Wikipedia

Wikipedia:WikiProject on open proxies/Requests/Archives/48

< Wikipedia:WikiProject on open proxies | Requests
Latest comment: 1 year ago by Blablubbs in topic 207.188.154.0/24


107.115.16.0/20

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Norton Securiy Suite IP. Reason: (add your reason here) Idesyest (talk) 20:51, 20 December 2022 (UTC)

OP blocked. Lemonaka (talk) 15:07, 28 December 2022 (UTC)
This looks like a regular AT&T range.   Closing without action. MarioGom (talk) 21:20, 8 January 2023 (UTC)

185.69.144.0/22

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Reason: Several recent VPN proxies running on this IP range. IP range has been blocked in the past (see block log) for LTA disruption. 73.67.145.30 (talk) 21:22, 8 January 2023 (UTC)

No sign of VPN exits here. This is a mobile range and edits are consistent with that. The possible residential proxies that are present here are unlikely to be used by vandals/trolls.   Closing without action. MarioGom (talk) 06:46, 9 January 2023 (UTC)

Unwired Broadband

Latest comment: 1 year ago4 comments3 people in discussion

{{proxycheckstatus}}

23.227.96.0/19 · contribs · block · log · stalk · Robtex · whois · Google
104.200.32.0/20 · contribs · block · log · stalk · Robtex · whois · Google
104.247.128.0/20 · contribs · block · log · stalk · Robtex · whois · Google
104.247.144.0/21 · contribs · block · log · stalk · Robtex · whois · Google
198.210.32.0/19 · contribs · block · log · stalk · Robtex · whois · Google
209.54.32.0/20 · contribs · block · log · stalk · Robtex · whois · Google

Reason: These ranges no longer appear to be used for hosting; the ones listed here are registered to Unwired Broadband (AS33548), which is a residential and business ISP. wizzito | say hello! 20:54, 22 August 2022 (UTC)

I agree it looks like these blocks are now obsolete. It's been long since they were added, and they seem to have changed hands from hosting to broadband since.   Awaiting administrative action: Please, consider unblocking these. MarioGom (talk) 22:42, 17 November 2022 (UTC)
I have lifted the local blocks on these ranges, but two of them are globally locked. It may be worth asking for the global blocks to be removed. JBW (talk) 13:16, 13 January 2023 (UTC)
Thanks! Closing. MarioGom (talk) 22:15, 31 January 2023 (UTC)

154.160.27.219

Latest comment: 1 year ago9 comments3 people in discussion

{{proxycheckstatus}}

154.160.27.219 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Mobile network, probably CGNAT. - RichT|C|E-Mail 11:49, 8 January 2023 (UTC)

Rich: The IP has a P2P proxy running behind it, so it got a temporary block. It will expire soon. Are you requesting an unblock for this particular IP? MarioGom (talk) 16:16, 8 January 2023 (UTC)
@MarioGom: Yea, don't worry about it. It's for an ACC request but we will just let it expire, all good :) - RichT|C|E-Mail 12:23, 9 January 2023 (UTC)
Rich: Ok. Looking at the block log, chances are that it gets re-blocked some time after it. IPs in this ISP are blocked quite frequently, so the user might need to request IPBE. I have marked this for admin attention, maybe we need to loosen the block to anon. only. MarioGom (talk) 18:26, 10 January 2023 (UTC)
@MarioGom: It would be nice if ST47ProxyBot was slightly less... bitey(?) with these and set anon only unless there is good reason not to - RichT|C|E-Mail 18:37, 10 January 2023 (UTC)
@Rich Smith: IPs with this type of vulnerability are routinely used by LTAs to conduct campaigns of harassment and other dangerous behavior using accounts created from different ranges that are not or can not be blocked with account creation disabled. ST47 (talk) 19:17, 10 January 2023 (UTC)

Rich: is this request still relevant? MarioGom (talk) 22:19, 31 January 2023 (UTC)

@MarioGom: Nope, all good - RichT|C|E-Mail 22:27, 31 January 2023 (UTC)
Thanks. Closing. MarioGom (talk) 22:32, 31 January 2023 (UTC)

192.155.80.0/20

Latest comment: 1 year ago5 comments4 people in discussion

{{proxycheckstatus}}

Reason: Linode range, already globally blocked. - RichT|C|E-Mail 03:35, 13 December 2022 (UTC)

Indeed. Please, consider blocking the range. Thank you. MarioGom (talk) 19:24, 16 December 2022 (UTC)
The range is already blocked. No action needed. ZsinjTalk 02:37, 2 January 2023 (UTC)
Not locally. As far as I know, it is relatively common to block these ranges locally even if they are globally blocked, since GIPBE/IPBE requirements are different. But if any patrolling admin thinks that's not worth it here, feel free to close the report. MarioGom (talk) 18:56, 5 January 2023 (UTC)

88.80.145.0/24

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: (IP belongs to a dedicated services provider (Belcloud, LTD)) Matthew Tyler-Harrington (aka mth8412) (talk) 00:45, 10 January 2023 (UTC)

88.80.144.0/21 · contribs · block · log · stalk · Robtex · whois · Google is a hosting range by "RedCluster LTD", many web servers, proxies, etc, within the range. Please, consider blocking the /21. Thank you. MarioGom (talk) 17:34, 11 January 2023 (UTC)

8.28.126.0/24

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: (Range belongs to Cloudflare, which is used on the WARP VPN network) Matthew Tyler-Harrington (aka mth8412) (talk) 10:19, 16 January 2023 (UTC)

187.62.33.220

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: Abused by the same sockmaster as 196.44.39.130 above; this one looks a bit more obvious 74.73.224.126 (talk) 03:28, 6 December 2022 (UTC)

  Likely IP is an open proxy,   Confirmed to be some a proxy of some sort. Flagging for an admin to consider a block. —‍Mdaniels5757 (talk • contribs) 03:40, 6 December 2022 (UTC)
Since it was a residential proxy, and it has been inactive for some time, it doesn't make sense to block it at this point. Closing. MarioGom (talk) 12:59, 19 February 2023 (UTC)

41.220.146.207

Latest comment: 1 year ago4 comments3 people in discussion

{{proxycheckstatus}}

Reason: used by a block evading sock and reported as a possible proxy by spur and a high risk proxy connection by IP quality store. M.Bitton (talk) 23:48, 6 December 2022 (UTC)

  Likely IP is an open proxy; admin: please consider a block. —‍Mdaniels5757 (talk • contribs) 01:02, 7 December 2022 (UTC)
I think there is a high chance that this IP is not being used as a proxy, just a regular mobile connection in Algeria. The Spur flag is related to a high-end residential proxy service that is certainly not being used for this. MarioGom (talk) 09:34, 9 December 2022 (UTC)
Since it was a residential proxy, and it has been inactive for some time, it doesn't make sense to block it at this point. Closing. MarioGom (talk) 12:59, 19 February 2023 (UTC)

70.54.45.110

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

This IP is the latest in a string of widely varying IPs and locations that have been pushing a blatantly promotional draft at Draft:Netta Jenkins. It seems probable that they are all proxies, but only the above one has been used recently. The other IPs were:

Has also been removing the decline templates from the draft despite being told not to. Mako001 (C)  (T)  🇺🇦 13:09, 12 January 2023 (UTC)

  Possible IP is an open proxy per spur data, but it says few connections, so I'm not sold on it. — Mdaniels5757 (talk • contribs) 18:55, 29 January 2023 (UTC)
Mako001: Requesting temporary semi-protection for Draft:Netta Jenkins will be more effective. Closing. MarioGom (talk) 12:57, 19 February 2023 (UTC)

41.210.30.70

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Reason: I just blocked this IP for 48 hours for vandalism, but it might need a longer block, the proxy bot seems to have targeted it in the past and it seems to be assigned to the same provider. – filelakeshoe (t / c) 🐱 10:36, 10 February 2023 (UTC)

Very crowded range with P2P proxies. Other than manual blocks for specific disruption, it's better to leave the proxy blocks to the bot in this case. MarioGom (talk) 12:52, 19 February 2023 (UTC)

89.17.214.10

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Reason: This is an open proxy being used by a blocked sock-puppet Belteshazzar. The same user has used open proxies before. The proxy is listed at scrapingant.com as a free proxy [1] Psychologist Guy (talk) 14:00, 25 February 2023 (UTC)

Already blocked. Closing. MarioGom (talk) 15:55, 12 March 2023 (UTC)

116.206.253.169

Latest comment: 1 year ago5 comments2 people in discussion

{{proxycheckstatus}}

Multiple proxy blocks in past. Ran into this IP because of their pov editing. Reason: (add your reason here) Doug Weller talk 08:57, 5 March 2023 (UTC)

119.160.59.82

Latest comment: 1 year ago3 comments2 people in discussion

{{proxycheckstatus}}

119.160.59.82 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. Says it's not a proxy, just what their mobile provider assigned. Daniel Case (talk) 07:35, 3 March 2023 (UTC)

Daniel Case: That's likely the case. These P2P proxies run on residential ISPs, often in crowded ranges. I don't think the person posting that appeal is any of the usual suspects who abuse this type of proxy. Changing the block to anon. only might make sense. But it'd be better if the user signed up and requested WP:IPBE and WP:GIPBE. MarioGom (talk) 21:16, 7 March 2023 (UTC)
Not currently blocked. Looking at the block log, I'm sure it'll be blocked again soon. There's not much more to here. Closing. MarioGom (talk) 21:24, 26 April 2023 (UTC)

150.101.252.89

Latest comment: 1 year ago3 comments2 people in discussion

{{proxycheckstatus}}

Reason: I reverted vandalism on this IP editor, and they responded by saying that it could have been anyone since it's a TOR IP and that the edits on this IP could be from anyone... here's the link. Marleeashton (talk) 07:31, 11 March 2023 (UTC)

I'm not sure it's a Tor node, but it's definitely a VPN node. MarioGom (talk) 15:54, 12 March 2023 (UTC)
Now blocked. Closing. MarioGom (talk) 21:24, 26 April 2023 (UTC)

110.93.84.151

Latest comment: 1 year ago3 comments2 people in discussion

{{proxycheckstatus}}

Reason: Lots of logged-out beauty pageant article editing from IPs hopping around the 110.93.84.0/24 range, a selection shown in this report. This article space (pageants) is general sanction-ed and full of blocked SPAs, this provider offers proxy/VPN services: https://www.crn.com/news/security/18828398/clearpath-preps-managed-vpn.htm ☆ Bri (talk) 15:52, 27 March 2023 (UTC)

Forgot to mention that whatismyipaddress.com says something about a datacenter. ☆ Bri (talk) 05:14, 3 April 2023 (UTC)
These seem regular residential connections. Closing. MarioGom (talk) 21:27, 26 April 2023 (UTC)

80.79.145.161

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Reason:Long-time disruptive edits on Volvo-related articles. Sjö (talk) 15:13, 3 April 2023 (UTC)

It might be a residential proxy. A block is likely to be pointless, since these usually rotate quickly. Closing. MarioGom (talk) 21:29, 26 April 2023 (UTC)

185.100.217.90

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Reason: LTA disruptive editing on Volvo-related articles. Sjö (talk) 20:53, 5 April 2023 (UTC)

It might be a residential proxy. A block is likely to be pointless, since these usually rotate quickly. Closing. MarioGom (talk) 21:29, 26 April 2023 (UTC)

208.185.0.0/15

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Reason: Proxy server; see stalktoy. Firestar464 (talk) 16:53, 17 April 2023 (UTC)

/15 is too broad. There are already narrower blocks for problematic individual addresses and ranges. Closing. MarioGom (talk) 21:40, 26 April 2023 (UTC)

195.210.104.0/22

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Range owned by iproyal.com (see whois). Used by WP:ABTACH. MarioGom (talk) 18:58, 21 March 2023 (UTC)

45.84.39.35

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: NordVPN exit node, and a likely residential proxy based on Spur data. I've done a quick check on the /24, and it looks like the NordVPN range starts at .39.6 and continues until .39.254. I've not had the time to check the entire range though to see if it's continuous NordVPN all the way through, but every IP I did check seems to be a NordVPN exit node and active on one or more residential proxy services.

Note, became aware of this IP after seeing disruptive editing/vandalism on Gender-affirming surgery. Sideswipe9th (talk) 22:27, 3 April 2023 (UTC)

  Confirmed, also "Packethub S.A." is a common identifier for them. Please, block the /24. MarioGom (talk) 12:57, 6 April 2023 (UTC)

31.31.72.0/21

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Wedos hosting services (wedos.com), lots of abused proxies here. MarioGom (talk) 16:02, 27 April 2023 (UTC)

38.240.224.0/21

Latest comment: 1 year ago6 comments5 people in discussion

{{proxycheckstatus}}

Reason: Web hosting server run by Tech Futures Interactive. Used by LTA twice wizzito | say hello! 04:42, 8 April 2023 (UTC)

Which LTA? 38.240.226.92 (talk) 21:49, 14 April 2023 (UTC)
You. wizzito | say hello! 00:57, 20 April 2023 (UTC)
Who's me? Check here: https://en.wiki.x.io/wiki/Special:Contributions/38.240.224.0/21
I have no idea what you're referring to. Who exactly is abusing this range? From the looks of it I see that not just one person is using it. 38.240.226.60 (talk) 21:43, 20 April 2023 (UTC)
A few IPs in the range, including the ones that signed the comments above, are Mullvad VPN exit nodes according to Spur. The /21 range is a hosting provider, since it's full of webhost and mail servers. Please, block the range as a webhost block. Thank you. MarioGom (talk) 21:37, 26 April 2023 (UTC)

198.140.141.0/24

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: VPN/Dedicated servers. 73.67.145.30 (talk) 19:06, 22 April 2023 (UTC)

This was blocked as proxy on ru.wiki and zh.wiki ☆ Bri (talk) 21:11, 22 April 2023 (UTC)

46.44.180.230

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: https://eu-browse.startpage.com/av/proxy --46.44.180.230 (talk) 15:19, 17 March 2023 (UTC)

Indeed. This is startpage's proxy: [3]. MarioGom (talk) 00:20, 19 March 2023 (UTC)
Blocked. firefly ( t · c ) 10:29, 10 June 2023 (UTC)

216.24.45.0/24

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: VPN server (Menlo or Supervpn360). Fraud Score: 75 from IPQualityScore. Also see stalktoy - 216.24.45.0/24 blocked at ru.wiki. ☆ Bri (talk) 17:05, 19 April 2023 (UTC)

I'd recommend blocking the /24. The full range is, indeed, Menlo Security, which provides some sort of VPN service. See whois and spur. MarioGom (talk) 21:45, 26 April 2023 (UTC)
Blocked the range for 2 years. firefly ( t · c ) 10:32, 10 June 2023 (UTC)

176.112.144.0/20

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: Public proxy server run by Astrec Data OU wizzito | say hello! 00:56, 20 April 2023 (UTC)

Yep. It's some sort of cloud provider, see astrec.data / pilvio.com. The range could get a webhost block. MarioGom (talk) 21:49, 26 April 2023 (UTC)
Blocked 2 years. firefly ( t · c ) 10:33, 10 June 2023 (UTC)

45.86.231.0/24

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Reason: Confirmed VPS hosting IP range (see Blue VPS). 73.67.145.30 (talk) 03:18, 8 May 2023 (UTC)

Blocked 2y. firefly ( t · c ) 10:48, 10 June 2023 (UTC)

138.124.187.0/24

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Reason: Webhosting/VPN range. 73.67.145.30 (talk) 17:14, 10 May 2023 (UTC)

Blocked 2y. firefly ( t · c ) 10:49, 10 June 2023 (UTC)

213.104.126.185

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Reason: LTA at this IP and others on 213.104.126.0/24, including:

This LTA frequently targets Eliza Scanlen and Bebe Bettencourt and many films, where the LTA adds "Nova Lee LeClair" as a cast member with no sourcing.

This LTA is also hopping around on IPs on 213.107.0.0/17 and 62.254.0.0/18.  — Archer1234 (t·c) 08:25, 10 June 2023 (UTC)

Not seeing any indications that these are proxies. firefly ( t · c ) 10:37, 10 June 2023 (UTC)

198.252.153.0/24, 199.254.238.0/24, and 204.13.164.0/24

Latest comment: 1 year ago1 comment1 person in discussion

{{proxycheckstatus}}

Reason: These three ranges belong to Riseup Networks, which is a VPN service for "censorship circumventation". [4][5] Deauthorized. (talk) 21:13, 2 July 2023 (UTC)

  • Globally blocked by AmandaNP a few days ago, so I will self-close this request.

2A0C:5C84:1:6004:0:0:0:32B5

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Reason: VPN. 73.67.145.30 (talk) 04:20, 26 May 2023 (UTC)

  Open proxy blocked IP range was globally blocked as an open proxy/webhost a few hours ago. Closing. Sideswipe9th (talk) 04:14, 15 July 2023 (UTC)

135.148.233.0/17: Veepn VPN

Latest comment: 1 year ago6 comments4 people in discussion

{{proxycheckstatus}}

Spur reports it is Veepn VPN; whatismyipaddress.com states it is a VPN server, "Recently reported forum spam source" Dubious AfD voting here. ☆ Bri (talk) 15:08, 12 July 2023 (UTC)

Looked a little more at the range 135.148.128.0/17 and found some more dubious AfD votes. We might have either UPE editors or a UPE scammer or scam ring here; this talkpage comment makes it clear they are aware of such things. ☆ Bri (talk) 15:41, 12 July 2023 (UTC)
BTW this whole thing came to my attention when one of the IPs tagged a draft in my userspace for notability (!), consistent with preparation for a UPE effort. ☆ Bri (talk) 17:32, 12 July 2023 (UTC)
You are one of the most obvious cases of UPE on this platform.. 1300 articles and at least a quarter of them are obvious paid editing. There are so many promotional hemp companies, I just about fell on the floor looking at them all.. 135.148.233.37 (talk) 02:34, 14 July 2023 (UTC)
The range has been globally blocked. Deauthorized. (talk) 03:09, 14 July 2023 (UTC)
The range has been globally blocked for a year as a possible proxy. Closing the case for archiving. Sideswipe9th (talk) 03:55, 15 July 2023 (UTC)

81.25.28.1

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Reason: Disruption. Marked as a public proxy server. 73.67.145.30 (talk) 18:25, 30 April 2023 (UTC)

  • This is likely a residential proxy based on the data available. These usually rotate quickly, and this particular IP hasn't been active since the report in April. If it becomes active again, in theory ST47ProxyBot should catch this. Not seeing any evidence of public proxy use so   Closing without action Sideswipe9th (talk) 18:49, 17 July 2023 (UTC)

103.111.0.0/16 and 103.119.0.0/16

Latest comment: 1 year ago4 comments2 people in discussion

{{proxycheckstatus}}

Suspicious beauty pageant SPA edits in range.

103.119.62.2 103.119.62.15 almost certainly the same operator, I think there is a second range. ☆ Bri (talk) 17:55, 25 April 2023 (UTC)
103.111.143.41 another. IPcheck says it is a proxy, 100% abuse score. Blocked on ru.wiki (expanded range to match). ☆ Bri (talk) 18:50, 25 April 2023 (UTC)
Here are edits showing probably the same operator using both ranges on the same article in a ~half hour time span. First pair, IP on 103.111 range at 10:41 followed by IP on 103.119 range [6]. Second pair, same day, different article – same IP on 103.111 range at 10:42 followed by IP on 103.119 range [7]. ☆ Bri (talk) 21:08, 25 April 2023 (UTC)
  •  N Stale /   Declined Had a quick look at the three IPs listed, and I'm not seeing any evidence of current proxy activity through Spur and Shodan. Any block that was on 103.111.143.41 seems to have expired and may possibly have been a range block. Were these IPs more spread apart I would suspect they might have been part of a residential proxy service at the time of this report, and have since left it. But because of the relative closeness of these IPs, I suspect this might have just been CGNAT related. Closing without action. Sideswipe9th (talk) 21:58, 18 July 2023 (UTC)

133.114.163.71

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: Possible VPN. 73.67.145.30 (talk) 17:33, 9 May 2023 (UTC)

  Not currently an open proxy ip address used for so-net, an japanese internet service provider Notrealname1234 (talk) 16:31, 21 June 2023 (UTC)
  Not currently an open proxy Confirm what Notrealname1234 has said, this doesn't appear to be a proxy and is an average connection on a residential ISP. Closing without action. Sideswipe9th (talk) 22:08, 18 July 2023 (UTC)

103.135.39.174

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Reason: Listed as a Public proxy server at whatismyipaddress.com/ip/103.135.39.174 and proxy with recent abuse at ipcheck.toolforge.org/index.php?ip=103.135.39.174. Mojoworker (talk) 03:57, 11 May 2023 (UTC)

  •   Not currently an open proxy While I can confirm that whatismyipaddress and IPQualityScore is listing it as a public proxy, the IP doesn't appear to currently be a proxy after checking through other means. However it's part of a /23 range that was softblocked for 2 years starting on 2 June 2023. Closing without further action. Sideswipe9th (talk) 22:27, 18 July 2023 (UTC)

202.125.32.0/20 webhost plus smaller PIA VPN range

Latest comment: 1 year ago6 comments2 people in discussion

{{proxycheckstatus}}

ftools on Toolforge is telling me that 202.125.43.0/25 · contribs · block · log · stalk · Robtex · whois · Google would cover the whole range for the subset of PIA VPN IPs, which it would but with some overlap. But I guess that's fine with the /20 being a webhost anyway? Sideswipe9th (talk) 21:02, 18 July 2023 (UTC)
@Sideswipe9thBlocked the /20 for three years. Courcelles (talk) 20:57, 18 July 2023 (UTC)
@Courcelles: Awesome, thanks! If we're happy to leave it with a 3 year block on the /20 then I'll close this off. Sideswipe9th (talk) 21:03, 18 July 2023 (UTC)
@Sideswipe9thI am, I can’t see anything else being a beneficial use of our time. Courcelles (talk) 21:08, 18 July 2023 (UTC)
@Courcelles: No worries. Closed as resolved. Thanks again :) Sideswipe9th (talk) 21:09, 18 July 2023 (UTC)

144.178.6.38

Latest comment: 1 year ago5 comments3 people in discussion

{{proxycheckstatus}}

Reason: WHOIS returns Apple Inc. data center, spur confirms; sus edits ☆ Bri (talk) 23:53, 5 June 2023 (UTC)

More disruptive edits from the IP today [8] ☆ Bri (talk) 22:55, 7 June 2023 (UTC)
I don't think this is a colo/hosting datacentre, my suspicion is that it's one of Apple's corporate offices (or the datacentre that their connections route through). firefly ( t · c ) 10:44, 10 June 2023 (UTC)
@Firefly: I'd agree with that assessment. I'm also not seeing any evidence of proxy or VPN services through the usual sources. If there's no objection, I'll mark this as closed without action. Sideswipe9th (talk) 23:39, 18 July 2023 (UTC)
Sideswipe9th closed! :) firefly ( t · c ) 08:48, 21 July 2023 (UTC)

216.194.96.0/20

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: IP range is a possible VPN server, belonging to Cato Networks. 73.67.145.30 (talk) 19:22, 9 January 2023 (UTC)

  •   Confirmed I can confirm the /20 is allocated to Cato Networks, and many of the IPs within seem to be active on Cato's VPN product, as well as at least one IP being active on a residential proxy service according to Spur. While the residential proxies are typically non-legitimate, Cato's primary VPN product seem to be akin to similar products also aimed at corporate customers like McAfee WGCS, Zscaler, and GlobalProtect (examples of which are currently under discussion elsewhere here). There's also some webservers hosted within the range as well. A softblock on the /20 might be appropriate in the circumstances. Sideswipe9th (talk) 21:32, 18 July 2023 (UTC)

61.220.170.133

Latest comment: 1 year ago4 comments4 people in discussion

{{proxycheckstatus}}

Reason: Open proxy IP being used by a blocked user Belteshazzar, also mentioned at their SPI [9] Psychologist Guy (talk) 17:47, 31 January 2023 (UTC)

45.134.110.0/24

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: Data center run by Kuroit (web hosting company) wizzito | say hello! 01:04, 20 April 2023 (UTC)

  •   Confirmed I'm seeing many web servers, some mail servers, and other services within this range per Shodan. Also seeing some IPs, including the only one to have made enwiki contributions, being active on a handful of common residential proxy services per Spur data. The range is currently being announced by LevelOneServers/DotTechLLC. The /24 should be safe to {{webhostblock}}. Sideswipe9th (talk) 22:45, 18 July 2023 (UTC)

209.80.128.102

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: Possible VPN server per WHOIS. 73.67.145.30 (talk) 15:36, 1 May 2023 (UTC)

  •   Likely Shodan showed something interesting, and upon a little digging this does appear to be a VPN server. The IP is assigned to a cloud hosting provider, with the full range being 209.80.128.0/17. However within that range, 209.80.128.0/27 is assigned to a public school district. Not sure if a range block on either would be appropriate, but I think we might be able to give this specific IP a webhost block. Sideswipe9th (talk) 21:00, 17 July 2023 (UTC)

185.69.144.152

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: This IP address has two prior short blocks for being a proxy. I have blocked it again for 31 hours due to recent vandalism. Please check if it is still a proxy. ~Anachronist (talk) 13:33, 14 July 2023 (UTC)

  • Based on what I can see currently, this is unlikely to be a proxy. The two block log entries suggest a type of proxy that expires relatively quickly, and ST47ProxyBot hasn't blocked this specific IP in about two years. Sideswipe9th (talk) 03:53, 15 July 2023 (UTC)
    P2P proxy blocks should generally be left to the bot unless there is ongoing disruption. Obviously any admin can do escalating blocks, but there's not much to do in terms of proxy blocking. Closing. MarioGom (talk) 21:23, 27 July 2023 (UTC)

103.221.55.106

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: IP address has several short-term proxy blocks in its block log. I just blocked it for a month for spam activity that has lasted about as long, but given the numerous past proxy blocks, I wondered if it would be worthwhile to check again. ~Anachronist (talk) 13:40, 16 July 2023 (UTC)

  • I think this is likely a residential proxy, and that would match up with the blocks by ST47ProxyBot in August 2022. Not sure why they weren't autoblocked when they edited recently though. Marking for a second opinion in case I missed something obvious. Sideswipe9th (talk) 22:30, 16 July 2023 (UTC)
    P2P proxy detection is not exhaustive. Detection can be delayed or missed, or it can be an unsupported proxy service. Just as above, feel free to escalate blocks based on disruption. Closing. MarioGom (talk) 21:27, 27 July 2023 (UTC)

205.253.38.215

Latest comment: 1 year ago2 comments2 people in discussion

{{proxycheckstatus}}

Reason: This user is making unnecessary changes to some living persons filmographies and spamming the changes which is not related to the person. Arctic Writer (talk) 12:04, 25 July 2023 (UTC)

Not a proxy. Closing. MarioGom (talk) 21:28, 27 July 2023 (UTC)

207.188.154.0/24

Latest comment: 1 year ago4 comments3 people in discussion

{{proxycheckstatus}}

207.188.154.0/24 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Just globally unblocked the range after an UTRS appeal. From WHOIS data this seems to belong now to Xfera Móviles S.A.U, from the MasMovil group ISP (Yoigo). Thanks, —MarcoAurelio (talk) 14:39, 16 February 2023 (UTC)

I'm not so sure. Whois data certainly looks like MásMóvil (mobile ISP), but the IP that appealed, 207.188.154.103, seemed to be a VPN node as recently as January 21st (see shodan). ST47: Do you have any input on this? I guess it can be unblocked and reviewed again in a few weeks. MarioGom (talk) 12:43, 19 February 2023 (UTC)
I took another look at the range. Services in that range are mostly Synology, HomeAssist, domestic routers, etc. So it is, indeed, a residential range. MarioGom (talk) 21:23, 7 March 2023 (UTC)

76.9.240.0/20

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: Possible VPN server per WHOIS. 73.67.145.30 (talk) 17:25, 2 May 2023 (UTC)

117.210.138.86

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Suspected Nord VPN ip Reason: Suspected Nord VPN ip Tonyinman (talk) 18:20, 15 May 2023 (UTC)

59.91.229.198

Latest comment: 1 year ago1 comment1 person in discussion

{{proxycheckstatus}}

Reason: Suspected NordVPN address Tonyinman (talk) 18:21, 15 May 2023 (UTC)

117.210.142.151

Latest comment: 1 year ago1 comment1 person in discussion

{{proxycheckstatus}}

Reason: suspected NordVPN ip address Tonyinman (talk) 18:22, 15 May 2023 (UTC)

59.91.224.115

Latest comment: 1 year ago1 comment1 person in discussion

{{proxycheckstatus}}

Reason: suspected NordVPN ip address Tonyinman (talk) 18:22, 15 May 2023 (UTC)

61.1.23.137

Latest comment: 1 year ago1 comment1 person in discussion

{{proxycheckstatus}}

Reason: suspected NordVPN ip address Tonyinman (talk) 18:23, 15 May 2023 (UTC)

59.91.229.17

Latest comment: 1 year ago1 comment1 person in discussion

{{proxycheckstatus}}

Reason: suspected NordVPN ip address Tonyinman (talk) 18:24, 15 May 2023 (UTC)

66.168.171.57

Latest comment: 1 year ago1 comment1 person in discussion

{{proxycheckstatus}}

Reason: Suspected NordVPN ip address Tonyinman (talk) 18:25, 15 May 2023 (UTC)

59.91.227.166

Latest comment: 1 year ago1 comment1 person in discussion

{{proxycheckstatus}}

Reason: suspected NordVPN ip address Tonyinman (talk) 18:25, 15 May 2023 (UTC)

45.248.44.0/23

Latest comment: 1 year ago3 comments3 people in discussion

{{proxycheckstatus}}

Reason: Webhost server. Was previously blocked for 1 year. 2601:1C0:4401:F60:758F:D0D6:53AE:83C1 (talk) 18:13, 29 June 2023 (UTC)

  •   Confirmed Range is still assigned by a web hosting provider. The IPs that were actively contributing through this recently are also all active on multiple residential proxy services and at least one VPN provider according to Spur's data. The range itself was webhostblocked by Daniel Case on 17 July 2023, however I would recommend additionally hardblocking 45.248.45.90 through 45.248.45.99 inclusive due to being active on a VPN service and multiple residential proxy services. Sideswipe9th (talk) 23:35, 18 July 2023 (UTC)

92.40.199.51

Latest comment: 1 year ago5 comments4 people in discussion

{{proxycheckstatus}}

Reason: API-confirmed P2P VPN. Obviously used by a LTA. Blocked previously. LilianaUwU (talk / contributions) 22:46, 15 August 2023 (UTC)

I haven't run extensive checks, but I consider this to be unlikely. -- zzuuzz (talk) 22:54, 15 August 2023 (UTC)
@Zzuuzz: Check the Spur data on Bullseye. It's a cell/mobile connection, but it's reported active on multiple residential proxy services. Sideswipe9th (talk) 23:11, 15 August 2023 (UTC)
Its current usage is not proxy usage. -- zzuuzz (talk) 23:19, 15 August 2023 (UTC)

208.87.236.201

Latest comment: 1 year ago11 comments3 people in discussion

{{proxycheckstatus}}

Reason: IPs 208.87.232.0 - 208.87.239.255 belong to ForcePoint Cloud Services which operate HTTP/HTTPS proxy servers, per https://www.websense.com/content/support/library/web/hosted/getting_started/how_wsc_works.aspx. Range has been blocked before and specific IP has recently voted in an RfD. TarnishedPathtalk 09:04, 18 August 2023 (UTC)

Note, this is Brooklyn Public Library; see Wikipedia:Administrators'_noticeboard/Archive351#Editing_from_the_Brooklyn_Public_Library. -- zzuuzz (talk) 15:49, 18 August 2023 (UTC)
That's merely an assertion as far as I can tell and looking at this gives a good indication why proxies shouldn't by allowed. TarnishedPathtalk 16:15, 18 August 2023 (UTC)
You can disagree with that assertion as much as you like. No one has looked at that address more than me. I am going to anonblock it for a long time forthwith; discussion may of course continue. -- zzuuzz (talk) 16:19, 18 August 2023 (UTC)
No comment on you. Comment on now blocked editor previously requesting the unblock. TarnishedPathtalk 16:30, 18 August 2023 (UTC)
Having blocked that user I can assure you that I've also closely examined them, their motivations, their activity, and their IP addresses. So look I maintain this is Brooklyn Public Library (think of that what you will, there are also librarians there). Other addresses in the /21 do get used, and there is quite a lot of potential collateral. I count something like 50 accounts within the last few months. -- zzuuzz (talk) 16:48, 18 August 2023 (UTC)
I understand. What happens if a public library somewhere else decides to use NordVPN or ExpressVPV? TarnishedPathtalk 17:06, 18 August 2023 (UTC)
I've never seen that happen and consider it unlikely :) Forcepoint is basically equivalent to Zscaler, and my views on Zscaler have been previously well declared, and there's a general consensus not to hard block them unless you have to. They're mostly used by big boring corporates, or similar groups with lots of money, big rulebooks, and high risks. The people using them are usually highly educated and in expert niches. On the whole they're pretty well behaved. NordVPN and other bargain VPNs are frequently used by trash. Brooklyn Public Library is something of a special case with quite a few considerations to balance including the socks who sometimes visit and the nature of the high collateral. I'd consider it a well-studied address. -- zzuuzz (talk) 17:32, 18 August 2023 (UTC)
Thanks for your explanation. TarnishedPathtalk 17:55, 18 August 2023 (UTC)
notably the user that requested that IP range be unblocked is now blocked indef. TarnishedPathtalk 16:21, 18 August 2023 (UTC)
Retrieved from "https://en.wiki.x.io/w/index.php?title=Wikipedia:WikiProject_on_open_proxies/Requests/Archives/48&oldid=1171112601"