Wikipedia:WikiProject on open proxies/Requests/Archives/29

61.204.102.120


Reason: Suspicious edits
 * SQL Query me! 00:17, 12 January 2018 (UTC)

61.204.102.117


Reason: Suspicious edits
 * SQL Query me! 00:17, 12 January 2018 (UTC)

210.230.140.88


Reason: Suspicious edits
 * SQL Query me! 00:16, 12 January 2018 (UTC)

210.230.140.125


Reason: Suspicious edits
 * SQL Query me! 00:16, 12 January 2018 (UTC)

210.230.140.234


Reason: Suspicious edits
 * SQL Query me! 00:16, 12 January 2018 (UTC)

210.251.24.7


Reason: Suspicious edits
 * SQL Query me! 00:16, 12 January 2018 (UTC)

61.204.102.196


Reason: Suspicious edits
 * SQL Query me! 00:14, 12 January 2018 (UTC)

124.103.3.25


Reason: Suspicious edits, geo info on IP says proxy server. Edits by recently blocked IPv6 in US moved to this IP. Geraldo Perez (talk) 06:53, 10 January 2018 (UTC)
 * SQL Query me! 21:59, 11 January 2018 (UTC)

210.251.24.104


Reason: Suspicious edits
 * No edits. Callanecc (talk • contribs • logs) 12:03, 13 January 2018 (UTC)

194.126.37.44


Reason: Suspicious edits
 * In the future, please sign your reports. I have blocked this proxy for 2 years. SQL Query me!  03:09, 18 January 2018 (UTC)

88.157.149.250


Reason: Suspicious edits
 * Already blocked. In the future, please remember to sign your reports. SQL Query me!  03:05, 18 January 2018 (UTC)

2A00:1838:37:1F1:0:0:0:2BE80


Reason: Suspicious edits
 * Already blocked. Please make sure that you sign your reports. SQL Query me!  03:04, 18 January 2018 (UTC)

23.226.128.0/22


The range is assigned to Quadranet, a webhost. This particular IP is used by commercial VPN service.

Reason: I’m WP:IPBE and am using this proxy right now. 23.226.128.122 (talk) 00:14, 18 January 2018 (UTC)
 * WHOIS shows this as being a /21 - blocked. SQL Query me!  03:01, 18 January 2018 (UTC)

36.2.227.164


Reason: Suspicious edits
 * No edits / unsigned report. SQL Query me!  04:43, 20 January 2018 (UTC)

96.54.225.11


Reason: Disruptive editing
 * Already blocked / unsigned report SQL Query me!  04:44, 20 January 2018 (UTC)

52.168.128.46


Reason: Suspicious edits. IPs block length may need to be increased (and hard-blocked). Registered to Microsoft Azure, which provides webhosting services. 160.39.245.239 (talk) 04:32, 20 January 2018 (UTC)
 * Really good point, most of need blocked as well, same as AWS.  SQL Query me!  04:48, 20 January 2018 (UTC)
 * User:SQL/Non-blocked Azure Ranges I've been working on blocking these. Closing request. SQL Query me!  23:31, 21 January 2018 (UTC)

198.98.183.136 (198.98.183.128/27)


Reason: Suspicious edits. Appears to be a dedicated hosting service. The WHOIS link says that 198.98.183.128/27 is the appropriate range to block. 73.96.104.126 (talk) 02:39, 22 January 2018 (UTC)
 * . GABgab 04:59, 22 January 2018 (UTC)

195.208.50.164


Reason: Suspicious edits, unlikely Russian geolocation and editing with a sockfarm that was using another proxy 180.151.193.74 ☆ Bri (talk) 17:22, 24 January 2018 (UTC)
 * I'd love a second set of eyes on this one.
 * All of my probes came back negative, but GetIPIntel seems relatively certain it's a proxy or VPN.
 * The ipcheck tool reports:
 * Result from Proxycheck: no
 * GetIPIntel's predicted chance of being a proxy: 87.642%
 * IPQualityScore reports Proxy: No, VPN: No, Mobile: No ISP: Autonomous Nonprofit Organisation Russian Scientif
 * IPHub reports this IP as a Block 0: Residential/Unclassified IP (i.e. safe IP) Possible ISP: KTTRADE-AS
 * Unless I'm missing something, this does not appear to presently be a proxy. SQL <sup style="font-size: 5pt;color:#999">Query me!  00:09, 25 January 2018 (UTC)
 * SQL <sup style="font-size: 5pt;color:#999">Query me! 03:36, 2 February 2018 (UTC)

107.152.96.0/20


Reason: Lots of disruptive edits coming from this dedicated webhosting service IP range. Was previously hard blocked for 2 years. 172.58.40.60 (talk) 20:47, 30 January 2018 (UTC)
 * ✅ as a webhost for another 2 years. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:38, 2 February 2018 (UTC)

208.87.232.0/21


Reason: Lots of disruptive edits from this IP range. Registered to SurfControl / FORCEPOINT-CLOUD dedicated webhosting services. 172.58.41.58 (talk) 17:17, 31 January 2018 (UTC)
 * ✅ Blocked as webhost. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:39, 2 February 2018 (UTC)

192.95.0.0/18


Reason: OVH Webhosting/dedicated servers. 125.175.57.147 (talk) 15:51, 5 February 2018 (UTC) — Berean Hunter   (talk)  20:24, 5 February 2018 (UTC)
 * ✅ Blocked as webhost.

183.182.101.131

 * -- Dlohcierekim (talk) 17:29, 6 February 2018 (UTC)

Ipcheck reports:


 * Result from Proxycheck.io: no
 * GetIPIntel.net's predicted chance of being a proxy: 100%
 * IPQualityScore reports Proxy: No, VPN: No, Mobile: No ISP: Unitel
 * IPHub.info reports this IP as a Block 0: Residential/Unclassified IP (i.e. safe IP) Possible ISP: UNITEL-LAcd

This IP is registered to Star Telecom / unitel.com.la - whom provides 3g/4g mobile internet as well as FTTH, and DSL home internet. I don't see any of the usual ports open (or any ports at all). Additionally, telnet, ssh, and vpn ports are returning filtered.

I don't believe that this is an open proxy - at least, at this time. :  SQL <sup style="font-size: 5pt;color:#999">Query me!  22:33, 6 February 2018 (UTC)

185.206.225.0/24


Reason: Webhost service. Same as currently blocked 185.206.224.0/24, as a webhost... 2601:1C0:4401:F360:2D95:B7:8C50:5379 (talk) 00:26, 9 February 2018 (UTC)
 * This range does appear to offer business connectivity - but I'm not convinced that it's a pure webhost. SQL <sup style="font-size: 5pt;color:#999">Query me!  02:19, 9 February 2018 (UTC)

162.251.61.241


Reason: Suspicious edits Pinkpastel (talk) 18:23, 17 February 2018 (UTC)
 * . GABgab 21:33, 20 February 2018 (UTC)

216.250.96.44


Reason: Again suspicious edits at China and the United Nations matching those of another IP editor, IP Quality Score flags as proxy/VPN. RA 0808 talkcontribs 17:36, 18 February 2018 (UTC)
 * . GABgab 21:35, 20 February 2018 (UTC)

103.200.5.137


Reason: Suspicious edits at China and the United Nations matching those of another IP editor, IP Quality Score flags as proxy/VPN. RA 0808 talkcontribs 19:14, 17 February 2018 (UTC)
 * as a webhost. NinjaRobotPirate (talk) 20:18, 23 February 2018 (UTC)

103.194.131.12


Reason: Vandalism at Out of scope, IPQualityScore flagged as proxy. RA 0808 talkcontribs 18:03, 20 February 2018 (UTC)
 * Blocked range as a colocation webhost - hexaware.com. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:44, 8 March 2018 (UTC)

208.67.7.8


Reason: Persistent vandalism. IP registered to "Wholesale Data Center, LLC" and IPQualityScore flags as proxy. RA 0808 talkcontribs 17:36, 28 February 2018 (UTC)


 * and have also recently made disruptive edits and are also within the same range as the IP mentioned above. According to the WHOIS link,  would be the appropriate range to block. 95.157.227.102 (talk) 22:45, 28 February 2018 (UTC)
 * Range blocked as a colocation webhost - datashack.com. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:40, 8 March 2018 (UTC)

198.13.62.106


Reason: Suspicious edits that suggest possible WP:Block evasion. At https://tools.wmflabs.org/ipinfo/q/198.13.62.106 the "Route record description" literally says "Customer proxy Reg". I am not an expert on proxies but I am fairly sure I know this editor is, however checkuser will obviously fail to confirm this if it a proxy. Emir of Wikipedia (talk) 21:02, 4 March 2018 (UTC)
 * Blocked the /19 for 2 years as a colocation webhost - Choopa.com. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:37, 8 March 2018 (UTC)

85.12.84.0/16


Reason: Bad-faith edits, these range of IP have E2BN broadband for school with web filter, which known to censor Wikipedia articles and perform man in the middle attack. This IP range is a open proxy, used for Central Beds Schools. I don't know is a open proxy or not. 2A02:C7F:963F:BA00:E028:6D66:6D42:F068 (talk) 16:53, 6 March 2018 (UTC)
 * These IP filtering Wikipedia is the same to 2008 IWF action, but on more pages and other filtering software. 2A02:C7F:963F:BA00:3928:4259:986C:BDA5 (talk) 20:54, 8 March 2018 (UTC)
 * SQL <sup style="font-size: 5pt;color:#999">Query me! 23:34, 8 March 2018 (UTC)

2605:FE80:0:0:0:0:0:0/32


Reason: Suspicious edits. Registered to LeaseWeb, which is a webhosting service. 113.198.233.46 (talk) 17:31, 6 March 2018 (UTC)
 * as a webhost. NinjaRobotPirate (talk) 02:39, 10 March 2018 (UTC)

2A03:1B20:3:F011:0:0:0:12DE


Reason: RIPE.net says "Mullvad is a VPN service that helps keep your online activity, identity and location private." PCHS-NJROTC (Messages)Have a blessed day. 18:58, 9 March 2018 (UTC)
 * 2a03:1b20:3::/48 as a VPN. It's nice of them to at least label themselves as such.  Some of the sketchier outfits try to hide themselves. NinjaRobotPirate (talk) 02:57, 10 March 2018 (UTC)

2001:4B98:0:0:0:0:0:0/32


Reason: Registered to "GANDI-HOSTING DC0 DATACENTER". One of the IPs in the range was recently CU blocked. 73.239.4.30 (talk) 00:04, 12 March 2018 (UTC)
 * Blocked as a webhost. SQL <sup style="font-size: 5pt;color:#999">Query me!  04:19, 14 March 2018 (UTC)

207.246.64.0/18


Reason: Lots of disruptive editing/trolling from this range. Registered to "Choopa, LLC", which has dedicated servers and webhosting services. 104.35.51.106 (talk) 04:53, 12 March 2018 (UTC)
 * Blocked as a webhost. SQL <sup style="font-size: 5pt;color:#999">Query me!  04:20, 14 March 2018 (UTC)

2A00:1768:1000:0:0:0:0:0/36


Reason: Registered to "NFOrce Entertainment B.V.", which provides webhosting services. 126.73.115.223 (talk) 17:10, 12 March 2018 (UTC)
 * Blocked as another webhost. SQL <sup style="font-size: 5pt;color:#999">Query me!  04:22, 14 March 2018 (UTC)

2605:6400:0:0:0:0:0:0/32


Reason: Registered to "FranTech Solutions", which provides webhosting services. 126.73.115.223 (talk) 17:10, 12 March 2018 (UTC)
 * A wide range, but blocked as a webhost. SQL <sup style="font-size: 5pt;color:#999">Query me!  04:24, 14 March 2018 (UTC)

173.209.192.0/19


Reason: Suspicious edits. Recent abuse, including (but not limited to) serial edit warring across several college and university articles. Registers to "Hosted Data Solutions, LLC" Webhosting services/dedicated servers. 24.205.75.247 (talk) 19:15, 16 March 2018 (UTC)
 * Blocked as a colocation webhost (I got all of hosted data solution's ranges). SQL <sup style="font-size: 5pt;color:#999">Query me!  21:15, 17 March 2018 (UTC)

104.224.49.36


Reason: Suspicious edits, appears to be "Roya Hosting LLC" and gives a weird geolocation in the Pacific Ocean. If this is a webhost there's a ton more 104.224.xxx.xxx listed at WP:RSPAM in a thread titled "investing.com". Bri.public (talk) 19:07, 20 March 2018 (UTC)
 * /18 Range blocked - Oppobox.com managed hosting. SQL <sup style="font-size: 5pt;color:#999">Query me!  20:36, 20 March 2018 (UTC)

41.227.139.72


Reason: Suspected open proxy, since it geolocates to Tunisia but has just been used on Baklava by a sockmaster, User:Shingling334, who geolocates to the UK (a known fact that can also be seen from the IP they used just minutes later, Special:Contributions/82.132.230.174, which belongs to Telefonica O2 in the UK). - Tom &#124; Thomas.W talk 22:28, 22 March 2018 (UTC)
 * Confirmed that this is a proxy or VPN, together with every one of a sample of other IP addresses in the same block used by the same ISP (41.227.128.0/17) so I have blocked that IP range. The editor who uses the pseudonym "JamesBWatson" (talk) 13:29, 23 March 2018 (UTC)

192.169.128.0/17


Reason: Suspicious edits. GoDaddy.com dedicated server. Recently active on. 201.226.126.112 (talk) 04:47, 25 March 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  01:04, 31 March 2018 (UTC)

207.148.64.0/18


Reason: Registered to webhosting servivce "Choopa, LLC", same ISP as which was recently blocked by SQL. 184.22.20.78 (talk) 04:12, 26 March 2018 (UTC)
 * Range is already blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  01:01, 31 March 2018 (UTC)

167.99.0.0/16


Reason: Digital Ocean webhosting services. 174.86.16.122 (talk) 04:17, 27 March 2018 (UTC)
 * Range blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  01:02, 31 March 2018 (UTC)

5.104.104.0/21


Reason: Suspicious edits. Managed webhosting services. 95.216.6.170 (talk) 05:00, 29 March 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  01:03, 31 March 2018 (UTC)

203.192.209.173 and 203.192.209.195


Reason: Suspicious edits at Hugh of Fauquembergues. RA 0808 talkcontribs 16:51, 26 March 2018 (UTC)
 * SQL <sup style="font-size: 5pt;color:#999">Query me! 01:06, 31 March 2018 (UTC)