Wikipedia:WikiProject on open proxies/Requests/Archives/32

Colocation America Corporation & Kvchosting.com LLC

– This proxy check request is closed and will soon be archived by a bot.

216.74.107.5 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

38.131.148.84 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, WHOIS (ip #1) gives Colocation America Corporation: could be webhost type proxy. IP #2 gives Kvchosting.com LLC; similar edits to same artcle in same time frame. ☆ Bri (talk) 20:05, 27 August 2018 (UTC)

 Range blocked 216.74.104.0/21 (talk · contribs) as a colo. GAB^gab 01:32, 28 August 2018 (UTC)

 Not done on the second IP. Cogent / PSINet provides connectivity. Based on other checks, I don't think this is a colocation host. SQL^{Query me!} 08:41, 2 September 2018 (UTC)

192.155.96.0/20

– This proxy check request is closed and will soon be archived by a bot.

192.155.96.0/20 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Possibly a webhosting server. Belongs to "HEG US". 2601:1C0:4401:24A0:75E3:C82B:A5D1:606B (talk) 05:59, 28 August 2018 (UTC)

Yep, Heg / godaddy. Blocked all the non-blocked heg and godaddy ranges as well. SQL^{Query me!} 08:38, 2 September 2018 (UTC)

104.37.168.0/22

– This proxy check request is closed and will soon be archived by a bot.

104.37.168.0/22 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Reprise Hosting: [1]. 73.240.4.160 (talk) 05:41, 30 August 2018 (UTC)

 Range blocked. GAB^gab 15:12, 30 August 2018 (UTC)

https://free-proxy-list.net/

– This proxy check request is closed and will soon be archived by a bot.

Reason: Using NuclearWarfare's mark-blocked script, a majority of these IP address to not appear to be blocked nor locked anywhere, but I'm not sure how to actually access them. If someone could check and verify (even just one), that'd be great. Zeke Essiestudy (talk) 21:11, 31 August 2018 (UTC)

I believe the proxy bot does this. SQL^{Query me!} 08:20, 2 September 2018 (UTC)

122.155.168.20

– This proxy check request is closed and will soon be archived by a bot.

122.155.168.20 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Evading scrutiny on WP:ANI. GenuineArt (talk) 05:15, 6 September 2018 (UTC)

Appears to be blocked as a proxy. SQL^{Query me!} 11:23, 6 September 2018 (UTC)

38.142.216.42

– This proxy check request is closed and will soon be archived by a bot.

38.142.216.42 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Only disruptive editing, vandalism. Used by obvious sock of user:shingling334, but also for vandalism that doesn't fit shinging334's pattern. IamNotU (talk) 21:52, 6 September 2018 (UTC)

This has now been blocked for a year, so I'll close the request, hope that's ok... IamNotU (talk) 01:45, 12 September 2018 (UTC)

38.122.207.34

– This proxy check request is closed and will soon be archived by a bot.

38.122.207.34 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Used today by obvious sock of user:shingling334. Previous uses all vandalism/disruptive. IamNotU (talk) 16:52, 7 September 2018 (UTC)

This has now been blocked so I marked it as closed. IamNotU (talk) 01:47, 12 September 2018 (UTC)

38.30.28.202

– This proxy check request is closed and will soon be archived by a bot.

38.30.28.202 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Currently in use by obvious sock of user:shingling334. Previous uses all vandalism/disruptive. IamNotU (talk) 16:57, 7 September 2018 (UTC)

Blocked by User:Zzuuzz, marking it closed. IamNotU (talk) 01:49, 12 September 2018 (UTC)

46.29.2.111

– This proxy check request is closed and will soon be archived by a bot.

46.29.2.111 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Sock Puppetry Ryanoo (talk) 19:12, 7 September 2018 (UTC)

This is pretty clearly a webhost. I've blocked the range, as well as all the other Lertas ranges. SQL^{Query me!} 23:27, 7 September 2018 (UTC)

45.123.118.159

– This proxy check request is closed and will soon be archived by a bot.

45.123.118.159 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, whatismyipaddress.com reports network sharing device or proxy. ☆ Bri (talk) 15:42, 22 September 2018 (UTC)

 Range blocked as a colo. GAB^gab 16:04, 22 September 2018 (UTC)

thx. Note to self, WHOIS = SERVERFIELD (Taiwan colo or cloud compute center). ☆ Bri (talk) 16:22, 22 September 2018 (UTC)

184.175.64.0/18

– This proxy check request is closed and will soon be archived by a bot.

184.175.64.0/18 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Disruptive edits coming from 184.175.102.29 (talk · contribs · WHOIS). Per WHOIS, the IP block range for this webhost is 184.175.64.0/18. Belongs to Cybercon dedicated webhosting servers. 49.142.7.206 (talk) 17:57, 24 September 2018 (UTC)

Blocked. SQL^{Query me!} 16:41, 26 September 2018 (UTC)

5.2.200.163

– This proxy check request is closed and will soon be archived by a bot.

5.2.200.163 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Reported possible open proxy: RCS-RDS («mail.bjmures.ro») which is located in Mures County. Thanks! 109.102.200.16 (talk) 18:34, 25 September 2018 (UTC)

 Checking... SQL^{Query me!} 16:42, 26 September 2018 (UTC)

 Likely IP is an open proxy SQL^{Query me!} 16:47, 26 September 2018 (UTC)

194.0.64.0/22

– This proxy check request is closed and will soon be archived by a bot.

194.0.64.0/22 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Ricoh Hosting. Dedicated webhosting servers. 98.151.240.200 (talk) 19:57, 25 September 2018 (UTC)

Blocked. SQL^{Query me!} 17:07, 26 September 2018 (UTC)

197.220.169.151

– This proxy check request is closed and will soon be archived by a bot.

197.220.169.151 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. First edit in a long time is to my talkpage apparently suddenly interested in harrassing me and another editor--sock or evasion behavior but I don't know the master and CU can't just blindly fish there. whatismyipaddress reports:

Services:   Network sharing device or proxy server
Type:       Wireless Broadband
Assignment: Static IP

which sounds like open-proxy (static but shared/proxy-server). But I don't know anything about that provider if that is reliable info. DMacks (talk) 06:28, 24 September 2018 (UTC)

 Checking... SQL^{Query me!} 16:42, 26 September 2018 (UTC)

DMacks - There are some indicators that a proxy is/was operating somewhere in the /19 surrounding that IP (lots of DNSBL hits - [2]), but at this time that host does not appear to be an open proxy. This appears to be a cellular range, and it's common for IP's to change rapidly in this case. SQL^{Query me!} 16:58, 26 September 2018 (UTC)

158.106.91.4

– This proxy check request is closed and will soon be archived by a bot.

158.106.91.4 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits on ro.wikipedia. Per https://www.ip2location.com/demo/158.106.91.4 Thank you. --37.6.109.144 (talk) 19:58, 27 September 2018 (UTC)

Without a doubt that's a VPN. The entire range also appears to be a webhost. /18 Blocked. SQL^{Query me!} 21:06, 30 September 2018 (UTC)

41.164.30.218

– This proxy check request is closed and will soon be archived by a bot.

41.164.30.218 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: These two proxy checkers: [3] and [4] both state that this is an open proxy. Not sure how reliable those are, though. Nmap also found a bunch of open ports on this IP address as well... 124.122.90.177 (talk) 18:48, 4 October 2018 (UTC)

It appears to be a residential connection, running a VPN. When I google it, it does appear on some proxy lists, but none of the ports mentioned appear to be open. It appears to be on some spambl's as well, but it's possible at this point that the proxy customer has moved on / been disconnected. Unfortunately, for now it's Inconclusive SQL^{Query me!} 21:56, 4 October 2018 (UTC)

188.2.135.66

A user has requested a proxy check. A proxy checker will shortly look into the case.

188.2.135.66 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits on en.wikipedia and ro.wikipedia --Pafsanias (talk) 18:24, 9 October 2018 (UTC)

Never mind. IP address already blocked on Romanian Wikipedia. No other edits within the past week. Thank you. --Pafsanias (talk) 00:05, 21 October 2018 (UTC)

69.193.69.244

– This proxy check request is closed and will soon be archived by a bot.

69.193.69.244 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Vandalistic edits since October 13, 2015‎, even after many warnings
--14:50, 15 October 2018 (UTC)Gpkp (u • t • c)

 IP blocked. Looks like a school. GAB^gab 20:02, 15 October 2018 (UTC)

Thank you, GAB^gab. --Gpkp (u • t • c) 03:49, 16 October 2018 (UTC)

1.10.189.91

– This proxy check request is closed and will soon be archived by a bot.

1.10.189.91 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits Beyond My Ken (talk) 15:40, 23 October 2018 (UTC)

 IP blocked by Zzuuzz. GAB^gab 19:30, 24 October 2018 (UTC)

177.85.90.33

– This proxy check request is closed and will soon be archived by a bot.

177.85.90.33 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits Beyond My Ken (talk) 15:42, 23 October 2018 (UTC)

 IP blocked by Zzuuzz. GAB^gab 19:30, 24 October 2018 (UTC)

190.64.147.18

– This proxy check request is closed and will soon be archived by a bot.

190.64.147.18 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits Beyond My Ken (talk) 15:44, 23 October 2018 (UTC)

 IP blocked by Zzuuzz. GAB^gab 19:30, 24 October 2018 (UTC)

185.247.136.200

– This proxy check request is closed and will soon be archived by a bot.

185.247.136.200 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits Beyond My Ken (talk) 15:47, 23 October 2018 (UTC)

 IP blocked by Zzuuzz. GAB^gab 19:30, 24 October 2018 (UTC)

45.119.91.111

– This proxy check request is closed and will soon be archived by a bot.

45.119.91.111 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Only 1 post, but by comment made in that post, clearly seems to be recent ref-desk troll who has been disrupting the reference desk and causing all of the problems that led to them being shut down. --Jayron32 15:12, 29 October 2018 (UTC) Reason: Suspicious edits Jayron32 15:12, 29 October 2018 (UTC)

 Proxy blocked. GAB^gab 20:42, 29 October 2018 (UTC)

139.180.192.0/19

– This proxy check request is closed and will soon be archived by a bot.

139.180.192.0/19 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Choopa/webhosting servers 119.18.174.67 (talk) 06:23, 1 November 2018 (UTC)

 Range blocked. GAB^gab 02:05, 2 November 2018 (UTC)

88.12.3.152

– This proxy check request is closed and will soon be archived by a bot.

88.12.3.152 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: This proxy check indicates that it's an open proxy, not to mention that it has been blocked by the proxy bot in the past as well. 47.149.143.100 (talk) 19:29, 4 October 2018 (UTC)

I've checked this repeatedly over the last month, and I've not seen any technical evidence that this is currently a proxy. There do appear to be some lingering RBL entries, but those are likely stale. SQL^{Query me!} 08:22, 19 November 2018 (UTC)

185.180.196.0/22

– This proxy check request is closed and will soon be archived by a bot.

185.180.196.0/22 · contribs · block · log · stalk · Robtex · whois · Google

Reason: All IP addresses from 185.180.196.0 to 185.180.199.255 belong to King Servers (dedicated webhosting servers). 2601:1C0:4401:24A0:F427:6E8F:5237:1F6F (talk) 05:23, 11 October 2018 (UTC)

Blocked every address owned by King-Servers for a year. SQL^{Query me!} 03:25, 9 November 2018 (UTC)

79.115.41.253

– This proxy check request is closed and will soon be archived by a bot.

79.115.41.253 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Apparent proxy/attack source. 2601:1C0:4401:24A0:7D2D:D646:4903:9614 (talk) 05:42, 12 October 2018 (UTC)

 Proxy blocked. GAB^gab 15:46, 13 November 2018 (UTC)

151.237.192.0/19 & 176.56.96.0/19

– This proxy check request is closed and will soon be archived by a bot.

151.237.192.0/19 · contribs · block · log · stalk · Robtex · whois · Google

176.56.96.0/19 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Both IP ranges belong to "ServiHosting Networks S.L." (webhosting/dedicated server networks). 73.240.4.160 (talk) 05:51, 12 October 2018 (UTC)

Blocked. SQL^{Query me!} 03:10, 9 November 2018 (UTC)

103.254.208.0/22

– This proxy check request is closed and will soon be archived by a bot.

103.254.208.0/22 · contribs · block · log · stalk · Robtex · whois · Google

Active IP range that was recently active on 103.254.208.148 (talk · contribs · WHOIS). This range has been blocked in the past. 2601:1C0:4401:24A0:D30:1D07:A2EE:90DB (talk) 07:14, 22 October 2018 (UTC)

Blocked. SQL^{Query me!} 03:06, 9 November 2018 (UTC)

172.83.40.67

– This proxy check request is closed and will soon be archived by a bot.

172.83.40.67 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits

• WHOIS states that the /24 range at 172.83.40.0/24 is operated by Total Server Solutions. From their web site they are a web hosting company. Edits from this range have been reported at WP:AN3. I've blocked the range for three months anon-only as {{webhostblock}}. Offering this for review here to be sure I did it correctly. If confirmed, a block of one year or more might be reasonable. EdJohnston (talk) 20:55, 23 October 2018 (UTC)

  EdJohnston, Yep - that's a hosting range. I've re-blocked it as a 1-year long hardblock, and cleaned up the other non-blocked TSS ranges. SQL^{Query me!} 23:08, 8 November 2018 (UTC)

192.93.8.156

– This proxy check request is closed and will soon be archived by a bot.

192.93.8.156 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Used by country-hopping spammer. IamNotU (talk) 22:33, 2 November 2018 (UTC)

IamNotU -  Unlikely IP is an open proxy. Unfortunately, I wasn't able to find any technical evidence that this IP is presently an open proxy. SQL^{Query me!} 03:03, 9 November 2018 (UTC)

80.179.42.39 Comment

– This proxy check request is closed and will soon be archived by a bot.

80.179.42.39 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Used by obvious sock of Shingling334 known to use proxies, ipqualityscore.com score 95 "Proxy/VPN Detected" IamNotU (talk) 22:52, 8 November 2018 (UTC)

IamNotU, HQServ indeed appears to be a VPS. Blocked, and I'll try to find more ranges belonging to this hosting provider to block. SQL^{Query me!} 02:57, 9 November 2018 (UTC)

107.77.249.6 Comment

– This proxy check request is closed and will soon be archived by a bot.

107.77.249.6 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Long history of vandalism and blocks, "confirmed proxy server" by whatismyipaddress.com, proxy score 100 at ipqualityscore.com. IamNotU (talk) 22:23, 14 November 2018 (UTC)

• Checking... SQL^{Query me!} 08:11, 19 November 2018 (UTC)
  • @IamNotU: This is very likely an infected host, per [5]. Blocking for 3 months. SQL^{Query me!} 08:15, 19 November 2018 (UTC)

46.229.160.0/20

– This proxy check request is closed and will soon be archived by a bot.

46.229.160.0/20 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Webhosting server. Most recently active on 46.229.172.183 (talk · contribs · WHOIS). Range was blocked for 1 year in September 2017 as a webhosting server. 73.110.138.115 (talk) 08:02, 19 November 2018 (UTC)

Yep, that's a webhost. I've blocked all the relevant ranges. SQL^{Query me!} 08:11, 19 November 2018 (UTC)

77.247.80.0/21

– This proxy check request is closed and will soon be archived by a bot.

77.247.80.0/21 · contribs · block · log · stalk · Robtex · whois · Google

Reason: SysEleven webhosting servers. Was blocked for 1 year in November 2017. 211.202.138.37 (talk) 18:51, 26 November 2018 (UTC)

All current SysEleven ranges are now blocked. SQL^{Query me!} 23:52, 26 November 2018 (UTC)

77.247.64.0/20

– This proxy check request is closed and will soon be archived by a bot.

77.247.64.0/20 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Rackhosting cloud servers. 211.202.138.37 (talk) 18:51, 26 November 2018 (UTC)

All current rackhosting ranges are now blocked. SQL^{Query me!} 23:46, 26 November 2018 (UTC)

95.168.177.215

– This proxy check request is closed and will soon be archived by a bot.

95.168.177.215 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Used by obvious sock of User:Shingling334. IamNotU (talk) 23:38, 26 November 2018 (UTC)

IamNotU, Yep, colocation host Leaseweb. Blocking 95.168.176.0/21, and I'll start looking for more leaseweb ranges. SQL^{Query me!} 23:43, 26 November 2018 (UTC)

177.21.103.136

– This proxy check request is closed and will soon be archived by a bot.

177.21.103.136 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Ongoing weird ref desk questions –Deacon Vorbis (carbon • videos) 05:17, 28 November 2018 (UTC)

Already blocked for quite some time. SQL^{Query me!} 05:27, 30 November 2018 (UTC)

165.161.16.45

– This proxy check request is closed and will soon be archived by a bot.

165.161.16.45 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Probably banned editor HarveyCarter. Beyond My Ken (talk) 17:38, 28 November 2018 (UTC)

Already blocked for a while. SQL^{Query me!} 05:28, 30 November 2018 (UTC)

62.215.100.42

– This proxy check request is closed and will soon be archived by a bot.

62.215.100.42 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, causing disruption at both Catgirl and Template:Furry fandom. A proxy has been used before to cause similar disruption back in October. Protection might be needed on affected pages for persistent sock puppetry. 66.87.149.92 (talk) 02:13, 18 December 2018 (UTC)

 Proxy blocked by Zzuuzz. GAB^gab 16:58, 21 December 2018 (UTC)

185.117.89.70

– This proxy check request is closed and will soon be archived by a bot.

185.117.89.70 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Currently being used by blocked user Shingling334. ipqualityscore.com reports it as a proxy. IamNotU (talk) 21:44, 19 December 2018 (UTC)

Now blocked as colocation webhost by zzuuzz. --IamNotU (talk) 23:19, 21 December 2018 (UTC)