Wikipedia:WikiProject on open proxies/Requests/Archives/31

191.252.134.240


Reason: ISP is Locaweb Serviços de Internet S/A which provides cloud/VPS services and domain registrations, if you visit through HTTP it displays a cPanel error page. Edits from this IP are only about discussing Wikinger socks edits (they have a habit of discussing their own socks). -★- PlyrStar93  → Message me. ← 18:09, 19 July 2018 (UTC)
 * I've blocked the /19. -- zzuuzz (talk) 18:22, 19 July 2018 (UTC)

51.38.82.237


Reason: Used by Sockpuppet investigations/PavelStaykov, appears to be a VPN/proxy service, and is part of a larger net that is currently blocked as proxies on multiple other WPs. - Tom &#124; Thomas.W talk 12:52, 9 July 2018 (UTC)
 * 51.38.80.0/22 blocked as webhost by Zzuzz. - Tom &#124; Thomas.W talk 08:39, 10 July 2018 (UTC)

2400:6180:0:0:0:0:0:0/32


Reason: Digital Ocean. 58.10.153.85 (talk) 20:38, 18 July 2018 (UTC)
 * Blocked. SQL Query me!  01:33, 20 July 2018 (UTC)

2001:4b78::/32


Reason: Tophost Servers. Also Seebweb Servers. 176.205.8.108 (talk) 22:00, 2 June 2018 (UTC)
 * Blocked. SQL Query me!  01:35, 20 July 2018 (UTC)

118.127.0.0/18


Reason: ServersAustralia. Dedicated severs and cloud hosting. 86.25.9.225 (talk) 15:35, 4 June 2018 (UTC)
 * Blocked. SQL Query me!  01:36, 20 July 2018 (UTC)

176.74.56.0/21


Reason: SysEleven webhosting servers. 82.41.37.166 (talk) 17:05, 4 June 2018 (UTC)
 * All SysEleven ranges are now blocked. SQL Query me!  18:06, 22 July 2018 (UTC)

174.34.64.0/18


Reason: Nextweb webhosting services. 93.137.17.27 (talk) 19:08, 7 June 2018 (UTC)
 * This appears to be a Covad company - a business / residential ISP (I had DSL service with them many many many ears ago) SQL Query me!  20:41, 22 July 2018 (UTC)

IP103.18.58.198


Reason: "VpsCity NZ" on. Wadaad (talk) 11:00, 25 June 2018 (UTC)
 * Blocked. SQL Query me!  21:21, 22 July 2018 (UTC)

IP188.116.34.66


Reason: "CIS NEPHAX" on. Wadaad (talk) 11:10, 25 June 2018 (UTC)
 * ✅ - I've blocked every NEPHAX range. SQL Query me!  21:29, 22 July 2018 (UTC)

IP185.84.181.116


Reason: "Bilintel Bilisim" on. Wadaad (talk) 11:40, 25 June 2018 (UTC)
 * Blocked, along with every other Bilintel range. SQL Query me!  21:33, 22 July 2018 (UTC)

107.242.113.12


Geolocate says it's a confirmed proxy server although proxycheck does not, which confuses me. It's certainly been used for vandalism for some time. Doug Weller talk 10:45, 10 July 2018 (UTC)
 * Sorry about the delay,  SQL Query me!  21:30, 22 July 2018 (UTC)

IP14.136.156.23


Reason: Suspicious edits

Some IPs from the Hong Kong Cyberport are itemized in my comment in an SPI case. I have blocked one range and two individual IPs, but am wondering if all IPs (shown by Whois) originating from the Hong Kong Cyberport might be eligible for webhostblock? The common feature is anti-Catalan editing, which is unusual coming from Hong Kong. The related SPI report is at Sockpuppet_investigations/14.136.156.23 and AN3 case was here. EdJohnston (talk) 15:34, 21 May 2018 (UTC)
 * If I read the article right - I'm not sure. It seems like there's residential and business connectivity there as well as hosting. I'll mark this one as needing a second opinion. SQL Query me!  02:05, 26 May 2018 (UTC)
 * We have seen some open proxies from this network, and I've not placed an extended block to date. That's as far as I'll go. This particular IP seems to hosting a network video recorder which should take some explanation. I'm unsure how dynamic it might be (other IPs on the network have proven to be dynamic). If there's other IPs from the same place I'd guess it's probably not a proxy. -- zzuuzz (talk) 20:49, 7 June 2018 (UTC)

92.195.0.0/16


Reason: This appears to be a German webhost and edits to Wikipedia have come from the range. I can't get specific, but I have someone editing on another wiki from this range and I'm leaning towards blocking it, so a second opinion would be appreciated. PCHS-NJROTC (Messages)Have a blessed day. 22:35, 26 July 2018 (UTC)
 * - QSC AG, It looks like they offer DSL as well as webhosting. That particular range looks like it might be more on the DSL side than the hosting side.  SQL Query me!  14:59, 27 July 2018 (UTC)
 * - Forgot to sign! SQL Query me!  14:59, 27 July 2018 (UTC)

185.227.68.38


Finnish IP address being used by a sockmaster who almost always geolocates to the UK. Proxychecker says it's a proxy. Just double checking here that I'm right - in the mean time I've blocked 185.227.68.0/24 for a year as it's pretty much exclusively used by disruptive editors, indeed looking at the contribs I've found another editor evading a block. Black Kite (talk) 13:55, 27 July 2018 (UTC)
 * I hard blocked 185.227.68.0/22. It's a webhost named EstNOC. NinjaRobotPirate (talk) 17:07, 29 July 2018 (UTC)

173.247.224.0/19


Reason: InMotion Hosting. 82.41.37.166 (talk) 16:12, 4 June 2018 (UTC)
 * Blocked SQL Query me!  01:00, 31 July 2018 (UTC)

174.34.128.0/18


Reason: Nobis Technology VPN services. 93.137.17.27 (talk) 19:08, 7 June 2018 (UTC)
 * I don't think it is anymore. Redirects to a leaseweb page. SQL Query me!  01:01, 31 July 2018 (UTC)

91.235.142.69


Geolocate says "Network sharing device or proxy server Recently reported forum spam source. (1) In addition, it geolocates to Kiev its edits make it seem unlikely the editor is based there. Doug Weller  talk 13:15, 22 June 2018 (UTC) - Good catch, I blocked the range, it looks like a webhost per .  SQL Query me!  01:04, 31 July 2018 (UTC)

91.235.142.0/23


Reason: "Agile webhosting servers" on. 126.22.117.27 (talk) 23:44, 23 June 2018 (UTC)
 * Already blocked above. SQL Query me!  01:07, 31 July 2018 (UTC)

108.167.128.0/18


Reason: HostGator and CyrusOne. 134.196.97.75 (talk) 21:16, 17 July 2018 (UTC)
 * Blocked SQL <sup style="font-size: 5pt;color:#999">Query me!  01:06, 31 July 2018 (UTC)

198.8.80.0/20


Reason: Total Server Solutions. 124.121.254.42 (talk) 06:10, 20 July 2018 (UTC)
 * Every total server solutions range has been blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  01:12, 31 July 2018 (UTC)

185.230.127.0/24


Reason: Recent vandalism from this webhosting service. Should be blocked similarly to 185.230.126.0/24, also a webhost in the same ISP. 90.101.62.63 (talk) 19:48, 11 July 2018 (UTC)
 * There's a lot of M247 that should probably be blocked. I'll start working on it in a bit. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:24, 23 July 2018 (UTC)
 * I've blocked all M247 ranges that I'm aware of at the moment. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:10, 4 August 2018 (UTC)

180.94.167.157


Reason: Suspicious edits Beeblebrox (talk) 17:40, 20 July 2018 (UTC)
 * SQL <sup style="font-size: 5pt;color:#999">Query me! 22:15, 4 August 2018 (UTC)

47.32.20.133


Reason: Suspicious edits (open proxy located in Madison, Wisconsin (US)) 5.171.0.211 (talk) 07:31, 28 July 2018 (UTC)
 * SQL <sup style="font-size: 5pt;color:#999">Query me! 22:20, 4 August 2018 (UTC)

103.60.172.10


Reason: Suspicious edits. Open proxy with two previous blocks from ProcseeBot. 96.249.217.100 (talk) 13:33, 31 July 2018 (UTC)
 * SQL <sup style="font-size: 5pt;color:#999">Query me! 22:18, 4 August 2018 (UTC)

162.210.192.0/21


Reason: LeaseWeb USA:. 101.108.97.90 (talk) 00:58, 20 July 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  04:23, 6 August 2018 (UTC)

178.140.144.173


Reason: Apparent Tor exit node:. 2601:1C0:4401:24A0:98CA:B38A:37D4:F038 (talk) 07:22, 5 August 2018 (UTC)
 * These are automatically blocked by an extension - but it looks to also be directly blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  17:47, 5 August 2018 (UTC)

46.242.130.212


Reason: ISP is home.pl S.A. which provides hosting services, organization "home.pl webhosting farm - static allocation". Some weird edits e.g. 1, and somehow they're able to use Twinkle - 2. -★- PlyrStar93  → Message me. ← 17:34, 5 August 2018 (UTC)
 * Thanks, I've blocked every one of home.pl's ranges. SQL <sup style="font-size: 5pt;color:#999">Query me!  17:51, 5 August 2018 (UTC)

41.202.238.254


Reason: Suspicious edits nearly concurrent with a blocked editor & whatismyipaddress.com/ip/41.202.238.254 comes back as a mail server. ☆ Bri (talk) 03:52, 6 August 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  04:21, 6 August 2018 (UTC)

209.58.128.0/18


Reason: Leasweb. Just off of 3-year webhost block. 2601:1C0:4401:24A0:8C08:620D:BCAF:5448 (talk) 04:17, 6 August 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  04:24, 6 August 2018 (UTC)

2600:3C03:0:0:0:0:0:0/32


Reason: Linode. 134.196.97.75 (talk) 21:16, 17 July 2018 (UTC)
 * Globally blocked. GABgab 02:30, 7 August 2018 (UTC)

95.216.142.196


Reason: Suspicious edits - MrX 🖋 00:06, 7 August 2018 (UTC)
 * . GABgab 02:29, 7 August 2018 (UTC)

147.75.46.130


Reason: Long-term abuse; user known to use open proxies. Ivanvector (Talk/Edits) 12:01, 8 August 2018 (UTC)
 * by Zzuuzz. GABgab 23:08, 8 August 2018 (UTC)

217.69.0.0/20


Reason: Choopa webhosting services. 2601:1C0:4401:24A0:58E3:2BFB:7648:785B (talk) 13:45, 10 August 2018 (UTC)
 * . GABgab 16:58, 17 August 2018 (UTC)

170.178.173.156


Reason: No activity on the English Wikipedia, but I have reason to believe this is an open proxy due to off-wiki abuse. There is, however, editing activity on the English Wikipedia from the 170.178.160.0/19 range, which belongs to a colocation provider. I would recommend blocking it. PCHS-NJROTC (Messages)Have a blessed day. 18:04, 11 August 2018 (UTC)
 * Blocked, along with every other sharktech range I could find. SQL <sup style="font-size: 5pt;color:#999">Query me!  17:50, 19 August 2018 (UTC)

185.44.76.119


Reason: Zare is a webhost, and someone who is proxy hopping on another site is using this IP. Since this IP is also editing Wikipedia, the range probably needs to be blocked here too. PCHS-NJROTC (Messages)Have a blessed day. 18:17, 11 August 2018 (UTC)
 * IP range for this is . 2601:1C0:4401:24A0:B807:B53C:D65:572C (talk) 18:26, 11 August 2018 (UTC)
 * now. GABgab 17:00, 17 August 2018 (UTC)

5.149.252.0/23


Reason: HZ Hosting Ltd. 2601:1C0:4401:24A0:A894:1D26:6856:35A5 (talk) 22:09, 12 August 2018 (UTC)
 * . GABgab 17:06, 17 August 2018 (UTC)

87.229.108.0/24


Reason: Webhosting service or similar used by obvious sock of Sockpuppet investigations/Shingling334 (see Special:Contributions/87.229.108.212). The IP geolocates to Hungary while Shingling334 geolocates to Turkey and Northern Cyprus during the summer and the UK during the winter. Shingling334 is known for using proxies, and has lead us to dozens of (now blocked) open proxies around the world, so I guess we owe him a thank for it. Special:Contributions/87.229.108.210 is already blocked for two years as a proxy, BTW, so it's not only Shingling334 who is using their services... - Tom &#124; Thomas.W talk 15:18, 17 August 2018 (UTC)
 * by Ian.thomson. GABgab 17:09, 17 August 2018 (UTC)
 * It's blocked for one month only, which is quite a bit too short for a proxy block... - Tom &#124; Thomas.W talk 17:30, 17 August 2018 (UTC)
 * It's not super active, but I extended the block by a couple of months. GABgab 21:09, 17 August 2018 (UTC)
 * If Shingling334 had been the only "problematic user" who had found it and used it I would have had no problems with a short block, but the mere fact that two different vandals/sockmasters have found it and used it over the past couple of days means that information about it is widely available, and that we can expect many more vandals and sockmasters to use it if we don't block it... - Tom &#124; Thomas.W talk 21:22, 17 August 2018 (UTC)

23.249.160.0/20


Reason: Colo-location web hosting range. Has been blocked before. 2601:1C0:4401:24A0:6880:7329:F509:DB0B (talk) 07:54, 11 August 2018 (UTC)
 * Blocked every net3 / N3t range. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:42, 21 August 2018 (UTC)

168.1.30.128/29


Reason: 168.1.30.128/29 assigned to Privax Limited (HideMyAss), VPN hosted at SoftLayer. MarioGom (talk) 16:37, 11 August 2018 (UTC)
 * Blocked, along with a lot of other privax ranges. SQL <sup style="font-size: 5pt;color:#999">Query me!  19:16, 19 August 2018 (UTC)

168.1.0.0/16


Reason: SoftLayer Technologies (webhosting service). The /16 range has a fairly lengthy block log. 2601:1C0:4401:24A0:64DF:A55A:67A:84C0 (talk) 04:04, 13 August 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:45, 21 August 2018 (UTC)

85.93.91.98


85.93.91.98 (talk) 14:23, 13 August 2018 (UTC)

Reason: user verified Tor exit node; requesting block to protect Wikipedia from future pests 85.93.91.98 (talk) 14:23, 13 August 2018 (UTC)
 * All of the IPs within the (85.93.64.0 to range belong to 85.93.95.255) all belong to HostEurope. Dedicated webhosting servers. 2601:1C0:4401:24A0:CC5A:FEC4:92E7:FEE8 (talk) 00:08, 15 August 2018 (UTC)
 * Blocked the tor node as well as the range. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:27, 21 August 2018 (UTC)

31.210.96.226


Reason: Sockpuppeting Ryanoo (talk) 03:57, 20 August 2018 (UTC)
 * - Looks like a colocation host from the whois. Also related:


 * All blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:56, 21 August 2018 (UTC)
 * All blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:56, 21 August 2018 (UTC)
 * All blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:56, 21 August 2018 (UTC)
 * All blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:56, 21 August 2018 (UTC)
 * All blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:56, 21 August 2018 (UTC)
 * All blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:56, 21 August 2018 (UTC)
 * All blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:56, 21 August 2018 (UTC)
 * All blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:56, 21 August 2018 (UTC)
 * All blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:56, 21 August 2018 (UTC)
 * All blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:56, 21 August 2018 (UTC)

192.154.96.0/20


Reason: GorillaServers:. 2601:1C0:4401:24A0:5111:5F4A:67FE:5C26 (talk) 17:33, 24 August 2018 (UTC)
 * This, and every other gorillaservers range - now blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  04:18, 25 August 2018 (UTC)

202.182.112.0/20


Reason: Choopa. 2601:1C0:4401:24A0:C0A8:948:A619:C90D (talk) 04:07, 24 August 2018 (UTC)
 * Note: Choopa provides connectivity as well as colocation / webhosting. SQL <sup style="font-size: 5pt;color:#999">Query me!  04:22, 25 August 2018 (UTC)
 * A lot of the recent IPs in this particular Choopa range (also indicated by WHOIS) have "vultr", in the hostname (example). I could be wrong, but I'm pretty sure that means it's a VPS server. Also, a banned user known widely for jumping between proxy IPs has recently used and  which are both within this IP range. 2601:1C0:4401:24A0:B80C:4065:CA00:567D (talk) 07:05, 25 August 2018 (UTC)
 * . GABgab 03:43, 26 August 2018 (UTC)

2A00:801:251:2530:46B:36AE:40F7:525A


Reason: Has used several other ip addresses   Magherbin (talk) 12:50, 27 August 2018 (UTC)