Wikipedia:WikiProject on open proxies/Requests

66.160.199.60

– This proxy check request is closed and will soon be archived by a bot. 66.160.199.60 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Hurricane Electric open proxy. 176.103.48.38 (talk) 16:18, 9 November 2017 (UTC)

(Non-administrator comment)  Done Open proxy blocked Already rangeblocked. 61.245.229.113 (talk) 05:03, 19 November 2017 (UTC)

104.129.196.206

– This proxy check request is closed and will soon be archived by a bot. 104.129.196.206 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Zscaler open proxy. 122.197.215.184 (talk) 17:59, 10 November 2017 (UTC)

Not currently an open proxy It's a closed proxy, not open for anyone from what I can tell. Callanecc (talk • contribs • logs) 10:28, 19 November 2017 (UTC)

52.173.74.241

– This proxy check request is closed and will soon be archived by a bot. 52.173.74.241 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious (promotional) edits; socking; has been identified as Microsoft Azure host. ☆ Bri (talk) 18:02, 10 November 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:25, 19 November 2017 (UTC)

185.104.185.239

– This proxy check request is closed and will soon be archived by a bot. 185.104.185.239 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 185.104.185.50 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 78.129.130.230 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan 45.41.135.130 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: sockpuppetry, IPs in France, England, and Japan, being used by a banned user located in the United States who has used open proxies for abuse in the past. (NOTE: I combined a few open reports) Ivanvector (^Talk/_Edits) 15:35, 18 November 2017 (UTC)

All blocked. GAB^gab 15:52, 18 November 2017 (UTC)

95.153.132.82

– This proxy check request is closed and will soon be archived by a bot. 95.153.132.82 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits — Preceding unsigned comment added by 95.153.132.82 (talk • contribs) 01:28, 17 November 2017 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 10:26, 19 November 2017 (UTC)

92.53.105.52

– This proxy check request is closed and will soon be archived by a bot. 92.53.105.52 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: edit war-ish edit summaries. Host name is vds-holanet.timeweb.ru and ISP is TimeWeb Ltd., a Russian web hosting company. -★- PlyrStar93. _{→Message me. ←} 03:07, 19 November 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:27, 19 November 2017 (UTC)

2a02:c207::/32

– This proxy check request is closed and will soon be archived by a bot. 2a02:c207::/32 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Suspicious edits. Recently blocked as a webhost on meta.wiki, and was once blocked on en.wiki too. This /32 IPv6 range still appears to be a webhosting service. 219.98.8.174 (talk) 22:40, 19 November 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:43, 20 November 2017 (UTC)

2A03:EFC0:900:0:0:0:0:252

– This proxy check request is closed and will soon be archived by a bot. 2A03:EFC0:900:0:0:0:0:252 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Fanciful hoaxing & BLP violations in the style of Jaredgk2008.—Odysseus1479 05:34, 21 November 2017 (UTC)

Open proxy blocked, /40 range. -- zzuuzz ^(talk) 07:18, 21 November 2017 (UTC)

198.27.128.0/17 incorrectly identified as colocationwebhost

– This proxy check request is closed and will soon be archived by a bot. 198.27.128.0/17 · contribs · block · log · stalk · Robtex · whois · Google I work for the ISP which owns this netblock and can confirm that this is a range of DHCP addresses handed out to residential customers and has no connection to our colocation facilities. Refer to this discussion if you want to know why I posted this request here. Reason: Incorrectly blocked as colocationwebhost. Opsftw (talk) 18:38, 27 November 2017 (UTC)

@Opsftw: I'm changing the block reason to something more generic, but I will leave the block on unregistered users for the time being, as there has been some vandalism from the range. Users who log in will be able to edit, and no user will be presented with a message about colos. I will also drop a note to Ks0stm with regards to removing the block entirely. -- zzuuzz ^(talk) 19:09, 27 November 2017 (UTC)

@Zzuuzz: Thanks for your attention to this issue and for making the change you made. I still don't understand why the anonblock is wanted - looking at the relevant user page when I use "Hide probably good edits" there are no "probably bad" edits shown. I'm guessing you are using a different tool to spot vandalism from that range. Further, is it policy to anonblock an entire /17 of residential internet customers because somebody in that range was committing vandalism? Remember, we are talking about roughly thirty two thousand households (or approximately 75,000 human beings) being anonblocked because somebody within that range has acted inappropriately. That seems a bit extreme IMHO. Opsftw (talk) 19:30, 27 November 2017 (UTC)

@Opsftw: Unfortunately I have special access to the relevant tools. We have had problems with a long term vandal creating accounts from throughout this range throughout this year. They have been active in just the last few hours (though probably from other ranges). One or two occurrences may possibly have been explained by compromised hosts, but there does seem to be a theme. -- zzuuzz ^(talk) 19:54, 27 November 2017 (UTC)

@Zzuuzz: Would you be willing to share some examples of vandalism edits from the user in this range that you're concerned about? Again, still trying to understand how one person's inappropriate conduct should justify an anonblock of this magnitude (75,000 or so human beings are impacted).Opsftw (talk) 20:47, 27 November 2017 (UTC)

@Opsftw: I'm going to have to decline due to the Privacy policy and the nature of the vandalism. Don't get me wrong I don't take /17 blocks lightly, and they're usually reserved for severe disruption. Whether or not it's justified is something I'm currently pondering, but also bear in mind this isn't technically my block. -- zzuuzz ^(talk) 22:06, 27 November 2017 (UTC)

@Zzuuzz: Understood perfectly re: privacy. My role here is to advocate on behalf of our users, the vast majority of whom are not abusing our service to cause disruption to Wikipedia.

I'm leaving the block in place at this time. I've left further advice at User talk:Ks0stm. -- zzuuzz ^(talk) 07:12, 28 November 2017 (UTC)

98.239.113.209

A user has requested a proxy check. A proxy checker will shortly look into the case. 98.239.113.209 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: WP:DUCK test matches Wikipedia:Long-term abuse/109.151.65.218, behavior matches that one almost spot on. However, this IP's WHOIS data indicates a US-based IP address, while all of the others indicate UK-based IP addresses. Asking for a proxy check to see if they are using an open proxy to mask their location. IP is already blocked a short time based on behavioral evidence. --Jayron32 20:07, 27 November 2017 (UTC)

103.23.29.253

A user has requested a proxy check. A proxy checker will shortly look into the case. 103.23.29.253 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. I'm not sure how to check which port the IP is open on, but whatismyipaddress.com labels it as a "confirmed proxy server".

190.226.154.234

A user has requested a proxy check. A proxy checker will shortly look into the case. 190.226.154.234 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, listed as problem host by Barracuda. ☆ Bri (talk) 18:38, 28 November 2017 (UTC)

@Bri: Based on behavioral evidence, it seems more probable than not that this is not a proxy. GAB^gab 16:57, 30 November 2017 (UTC)

173.9.233.41

A user has requested a proxy check. A proxy checker will shortly look into the case. 173.9.233.41 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: All edits are vandalism/unconstructive. Also some other edits in other wikis: frwiki/simplewiki are the same type of vandalism. Proxy checker shows as VPN/proxy. Based on behavior, this is the Pikepass vandal at frwiki, who is known to abuse proxies (e.g. previous blocked IP 96.92.203.45 now globally blocked 1 year as open proxy). -★- PlyrStar93. _{→Message me. ←} 04:11, 29 November 2017 (UTC)

192.240.127.78

– This proxy check request is closed and will soon be archived by a bot. 192.240.127.78 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Dedicated server proxy IP. May need to be rangeblocked as {{webhostblock}}. 116.123.126.79 (talk) 10:05, 29 November 2017 (UTC)

 Range blocked by Zzuuzz. GAB^gab 16:56, 30 November 2017 (UTC)

147.91.1.43

A user has requested a proxy check. A proxy checker will shortly look into the case. 147.91.1.43 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. IP address is back to being a proxy once again per whatismyipaddress.com (refer to block log). 203.128.191.50 (talk) 18:04, 29 November 2017 (UTC)

117.20.41.10

A user has requested a proxy check. A proxy checker will shortly look into the case.

117.20.41.10 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

I am using an open proxy and you should ban it. The reason for this was to stay entirely anonymous and protect my identity. I joined Wikipedia to report a blocked sock-puppet Blastkius. I have been monitoring his disruptive behaviour on Wikipedia for a while. The SPI was successful and his latest socks have been blocked. So my work is done. Thank you. 117.20.41.10 (talk) 03:01, 2 December 2017 (UTC)

2001:42C8:0:301:41:206:188:206

– This proxy check request is closed and will soon be archived by a bot. 2001:42C8:0:301:41:206:188:206 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. User has admitted that this IP address is a Tor exit node. 60.36.225.155 (talk) 13:10, 30 November 2017 (UTC)

 IP blocked. GAB^gab 16:54, 30 November 2017 (UTC)