Wikipedia:WikiProject on open proxies/Requests: Difference between revisions

Browse history interactively

← Previous edit Next edit →

Content deleted Content added

VisualWikitext

Inline

Revision as of 04:47, 25 March 2018

Current Archives

Index

6, 7, 8, 9, 10, 11, 12, 13, 14, 15
16, 17, 18, 19, 20, 21, 22, 23, 24, 25
26, 27, 28, 29, 30, 31, 32, 33, 34, 35
36, 37, 38, 39, 40, 41, 42, 43, 44, 45
46, 47, 48, 49, 50

202.129.16.72/22

A user has requested a proxy check. A proxy checker will shortly look into the case. 202.129.16.72/22 · contribs · block · log · stalk · Robtex · whois · Google Reason: This IP range is used by a major commercial VPN provider. I'm WP:IPBE and I'm using this IP right now. BillHPike (talk, contribs) 01:32, 17 March 2018 (UTC)[reply]

Comment: Did you mean to post 202.129.16.0/22 · contribs · block · log · stalk · Robtex · whois · Google

That's the IP range that WHOIS confirms. 95.55.128.220 (talk) 06:54, 17 March 2018 (UTC)[reply]

The IP editor is right in so far as 202.129.16.0/22 is the standard CIDR notation, but it doesn't actually make any difference, because in a /22 range everything after the first 22 bits of the IP address is ignored, so that 202.129.16.0/22 and 202.129.16.72/22 are treated as the same range.

I don't know of any way to do a blanket check on a whole IP range, and I am not going to manually check all 1024 IP addresses in the range. However, I have checked 35 IP addresses in the range, including all of those which have ever edited Wikipedia, a few adjacent to some of those which did turn out to be proxies or VPNS, and a random sample of others. I have confirmed that 7 IP addresses of those 35 are running proxies or VPNs; for the other 28 I can't say. Since the sample that I have checked is a very small fraction of the total number of the range there will pretty certainly be many more. I am not sure whether that is enough to justify a range block. For the moment I shall block the ones that I know of. I may possibly come back and do some more work on this when I have more time. I am also leaving this report open in case someone else can help. The editor who uses the pseudonym "JamesBWatson" (talk) 11:18, 21 March 2018 (UTC)[reply]

I have now blocked the 7 that I know of, which are 202.129.16.8, 202.129.16.17, 202.129.16.29, 202.129.16.72, 202.129.16.104, 202.129.16.140, 202.129.17.177. The editor who uses the pseudonym "JamesBWatson" (talk) 11:26, 21 March 2018 (UTC)[reply]
2 more found and blocked: 202.129.16.70, 202.129.16.124. The editor who uses the pseudonym "JamesBWatson" (talk) 12:07, 21 March 2018 (UTC)[reply]

41.227.139.72

– This proxy check request is closed and will soon be archived by a bot. 41.227.139.72 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspected open proxy, since it geolocates to Tunisia but has just been used on Baklava by a sockmaster, User:Shingling334, who geolocates to the UK (a known fact that can also be seen from the IP they used just minutes later, Special:Contributions/82.132.230.174, which belongs to Telefonica O2 in the UK). - Tom | Thomas.W ^talk 22:28, 22 March 2018 (UTC)[reply]

Open proxy blocked Confirmed that this is a proxy or VPN, together with every one of a sample of other IP addresses in the same block used by the same ISP (41.227.128.0/17) so I have blocked that IP range. The editor who uses the pseudonym "JamesBWatson" (talk) 13:29, 23 March 2018 (UTC)[reply]

210.16.81.145 and 2405:204:9493:913F:DCE3:AB6A:D101:B93C

A user has requested a proxy check. A proxy checker will shortly look into the case. 210.16.81.145 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 2405:204:9493:913F:DCE3:AB6A:D101:B93C · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · geo · rangeblocks · spur · shodan

Both of the IPs above have per WP:DUCK been used by Shingling334 (i.e. the same sockmaster as in the report above), an editor who geolocates to the UK. The article they're hitting now (see also Special:Contributions/79.71.239.28,a dynamic 'phone company IP that geolocates to their known area) is Lahmajoun, an article that hasn't previously been among their favourites, but is now that Baklava and Döner kebab have been protected... - Tom | Thomas.W ^talk 14:36, 24 March 2018 (UTC)[reply]

192.169.128.0/17

A user has requested a proxy check. A proxy checker will shortly look into the case. 192.169.128.0/17 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Suspicious edits. GoDaddy.com dedicated server. Recently active on 192.169.226.73 (talk · contribs · WHOIS). 201.226.126.112 (talk) 04:47, 25 March 2018 (UTC)[reply]

@@ Line 36: / Line 36: @@
 Both of the IPs above have per [[WP:DUCK]] been used by ''Shingling334'' (i.e. the same sockmaster as in the report above), an editor who geolocates to the UK. The article they're hitting now (see also [[Special:Contributions/79.71.239.28]],a dynamic 'phone company IP that geolocates to their known area) is [[Lahmajoun]], an article that hasn't previously been among their favourites, but is now that [[Baklava]] and [[Döner kebab]] have been protected... -&nbsp;'''Tom'''&nbsp;&#124;&nbsp;[[User:Thomas.W|Thomas.W]] [[User talk:Thomas.W|'''''<sup><small> talk</small></sup>''''']] 14:36, 24 March 2018 (UTC)
+== 192.169.128.0/17 ==
+{{proxycheckstatus|}}
+{{Proxyip4|192.169.128.0/17}}
+<!-- Edit, add any other comments and sign -->
+<!-- NOTE: If you are reporting a web-proxy *please* include the URL if known. -->
+Reason: Suspicious edits. GoDaddy.com dedicated server. Recently active on {{IP|192.169.226.73}}. [[Special:Contributions/201.226.126.112|201.226.126.112]] ([[User talk:201.226.126.112|talk]]) 04:47, 25 March 2018 (UTC)