Jump to content

Wikipedia:WikiProject on open proxies/Requests/Archives/43

From Wikipedia, the free encyclopedia


69.248.29.230

{{proxycheckstatus}}

69.248.29.230 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
46.109.33.214 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: First IP was previously blocked by Checkuser: [1], and both IPs appear to act in coordination by supporting each other reverts. My very best wishes (talk) 01:51, 13 June 2021 (UTC)

Ugh. My very best wishes, these are indeed proxy IPs (as is the other one they showed up with to revert a third time), but they're residential proxies - blocking them will not be particularly effective. I've semi'd Radio Free Europe. GeneralNotability (talk) 02:02, 13 June 2021 (UTC)

194.195.112.0/20

{{proxycheckstatus}}

194.195.112.0/20 · contribs · block · log · stalk · Robtex · whois · Google

Linode range. Seed4me VPN on 194.195.117.201 (DNS: in.seed4.me). MarioGom (talk) 22:27, 12 June 2021 (UTC)

Blocked by SQL. Closing. MarioGom (talk) 18:17, 14 June 2021 (UTC)

103.192.173.0/24

{{proxycheckstatus}}

103.192.173.0/24 · contribs · block · log · stalk · Robtex · whois · Google

Intergrid range. The ASN is mostly blocked already. VPN.AC from 103.192.173.92 to 103.192.173.102. See DNS au2.vpn.ac. MarioGom (talk) 22:29, 12 June 2021 (UTC)

107.150.94.0/24

{{proxycheckstatus}}

107.150.94.0/24 · contribs · block · log · stalk · Robtex · whois · Google

Packet Exchange range. Many ranges already blocked. NordVPN and SurfShark:

NordVPN and SurfShark

--MarioGom (talk) 22:37, 12 June 2021 (UTC)

Range softblocked, ID'd VPN endpoints hardblocked. GeneralNotability (talk) 22:13, 15 June 2021 (UTC)

Biterika Group

{{proxycheckstatus}}

Extended content
2.59.50.0/24 · contribs · block · log · stalk · Robtex · whois · Google
5.183.130.0/24 · contribs · block · log · stalk · Robtex · whois · Google
31.40.203.0/24 · contribs · block · log · stalk · Robtex · whois · Google
45.11.20.0/23 · contribs · block · log · stalk · Robtex · whois · Google
45.15.72.0/23 · contribs · block · log · stalk · Robtex · whois · Google
45.81.136.0/23 · contribs · block · log · stalk · Robtex · whois · Google
45.84.176.0/23 · contribs · block · log · stalk · Robtex · whois · Google
45.86.0.0/23 · contribs · block · log · stalk · Robtex · whois · Google
45.87.252.0/23 · contribs · block · log · stalk · Robtex · whois · Google
45.89.16.0/22 · contribs · block · log · stalk · Robtex · whois · Google
45.90.196.0/24 · contribs · block · log · stalk · Robtex · whois · Google
45.140.52.0/22 · contribs · block · log · stalk · Robtex · whois · Google
46.8.10.0/23 · contribs · block · log · stalk · Robtex · whois · Google
46.8.14.0/23 · contribs · block · log · stalk · Robtex · whois · Google
46.8.16.0/23 · contribs · block · log · stalk · Robtex · whois · Google
46.8.22.0/23 · contribs · block · log · stalk · Robtex · whois · Google
46.8.56.0/23 · contribs · block · log · stalk · Robtex · whois · Google
46.8.106.0/23 · contribs · block · log · stalk · Robtex · whois · Google
46.8.110.0/23 · contribs · block · log · stalk · Robtex · whois · Google
46.8.154.0/23 · contribs · block · log · stalk · Robtex · whois · Google
46.8.156.0/23 · contribs · block · log · stalk · Robtex · whois · Google
46.8.192.0/23 · contribs · block · log · stalk · Robtex · whois · Google
46.8.212.0/23 · contribs · block · log · stalk · Robtex · whois · Google
46.8.222.0/23 · contribs · block · log · stalk · Robtex · whois · Google
92.119.193.0/24 · contribs · block · log · stalk · Robtex · whois · Google
94.158.190.0/24 · contribs · block · log · stalk · Robtex · whois · Google
95.182.124.0/22 · contribs · block · log · stalk · Robtex · whois · Google
109.248.12.0/22 · contribs · block · log · stalk · Robtex · whois · Google
109.248.48.0/23 · contribs · block · log · stalk · Robtex · whois · Google
109.248.54.0/23 · contribs · block · log · stalk · Robtex · whois · Google
109.248.128.0/23 · contribs · block · log · stalk · Robtex · whois · Google
109.248.138.0/23 · contribs · block · log · stalk · Robtex · whois · Google
109.248.142.0/23 · contribs · block · log · stalk · Robtex · whois · Google
109.248.166.0/23 · contribs · block · log · stalk · Robtex · whois · Google
109.248.204.0/23 · contribs · block · log · stalk · Robtex · whois · Google
185.181.244.0/22 · contribs · block · log · stalk · Robtex · whois · Google
188.130.128.0/23 · contribs · block · log · stalk · Robtex · whois · Google
188.130.136.0/23 · contribs · block · log · stalk · Robtex · whois · Google
188.130.142.0/23 · contribs · block · log · stalk · Robtex · whois · Google
188.130.184.0/22 · contribs · block · log · stalk · Robtex · whois · Google
188.130.188.0/23 · contribs · block · log · stalk · Robtex · whois · Google
188.130.210.0/23 · contribs · block · log · stalk · Robtex · whois · Google
188.130.218.0/23 · contribs · block · log · stalk · Robtex · whois · Google
188.130.220.0/23 · contribs · block · log · stalk · Robtex · whois · Google
194.32.229.0/24 · contribs · block · log · stalk · Robtex · whois · Google
194.34.248.0/24 · contribs · block · log · stalk · Robtex · whois · Google
194.35.113.0/24 · contribs · block · log · stalk · Robtex · whois · Google
212.115.49.0/24 · contribs · block · log · stalk · Robtex · whois · Google
213.226.101.0/24 · contribs · block · log · stalk · Robtex · whois · Google
2a06:d647::/32 · contribs · block · log · stalk · Robtex · whois · Google
2a07:ca07::/32 · contribs · block · log · stalk · Robtex · whois · Google
2a0a:5680::/29 · contribs · block · log · stalk · Robtex · whois · Google
2a0a:b387::/32 · contribs · block · log · stalk · Robtex · whois · Google
2a0b:2d87::/32 · contribs · block · log · stalk · Robtex · whois · Google

WHOIS says those IPs belong to Biterika Group LLC, a Web hosting provider. Some 188.130.x.x IPs were used to spam activilla.com (Wikipedia:WikiProject Spam/LinkReports/activilla.com). Kleinpecan (talk) 01:12, 15 June 2021 (UTC)

The IPs in the spam report are private proxies (verifiable with shodan). Possibly part of some paid proxy service or maybe in-house by the spammers. MarioGom (talk) 10:13, 15 June 2021 (UTC)
Thank you both. Softblocked the ranges, hardblocked the individual IPs. GeneralNotability (talk) 22:05, 15 June 2021 (UTC)

185.125.227.0/24

{{proxycheckstatus}}

185.125.227.0/24 · contribs · block · log · stalk · Robtex · whois · Google

Whole range in McAffee (not colo). Most IPs are used for the McAffee VPN service. spur flags, and it can also verified by SSL certs on ports 443 and 8081 (check shodan). MarioGom (talk) 17:59, 13 March 2021 (UTC)

185.221.69.46 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
2a06:bcc0::/29
, which is covered by

107.150.94.0/24 (again)

{{proxycheckstatus}}

107.150.94.0/24 · contribs · block · log · stalk · Robtex · whois · Google

This is a follow up to a previous report. Since the action was softblock on the range and hardblock on the individual IPs, I'm updating here with a more exhaustive list of VPN nodes per Spur.

Individual VPN addresses in the range
107.150.94.3 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.11 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.12 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.13 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.14 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.19 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.20 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.21 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.22 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.27 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.28 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.29 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.30 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.35 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.36 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.37 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.38 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.43 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.44 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.45 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.46 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan SURFSHARK_VPN
107.150.94.51 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.59 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.67 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.68 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.69 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.70 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.75 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.76 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.77 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.78 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.83 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.84 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.85 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.86 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.91 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.92 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.93 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.94 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.99 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.100 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.101 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.102 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.107 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.108 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.109 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.110 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.115 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.116 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.117 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.118 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN
107.150.94.123 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan NORD_VPN

--MarioGom (talk) 12:46, 16 June 2021 (UTC)

94.140.11.0/24

{{proxycheckstatus}}

94.140.11.0/24 · contribs · block · log · stalk · Robtex · whois · Google

Full range in NordVPN, see whois. MarioGom (talk) 22:10, 29 June 2021 (UTC)

BulletVPN

{{proxycheckstatus}}

103.131.95.105 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan mak01.bulletvpn.com
103.16.180.90 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan auc03.bulletvpn.com
103.16.181.14 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan auc01.bulletvpn.com
110.10.178.233 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan seo01.bulletvpn.com
162.217.248.162 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan lax02.bulletvpn.com
162.217.248.181 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan lax03.bulletvpn.com
185.113.140.190 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan qda01.bulletvpn.com
185.155.99.51 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan tll01.bulletvpn.com
196.46.191.250 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan cai03.bulletvpn.com
202.38.172.119 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan pun01.bulletvpn.com
202.38.172.157 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan pun02.bulletvpn.com
38.117.105.115 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan tor02.bulletvpn.com
38.117.105.139 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan tor01.bulletvpn.com
41.106.2.23 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan ann01.bulletvpn.com
41.215.240.133 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan cai02.bulletvpn.com
5.188.36.119 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan ist01.bulletvpn.com
64.71.133.140 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan cal01.bulletvpn.com
69.163.33.26 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan por02.bulletvpn.com
69.163.36.194 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan por01.bulletvpn.com
91.210.59.47 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan cph02.bulletvpn.com
96.47.10.96 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan col01.bulletvpn.com

Unblocked BulletVPN nodes. MarioGom (talk) 20:43, 24 May 2021 (UTC)

37.111.139.70

{{proxycheckstatus}}

37.111.139.70 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

The IP comes from Telenor Pakistan which does not host any Open proxies or VPN service. Let me remind you, open ports does not mean open proxy. @ST47: may i have your words to explain from where you got the impression that its a proxy? 37.111.129.108 (talk) 12:49, 2 June 2021 (UTC)

whois is from Telenor Pakistan. 37.111.129.108 (talk) 12:58, 2 June 2021 (UTC)
37.111.139.70, 37.111.129.108: Both of these IPs seem to be from the same device, possibly a mobile connection (or equivalent such as 4G broadband). This device appears to be running a residential proxy. This is usually because you have a malicious application in your mobile phone which is turning the device into a proxy for others to use. I would suggest you to review your device for potentially dodgy applications. MarioGom (talk) 17:30, 2 June 2021 (UTC)
  • All blocked as proxies, but from what I can see, I'd call this highly  Unlikely, unless there's some open proxy node behind the IP that I can't see (or ST47 has more data available than I do). There are proxy signatures here, but not the type I'd expect to see used on Wikipedia (beans, but cf. T265845). --Blablubbs|talk 11:15, 10 June 2021 (UTC)

105.235.71.132

{{proxycheckstatus}}

105.235.71.132 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Edit warring through yet another proxy on page Radio Free Asia. This is almost certainly the same person as the IP 94.64.198.226 reported just above here. I suspect that could be also one of named accounts who edited this page through proxy. As a note of order, all edits by this IP must be reverted because this is not a legitimate account/editing. My very best wishes (talk) 16:39, 12 June 2021 (UTC)

Very likely peer-to-peer proxy. Same as with this previous report. It is already blocked, although the long block will be ineffective in this case. Since the page is now semi-protected, I'd suggest closing this. MarioGom (talk) 22:05, 13 June 2021 (UTC)

114.141.194.0/24

{{proxycheckstatus}}

114.141.194.0/24 · contribs · block · log · stalk · Robtex · whois · Google

"Wholesale Services Provider", see website. Many ranges already blocked. CyberGhost VPN, more info below:

Some CyberGhost IPs

--MarioGom (talk) 22:33, 12 June 2021 (UTC)

Done. GeneralNotability (talk) 01:18, 3 July 2021 (UTC)

PureVPN (II)

{{proxycheckstatus}}

46.243.224.2 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan al-ikev.ptoserver.com
46.243.224.4 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan al-ipsec.pointtoserver.com
178.170.136.2 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan cy2-ikev.ptoserver.com
178.170.136.4 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan cy2-tcp.ptoserver.com
85.208.3.18 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur/shodan
85.208.3.19 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan fi2-auto-ikev.ptoserver.com
85.208.3.20 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur
85.208.3.21 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur/shodan, ns1057.dnspure.com
85.208.3.22 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur/shodan
85.208.3.26 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur/shodan
85.208.3.27 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur/shodan
85.208.3.28 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur/shodan
85.208.3.29 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur/shodan
85.208.3.30 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur
85.208.3.34 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan fi2-auto-tcp.ptoserver.com
85.208.3.35 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur
85.208.3.43 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan fi2-tcp.ptoserver.com
85.208.3.44 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur
5.172.204.194 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur
5.172.204.195 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan gr2-auto-udp.ptoserver.com
5.172.204.196 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur
5.172.204.197 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur
5.172.204.198 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur
178.21.169.244 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan gr2-tcp.ptoserver.com
178.21.169.245 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan gr2-udp.ptoserver.com
103.16.199.164 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan id2-auto-ikev.ptoserver.com
103.16.199.117 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan id2-auto-tcp.ptoserver.com
103.16.199.115 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan id2-auto-udp.ptoserver.com
92.38.175.7 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan it2-auto-ipsec.ptoserver.com
92.38.175.9 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan it2-auto-udp.ptoserver.com
213.21.198.17 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan lv-ipsec.ptoserver.com
213.21.198.18 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur
213.21.198.19 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan lv2-auto-tcp.ptoserver.com
213.21.198.20 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur
213.21.198.21 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur
141.101.134.6 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan lv2-udp.ptoserver.com
103.28.90.31 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur
103.28.90.32 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan my2-ovpn-tcp.ptoserver.com
103.28.90.54 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan my2-auto-tcp.ptoserver.com
103.28.90.55 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan my2-auto-udp.ptoserver.com
103.28.90.56 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan my-ikev.ptoserver.com
103.28.91.148 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan my2-auto-ikev.ptoserver.com
79.142.64.207 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan nl2-auto-ipsec.ptoserver.com
141.101.146.2 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan no-ikev.ptoserver.com
185.125.170.26 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan no2-auto-udp.ptoserver.com
185.125.170.44 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan no2-auto-tcp.ptoserver.com
185.125.170.163 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan no2-ovpn-tcp.pointtoserver.com
185.125.170.162 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan no2-ovpn-tcp.ptoserver.com
185.125.170.164 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan no2-ovpn-udp.pointtoserver.com
185.125.170.165 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan no2-ovpn-udp.pointtoserver.com
185.125.170.166 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan no2-ovpn-udp.pointtoserver.com
185.125.170.167 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan no2-ovpn-udp.pointtoserver.com
185.125.170.168 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan no2-ovpn-udp.pointtoserver.com
185.125.170.169 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan no2-ovpn-udp.pointtoserver.com
185.125.170.170 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan no2-ovpn-udp.pointtoserver.com
185.125.170.171 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan no2-ovpn-udp.pointtoserver.com
94.242.54.23 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan ru2-ovpn-tcp.pointtoserver.com
HOSTKEY-RU-AS
:46.243.220.0/24 · contribs · block · log · stalk · Robtex · whois · Google
46.243.220.4 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan ru-ipsec.pointtoserver.com
HOSTKEY-RU-AS
:206.123.128.0/19 · contribs · block · log · stalk · Robtex · whois · Google
206.123.139.4 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan ru2-ovpn-tcp.pointtoserver.com
149.7.226.105 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan per spur
149.7.226.106 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan sk-ipsec.ptoserver.com
149.7.226.110 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan sk2-auto-udp.ptoserver.com
149.7.226.111 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan sk2-auto-tcp.ptoserver.com
116.206.126.69 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan th2-auto-ipsec.ptoserver.com
128.1.63.67 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan tw2-auto-udp.ptoserver.com

Notes:

  • 46.243.224.0/24 per whois data is wholly assigned to PureVPN-NET.
  • 178.170.136.0/24 per whois data is wholly assigned to PureVPN-NET.
  • 85.208.3.0/24 whois data may be misleading. This /24 has many PureVPN nodes and every IP has a srv-dN.inioscloud.com hostname. Website (http://inioscloud.com/ https://www.kotisivut.com/) and hostnames suggest that the whole /24 is a web host.
  • 5.172.204.192/26 offers all kinds of server hosting and colocation services (https://www.lancom.gr/). If you check ISP Range Finder, be careful, since results are mixed with CityLanCom LTD. Many other ranges in the ISP are already blocked. So I guess either the /24 or /26 are good for a block.
  • 178.21.169.0/24 is also Lancom LTD as the previous one. This /24 is clearly marked in whois as Cloud-Customers. So a webhost block should be good.
  • 103.16.199.0/24 provides servers and connectivity (https://jalanet.co.id), I'm not really sure about this one. Maybe hard blocks for the individual IPs?
  • 92.38.175.0/27 per whois data is wholly assigned to pointtoserver (PureVPN alias), but the /24 would also be good to block since we're already blocking most G-Core Labs S.A. ranges.
  • 213.21.192.0/20 seems to be a ISP/backbone (Versia), not good to block. It might be better to hard block the individual IPs.
  • 141.101.134.0/24 also on Versia but this whole /24 subrange is assigned to PureVPN-NET per whois.
  • 103.28.90.0/24 and 103.28.91.0/24 is primarily hosting (https://www.gbnetwork.my/), other ranges already blocked for hosting VPNs.
  • 79.142.64.0/22 is already under a soft block. Please do hard block the individual IPs.
  • 141.101.146.0/24 per whois data is wholly assigned to PureVPN-NET.
  • 185.125.170.0/24 whois data is a bit weird. 185.125.170.40/29 and 185.125.170.160/28 are assigned to GZSYSTEMS (PureVPN alias) while 185.125.170.24 to 185.125.170.30 are outside those subranges and are PureVPN too. I guess the /24 is good for a hard block.
  • 94.242.48.0/20 is a FishNet ASN, Veesp datacenter subrange.
  • 46.243.220.0/24 per whois data is wholly assigned to PureVPN-NET.
  • 206.123.128.0/19 per whois email is assigned to pointtoserver (PureVPN alias).
  • 149.7.226.0/24 second opinion needed.
  • 116.206.126.0/24 cloud service per whois. Didn't look in depth.
  • 128.1.63.0/24 per whois data is subrange is Zenlayer Managed Hosting.

Unblocked PureVPN nodes that I missed in the initial report. MarioGom (talk) 11:40, 15 May 2021 (UTC)

IPVanish (II)

{{proxycheckstatus}}

81.171.52.0/27 · contribs · block · log · stalk · Robtex · whois · Google
81.171.52.32/27 · contribs · block · log · stalk · Robtex · whois · Google
81.171.52.64/27 · contribs · block · log · stalk · Robtex · whois · Google
81.171.52.96/27 · contribs · block · log · stalk · Robtex · whois · Google
81.171.52.128/27 · contribs · block · log · stalk · Robtex · whois · Google
81.171.52.160/27 · contribs · block · log · stalk · Robtex · whois · Google
81.171.52.192/27 · contribs · block · log · stalk · Robtex · whois · Google
81.171.52.224/27 · contribs · block · log · stalk · Robtex · whois · Google
81.171.53.0/27 · contribs · block · log · stalk · Robtex · whois · Google

IPVanish (AKA Mudhook Marketing, see whois). They can be consolidated as:

81.171.52.0/24 · contribs · block · log · stalk · Robtex · whois · Google
81.171.53.0/27 · contribs · block · log · stalk · Robtex · whois · Google

--MarioGom (talk) 22:26, 29 June 2021 (UTC)

Done. GeneralNotability (talk) 01:14, 3 July 2021 (UTC)

109.111.209.163

{{proxycheckstatus}}

109.111.209.211 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Off a one month block and vandalising again (see also edit filter). Popped up on WIMIA as a "Confirmed proxy server". Proxychecker ticks proxy/VPN (IPQualityScore only). Spur says it "has been used as a VPN or Proxy to anonymize traffic" but low traffic. Web address in hostname (metronet-uk.com) resolves to M247, a company that offers dedicated servers, cloud hosting, data centres and colocation among other things. --Malcolmxl5 (talk) 14:51, 7 July 2021 (UTC)

Malcolmxl5: No luck with Spur's API. While almost everything in M247 proper (AS9009) are proxies, this IP belongs to a different AS, which I think is residential. Looking at Shodan, port 80 runs Squid (possibly a proxy), port 443 serves a certificate for ivybridge.devon.sch.uk. This could be a school, school gateway, school proxy or something like that, which is consistent with the edits to Ivybridge. A school block on the individual IP might be more appropriate than a proxy block. MarioGom (talk) 22:29, 8 July 2021 (UTC)
Nice work, MarioGom, thanks. Certainly looks like a school so I’ll put a SharedIPedu template on the talk page and keep an eye on it. I’ll close this request now. --Malcolmxl5 (talk) 22:47, 8 July 2021 (UTC)

93.190.93.133

{{proxycheckstatus}}

93.190.93.133 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Spur flags this as Hide My Ip VPN. --Malcolmxl5 (talk) 10:31, 14 July 2021 (UTC)

@Malcolmxl5:  Confirmed. The ISP is a mixed colo/webhosting provider, looks like there are quite a few blockable ranges here ([2]) but I unfortunately don't have time for a deeper check right now. The IP is good to hardblock, I'd go for a year. Blablubbs (talk) 10:38, 14 July 2021 (UTC)
 Done --Malcolmxl5 (talk) 10:54, 14 July 2021 (UTC)

Ivacy VPN

{{proxycheckstatus}}

103.109.103.59 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan hk-ovpn-udp2.dns2use.com
103.28.90.32 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan my2-ovpn-udp.dns2use.com
91.218.115.221 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan ru2-ovpn-tcp.dns2use.com
141.101.170.2 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan vlbr-usvc1.dns2use.com

-- MarioGom (talk) 20:52, 24 May 2021 (UTC)

31.41.45.190

{{proxycheckstatus}}

31.41.45.190 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Webproxy, flagged by GetIPIntel and leads to https://proxylistpro.com/ Firestar464 (talk) 11:57, 17 June 2021 (UTC)

  •  Confirmed, thank you for reporting. Pink clock Awaiting administrative action – please hardblock 31.41.40.0/21 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser (log)) (cishost) for two years. The ASN could potentially use a look as well. --Blablubbs|talk 12:04, 17 June 2021 (UTC)
    Blablubbs, a quick looks suggests that cishost is a colo/hosting provider, why am I hardblocking it? GeneralNotability (talk) 17:05, 17 June 2021 (UTC)
    @GeneralNotability, I only saw webhost offerings; virtual dedicated servers, physical dedicated servers, hosting resale, domains and SSL certs. Did I miss something? --Blablubbs|talk 17:29, 17 June 2021 (UTC)
    So I think I can provide a bit of background, actually I already did here. So I don't think this is an open proxy per se, but it is anonymizing, probably a vpn or secure proxy. I'm not up to date on the latest policy but if merely being anonymizing is against it than this will fall afoul. Technically I am using it to bypass a longish mobile IP range-block, which I am fairly certain is permitted since the block is not directed against me as a person, and no I'm not creating an account period even if it would make editing easier because, you know, principles. It's not really a big deal both because I told myself I was going to limit my activity to a month or two at most, and because there's dozens of similar apps of which at a spot check about 3/4s are unblocked at any one time, that is assuming that any block would be aimed at the IP at not at myself of course. Anyway I should be around for the next hour or so to answer any questions, assuming that even if a block is required there's no urgency in implementing. Pinging GeneralNotability and Blablubbs. Regards, 31.41.45.190 (talk) 19:29, 17 June 2021 (UTC)
    Look, I need to get some shut-eye. Hopefully the information I've provided is adequate, because I think I've finally convinced myself to follow my own rules and try to forget about all this behind the scenes stuff for a bit no really. I'll be back around to help out eventually and yes I know it's all going to dissolve into grey goo sooner or later no matter what I do, but maybe I can assist in slowing things down a bit, and I'll make a note of this IP in case there are conversations to be had later. Regards, 31.41.45.190 (talk) 20:30, 17 June 2021 (UTC)
  • I'm seeing lots of good edits from this IP - no abusive contributions, which is a criterion for block requests. That might change of course if someone else gets to use the IP address but for now, I would be inclined to hold off blocking. --Malcolmxl5 (talk) 00:37, 18 June 2021 (UTC)
    @Malcolmxl5, as far as I'm aware, all open proxies may be blocked on sight, regardless of whether there are abusive anonymous contributions or not (we have tonnes and tonnes of unblocked webhosts with no visible anon edits). I'm also sympathetic here, but the issue is that we have no way of telling whether others may be using this IP abusively while logged in (unless someone wants to CU it, but being a proxy is not grounds for a check on its own); we also don't know how many other hosts on the range are proxies – I can openssl my way through, but I usually prefer not doing that unless there's a highly compelling reason. We have also now publicised this node, meaning that the chances of future abuse (logged-in or logged-out) have increased substantially. My inclination would be to block regardless, and with sincere apologies to the IP editor currently on this proxy. --Blablubbs|talk 12:42, 18 June 2021 (UTC
    No apology necessary, I understand fully, however note the word may, not must, so admin discretion is permitted.
    I'm not particularly technically knowledgeable so take this FWIW, but I'm unsure how much this being publicised actually increases risk, trying to find one app among many other essentially identical apps is like looking for one particular needle in a needlestack. And given current geopolitics it may not even be directly accessible in the regions where the majority of contributors are located (not that eastern Europe has any shortage of LTAs, believe me I’ve had my run-ins with a few, just that the density is lower).
    Anyway, I endorse the block, but I’m also big on meatball:AvoidIllusion. We are lucky that most vandals are too dull to realise that downloading apps to evade a block is even an option. But those that do will just continue to switch between apps (or between options within apps) until they get bored, and given how many apps come and go on a weekly basis we are never going to block them all, or even a significant percentage of them; that is why page protection exists. Regards, 81.177.3.8 (talk) 19:51, 14 July 2021 (UTC)

"Technically I am using it to bypass a longish mobile IP range-block, which I am fairly certain is permitted since the block is not directed against me as a person" Isn't that block evasion? Create an account. That's how we do it here. Firestar464 (talk) 04:43, 19 June 2021 (UTC)

If they are not the block target, that is not evasion, no. --Blablubbs|talk 09:39, 19 June 2021 (UTC)
See meatball:LoginsAreEvil. Regards, 81.177.3.8 (talk) 19:49, 14 July 2021 (UTC)

M247 (91.245.x.x)

{{proxycheckstatus}}

91.245.252.0/24 · contribs · block · log · stalk · Robtex · whois · Google
91.245.253.0/24 · contribs · block · log · stalk · Robtex · whois · Google
91.245.254.0/24 · contribs · block · log · stalk · Robtex · whois · Google
91.245.255.0/24 · contribs · block · log · stalk · Robtex · whois · Google

M247 with various VPN services. M247 ranges are usually catched by ASNBlock and hard blocked. But these are missing. MarioGom (talk) 17:59, 3 July 2021 (UTC)

 Done 91.245.254.0/24 and 91.245.255.0/24 are already blocked. --Malcolmxl5 (talk) 09:09, 16 July 2021 (UTC)

206.217.192.0/19

{{proxycheckstatus}}

206.217.192.0/19 · contribs · block · log · stalk · Robtex · whois · Google
Proxies in the reported range

UK2NET. Judging from previous blocks in the ASN (all of them with proxies), this is a common VPN host. The reported range hosts TorGuard from 206.217.216.3 to 206.217.216.28. According to Spur, 206.217.207.36 is Actmobile VPN. Possibly others too. MarioGom (talk) 21:17, 4 July 2021 (UTC)

104.166.128.0/18

{{proxycheckstatus}}

TunnelBear servers

ZenLayer (frequent VPN colo), see previous blocks. This range hosts TunnelBear (see above) and TurboVPN (see enwiki contribs). The TurboVPN nodes are used by LTA. MarioGom (talk) 14:54, 16 July 2021 (UTC)

@MarioGom:  Done !ɘM γɿɘυϘ⅃ϘƧ 18:20, 16 July 2021 (UTC)