Wikipedia:WikiProject on open proxies/Requests/Archives/33

64.42.176.0/21


Reason: "US Dedicated" servers. 2601:1C0:4401:24A0:D0C3:28B8:D3C3:B995 (talk) 23:58, 28 November 2018 (UTC)
 * Every "US Dedicated" range I could find is now blocked. SQL Query me!  00:02, 12 January 2019 (UTC)

61.91.86.227


Reason: Vandalism to an article vandalized earlier by a now-blocked IP Natureium (talk) 00:10, 29 November 2018 (UTC)
 * Blocked as a proxy. SQL Query me!  23:57, 11 January 2019 (UTC)

2a02:4a8::/32


Reason: Likely webhost server(s). Current block should probably be extended and converted to a hard-block as well. 2601:1C0:4401:24A0:51BC:5241:9A0E:B49A (talk) 05:53, 6 December 2018 (UTC)
 * Every active 24 range I could find is now blocked. SQL Query me!  00:03, 12 January 2019 (UTC)

2a03:e600:100:0:0:0:0:15


Reason: Unblocked TOR Exit node as indicated by edit and reverse DNS which resolves to tor-exit-anonymizer-04-v6.appliedprivacy.net. No abuse from this exit node at this time. Kb03 (talk) 15:54, 8 January 2019 (UTC)
 * Blocked 2a03:e600:100::/112. SQL Query me!  00:13, 12 January 2019 (UTC)

138.162.0.41


Reason: Proxy used by User:Reguyla. See proxychecker result. --Guy Macon (talk) 23:50, 11 January 2019 (UTC)
 * Presently blocked for 6 months. Probably not an open proxy per se, but does carry a lot of navy traffic. SQL Query me!  23:53, 11 January 2019 (UTC)

172.78.12.200


Reason: Suspicious edits Beyond My Ken (talk) 06:02, 7 December 2018 (UTC)
 * This does not appear to be an open proxy at this time. SQL Query me!  00:19, 12 January 2019 (UTC)

216.248.99.93


Reason: Suspicious edits; editing almost exclusively about Russian and Cyprus biz/fin topics or bios, but is located in Iowa, United States from a possible business private cloud provider. ☆ Bri (talk) 03:54, 18 December 2018 (UTC)
 * , This appears to be a public library. I don't see anything on the technical side to indicate that it may be an open proxy.  SQL Query me!  00:18, 12 January 2019 (UTC)

195.75.95.5


Internal AT&T corporate proxy, not anonymous, for intra-company use only.

Reason: Requested unblock. 85.237.234.205 (talk) 14:08, 11 January 2019 (UTC)
 * Could you point me at the unblock request, please? SQL Query me!  00:09, 12 January 2019 (UTC)
 * Here is it: Обсуждение_участника:195.75.95.5. Sorry, it's in Russian. I've asked to unban this two IP addresses, that is why I'm trying to get more evidence from reputable sources (like your verification and input). This two IP addresses were auto-banned by robot only for the reason that they are listed in online IP address databases and marked as VPN/proxy addresses. Well, yes, they are exit points of AT&T corporate VPN and web-proxy, not public VPN/proxy. Administrator Q-bit_array denies to unban IPs, and requests to find ways to delist IP addresses from those databases, I (obviously) have no control of. That's what I can say on this situation. 84.245.121.15 (talk) 14:53, 12 January 2019 (UTC) Roman
 * Unfortunately, this is on ruwiki, not here - there isn't anything we can do about blocks on other wikis. SQL Query me!  18:07, 12 January 2019 (UTC)
 * Sorry to hear that. I have just requested for a (manual) check, not for any interference in ruwiki. 84.245.121.15 (talk) 18:18, 12 January 2019 (UTC) Roman
 * There don't appear to be any DNSBl listings on 195.212.58.200, tho there are on 195.75.95.5. This can sometimes be symptomatic of an open proxy. 195.75.95.5 is also listed as a "AT&T EMEA Customer Range", this may not be consistent with internal use. There isn't any hard and fast technical evidence of either being an open proxy, but that certainly does not rule out the possibility, especially if there were behavioral evidence. SQL Query me!  18:36, 12 January 2019 (UTC)
 * I have found no suspicious activities (edits) from this addresses in Wikipedia, however I have no access to advanced tooling you use internally. I hear you response that you would not be able to technically verify if this addresses are open proxies or not, thus I'm fine with closing this request and will try to appeal on administrators board of ruwiki on the basis of lack of evidence of suspicious activities on Wikipedia (rather than being listed in some list). Thank you. 85.216.236.3 (talk) 09:56, 13 January 2019 (UTC) Roman.

103.20.212.0/22


Reason: Open proxy which is freely available, may be subject to abuse since it is collateral.. This is a proxy, proxy.. Thanks.. 182.58.235.109 (talk) 16:46, 11 January 2019 (UTC)
 * I've blocked every netmagic range, as well as e2e. SQL Query me!  00:52, 14 January 2019 (UTC)

203.190.37.250


Also see:

Reason: Engaging in an edit war at Help:IPA/Italian. Nardog (talk) 17:26, 11 January 2019 (UTC)
 * - Blocked both ips for 1 month as a possibly infected / botnet host per https://www.abuseat.org/lookup.cgi?ip=203.190.37.250 and https://www.abuseat.org/lookup.cgi?ip=203.190.36.250. SQL Query me!  20:25, 12 January 2019 (UTC)

212.103.49.164


Reason: I am currently editing this using the Private Internet Access VPN. 212.103.49.164 (talk) 11:15, 12 January 2019 (UTC)
 * Blocked. SQL Query me!  14:37, 13 January 2019 (UTC)

185.34.40.0/22


Reason: Host1Plus. Technically, WHOIS shows the IP ranges 185.34.40.0 through 185.34.43.255 are all registered to this hosting service (although the WHOIS link only shows each of the /24 ranges, each one is registered to this hosting service). 60.238.69.45 (talk) 18:58, 28 November 2018 (UTC)
 * Blocked. SQL Query me!  17:51, 17 January 2019 (UTC)

94.236.253.39


Reason: Suspicious edits Beyond My Ken (talk) 13:51, 5 January 2019 (UTC)
 * . GABgab 03:06, 18 January 2019 (UTC)

45.56.128.0/18


Reason: Suspicious edits. Lots of unconstructive edits from this IP range, just off of a three year webhost block. 116.98.203.212 (talk) 23:45, 16 January 2019 (UTC)
 * Blocked another 3 years - Webhost "Blockless VPN". SQL Query me!  03:36, 17 January 2019 (UTC)

18.144.0.0/16


Reason: Amazon AWS. Immediately started back up again after 1-year block was lifted. 100.12.237.205 (talk) 05:29, 17 January 2019 (UTC)
 * Reblocked for 3 years. SQL Query me!  17:48, 17 January 2019 (UTC)

157.230.0.0/16


Reason: Suspicious edits. Digital Ocean. 101.109.142.224 (talk) 17:45, 17 January 2019 (UTC)
 * Blocked, thanks! SQL <sup style="font-size: 5pt;color:#999">Query me!  18:35, 17 January 2019 (UTC)

104.129.0.0/18


Reason: QuadraNet IP range/webhosting service. Was previously blocked as a webhost. 67.246.113.98 (talk) 06:31, 18 January 2019 (UTC)
 * Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:48, 21 January 2019 (UTC)

155.254.115.73


Reason: Suspicious edits 156.219.175.224 (talk) 14:03, 19 January 2019 (UTC)
 * Blocked, along with every other Oppobox range I could find. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:55, 21 January 2019 (UTC)

213.65.195.254


Reason: Suspicious edits. Suspected block evasion. Previously blocked as open proxy. ipqualityscore report confirms likely proxy connection. <span style="font-family:Verdana, sans-serif">Bastun Ėġáḍβáś₮ŭŃ! 23:53, 19 January 2019 (UTC)
 * , Good catch. This is very likely a compromised host. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:51, 21 January 2019 (UTC)

37.112.8.48


Reason: Suspicious edits Beyond My Ken (talk) 13:52, 5 January 2019 (UTC)
 * I can't find any technical evidence of this being an open proxy, and I've been watching it for a couple weeks. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:47, 28 January 2019 (UTC)

3.90.0.0/16


Reason: Amazon AWS. 200.123.121.69 (talk) 20:32, 24 January 2019 (UTC)
 * Blocked! SQL <sup style="font-size: 5pt;color:#999">Query me!  22:38, 28 January 2019 (UTC)

221.132.113.78


Reason: Suspicious edits, WHOIS reports this is a mail server. Bri.public (talk) 22:08, 24 January 2019 (UTC)
 * I believe that this is a colocation webhost, based on the webpage for the provider, combined with range resolution. Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  22:45, 28 January 2019 (UTC)

84.39.112.0/21


Reason: M247 webhosting servers. 190.73.158.226 (talk) 18:38, 30 January 2019 (UTC)
 * In order to block around these 6 vodafone hosts in this /21 (Special:Contribs/84.39.116.8/29), we need to block:


 * I'll start looking at these ranges in a moment. SQL <sup style="font-size: 5pt;color:#999">Query me!  18:25, 31 January 2019 (UTC)
 * Subranges blocked, here is the map in case it helps future me. SQL <sup style="font-size: 5pt;color:#999">Query me!  18:28, 31 January 2019 (UTC)
 * I'll start looking at these ranges in a moment. SQL <sup style="font-size: 5pt;color:#999">Query me!  18:25, 31 January 2019 (UTC)
 * Subranges blocked, here is the map in case it helps future me. SQL <sup style="font-size: 5pt;color:#999">Query me!  18:28, 31 January 2019 (UTC)
 * I'll start looking at these ranges in a moment. SQL <sup style="font-size: 5pt;color:#999">Query me!  18:25, 31 January 2019 (UTC)
 * Subranges blocked, here is the map in case it helps future me. SQL <sup style="font-size: 5pt;color:#999">Query me!  18:28, 31 January 2019 (UTC)
 * I'll start looking at these ranges in a moment. SQL <sup style="font-size: 5pt;color:#999">Query me!  18:25, 31 January 2019 (UTC)
 * Subranges blocked, here is the map in case it helps future me. SQL <sup style="font-size: 5pt;color:#999">Query me!  18:28, 31 January 2019 (UTC)
 * I'll start looking at these ranges in a moment. SQL <sup style="font-size: 5pt;color:#999">Query me!  18:25, 31 January 2019 (UTC)
 * Subranges blocked, here is the map in case it helps future me. SQL <sup style="font-size: 5pt;color:#999">Query me!  18:28, 31 January 2019 (UTC)

51.158.0.0/16


Reason: Recent disruption at, which is a confirmed VPN server. May need to be rangeblocked. 82.43.173.129 (talk) 12:09, 31 January 2019 (UTC)
 * All online s.a.s. ranges have been blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  16:39, 31 January 2019 (UTC)

77.68.0.0/17


Reason: Dedicated servers. IP range has been blocked twice in the past. 103.90.220.88 (talk) 02:29, 1 February 2019 (UTC)
 * Blocked for a while. SQL <sup style="font-size: 5pt;color:#999">Query me!  03:37, 1 February 2019 (UTC)

38.91.106.250


Reason: ipqualityscore reports 100%, used for vandalism and sock puppetry. IamNotU (talk) 00:29, 8 February 2019 (UTC)
 * Yep, webhost. Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  04:20, 8 February 2019 (UTC)

2605:3E80:0:0:0:0:0:0/32


Reason: Suspicious edits. This webhost range has been blocked several times in the past. 106.176.182.73 (talk) 20:16, 12 February 2019 (UTC)
 * Blocked, Micfo. SQL <sup style="font-size: 5pt;color:#999">Query me!  17:51, 14 February 2019 (UTC)

64.156.195.179


Reason: Suspected proxy sock of Shingling334 IamNotU (talk) 02:02, 14 February 2019 (UTC)
 * , That does appear to be a VPN host on M5Hosting, but I don't have enough evidence to define a range to block. I'll block that IP for 3 years. SQL <sup style="font-size: 5pt;color:#999">Query me!  04:12, 14 February 2019 (UTC)

193.37.253.140


Reason: Suspicious edits, Geolocate returns "Network sharing device or proxy server" IPQ's fraud scoring algorithm has rated this IP address as high risk, scoring 100 out of 100. Toddst1 (talk) 14:54, 14 February 2019 (UTC)
 * , Yep, M247, a VPS / hosting provider. Range blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  16:44, 14 February 2019 (UTC)

66.199.245.92


Reason: Probably just a troll, but claims to be "behind 7 proxies." Deserves some kind of block in any case. Mojoworker (talk) 20:08, 16 February 2019 (UTC)
 * , It is a webhost, for sure - AccessIT - Hosting Services. Blocked the entire range for a good long while. SQL <sup style="font-size: 5pt;color:#999">Query me!  04:18, 17 February 2019 (UTC)

169.56.89.114


Reason: Today's sock IP of Shingling334 IamNotU (talk) 02:45, 17 February 2019 (UTC)
 * , Yep, blocked the range. SQL <sup style="font-size: 5pt;color:#999">Query me!  04:19, 17 February 2019 (UTC)

197.156.107.156


Reason: Is this the right place for this? Usage of multiple ip's they start off the same and the last few digits are different. The ip is blanking content Lokiszm7 (talk) 22:28, 10 February 2019 (UTC)
 * SQL <sup style="font-size: 5pt;color:#999">Query me! 02:35, 4 March 2019 (UTC)

204.237.128.0/17


Reason: Suspicious edits. All of the recent IPs used to edit in this range all show up as either confirmed open proxies and/or VPNs on ipqualityscore.com. 106.176.182.73 (talk) 19:07, 12 February 2019 (UTC)
 * Yes, unitasglobal.com - Blocked for a while. SQL <sup style="font-size: 5pt;color:#999">Query me!  02:36, 4 March 2019 (UTC)

41.106.3.19


Reason: Suspicious edits. IP hopping attacks on The Barclay School. This one reports as "Network sharing device or proxy server" with 95% on IPQ. Meters (talk) 04:44, 18 February 2019 (UTC)
 * Possibly a compromised host. Seems that it may no longer be compromised. SQL <sup style="font-size: 5pt;color:#999">Query me!  02:39, 4 March 2019 (UTC)

191.96.97.58


Reason: Currently editing on proxy. Host1Plus VPN server. WHOIS gives 191.96.0.0/16 range to block, but that may be too wide... 191.96.97.58 (talk) 04:40, 21 February 2019 (UTC)
 * /16 seems appropriate. Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  02:40, 4 March 2019 (UTC)

85.255.0.0/20


Reason: Possible webhosting/VPN cloud IP range. 115.163.197.237 (talk) 17:34, 21 February 2019 (UTC)
 * Cloud Services CZ1 - Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  02:43, 4 March 2019 (UTC)

77.73.64.0/21


Reason: Possible webhosting/VPN cloud IP range. 115.163.197.237 (talk) 17:35, 21 February 2019 (UTC)
 * veesp.com/ - Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  02:42, 4 March 2019 (UTC)

98.189.246.148


Reason: Confirmed mail server/possible VPN/open proxy. 122.197.229.186 (talk) 17:48, 21 February 2019 (UTC)
 * Looks like it. Blocked. SQL <sup style="font-size: 5pt;color:#999">Query me!  02:48, 4 March 2019 (UTC)

107.77.245.11


Reason: Suspicious edits, identified as network sharing device or proxy server and this CBL report.  Doug Weller  talk 10:43, 25 February 2019 (UTC)
 * , It's AT&T wireless - so whomever was connected to that IP is probably long gone. It looks like there haven't been any hits since Feb 20 according to the CBL. It does look like it's had some issues last year as well, but nothing I can find suggests that it is currently compromised. SQL <sup style="font-size: 5pt;color:#999">Query me!  02:53, 4 March 2019 (UTC)
 * thanks. Doug Weller  talk 10:15, 5 March 2019 (UTC)

52.124.6.146


Based on Geolocate, this is also a "Recently reported forum spam source". The user is clearly WP:Not here. My very best wishes (talk) 18:24, 4 March 2019 (UTC)
 * Already blocked as a proxy. SQL <sup style="font-size: 5pt;color:#999">Query me!  18:44, 4 March 2019 (UTC)

199.247.0.103


Reason: sock of user:Shingling334 via Choopa/Vultr. See also (already (range)blocked): Special:Contributions/199.247.19.165, Special:Contributions/199.247.11.161, Special:Contributions/199.247.15.29, etc. (all Shingling334) - maybe a wider range needed? IamNotU (talk) 00:07, 10 March 2019 (UTC)
 * I've expanded two of the blocks to rangeblocks. There isn't really a wider range to be set, however. SQL <sup style="font-size: 5pt;color:#999">Query me!  20:44, 12 March 2019 (UTC)

46.166.160.0/21


Reason: Dedicated servers. 68.183.186.105 (talk) 03:27, 12 March 2019 (UTC)
 * Blocked all Cherry Servers ranges. SQL <sup style="font-size: 5pt;color:#999">Query me!  20:49, 12 March 2019 (UTC)

65.202.120.234


Reason: Mail server. Probable VPN/open proxy. 185.104.93.114 (talk) 20:27, 12 March 2019 (UTC)
 * Looking at the organization name, and what the IP is editing - while the hostname does begin with the string "mail", I don't believe that this is an open proxy. SQL <sup style="font-size: 5pt;color:#999">Query me!  20:58, 12 March 2019 (UTC)
 * Yep, you're right. The IP belongs to a school: "LAUREATE EDUCATION, INC". Thanks. 185.104.93.114 (talk) 21:18, 12 March 2019 (UTC)