Suspected open proxies to be checked

178.177.70.243

178.177.70.243 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Wikipedia:Sockpuppet investigations/Andranikpasha looks like a duck proxy, but please check it out as this is my first time looking into OPs. -- DQ (t) (e) 21:31, 29 October 2010 (UTC)[reply]

Not on any proxy lists, but looks to be a wireless access point, which is not the same as an open proxy. I would rate it as unlikely to be an open proxy without more detailed evidence. Sailsbystars (talk • contribs • email) 03:12, 30 October 2010 (UTC)[reply]

Not an open proxy -- zzuuzz ^(talk) 10:55, 6 November 2010 (UTC)[reply]

204.152.215.116

204.152.215.116 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: I am investigating a larger proxy farm and this address came up. It may or may not be related to the farm.

The IP in California is used to post anonymous messages locally in Singapore. The IP address 204.152.215.115 (talk · contribs · WHOIS) has already been blocked as sock puppet.

The proxy seems to be moving around in the 204.152.215.0/24 network. Latest IP:

204.152.215.146 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

-- Petri Krohn (talk) 02:53, 4 November 2010 (UTC)[reply]

The first one appears to have once hosted btunnel.com as a web proxy, but no longer does so, thus merits no block. The second one is a closed http proxy on 8080 (requires user name and password to actually proxy anything). Sailsbystars (talk • contribs • email) 03:36, 4 November 2010 (UTC)[reply]

184.105.144.4

184.105.144.4 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Web proxy [1] (warning full of nasty pop ups). Also exists on ip 184.105.146.12. Nuke it! Sailsbystars (talk • contribs • email) 03:39, 4 November 2010 (UTC)[reply]

NOTE: This is the new ip for the proxy that was previously 204.152.215.116 (talk · contribs · WHOIS) Sailsbystars (talk • contribs • email) 03:41, 4 November 2010 (UTC)[reply]
- This one's already rangeblocked. These proxies rotate through various ranges, so I'll leave it here for a while in case any unblocked ranges turn up. -- zzuuzz ^(talk) 09:07, 4 November 2010 (UTC)[reply]

74.115.214.158

74.115.214.158 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. On The Fugitive: Plan B the IP user added the same (possible copyrighted) content as an IP blocked as proxy. Tbhotch^Talk ^C. 04:52, 4 November 2010 (UTC)[reply]

This has WP:DUCK written all over it. I'll award a barnstar to anyone who can find how to edit from 74.115.214.152/29. -- zzuuzz ^(talk) 09:02, 4 November 2010 (UTC)[reply]

In fact, I am already working on it, see User:Petri Krohn/Pink proxy. I know four people who can give you the answer. I have posed the question to one of them. Another is a nice lady in California, who gives away puppies. (Ever wonder how Snoopy lost contact with his siblings?) I do not know If I want to write to her, but will you give me half a barnstar if I give you her email address? In fact most of the information can be reached from the now deleted sock puppet investigation. If you have a look at it, could you please retrieve the IP address of the proxy server in Ghana? -- Petri Krohn (talk) 22:29, 4 November 2010 (UTC)[reply]

Try this: http://www.easy-hide-ip.com/

In fact I was thinking this might be http://www.hide-ip-soft.com , but this is the information I received from the blocked user. -- Petri Krohn (talk) 03:50, 5 November 2010 (UTC)[reply]

The company web site has an image of the user interface. The user gets to choose his IP address from a list. From the small print I can make out these.

UK

81.94.201.0/24 – Gosport, England (Redstation Limited)

81.94.201.83 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 81.94.201.87 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 81.94.201.90 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

93.174.138.0/24 – Derby, England (Node4 UK Hosting)

93.174.138.36 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 93.174.138.245 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

77.245.75.0/24 – Gosport, England (Redstation Limited)

77.245.75.53 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 77.245.75.50 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

USA

67.219.51.0/24 Pittsford, New York (Rackwire.com)

67.219.51.110 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 67.219.51.112 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 67.219.51.116 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 67.219.51.124 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 67.219.51.123 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

I do not remember how and from which of the 50 pages I have open I got this from, but it says that 93.174.81.194 is a proxy on port 3128 93.174.81.194 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

This may also be related. Note the interest in Talk:Jessica_(entertainer)‎:

74.115.208.0/21

-- Petri Krohn (talk) 04:36, 5 November 2010 (UTC)[reply]

93.174.81.194 is already blocked as an open proxy on 3128. Sailsbystars (talk • contribs • email) 04:41, 5 November 2010 (UTC)[reply]

Yeah, It seems to be unrelated. I guess it showed up on the Singapore evidence and looked suspicious. -- Petri Krohn (talk) 05:18, 5 November 2010 (UTC)[reply]

78.107.237.16

78.107.237.16 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Off-wiki evidence indicates that these proxies have been used to anonymously procure the same or similar services that is being offered for sale through the proxy network i am investigating. I collected the IP addresses in the 70 first Google search results and checked if they had already been blocked, most were blocked as proxies or Tor nodes. These are however unblocked, most seem to be Tor nodes. I will post the Goolgle search string here, unless someone objects. -- Petri Krohn (talk) 23:52, 4 November 2010 (UTC)[reply]

As no one objected I will post the Google search string here: "to Earn SG$200/Hour" "IP:" site:sgadsonline.com -- Petri Krohn (talk) 05:33, 5 November 2010 (UTC)[reply]

69.91.223.154

69.91.223.154 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

66.215.42.157

66.215.42.157 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

79.88.47.195

79.88.47.195 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

80.79.126.30

80.79.126.30 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

81.17.91.122

81.17.91.122 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

87.89.74.135

87.89.74.135 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

88.86.122.153

88.86.122.153 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

95.27.150.240

95.27.150.240 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

173.193.219.190

173.193.219.190 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

173.255.213.207

173.255.213.207 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

212.227.101.236

212.227.101.236 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

213.112.111.205

213.112.111.205 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

174.132.254.58

174.132.254.58 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: 174.132.254.58 is the address of http://cmyip.com. The web site tells you your IP address, but also post a link to an proxy service: http://www.hide-ip-soft.com/

Off-wiki evidence shows this is a proxy or an exit node of some anonymizer.—Preceding unsigned comment added by Petri Krohn (talk • contribs) 02:47, 5 November 2010 (UTC) [reply]

Any site associated with that company should be considered blockable on sight. According to the product description their product hops around 11 different IPs that they own and the two websites listed qualify as IPs that they own..... Sailsbystars (talk • contribs • email) 03:25, 5 November 2010 (UTC)[reply]

Already rangeblocked: 174.132.0.0/16 is blocked for several months. Sailsbystars (talk • contribs • email) 03:27, 5 November 2010 (UTC)[reply]

Aaaaand the 74.55.0.0/16 (where hide-ip-soft.com is hosted) is indef rangeblocked. Sailsbystars (talk • contribs • email) 03:29, 5 November 2010 (UTC)[reply]

Someone should should download the shareware trial version of the software and check the server addresses. The software requires Windows, I run Linux. -- Petri Krohn (talk) 07:55, 5 November 2010 (UTC)[reply]

IP163.180.179.58

163.180.179.58 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

This IP is involved in an edit war at Cinnamon Gardens. There are numerous IP addresses involved but all appear to be the same editor (they are listed below.) Since User:69.91.223.154 was reported and blocked, the others may be OPs as well. —Preceding unsigned comment added by The Four Deuces (talk • contribs)

- They're normally Tor with this user. -- zzuuzz ^(talk) 17:30, 6 November 2010 (UTC)[reply]

already blocked

not proxies

need further review

207.239.100.158 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 75.70.122.62 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 89.238.143.50 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 91.121.229.237 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

92.28.80.16

92.28.80.16 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: A pattern of attacks on User talk:Diannaa, all coming from different IP ranges. Most edits have been oversighted. Self-declared vandal: [2] All the IPs are in different geographic locations, so this is obviously some proxying service. -- Petri Krohn (talk) 00:25, 7 November 2010 (UTC)[reply]

46.112.227.105 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 66.36.230.89 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 75.89.172.38 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 89.243.224.54 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 142.24.53.213 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 188.33.56.32 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Went to http://66.36.230.89

This is is me editing through the PHPxoxy link -- 66.36.230.89 (talk) 01:07, 7 November 2010 (UTC) (Petri Krohn)[reply]
And this is me editing through the © 2010 glype proxy : Powered by glype v1.1 link. -- 66.36.230.89 (talk) 01:09, 7 November 2010 (UTC)[reply]