Wikipedia:WikiProject on open proxies/Archives/Declined/2009/June

71.228.220.209

71.228.220.209 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan POINTy. QUESTION: Does ClueBot IV actually perform/cause a proxy scan to occur, or does it just look up the IP in open proxy lists. Looking at an WPOPreports page might lead one to conclude it's just doing the latter, but that seems like a bad idea. Clarification would be good.--Elvey (talk) 16:31, 2 February 2009 (UTC)

ClueBot does both. It checks reverse DNS, WHOIS, a couple blacklists (including some tor blacklists), and then does a Nmap. Calvin 1998 ^(t·c) 04:46, 3 February 2009 (UTC)

Thanks. Turns out that sometimes it does, sometimes it doesn't. This is the entry that led me to ask the question - it has only WhoIs and DNSBL sections. What's up with that one?--Elvey (talk) 19:59, 10 February 2009 (UTC)

If there is no port scan section, then there were no open ports. -- Cobi^(t|c|b) 21:18, 10 February 2009 (UTC)

OK. That should be made obvious, such as with the text "there were no open ports". (I know of no way for me to find this answer on my own.)--Elvey (talk) 16:23, 12 February 2009 (UTC)

 Clerk note: Report page has been deleted. ClueBot IV (talk) 05:06, 17 February 2009 (UTC)

{{decline}} Stale report, feel free to resubmit at a later date. Q ^{T C} 03:51, 17 June 2009 (UTC)

216.56.7.98

216.56.7.98 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Please check 216.56.7.98 - all of the edits are vandalism and look proxy-like. --B (talk) 19:44, 8 January 2009 (UTC)

 Clerk note: Report page has been deleted. ClueBot IV (talk) 19:51, 8 January 2009 (UTC)

88.112.28.172

88.112.28.172 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Blocked as open proxy in 2007, requests unblock. Still an open proxy?  Sandstein  16:32, 8 January 2009 (UTC)

 Clerk note: Report page has been deleted. ClueBot IV (talk) 16:37, 8 January 2009 (UTC)

68.54.3.98

68.54.3.98 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan See how my entry below says an anon. user found the last TOR OP? That same anon. user was found on an exit TOR node. BTW, the Cluebot port scan isn't going to turn out right. ~ Troy (talk) 05:38, 1 January 2009 (UTC)

 Clerk note: Report page has been deleted. ClueBot IV (talk) 05:49, 1 January 2009 (UTC)

76.172.217.103

76.172.217.103 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan the user's repeated violation on Lee Myung-bak reminds of an indef.blocked user who did the same thing, but the location is different, so may be an OP.--Caspian blue 08:38, 25 December 2008 (UTC)

 Clerk note: Report page has been deleted. ClueBot IV (talk) 08:46, 25 December 2008 (UTC)

86.45.222.9

86.45.222.9 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan User claims he is logging in from open proxies and claims that his IP address changes from time to time. Before I have a checkuser check all his IPs as open proxies, I want to see if the one we know about is an open proxy. If it isn't, then it's a safe bet the others are not either. Claim: [1]. It's common knowledge that in early December D. H. was also 86.45.222.9. davidwr/(talk)/(contribs)/(e-mail) 22:30, 23 December 2008 (UTC)

 Clerk note: Report page has been deleted. ClueBot IV (talk) 22:35, 23 December 2008 (UTC)

My portscan results:

Port Scan has started ...

Port Scanning host: 86.45.222.9

     Open TCP Port:     80             http
     Open TCP Port:     443            https
Port Scan has completed ...

Merits further investigation... Calvin 1998 ^(t·c) 02:59, 31 December 2008 (UTC)

121.9.230.162

121.9.230.162 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan This is one of the IPs named in WP:Suspected sock puppets/Yaneleksklus (3rd). A reverse DNS on this IP leads back to a Chinese outfit, guangzhou.gd.cn, which is associated with some spam domains, according to this Robtex lookup. I'm not sure if I interpreted the RDNS output correctly. This editor has abused quite a number of Belarus IPs that start with 82.209, but he also seems to use this one, based in China. It's the puzzlement that he would have access to a Chinese ISP, or host, that leads me to guess it's an open proxy. EdJohnston (talk) 04:16, 11 December 2008 (UTC)

At the moment I can't connect through port 80. This seems like a former open proxy as port 80 is now filtered same with 8080. --Kanonkas :  Talk  17:17, 12 December 2008 (UTC)

 Clerk note: Report page has been deleted. ClueBot IV (talk) 15:10, 17 December 2008 (UTC)

217.136.108.21

217.136.108.21 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan User:DavidYork71 used IP address. Seems much of the 217.136.108.21/24 and possibly more is open on port 80- Peripitus (Talk) 06:11, 4 January 2009 (UTC)

 Clerk note: Report page has been deleted. ClueBot IV (talk) 06:14, 4 January 2009 (UTC)