Wikipedia:WikiProject on open proxies/Requests

Looking to make a new report? You're in the wrong place! Please go to Wikipedia:WikiProject on open proxies#Reporting and fill in the relevant box.

36.77.0.0/16

A user has requested a proxy check. A proxy checker will shortly look into the case. 36.77.0.0/16 · contribs · block · log · stalk · Robtex · whois · Google

Discussion disruption at Talk:History of English#Requested move 31 July 2020: 36.77.92.121 (talk · contribs · WHOIS) added a bunch of articles as subjects of the RM despite the OP's (Soumya-8974) intention. Later 36.77.92.128 (talk · contribs · WHOIS) added a comment that copied a sentence from someone else's almost verbatim, likely in an attempt to create an impression of canvassing or puppetry.

The latter tests poorly on IPQualityScore. The range has been blocked in the past by Berean Hunter. Nardog (talk) 04:38, 6 August 2020 (UTC)

• @Nardog:  Unlikely IP is an open proxy. The range you're looking for (including 1 from your ANI report) is 36.77.92.0/23. I'm going to leave this open for someone else to take a look, to see if a block is indicated anyways. —Mdaniels5757 (talk) 20:45, 7 August 2020 (UTC)

User:Berean Hunter had previously twice blocked all of 36.77.0.0/16 for three months, anon-only, account creation blocked, for "CheckUser block: squelch sock account creation and IP socking". It's possible they might see a reason to reapply that block based on technical data. But if we just look at the behavior of Special:Contributions/36.77.92.0/23 I don't think it is quite vandalistic enough to justify a block on its own. Though a /23 is much narrower if we were tempted at all. The worst thing I noticed was the behavior at Talk:History of English that was already noted above. EdJohnston (talk) 16:20, 28 August 2020 (UTC)

Thanks EdJohnston. I have blocked that /16 again. That sockmaster is appearing in more than the /23, see 36.77.101.211, 36.77.135.116, 36.77.139.145, 36.77.111.114 as a few examples. He has multiple blocked accounts but was editing while logged out in this range.
 — Berean Hunter (talk) 18:07, 28 August 2020 (UTC)

143.244.48.0/22

– This proxy check request is closed and will soon be archived by a bot. 143.244.48.0/22 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Personal attacks on talk page after block. WHOIS data indicates some sort of colowebhost. The IP has already been temporarily blocked for disruptive editing however I'm wondering if the entire range should be blocked. -- LuK3 (Talk) 15:26, 28 August 2020 (UTC)

•  Confirmed, Already blocked. Closing without further action. —‍Mdaniels5757 (talk • contribs) 20:28, 28 August 2020 (UTC)

152.32.109.37

– This proxy check request is closed and will soon be archived by a bot. 152.32.109.37 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 152.32.108.72 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, IP Reported as Blacklisted Proxy/VPN Detection Proxy/VPN Proxy/VPN Detected ☆ Bri (talk) 14:31, 1 September 2020 (UTC)

152.32.108.72 similar edits same range ☆ Bri (talk) 14:49, 1 September 2020 (UTC)

No proxy found on either; closing. —‍Mdaniels5757 (talk • contribs) 22:04, 1 September 2020 (UTC)

@Mdaniels5757: Sometimes I get results like this, and it's puzzling. Do you know why IPQualityScore shows checkmarks by the first IP for proxy and recent abuse? ☆ Bri (talk) 04:58, 2 September 2020 (UTC)

@Bri: IPQualityScore isn't particularly accurate; it also can give old results (I don't know how recent they mean by "recent", but many proxies aren't active for long). —‍Mdaniels5757 (talk • contribs) 15:56, 2 September 2020 (UTC)

80.161.48.203

– This proxy check request is closed and will soon be archived by a bot. 80.161.48.203 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. This proxy used is not public and I can not see why it is blocked? — Preceding unsigned comment added by 217.16.108.164 (talk) 07:59, 2 September 2020 (UTC)

 Declined to run a check IP is not blocked; no signs that it's a proxy anyways. Closing. —‍Mdaniels5757 (talk • contribs) 15:59, 2 September 2020 (UTC)

202.65.154.182

– A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below. 202.65.154.182 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, appears to be a data center, ipqualityscore reports VPN or proxy & fraud score 99.

There are other suspicious IPs editing in same set of articles, I have reported two of them before. Running list at User:Bri/COIbox97 ☆ Bri (talk) 17:02, 3 September 2020 (UTC)

•  Confirmed {{colocationwebhost}} via WHOIS and open SSH port, as is the rest of the 202.65.128.0/19 range. Block of the 202.65.128.0/19 range requested: last global block, which recently expired, was for a year, so I'd go for 1-3 years. —‍Mdaniels5757 (talk • contribs) 16:15, 4 September 2020 (UTC)