Wikipedia:WikiProject on open proxies/Requests/Archives/28

150.129.4.18


open port 8080 2016-05-27

Reason: suspicious edits
 * Confirmed, blocked. Materialscientist (talk) 11:42, 25 July 2016 (UTC)

71.207.70.133


Reason: Suspicious edits. Has been blocked once before on port 30364. 71.237.141.40 (talk) 19:32, 28 May 2016 (UTC)
 * Yes check.svg Blocked Callanecc (talk • contribs • logs) 10:17, 19 October 2017 (UTC)

70.192.71.206


Reason: Suspicious edits. 71.237.141.40 (talk) 03:03, 29 May 2016 (UTC)
 * X mark.svg Not done Callanecc (talk • contribs • logs) 10:18, 19 October 2017 (UTC)

45.127.122.174


Open on port 8080, blocked in March by ProcseeBot

Reason: Suspicious edits. Sro23 (talk) 07:35, 4 June 2016 (UTC)
 * Confirmed, blocked. Materialscientist (talk) 08:07, 30 July 2016 (UTC)

139.255.39.147


port 8080 2016-06-08

Reason: Suspicious edits
 * &mdash; the ip's literally done nothing. -- slakr \ talk / 04:41, 25 March 2017 (UTC)

64.61.164.82


blocked once before 2016-06-11

Reason: Suspicious edits

177.128.34.27


many open ports in the 8000 range 2016-06-12

Reason: Suspicious edits

84.22.35.37


mikrotik router open port 80 2016-06-12

Reason: Suspicious edits

197.210.185.246


2016-06-17

pot 8080 blocked before

Reason: Suspicious edits

24.167.246.32


2016-06-17

Reason: Suspicious edits

177.128.34.27


port 8080 and 3128 open, among others 2016-06-17

Reason: Suspicious edits

67.160.137.188


Reason: Suspicious edits/signs of sockpupetry. Most of these ips above were mentioned on here and the last one was confirmed here. The proxies seem stale. However, it doesn't mean that they are not being abused by the long-term abuser, since his status is still active. 46.221.217.82 (talk) 16:54, 17 June 2016 (UTC)

46.16.193.70


Reason: Suspicious edits. Also, the same ip was reported on Sockpuppet investigations/Tirgil34. 46.221.217.82 (talk) 17:10, 17 June 2016 (UTC)
 * on PPTP port, might require an app and (or) username/password combination. Regards— UY Scuti Talk  19:24, 18 June 2016 (UTC)

213.33.142.90


Reason: Proxy socking.- MrX 15:36, 19 June 2016 (UTC)

54.166.106.30


Reason: Socking via Amazon AWS.- MrX 15:39, 19 June 2016 (UTC)

86.52.101.203


Reason: Suspicious edits, likely proxy. Also, similar edits and fields of interest with a banned sockmaster. See: WP:Tirgil34. 46.221.224.69 (talk) 15:55, 19 June 2016 (UTC)

70.90.16.115


Reason: suspicious edits & blocked by ProcseeBot in November Sro23 (talk) 14:42, 24 June 2016 (UTC)
 * on port 8080. Regards— UY Scuti Talk  15:49, 8 July 2016 (UTC)

217.64.195.226


Reason: Suspicious edits. IP is registered to "Tophost hosting servers", geo-locating to Italy, and is based from this proxy hosting service/website. 172.56.42.70 (talk) 22:25, 25 June 2016 (UTC)
 * please block the range as  and block  as, since the traffic to this web-proxy exits via that IP. Regards— UY Scuti  Talk  16:04, 8 July 2016 (UTC)

159.253.145.183


Reason: Suspicious edits. Open proxy at anonymoX.net. 172.56.42.70 (talk) 22:44, 25 June 2016 (UTC)
 * with anonymoX on port 80 (requires login credentials). Regards— UY Scuti Talk  16:12, 8 July 2016 (UTC)

198.24.162.179


Reason: Suspicious edits. Open proxy at anonymoX.net. 172.56.42.70 (talk) 22:44, 25 June 2016 (UTC)
 * belongs to anonymoX. Regards— UY Scuti Talk  16:33, 8 July 2016 (UTC)

208.110.81.90


Reason: Suspicious edits. IPv4 proxy IP from proxfree.com. 172.56.42.5 (talk) 22:33, 30 June 2016 (UTC)
 * , a web-proxy. Lot of open proxies operating on this range and should be blocked as . Regards— UY Scuti  Talk  16:48, 8 July 2016 (UTC)
 * Globally hardblocked. Regards— UY Scuti Talk  14:07, 9 July 2016 (UTC)

5.39.188.0


Reason: Suspicious edits. Open on port 3128. 172.56.42.5 (talk) 22:50, 30 June 2016 (UTC)
 * IP resolves to colocenter.nl, unlikely an open proxy is operating there. Regards— UY Scuti Talk  17:02, 8 July 2016 (UTC)

104.171.115.66


Reason: Suspicious edits. Open proxy here. 172.56.42.5 (talk) 22:56, 30 June 2016 (UTC)

206.41.39.56


Reason: Suspicious edits. Open on port 8080. 172.56.42.5 (talk) 23:48, 30 June 2016 (UTC)
 * on port 8080. Regards— UY Scuti Talk  17:17, 8 July 2016 (UTC)

202.77.57.124



 * http://202.77.57.124:3128/ --Antigng (talk) 03:32, 2 July 2016 (UTC)

Reason: Suspicious edits
 * on port 3128. Regards— UY Scuti Talk  17:22, 8 July 2016 (UTC)

113.160.57.242



 * See http://113.160.57.242:8080/ --Antigng (talk) 05:03, 2 July 2016 (UTC)

Reason: Suspicious edits

89.141.113.180



 * port 9080 --Antigng (talk) 16:32, 6 July 2016 (UTC)
 * Confirmed, blocked. Materialscientist (talk) 22:18, 24 July 2016 (UTC)

195.144.232.165


Reason: Suspicious edits. Open on port 1080. More details can be found here. 172.56.42.233 (talk) 20:21, 9 July 2016 (UTC)
 * Confirmed, blocked. Materialscientist (talk) 22:07, 26 July 2016 (UTC)

78.135.114.76


Reason: Suspicious edits. Open on port 1080. More details can be found here. 172.56.42.233 (talk) 20:30, 9 July 2016 (UTC)
 * Confirmed, blocked. Materialscientist (talk) 22:18, 24 July 2016 (UTC)

64.26.95.14


Reason: Suspicious edits. Open on port 8080. 172.56.42.221 (talk) 21:45, 9 July 2016 (UTC)

188.165.199.94


Reason: Suspicious edits. Open proxy. The following IP seems to be in a wide variety of open proxies with the IP range of per WHOIS. Also, this IPv6 address which is currently blocked, exits through the IPv4 address above. 172.56.42.221 (talk) 22:11, 9 July 2016 (UTC)
 * 188.165.192.0/18 proxy blocked. The editor who uses the pseudonym "JamesBWatson" (talk) 12:40, 26 July 2016 (UTC)

91.203.111.4
Blocked by DoRD. The editor who uses the pseudonym "JamesBWatson" (talk) 12:52, 26 July 2016 (UTC)

Reason: Suspicious edits. Current open proxy. Has been recently used to evade a block. 172.58.35.162 (talk) 22:33, 9 July 2016 (UTC)

165.139.149.169


Reason: Suspicious edits. Open on port 3128. 172.58.41.207 (talk) 03:39, 11 July 2016 (UTC)

UPDATE: Apparently, it is registered to a school in Indiana, per the school template on the IP's talkpage. The IP registration may have recently changed... 172.58.41.207 (talk) 03:43, 11 July 2016 (UTC)
 * Regards— UY Scuti Talk  13:17, 6 August 2016 (UTC)

12.196.110.50


Reason: Suspicious edits. Open on port 8080. 172.58.41.207 (talk) 03:41, 11 July 2016 (UTC)

190.144.114.122


Reason: Suspicious edits. Open on port 3128. 172.58.41.207 (talk) 03:44, 11 July 2016 (UTC)
 * Confirmed, blocked. Materialscientist (talk) 22:19, 24 July 2016 (UTC)

82.117.163.74


Reason: Suspicious edits. Open on port 8080. 172.58.41.207 (talk) 03:45, 11 July 2016 (UTC)
 * on port 8080, exiting on . Regards— UY Scuti Talk  13:42, 6 August 2016 (UTC)

201.55.46.6


Reason: Suspicious edits. Open on port 80. 172.58.41.207 (talk) 03:47, 11 July 2016 (UTC)
 * Confirmed, blocked. Materialscientist (talk) 21:58, 25 July 2016 (UTC)

111.7.162.46


Reason: Suspicious edits. Open on port 8080. 172.58.41.207 (talk) 03:48, 11 July 2016 (UTC)

66.253.245.180


Reason: Suspicious edits. Open on port 10200. 172.58.41.207 (talk) 03:49, 11 July 2016 (UTC)

107.191.199.198


Reason: Suspicious edits. Open on port 10200. 172.58.41.207 (talk) 03:50, 11 July 2016 (UTC)

208.103.10.152


Reason: Suspicious edits. Open on port 10200. 172.58.41.207 (talk) 03:52, 11 July 2016 (UTC)
 * Confirmed, blocked. Materialscientist (talk) 11:41, 25 July 2016 (UTC)

50.115.129.125


Reason: Suspicious edits. Open on port 60088. 172.58.41.207 (talk) 03:53, 11 July 2016 (UTC)

112.213.126.130


Reason: Suspicious edits. Open on port 1080. 172.58.41.207 (talk) 03:55, 11 July 2016 (UTC)

66.228.33.248


Reason: Suspicious edits. Open on port 9050. 172.58.41.207 (talk) 03:57, 11 July 2016 (UTC)
 * Confirmed, blocked. Materialscientist (talk) 22:52, 24 July 2016 (UTC)

212.56.157.188


Reason: Suspicious edits. Open on port 60088. 172.58.41.207 (talk) 04:04, 11 July 2016 (UTC)

5.255.65.140


Reason: Suspicious edits. Open on port 60088. 172.58.41.207 (talk) 04:05, 11 July 2016 (UTC)

65.60.220.192


Reason: Suspicious edits. Open on port 10200. 172.58.41.207 (talk) 04:07, 11 July 2016 (UTC)
 * Confirmed, blocked. Materialscientist (talk) 21:57, 25 July 2016 (UTC)

177.99.83.47


Reason: Suspicious edits. Open on port 8080. 2607:FB90:8089:750F:0:18:D040:9101 (talk) 02:25, 16 July 2016 (UTC)

2001:41D0:0:0:0:0:0:0/32


Reason: requested unblock. Reason given for IP address: webhostblock. עוד מישהו Od Mishehu 11:43, 17 July 2016 (UTC)
 * Unblocked by Luk. Regards— UY Scuti Talk  16:17, 6 August 2016 (UTC)

114.215.114.25


Reason: suspicious edits Sro23 (talk) 18:22, 23 July 2016 (UTC)
 * Globally blocked by Tegel. The editor who uses the pseudonym "JamesBWatson" (talk) 10:31, 26 July 2016 (UTC)

129.45.70.0


Reason: Suspicious edits. 2607:FB90:80AE:5088:0:31:E487:1301 (talk) 22:02, 24 July 2016 (UTC)

189.115.157.122


Reason: Suspicious edits on ja.wikipedia.org.--HotKorokke (talk) 22:42, 24 July 2016 (UTC)

198.61.174.32 (Range: 198.61.174.0/23)


Reason: Suspicious edits. Belongs to Rackspace Cloud Servers in San Antonio, Texas. Also offered by proxy hosting site known as browserling.com. 2607:FB90:80AE:5088:0:31:E487:1301 (talk) 00:50, 25 July 2016 (UTC)
 * What do you mean by "Suspicious edits"? I can find no record of any edits from this IP address on any Wikimedia project, and I can find no edits from any IP address in the given range on English Wikipedia (I have not checked other projects). There are four open ports, but I have not yet been able to confirm that it's an open proxy. The editor who uses the pseudonym "JamesBWatson" (talk) 10:29, 26 July 2016 (UTC)
 * Please note that I am the same user as the 2607 IP. Sorry about that. The default message when reporting a proxy at this noticeboard is "suspicious edits". I apparently left the default text there and then described the proxy range afterwards. Anyway, this appears to be a high-usage proxy/web-hosting platform that is widely used. I've been testing out some proxy sites in trying to find open proxies that are currently not blocked. Cheers. 172.58.24.218 (talk) 00:55, 31 July 2016 (UTC)

117.211.83.18


Reason: Recent disruptive edits and this IP has been blocked as a proxy twice before - see log. Geraldo Perez (talk) 13:42, 25 July 2016 (UTC)
 * This is certainly a proxy, with open ports at 3128 & 8021 but I have not yet been able to confirm that it's an open proxy. The editor who uses the pseudonym "JamesBWatson" (talk) 10:16, 26 July 2016 (UTC)
 * Static IP allocated to an Indian University. Although this technically is a proxy, it does not redirect requests. Regards— UY Scuti Talk  16:46, 6 August 2016 (UTC)

78.46.43.39


Reason: Suspicious edits. 2607:FB90:4A3B:11E7:0:4B:E2D7:1501 (talk) 07:18, 28 July 2016 (UTC)

114.6.45.106


Reason: Suspicious edits. Open on port 1080. More details can be found here. 172.58.24.218 (talk) 00:44, 31 July 2016 (UTC)

177.11.136.138


Reason: Suspicious edits. Open on port 1080. More details can be found here. 172.58.24.218 (talk) 00:47, 31 July 2016 (UTC)

118.192.145.99


Reason: Suspicious edits. Open on port 1080. More details can be found here. 172.58.24.218 (talk) 00:50, 31 July 2016 (UTC)

31.192.104.216


Reason: ru-02.tunnello.com Tunnello open proxy. See http://31.192.104.216:3129/, https://31.192.104.216/. --Antigng (talk) 01:36, 31 July 2016 (UTC)
 * Open on port 3129. 172.58.40.81 (talk) 03:44, 31 July 2016 (UTC)
 * from Hong Kong
 * hk-01.tunnello.com. ->
 * hk-03.tunnello.com. ->
 * hk-04.tunnello.com. ->
 * from Singapore
 * sg-01.tunnello.com. ->
 * from France
 * fr-01.tunnello.com. ->
 * fr-02.tunnello.com. ->
 * fr-03.tunnello.com. ->
 * from Britain
 * gb-01.tunnello.com. ->
 * gb-03.tunnello.com. ->
 * from US
 * us-01.tunnello.com. ->
 * us-02.tunnello.com. ->
 * us-03.tunnello.com. ->
 * us-04.tunnello.com. ->
 * us-05.tunnello.com. ->
 * from Italy
 * it-01.tunnello.com. ->
 * it-02.tunnello.com. ->
 * it-03.tunnello.com. ->
 * from Canada
 * ca-01.tunnello.com. ->
 * from Russia
 * ru-01.tunnello.com. ->
 * ru-02.tunnello.com. ->
 * from Germany
 * de-01.tunnello.com. ->
 * de-02.tunnello.com. ->
 * de-03.tunnello.com. ->
 * from Spain
 * es-01.tunnello.com. ->
 * es-02.tunnello.com. ->
 * es-02.tunnello.com. ->

The official website says there are Belgian proxies, but I can't find any of them. --Antigng (talk) 07:50, 31 July 2016 (UTC)

31.131.20.170


Reason: Open proxy via web hosting system Tunnello.com. Open on port 3129. 172.58.40.81 (talk) 03:43, 31 July 2016 (UTC)
 * Blocked by Materialscientist. 172.58.41.237 (talk) 21:18, 31 July 2016 (UTC)

85.185.244.116


Reason: Open at port 1080. More details can be found here. 172.56.42.174 (talk) 04:42, 31 July 2016 (UTC)
 * Confirmed, blocked. Materialscientist (talk) 22:23, 1 August 2016 (UTC)

114.252.68.87


Reason: Open at port 1080. More details can be found here. 172.56.42.174 (talk) 04:43, 31 July 2016 (UTC)

173.189.25.73


Reason: Open at port 10200. More details can be found here. 172.56.42.174 (talk) 04:44, 31 July 2016 (UTC)
 * Confirmed, blocked. Materialscientist (talk) 22:26, 1 August 2016 (UTC)

203.93.97.24


Reason: Open at port 1080. More details can be found here. 172.56.42.174 (talk) 04:46, 31 July 2016 (UTC)

41.204.93.194


Reason: Open at port 1080. More details can be found here. 172.56.42.174 (talk) 04:47, 31 July 2016 (UTC)

213.151.206.178


Reason: Open at port 1080. More details can be found here. 172.56.42.174 (talk) 04:48, 31 July 2016 (UTC)

5.160.247.76


Reason: Open on port 1080. More details can be found here. 172.58.41.237 (talk) 20:05, 31 July 2016 (UTC)

(See IP's Below)
Reason: Mobile phone app web-hosting site. This seems to be a very wide IP range, but all may be of the same hosting network per WHOIS. Some of the proxies that I have found to be open are all on port 1080. Some of them include:


 * - Confirmed here
 * - Confirmed here
 * - Confirmed here

There is probably a better hidden CIDR sub-mask that I'm just not seeing...

172.56.42.18 (talk) 05:13, 2 August 2016 (UTC)

104.131.0.0/16


Reason: IP range is almost at the end of it's current web-host-block. The IP range is still open. 172.58.41.186 (talk) 00:04, 4 August 2016 (UTC)

162.243.0.0/16


Reason: IP range is currently open. Has been blocked in the past. 172.58.41.186 (talk) 00:04, 4 August 2016 (UTC)

114.6.45.106


Reason: Open on port 1080. More details can be found here. 172.58.40.246 (talk) 03:51, 4 August 2016 (UTC)

5.160.247.76


Reason: Open on port 1080. More details can be found here. 172.58.40.246 (talk) 03:51, 4 August 2016 (UTC)

118.192.145.99


Reason: Open on port 1080. More details can be found here. 172.58.40.246 (talk) 03:51, 4 August 2016 (UTC)

95.188.77.233


Reason: Open on port 1080. More details can be found here. 172.58.40.246 (talk) 03:51, 4 August 2016 (UTC)

81.30.116.103


Reason: Open on port 1080. Runs through the same traffic as currently blocked proxy:. 172.58.40.246 (talk) 03:51, 4 August 2016 (UTC)

64.188.212.9


Reason: Open on port 10200. More details can be found here. 172.58.40.246 (talk) 03:51, 4 August 2016 (UTC)

78.135.114.77


Reason: Open on port 1080. Runs through the same traffic as currently blocked proxy:. See also the very first block entry for blocked by. 172.58.40.246 (talk) 04:13, 4 August 2016 (UTC)
 * Confirmed, blocked. Materialscientist (talk) 09:56, 4 August 2016 (UTC)

195.154.0.0/16


Reason: Block for this IP range is about to end, and it is still currently open through VPN serive "SaferVPN". 208.54.5.206 (talk) 20:56, 5 August 2016 (UTC)

192.184.48.10


Reason: Many edits that are obvious vandalism, even more edits that add information to articles without citation. Going to user's IP address redirects to Google. Running WHOIS on user's IP shows a virtual private server provider which is likely being used as a proxy.

Wave1453 (talk) 18:31, 7 August 2016 (UTC)
 * This IP appears to be one of many IP's registered to a private VPN network known as "Psychz Networks", from the following IP range: . Please see this link. 172.56.39.164 (talk) 03:44, 15 August 2016 (UTC)

192.95.0.0/18


Reason: Suspicious edits from &. WHOIS shows that this is the range containing the open proxy(ies). Also is used by proxy web-hosting website known as "KProxy.com". 172.56.7.10 (talk) 13:44, 10 August 2016 (UTC)

82.117.163.74


Reason: Open proxy with running traffic through already currently blocked proxy. 172.56.7.10 (talk) 13:53, 10 August 2016 (UTC)
 * Already blocked. Worthless it is to block the entry node. Regards— UY Scuti Talk  15:49, 10 August 2016 (UTC)

37.187.0.0/16


Reason: This IP range is still currently open through dedicated OVH servers; current block is about to expire. 172.58.40.103 (talk) 03:02, 12 August 2016 (UTC)
 * Already blocked. Regards— UY Scuti Talk  16:10, 15 August 2016 (UTC)

87.98.128.0/17


Reason: This IP range is still currently open through dedicated OVH servers. Has been blocked twice in the past. 172.58.40.103 (talk) 03:05, 12 August 2016 (UTC)

192.95.0.0/18


Reason: Open IP range through web-host cloud service through "KProxy.com". 172.56.42.156 (talk) 03:31, 12 August 2016 (UTC)

167.114.0.0/16


Reason: OVH dedicated range through web-hosting proxy service "KProxy.com". 172.58.41.1 (talk) 18:40, 12 August 2016 (UTC)
 * Already blocked globally. Materialscientist (talk) 22:14, 14 August 2016 (UTC)

149.202.0.0/16


Reason: OVH dedicated range through web-hosting proxy service "KProxy.com". 208.54.5.147 (talk) 21:54, 12 August 2016 (UTC)

205.157.66.4


Reason: Apparently involved in Vodkapoise LTA socking, reported by tools as confirmed proxy. Brianhe (talk) 15:57, 14 August 2016 (UTC)
 * This IP is registered to Office Depot in Delray Beach, United States (which is not a proxy server) with the following IP range: . Also whatismyipaddress.com does not actually confirm open proxies, as is noted on the top of the edit notice when editing this noticeboard. 172.56.39.164 (talk) 03:51, 15 August 2016 (UTC)

74.120.222.234


Reason: Canadian server for Boleh VPN (https://www.bolehvpn.net/) <b style="border:1px solid #dfdfdf;color:green; padding:1px 3px;background:#FFD">Ron h jones </b>(Talk) 19:52, 14 August 2016 (UTC)
 * IP is registered to GloboTech Communications under the following IP range: . This appears to be a cloud hosting service. The IP range has also been blocked three times, with the latest block as six months. Please see this link. 172.56.38.211 (talk) 04:37, 15 August 2016 (UTC)

198.61.128.0/18


Reason: Belongs to Rackspace Cloud Servers in San Antonio, Texas. Also offered by proxy hosting site known as browserling.com. Please see this link. 172.56.38.211 (talk) 04:58, 15 August 2016 (UTC)

92.63.100.80


Reason: IP was recently blocked as an open proxy. Current blocking period has almost expired. Registered to [Cohula.ru] and open on port 80. 172.56.38.211 (talk) 04:58, 15 August 2016 (UTC)
 * See #130— UY Scuti <sup style="color:green; font-family:Times;">Talk  14:00, 24 August 2016 (UTC)

188.165.0.0/16


Reason: Dedicated OVH open IP proxy range. Has been blocked in the past. 172.56.38.211 (talk) 04:58, 15 August 2016 (UTC)
 * Already blocked. As you can see, reporting IPs with no suspicious editing patterns makes things slow and is overwhelming to proxy checkers. It is quite hard to clear the current high backlog. There are a LOT of open proxies that haven't edited Wikipedia. It is also counter productive, should we choose to check and block them all individually. To ease things a bit, I'd suggest you to henceforth report IPs that only have suspicious editing patterns. Please also consider not reporting IP ranges unless you see a pattern of editing. Regardless, I appreciate your work to help defend Wikipedia. Regards— UY Scuti  <sup style="color:green; font-family:Times;">Talk  16:21, 15 August 2016 (UTC)

95.213.128.0/17


Reason: Dedicated OVH open IP proxy range. Has been blocked in the past. 172.56.38.211 (talk) 04:58, 15 August 2016 (UTC)

62.210.0.0/16


Reason: Dedicated OVH open IP proxy range. Has been blocked in the past. 172.56.38.211 (talk) 04:58, 15 August 2016 (UTC)

178.32.0.0/15


Reason: Dedicated OVH open IP proxy range. 172.56.38.211 (talk) 04:58, 15 August 2016 (UTC)

46.28.67.33



 * zenmate. See https://46.28.67.33 .--Antigng (talk) 14:57, 15 August 2016 (UTC)
 * IP range locates to Ukraine, and is likely a webhosting service with the IP range at . 172.56.38.228 (talk) 01:43, 16 August 2016 (UTC)

45.56.80.0/20


Reason: Suspicious edits at. The following IP with the given IP range locates it's ISP to Linode Cloud Hosting Services, which is a virtual private network. Please see this link. 172.56.38.228 (talk) 01:39, 16 August 2016 (UTC)
 * on the IP, on the range (No reason given)— UY Scuti  <sup style="color:green; font-family:Times;">Talk  15:20, 24 August 2016 (UTC)

185.104.186.10 & 185.104.186.11



 * zenmate. See https://185.104.186.10/ & https://185.104.186.11/ .--Antigng (talk) 05:06, 17 August 2016 (UTC)
 * The IP range for this network/IP address is Please see this link. 172.58.41.120 (talk) 20:46, 17 August 2016 (UTC)
 * Zenmate exit nodes on port 443 (both IPs). Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  14:41, 24 August 2016 (UTC)

193.182.144.73


Reason: IP traffic through Zenmate VPN service. The IP is within the same network with the following IP range:. Please see this link. 193.182.144.73 (talk) 21:31, 17 August 2016 (UTC)
 * Zenmate exit nodes on port 443. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  14:04, 24 August 2016 (UTC)

178.255.42.234


Reason: IP traffic through Zenmate VPN service. The IP is within the same network with the following IP range:. Please see this link. 178.255.42.234 (talk) 21:41, 17 August 2016 (UTC)
 * Zenmate exit nodes on port 443. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  14:04, 24 August 2016 (UTC)

31.192.111.201 & 31.192.111.234


Reason: IP traffic through Zenmate VPN service. These IP's are within the same network with the following IP range:. Please see this link. 31.192.111.201 (talk) 21:45, 17 August 2016 (UTC)
 * Zenmate exit nodes on port 443 (both IPs). Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  14:28, 24 August 2016 (UTC)

103.43.75.100


Reason: IP traffic through Zenmate VPN service. The IP is within the same network with the following IP range:. Please see this link. 103.43.75.100 (talk) 22:08, 17 August 2016 (UTC)
 * port 443 was closed when I checked, but all other patterns indicate this is likely an exit node of Zenmate. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  14:35, 24 August 2016 (UTC)

185.9.19.66 & 185.9.19.67


Reason: Both IP's contain traffic through Zenmate VPN service, though these two IP's seem to be the only ones that are programmed within the server itself (no IP range detected here)... 185.9.19.66 (talk) 22:18, 17 August 2016 (UTC)
 * Zenmate exit nodes on port 443 (both the IPs). Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  13:55, 24 August 2016 (UTC)

69.217.73.52


Reason: Open proxy. Suspicious edits. Has been blocked in the past. 73.96.115.45 (talk) 05:06, 23 August 2016 (UTC)
 * No recent edits from the IP. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  13:21, 24 August 2016 (UTC)

89.100.41.32


Reason: Open proxy on port 9987. Suspicious edits. 73.96.115.45 (talk) 05:06, 23 August 2016 (UTC)
 * No recent edits from the IP. I quote from my earlier statement, reporting IPs with no suspicious editing patterns makes things slow and is overwhelming to proxy checkers. It is quite hard to clear the current high backlog. There are a LOT of open proxies that haven't edited Wikipedia. It is also counter productive, should we choose to check and block them all individually. To ease things a bit, I'd suggest you to henceforth report IPs that only have suspicious editing patterns. Please also consider not reporting IP ranges unless you see a pattern of editing. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  13:19, 24 August 2016 (UTC)

92.63.100.80


Reason: Don't know much about open proxy's saw this when I noticed that a user was evading a block. This says it is a confirmed proxy server. -- GB fan 20:13, 23 August 2016 (UTC)
 * Although I wasn't able to connect, I'm pretty sure this warrants for a . Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  13:15, 24 August 2016 (UTC)

195.88.208.155


Reason: Open proxy; VERY active and being used to evade block(s). Web proxy is from this service. A VERY long block duration is needed here. Regards. 208.54.5.133 (talk) 18:49, 26 August 2016 (UTC)
 * — UY Scuti <sup style="color:green; font-family:Times;">Talk  20:37, 26 August 2016 (UTC)

2604:1380:1000:6E00:0:0:0:1
Reason: http://whatismyipaddress.com/ip/2604:1380:1000:6e00::1 shows "Confirmed Proxy Server" <b style="border:1px solid #dfdfdf;color:green; padding:1px 3px;background:#FFD">Ron h jones </b>(Talk) 22:40, 30 August 2016 (UTC)

88.202.190.200


Open proxy at port 8080. --Antigng (talk) 10:11, 1 September 2016 (UTC)
 * on port 8080 (requiring authentication) . Regards— UY Scuti  <sup style="color:green; font-family:Times;">Talk  19:01, 7 September 2016 (UTC)

112.133.236.183


Reason: Suspicious edits, is blacklisted by a number of open proxy detection/spammer detection services such as Barracuda Networks. Brianhe (talk) 04:59, 2 September 2016 (UTC)
 * no open ports, all clear. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  19:08, 7 September 2016 (UTC)

37.48.86.212


Reason: Open on port 80, currently editing from the proxy just for reporting here, please see this link. 37.48.86.212 (talk) 01:50, 9 September 2016 (UTC)
 * — UY Scuti <sup style="color:green; font-family:Times;">Talk  18:43, 9 September 2016 (UTC)

108.162.245.78


Reason: Registered to CloudFlare, Inc. Web-hosting services. Open proxy. 37.48.86.212 (talk) 01:50, 9 September 2016 (UTC)
 * No recent suspicious edits — UY Scuti <sup style="color:green; font-family:Times;">Talk  18:45, 9 September 2016 (UTC)

200.72.240.130


Reason: has previously blocked this IP twice; still open on port 8080. 37.48.86.212 (talk) 02:12, 9 September 2016 (UTC)
 * No recent suspicious edits — UY Scuti <sup style="color:green; font-family:Times;">Talk  18:46, 9 September 2016 (UTC)

103.234.26.106


Reason: has previously blocked this IP; still open on port 1080. 37.48.86.212 (talk) 04:06, 9 September 2016 (UTC)
 * No recent suspicious edits — UY Scuti <sup style="color:green; font-family:Times;">Talk  18:46, 9 September 2016 (UTC)

2001:1608:10:135::e3d8:f0a8 (Range: 2001:1608::/32)


Reason: Open proxy, currently using to report the proxy, this link confirms the IPV6 /32 range. 2001:1608:10:135:0:0:E3D8:F0A8 (talk) 23:14, 12 September 2016 (UTC)

91.108.68.215 (Range: 91.108.64.0/19)


Reason: IPV4 traffic of the IPV6 report made above. this link confirms the IPV4 /19 range. 2001:1608:10:135:0:0:E3D8:F0A8 (talk) 23:14, 12 September 2016 (UTC)

108.161.136.29


Reason: Open proxy through 0xproxy. 108.161.136.29 (talk) 23:58, 12 September 2016 (UTC)
 * Blocked. Materialscientist (talk) 10:40, 16 September 2016 (UTC)

195.154.126.106


Reason: Open proxy through europroxy.pw and 8proxy.space. 172.58.40.148 (talk) 00:40, 13 September 2016 (UTC)
 * Blocked. Materialscientist (talk) 10:38, 16 September 2016 (UTC)

103.11.78.21


Reason: Open proxy server at this web proxy hosting site. Mobile web-browser hosting. 2607:FB90:A62C:37CC:0:20:D6D8:B101 (talk) 02:37, 15 September 2016 (UTC)

188.61.207.58


Reason: Suspicious edits. Open on port 1024. 172.56.38.131 (talk) 04:12, 16 September 2016 (UTC)

92.98.150.82


Reason: Suspicious edits. Open on port 1024. 172.56.38.53 (talk) 04:18, 16 September 2016 (UTC)

2.136.129.12


Reason: Suspicious edits. 172.56.38.53 (talk) 04:18, 16 September 2016 (UTC)
 * no open ports, nothing suspicious. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  16:00, 15 October 2016 (UTC)

24.141.6.209


Reason: Suspicious edits. Lord Sjones23 (talk - contributions) 05:14, 16 September 2016 (UTC)
 * Closed ports, I don't smell open proxy here. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  15:45, 15 October 2016 (UTC)

2.216.30.87


Reason: Suspicious edits. 73.96.115.3 (talk) 00:02, 17 September 2016 (UTC)
 * everything looks clear. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  15:36, 15 October 2016 (UTC)

196.40.43.74


UNBLOCK: IP is no longer an open proxy, in fact, I don't even think it ever was an open proxy based on it's WHOIS credentials... 73.96.114.205 (talk) 23:01, 24 September 2016 (UTC)
 * Although it's closed now, I'm not convinced (Have a look at this list). However, the indef on this IP needs to be modified to something temporary. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  08:04, 25 September 2016 (UTC)


 * The IP address certainly has been in use as an open proxy, over a period extending from many years ago to this month. I don't know how anyone can possibly reach the conclusion that an IP address is unlikely ever to have hosted an open proxy "based on it's [sic] WHOIS credentials". As for replacing the indefinite block with a limited one, the reason for IP addresses not usually being blocked indefinitely is that their use may change, but considering the fact that this one's use has not changed in well over a decade, and that it is known to have hosted an open proxy at intervals covering the whole of that period, the likelihood that it's going to change within some arbitrary number of years that we choose is much lower than the likelihood that if the block ends it will still be hosting an open proxy. The editor who uses the pseudonym "JamesBWatson" (talk) 11:10, 26 September 2016 (UTC)
 * Fair enough. I've closed the request as unblocking is not possible at this time. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  16:23, 28 September 2016 (UTC)

199.212.86.0/23


Range appears to be used by HexaTech VPN. Please investigate this claim! Thank you. 199.212.86.23 (talk) 22:26, 3 October 2016 (UTC)

Reason: Suspicious edits
 * Why do you think so? Any suspicious edits, particular IPs? I see a lot of legitimate edits. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  15:27, 15 October 2016 (UTC)
 * Pinging Gilliam, as they have blocked the individual IP (199.212.86.23) for two years. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 18:38, 22 October 2016 (UTC)
 * I will unblock and let the investigation run its course.– Gilliam (talk) 20:39, 22 October 2016 (UTC)
 * Note: Suspicious IP's include: & . 2601:1C0:4401:F360:4057:B87:4A96:758B (talk) 01:23, 26 October 2016 (UTC)

Individual IPs can be blocked as necessary. The range also has a lot of legitimate edits and I'm not seeing the need to implement a block at this range despite the range being allocated to a webhost provider. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  17:47, 29 October 2016 (UTC)

81.30.116.103


Reason: Confirmed open proxy. Please see this link. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 02:20, 19 October 2016 (UTC)
 * no recent suspicious edits. Before submitting, please see if the criteria for block requests has been met (The IP has made abusive contributions within the past week). Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  06:08, 23 October 2016 (UTC)

118.192.145.99


Reason: Confirmed open proxy. Please see this link. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 02:20, 19 October 2016 (UTC)
 * no recent suspicious edits. Before submitting, please see if the criteria for block requests has been met (The IP has made abusive contributions within the past week). Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  14:18, 23 October 2016 (UTC)

218.248.73.193


Reason: Confirmed open proxy. Please see this link. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 02:20, 19 October 2016 (UTC)
 * no recent suspicious edits. Before submitting, please see if the criteria for block requests has been met (The IP has made abusive contributions within the past week). Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  14:20, 23 October 2016 (UTC)

204.52.135.204 (Range: 204.52.135.0/24)


Reason: Suspicious edits. Registered to SurfEasy Inc. I put the range here just in case if the patrolling admin decides to implement the rangeblock, per the WHOIS credentials. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 18:31, 22 October 2016 (UTC)
 * belongs to SurfEasy VPN. Please block the range as . Regards— UY Scuti  <sup style="color:green; font-family:Times;">Talk  14:43, 23 October 2016 (UTC)

85.195.76.173 (Range: 85.195.64.0/18)


Reason: Suspicious edits. Registered to SurfEasy Inc. I put the range here just in case if the patrolling admin decides to implement the rangeblock, per the WHOIS credentials. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 18:31, 22 October 2016 (UTC)
 * — UY Scuti <sup style="color:green; font-family:Times;">Talk  17:49, 29 October 2016 (UTC)

162.253.131.187 (Range: 162.253.128.0/22)


Reason: Suspicious edits. The IP range listed above has already been blocked once for two years, by administrator Elockid. I put the range here just in case if the patrolling admin decides to implement the rangeblock, per the WHOIS credentials. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 18:31, 22 October 2016 (UTC)
 * Please block the IP as . Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  18:05, 29 October 2016 (UTC)

195.154.0.0/16


Reason: Open proxy IP range, highly used, previous 2 year block by Elockid has now expired. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 23:23, 22 October 2016 (UTC)
 * Please block the range as a — UY Scuti <sup style="color:green; font-family:Times;">Talk  18:22, 29 October 2016 (UTC)

62.232.195.130 (Range: 62.232.195.0/24)


Reason: Suspicious edits. Registered to Donhost webhosting services. I put the range here just in case if the patrolling admin decides to implement the rangeblock, per the WHOIS credentials. 2601:1C0:4401:F360:4057:B87:4A96:758B (talk) 23:00, 23 October 2016 (UTC)
 * please block the IP as . Regards — UY Scuti <sup style="color:green; font-family:Times;">Talk  20:02, 29 October 2016 (UTC)

49.213.19.85 (Range: 49.213.16.0/21)


Reason: Suspicious edits. Registered to OneAsiaHost webhosting services. I put the range here just in case if the patrolling admin decides to implement the rangeblock, per the WHOIS credentials. 2601:1C0:4401:F360:4057:B87:4A96:758B (talk) 00:56, 27 October 2016 (UTC)
 * please block the IP as . Regards — UY Scuti <sup style="color:green; font-family:Times;">Talk  20:34, 29 October 2016 (UTC)

5.104.175.107 (Range: 5.104.175.0/24)


Reason: Suspicious edits. Registered to BelCloud Hosting Cooperation webhosting services. I put the range here just in case if the patrolling admin decides to implement the rangeblock, per the WHOIS credentials. 2601:1C0:4401:F360:4057:B87:4A96:758B (talk) 03:49, 28 October 2016 (UTC)
 * CGI proxy — UY Scuti <sup style="color:green; font-family:Times;">Talk  20:13, 29 October 2016 (UTC)

2604:3400:dc1:43:216:3eff:fe6b:497f


Reason: Suspicious edits. Likely a sock of a recently blocked or topic banned user.- MrX 04:24, 7 November 2016 (UTC)
 * Blocked by DoRD. 2601:1C0:105:5C39:CD59:D092:A125:48F6 (talk) 01:13, 7 December 2016 (UTC)

104.254.215.90


Reason: Suspicious edits. Registered to Power Up Hosting, Inc. Yinf (talk) 22:55, 12 November 2016 (UTC)
 * Blocked by Materialscientist. 2601:1C0:2:3207:F9C4:CC2A:EB:3760 (talk) 00:26, 16 November 2016 (UTC)

45.115.25.68


Reason: Suspicious edits (spamming Binary options) & WHOIS shows this is a Korean cloud hosting service known as SoftLayer. - Brianhe (talk) 00:41, 15 November 2016 (UTC)
 * I scanned that one earlier when I saw the spam at binary options (and the pattern of the last few IPs adding that link). No proxies, open ports or recent logs of abuse in the usual places. Something up there; I just can't see it. Kuru   (talk)  02:26, 15 November 2016 (UTC)
 * This is a webhost cloud server (not necessarily a single open proxy IP, which is still grounds for a block per WP:NOP. Should probably be blocked. 2601:1C0:102:E3E:A86E:8F4:1AB6:CDC (talk) 04:01, 30 November 2016 (UTC)
 * Callanecc (talk • contribs • logs) 10:26, 19 October 2017 (UTC)

185.24.68.67 (Range: 185.24.68.0/22)


Reason: Suspicious edits. Registered to SurfEasy VPN, which is a webhost service. I put the range here just in case if the patrolling admin decides to implement the rangeblock, per the WHOIS credentials. 2601:1C0:2:3207:F9C4:CC2A:EB:3760 (talk) 00:26, 16 November 2016 (UTC)
 * -- zzuuzz (talk) 21:40, 19 November 2016 (UTC)

89.46.102.15


Reason: sockpuppetry. Please see Sockpuppet investigations/Internetwikier. Ivanvector (Talk/Edits) 21:28, 19 November 2016 (UTC)
 * . It's certainly a web server. I've colo-blocked the /24. -- zzuuzz (talk) 21:32, 19 November 2016 (UTC)

212.7.221.180 (Range: 212.7.221.0/24)


Reason: Suspicious edits. Appears to be registered to this dedicated server. The IP range appears to be. 2601:1C0:109:2557:11F8:BEF8:160B:24CC (talk) 06:12, 25 November 2016 (UTC)
 * Self-closing, the /24 range is already blocked by DeltaQuad. 71.237.141.40 (talk) 06:16, 25 November 2016 (UTC)

IP 14.139.183.220


Reason: whatismyipaddress.com notes that it is a confirmed proxy server, while I know their word isn't gospel, and this doesn't mean that it's an open proxy, I'm curious if it is. An IP-hopping user from India appears to be using it to perpetuate an edit war, as can be seen here throughout November 2016. Thanks, Cyphoidbomb (talk) 00:56, 27 November 2016 (UTC)
 * There are a few open ports, but it's unlikely requests are redirected. The range <tt>14.139.183.208/28</tt> is allocated to C-DAC Thiruvananthapuram, a scientific society of the government of India. I also checked the other IPs that have edited the article in November. All of them belong to the range <tt>111.92.0.0/17</tt>, allocated to the ISP Asianet Communications from the same geolocation and probably dynamic. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  07:59, 27 November 2016 (UTC)
 * Thanks for looking into it. Cyphoidbomb (talk) 22:07, 29 November 2016 (UTC)

199.212.87.98 (Range: 199.212.86.0/23)


Reason: Suspicious edits. Registered to Power Up Hosting. Included the range, too. 2607:FB90:A51A:3F75:0:48:261E:FB01 (talk) 17:18, 29 November 2016 (UTC)
 * Globally blocked. 2601:1C0:10D:8D92:CD59:D092:A125:48F6 (talk) 01:10, 7 December 2016 (UTC)

168.244.11.44


Reason: clear sockpuppetry by a user who nearly always geolocates to Toronto, Canada. This IP belongs to Lowe's and geolocates to North Carolina. Ivanvector (Talk/Edits) 17:58, 30 November 2016 (UTC)
 * Lowe's (see article for more detail) is a retail and appliance store. Not a proxy or web hosting service. 2607:FB90:A757:51B9:0:4B:4B30:8901 (talk) 19:13, 30 November 2016 (UTC)
 * Okay, maybe I'm in the wrong place. I know Lowe's is a hardware store (they're in Canada too) but I think it's unlikely that a user who's been in Toronto for 9 months would be suddenly on a store's computer system in North Carolina, so it feels like a spoofed IP or hacked VPN or some such. It's quite likely I just don't know what I'm talking about. Ivanvector (Talk/Edits) 19:32, 30 November 2016 (UTC)
 * No, probably the right place.. Looking at the SPI it would just as unusual for them to use an open proxy as it would be for them to edit from the US. I also notice the IP geolocates to the same place as Lowe's headquarters, so the stores might funnel all store traffic through there, or the geolocation sites might not know where else to place it. Suspicious previous edits. However I'm not seeing anything immediately suggestive of an open proxy. -- zzuuzz (talk) 19:49, 30 November 2016 (UTC)
 * Callanecc (talk • contribs • logs) 10:27, 19 October 2017 (UTC)

116.228.82.194


Reason: Suspicious edits. Many disruptive edits from "CHINANET" IP addresses, ProceeBot often blocks IP's from this ISP. Well for example, which was just blocked minutes ago... Open on ports 22 and 443. 2601:1C0:102:B7:1511:5911:F6C6:FF50 (talk) 06:48, 3 December 2016 (UTC)
 * Jezebel's Ponyo bons mots 23:42, 6 December 2016 (UTC)

202.69.12.0/24


Reason:unblock request. this ip is range is blocked from long time and now must unblock. — Preceding unsigned comment added by John CS (talk • contribs)
 * This is a checkuser block and not a proxy block, so deferred to the blocking admin to take a real close look at this request. -- zzuuzz (talk) 11:04, 6 December 2016 (UTC)
 * It is not an open proxy. Rather, we have at least three prolific sockmasters operating from this range. The rangeblock is necessary to stop them from creating the dozens of new accounts they've been using to cause some pretty serious disruption and use of resources. Additionally, it's only been blocked since November 3 of this year, and I wouldn't call that a long time. Katietalk 11:48, 6 December 2016 (UTC)
 * Welp, it looks like was just another sock that was abusing this IP range in the first place, now blocked by DoRD. 2601:1C0:10D:8D92:6177:2722:C0EF:15C3 (talk) 01:08, 7 December 2016 (UTC)

210.211.122.214


Geolocate data says this ip is in Ho Chi Min City and is a suspected network sharing device. Beeblebrox (talk) 23:32, 6 December 2016 (UTC)

Reason: Suspicious edits
 * . Torguard outlet node on port 993; cheap anonymous proxy service.  Kuru   (talk)  23:38, 6 December 2016 (UTC)

198.135.124.219 (Range: 198.135.124.0/23)


Reason: Suspicious edits. Registered to "Blue Coat Systems, Inc". Webhost service. 2601:1C0:10D:8D92:6177:2722:C0EF:15C3 (talk) 01:06, 7 December 2016 (UTC)
 * providing cloud security. Might provide access to some of its clients, but not an open proxy, no open ports. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  03:47, 7 December 2016 (UTC)

77.234.40.145 (Range: 77.234.40.0/24)


Reason: Suspicious edits. Check the edit filter log entries for this IP for their most recent edits. Webhosting cloud service "Avast". 73.96.115.2 (talk) 01:54, 7 December 2016 (UTC)
 * Ditto, but Avast in this case. No open ports/proxy. Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  03:57, 7 December 2016 (UTC)

199.85.208.19 (Range: 199.85.208.0/21)


Reason: Registered to MegaProxy.com. Highly visible proxy server. The /21 range specified above has been previously blocked before. 2601:1C0:10D:5E68:107A:41A1:58F4:7F73 (talk) 05:40, 8 December 2016 (UTC)
 * Callanecc (talk • contribs • logs) 10:32, 19 October 2017 (UTC)

168.132.10.250


Reason: Suspicious edits - MrX 16:41, 8 December 2016 (UTC)
 * Looks like a closed proxy used by Air Services Australia. Callanecc (talk • contribs • logs) 10:33, 19 October 2017 (UTC)

137.74.1.203


Reason: Suspicious rDNS: service.brought.to.you.by.uk7.org – 🐈? (talk) 20:28, 8 December 2016 (UTC)
 * -- zzuuzz (talk) 20:33, 8 December 2016 (UTC)

219.159.82.26
{{proxycheckstatus}close}}

Reason: Suspicious edits. Another "CHINANET" open proxy, see report for 116.228.82.194 above, which was blocked by Ponyo. 2601:1C0:104:51C4:915F:9EAD:1324:BC92 (talk) 23:41, 8 December 2016 (UTC)
 * Callanecc (talk • contribs • logs) 10:34, 19 October 2017 (UTC)

82.211.251.51


Reason: Suspicious, disruptive edits. Possibly related to this banned sockpuppet. Cathexis1349 (talk) 09:30, 9 December 2016 (UTC)
 * Callanecc (talk • contribs • logs) 10:35, 19 October 2017 (UTC)

80.153.74.209


Reason: Suspicious, disruptive edits. Possibly related to this banned sockpuppet.Cathexis1349 (talk) 09:30, 9 December 2016 (UTC)
 * Callanecc (talk • contribs • logs) 10:35, 19 October 2017 (UTC)

87.244.181.185


Reason: Highly visible proxy server. Open on port 8080. 87.244.181.185 (talk) 01:03, 12 December 2016 (UTC)
 * -- samtar talk or stalk 14:44, 12 December 2016 (UTC)

202.106.16.36


Reason: Highly visible proxy server. Open on port 3128. 202.106.16.36 (talk) 01:09, 12 December 2016 (UTC)
 * -- zzuuzz (talk) 18:04, 12 December 2016 (UTC)

122.248.121.184

 * Reason: Highly visible proxy server. Open on port 8080. 122.248.121.184 (talk) 04:50, 13 December 2016 (UTC)
 * Callanecc (talk • contribs • logs) 10:38, 19 October 2017 (UTC)

110.77.215.181

 * Reason: Highly visible proxy server. Open on port 8080. Note: The proxy/port to access this IP is 122.154.71.49:8080 but 110.77.215.181 is the external IP node, which is the one that should be blocked. 110.77.215.181 (talk) 05:03, 13 December 2016 (UTC)
 * Callanecc (talk • contribs • logs) 10:38, 19 October 2017 (UTC)

104.238.64.0/18


Reason: Suspicious edits. Registered to GoDaddy. Often used by the LTA sandbox vandal. 2601:1C0:104:9A47:2C4F:1095:CDC4:24CD (talk) 23:52, 15 December 2016 (UTC)
 * Callanecc (talk • contribs • logs) 10:38, 19 October 2017 (UTC)

178.18.201.95 and 178.18.201.96/27


Reason: I want you to take note of that whois. "Avast Software Servers". Now, we can note that some of these IPs seem to all have odd, vandal behavior. However, Avast, an antivirus company, seems like an odd AS for that behavior. After doing some research, I quickly found out Avast hosts a VPN! And guess what: one of the locations they list is Istanbul, which is of course, in Turkey. I didn't go looking for the other ranges they might have because I didn't know if things like this would get blocked, but I thought I might as well try. – 🐈? (talk) (ping me!) 02:33, 18 December 2016 (UTC)
 * Note: I recently made a request that was also registered to "Avast", [see report for 77.234.40.145 (Range: 77.234.40.0/24)], and it was declined by UY Scuti. I guess "cloud security" services don't necessarily mean webhosts and/or VPN's. 2601:1C0:103:C62:648B:E102:9265:E802 (talk) 04:27, 20 December 2016 (UTC)
 * Callanecc (talk • contribs • logs) 10:38, 19 October 2017 (UTC)

192.168.100.1


Reason: Requested unblock.
 * . This is a private IP address. Please list the public IP address if you want it looked at. -- zzuuzz (talk) 14:30, 18 December 2016 (UTC)
 * The IP that they used to make this report was . Maybe that was what they wanted to be looked at? 73.96.113.71 (talk) 04:22, 20 December 2016 (UTC)

142.234.73.104


Reason: Suspicious edits. Registered here. 2601:1C0:10C:CF1C:9CB2:BA23:5AA4:2F1F (talk) 04:20, 20 December 2016 (UTC)
 * Callanecc (talk • contribs • logs) 10:45, 19 October 2017 (UTC)

103.52.134.18


Reason: Suspicious edits. Although whatismyipaddress.com isn't as accurate, but it is claimed to be a confirmed proxy server, if not that it is a shared IP of some sort... 2601:1C0:10D:7EEA:C01A:87C:FE3B:8846 (talk) 06:32, 20 December 2016 (UTC)
 * Callanecc (talk • contribs • logs) 10:45, 19 October 2017 (UTC)

173.227.74.5


Reason: Suspicious edits. Registered to HostGator. 2601:1C0:105:DE17:6973:298F:C092:ED0B (talk) 16:19, 20 December 2016 (UTC)
 * Not enough recent edits to worry about it this time. Callanecc (talk • contribs • logs) 10:47, 19 October 2017 (UTC)

80.72.94.177


Reason: Suspicious edits. 176.54.93.202 (talk) 19:32, 27 December 2016 (UTC)
 * Callanecc (talk • contribs • logs) 10:41, 19 October 2017 (UTC)

59.46.158.164


Reason: Suspicious edits. "CHINANET" proxy. 2601:1C0:106:17FE:D5AF:4387:5D5F:D086 (talk) 03:54, 29 December 2016 (UTC)
 * Callanecc (talk • contribs • logs) 10:42, 19 October 2017 (UTC)

104.153.108.126 (Range: 104.153.108.0/24)


Reason: Suspicious edits. The entire range listed above is also webhosting service as well. 2601:1C0:10D:BF57:953B:1A26:5126:7B57 (talk) 04:39, 1 January 2017 (UTC)
 * Callanecc (talk • contribs • logs) 10:43, 19 October 2017 (UTC)

199.102.97.236 (Range: 199.102.96.0/21)


Reason: Suspicious edits. The entire range is registered to Transvision Reseau webhosting services. 172.56.42.77 (talk) 18:30, 2 January 2017 (UTC)
 * Callanecc (talk • contribs • logs) 10:48, 19 October 2017 (UTC)

77.51.77.191


Reason: Suspicious edits on jawp.--HotKorokke (talk) 23:21, 2 January 2017 (UTC)
 * . Sorry, I don't see anything open. Kuru   (talk)  00:05, 3 January 2017 (UTC)

5.12.50.68


Reason: Suspicious edits. The proxy is from "Romania" and its contributions reminds a sockmaster banned last year. Please check. 46.221.187.97 (talk) 23:55, 7 January 2017 (UTC)
 * . Sorry, nothing odd. It's not clear which sockmaster you're referring to, so I can't help you follow up. Kuru   (talk)  00:54, 20 January 2017 (UTC)

209.87.206.17


Reason: Suspicious edits. Webhost/cloud server. Lots of long-term issues with this IP address, many warnings on their talkpage. 2601:1C0:102:B2A0:6B:B5FF:C620:7D13 (talk) 23:23, 10 January 2017 (UTC)
 * . Nothing fishy. As you note, the ISP bills as a webhost, but they also provide other services. One other administer notes it may be a school on a leased line.  Kuru   (talk)  00:47, 20 January 2017 (UTC)

64.94.31.206


Reason: Suspicious edits, Geolocate says "Confirmed proxy server". Beyond My Ken (talk) 15:18, 18 January 2017 (UTC)
 * . Just one open port that looks like it is allowing only specific clients to connect. The "proxy" annotation on the geolocate summary is just noting that it acts as a connection point for other clients. In this case, the most likely function is what is shown on the talk page - it's an exit point for a bunch of wi-fi services on trains. Kuru   (talk)  12:37, 19 January 2017 (UTC)

159.180.16.2


Reason: A variety of near death threats and abusive behavior at Talk:Chelsea Manning, e.g., [], started at 130.211.161.255, hopped after block to 159.180.16.2 (which geolocate says is a confirmed proxy), after block complained with dubious innocence on my talk page from 123.30.130.215, which is also marked as a confirmed proxy by geolocate. Request open proxy checks on the latter two addresses. Note the diff I gave has been revdel'd and may end up oversighted. --joe deckertalk 06:05, 19 January 2017 (UTC)


 * You might also want to look at 191.234.183.150. This ties into the above thread through my talk page (edited by .215) and the edits by .150 at Rosalind Franklin, and the timing, of course. --joe deckertalk 06:31, 19 January 2017 (UTC)
 * . All of these are confirmed and blocked. Kuru   (talk)  12:24, 19 January 2017 (UTC)

115.249.229.41


Reason: Harassment related to previous request. Geolocate calls it a confirmed proxy. (I've done a short term block there, but if this is an open proxy you'll want to lengthen it.) --joe deckertalk 15:18, 19 January 2017 (UTC)
 * . Si, wide open squid proxy on 3128. Extended the block. Kuru   (talk)  00:39, 20 January 2017 (UTC)

49.213.19.133


Reason: Suspicious edits
 * This IP address is currently used by SurfEasy, you guys might want to block it due to it being an open VPN. --49.213.19.133 (talk) 22:55, 23 January 2017 (UTC)
 * See http://oneasiahost.com. See the Whois. It appears to me that there should be a webhost block of, intended to cover 49.213.16.0 - 49.213.19.255. EdJohnston (talk) 03:34, 24 January 2017 (UTC)
 * Note: Report copied here from WP:ANI. I am planning to do the /22 as a webhost block unless someone here can advise me that it's not appropriate. This Robtex shows that there are a lot of websites hosted in the range. Is it possible that something wider than the /22 could be appropriate? Thanks, EdJohnston (talk) 04:11, 24 January 2017 (UTC)
 * ✅ SQL <sup style="font-size: 5pt;color:#999">Query me!  04:15, 24 January 2017 (UTC)
 * I can't test the entire range, but that one is certainly Opera Proxy, presumably SurfEasy - the service makes no attempt to obscure its ID. Kuru   (talk)  00:38, 25 January 2017 (UTC)

162.211.122.69


Reason: I'm on SurfEasy VPN right now and I'm unblocked. --162.211.122.69 (talk) 21:44, 24 January 2017 (UTC)
 * Found another one right after. --185.80.220.40 (talk) 21:45, 24 January 2017 (UTC)
 * Confirmed both, Mr. Scientist beat me to the blocks. Kuru   (talk)  00:50, 25 January 2017 (UTC)

146.0.229.30


Reason: I'm on a SurfEasy VPN right now and unblocked. 146.0.229.30 (talk) 15:27, 26 January 2017 (UTC)
 * Personally confirmed and blocked -- Samtar talk &middot; contribs 16:09, 27 January 2017 (UTC)

117.102.10.98


Someone from that IP address argues that while it might have been an open proxy back in December, it no longer is. My own rather primitive attempts at verification have yielded mixed results. Someone more experienced than me, possibly Ponyo, may want to take another look. Huon (talk) 14:43, 27 January 2017 (UTC)


 * Seeing elements suggesting this is still an open proxy or webhost
 * Ports 22 (SSH), 8080 (HTTP), 10000 open
 * SSH reports version `OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.6 (Ubuntu Linux; protocol 2.0)`
 * HTTP reports `Squid http proxy 3.3.8`
 * 10000 reports `MiniServ 1.810 (Webmin httpd)` (AKA http://www.webmin.com/)
 * -- Samtar talk &middot; contribs 16:05, 27 January 2017 (UTC)
 * My results are the same as Samtar's, showing open ports on 22 and 8080.-- Jezebel's Ponyo bons mots 17:02, 27 January 2017 (UTC)
 * and, sorry, but open ports does not mean open proxy. I was not able to connect to any of the open ports. Besides, the allocation does not belong to a webhosting company. WikiProject on open proxies/Guide to checking open proxies says, "..A common mistake is to block a legitimate closed caching proxy as an open proxy, simply because it has ports open." Regards— UY Scuti <sup style="color:green; font-family:Times;">Talk  17:50, 27 January 2017 (UTC)
 * In addition to the ports being open, the IP was being used for vandalism and socking, which is how it came to my attention in the first place (via Checkuser). I've tentatively unblocked for now.-- Jezebel's Ponyo bons mots 18:03, 27 January 2017 (UTC)
 * Ugh. I ran a few scans earlier, but had to step away before I could post anything. Generally had the same results as Mr. Scuti. The server is owned by a school - University of Management and Technology, Lahore. The IP does show up on a few range blacklists, but that may be due to the location. There is a squid (usually caching) proxy on an open port (8080). It looks like it is locked now; I can't connect to it (I get a 403 or access denied boilerplate). This does not mean it wasn't open in the past, or that someone wasn't connecting and using it abusively, which Ponyo's checkuser pixie dust seems to confirm. Note that sometimes these proxies only work on a limited set of targets - the squid on 115.249.229.41:3128 (a few reports up) was and is an open squid proxy that lets me edit wikipedia, but denies imdb. Go figure. This is one of those fuzzy ones; maybe spot check it from time to time. Kuru   (talk)  18:23, 27 January 2017 (UTC)
 * Interesting one that. Open proxy allows only SSL requests and blocks non-SSL requests (includes imdb). And the funny part, request a non-SSL website and you get access denied with weird reasons. The URL I requested was categorized as "Japanese pornography", I can assure it was not what I requested— UY Scuti <sup style="color:green; font-family:Times;">Talk  18:48, 27 January 2017 (UTC)

190.10.8.6


Reason: Suspicious edits Sro23 (talk) 02:53, 3 September 2017 (UTC)
 * This proxy has been used by multiple sockmasters, including, , and . for 2 years. GABgab 23:49, 4 September 2017 (UTC)

66.11.122.109, 103.75.116.125, 216.230.226.42


Reason: Adding promotion for Ismael Ogando (see Sockpuppet investigations/Cocainaenvenenada) on Ezili Dantor (,, ; it's a fake source, added only to get Ogando's name into the article), like many socks before them (see page history of article), a sockpuppeteer whose known geolocation is Berlin, Germany, and who is also known to have used proxies before (a proxy they had used was blocked earlier today...). While these IPs geolocate to other continents, in spite of making one of the sockmaster's signature edits. - Tom &#124; Thomas.W talk 23:44, 13 September 2017 (UTC)
 * All blocked. GABgab 23:51, 13 September 2017 (UTC)

216.218.131.143, 191.101.12.120, 51.15.136.216


Reason: More Cocainaenvenenada/Ismael Ogando (see above), making Cocainaenvenenada's/Ogando's signature edits on their favourite targets but geolocating to somewhere other than where the sockmaster lives. Another IP used by him today (Special:Contributions/193.182.144.88) has already been blocked as a proxy by. - Tom &#124; Thomas.W talk 10:29, 14 September 2017 (UTC)
 * Reblocked the .143. GABgab 18:28, 14 September 2017 (UTC)

103.75.116.120, 217.64.127.113


Reason: Two more Cocainaenvenenada. They both posted on my talk page yesterday, in a thread started by Cocainaenvenenada/Ogando, and might be meat, but are most probably Ogando himself using proxies. - Tom &#124; Thomas.W talk 19:25, 14 September 2017 (UTC)
 * Blocked. GABgab 19:59, 14 September 2017 (UTC)

185.212.170.103


Reason: abusive edits coming from European IPs by a user likely located in California. Ivanvector (Talk/Edits) 14:06, 16 September 2017 (UTC)
 * Extended their block, since they're obvious proxies. GABgab 15:16, 16 September 2017 (UTC)

162.212.152.103


Reason: IP geolocating to the US but used by obvious sock of Sockpuppet investigations/Bosnipedian (who geolocates to Sarajevo, Bosnia). - Tom &#124; Thomas.W talk 13:11, 17 September 2017 (UTC)
 * Blocked 3 months for block evasion, but still worthy of a check. - Tom &#124; Thomas.W talk 17:08, 17 September 2017 (UTC)
 * (re-blocked). -- zzuuzz (talk) 13:08, 23 September 2017 (UTC)

185.92.24.44


Reason: related to the request above for 185.212.170.103, clearly the same user still on a closely related subnet. Ivanvector (Talk/Edits) 12:30, 23 September 2017 (UTC)
 * rangeblocked (/24) -- zzuuzz (talk) 13:06, 23 September 2017 (UTC)

216.126.225.254


Reason: Another sock of Sockpuppet investigations/Cocainaenvenenada. An IP geolocating to California making the sockmasters signature edit on Vusamazulu Credo Mutwa (see page history). Cocainaenvenenada geolocates to Berlin, Germany, but almost a dozen open proxies in other countries were blocked as socks of his not long ago (see a number of previous reports here), so using open proxies is nothing new. - Tom &#124; Thomas.W talk 12:52, 23 September 2017 (UTC)
 * by Widr. -- zzuuzz (talk) 13:04, 23 September 2017 (UTC)

203.112.76.74


Reason: As of 24 Sep 2017, is being used for editwarring and other disruption on several articles. These edits are evidently part of a pattern involving a blocked user using more than one open proxy. IP address itself appears on several lists titled "Free Bangladesh proxy". Guliolopez (talk) 22:24, 24 September 2017 (UTC)
 * by Zzuuzz. GABgab 22:40, 25 September 2017 (UTC)

62.12.114.214


Reason: The IP has been used by Sockpuppet investigations/PavelStaykov (the edits about Bulgarians), but has also been used for childish vandalism, which I've never seen from Staykov, the geolocation (Nairobi, Kenya) also matches neither Staykov nor the other edits, making me believe it's an open proxy, one of many in that country it seems. It's currently blocked for three months, but if it is an open proxy it ought to get a longer block. - Tom &#124; Thomas.W talk 18:57, 27 September 2017 (UTC)
 * 6 months. GABgab 22:38, 27 September 2017 (UTC)

109.185.139.177


Reason: Suspicious edits. Reported for edit warring at Sinn Féin at WP:AN3. Previously blocked two months by User:ProcseeBot as an open proxy, port 53281. EdJohnston (talk) 03:15, 5 October 2017 (UTC)
 * port 62225 confirmed (highly variable). I'll just extend the block a bit. -- zzuuzz (talk) 03:22, 5 October 2017 (UTC)

27.131.175.126


Reason: Suspicious edits. IP's host is a clear indicator of a VPN. 172.56.39.241 (talk) 03:20, 1 February 2017 (UTC)
 * My suspicion is that it's actually a closed VPN/proxy network. Callanecc (talk • contribs • logs) 10:53, 19 October 2017 (UTC)

83.143.27.122


Reason: Suspicious edits. IP's host is a clear indicator of a VPN. 172.56.39.241 (talk) 05:33, 1 February 2017 (UTC)
 * . My suspicion is that it's actually a closed VPN/proxy network. Callanecc (talk • contribs • logs) 10:54, 19 October 2017 (UTC)

210.212.148.38


Reason: Spotted vandalism here, looked them up here and saw the hostname indicates a proxy of some kind. Thanks. Cyphoidbomb (talk) 19:11, 2 February 2017 (UTC)
 * There is an open squid cache proxy on 3128, but it looks secured (password challenged). This looks like a college proxy for Indian Institute of Information Technology, Design and Manufacturing, Jabalpur; it's a proxy for school traffic. I'd just "schoolblock" it if problems persist. Kuru   (talk)  03:56, 3 February 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:15, 21 October 2017 (UTC)

27.151.195.131


Reason: Suspicious edits. Clearly the LTA flag vandal. They will almost definitely return after the short block... 172.58.41.13 (talk) 03:33, 3 February 2017 (UTC)
 * . Sorry, I don't see anything odd. Kuru   (talk)  03:42, 3 February 2017 (UTC)

2.50.39.9


Reason: Blocked proxy; host offline unable to verify if this is IP is still a proxy or concern. Looking for guidance on this IP. — Preceding unsigned comment added by Dane (talk • contribs)
 * The host appears to be up and I can't connect to the port ProxseeBot identified. I don't see anything else open. What concerns do you have? Kuru   (talk)  12:41, 8 February 2017 (UTC)
 * No further concerns. This can be closed. --  Dane  talk  21:51, 10 February 2017 (UTC)

206.225.83.234


Reason: Suspicious edits. Possible webhosting service. 172.58.41.122 (talk) 01:16, 9 February 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:17, 21 October 2017 (UTC)

207.154.193.38


Reason: Suspicious edits. Digital Ocean webhosting services. 172.58.40.66 (talk) 01:43, 10 February 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:18, 21 October 2017 (UTC)

86.96.201.69


Reason: Suspicious edits. Long block log of proxy blocks. Most recent edits can be found in the edit filter log. 172.58.41.58 (talk) 18:40, 10 February 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:19, 21 October 2017 (UTC)

199.58.85.239 (Range: 199.58.84.0/22)


Reason: Suspicious edits. Webhosting service. The /22 range is the network used. 172.58.40.51 (talk) 00:50, 14 February 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:19, 21 October 2017 (UTC)

12.4.17.3 (Range: 12.4.17.0/24)


Reason: Suspicious edits. Registered VPN service. 172.58.40.139 (talk) 17:54, 14 February 2017 (UTC)
 * Looks like it's a closed proxy for the AFL-CIO. Callanecc (talk • contribs • logs) 05:20, 21 October 2017 (UTC)

79.101.145.204


Reason: Suspicious edits. 172.58.41.131 (talk) 18:48, 16 February 2017 (UTC)
 * or not anymore at least. Callanecc (talk • contribs • logs) 05:21, 21 October 2017 (UTC)

162.221.202.16 (Range: 162.221.200.0/21)


Reason: Suspicious edits. Registered VPN service. 172.58.41.30 (talk) 03:45, 21 February 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:22, 21 October 2017 (UTC)

202.74.160.30 (Range: 202.74.160.0/19)


Reason: Suspicious edits. The /19 range includes the entire webhost service. 172.58.40.170 (talk) 04:36, 24 February 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:24, 21 October 2017 (UTC)

62.201.211.76


Reason: Suspicious edits. Open on port 8080. (Note: I was testing the connection of this proxy yesterday and made some edits with it...) 172.58.40.173 (talk) 23:25, 27 February 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:25, 21 October 2017 (UTC)

8.37.225.0/24


Reason: Requested unblock at User talk:8.37.225.78. עוד מישהו Od Mishehu 06:46, 5 March 2017 (UTC)
 * Not sure on this one. This is a "web acceleration" service, Quantil, formerly known as Mileweb. All kinds of shady practices there, but some real products use them as well (accelerated mobile web browsers, etc). There are actually two independent range blocks, both triggered by someone using the service poorly. I would not recommend unblocking; the "hard" range block expires in a few weeks, they can create an account then, or simply turn off their accelerator/connect with another service. Kuru   (talk)  14:30, 5 March 2017 (UTC)

146.247.0.0/16


Reason: Requested unblock at User talk:146.247.83.91. עוד מישהו Od Mishehu 06:51, 5 March 2017 (UTC)
 * . The individual IP looks like part of a regular ISP. As the requester notes, it does belong to Universal Broadband, leased through AllTele. Looks like the original range block was targeting abusive edits from 146.247.25.49 and 146.247.25.50 - a very different situation., do you think it would be okay to release this range block, or can we narrow it to 146.247.25.0/24? I know Sro23 is frequently targeted, so wanted to make sure there isn't something I cant see. Kuru   (talk)  14:04, 5 March 2017 (UTC)
 * After review, I decided to unblock the /16 for now. ​—DoRD (talk)​ 14:43, 5 March 2017 (UTC)

107.151.128.0/18


Reason: Requested unblock at User talk:W33dscoper. עוד מישהו Od Mishehu 06:55, 5 March 2017 (UTC)
 * . This is indeed a webhost - Zenlayer cloud hosting. The range block is technically correct, the hard block is intentional. This would be a candidate for IPBE if he really needs to connect through a remote server. Kuru   (talk)  13:46, 5 March 2017 (UTC)

191.187.242.227


Reason: Appeal at User talk:Saturnalia0. Block log. Please check whether indeed open proxy.
 * . There is no longer an open proxy on the port Procseebot identified. One other odd open port that looks like a router, but I an't connect to it. I removed the block. Kuru   (talk)  12:40, 7 March 2017 (UTC)

185.80.220.42


Reason: Part of Opera's SurfEasy VPN. --185.80.220.42 (talk) 03:43, 11 March 2017 (UTC)
 * The range has been indefinitely blocked on 1 March 2017 on the Turkish Wikipedia as “Anonymous and open proxies : Virtual Internet (UK) Limited (United Kingdom)” by tr:Kullanıcı:Vito Genovese. See also the Wikipedia page on the UK2 Group and the reference to http://www.vps.net. Per this Techcrunch article the UK2 Group is a webhosting provider. It looks to me that that a web host block of the /22 may be justified. EdJohnston (talk) 04:09, 11 March 2017 (UTC)


 * These are part of AS13213 (UK-2 Limited) (uk2group.com)'s allocations. They're a colocation provider that already has numerous blocks because of abusive VPN and web proxy hosting. I'm blocking their ranges presently. -- slakr \ talk / 05:26, 25 March 2017 (UTC)

104.145.235.41


Reason: I sometimes use a VPN (for gaming). This is a new one on NordVPN, and not blocked. <b style="border:1px solid #dfdfdf;color:green; padding:1px 3px;background:#FFD">Ron h jones </b>(Talk) 20:43, 12 March 2017 (UTC)
 * &mdash; blocked all of AS64245 (DigitalFyre Internet Solutions, LLC.) as a colocation / webhost provider. -- slakr \ talk / 05:01, 25 March 2017 (UTC)

138.26.90.37


Reason: Suspicious edits. Probably a proxy sock-the same article was targeted a notorious sockmaster before. 46.154.45.179 (talk) 12:52, 17 March 2017 (UTC)
 * . I don't see anything obvious; college POP. Kuru   (talk)  14:08, 17 March 2017 (UTC)

45.72.133.95


Reason: Suspicious edits. Likely a proxy sock-the same article was targeted by a notorious sockmaster before.46.154.45.179 (talk) 13:03, 17 March 2017 (UTC)
 * . I don't see anything. Kuru   (talk)  14:02, 17 March 2017 (UTC)

202.136.88.99


Reason: Some random troll or other used it to vandalize my talk page, geolocate says it's a confirmed proxy server. Beeblebrox (talk) 19:54, 22 March 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:27, 21 October 2017 (UTC)

212.31.100.218


Reason: IP already blocked for vandalism; WHOIS confirms as proxy server. Thank you, &#60;&#60;&#60; SOME GADGET GEEK &#62;&#62;&#62; (talk) 01:50, 23 March 2017 (UTC)


 * / blocked as a school by another admin.  slakr  \ talk / 04:47, 25 March 2017 (UTC)

91.223.106.152


Reason: Vandalism and admittance by user it's a proxy server <b style="border:1px solid #dfdfdf;color:green; padding:1px 3px;background:#FFD">Ron h jones </b>(Talk) 17:14, 25 March 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:29, 21 October 2017 (UTC)

69.63.114.66


User claims in this appeal on UTRS that the IP address is a proxy that requires authorization, not an open proxy. ~Anachronist (talk) 00:56, 5 April 2017 (UTC)

Reason: Requested unblock.
 * . Wide open squid proxy on 3128; was able to connect and attempt to edit. This is blocked (correctly) on meta at any rate. Kuru   (talk)  01:33, 5 April 2017 (UTC)

49.145.219.199


Reason: Vandalism as editing on List of programs broadcast by UNTV. LG-Gunther : Talk  04:28, 5 April 2017 (UTC)
 * Please provide evidence of an open proxy. I see none. Materialscientist (talk) 04:35, 5 April 2017 (UTC)
 * No evidence has been provided since April so I'm closing this. De728631 (talk) 21:10, 15 August 2017 (UTC)

IP 180.148.211.21


Reason: Noticed a bit of vandalism coming from this IP. I've blocked them for 72 hours, but I noticed that What's My IP Address thinks they might be a proxy and a forum spam source. Granted, I know that this doesn't always mean anything, but my other option was to do nothing, which I didn't think would be helpful. Thanks for looking into this. Cyphoidbomb (talk) 16:03, 7 April 2017 (UTC)
 * Not sure. There's an open port (8291), but I can't figure out what's there. Can't connect to it, so it's not a simple open proxy. The IP has been used abusively in the past - it's on several blacklists for spam and attacks. Looks like it belongs to "stargatebd.com", which is an established ISP in Dhaka. May be leased to local internet cafes, etc. Suggest treating it like any other IP and increase as you go, unless someone else can see more than I'm seeing? Kuru   (talk)  17:43, 7 April 2017 (UTC)
 * My checks only confirm what Kuru says, so I am closing this case. The editor who uses the pseudonym "JamesBWatson" (talk) 12:02, 26 April 2017 (UTC)

76.169.240.143


Reason: Suspicious and disruptive edits. The ip is blacklisted at dnsbl.sorbs.net, dul.dnsbl.sorbs.net, 12.apews.org. The ip is static like many proxies and is apparently used by the same person since december. Plus, its edit conduct is resembling a notorious sockmaster involved in ip-socking before. I know this project cannot detect all the proxies any time but it would be nice if someone check this highly dubious ip. 46.221.192.32 (talk) 12:40, 18 April 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:30, 21 October 2017 (UTC)

123.243.214.185


Some recent disruptive editing coming from this IP. Per the IP's block log, ProcseeBot issued a block in 2010 on the basis that the IP was a proxy of some kind. Thought it could use another look. Thanks, Cyphoidbomb (talk) 15:46, 20 April 2017 (UTC)
 * I can't find any evidence that this is currently an open proxy, nor even that it has been since 2010. However, I am leaving this open in case anyone else can find evidence. The editor who uses the pseudonym "JamesBWatson" (talk) 11:56, 26 April 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:31, 21 October 2017 (UTC)

111.88.0.0/16


Reason: Requested unblock at User talk:111.88.115.104. עוד מישהו Od Mishehu 09:47, 23 April 2017 (UTC)
 * I can find no evidence at all that 111.88.115.104 is an open proxy.  You placed the block, can you offer any useful information? The editor who uses the pseudonym "JamesBWatson" (talk) 11:46, 26 April 2017 (UTC)


 * Callanecc has not edited for two weeks, so I am going ahead with this. I have checked a number of IP addresses in the range, including all those which have most recently edited, and I can find no evidence that any of them is currently hosting an open proxy. However, almost all of the edits from the blocked range are vandalism or other unconstructive editing, so I am not going to unblock, but I shall reduce the block to an anon-block. The editor who uses the pseudonym "JamesBWatson" (talk) 13:09, 5 May 2017 (UTC)

110.21.0.7

 * Callanecc (talk • contribs • logs) 05:32, 21 October 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:32, 21 October 2017 (UTC)

85.17.24.76


Used Hide.me, then asked google "what's my ip?". -barrelroll.dev (talk) 23:33, 1 May 2017 (UTC)


 * Callanecc (talk • contribs • logs) 05:33, 21 October 2017 (UTC)

34.201.164.129


Reason: Vandalism from Amazon EC cloud IP
 * Callanecc (talk • contribs • logs) 05:33, 21 October 2017 (UTC)

151.240.233.46


Reason: Requested unblock.
 * . Not clear what you're asking; I don't see an unblock request associated with this IP, nor do I see an active block.  Kuru   (talk)  14:01, 20 May 2017 (UTC)

173.236.128.0/17


Webhosting service; continued to cause disruption after recent release from block. 2A00:1838:37:C1:0:0:0:6A9D (talk) 01:44, 16 June 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:35, 21 October 2017 (UTC)

198.15.64.0/18


Webhosting service; continued to cause disruption after recent release from block. Specifically from. 2601:1C0:10E:B297:1056:9979:D4E9:73AE (talk) 01:45, 19 June 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:36, 21 October 2017 (UTC)

196.52.2.97


See.

Web check reveals it to be a network sharing device or proxy. GABgab 21:02, 23 June 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:36, 21 October 2017 (UTC)

54.236.45.171


Reason: This IP has been used by a proxy hopping troll on another wiki I am a checkuser on, and it belongs to Amazon. Amazon has hosting services, and if this is an open proxy being used for wiki vandalism, it's only a matter of time until someone uses it to vandalize Wikipedia. PCHS-NJROTC (Messages)Have a blessed day. 21:30, 5 July 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:37, 21 October 2017 (UTC)

122.8.141.171


Reason: Suspicious edits; long-term prolific sockfarm Sockpuppet investigations/OfficialPankajPatidar. The IP geolocates to Beijing but here they claim to be in Pakistan, which is consitent with the sockfarm's profile. _ Bri (talk) 18:55, 7 July 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:38, 21 October 2017 (UTC)

68.168.119.230


Reason: Managed to edit user:Ronhjones/Proxy, while connected through Nord vpn Canada  Ron h jones  (Talk) 19:40, 23 July 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:39, 21 October 2017 (UTC)

107.77.165.6


Reason: Suspicious edits, web check reveals it to be a confirmed proxy server. Probably User:Accopulocrat. GABgab 00:46, 31 July 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:40, 21 October 2017 (UTC)

94.242.62.112


Reason: Suspicious edits, "Network sharing device or proxy server... Likely mail server". GABgab 00:03, 1 August 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:41, 21 October 2017 (UTC)

210.95.217.175


Reason: Suspicious edits Beyond My Ken (talk) 14:25, 31 August 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:42, 21 October 2017 (UTC)

190.79.25.143


Reason: Suspicious edits Beyond My Ken (talk) 14:25, 31 August 2017 (UTC)
 * Callanecc (talk • contribs • logs) 05:42, 21 October 2017 (UTC)

124.215.138.169


Reason: Disruptive edits over the past year, this says it's a network sharing device or proxy server. -★- PlyrStar93. → Message me. ← 00:09, 23 October 2017 (UTC)
 * Callanecc (talk • contribs • logs) 10:31, 23 October 2017 (UTC)

41.209.50.225


Reason: Began making same pattern of disruptive edits to fast food mascot articles after a prior IP (200.76.184.163) was given a level 4 warning. IP Quality Score lists as a proxy. RA 0808 talkcontribs 15:20, 24 October 2017 (UTC)
 * Callanecc (talk • contribs • logs) 07:53, 25 October 2017 (UTC)

173.224.116.233


Reason: ISP is server4you, indicating a web hosting service. Edit warring on some pages. -★- PlyrStar93. → Message me. ← 14:52, 28 October 2017 (UTC)
 * Callanecc (talk • contribs • logs) 01:24, 29 October 2017 (UTC)

69.223.191.136


Reason: Disruptive edits adding deliberate misinformation, IP Quality Score flags as a proxy. RA 0808 talkcontribs 21:12, 28 October 2017 (UTC)
 * Callanecc (talk • contribs • logs) 01:26, 29 October 2017 (UTC)

2404:C800:9002:8:0:0:0:13


Reason: Suspicious edits 222.167.166.187 (talk)
 * Callanecc (talk • contribs • logs) 00:13, 31 October 2017 (UTC)

12.110.218.178


Reason: Suspicious edits, vandalism, School block.222.167.166.187 (talk)
 * It might be open, but also possible that it's a closed proxy used by the school system. The two year school block will do the job anyway. Callanecc (talk • contribs • logs) 00:18, 31 October 2017 (UTC)

182.253.125.7


Reason: Suspicious edits, blocked proxy. 222.167.166.187 (talk)
 * Callanecc (talk • contribs • logs) 00:19, 31 October 2017 (UTC)

52.168.135.254


Reason: vandalism from this IP. ISP is Microsoft Corporation and organization is listed as Microsoft Azure, which is a cloud computing platform to deploy applications as well as web hosts. Geolocation shows up as East Coast of US, which is not where Microsoft's corporate office is at, but rather a Microsoft datacenter (Boydton, VA). -★- PlyrStar93. → Message me. ← 19:33, 29 October 2017 (UTC)
 * While the range is registered to MS Azure, it's too big to block so it'll be whack-a-mole. Callanecc (talk • contribs • logs) 00:22, 31 October 2017 (UTC)

113.160.55.242


Reason: Vandalism, blocked proxy 222.167.166.187 (talk) 21:06, 30 October 2017 (UTC)
 * Already blocked. Callanecc (talk • contribs • logs) 00:22, 31 October 2017 (UTC)

185.17.132.66


Reason: 185.17.132.66:53281 is an open proxy which was used for a vandalbot attack on Commons. —Guanaco 08:12, 31 October 2017 (UTC)
 * . GABgab 15:08, 31 October 2017 (UTC)

165.225.96.61


Reason: Suspicious edits, appears to be Zscaler proxy ☆ Bri (talk) 14:41, 1 November 2017 (UTC)
 * . GABgab 15:06, 1 November 2017 (UTC)

77.247.85.102


Reason: Suspicious edits. whatismyipaddress.com says that it is a VPN server. Even though the IP address is already blocked, it should be hard-blocked and possibly for a longer duration. 24.51.86.102 (talk) 18:07, 1 November 2017 (UTC)
 * . Range blocked. NinjaRobotPirate (talk) 04:39, 2 November 2017 (UTC)

103.4.164.204


Reason: Suspicious edits. Recently started editing again within the last few days. Blocked by the proxy bot, still an open proxy. 159.89.10.188 (talk) 15:54, 2 November 2017 (UTC)
 * Already blocked. Callanecc (talk • contribs • logs) 05:35, 3 November 2017 (UTC)

104.129.198.115


Reason: Suspicious edits. Zscaler open proxy. 116.220.7.10 (talk) 20:43, 3 November 2017 (UTC)
 * . GABgab 21:26, 3 November 2017 (UTC)

202.134.13.135


Reason: Suspicious edits. whatismyipaddress.com reports it as a spam source (within the last 30 days, etc.). 82.0.113.79 (talk) 18:30, 5 November 2017 (UTC)
 * Actually, I'm not really sure if it's a proxy per se, it may be a shared IP address at a coorporation. The "spam source" was the original indicator that made me think that this is a proxy server, but I may be incorrect here... 82.0.113.79 (talk) 18:34, 5 November 2017 (UTC)
 * Callanecc (talk • contribs • logs) 09:00, 7 November 2017 (UTC)

66.160.199.60


Reason: Hurricane Electric open proxy. 176.103.48.38 (talk) 16:18, 9 November 2017 (UTC)
 * ✅ Already rangeblocked. 61.245.229.113 (talk) 05:03, 19 November 2017 (UTC)

104.129.196.206


Reason: Suspicious edits. Zscaler open proxy. 122.197.215.184 (talk) 17:59, 10 November 2017 (UTC)
 * It's a closed proxy, not open for anyone from what I can tell. Callanecc (talk • contribs • logs) 10:28, 19 November 2017 (UTC)

52.173.74.241


Reason: Suspicious (promotional) edits; socking; has been identified as Microsoft Azure host. ☆ Bri (talk) 18:02, 10 November 2017 (UTC)
 * Callanecc (talk • contribs • logs) 10:25, 19 November 2017 (UTC)

185.104.185.239


Reason: sockpuppetry, IPs in France, England, and Japan, being used by a banned user located in the United States who has used open proxies for abuse in the past. (NOTE: I combined a few open reports) Ivanvector (Talk/Edits) 15:35, 18 November 2017 (UTC)
 * All blocked. GABgab 15:52, 18 November 2017 (UTC)

95.153.132.82


Reason: Suspicious edits — Preceding unsigned comment added by 95.153.132.82 (talk • contribs) 01:28, 17 November 2017 (UTC)
 * Callanecc (talk • contribs • logs) 10:26, 19 November 2017 (UTC)

92.53.105.52


Reason: edit war-ish edit summaries. Host name is vds-holanet.timeweb.ru and ISP is TimeWeb Ltd., a Russian web hosting company. -★- PlyrStar93. → Message me. ← 03:07, 19 November 2017 (UTC)
 * Callanecc (talk • contribs • logs) 10:27, 19 November 2017 (UTC)

2a02:c207::/32


Reason: Suspicious edits. Recently blocked as a webhost on meta.wiki, and was once blocked on en.wiki too. This /32 IPv6 range still appears to be a webhosting service. 219.98.8.174 (talk) 22:40, 19 November 2017 (UTC)
 * Callanecc (talk • contribs • logs) 10:43, 20 November 2017 (UTC)

2A03:EFC0:900:0:0:0:0:252


Reason: Fanciful hoaxing & BLP violations in the style of Jaredgk2008.—Odysseus 1 4 7  9  05:34, 21 November 2017 (UTC)
 * , /40 range. -- zzuuzz (talk) 07:18, 21 November 2017 (UTC)

198.27.128.0/17 incorrectly identified as colocationwebhost


I work for the ISP which owns this netblock and can confirm that this is a range of DHCP addresses handed out to residential customers and has no connection to our colocation facilities. Refer to this discussion if you want to know why I posted this request here. Reason: Incorrectly blocked as colocationwebhost. Opsftw (talk) 18:38, 27 November 2017 (UTC)
 * I'm changing the block reason to something more generic, but I will leave the block on unregistered users for the time being, as there has been some vandalism from the range. Users who log in will be able to edit, and no user will be presented with a message about colos. I will also drop a note to Ks0stm with regards to removing the block entirely. -- zzuuzz (talk) 19:09, 27 November 2017 (UTC)
 * Thanks for your attention to this issue and for making the change you made. I still don't understand why the anonblock is wanted - looking at the relevant user page when I use "Hide probably good edits" there are no "probably bad" edits shown. I'm guessing you are using a different tool to spot vandalism from that range. Further, is it policy to anonblock an entire /17 of residential internet customers because somebody in that range was committing vandalism? Remember, we are talking about roughly thirty two thousand households (or approximately 75,000 human beings) being anonblocked because somebody within that range has acted inappropriately. That seems a bit extreme IMHO. Opsftw (talk) 19:30, 27 November 2017 (UTC)
 * Unfortunately I have special access to the relevant tools. We have had problems with a long term vandal creating accounts from throughout this range throughout this year. They have been active in just the last few hours (though probably from other ranges). One or two occurrences may possibly have been explained by compromised hosts, but there does seem to be a theme. -- zzuuzz (talk) 19:54, 27 November 2017 (UTC)
 * Would you be willing to share some examples of vandalism edits from the user in this range that you're concerned about? Again, still trying to understand how one person's inappropriate conduct should justify an anonblock of this magnitude (75,000 or so human beings are impacted).Opsftw (talk) 20:47, 27 November 2017 (UTC)
 * I'm going to have to decline due to the Privacy policy and the nature of the vandalism. Don't get me wrong I don't take /17 blocks lightly, and they're usually reserved for severe disruption. Whether or not it's justified is something I'm currently pondering, but also bear in mind this isn't technically my block. -- zzuuzz (talk) 22:06, 27 November 2017 (UTC)
 * Understood perfectly re: privacy. My role here is to advocate on behalf of our users, the vast majority of whom are not abusing our service to cause disruption to Wikipedia.
 * I'm leaving the block in place at this time. I've left further advice at User talk:Ks0stm. -- zzuuzz (talk) 07:12, 28 November 2017 (UTC)

98.239.113.209


Reason: WP:DUCK test matches Long-term abuse/109.151.65.218, behavior matches that one almost spot on. However, this IP's WHOIS data indicates a US-based IP address, while all of the others indicate UK-based IP addresses. Asking for a proxy check to see if they are using an open proxy to mask their location. IP is already blocked a short time based on behavioral evidence. -- Jayron <b style="color:#090">32</b> 20:07, 27 November 2017 (UTC)
 * Already blocked, but not an open proxy. Callanecc (talk • contribs • logs) 03:41, 2 December 2017 (UTC)

103.23.29.253


Reason: Suspicious edits. I'm not sure how to check which port the IP is open on, but whatismyipaddress.com labels it as a "confirmed proxy server".
 * Looks like this is a closed proxy. Callanecc (talk • contribs • logs) 03:42, 2 December 2017 (UTC)

190.226.154.234


Reason: Suspicious edits, listed as problem host by Barracuda. ☆ Bri (talk) 18:38, 28 November 2017 (UTC)
 * Based on behavioral evidence, it seems more probable than not that this is not a proxy. GABgab 16:57, 30 November 2017 (UTC)
 * Agreed, Callanecc (talk • contribs • logs) 03:42, 2 December 2017 (UTC)

173.9.233.41


Reason: All edits are vandalism/unconstructive. Also some other edits in other wikis: frwiki/simplewiki are the same type of vandalism. Proxy checker shows as VPN/proxy. Based on behavior, this is the Pikepass vandal at frwiki, who is known to abuse proxies (e.g. previous blocked IP 96.92.203.45 now globally blocked 1 year as open proxy). -★- PlyrStar93. → Message me. ← 04:11, 29 November 2017 (UTC)
 * Already blocked, and I'm not sure it is an open proxy. Callanecc (talk • contribs • logs) 03:44, 2 December 2017 (UTC)

192.240.127.78


Reason: Suspicious edits. Dedicated server proxy IP. May need to be rangeblocked as. 116.123.126.79 (talk) 10:05, 29 November 2017 (UTC)
 * by Zzuuzz. GABgab 16:56, 30 November 2017 (UTC)

147.91.1.43


Reason: Suspicious edits. IP address is back to being a proxy once again per whatismyipaddress.com (refer to block log). 203.128.191.50 (talk) 18:04, 29 November 2017 (UTC)
 * Doesn't appear to be an open proxy. Warn and report to WP:AIV as normal for a 'school'. Callanecc (talk • contribs • logs) 03:48, 2 December 2017 (UTC)

2001:42C8:0:301:41:206:188:206


Reason: Suspicious edits. User has admitted that this IP address is a Tor exit node. 60.36.225.155 (talk) 13:10, 30 November 2017 (UTC)
 * . GABgab 16:54, 30 November 2017 (UTC)

46.166.176.0/21 (46.166.176.169)


Reason: Suspicious edits. Hostname is: "hosted-by.seedvps.com" which is registered to this VPN hosting service. According to the WHOIS links, would be the correct range to block if a  would be performed. 76.109.126.61 (talk) 05:59, 4 December 2017 (UTC)
 * Blocked. Callanecc (talk • contribs • logs) 10:55, 4 December 2017 (UTC)

77.234.46.177


Reason: Suspicious edits, address query reports Webhosting cloud service Avast "Network sharing device or proxy server", poss proxy thing ☆ Bri (talk) 04:48, 5 December 2017 (UTC)
 * Note: is currently blocked as a webhost, which is in the same ISP as 77.234.46.177. 118.153.81.72 (talk) 05:21, 5 December 2017 (UTC)


 * Blocked. Callanecc (talk • contribs • logs) 07:11, 5 December 2017 (UTC)

130.180.122.138


Reason: Requested unblock.
 * See User talk:130.180.122.138 <b style="border:1px solid #dfdfdf;color:green; padding:1px 3px;background:#FFD">Ron h jones </b>(Talk) 00:18, 9 December 2017 (UTC)
 * Callanecc (talk • contribs • logs) 07:12, 18 December 2017 (UTC)

108.171.159.47


Reason: Recently used by sockpuppeteer; whatismyaddress.com says it's a proxy server. Trivialist (talk) 21:10, 17 December 2017 (UTC)
 * by . GABgab 01:21, 18 December 2017 (UTC)

208.87.237.201


Reason: Suspicious edits. confirmed proxy server and webhosting service. 180.47.118.156 (talk) 18:58, 18 December 2017 (UTC)
 * SQL <sup style="font-size: 5pt;color:#999">Query me! 00:06, 12 January 2018 (UTC)

62.255.118.6


Reason: Suspicious edits

See a complaint of disruptive editing at WP:Administrators' noticeboard. User:Berean Hunter tried checking the IP at one of the IP lookup sites, and that site reports it to be an open proxy. I am unsure whether to trust this verdict. EdJohnston (talk) 00:34, 21 December 2017 (UTC)
 * (non-admin closure) Blocked for 1 year by Yamla. 213.231.118.93 (talk) 17:48, 21 December 2017 (UTC)

110.77.181.148


Reason: See discussion, the final section at WP:ANI. In short, someone created a couple of attack accounts, and when they were blocked, this IP continued the disruption. According to checkuser NinjaRobotPirate, the accounts are using proxies, so I suppose it's likely that this one also might be. It was previously blocked by Procseebot, but that block expired without being renewed, so I'm not clear if that means that the bot hadn't gotten around to reblocking it yet or if it means that it's not a proxy anymore. I gave it a short block for the disruption, but please lengthen the block if it's a proxy. Nyttend (talk) 14:05, 23 December 2017 (UTC)
 * . GABgab 17:06, 23 December 2017 (UTC)

121.225.25.197


A few minutes after I made the block referenced in the previous section, I got this friendly notice from an IP with no previous edits. This is the first logged action I've made in several days, aside from unprotecting a page (can't imagine anyone objecting to that in such a manner), so I strongly suspect that it's related. Seeing that 110.77.181.148 is Thai, and this one's Chinese, I strongly suspect that they're both open proxies. Nyttend (talk) 14:24, 23 December 2017 (UTC)
 * . GABgab 17:07, 23 December 2017 (UTC)

203.81.71.25


Reason: Suspicious edits. IP has been blocked twice in the past as an open proxy. 14.190.44.204 (talk) 17:47, 28 December 2017 (UTC)
 * . GABgab 19:19, 28 December 2017 (UTC)