Wikipedia:WikiProject on open proxies/Requests/Archives/33
 | This page is an archive. Do not edit the contents of this page. Please direct any additional comments to the current main page. |
64.42.176.0/21
– This proxy check request is closed and will soon be archived by a bot.
Reason: "US Dedicated" servers. 2601:1C0:4401:24A0:D0C3:28B8:D3C3:B995 (talk) 23:58, 28 November 2018 (UTC)
61.91.86.227
– This proxy check request is closed and will soon be archived by a bot.
- 61.91.86.227 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Vandalism to an article vandalized earlier by a now-blocked IP Natureium (talk) 00:10, 29 November 2018 (UTC)
2a02:4a8::/32
– This proxy check request is closed and will soon be archived by a bot.
Reason: Likely webhost server(s). Current block should probably be extended and converted to a hard-block as well. 2601:1C0:4401:24A0:51BC:5241:9A0E:B49A (talk) 05:53, 6 December 2018 (UTC)
2a03:e600:100:0:0:0:0:15
– This proxy check request is closed and will soon be archived by a bot.
- 2a03:e600:100:0:0:0:0:15 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · geo · rangeblocks · spur · shodan
Reason: Unblocked TOR Exit node as indicated by edit and reverse DNS which resolves to tor-exit-anonymizer-04-v6.appliedprivacy.net. No abuse from this exit node at this time. Kb03 (talk) 15:54, 8 January 2019 (UTC)
138.162.0.41
– This proxy check request is closed and will soon be archived by a bot.
- 138.162.0.41 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Proxy used by User:Reguyla.[1] See proxychecker result. --Guy Macon (talk) 23:50, 11 January 2019 (UTC)
- Presently blocked for 6 months. Probably not an open proxy per se, but does carry a lot of navy traffic. SQLQuery me! 23:53, 11 January 2019 (UTC)
172.78.12.200
– This proxy check request is closed and will soon be archived by a bot.
- 172.78.12.200 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits Beyond My Ken (talk) 06:02, 7 December 2018 (UTC)
216.248.99.93
– This proxy check request is closed and will soon be archived by a bot.
- 216.248.99.93 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits; editing almost exclusively about Russian and Cyprus biz/fin topics or bios, but is located in Iowa, United States from a possible business private cloud provider. ☆ Bri (talk) 03:54, 18 December 2018 (UTC)
- Bri, This appears to be a public library. I don't see anything on the technical side to indicate that it may be an open proxy. SQLQuery me! 00:18, 12 January 2019 (UTC)
195.75.95.5
– This proxy check request is closed and will soon be archived by a bot.
- 195.75.95.5 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 195.212.58.200 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Internal AT&T corporate proxy, not anonymous, for intra-company use only. Reason: Requested unblock. 85.237.234.205 (talk) 14:08, 11 January 2019 (UTC)
- Could you point me at the unblock request, please? SQLQuery me! 00:09, 12 January 2019 (UTC)
- Here is it: Обсуждение_участника:195.75.95.5. Sorry, it's in Russian. I've asked to unban this two IP addresses, that is why I'm trying to get more evidence from reputable sources (like your verification and input). This two IP addresses were auto-banned by robot only for the reason that they are listed in online IP address databases and marked as VPN/proxy addresses. Well, yes, they are exit points of AT&T corporate VPN and web-proxy, not public VPN/proxy. Administrator denies to unban IPs, and requests to find ways to delist IP addresses from those databases, I (obviously) have no control of. That's what I can say on this situation. 84.245.121.15 (talk) 14:53, 12 January 2019 (UTC) Roman
- Unfortunately, this is on ruwiki, not here - there isn't anything we can do about blocks on other wikis. SQLQuery me! 18:07, 12 January 2019 (UTC)
- Sorry to hear that. I have just requested for a (manual) check, not for any interference in ruwiki. 84.245.121.15 (talk) 18:18, 12 January 2019 (UTC) Roman
- There don't appear to be any DNSBl listings on 195.212.58.200, tho there are on 195.75.95.5. This can sometimes be symptomatic of an open proxy. 195.75.95.5 is also listed as a "AT&T EMEA Customer Range", this may not be consistent with internal use. There isn't any hard and fast technical evidence of either being an open proxy, but that certainly does not rule out the possibility, especially if there were behavioral evidence. SQLQuery me! 18:36, 12 January 2019 (UTC)
- I have found no suspicious activities (edits) from this addresses in Wikipedia, however I have no access to advanced tooling you use internally. I hear you response that you would not be able to technically verify if this addresses are open proxies or not, thus I'm fine with closing this request and will try to appeal on administrators board of ruwiki on the basis of lack of evidence of suspicious activities on Wikipedia (rather than being listed in some list). Thank you. 85.216.236.3 (talk) 09:56, 13 January 2019 (UTC) Roman.
- There don't appear to be any DNSBl listings on 195.212.58.200, tho there are on 195.75.95.5. This can sometimes be symptomatic of an open proxy. 195.75.95.5 is also listed as a "AT&T EMEA Customer Range", this may not be consistent with internal use. There isn't any hard and fast technical evidence of either being an open proxy, but that certainly does not rule out the possibility, especially if there were behavioral evidence. SQLQuery me! 18:36, 12 January 2019 (UTC)
- Sorry to hear that. I have just requested for a (manual) check, not for any interference in ruwiki. 84.245.121.15 (talk) 18:18, 12 January 2019 (UTC) Roman
- Unfortunately, this is on ruwiki, not here - there isn't anything we can do about blocks on other wikis. SQLQuery me! 18:07, 12 January 2019 (UTC)
- Here is it: Обсуждение_участника:195.75.95.5. Sorry, it's in Russian. I've asked to unban this two IP addresses, that is why I'm trying to get more evidence from reputable sources (like your verification and input). This two IP addresses were auto-banned by robot only for the reason that they are listed in online IP address databases and marked as VPN/proxy addresses. Well, yes, they are exit points of AT&T corporate VPN and web-proxy, not public VPN/proxy. Administrator denies to unban IPs, and requests to find ways to delist IP addresses from those databases, I (obviously) have no control of. That's what I can say on this situation. 84.245.121.15 (talk) 14:53, 12 January 2019 (UTC) Roman
103.20.212.0/22
– This proxy check request is closed and will soon be archived by a bot.
Reason: Open proxy which is freely available, may be subject to abuse since it is collateral.. This is a proxy, proxy.. Thanks.. 182.58.235.109 (talk) 16:46, 11 January 2019 (UTC)
203.190.37.250
– This proxy check request is closed and will soon be archived by a bot.
- 203.190.37.250 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Also see:
- 203.190.36.250 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Engaging in an edit war at Help:IPA/Italian. Nardog (talk) 17:26, 11 January 2019 (UTC)
- @Nardog: - Blocked both ips for 1 month as a possibly infected / botnet host per https://www.abuseat.org/lookup.cgi?ip=203.190.37.250 and https://www.abuseat.org/lookup.cgi?ip=203.190.36.250. SQLQuery me! 20:25, 12 January 2019 (UTC)
212.103.49.164
– This proxy check request is closed and will soon be archived by a bot.
- 212.103.49.164 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: I am currently editing this using the Private Internet Access VPN. 212.103.49.164 (talk) 11:15, 12 January 2019 (UTC)
185.34.40.0/22
– This proxy check request is closed and will soon be archived by a bot.
Reason: Host1Plus. Technically, WHOIS shows the IP ranges 185.34.40.0 through 185.34.43.255 are all registered to this hosting service (although the WHOIS link only shows each of the /24 ranges, each one is registered to this hosting service). 60.238.69.45 (talk) 18:58, 28 November 2018 (UTC)
94.236.253.39
– This proxy check request is closed and will soon be archived by a bot.
- 94.236.253.39 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits Beyond My Ken (talk) 13:51, 5 January 2019 (UTC)
45.56.128.0/18
– This proxy check request is closed and will soon be archived by a bot.
Reason: Suspicious edits. Lots of unconstructive edits from this IP range, just off of a three year webhost block. 116.98.203.212 (talk) 23:45, 16 January 2019 (UTC)
18.144.0.0/16
– This proxy check request is closed and will soon be archived by a bot.
Reason: Amazon AWS. Immediately started back up again after 1-year block was lifted. 100.12.237.205 (talk) 05:29, 17 January 2019 (UTC)
157.230.0.0/16
– This proxy check request is closed and will soon be archived by a bot.
Reason: Suspicious edits. Digital Ocean. 101.109.142.224 (talk) 17:45, 17 January 2019 (UTC)
104.129.0.0/18
– This proxy check request is closed and will soon be archived by a bot.
Reason: QuadraNet IP range/webhosting service. Was previously blocked as a webhost. 67.246.113.98 (talk) 06:31, 18 January 2019 (UTC)
155.254.115.73
– This proxy check request is closed and will soon be archived by a bot.
- 155.254.115.73 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 155.254.115.74 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits 156.219.175.224 (talk) 14:03, 19 January 2019 (UTC)
- Blocked, along with every other Oppobox range I could find. SQLQuery me! 03:55, 21 January 2019 (UTC)
213.65.195.254
– This proxy check request is closed and will soon be archived by a bot.
- 213.65.195.254 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits. Suspected block evasion. Previously blocked as open proxy. ipqualityscore report confirms likely proxy connection. BastunĖġáḍβáś₮ŭŃ! 23:53, 19 January 2019 (UTC)
- Bastun, Good catch. This is very likely a compromised host. SQLQuery me! 03:51, 21 January 2019 (UTC)
37.112.8.48
– This proxy check request is closed and will soon be archived by a bot.
- 37.112.8.48 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits Beyond My Ken (talk) 13:52, 5 January 2019 (UTC)
- I can't find any technical evidence of this being an open proxy, and I've been watching it for a couple weeks. SQLQuery me! 22:47, 28 January 2019 (UTC)
3.90.0.0/16
– This proxy check request is closed and will soon be archived by a bot.
Reason: Amazon AWS. 200.123.121.69 (talk) 20:32, 24 January 2019 (UTC)
221.132.113.78
– This proxy check request is closed and will soon be archived by a bot.
- 221.132.113.78 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits, WHOIS reports this is a mail server. Bri.public (talk) 22:08, 24 January 2019 (UTC)
- I believe that this is a colocation webhost, based on the webpage for the provider, combined with range resolution. Blocked. SQLQuery me! 22:45, 28 January 2019 (UTC)
84.39.112.0/21
– This proxy check request is closed and will soon be archived by a bot.
Reason: M247 webhosting servers. 190.73.158.226 (talk) 18:38, 30 January 2019 (UTC)
- In order to block around these 6 vodafone hosts in this /21 (Special:Contribs/84.39.116.8/29), we need to block:
- 84.39.112.0/22 · contribs · block · log · stalk · Robtex · whois · Google
- 84.39.116.0/29 · contribs · block · log · stalk · Robtex · whois · Google
- 84.39.116.16/28 · contribs · block · log · stalk · Robtex · whois · Google
- 84.39.116.32/27 · contribs · block · log · stalk · Robtex · whois · Google
- 84.39.116.64/26 · contribs · block · log · stalk · Robtex · whois · Google
- 84.39.116.128/25 · contribs · block · log · stalk · Robtex · whois · Google
- 84.39.117.0/24 · contribs · block · log · stalk · Robtex · whois · Google
- 84.39.118.0/23 · contribs · block · log · stalk · Robtex · whois · Google
- I'll start looking at these ranges in a moment. SQLQuery me! 18:25, 31 January 2019 (UTC)
- Subranges blocked, here is the map in case it helps future me. SQLQuery me! 18:28, 31 January 2019 (UTC)
51.158.0.0/16
– This proxy check request is closed and will soon be archived by a bot.
Reason: Recent disruption at 51.158.68.68 (talk · contribs · WHOIS), which is a confirmed VPN server. May need to be rangeblocked. 82.43.173.129 (talk) 12:09, 31 January 2019 (UTC)
77.68.0.0/17
– This proxy check request is closed and will soon be archived by a bot.
Reason: Dedicated servers. IP range has been blocked twice in the past. 103.90.220.88 (talk) 02:29, 1 February 2019 (UTC)
38.91.106.250
– This proxy check request is closed and will soon be archived by a bot.
- 38.91.106.250 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: ipqualityscore reports 100%, used for vandalism and sock puppetry. IamNotU (talk) 00:29, 8 February 2019 (UTC)
2605:3E80:0:0:0:0:0:0/32
– This proxy check request is closed and will soon be archived by a bot.
Reason: Suspicious edits. This webhost range has been blocked several times in the past. 106.176.182.73 (talk) 20:16, 12 February 2019 (UTC)
64.156.195.179
– This proxy check request is closed and will soon be archived by a bot.
- 64.156.195.179 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspected proxy sock of Shingling334 IamNotU (talk) 02:02, 14 February 2019 (UTC)
- IamNotU, That does appear to be a VPN host on M5Hosting, but I don't have enough evidence to define a range to block. I'll block that IP for 3 years. SQLQuery me! 04:12, 14 February 2019 (UTC)
193.37.253.140
– This proxy check request is closed and will soon be archived by a bot.
- 193.37.253.140 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits, Geolocate returns "Network sharing device or proxy server" IPQ's fraud scoring algorithm has rated this IP address as high risk, scoring 100 out of 100. Toddst1 (talk) 14:54, 14 February 2019 (UTC)
- Toddst1, Yep, M247, a VPS / hosting provider. Range blocked. SQLQuery me! 16:44, 14 February 2019 (UTC)
66.199.245.92
– This proxy check request is closed and will soon be archived by a bot.
- 66.199.245.92 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Probably just a troll, but claims to be "behind 7 proxies." Deserves some kind of block in any case. Mojoworker (talk) 20:08, 16 February 2019 (UTC)
- Mojoworker, It is a webhost, for sure - AccessIT - Hosting Services. Blocked the entire range for a good long while. SQLQuery me! 04:18, 17 February 2019 (UTC)
169.56.89.114
– This proxy check request is closed and will soon be archived by a bot.
- 169.56.89.114 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Today's sock IP of Shingling334 IamNotU (talk) 02:45, 17 February 2019 (UTC)
197.156.107.156
– This proxy check request is closed and will soon be archived by a bot.
- 197.156.107.156 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Is this the right place for this? Usage of multiple ip's they start off the same and the last few digits are different. The ip is blanking content Lokiszm7 (talk) 22:28, 10 February 2019 (UTC)
204.237.128.0/17
– This proxy check request is closed and will soon be archived by a bot.
Reason: Suspicious edits. All of the recent IPs used to edit in this range all show up as either confirmed open proxies and/or VPNs on ipqualityscore.com. 106.176.182.73 (talk) 19:07, 12 February 2019 (UTC)
41.106.3.19
– This proxy check request is closed and will soon be archived by a bot.
- 41.106.3.19 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits. IP hopping attacks on The Barclay School. This one reports as "Network sharing device or proxy server" with 95% on IPQ. Meters (talk) 04:44, 18 February 2019 (UTC)
- Possibly a compromised host. Seems that it may no longer be compromised. SQLQuery me! 02:39, 4 March 2019 (UTC)
191.96.97.58
– This proxy check request is closed and will soon be archived by a bot.
- 191.96.97.58 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Currently editing on proxy. Host1Plus VPN server. WHOIS gives 191.96.0.0/16 range to block, but that may be too wide... 191.96.97.58 (talk) 04:40, 21 February 2019 (UTC)
85.255.0.0/20
– This proxy check request is closed and will soon be archived by a bot.
Reason: Possible webhosting/VPN cloud IP range. 115.163.197.237 (talk) 17:34, 21 February 2019 (UTC)
77.73.64.0/21
– This proxy check request is closed and will soon be archived by a bot.
Reason: Possible webhosting/VPN cloud IP range. 115.163.197.237 (talk) 17:35, 21 February 2019 (UTC)
98.189.246.148
– This proxy check request is closed and will soon be archived by a bot.
- 98.189.246.148 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Confirmed mail server/possible VPN/open proxy. 122.197.229.186 (talk) 17:48, 21 February 2019 (UTC)
107.77.245.11
– This proxy check request is closed and will soon be archived by a bot.
- 107.77.245.11 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits, identified as network sharing device or proxy server[2] and this CBL report.[3] Doug Weller talk 10:43, 25 February 2019 (UTC)
- Doug Weller, It's AT&T wireless - so whomever was connected to that IP is probably long gone. It looks like there haven't been any hits since Feb 20 according to the CBL. It does look like it's had some issues last year as well [4], but nothing I can find suggests that it is currently compromised. SQLQuery me! 02:53, 4 March 2019 (UTC)
- @SQL: thanks. Doug Weller talk 10:15, 5 March 2019 (UTC)
52.124.6.146
– This proxy check request is closed and will soon be archived by a bot.
- 52.124.6.146 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Based on Geolocate, this is also a "Recently reported forum spam source". The user is clearly WP:Not here. My very best wishes (talk) 18:24, 4 March 2019 (UTC)
199.247.0.103
– This proxy check request is closed and will soon be archived by a bot.
- 199.247.0.103 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: sock of user:Shingling334 via Choopa/Vultr. See also (already (range)blocked): Special:Contributions/199.247.19.165, Special:Contributions/199.247.11.161, Special:Contributions/199.247.15.29, etc. (all Shingling334) - maybe a wider range needed? IamNotU (talk) 00:07, 10 March 2019 (UTC)
- I've expanded two of the blocks to rangeblocks. There isn't really a wider range to be set, however. SQLQuery me! 20:44, 12 March 2019 (UTC)
46.166.160.0/21
– This proxy check request is closed and will soon be archived by a bot.
Reason: Dedicated servers. 68.183.186.105 (talk) 03:27, 12 March 2019 (UTC)
65.202.120.234
– This proxy check request is closed and will soon be archived by a bot.
- 65.202.120.234 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Mail server. Probable VPN/open proxy. 185.104.93.114 (talk) 20:27, 12 March 2019 (UTC)
Declined to run a check Looking at the organization name, and what the IP is editing - while the hostname does begin with the string "mail", I don't believe that this is an open proxy. SQLQuery me! 20:58, 12 March 2019 (UTC)
- Yep, you're right. The IP belongs to a school: "LAUREATE EDUCATION, INC". Thanks. 185.104.93.114 (talk) 21:18, 12 March 2019 (UTC)
