Wikipedia:WikiProject on open proxies/Archive 1

From Wikipedia, the free encyclopedia

IP address user talk edits log scan block Notes


207.157.9.133 user talk edits log cwi-tor-google-nmap-whois block-log User:207.157.9.133 (Special:Contributions/207.157.9.133 | Special:Blockip/207.157.9.133) is listed on the NJABL list (http://www.njabl.org/cgi-bin/lookup.cgi?query=207.157.9.133) for the following types of proxies which I checked when they vandalized Louisiana: Open proxy. ClueBot 14:02, 7 September 2007 (UTC)
A lot of open ports, but none are standard proxy ones. —Crazytales talk/desk 15:14, 9 September 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
219.95.168.126 user talk edits log cwi-tor-google-nmap-whois block-log User:219.95.168.126 (Special:Contributions/219.95.168.126 | Special:Blockip/219.95.168.126) is listed on the NJABL list (http://www.njabl.org/cgi-bin/lookup.cgi?query=219.95.168.126) for the following types of proxies which I checked when they vandalized Hygiene: Open proxy. ClueBot 13:06, 7 September 2007 (UTC)
Open on 21, 23, and 80. I can't telnet to it. It would appear that the ports are open for a cable modem's webmin interface. —Crazytales talk/desk 15:14, 9 September 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
65.64.97.1 user talk edits log cwi-tor-google-nmap-whois block-log User:65.64.97.1 (Special:Contributions/65.64.97.1 | Special:Blockip/65.64.97.1) is listed on the NJABL list (http://www.njabl.org/cgi-bin/lookup.cgi?query=65.64.97.1) for the following types of proxies which I checked when they vandalized Zircon: Open proxy. ClueBot 00:56, 6 September 2007 (UTC)
Only open port is 22, for SSH. I'm not trying to bruteforce it. —Crazytales talk/desk 15:14, 9 September 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
199.60.112.15 user talk edits log cwi-tor-google-nmap-whois block-log User:199.60.112.15 (Special:Contributions/199.60.112.15 | Special:Blockip/199.60.112.15) is listed on the AHBL list (http://www.ahbl.org/tools/lookup.php?ip=199.60.112.15) for the following types of proxies which I checked when they vandalized Best Buy: DDoS Drone. ClueBot 21:12, 5 September 2007 (UTC)
Registers to Future Shop in Canada, which is owned by Best Buy. Bored employee is my diagnosis.—Crazytales talk/desk 01:56, 9 September 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
88.86.31.1 user talk edits log cwi-tor-google-nmap-whois block-log ISP based in Syria, DNS seems to resolve to Jordan? -- Avi 19:16, 4 September 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
160.94.148.235 user talk edits log cwi-tor-google-nmap-whois block-log Part of a series of IPs who added the same spam link over 15 minutes or so, some of which have already been blocked as proxies. Located on a variety of different continents, so proxies are even more likely. See WT:WPSPAM#http://spam.drug3k.com. MER-C 09:01, 13 August 2007 (UTC)
Appears to be the University of Minnesota's mail server. A whole mess of open ports, including 5900. —Crazytales (t.) 16:05, 17 August 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
129.170.61.29 user talk edits log cwi-tor-google-nmap-whois block-log Part of a series of IPs who added the same spam link over 15 minutes or so, some of which have already been blocked as proxies. Located on a variety of different continents, so proxies are even more likely. See WT:WPSPAM#http://spam.drug3k.com. MER-C 09:01, 13 August 2007 (UTC)
A Dartmouth University webserver. No proxy. —Crazytales talk/desk 21:23, 8 September 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
219.74.20.128 user talk edits log cwi-tor-google-nmap-whois block-log No description given, also no proxy. —Crazytales (public computer) (talk) (main) 16:31, 20 August 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
68.199.178.194 user talk edits log cwi-tor-google-nmap-whois block-log One of 13 IPs making a coordinated attack on Meta pages within a few minutes of each other. IPs are registered to ISPs on different continents, making an open proxy a likely explanation. --A. B. (talk) 13:18, 21 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
68.225.178.219 user talk edits log cwi-tor-google-nmap-whois block-log One of 13 IPs making a coordinated attack on Meta pages within a few minutes of each other. IPs are registered to ISPs on different continents, making an open proxy a likely explanation. --A. B. (talk) 13:18, 21 June 2007 (UTC)


Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
69.246.169.86 user talk edits log cwi-tor-google-nmap-whois block-log One of 13 IPs making a coordinated attack on Meta pages within a few minutes of each other. IPs are registered to ISPs on different continents, making an open proxy a likely explanation. --A. B. (talk) 13:18, 21 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
70.107.121.32 user talk edits log cwi-tor-google-nmap-whois block-log One of 13 IPs making a coordinated attack on Meta pages within a few minutes of each other. IPs are registered to ISPs on different continents, making an open proxy a likely explanation. --A. B. (talk) 13:18, 21 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
72.196.209.51 user talk edits log cwi-tor-google-nmap-whois block-log One of 13 IPs making a coordinated attack on Meta pages within a few minutes of each other. IPs are registered to ISPs on different continents, making an open proxy a likely explanation. --A. B. (talk) 13:18, 21 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
74.130.197.99 user talk edits log cwi-tor-google-nmap-whois block-log One of 13 IPs making a coordinated attack on Meta pages within a few minutes of each other. IPs are registered to ISPs on different continents, making an open proxy a likely explanation. Blacklisted by SORBS. --A. B. (talk) 13:18, 21 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
85.8.2.168 user talk edits log cwi-tor-google-nmap-whois block-log One of 13 IPs making a coordinated attack on Meta pages within a few minutes of each other. IPs are registered to ISPs on different continents, making an open proxy a likely explanation. --A. B. (talk) 13:18, 21 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
219.64.185.7 user talk edits log cwi-tor-google-nmap-whois block-log Please see Administrators' noticeboard/Incidents for details. — N96 (talk) 05:43, 17 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
125.99.225.216 user talk edits log cwi-tor-google-nmap-whois block-log Please refer case to 219.64.185.7. — N96 (talk) 05:46, 17 June 2007 (UTC)
Hathway broadband IP, Mumbai India. No rDNS. —Crazytales (talk) (alt) 17:47, 18 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
219.64.148.125 user talk edits log cwi-tor-google-nmap-whois block-log Please refer case to 219.64.185.7. — N96 (talk) 05:51, 17 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
125.16.143.133 user talk edits log cwi-tor-google-nmap-whois block-log Please refer case to 219.64.185.7. — N96 (talk) 05:53, 17 June 2007 (UTC)
Bharti Infotel IP, Mumbai India. No rDNS. —Crazytales (talk) (alt) 17:47, 18 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
124.125.229.94 user talk edits log cwi-tor-google-nmap-whois block-log Please refer case to 219.64.185.7. — N96 (talk) 05:53, 17 June 2007 (UTC)
Reliance Infocomm broadband IP, Mumbai India. No rDNS. —Crazytales (talk) (alt) 17:47, 18 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
219.64.151.135 user talk edits log cwi-tor-google-nmap-whois block-log Please refer case to 219.64.185.7. — N96 (talk) 05:54, 17 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
219.64.66.150 user talk edits log cwi-tor-google-nmap-whois block-log Please refer case to 219.64.185.7. — N96 (talk) 16:44, 17 June 2007 (UTC)
All the 219.64.0.0/16 ip's are from the same dynamic dialup ISP, Videsh Sanghar Nigam ltd, Mumbai India. All except 219.64.151.135 have multiple RBL listings, leading me to think it's a dynamic proxy. A 219.64.0.0/16 range block should take care of it. —Crazytales (talk) (alt) 17:47, 18 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
203.221.6.70 user talk edits log cwi-tor-google-nmap-whois block-log And the three below (82.0.115.196, 200.126.74.123, 75.167.157.106). I just don't trust this. On commons http://commons.wikimedia.org/w/index.php?title=User:MiLoXo&action=edit user MiLoXo this afternoon uploaded a handfull of pictures, and now these 4 totally unrelated IPs are suddenly adding the pictures to documents on en.wikipedia. These pages are under monitor by an IRC-bot I am running because they are under a continuous attact by sockpuppets of user:JB196 (Wikipedia:Long_term_abuse/JB196). --Dirk Beetstra T C 17:04, 11 June 2007 (UTC)
Australian IP. —Crazytales (public computer) (talk) (main) 12:28, 13 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
82.0.115.196 user talk edits log cwi-tor-google-nmap-whois block-log See 203.221.6.70, above. --Dirk Beetstra T C 17:04, 11 June 2007 (UTC)
British IP. —Crazytales (public computer) (talk) (main) 12:28, 13 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
200.126.74.123 user talk edits log cwi-tor-google-nmap-whois block-log See 203.221.6.70, above. --Dirk Beetstra T C 17:04, 11 June 2007 (UTC)
Multiple RBL records point to it being an open proxy or compromised system. Chilean IP. —Crazytales (public computer) (talk) (main) 12:23, 13 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
75.167.157.106 user talk edits log cwi-tor-google-nmap-whois block-log See 203.221.6.70, above. --Dirk Beetstra T C 17:04, 11 June 2007 (UTC)
IP from Colorado. —Crazytales (public computer) (talk) (main) 12:28, 13 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
67.85.129.5 user talk edits log cwi-tor-google-nmap-whois block-log cross-wiki vandalbot similar to the recently blocked 69.201.128.247. Spams pages with names like "w/w/w/index.php" (If cross-wiki search function doesn't work, see this example.) --A. B. (talk) 02:15, 10 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
87.117.196.237 user talk edits log cwi-tor-google-nmap-whois block-log Unblocked IP for an Anonymous Web Proxy ([1]). Madmikeuk needs more cowbell. 13:22, 4 June 2007 (UTC)
Already blocked within 87.117.192.0/18 range. —Centrx→talk • 04:47, 5 June 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
74.228.91.7 user talk edits log cwi-tor-google-nmap-whois block-log As with the reports below, this IP relates to the same incidents where a number of IP addresses apparently from different parts of the world have been adding the same nonsense to articles relating to Jerry Falwell and Baptists. Several turned out to be open proxies. If this one isn't, then he's spoofing the IP from somewhere, just like he did for 72.20.2.30 below. See edit history for In Touch Ministries for an example of identical vandal edits from different IP addresses. And in this edit he boasts about being able to spoof any address. =Axlq 06:57, 18 May 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
87.244.80.169 user talk edits log cwi-tor-google-nmap-whois block-log Reported as a possible sockpuppet, but the suspected sockmaster is not in the same /8. Jesse Viviano 14:36, 16 May 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
62.3.32.55 user talk edits log cwi-tor-google-nmap-whois block-log Used by banned user Artaxiad who used a lot of proxies, I blocked it but got an e-mail requesting unblocking saying it was in Saudi Arabia (but whois says UK?). Unblocked pending verification. Thatcher131 12:55, 16 May 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
85.214.40.81 user talk edits log cwi-tor-google-nmap-whois block-log Bizzare that a computer called extreesports.net, making edits to Scotch Plains, NJ, registers to Berlin, Germany
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
82.168.59.236 user talk edits log cwi-tor-google-nmap-whois block-log Block-evading, open proxy using sockpuppeteer/vandal Burak18. AecisBrievenbus 22:42, 13 May 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
193.69.167.130 user talk edits log cwi-tor-google-nmap-whois block-log Block-evading, open proxy using sockpuppeteer/vandal Burak18. AecisBrievenbus 22:42, 13 May 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
203.218.106.196 user talk edits log cwi-tor-google-nmap-whois block-log Same as below. -- Consumed Crustacean (talk) 07:51, 12 May 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
58.10.68.149 user talk edits log cwi-tor-google-nmap-whois block-log Same as below. -- Consumed Crustacean (talk) 02:33, 12 May 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
124.120.219.177 user talk edits log cwi-tor-google-nmap-whois block-log Same as below. -- Consumed Crustacean (talk) 02:33, 12 May 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
61.91.220.151 user talk edits log cwi-tor-google-nmap-whois block-log IP-switching political vandal. -- Consumed Crustacean (talk) 02:29, 12 May 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
124.120.222.189 user talk edits log cwi-tor-google-nmap-whois block-log IP-switching political vandal -- Consumed Crustacean (talk) 02:27, 12 May 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
58.10.167.79 user talk edits log cwi-tor-google-nmap-whois block-log IP-switching political vandal -- Consumed Crustacean (talk) 02:27, 12 May 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
64.5.146.13 user talk edits log cwi-tor-google-nmap-whois block-log IP is registered to a PBS TV station in Virginia. Recent edits and vandalism seem a little suspicious. Mr.Z-mantalk¢ 23:48, 7 May 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
207.144.70.66 user talk edits log cwi-tor-google-nmap-whois block-log Loads of vandalism is coming from this address, and the Composite Block List thinks that this IP is an open proxy. Jesse Viviano 22:00, 27 April 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
216.86.146.184 user talk edits log cwi-tor-google-nmap-whois block-log Web proxy- [2]. Nwwaew (Talk Page) (Contribs) (E-mail me) 18:52, 26 July 2007 (UTC)
Already blocked. —Crazytales talk/desk 21:23, 8 September 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)

[edit] Requested Unblock

IP address user talk edits log scan block Notes


127.0.0.1 user talk edits log cwi-tor-google-nmap-whois block-log example


65.91.249.64 user talk edits log cwi-tor-google-nmap-whois block-log comes up as a proxy block but was not confirmed, admin just assumed it was.
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
64.202.165.201 user talk edits log cwi-tor-google-nmap-whois block-log I don't know if this is an open proxy or not, it's a GoDaddy server that hosts my domain. I'm not even sure that it's still blocked, it shows up here, but not in the blocked list below. My site does some screen scraping of Wikipedia (~150 articles a week) using PHP CURL. It started getting an ERR_ACCESS_DENIED error a few weeks ago and I'm wondering if this block is the cause. If it IS an open proxy, is there something I can do about it, contact GoDaddy or something? Thanks - Symmetric 06:16, 6 May 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)
Screen scrapping Wikipedia is not allowed. You have been blocked at the squid level (ie. sysops's can't unblock you, you'd need a developer). You should use a dump instead. See Wikipedia:Mirrors_and_forks#Remote_loading Platonides 19:44, 26 September 2007 (UTC)
202.21.176.50 user talk edits log cwi-tor-google-nmap-whois block-log Caught for proxy abuse here on enwiki in May, and apparently on Bulgarian Wikipedia in June [3], now causing collateral damage on legitimate contributor (User talk:Mahudhy). Please check. Fut.Perf. ☼ 09:08, 15 July 2007 (UTC)
Clerk note: Report page has been deleted. ClueBot IV 02:00, 13 September 2007 (UTC)