Wikipedia:WikiProject on open proxies/Requests/Archives/30

210.16.81.145, 2405:204:9493:913F:DCE3:AB6A:D101:B93C and 2402:3A80:515:7979:1831:DC26:5331:7923


Both of the IPs above have per WP:DUCK been used by Shingling334 (i.e. the same sockmaster as in the report above), an editor who geolocates to the UK. The article they're hitting now (see also Special:Contributions/79.71.239.28,a dynamic 'phone company IP that geolocates to their known area) is Lahmajoun, an article that hasn't previously been among their favourites, but is now that Baklava and Döner kebab have been protected... - Tom &#124; Thomas.W talk 14:36, 24 March 2018 (UTC)
 * Added one more IP (Special:Contributions/2402:3A80:515:7979:1831:DC26:5331:7923) that has been used by Shingling334. - Tom &#124; Thomas.W talk 16:54, 29 March 2018 (UTC)
 * Decline, this seems like something more suited for WP:SPI. SQL Query me!  04:02, 5 April 2018 (UTC)

1.1.1.1


Reason: Open proxy/DNS, registered to webhost provider. 2A02:C7F:963F:BA00:C51:C3B4:3399:F0B3 (talk) 18:59, 4 April 2018 (UTC)
 * It's not an open proxy, it's a secure DNS-service (using DNS over HTTPS, i.e. encrypted DNS-queries) operated by APNIC and Cloudflare. - Tom &#124; Thomas.W talk 19:16, 4 April 2018 (UTC)
 * Please close it because it just a DNS. 2A02:C7F:963F:BA00:C51:C3B4:3399:F0B3 (talk) 19:41, 4 April 2018 (UTC)
 * Closed. SQL Query me!  03:55, 5 April 2018 (UTC)

144.202.0.0/17


Reason: Digital Ocean webhosting services. 172.58.43.90 (talk) 03:29, 5 April 2018 (UTC)
 * Blocked. Please note that this is a choopa range, not a DO range. SQL Query me!  03:59, 5 April 2018 (UTC)

96.9.247.168/29


Reason: NordVPN. Webhost, per. 172.58.43.24 (talk) 03:22, 7 April 2018 (UTC)
 * Blocked SQL Query me!  11:43, 10 April 2018 (UTC)

185.236.200.0/22


Reason: M247 webhosting services:. 172.58.46.240 (talk) 04:02, 8 April 2018 (UTC)
 * Blocked. SQL Query me!  11:47, 10 April 2018 (UTC)

185.9.16.0/22


Reason: M247 webhosting services:. 172.58.46.240 (talk) 04:03, 8 April 2018 (UTC) Blocked. SQL Query me! 11:47, 10 April 2018 (UTC)

104.207.64.0/19


Reason: OppoBox LLC (managed servers):. 172.58.43.152 (talk) 00:13, 9 April 2018 (UTC)
 * Blocked. SQL Query me!  11:48, 10 April 2018 (UTC)

2607:F480:0:0:0:0:0:0/32


Reason: Dimension Data Cloud Solutions, Inc. 172.58.43.168 (talk) 15:32, 9 April 2018 (UTC)
 * Blocked. SQL Query me!  11:49, 10 April 2018 (UTC)

202.129.16.72/22


Reason: This IP range is used by a major commercial VPN provider. I'm WP:IPBE and I'm using this IP right now. BillHPike (talk, contribs) 01:32, 17 March 2018 (UTC)
 * Did you mean to post
 * That's the IP range that WHOIS confirms. 95.55.128.220 (talk) 06:54, 17 March 2018 (UTC)
 * The IP editor is right in so far as 202.129.16.0/22 is the standard CIDR notation, but it doesn't actually make any difference, because in a /22 range everything after the first 22 bits of the IP address is ignored, so that 202.129.16.0/22 and 202.129.16.72/22 are treated as the same range.
 * I don't know of any way to do a blanket check on a whole IP range, and I am not going to manually check all 1024 IP addresses in the range. However, I have checked 35 IP addresses in the range, including all of those which have ever edited Wikipedia, a few adjacent to some of those which did turn out to be proxies or VPNS, and a random sample of others. I have confirmed that 7 IP addresses of those 35 are running proxies or VPNs; for the other 28 I can't say. Since the sample that I have checked is a very small fraction of the total number of the range there will pretty certainly be many more. I am not sure whether that is enough to justify a range block. For the moment I shall block the ones that I know of. I may possibly come back and do some more work on this when I have more time. I am also leaving this report open in case someone else can help. The editor who uses the pseudonym "JamesBWatson" (talk) 11:18, 21 March 2018 (UTC)


 * I have now blocked the 7 that I know of, which are 202.129.16.8, 202.129.16.17, 202.129.16.29, 202.129.16.72, 202.129.16.104, 202.129.16.140, 202.129.17.177. The editor who uses the pseudonym "JamesBWatson" (talk) 11:26, 21 March 2018 (UTC)
 * 2 more found and blocked: 202.129.16.70, 202.129.16.124. The editor who uses the pseudonym "JamesBWatson" (talk) 12:07, 21 March 2018 (UTC)
 * I think everything that's going to be blocked - has been at this point. SQL Query me!  22:55, 13 May 2018 (UTC)

2A02:4780:BAD:25:FCED:1FF:FE25:109


Reason: Suspicious edits. This is a web host (hosting24.com) that geolocates to Lithuania. Similar ranges on this web host have been globally blocked by. See - MrX 🖋 20:26, 6 April 2018 (UTC)
 * should be rangeblocked. This is indeed a webhost. 172.58.46.199 (talk) 23:09, 6 April 2018 (UTC)
 * SQL Query me! 22:58, 13 May 2018 (UTC)

47.196.69.45


Reason: Suspicious SPA behaviour at AFD (Articles for deletion/The Powers of the Earth and Articles for deletion/Travis J I Corcoran), IPQualityScore flags as proxy. RA 0808 talkcontribs 17:28, 7 April 2018 (UTC)
 * SQL Query me! 23:00, 13 May 2018 (UTC)

125.199.131.221


Free MS-SSTP VPN (vpn885338432.opengw.net:995)―― Phoenix7777 (talk) 02:25, 10 April 2018 (UTC)
 * This IP address has been globally locked along with many other IPs from this list. 150.246.59.176 (talk) 14:50, 11 April 2018 (UTC)
 * I can't actually connect to it, but it's globally blocked - so shouldn't be able to edit here in either case. SQL Query me!  23:02, 13 May 2018 (UTC)

2A00:C98:0:0:0:0:0:0/32


Reason: Leaseweb hosting services. Already blocked but the duration should probably be a bit longer considering that this is a webhost. 172.58.41.109 (talk) 19:04, 12 April 2018 (UTC)
 * ✅ SQL Query me!  00:29, 13 April 2018 (UTC)

185.244.215.0/24


Reason: M247 Infrastructure webhosting/dedicated servers:, 109.193.29.57 (talk) 15:21, 18 April 2018 (UTC)
 * M247 also provides leased lines and biz connectivity. It looks like the range isn't currently in use. SQL Query me!  23:04, 13 May 2018 (UTC)

81.196.107.170


Reason: Edits at Bitcoin Cash claiming it as scam or something. Proxy checker shows VPN/proxy detected, domain name is mail.naturapreserved.com and ISP is RCS & RDS Business, Romania, likely mail server. -★- PlyrStar93. → Message me. ← 13:53, 20 April 2018 (UTC)
 * Very likely a webhost - blocked. SQL Query me!  23:06, 13 May 2018 (UTC)

206.174.180.0/24


Reason: VPS Hosting:. 173.10.239.197 (talk) 15:34, 23 April 2018 (UTC)
 * Packetworks appears to provide connectivity. SQL Query me!  23:08, 13 May 2018 (UTC)

185.130.105.66


Reason: Vandalism, web host that is also flagged by IPQualityScore as a proxy. RA 0808 talkcontribs 18:44, 23 April 2018 (UTC)
 * Please rangeblock on 106.165.233.16 (talk) 22:25, 23 April 2018 (UTC)
 * Blocked, king-servers.com. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:10, 13 May 2018 (UTC)

23.251.0.0/19


Reason: Web host Krypt Technologies, address 23.251.11.180 already blocked 72 hours for vandalism. Range has also been blocked at ruwiki as web host. RA 0808 talkcontribs 17:08, 26 April 2018 (UTC)
 * New wave communications is an ISP. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:12, 13 May 2018 (UTC)

2001:ac8:25::/48


Reason: M247 Infrastructure webhosting/dedicated servers:,. 89.78.126.192 (talk) 17:55, 30 April 2018 (UTC)
 * M247 also provides leased lines and connectivity. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:14, 13 May 2018 (UTC)

165.225.0.0/17


Reason: Zscaler. At least one address (165.225.38.215) engaging in vandalism. RA 0808 talkcontribs 21:54, 30 April 2018 (UTC)
 * . ZScaler is no more an open proxy than an ISP cache or a mobile phone. It is typically used in corporate environments and blocks can cause significant detrimental collateral to users who have no choice about which network to use for editing. -- zzuuzz (talk) 20:08, 1 May 2018 (UTC)

104.129.192.0/20


Reason: Zscaler. Dedicated cloud hosting. 118.87.184.97 (talk) 16:19, 1 May 2018 (UTC)
 * . It's neither web hosting or cloud hosting. ZScaler is no more an open proxy than an ISP cache or a mobile phone. It is typically used in corporate environments and blocks can cause significant detrimental collateral to users who have no choice about which network to use for editing. -- zzuuzz (talk) 20:08, 1 May 2018 (UTC)

186.206.128.0/22 and one two more


Reason: Persistent vandal who is known to use open proxies and anonymising services. He's been on a tear tonight. —<i style="color: #228B22;">Jeremy</i> v^_^v  Bori! 05:00, 3 May 2018 (UTC)
 * And one more. —<i style="color: #228B22;">Jeremy</i> v^_^v  Bori! 05:31, 3 May 2018 (UTC)
 * The single IP's are blocked. I can't scan an entire /22. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:22, 13 May 2018 (UTC)

186.227.192.0/20


Reason: HostDime.com. 24.235.183.94 (talk) 07:03, 3 May 2018 (UTC)
 * Blocked range. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:19, 13 May 2018 (UTC)

89.40.112.0/22


Reason: Aruba Cloud hosting and VPS services. 77.30.217.15 (talk) 06:45, 4 May 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:23, 13 May 2018 (UTC)

140.82.0.0/18


Reason: Another Choopa range. 14.236.28.242 (talk) 22:44, 7 May 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:24, 13 May 2018 (UTC)

107.77.165.9


Reason: Investigating possible sockpuppetry, did a geolocate check and whatismyipaddress says the address is a "Confirmed Proxy Server". JohnBlackburne words<sub style="margin-left:-2.0ex;">deeds 17:50, 8 May 2018 (UTC)
 * It's AT&T Mobility. Even if it were a proxy at the time, it's likely long gone. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:25, 13 May 2018 (UTC)

2a0d:5600:3::/48


Reason: CyberGhost VPN:. 47.216.173.104 (talk) 20:38, 9 May 2018 (UTC)
 * is the cyberghost range. Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:27, 13 May 2018 (UTC)

82.202.166.178


Reason: Proxy IP used for warring and 3RR evasion on (at least) Éamon de Valera article. Guliolopez (talk) 22:51, 13 May 2018 (UTC)
 * Blocked the range. Hoztnode. Also running openVPN on 443. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:31, 13 May 2018 (UTC)

2405:205:1284:52A8:602F:D96B:8B52:879D


Reason: Suspicious edits, trolled my talk page. Beeblebrox (talk) 23:28, 12 May 2018 (UTC)
 * - Sorry for the delay. Does not appear to me to be a proxy at this time. The IP does come back to an indian cellphone company, Jio. SQL <sup style="font-size: 5pt;color:#999">Query me!  21:59, 14 May 2018 (UTC)
 * Thanks for checking anyway, obviously some long-forgotten troll of some sort but I have no idea which one... Beeblebrox (talk) 00:10, 15 May 2018 (UTC)

204.12.0.0/17


Reason: hosting.com. 115.87.66.237 (talk) 21:40, 14 May 2018 (UTC)
 * Blocked - [hostmysite.com hostmysite.com]. SQL <sup style="font-size: 5pt;color:#999">Query me!  21:44, 14 May 2018 (UTC)

158.85.0.0/16


Reason: SoftLayer Technologies. Has been blocked as a webhost before. 190.207.191.138 (talk) 00:27, 15 May 2018 (UTC)
 * Blocked SQL <sup style="font-size: 5pt;color:#999">Query me!  00:43, 15 May 2018 (UTC)

216.162.47.18


Reason: Open proxy. Blocked on NL and RU projects already. Used to continue trolling by another (now blocked) open proxy. Guliolopez (talk) 02:01, 15 May 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  02:22, 15 May 2018 (UTC)

46.243.152.0/22


Reason: Serverius co-location and dedicated webhosting servers:. 187.189.107.250 (talk) 06:06, 16 May 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:02, 19 May 2018 (UTC)

199.168.112.0/21


Reason: GigeNet Managed cloud dedicated servers:. 187.189.107.250 (talk) 06:06, 16 May 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:03, 19 May 2018 (UTC)

81.92.200.0/22


Reason: Webhosting server (M247). 86.97.33.115 (talk) 00:31, 17 May 2018 (UTC)
 * M247 provides connectivity as well as hosting. Not blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:04, 19 May 2018 (UTC)

207.38.80.0/20


Reason: GoDaddy dedicated servers. 86.158.91.112 (talk) 19:00, 17 May 2018 (UTC)
 * The range in question appears to be registered to Heg US Inc, https://www.serverloft.com/. Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:07, 19 May 2018 (UTC)

85.159.95.2/26


Reason: A more chequered talk page than a chess board. &#x2230; Bellezzasolo &#x2721;  Discuss  13:51, 18 May 2018 (UTC)
 * - They do not appear to me to be an open proxy. They do seem to provide Colocation hosting as one service, but others include infrastructure / connectivity / firewalling (which can mean that they are a very large closed proxy). SQL <sup style="font-size: 5pt;color:#999">Query me!  03:11, 19 May 2018 (UTC)

106.184.0.0/21


Reason: Linode webhosting and dedicated servers. 121.104.140.79 (talk) 00:57, 27 April 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  02:07, 26 May 2018 (UTC)

199.247.8.0/21


Reason: Choopa, LLC. 86.97.33.115 (talk) 15:42, 16 May 2018 (UTC)
 * Unfortunately, Choopa offers connectivity as well. SQL <sup style="font-size: 5pt;color:#999">Query me!  02:06, 26 May 2018 (UTC)

192.207.62.209


Reason: Webhost ISP (HostBrew, LLC) making disruptive additions of unsourced or poorly sourced material. -★- PlyrStar93  → Message me. ← 14:48, 19 May 2018 (UTC)
 * The range to block for this is . 58.11.170.164 (talk) 15:32, 19 May 2018 (UTC)
 * The /24 range has been blocked by User:Dougweller for three months as a web host. EdJohnston (talk) 15:36, 21 May 2018 (UTC)
 * Blocked, then! SQL <sup style="font-size: 5pt;color:#999">Query me!  00:28, 24 May 2018 (UTC)

62.112.8.0/22


Reason: WorldStream dedicated servers. 58.10.153.60 (talk) 18:24, 19 May 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  02:04, 26 May 2018 (UTC)

2001:67C:2660:425:92E2:BAFF:FE91:1CB8


Reason: Part of Opera VPN 2001:67C:2660:425:92E2:BAFF:FE91:1CB8 (talk) 13:14, 20 May 2018 (UTC)
 * IP Range to block is . 171.101.73.44 (talk) 18:34, 20 May 2018 (UTC)
 * Blocked SQL <sup style="font-size: 5pt;color:#999">Query me!  00:28, 24 May 2018 (UTC)

192.171.224.0/19


Reason: Micfo, LLC. Cloud/web hosting. 115.74.200.102 (talk) 22:32, 23 May 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  02:06, 26 May 2018 (UTC)

23.226.128.0/20


Reason: QuadraNet. Current webhost block on 23.226.128.0/21 needs to be transfered over to 23.226.128.0/20; since IPs such as, , and are left unblocked (and are also part of QuadraNet). 47.38.17.80 (talk) 06:17, 26 May 2018 (UTC)
 * Quadranet has a lot of ranges. Working on it. SQL <sup style="font-size: 5pt;color:#999">Query me!  20:03, 26 May 2018 (UTC)
 * Blocked, in either case. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:19, 27 May 2018 (UTC)

5.77.32.0/19


Reason: eUKHost. 24.205.75.247 (talk) 18:28, 26 May 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:20, 27 May 2018 (UTC)

194.67.193.213


Reason: Open proxy engaged in block evasion, warring and griefing. Guliolopez (talk) 19:18, 27 May 2018 (UTC)
 * That's a webhost for sure. Good catch.


 * Blocked. I'll work on blocking the rest of the ranges in a bit. SQL <sup style="font-size: 5pt;color:#999">Query me!  19:58, 27 May 2018 (UTC)
 * All ranges are blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  20:34, 27 May 2018 (UTC)

206.81.0.0/19


Reason: Digital Ocean. 88.206.86.140 (talk) 06:27, 2 June 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  13:30, 2 June 2018 (UTC)

185.20.136.0/22


Reason: UpCloud cloud servers. 93.137.17.27 (talk) 19:08, 7 June 2018 (UTC)
 * Blocked by DoRD. SQL <sup style="font-size: 5pt;color:#999">Query me!  00:10, 24 June 2018 (UTC)

185.26.48.0/22


Reason: UpCloud cloud servers. 93.137.17.27 (talk) 19:10, 7 June 2018 (UTC)
 * Blocked by DoRD. SQL <sup style="font-size: 5pt;color:#999">Query me!  00:11, 24 June 2018 (UTC)

IP177.128.216.106


Reason: Suspicious edits This IP was recently blocked one year for disruptive editing. History of the problem is here. Previously blocked back in August 2017 by ProcseeBot. I'm hoping someone can confirm my diagnosis that this is an open proxy. (I did not try to activate it myself). In 2017 ProcseeBot found it to be open on port 53281. EdJohnston (talk) 20:07, 7 June 2018 (UTC)
 * . Yup it's a confirmed zombie. Open on port 65205. Maybe the block can go to two years, considering. -- zzuuzz (talk) 20:17, 7 June 2018 (UTC)

68.65.120.0/22


Reason: Dedicated webhosting server. (NameCheap). 197.206.164.135 (talk) 04:35, 10 June 2018 (UTC)
 * Already done. Callanecc (talk • contribs • logs) 04:39, 10 June 2018 (UTC)

178.128.0.0/16


Reason: Digital Ocean. 70.66.157.83 (talk) 04:42, 15 June 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  00:07, 24 June 2018 (UTC)

185.98.233.64


Reason: Suspicious edits. This user was on an IP in England, 80.2.23.133, which I blocked, and then they very obviously evaded that block from an IP in Spain, so unless they have a teleporter something ain’t right. Beeblebrox (talk) 18:09, 22 June 2018 (UTC)
 * I agree with you, Beeblebrox, and the IP address must have been a proxy, a VPN, or something similar, but I can find no proof that it still is. However, in view of the fact that the only recent editing from the IP range 185.98.233.0/24 has been this and other similar disruptive editing by an editor who has also used an account which is blocked, I have blocked the range for 2 months. The editor who uses the pseudonym "JamesBWatson" (talk) 12:36, 28 June 2018 (UTC)

103.231.88.0/22


Reason: Wombat Servers. 188.191.101.253 (talk) 23:36, 23 June 2018 (UTC)
 * 103.231.91.0/24 Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  00:09, 24 June 2018 (UTC)

199.247.0.0/19


Reason: Choopa servers. Both ends of the range, 199.247.0.0 and 199.247.31.255 are both Choopa, and IPs to the outside of it, 199.246.255.255 and 199.247.32.0 are not Choopa (which makes the /19 range the probable range to block). Obviously I didn't check every other IP address in between the range, but all of the ones here are also Choopa. 176.205.8.108 (talk) 22:16, 2 June 2018 (UTC)
 * Choopa does transit as well, so they aren't really blockable as open proxies unfortunately. SQL <sup style="font-size: 5pt;color:#999">Query me!  01:32, 20 July 2018 (UTC)

More Choopa IP Ranges


Reason: All are Choopa webhosting/VPN servers, as per this, listed in the "CIDR" section. 176.205.8.108 (talk) 22:25, 2 June 2018 (UTC)
 * Choopa does transit as well, so they aren't really blockable as open proxies unfortunately. SQL <sup style="font-size: 5pt;color:#999">Query me!  01:31, 20 July 2018 (UTC)

202.182.96.0/19


Reason: Choopa webhosting servers. 82.41.37.166 (talk) 17:00, 4 June 2018 (UTC)
 * Choopa does transit as well, so they aren't really blockable as open proxies unfortunately SQL <sup style="font-size: 5pt;color:#999">Query me!  01:32, 20 July 2018 (UTC)