of the other odd open ports. Kuru   (talk)  02:08, 31 May 2015 (UTC)

61.37.31.80


Reason: Suspicious edits in ja.wikipedia.org .--HotKorokke (talk) 11:39, 30 January 2015 (UTC)


 * There are several open ports, but I am unable to connect to any of them, and I can't find the IP address listed anywhere as an open proxy. The editor who uses the pseudonym "JamesBWatson" (talk) 15:30, 5 February 2015 (UTC)


 * Also, the IP address geolocates to South Korea, and all the anon edits from the IP address are to either ja.wikipedia or ko.wikipedia. Open proxies commonly get used by people in different parts of the world from where the proxies are situated. That encourages me to think it less likely that it's an open proxy. The editor who uses the pseudonym "JamesBWatson" (talk) 15:34, 5 February 2015 (UTC)

162.119.240.70


Requesting unblock here. Origamiteⓣⓒ 13:50, 30 January 2015 (UTC)

Reason: Requested unblock.
 * Not a proxy, leaving a note to the blocking admin. Materialscientist (talk) 23:36, 30 January 2015 (UTC)
 * Unblocked. Materialscientist (talk) 21:33, 31 January 2015 (UTC)

182.18.177.170


Reason: This IP belongs to Data Center India, a cloud hosting company. PCHS-NJROTC (Messages) 17:33, 31 January 2015 (UTC)
 * Stale; can't connect to the three suspicious open ports. Kuru   (talk)  02:15, 31 May 2015 (UTC)

103.7.250.251


Reason: Unblock request at User talk:Nahiyan8 - user states that their IP is no longer open. ​—DoRD (talk)​ 17:41, 13 February 2015 (UTC)
 * Completed by User:Kuru. Thank you. Proof: User talk:Nahiyan8– Nahiyan8 (talk | contribs) 17:22, 14 February 2015 (UTC)

Geoproxy
This is a long list of open proxies that can be used on the Geoproxy plugin on Chrome. (I have not checked if they were blocked or not. It takes 3 mins just to open the sandbox.) Albania
 * 8080
 * 8080

Argentina
 * 8080
 * 8080
 * 8080
 * 8080
 * 8080
 * 8080
 * 3128

Hong Kong
 * 3128
 * 3128
 * 3128
 * 8080
 * 3128
 * 3128
 * 3128
 * 3128
 * 44338
 * 3128

Great Britain
 * 3128
 * 8080
 * 3128
 * 80
 * 3128
 * 3128
 * 3128
 * 80
 * 8080
 * 3129

The USA
 * 3128
 * 3128
 * 3128
 * 3128
 * 8080
 * 80
 * 3128
 * 3128

South Korea
 * 8080
 * 3128
 * 3128

Australia
 * 8080

Brazil
 * 3128
 * 3128
 * 3128
 * 3128
 * 3128
 * 8080
 * 8080
 * 8080
 * 3128
 * 80

China
 * 80
 * 80
 * 80
 * 80
 * 80
 * 80
 * 80
 * 80
 * 80
 * 8090

Singapore
 * 3128

Sigh.... Clubjustin3 (talk) 03:40, 18 February 2015 (UTC)
 * Most of them were already blocked by the proxy bot, and I've blocked the rest. Materialscientist (talk) 03:54, 18 February 2015 (UTC)


 * Thx, 'cause i was in a (sort of) hurry when I posted this. Clubjustin3 (talk) 09:29, 18 February 2015 (UTC)

More geoproxy
Same reason as above


 * 80
 * 8080
 * 8080
 * 3128
 * 3128
 * 8080
 * 8080
 * 8080
 * 8080
 * 3128
 * 8080
 * 8089
 * 8080
 * 8080
 * 8080
 * 80
 * 8080
 * 8080


 * Just clicking on the "current blocks" links above shows whether they are blocked or not. All but one were blocked, and I have blocked that one. The editor who uses the pseudonym "JamesBWatson" (talk) 15:09, 24 February 2015 (UTC)

197.85.132.8


Reason: Requested unblock for. PhilKnight (talk) 18:15, 20 February 2015 (UTC)


 * I am unable to connect to the proxy. Online searches indicate that the IP address was once used for dubious purposes, but I can find no evidence anywhere of recent abuse. For example, Project Honey Pot has not detected suspicious activity for over 11 months. I am therefore inclined to unblock, But I shall wait a while for anyone else to comment. The editor who uses the pseudonym "JamesBWatson" (talk) 16:07, 23 February 2015 (UTC)


 * I have checked again, and can still find no evidence that this IP address is currently hosting an open proxy, and a CheckUser has failed to find any problems, so I have unblocked the IP address. For the moment, however, I will leave this request open, in case anyone else has any evidence that I haven't seen, meaning that the block should be restored. The editor who uses the pseudonym "JamesBWatson" (talk) 14:57, 24 February 2015 (UTC)


 * I have checked again, and can still find no evidence that this IP address is currently hosting an open proxy, so I am closing this case. The editor who uses the pseudonym "JamesBWatson" (talk) 14:19, 2 March 2015 (UTC)

59.120.0.127


Reason: Suspicious edits


 * This IP adress has been blocked before, but seem to be editing pages again. It deletes original sources and replace them with other links, probably for spam-purposes.--Securitymarket (talk) 21:57, 25 February 2015 (UTC)


 * Blocked by EdJohnston for 2 years. The editor who uses the pseudonym "JamesBWatson" (talk) 14:21, 2 March 2015 (UTC)

67.220.22.228


Reason: Requested unblock.
 * Unblock requested by User talk:602p. IP blocked for two months by ProcseeBot on 15 February. This IP was advertised on some proxy lists on the web as recently as 15 February, with an open port on 3128, but when I tried to activate it just now it didn't work. User says he has fixed his firewall problem. EdJohnston (talk) 21:22, 26 February 2015 (UTC)
 * The port at 3128 is no longer open, but 1723 is now open. However, repeated attempts to connect to that port have failed, and I have not found the IP address on any proxy lists since 21 February, and all the listings I have seen have been for the now-closed port 3128, so I shall unblock the IP address. The editor who uses the pseudonym "JamesBWatson" (talk) 14:31, 2 March 2015 (UTC)

2607:FF48:1:301:0:0:5C1B:BFCE


Reason: Suspicious edits in ja.wikipedia.org .--HotKorokke (talk) 23:24, 28 February 2015 (UTC)
 * Very likely (see their edit). Blocked. Materialscientist (talk) 12:36, 5 March 2015 (UTC)

Various IPs


See the admin-only spam-blacklist hitlist - a couple of days already we have a continuous list of hits on the blacklist due to attempts to add blacklisted domains. I will make a permanent record on meta shortly.

This morning I started to hand-out 1-week blocks (to give people time to find a more permanent solution), please reblock them appropriately (globally??!!??). Note, that I may extend this list when they move again to other IPs during the day. --Dirk Beetstra T C 04:43, 9 February 2015 (UTC)
 * Nothing on 5.164.192.80, 5.164.195.56, 5.166.206.214, 27.150.228.6, 46.151.55.4, 58.23.18.178, 58.23.233.86, 120.33.220.135, or 223.240.136.18
 * 27.150.239.206 (10566, 49158), 58.23.232.2 (1154, 1721, 5120) have a few closed ports, can't connect.
 * 46.235.44.156 is a hot mess. 29 open ports, many of them look like mail routers (smtp, pop, imap). This is a part of WebReus, a dutch webhost and is already in a 3 year block as such.
 * 223.240.128.58 has a number of open and filtered ports, but the only explicit http proxy (8080) has a password prompt. Kuru   (talk)  13:09, 20 June 2015 (UTC)

Another spammer


See the admin-only spam-blacklist hitlist, seems unrelated to above system (this is a viagra spammer). --Dirk Beetstra T C 04:52, 9 February 2015 (UTC)
 * No comment on the proxy status but this IP was actively spamming on 2 March. I've blocked for three months. EdJohnston (talk) 15:17, 2 March 2015 (UTC)
 * . Can't connect to the only open port. On a few blacklists, but nothing else found. Kuru   (talk)  14:16, 31 May 2015 (UTC)

69.63.114.3


Reason: Requested unblock, due to the fact that the CBCSD has now enforced auth on it's proxy.



Reason: Requested unblock. PhilKnight (talk) 15:55, 5 March 2015 (UTC)


 * This IP address certainly did host an open proxy in the past. At present there are no open ports, but since many open proxies sporadically come on and off line, that is no proof. If there is still no evidence of an open proxy after a day or so, I shall be willing to change the block to anon-only, which will allow logged-in accounts to edit, but in my opinion there is no case for completely unblocking, because apart from a few edits to this page in connection with the block, the edits from this IP address have been 100% vandalism (as is often the way with school IP addresses). If anyone knows any reason why I should not lift the blcok on logged-in editing, please let me know. The editor who uses the pseudonym "JamesBWatson" (talk) 14:48, 6 March 2015 (UTC)


 * Since I wrote the above message, I have found that the IP address has been the source of spam up to less than three weeks ago. That makes me somewhat less willing to lift the block, and I am inclined to wait for more than just a few days before considering doing so. The editor who uses the pseudonym "JamesBWatson" (talk) 15:05, 6 March 2015 (UTC)


 * . Obvious and easy proxy on 3128. Someone is clearly playing games; I've hard blocked. Kuru   (talk)  14:30, 31 May 2015 (UTC)

62.212.85.119


Reason: Requested unblock. PhilKnight (talk) 19:28, 8 March 2015 (UTC)

The IP address is assigned to "LeaseWeb B.V." and its hostname is "hosted-by.leaseweb.com". That looks to me pretty much like an indication that it is a web host, despite the denial by the person making the unblock request. The editor who uses the pseudonym "JamesBWatson" (talk) 17:28, 9 March 2015 (UTC)
 * There are several http proxies that are identifying as Cactus VPN exit nodes; a $1 a month "anonymizer". I've blocked this IP directly.  Kuru   (talk)  14:50, 31 May 2015 (UTC)

CyberGhost proxies



 * 109.236.87.xx
 * 109.236.90.xx
 * 161.202.76.xx
 * 162.244.81.xx
 * 168.1.69.xx
 * 169.57.1.xx
 * 176.10.98.xx
 * 176.116.153.xx
 * 185.8.107.xx
 * 194.187.250.xx
 * 194.187.251.xx
 * 199.195.199.xx
 * 199.231.208.xx
 * 209.58.130.xx
 * 212.232.25.xx
 * 217.23.12.xx
 * 217.23.5.xx
 * 217.23.7.xx
 * 69.46.6.xx
 * 77.243.181.xx
 * 77.243.189.xx
 * 79.141.160.xx
 * 79.141.162.xx
 * 79.141.164.xx
 * 79.141.165.xx
 * 79.141.166.xx
 * 79.141.167.xx
 * 79.141.170.xx
 * 79.141.172.xx
 * 79.141.173.xx
 * 82.103.129.xx
 * 82.103.130.xx
 * 82.103.140.xx
 * 82.103.142.xx
 * 82.221.102.xx
 * 84.19.169.xx
 * 85.9.20.xx
 * 91.135.65.xx
 * 93.190.138.xx
 * 93.190.139.xx
 * 95.141.20.xx
 * 95.141.27.xx
 * 95.141.29.xx
 * 95.141.31.xx

Reason: These are IPs that I found through the CyberGhost webhost application. Rangeblocks might be applicable for some cases. Sorry for the long list; I couldn't think of a better way to format it. Conifer (talk ) 02:31, 9 March 2015 (UTC)


 * I'm really not sure how to help. I spot checked a few of them; some IPs are clean, some have odd open ports, but I wasn't able to clearly identify a Cyberghost redirect in any of the 20 or so scans I did. It may be more helpful to tell me the actual IPs, so I don't have to pick from 256 in each scenario listed above. Maybe there's a way to automate the 11264 possible choices in your list, but I'm not that technically gifted anymore.  Kuru   (talk)  13:37, 20 June 2015 (UTC)

94.249.128.0


Reason: Requested unblock for PhilKnight (talk) 20:44, 14 March 2015 (UTC).
 * Why not asking the blocking admin? Materialscientist (talk) 22:15, 14 March 2015 (UTC)


 * - could you comment on this block? PhilKnight (talk) 22:05, 18 March 2015 (UTC)
 * Closing this with no further action. While I don't see anything odd with this specific IP, there are clearly problems with the range. It is now rangeblocked both locally and globally. I applied IP exemption to the user requesting an unblock a while back, but they have not edited since then.  Kuru   (talk)  14:59, 31 May 2015 (UTC)

92.36.165.127


Origamiteⓣⓒ 02:28, 15 March 2015 (UTC)

Reason: Requested unblock.
 * Decline. This is a checkuser block, and the unblock request comes from the person who was targeted by the block. Materialscientist (talk) 02:42, 15 March 2015 (UTC)
 * If this is a checkuser block, then why is the reason blocked proxy, not checkuserblock?עוד מישהו Od Mishehu 13:17, 15 March 2015 (UTC)
 * Because it is both a proxy block and a checkuserblock :-D. Materialscientist (talk) 23:21, 15 March 2015 (UTC)

213.55.89.14


Reason: See https://www.robtex.com/en/advisory/ip/213/55/89/14/ - blacklists. Used for vandalization (reported at WP:AIV. JoeSperrazza (talk) 01:20, 28 March 2015 (UTC)
 * I can't seem to confirm that there is a proxy here. While it does show up on several blacklists, some of them are range based. The only odd port is 113, which is closed and I can't connect to it. Kuru   (talk)  00:55, 2 June 2015 (UTC)