Wikipedia:WikiProject on open proxies/Requests/Archives/32

Colocation America Corporation & Kvchosting.com LLC


Reason: Suspicious edits, WHOIS (ip #1) gives Colocation America Corporation: could be webhost type proxy. IP #2 gives Kvchosting.com LLC; similar edits to same artcle in same time frame. ☆ Bri (talk) 20:05, 27 August 2018 (UTC)
 * as a colo. GABgab 01:32, 28 August 2018 (UTC)
 * on the second IP. Cogent / PSINet provides connectivity. Based on other checks, I don't think this is a colocation host. SQL Query me!  08:41, 2 September 2018 (UTC)

192.155.96.0/20


Reason: Possibly a webhosting server. Belongs to "HEG US". 2601:1C0:4401:24A0:75E3:C82B:A5D1:606B (talk) 05:59, 28 August 2018 (UTC)
 * Yep, Heg / godaddy. Blocked all the non-blocked heg and godaddy ranges as well. SQL Query me!  08:38, 2 September 2018 (UTC)

104.37.168.0/22


Reason: Reprise Hosting:. 73.240.4.160 (talk) 05:41, 30 August 2018 (UTC)
 * . GABgab 15:12, 30 August 2018 (UTC)

https://free-proxy-list.net/


Reason: Using NuclearWarfare's mark-blocked script, a majority of these IP address to not appear to be blocked nor locked anywhere, but I'm not sure how to actually access them. If someone could check and verify (even just one), that'd be great. Zeke Essiestudy (talk) 21:11, 31 August 2018 (UTC)
 * I believe the proxy bot does this. SQL Query me!  08:20, 2 September 2018 (UTC)

122.155.168.20


Reason: Evading scrutiny on WP:ANI. GenuineArt (talk) 05:15, 6 September 2018 (UTC)
 * Appears to be blocked as a proxy. SQL Query me!  11:23, 6 September 2018 (UTC)

38.142.216.42


Reason: Only disruptive editing, vandalism. Used by obvious sock of user:shingling334, but also for vandalism that doesn't fit shinging334's pattern. IamNotU (talk) 21:52, 6 September 2018 (UTC)
 * This has now been blocked for a year, so I'll close the request, hope that's ok... IamNotU (talk) 01:45, 12 September 2018 (UTC)

38.122.207.34


Reason: Used today by obvious sock of user:shingling334. Previous uses all vandalism/disruptive. IamNotU (talk) 16:52, 7 September 2018 (UTC)
 * This has now been blocked so I marked it as closed. IamNotU (talk) 01:47, 12 September 2018 (UTC)

38.30.28.202


Reason: Currently in use by obvious sock of user:shingling334. Previous uses all vandalism/disruptive. IamNotU (talk) 16:57, 7 September 2018 (UTC)
 * Blocked by User:Zzuuzz, marking it closed. IamNotU (talk) 01:49, 12 September 2018 (UTC)

46.29.2.111


Reason: Sock Puppetry Ryanoo (talk) 19:12, 7 September 2018 (UTC)
 * This is pretty clearly a webhost. I've blocked the range, as well as all the other Lertas ranges. SQL Query me!  23:27, 7 September 2018 (UTC)

45.123.118.159


Reason: Suspicious edits, whatismyipaddress.com reports network sharing device or proxy. ☆ Bri (talk) 15:42, 22 September 2018 (UTC)
 * as a colo. GABgab 16:04, 22 September 2018 (UTC)
 * thx. Note to self, WHOIS = SERVERFIELD (Taiwan colo or cloud compute center). ☆ Bri (talk) 16:22, 22 September 2018 (UTC)

184.175.64.0/18


Reason: Disruptive edits coming from. Per WHOIS, the IP block range for this webhost is 184.175.64.0/18. Belongs to Cybercon dedicated webhosting servers. 49.142.7.206 (talk) 17:57, 24 September 2018 (UTC)
 * Blocked. SQL Query me!  16:41, 26 September 2018 (UTC)

5.2.200.163


Reason: Reported possible open proxy: RCS-RDS («mail.bjmures.ro») which is located in Mures County. Thanks! 109.102.200.16 (talk) 18:34, 25 September 2018 (UTC)
 * SQL Query me! 16:42, 26 September 2018 (UTC)
 * SQL Query me! 16:47, 26 September 2018 (UTC)

194.0.64.0/22


Reason: Ricoh Hosting. Dedicated webhosting servers. 98.151.240.200 (talk) 19:57, 25 September 2018 (UTC)
 * Blocked. SQL Query me!  17:07, 26 September 2018 (UTC)

197.220.169.151


Reason: Suspicious edits. First edit in a long time is to my talkpage apparently suddenly interested in harrassing me and another editor--sock or evasion behavior but I don't know the master and CU can't just blindly fish there. whatismyipaddress reports: Services:  Network sharing device or proxy server Type:      Wireless Broadband Assignment: Static IP which sounds like open-proxy (static but shared/proxy-server). But I don't know anything about that provider if that is reliable info. DMacks (talk) 06:28, 24 September 2018 (UTC)
 * SQL Query me! 16:42, 26 September 2018 (UTC)
 * - There are some indicators that a proxy is/was operating somewhere in the /19 surrounding that IP (lots of DNSBL hits - ), but at this time that host does not appear to be an open proxy. This appears to be a cellular range, and it's common for IP's to change rapidly in this case. SQL Query me!  16:58, 26 September 2018 (UTC)

158.106.91.4


Reason: Suspicious edits on ro.wikipedia. Per https://www.ip2location.com/demo/158.106.91.4 Thank you. --37.6.109.144 (talk) 19:58, 27 September 2018 (UTC)
 * Without a doubt that's a VPN. The entire range also appears to be a webhost. /18 Blocked. SQL Query me!  21:06, 30 September 2018 (UTC)

41.164.30.218


Reason: These two proxy checkers: and  both state that this is an open proxy. Not sure how reliable those are, though. Nmap also found a bunch of open ports on this IP address as well... 124.122.90.177 (talk) 18:48, 4 October 2018 (UTC)
 * It appears to be a residential connection, running a VPN. When I google it, it does appear on some proxy lists, but none of the ports mentioned appear to be open. It appears to be on some spambl's as well, but it's possible at this point that the proxy customer has moved on / been disconnected. Unfortunately, for now it's  SQL Query me!  21:56, 4 October 2018 (UTC)

188.2.135.66


Reason: Suspicious edits on en.wikipedia and ro.wikipedia --Pafsanias (talk) 18:24, 9 October 2018 (UTC)
 * Never mind. IP address already blocked on Romanian Wikipedia. No other edits within the past week. Thank you. --Pafsanias (talk) 00:05, 21 October 2018 (UTC)

69.193.69.244


Reason: Vandalistic edits since October 13, 2015‎, even after many warnings --14:50, 15 October 2018 (UTC) Gpkp ( u • t • c )
 * . Looks like a school. GABgab 20:02, 15 October 2018 (UTC)
 * Thank you, GABgab. -- Gpkp ( u • t • c ) 03:49, 16 October 2018 (UTC)

1.10.189.91


Reason: Suspicious edits Beyond My Ken (talk) 15:40, 23 October 2018 (UTC)
 * by . GABgab 19:30, 24 October 2018 (UTC)

177.85.90.33


Reason: Suspicious edits Beyond My Ken (talk) 15:42, 23 October 2018 (UTC)
 * by . GABgab 19:30, 24 October 2018 (UTC)

190.64.147.18


Reason: Suspicious edits Beyond My Ken (talk) 15:44, 23 October 2018 (UTC)
 * by . GABgab 19:30, 24 October 2018 (UTC)

185.247.136.200


Reason: Suspicious edits Beyond My Ken (talk) 15:47, 23 October 2018 (UTC)
 * by . GABgab 19:30, 24 October 2018 (UTC)

45.119.91.111


Only 1 post, but by comment made in that post, clearly seems to be recent ref-desk troll who has been disrupting the reference desk and causing all of the problems that led to them being shut down. -- Jayron 32</b> 15:12, 29 October 2018 (UTC)

Reason: Suspicious edits  Jayron <b style="color:#090">32</b> 15:12, 29 October 2018 (UTC)
 * . GABgab 20:42, 29 October 2018 (UTC)

139.180.192.0/19


Reason: Choopa/webhosting servers 119.18.174.67 (talk) 06:23, 1 November 2018 (UTC)
 * . GABgab 02:05, 2 November 2018 (UTC)

88.12.3.152


Reason: This proxy check indicates that it's an open proxy, not to mention that it has been blocked by the proxy bot in the past as well. 47.149.143.100 (talk) 19:29, 4 October 2018 (UTC)
 * I've checked this repeatedly over the last month, and I've not seen any technical evidence that this is currently a proxy. There do appear to be some lingering RBL entries, but those are likely stale. SQL <sup style="font-size: 5pt;color:#999">Query me!  08:22, 19 November 2018 (UTC)

185.180.196.0/22


Reason: All IP addresses from 185.180.196.0 to 185.180.199.255 belong to King Servers (dedicated webhosting servers). 2601:1C0:4401:24A0:F427:6E8F:5237:1F6F (talk) 05:23, 11 October 2018 (UTC)
 * Blocked every address owned by King-Servers for a year. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:25, 9 November 2018 (UTC)

79.115.41.253


Reason: Apparent proxy/attack source. 2601:1C0:4401:24A0:7D2D:D646:4903:9614 (talk) 05:42, 12 October 2018 (UTC)
 * . GABgab 15:46, 13 November 2018 (UTC)

151.237.192.0/19 & 176.56.96.0/19


Reason: Both IP ranges belong to "ServiHosting Networks S.L." (webhosting/dedicated server networks). 73.240.4.160 (talk) 05:51, 12 October 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:10, 9 November 2018 (UTC)

103.254.208.0/22


Active IP range that was recently active on. This range has been blocked in the past. 2601:1C0:4401:24A0:D30:1D07:A2EE:90DB (talk) 07:14, 22 October 2018 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:06, 9 November 2018 (UTC)

172.83.40.67


Reason: Suspicious edits
 * WHOIS states that the /24 range at 172.83.40.0/24 is operated by Total Server Solutions. From their web site they are a web hosting company. Edits from this range have been reported at WP:AN3. I've blocked the range for three months anon-only as webhostblock. Offering this for review here to be sure I did it correctly. If confirmed, a block of one year or more might be reasonable. EdJohnston (talk) 20:55, 23 October 2018 (UTC)
 * , Yep - that's a hosting range. I've re-blocked it as a 1-year long hardblock, and cleaned up the other non-blocked TSS ranges. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:08, 8 November 2018 (UTC)

192.93.8.156


Reason: Used by country-hopping spammer. IamNotU (talk) 22:33, 2 November 2018 (UTC)
 * - . Unfortunately, I wasn't able to find any technical evidence that this IP is presently an open proxy. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:03, 9 November 2018 (UTC)

80.179.42.39 Comment


Reason: Used by obvious sock of Shingling334 known to use proxies, ipqualityscore.com score 95 "Proxy/VPN Detected" IamNotU (talk) 22:52, 8 November 2018 (UTC)
 * , HQServ indeed appears to be a VPS. Blocked, and I'll try to find more ranges belonging to this hosting provider to block. SQL <sup style="font-size: 5pt;color:#999">Query me!  02:57, 9 November 2018 (UTC)

107.77.249.6 Comment


Reason: Long history of vandalism and blocks, "confirmed proxy server" by whatismyipaddress.com, proxy score 100 at ipqualityscore.com. IamNotU (talk) 22:23, 14 November 2018 (UTC)
 * Pictogram voting wait blue.svg Checking... SQL <sup style="font-size: 5pt;color:#999">Query me!  08:11, 19 November 2018 (UTC)
 * This is very likely an infected host, per . Blocking for 3 months. SQL <sup style="font-size: 5pt;color:#999">Query me!  08:15, 19 November 2018 (UTC)

46.229.160.0/20


Reason: Webhosting server. Most recently active on. Range was blocked for 1 year in September 2017 as a webhosting server. 73.110.138.115 (talk) 08:02, 19 November 2018 (UTC)
 * Yep, that's a webhost. I've blocked all the relevant ranges. SQL <sup style="font-size: 5pt;color:#999">Query me!  08:11, 19 November 2018 (UTC)

77.247.80.0/21


Reason: SysEleven webhosting servers. Was blocked for 1 year in November 2017. 211.202.138.37 (talk) 18:51, 26 November 2018 (UTC)
 * All current SysEleven ranges are now blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:52, 26 November 2018 (UTC)

77.247.64.0/20


Reason: Rackhosting cloud servers. 211.202.138.37 (talk) 18:51, 26 November 2018 (UTC)
 * All current rackhosting ranges are now blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:46, 26 November 2018 (UTC)

95.168.177.215


Reason: Used by obvious sock of User:Shingling334. IamNotU (talk) 23:38, 26 November 2018 (UTC)
 * , Yep, colocation host Leaseweb. Blocking 95.168.176.0/21, and I'll start looking for more leaseweb ranges. SQL <sup style="font-size: 5pt;color:#999">Query me!  23:43, 26 November 2018 (UTC)

177.21.103.136


Reason: Ongoing weird ref desk questions –Deacon Vorbis (carbon &bull; videos) 05:17, 28 November 2018 (UTC)
 * Already blocked for quite some time. SQL <sup style="font-size: 5pt;color:#999">Query me!  05:27, 30 November 2018 (UTC)

165.161.16.45


Reason: Suspicious edits. Probably banned editor HarveyCarter. Beyond My Ken (talk) 17:38, 28 November 2018 (UTC)
 * Already blocked for a while. SQL <sup style="font-size: 5pt;color:#999">Query me!  05:28, 30 November 2018 (UTC)

62.215.100.42


Reason: Suspicious edits, causing disruption at both Catgirl and Template:Furry fandom. A proxy has been used before to cause similar disruption back in October. Protection might be needed on affected pages for persistent sock puppetry. 66.87.149.92 (talk) 02:13, 18 December 2018 (UTC)
 * by Zzuuzz. GABgab 16:58, 21 December 2018 (UTC)

185.117.89.70


Reason: Currently being used by blocked user Shingling334. ipqualityscore.com reports it as a proxy. IamNotU (talk) 21:44, 19 December 2018 (UTC)
 * Now blocked as colocation webhost by zzuuzz. --IamNotU (talk) 23:19, 21 December 2018 (UTC)