Reason: Requested unblock. Multiple requests to the unblock-en mailing list from the IP range. Seems that Singaporean ISP maybe putting customers through a local proxy, rather than open proxies. Spoke with admin placing block and their memory of the specifics of the incident are now vague beyond a check was run. Thanks . —billinghurstsDrewth01:38, 8 January 2012 (UTC)
I'm on my way out of town, but I looked into this briefly. It looks like a closed proxy or web-accelerator type service for the customers of that ISP. It was also a ridiculously active range for a /26 (actually, thisapparently came up before and the entire /22 is ridiculously active....). I vaguely remember seeing this exact range before myself, but can't find where I intersected with it..... I recommend unblocking, but someone else should look at this who can do a more thorough check.Sailsbystars (talk)03:22, 8 January 2012 (UTC)
I will unblock it, and we can continue testing, if it is problematic we can just reapply, that is nothing new. Yet more mail from the IP range. —billinghurstsDrewth13:10, 9 January 2012 (UTC)
This has been blocked for a year, have a request to unblock-en, can we please check the range to determine whether it still is problematic. Thanks —billinghurstsDrewth02:48, 15 January 2012 (UTC)Reason: Requested unblock.
Errr... this looks like an anonymising programto me. And is coming from a colocation provider which no one has to edit from. The unblock request had better be more specific than "unblock please." The program is free to download and specifically hides IPs, and jumps around a lot in the range. I don't see why the block shouldn't be extended, recent proxy like actions as of Dec. 6 2011. Any unblock request should contain specific reference to why they have to edit from that IP range..... A second opinion is welcome of course....Sailsbystars (talk)14:16, 15 January 2012 (UTC)
I have to agree, I know this companies proxy pretty well, and they stick around for a long time, but in interest of compromise, 2 years sounds fine. Also Spellcast knows what he's doing and catches all those IPs. --DQ (ʞlɐʇ)11:06, 21 January 2012 (UTC)
195.189.142.176
– This proxy check request isclosed and will soon be archived by a bot.
Blocked 4+ years ago, time to review following email to unblock-en1 October 2007 Ryulong (talk | contribs | block) blocked 195.189.142.176 (talk) (account creation blocked) with an expiry time of indefinite ({{blocked proxy}}: Opera Mini Demo interface) (unblock | change block) Reason: Check for ongoing validity. Thx —billinghurstsDrewth13:24, 17 January 2012 (UTC)
Inconclusive This one is complicated. I tried the opera mini demo interface and sure enough it works nice and open proxy like. However, I came out as82.145.208.189(talk·contribs·IP contribs·WHOIS). It's possible that opera has shifted around their IPs such that the demo interface uses. Or alternately, the demo interface dynamically choose random opera IPs, just like the real browser. On the one hand, opera mini IPs are pretty similar to any cell provider, which we generally don't long term block. On the other hand, the demo interface allows people to access it from their full computers. I lean towards unblocking.Sailsbystars (talk)01:13, 18 January 2012 (UTC)
Inconclusive also, and agree with the above assessment, therefore unblocked. Though I didYou have not given a value for the mandatory first parameter! Possible parameters are:{{proxycheck| …|complete,|confirmed,|likely,|unlikely,|possible,|blocked,|inconclusive,|notaproxy, and|decline. that it generates random IPs, so i've blocked the /20 and we'll try later to see if this one comes back. --DQ (ʞlɐʇ)10:10, 21 January 2012 (UTC)
216.17.107.51
– This proxy check request isclosed and will soon be archived by a bot.
There is an unblock request atUser talk:216.17.107.51. There are, in fact, two range blocks affecting that IP address, one is a checkuser block, which I have referred to the blocking checkuser/admin. The other is a proxy block, and I would be grateful if someone could check it. The user says "this ip is not an open proxy and is only used by me." The block log entry is 07:07, 15 June 2007 Ryulong blocked 216.17.104.0/21 (talk) (account creation blocked) with an expiry time of indefinite ({{blocked proxy}}).JamesBWatson (talk)11:38, 20 January 2012 (UTC)
Reason: Requested unblock.
I've lifted the one, this is probably a different person than the one who caused the block. Range was exclusively used by one persistent troublemaker in the past three months, but it's not important enough ATM if it causes collateral damage. I have also lifted the proxy block: I'd be surprised if the whole /21 was ever used exclusively by open proxies, and it's been 4.5 years since it's been set anyway.Amalthea 18:41, 20 January 2012 (UTC)Note this was copied from a TP after the below cmt. --DQ (ʞlɐʇ) 15:35, 23 January 2012 (UTC)— Sorry, I thought it would help to give your reply context. ;)Amalthea15:58, 23 January 2012 (UTC)
I have to disagree with Amalthea's assesment, because it looks like we have a webhost here on the /21. Not that this IP contains proxies, but it does contain sites like [searchengineadult.com this one]. Can I have someone double check me just to make sure i'm not just being tired? --DQ (ʞlɐʇ)11:06, 21 January 2012 (UTC)
Ah, well then, feel free to re-block the /20 for whichever duration is appropriate. Do we have a guideline page on that? I can't quite get that aligned with my understanding ofWP:BLOCK#PREVENTATIVE …Amalthea15:58, 23 January 2012 (UTC)
I don't know where your getting the /20 from, but that would cause some collateral damage when we can hit some smaller ranges including to a group of sprint customers (it's just the first name I recognized off the list. 216.17.100.0/22 and 216.17.104.0/21 blocked for a year. As for a guideline,WP:PROXY covers this as an anonymous proxy, and so doesthe blocking policy, but they should get an update with some more detailed info on why we block them. It's primarily because there is no reason for webhosts to be editing. They aren't individuals, and usually are trying to evade a block when doing so. (I've seen too many examples of this) So we always hardblock the ranges. --DQ (ʞlɐʇ)17:25, 23 January 2012 (UTC)
I'm getting 216.17.96.0/20 from the whois record ([1]). The whole range is assigned to a1colo.com aka amerinoc.com. Where are you getting the 216.17.104.0/21 from? And it's in my opinion quite a leap to call any closed webserver anAnonymizer. I can get on board saying that end-users are very unlikely to use it for normal editing, but like I said, I wouldn't call it "imminent or continuing damage and disruption". If there is disruption from one, we can handle them like any other static IP.Amalthea18:31, 23 January 2012 (UTC)
Sorry for the delay in response, the /21 is from the Robtex link above, which I personally tend to find the most accurate, but that's me. As far as Webhosts being blocked, i'll take that to the talkpage. --DQ (ʞlɐʇ)20:41, 25 January 2012 (UTC)
202.156.10.9
– This proxy check request isclosed and will soon be archived by a bot.
If we could at least check and rule out open proxy (as history previously as open proxy, though not currently labelled that way, just problematic), then we can modify how we handle requests from this IP. Reason: Check only at this stage. Thanks. —billinghurstsDrewth01:37, 22 January 2012 (UTC)
UnlikelyIP is an open proxy I have to agree with hash.es on this one and say it's been down for a good while, but maybe it should go without the account creation flag? To allow legit users? --DQ (ʞlɐʇ)07:24, 23 January 2012 (UTC)
My understanding of XFF is not that strong, but we actually don't put our trust in the cite you list above as it's been known to have incorrect information. Does MaxOnline/Starhub do XFF for us? --DQ (ʞlɐʇ)17:40, 23 January 2012 (UTC)
I'm not asking you to put trust in any site, I'm using it since it is convenient summary of the situation as I see it. I'll be more verbose: Reverse-lookup of 202.156.10.9 produces 202.156.10.9.cache.maxonline.com.sg. This IP gives every indication to be an ISP proxy; among other signs, requests through it are sending XFF headers. I know thatVoA added MaxOnline/StarHub Cable Vision to the list of XFF-trusted ISPs atmeta:XFF project, and thata proxy of that ISP (IP 218.186.9.1, reverse-lookup 218-186-9-1.cache.maxonline.com.sg) is listed onhttp://www.wikimedia.org/trusted-xff.html; I don't know the process for selecting those trusted proxies, but I assume that 202.156.10.9 can be added there as well, so I wrote a mail to the address noted onmeta:XFF project suggesting to add it.Amalthea18:14, 23 January 2012 (UTC)
I wasn't trying to indicate that you were asking me to put my trust in that site. And thanks for the clarification on that, I now have some new bookmarks :) --DQ (ʞlɐʇ)20:43, 25 January 2012 (UTC)
Sorry that I was thinking you were trying to indicate that I was asking you to trust in that site. ;) And you are right of course that whatismyipaddress.com is not always correct or up to date; for me it has always been a good starting point -- no more, no less. You should update that one new bookmark by the way, the site I linked to isn't actually kept in synch with the repository; current list in MediaWiki trunk ishere, current wmf branch is probablythis one. Tim Starling added this IP yesterday, so I guess this block can be lifted, but should never see edits.Amalthea15:50, 26 January 2012 (UTC)
We actually don't put our faith in the site you source, it's frequently unreliable. I'm not seeing anything from my end right now to indicate a proxy, but I don't fully trust all the checks i'm running right now because of the location i'm in. I'll give it another check later. --DQ (ʞlɐʇ)17:37, 23 January 2012 (UTC)
Interesting, I'm now getting stuff since changing locations. Though withthis requested login, I think were dealing with a closed proxy unless a default password is in place, but would like someone to triple for me to be sure. --DQ (ʞlɐʇ)21:13, 25 January 2012 (UTC)
Reason: Suspicious edits. I used the tor check tool which seemed to indicate that it was a tor node that exited to wikipedia, but figured it was worth reporting. Currently is blocked for 3 months, email and talkpage blocked since it was being abusively abusive, abusively.Syrthiss (talk)18:47, 24 January 2012 (UTC)
FromUser_talk:64.76.75.58: "This is not really an open proxy. It's a transparent proxy for the customers of IFotoncorp (ifotoncorp.com), a small (as in <200 customers) ISP in the Galapagos islands."
Reason: Requested unblock.
Admin comment - I found this through Unblock Requests, although the IP block is not active. I can't figure out what is going on, but I'm sure a tech wizard here might sort it out. Apologies if this is time-wasting.Manning (talk)11:14, 29 January 2012 (UTC)
User:Mbethke posted that unblock request, and he currently has an unblock request on his talkpage. Took the liberty of looking, and I have to sayInconclusive because I was getting some kind of response on the HTTP side of things, to the point where I had a supposed certificate for (something).example.com but it timed out on the connection, so I'm not sure. --DQ (ʞlɐʇ)15:03, 29 January 2012 (UTC)
LikelyIP is an open proxy Hash.es gives some interesting info. The proxy is likely around, just not right now... so asking for a hold/2nd opinion here. Also note something funny when I try to web address it on 8080. --DQ (ʞlɐʇ)01:42, 2 February 2012 (UTC)
Definitely an ISP proxy, though it would appear to require authentication... user seems to have a non-disruptive history, maybe IP block exemption? I definitely would not recommend unblocking this one. —madman19:50, 4 February 2012 (UTC)
I am able to use 116.66.194.33:8080 as an open proxy, which terminates at 110.34.4.242:
Thanks, Crazycomputers. I wasn't able to connect through the 116 address the other day, but since it appears to be back, I have declined the unblock request. I'm willing to grant an IPBE if the user agrees not to misuse it and it'll be removed later, etc. Watching user talk page. —madman14:32, 6 February 2012 (UTC)
I wonder if it's perhaps an infected computer? Maybe when they shut down their box at night that's why we can't reach the proxy. :) --Chris(talk)17:15, 6 February 2012 (UTC)
Thinking about it, that's almost certainly the case and explains why the connection terminates at the ISP proxy's address. —madman19:27, 6 February 2012 (UTC)
96.44.163.76
– This proxy check request isclosed and will soon be archived by a bot.
I am aUser:Ramaksoud2000 and I'm reporting this proxy myself from this proxy because it is a tor exit relay. I'll be signing here as Ramaksoud2000 shortly to confirm but this is a tor exit relay and should be blocked.
I have confirmed that this is a tor exit node opening to Wikipedia. I have blocked the IP address for 6 months, and am marking this report as checked. Please let me know if anyone more experienced in these matters think this was not the right way to handle this.JamesBWatson (talk)13:17, 3 February 2012 (UTC)
Sorry, I don't remember anything behind the circumstances of this block. Anyone is free to overturn it if they don't think that this is an open proxy.NW(Talk)18:45, 5 February 2012 (UTC)
Per the talk page, it looks like this may have been americanproxy.org at one point, but that site appears to be defunct. I'm going to take a while to search this range just to make sure. —madman03:46, 6 February 2012 (UTC)
After an nmap of this range and a run of my proxy checking script over the open ports, nothing turned up. There was one host that accepted proxy requests, but replied to every request with 302 Found and changed the scheme to https. Not sure what that's about, but it didn't actually do any proxying. --Chris(talk)22:23, 7 February 2012 (UTC)
Not currently an open proxy. The blocking administrator may have mistaken a shared IP address (which may be the case) with an open proxy. —madman04:18, 6 February 2012 (UTC)
This is St. John's College. "Open proxy" is just one line below "schoolblock" in the block popup list. This may also be a reason for IPs blocked indef instead of 3 hr :-D.Materialscientist (talk)04:25, 6 February 2012 (UTC)
I've changed the block to an{{anonblock}} then, as was probably intended. Account creation is still blocked, but the user may create an account and edit by following the instructions in the block message. —madman04:57, 6 February 2012 (UTC)
201.9.177.212
A user hasrequested a proxy check. A proxy checker will shortly look into the case.
UnlikelyIP is an open proxy. The IP appears to belong to a VPS. Port 8081 is open but does not appear to proxy anything. --Chris(talk)17:01, 7 February 2012 (UTC)
173.192.0.0/16 blocked by Zzuuzz, ({{blocked proxy}}: <!-- SoftLayer Technologies hosting range -->).
Reason: Requested unblock atUser talk:Speeddymon. The user says "The IP in question is the external endpoint IP for SoftLayer's corporate office network. No idea why they use a proxy, but I am reasonably sure that the single IP could be whitelisted without causing any further spamming since it is separate from the rest of the hosted customers.
If we forgo the proxy check for now and assume that the range is clear, the existing 173.192.0.0/16 block will have to expand into these blocks to exclude the 173.192.118.0/24 range:
173.192.0.0/18
173.192.64.0/19
173.192.96.0/20
173.192.112.0/22
173.192.116.0/23
173.192.119.0/24
173.192.120.0/21
173.192.128.0/17
So... should we consider doing that (more block maintenance, less collateral damage) or just go the IPBE route (easy fix, but may have to grant IPBE to more accounts later)? --Chris(talk)22:20, 7 February 2012 (UTC)
Not currently an open proxy. I was unable to find any open proxies in the 173.192.118.0/24 range. The remaining question now is how do we deal with the wider rangeblock. --Chris(talk)23:30, 7 February 2012 (UTC)
I've Googled the /16 range and here is what I've got: there are tons of web and http proxies in the range and some web proxies are below (verified). The 173.192.118.0/24 range seems clean, but there are some ghosts like freewebproxy.co, which was (is?) sitting in the 173.192.64.0/18 range. To sum up, the /16 range is rotten, but I have no direct evidence there is an active proxy in the particular 173.192.118.0/24 subrange. A possible compromise is "anonblock" on /16, i.e. release users who are already registered.Materialscientist (talk)11:38, 8 February 2012 (UTC)
I saw the statement on the list and according to the block logs I think those all should be 222 for the first octet. But looking into. --DQ (ʞlɐʇ)17:31, 23 January 2012 (UTC)
UnlikelyIP is an open proxy Right now i'm not seeing it for all 222s. There was one minor piece of evidence that was odd, but nothing to indicate anything I can go on. --DQ (ʞlɐʇ)21:08, 25 January 2012 (UTC)
Beetstra and XLinkBot are having a little battle with a morphing set of domains, and a few IP addresses. Needing to determine whether it is corrupted, open, owned. Have a series that belong to same case. There are more. however, this should give a good indication of whether it is open proxy abuse. Thanks. —billinghurstsDrewth03:45, 26 January 2012 (UTC)
Reason: Requested block.
Here is some info on your hosts:
68.190.12.40(talk·contribs·IP contribs·WHOIS) -PossibleIP is an open proxy -Charter Communications, normalISP - I can`t activate a proxy, but there is definitely something suspicious here that`s not normal for an ISP. Possible that a login is required, but I can`t even find that.
This looks like you've got someone who has access to multiple computers across the United States or a peer-to-peer network, but no open proxies to report as far as I see. --DQ (ʞlɐʇ)04:37, 26 January 2012 (UTC)
106.187.43.220
– This proxy check request isclosed and will soon be archived by a bot.
Reason: Requested an unblock. Claims the open proxy was a misconfiguration and has since closed the open squid on port 3128.--v/r -TP13:39, 29 January 2012 (UTC)
He's cleared up the proxy on 3128, but it doesn't explain why he's editing from a webhost. I'm going to unblock because it's not being used abusively as far as I can tell, but please do watch the source that this came from carefully. If it's from unblock-en-l, offer to create him an account. --DQ (ʞlɐʇ)15:12, 29 January 2012 (UTC)
50.22.226.81
– This proxy check request isclosed and will soon be archived by a bot.
Not currently an open proxy. Most ports were filtered by a firewall, but port 8080 was closed. This may indicate that a proxy was previously running, but I cannot verify that one is any longer. --Chris(talk)04:37, 8 February 2012 (UTC)
All these IP addresses are already rangeblocked since 2008/2010. Use "current blocks" link at the bottom of IP contribs page. —AlexSm20:06, 26 February 2012 (UTC)
Declinedto run a check – Indeed, they're all indefinitely blocked (and all but the last two are blocked globally). —madman22:25, 26 February 2012 (UTC)
85.194.127.10
– This proxy check request isclosed and will soon be archived by a bot.
Not currently an open proxy – Well, it is a proxy, but its policy does not permit access to enwiki (at least from my IP...). Therefore, I've unblocked, but the IP should be reblocked if there are indications it does permitopen access to enwiki from elsewhere (I'm assuming itdoes provide some access to the requester; otherwise, unblocking is not going to particularly help him/her. If not, he/she may have to discuss getting access to enwiki with his/her network administrator.) —madman22:37, 26 February 2012 (UTC)
217.64.30.8
– This proxy check request isclosed and will soon be archived by a bot.
Edit warrior from Azerbaijan who feels like spamming all kinds of comment sections and email spamming[3] or an open proxy. You decide!Hipocrite (talk)14:10, 2 March 2012 (UTC)
Reason: Suspicious edits
Looks like an open proxy, but I was only able to fetch Google's homepage before the proxy started lagging too much, so I cannot verify the exit point. I will keep trying. (This IP has been blocked as an open proxy before.) --Chris(talk)15:24, 2 March 2012 (UTC)
Reason: The account is currently blocked, but we have received no less than 9 clearly distinct unblock requests from the unblock mailinglist. This indicates there might be some proxy editing going on.Martijn Hoekstra (talk)13:48, 6 March 2012 (UTC)
Declinedto run a check. The block message is quite clear already; this is an ISP proxy that is used by many subscribers. --Chris(talk)15:21, 6 March 2012 (UTC)
Seems like it's indeed a closed proxy: hence my change of the block message. Note that the only change I made to to block is the messsage, not that I blocked the IP.Martijn Hoekstra (talk)19:02, 25 March 2012 (UTC)
61.18.170.84
– This proxy check request isclosed and will soon be archived by a bot.
Not currently an open proxy. The entry point cited in the block message is now returning 403 Forbidden errors for all proxy requests. Accordingly, I have unblocked this IP. --Chris(talk)12:44, 12 March 2012 (UTC)
173.245.64.124
– This proxy check request isclosed and will soon be archived by a bot.
Reason: Requested unblock atUser talk:61.18.170.68. Blocked at 06:33, 14 October 2011 by ProcseeBot. Block reason is {{blocked proxy}} <!-- 61.10.194.136:8909 -->. Unblock request reason is "Dynamic IP of the second largest ISP in Hong Kong. Not a proxy server." I have not been able to confirm that either 61.10.194.136 or 61.18.170.68 is currently a proxy, but would appreciate a check from someone more knowledgeable about proxies than me.JamesBWatson (talk)20:34, 13 March 2012 (UTC)
I am still working on this. The scan is going slower than I initially thought, since the stealth SYN scan is causing my router to reboot every hour or so when it exhausts kernel memory trying to maintain the TCP sessions table. :( --Chris(talk)15:23, 14 March 2012 (UTC)
My scan turned up nothing, so I thinkNot currently an open proxy. (Can't be 100% sure, but without positive proof...) --Chris(talk)02:37, 15 March 2012 (UTC)
I'll check myself if you'd like a second opinion; at the veryleast for administration I would say to treat this as a shared IP. Ihighly suspect that it is a zombie computer as it's a well-documented, major source of spam. —madman12:46, 15 March 2012 (UTC)
Newipnow.com
They updated their IP list. I have blocked the IPs themself but will have no time (and technical ability) to check for rangeblocks[4] for the next day or so (those IPs usually sit within hosting ranges). If you can, please check.Materialscientist (talk)22:48, 13 March 2012 (UTC)
which are also newipnow.com proxies. I see that Materialscientist has blocked all the IP addresses he/she has listed and also two more (184.107.58.144, 173.248.191.250), almost all for 6 months. I would think that longer blocks would be in order. (Other IPs from the same proxy server have been blocked for substantially longer. For example, 64.15.147.205 has been blocked by Zzuuzz for 5 years.) My inclination is to increase the block lengths, but I will wait to see if anyone else disagrees.JamesBWatson (talk)09:13, 14 March 2012 (UTC)
Longer blocks are normally issued for IP ranges, because the proxy IP might change over time - this is what you see in Zzuuzz's blocks; they also target a provider, not just one webportal like newipnow. In my experience, newipnow changes about a half of their proxy IPs (they offer a choice of a dozen) within about half a year, but a few IPs might stay longer.Materialscientist (talk)09:25, 14 March 2012 (UTC)
Thanks for clarifying things, as you evidently know more far about this than I do. However, the particular block I mentioned is not a range block, nor is any nearby IP blocked. (The same also applies to 199.58.161.130, blocked by Bsadowski1 for 2 years.)JamesBWatson (talk)13:22, 14 March 2012 (UTC)
218.208.97.226 et al.
– This proxy check request isclosed and will soon be archived by a bot.
Judging from Robtex and behavior, they look like tunnel proxies, except for 113.105.88.196, which is "usual", direct proxy (blocked as such). I can't connect to 218.208.97.226 right now.Materialscientist (talk)14:28, 24 March 2012 (UTC)
Not currently an open proxy – Dynamic address assigned to Bell Alliant; no consistent history of bad behavior on- or off-wiki. —madman14:43, 5 April 2012 (UTC)
144.132.145.68
– This proxy check request isclosed and will soon be archived by a bot.
Not a valid one right now, though it is on a shared range of an ISP/webhost, would not hesitate to reblock on suspicious edits. So unblocked. --DQ (ʞlɐʇ)01:39, 11 April 2012 (UTC)
64.251.21.76
– This proxy check request isclosed and will soon be archived by a bot.
No edits in almost a month, so I'm guessing the proxy was, indeed, "gone tomorrow". Closing; can re-open and administrate if we get a second edit from this IP at some point in the future. —madman14:15, 7 May 2012 (UTC)
Not yet looked too close at those contribs. I've seen a few very similar just recently. These types of IP are normally used by desktop/browser apps, like 'hide my ip' or whatever. There may be a legit user or two in the hosting range, at least at some point, and these VPN ranges are normally fairly small, like /27s, but scattered about a bit. hth. --zzuuzz(talk)17:39, 12 April 2012 (UTC)
I looked at the contribs, and the fact that it was a webhost, and found that the edits were not being useful (especially with the tp spamming) so i've nuked the /19 as I normally do for webhosts. People that need an account for a legit reason on a webhost, can talk to a CU. --DQ (ʞlɐʇ)22:51, 12 April 2012 (UTC)
83.170.106.45
– This proxy check request isclosed and will soon be archived by a bot.
IP is an open proxy - Also mentioned above, funnily enough. I've reblocked it for two years. Not currently Tor, but part of a free anonymity service. --zzuuzz(talk)16:57, 12 April 2012 (UTC)
118.112.185.66
– This proxy check request isclosed and will soon be archived by a bot.
Reason: yesteday, another IP editor made a similar edit to Darkness Shines' talk page; it turned out that the IP was an open proxy. I suspect this one could be too.SalvioLet's talk about it!10:08, 13 April 2012 (UTC)
Appears to be an open proxy. User has previously added identical edits[13] onUser talk:Erikvcl as two other blocked proxies (193.224.193.153,[14] 41.35.45.197[15]). One of the blocking admins recognized the edits as those of a banned user.Mathsci (talk)04:19, 14 April 2012 (UTC)
If the intent was to block the hosting facility, I think NETBLK-UBIQUITY-LOS-ANGELES-173-234-208-0 (173.234.208.0 - 173.234.211.255) should have been blocked and not necessarily NETBLK-NOBIS-TECHNOLOGY-GROUP-08 (173.234.0.0 - 173.234.255.255). —madman15:35, 12 March 2012 (UTC)
There is no reason to assume that this specific IP address requesting unblock was the one that triggered the block initially. Looking at the block itself in the absence of any unblock request, it's not immediately apparent which addresses were running open proxies. --Chris(talk)16:46, 12 March 2012 (UTC)
Well, in the discussion to which you linked, Vituzzu mentioned a large hosting facility, and it seemed likely to me that Ubiquity was that facility (it's apparently the only facility major enough to be listed on Nobis Technology's Web site). If it was another facility I'd prefer that that facility's netblock be blocked more specifically too. I'm just thinking in terms of collateral damage and blocking as a preventative measure. But your point is well taken so it's kind of a moot point, I suppose. —madman17:59, 12 March 2012 (UTC)
Closed; the block is anonymous-only, so anyone affected by the block should simply create an account. —madman15:10, 9 May 2012 (UTC)
182.50.64.71
– This proxy check request isclosed and will soon be archived by a bot.
LikelyIP is an open proxy – I can't connect through port 80 as ProcseeBot indicated and confirm it, but it looks like an ISP proxy, one that's in half a dozen blacklists for link spamming, in some cases advertising child pornography. And ProcseeBot did flag it relatively recently. I wouldn't recommend unblock, maybe account creation and a change to softblock. (Not IPBE as I don't know that there's a history of positive contributions.) —madman15:33, 6 February 2012 (UTC)
I should note that nmap doesn't return anything at all. There is either no computer with this IP or it's dropping all incoming traffic. Further,stopforumspam has seen no activity in 17 days, and when there was activity there were spans of no activity only lasting a day or two. This proxy may have been taken down. I'd suggest we look at it again in a week or two. --Chris(talk)17:04, 7 February 2012 (UTC)
Not currently an open proxy – Upon re-review, if this was an open proxy at some point (there seems to besome evidence of that, though I don't think it's as much as I previously argued), it's not anymore. Block has expired. —madman16:59, 9 May 2012 (UTC)
202.189.69.150
– This proxy check request isclosed and will soon be archived by a bot.
Declinedto run a check – I don't think we do, but I'll look through the source to make sure; it's a good question. In any case, I don't think it's likely at all that there's much collateral; this is a web host. If a particular contributor requests IPBE, we can consider it. —madman13:50, 7 May 2012 (UTC)
Reviewing the TorBlock code and CommonSettings.php, it looks like users can be exempted by giving them the torunblocked user right (which we can't do; it's not assigned to any groups) or by placing them on theMediaWiki:Autoblock whitelist (which we also can't do; that's not its purpose). —madman14:03, 7 May 2012 (UTC)
Note: – OverlordQ's tool isnot correct (it may not have been authoritative for some time and I'm the last to know); this node is active anddoes exit to Wikipedia. —madman17:03, 9 May 2012 (UTC)
83.170.106.45
– This proxy check request isclosed and will soon be archived by a bot.
Hi, would one of the more experienced admins please look over this proxy block? It was clearly being used for sockpuppetry, and appears to be the server "ems23.your-freedom.de" via the port 53379. Thanks!Reaper Eternal (talk)14:20, 13 March 2012 (UTC)
I'm running a thorough check right now, but my initial impression is that the open proxy was taken down and has been replaced by a closed proxy. However, it looks like this closed proxy may be shared by many, many subscribers... and I suspect that the primary reasons someone might want to subscribe to this service and edit Wikipedia through it are probably not benevolent. --Chris(talk)14:25, 13 March 2012 (UTC)
IP is an open proxy – Proprietary protocol from what I can tell. 263 users currently using this IP[16]. Blocked for three years by Materialscientist. —madman16:38, 9 May 2012 (UTC)
1.64.162.247
– This proxy check request isclosed and will soon be archived by a bot.
– This proxy check request isclosed and will soon be archived by a bot.
Inconclusive This one is complicated. I tried the opera mini demo interface and sure enough it works nice and open proxy like. However, I came out as82.145.208.189(talk ·contribs ·IP contribs ·WHOIS). It's possible that opera has shifted around their IPs such that the demo interface uses. Or alternately, the demo interface dynamically choose random opera IPs, just like the real browser. On the one hand, opera mini IPs are pretty similar to any cell provider, which we generally don't long term block. On the other hand, the demo interface allows people to access it from their full computers. I lean towards unblocking.Sailsbystars (talk)01:13, 18 January 2012 (UTC)
You have not given a value for the mandatory first parameter! Possible parameters are:
UnlikelyIP is an open proxy I have to agree with hash.es on this one and say it's been down for a good while, but maybe it should go without the account creation flag? To allow legit users? --DQ (ʞlɐʇ)07:24, 23 January 2012 (UTC)
IP is an open proxy it's Tor. Upgraded to hardblock. --DQ (ʞlɐʇ)21:03, 25 January 2012 (UTC)
Unnecessary Webhost that I just nuked. Robtex tells all. --DQ (ʞlɐʇ)23:46, 1 February 2012 (UTC)
LikelyIP is an open proxy Hash.es gives some interesting info. The proxy is likely around, just not right now... so asking for a hold/2nd opinion here. Also note something funny when I try to web address it on 8080. --DQ (ʞlɐʇ)01:42, 2 February 2012 (UTC)
Not currently an open proxy —madman03:36, 6 February 2012 (UTC)
A user hasrequested a proxy check. A proxy checker will shortly look into the case.
Open proxy blocked. (Browser-based proxy.) --Chris(talk)16:57, 7 February 2012 (UTC)
PossibleIP is an open proxy -Charter Communications, normalISP - I can`t activate a proxy, but there is definitely something suspicious here that`s not normal for an ISP. Possible that a login is required, but I can`t even find that.
Sounds like a duck quacking into a megaphone to me. Those Brazilian proxies though, they're usually so dynamic they're gone tomorrow. My guess would be a month tops. --zzuuzz(talk)17:12, 12 April 2012 (UTC)
Already done nuked 62.212.64.0/19 the other day per an SPI. --DQ (ʞlɐʇ)01:12, 25 April 2012 (UTC)
Note: – OverlordQ's tool isnot correct (it may not have been authoritative for some time and I'm the last to know); this node is active anddoes exit to Wikipedia. —madman17:03, 9 May 2012 (UTC)