Wikipedia:WikiProject Open proxies/Requests/Archives/28

150.129.4.18

– This proxy check request is closed and will soon be archived by a bot.

150.129.4.18 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

open port 8080 2016-05-27

Reason: suspicious edits

Confirmed, blocked. Materialscientist (talk) 11:42, 25 July 2016 (UTC)

71.207.70.133

– This proxy check request is closed and will soon be archived by a bot.

71.207.70.133 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Has been blocked once before on port 30364. 71.237.141.40 (talk) 19:32, 28 May 2016 (UTC)

•  Blocked Callanecc (talk • contribs • logs) 10:17, 19 October 2017 (UTC)

70.192.71.206

– This proxy check request is closed and will soon be archived by a bot.

70.192.71.206 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. 71.237.141.40 (talk) 03:03, 29 May 2016 (UTC)

• Not done Callanecc (talk • contribs • logs) 10:18, 19 October 2017 (UTC)

45.127.122.174

– This proxy check request is closed and will soon be archived by a bot.

45.127.122.174 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Open on port 8080, blocked in March by ProcseeBot

Reason: Suspicious edits. Sro23 (talk) 07:35, 4 June 2016 (UTC)

• Confirmed, blocked. Materialscientist (talk) 08:07, 30 July 2016 (UTC)

139.255.39.147

– This proxy check request is closed and will soon be archived by a bot.

139.255.39.147 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

port 8080 2016-06-08

Reason: Suspicious edits

 Declined to run a check — the ip's literally done nothing. --slakr^\ talk / 04:41, 25 March 2017 (UTC)

64.61.164.82

– This proxy check request is closed and will soon be archived by a bot.

64.61.164.82 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

blocked once before 2016-06-11

Reason: Suspicious edits

177.128.34.27

– This proxy check request is closed and will soon be archived by a bot.

177.128.34.27 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

many open ports in the 8000 range 2016-06-12

Reason: Suspicious edits

84.22.35.37

– This proxy check request is closed and will soon be archived by a bot.

84.22.35.37 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

mikrotik router open port 80 2016-06-12

Reason: Suspicious edits

197.210.185.246

– This proxy check request is closed and will soon be archived by a bot.

197.210.185.246 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

2016-06-17

pot 8080 blocked before

Reason: Suspicious edits

24.167.246.32

– This proxy check request is closed and will soon be archived by a bot.

24.167.246.32 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

2016-06-17

Reason: Suspicious edits

177.128.34.27

– This proxy check request is closed and will soon be archived by a bot.

177.128.34.27 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

port 8080 and 3128 open, among others 2016-06-17

Reason: Suspicious edits

67.160.137.188

– This proxy check request is closed and will soon be archived by a bot.

67.160.137.188 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

78.250.21.159 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

78.162.53.254 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

85.97.5.25 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

77.248.191.60 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

174.112.11.49 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

111.69.225.40 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

151.241.65.134 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

103.41.63.12 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

93.199.28.80 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

162.219.26.43 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

94.196.213.139 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

108.14.102.26 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

80.2.81.187 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

217.118.79.46 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

78.170.99.254 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

91.235.247.56 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

193.15.144.245 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

62.143.41.82 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits/signs of sockpupetry. Most of these ips above were mentioned on here and the last one was confirmed here. The proxies seem stale. However, it doesn't mean that they are not being abused by the long-term abuser, since his status is still active. 46.221.217.82 (talk) 16:54, 17 June 2016 (UTC)

46.16.193.70

– This proxy check request is closed and will soon be archived by a bot.

46.16.193.70 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Also, the same ip was reported on Wikipedia:Sockpuppet investigations/Tirgil34. 46.221.217.82 (talk) 17:10, 17 June 2016 (UTC)

 Possible IP is an open proxy on PPTP port, might require an app and (or) username/password combination. Regards—UY Scuti ^Talk 19:24, 18 June 2016 (UTC)

213.33.142.90

– This proxy check request is closed and will soon be archived by a bot.

213.33.142.90 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Proxy socking.- MrX 15:36, 19 June 2016 (UTC)

54.166.106.30

– This proxy check request is closed and will soon be archived by a bot.

54.166.106.30 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Socking via Amazon AWS.- MrX 15:39, 19 June 2016 (UTC)

86.52.101.203

– This proxy check request is closed and will soon be archived by a bot.

86.52.101.203 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, likely proxy. Also, similar edits and fields of interest with a banned sockmaster. See: WP:Tirgil34. 46.221.224.69 (talk) 15:55, 19 June 2016 (UTC)

70.90.16.115

– This proxy check request is closed and will soon be archived by a bot.

70.90.16.115 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: suspicious edits & blocked by ProcseeBot in November Sro23 (talk) 14:42, 24 June 2016 (UTC)

IP is an open proxy on port 8080. Regards—UY Scuti ^Talk 15:49, 8 July 2016 (UTC)

217.64.195.226

– This proxy check request is closed and will soon be archived by a bot.

217.64.195.226 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. IP is registered to "Tophost hosting servers", geo-locating to Italy, and is based from this proxy hosting service/website. 172.56.42.70 (talk) 22:25, 25 June 2016 (UTC)

 Likely IP is an open proxy please block the range 217.64.195.192/26 (block range · block log (global) · WHOIS (partial)) as {{webhostblock}} and block 2001:4B78:1001:0:0:0:0:401 (talk · contribs · WHOIS) as {{blocked proxy}}, since the traffic to this web-proxy exits via that IP. Regards—UY Scuti ^Talk 16:04, 8 July 2016 (UTC)

159.253.145.183

– This proxy check request is closed and will soon be archived by a bot.

159.253.145.183 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open proxy at anonymoX.net. 172.56.42.70 (talk) 22:44, 25 June 2016 (UTC)

IP is an open proxy with anonymoX on port 80 (requires login credentials). Regards—UY Scuti ^Talk 16:12, 8 July 2016 (UTC)

198.24.162.179

– This proxy check request is closed and will soon be archived by a bot.

198.24.162.179 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open proxy at anonymoX.net. 172.56.42.70 (talk) 22:44, 25 June 2016 (UTC)

 Likely IP is an open proxy belongs to anonymoX. Regards—UY Scuti ^Talk 16:33, 8 July 2016 (UTC)

208.110.81.90

– This proxy check request is closed and will soon be archived by a bot.

208.110.81.90 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. IPv4 proxy IP from proxfree.com. 172.56.42.5 (talk) 22:33, 30 June 2016 (UTC)

IP is an open proxy, a web-proxy. Lot of open proxies operating on this range 208.110.64.0/19 (block range · block log (global) · WHOIS (partial)) and should be blocked as {{webhostblock}}. Regards—UY Scuti ^Talk 16:48, 8 July 2016 (UTC)

Globally hardblocked. Regards—UY Scuti ^Talk 14:07, 9 July 2016 (UTC)

5.39.188.0

– This proxy check request is closed and will soon be archived by a bot.

5.39.188.0 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 3128. 172.56.42.5 (talk) 22:50, 30 June 2016 (UTC)

 Unlikely IP is an open proxy IP resolves to colocenter.nl, unlikely an open proxy is operating there. Regards—UY Scuti ^Talk 17:02, 8 July 2016 (UTC)

104.171.115.66

– This proxy check request is closed and will soon be archived by a bot.

104.171.115.66 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open proxy here. 172.56.42.5 (talk) 22:56, 30 June 2016 (UTC)

206.41.39.56

– This proxy check request is closed and will soon be archived by a bot.

206.41.39.56 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 8080. 172.56.42.5 (talk) 23:48, 30 June 2016 (UTC)

 Likely IP is an open proxy on port 8080. Regards—UY Scuti ^Talk 17:17, 8 July 2016 (UTC)

202.77.57.124

– This proxy check request is closed and will soon be archived by a bot.

202.77.57.124 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

• http://202.77.57.124:3128/ --Antigng (talk) 03:32, 2 July 2016 (UTC)

Reason: Suspicious edits

IP is an open proxy on port 3128. Regards—UY Scuti ^Talk 17:22, 8 July 2016 (UTC)

113.160.57.242

– This proxy check request is closed and will soon be archived by a bot.

113.160.57.242 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

• See http://113.160.57.242:8080/ --Antigng (talk) 05:03, 2 July 2016 (UTC)

Reason: Suspicious edits

89.141.113.180

– This proxy check request is closed and will soon be archived by a bot.

89.141.113.180 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

• port 9080 --Antigng (talk) 16:32, 6 July 2016 (UTC)

  Confirmed, blocked. Materialscientist (talk) 22:18, 24 July 2016 (UTC)

195.144.232.165

– This proxy check request is closed and will soon be archived by a bot.

195.144.232.165 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 1080. More details can be found here. 172.56.42.233 (talk) 20:21, 9 July 2016 (UTC)

Confirmed, blocked. Materialscientist (talk) 22:07, 26 July 2016 (UTC)

78.135.114.76

– This proxy check request is closed and will soon be archived by a bot.

78.135.114.76 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 1080. More details can be found here. 172.56.42.233 (talk) 20:30, 9 July 2016 (UTC)

Confirmed, blocked. Materialscientist (talk) 22:18, 24 July 2016 (UTC)

64.26.95.14

– This proxy check request is closed and will soon be archived by a bot.

64.26.95.14 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 8080. 172.56.42.221 (talk) 21:45, 9 July 2016 (UTC)

188.165.199.94

– This proxy check request is closed and will soon be archived by a bot.

188.165.199.94 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open proxy. The following IP seems to be in a wide variety of open proxies with the IP range of 188.165.0.0/16 (talk · contribs · WHOIS) per WHOIS. Also, this IPv6 address which is currently blocked, 2001:41d0:2:905e::1 (talk · contribs · WHOIS) exits through the IPv4 address above. 172.56.42.221 (talk) 22:11, 9 July 2016 (UTC)

188.165.192.0/18 proxy blocked. The editor who uses the pseudonym "JamesBWatson" (talk) 12:40, 26 July 2016 (UTC)

91.203.111.4

– This proxy check request is closed and will soon be archived by a bot.

Blocked by DoRD. The editor who uses the pseudonym "JamesBWatson" (talk) 12:52, 26 July 2016 (UTC)

91.203.111.4 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Current open proxy. Has been recently used to evade a block. 172.58.35.162 (talk) 22:33, 9 July 2016 (UTC)

165.139.149.169

– This proxy check request is closed and will soon be archived by a bot.

165.139.149.169 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 3128. 172.58.41.207 (talk) 03:39, 11 July 2016 (UTC)

UPDATE: Apparently, it is registered to a school in Indiana, per the school template on the IP's talkpage. The IP registration may have recently changed... 172.58.41.207 (talk) 03:43, 11 July 2016 (UTC)

Not currently an open proxy Regards—UY Scuti ^Talk 13:17, 6 August 2016 (UTC)

12.196.110.50

– This proxy check request is closed and will soon be archived by a bot.

12.196.110.50 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 8080. 172.58.41.207 (talk) 03:41, 11 July 2016 (UTC)

190.144.114.122

– This proxy check request is closed and will soon be archived by a bot.

190.144.114.122 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 3128. 172.58.41.207 (talk) 03:44, 11 July 2016 (UTC)

Confirmed, blocked. Materialscientist (talk) 22:19, 24 July 2016 (UTC)

82.117.163.74

– This proxy check request is closed and will soon be archived by a bot.

82.117.163.74 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 8080. 172.58.41.207 (talk) 03:45, 11 July 2016 (UTC)

IP is an open proxy on port 8080, exiting on 109.202.15.100 (talk · contribs · deleted contribs · page moves · block user · block log). Regards—UY Scuti ^Talk 13:42, 6 August 2016 (UTC)

201.55.46.6

– This proxy check request is closed and will soon be archived by a bot.

201.55.46.6 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 80. 172.58.41.207 (talk) 03:47, 11 July 2016 (UTC)

Confirmed, blocked. Materialscientist (talk) 21:58, 25 July 2016 (UTC)

111.7.162.46

– This proxy check request is closed and will soon be archived by a bot.

111.7.162.46 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 8080. 172.58.41.207 (talk) 03:48, 11 July 2016 (UTC)

66.253.245.180

– This proxy check request is closed and will soon be archived by a bot.

66.253.245.180 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 10200. 172.58.41.207 (talk) 03:49, 11 July 2016 (UTC)

107.191.199.198

– This proxy check request is closed and will soon be archived by a bot.

107.191.199.198 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 10200. 172.58.41.207 (talk) 03:50, 11 July 2016 (UTC)

208.103.10.152

– This proxy check request is closed and will soon be archived by a bot.

208.103.10.152 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 10200. 172.58.41.207 (talk) 03:52, 11 July 2016 (UTC)

Confirmed, blocked. Materialscientist (talk) 11:41, 25 July 2016 (UTC)

50.115.129.125

– This proxy check request is closed and will soon be archived by a bot.

50.115.129.125 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 60088. 172.58.41.207 (talk) 03:53, 11 July 2016 (UTC)

112.213.126.130

– This proxy check request is closed and will soon be archived by a bot.

112.213.126.130 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 1080. 172.58.41.207 (talk) 03:55, 11 July 2016 (UTC)

66.228.33.248

– This proxy check request is closed and will soon be archived by a bot.

66.228.33.248 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 9050. 172.58.41.207 (talk) 03:57, 11 July 2016 (UTC)

Confirmed, blocked. Materialscientist (talk) 22:52, 24 July 2016 (UTC)

212.56.157.188

– This proxy check request is closed and will soon be archived by a bot.

212.56.157.188 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 60088. 172.58.41.207 (talk) 04:04, 11 July 2016 (UTC)

5.255.65.140

– This proxy check request is closed and will soon be archived by a bot.

5.255.65.140 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 60088. 172.58.41.207 (talk) 04:05, 11 July 2016 (UTC)

65.60.220.192

– This proxy check request is closed and will soon be archived by a bot.

65.60.220.192 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 10200. 172.58.41.207 (talk) 04:07, 11 July 2016 (UTC)

Confirmed, blocked. Materialscientist (talk) 21:57, 25 July 2016 (UTC)

177.99.83.47

– This proxy check request is closed and will soon be archived by a bot.

177.99.83.47 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 8080. 2607:FB90:8089:750F:0:18:D040:9101 (talk) 02:25, 16 July 2016 (UTC)

2001:41D0:0:0:0:0:0:0/32

– This proxy check request is closed and will soon be archived by a bot.

2001:41D0:0:0:0:0:0:0/32 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Unicyclon requested unblock. Reason given for IP address: {{webhostblock}}. עוד מישהו Od Mishehu 11:43, 17 July 2016 (UTC)

Unblocked by Luk. Regards—UY Scuti ^Talk 16:17, 6 August 2016 (UTC)

114.215.114.25

– This proxy check request is closed and will soon be archived by a bot.

114.215.114.25 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: suspicious edits Sro23 (talk) 18:22, 23 July 2016 (UTC)

Globally blocked by Tegel. The editor who uses the pseudonym "JamesBWatson" (talk) 10:31, 26 July 2016 (UTC)

129.45.70.0

– This proxy check request is closed and will soon be archived by a bot.

129.45.70.0 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. 2607:FB90:80AE:5088:0:31:E487:1301 (talk) 22:02, 24 July 2016 (UTC)

189.115.157.122

– This proxy check request is closed and will soon be archived by a bot.

189.115.157.122 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits on ja.wikipedia.org.--HotKorokke (talk) 22:42, 24 July 2016 (UTC)

198.61.174.32 (Range: 198.61.174.0/23)

– This proxy check request is closed and will soon be archived by a bot.

198.61.174.32 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Belongs to Rackspace Cloud Servers in San Antonio, Texas. Also offered by proxy hosting site known as browserling.com. 2607:FB90:80AE:5088:0:31:E487:1301 (talk) 00:50, 25 July 2016 (UTC)

What do you mean by "Suspicious edits"? I can find no record of any edits from this IP address on any Wikimedia project, and I can find no edits from any IP address in the given range on English Wikipedia (I have not checked other projects). There are four open ports, but I have not yet been able to confirm that it's an open proxy. The editor who uses the pseudonym "JamesBWatson" (talk) 10:29, 26 July 2016 (UTC)

@JamesBWatson: Please note that I am the same user as the 2607 IP. Sorry about that. The default message when reporting a proxy at this noticeboard is "suspicious edits". I apparently left the default text there and then described the proxy range afterwards. Anyway, this appears to be a high-usage proxy/web-hosting platform that is widely used. I've been testing out some proxy sites in trying to find open proxies that are currently not blocked. Cheers. 172.58.24.218 (talk) 00:55, 31 July 2016 (UTC)

117.211.83.18

– This proxy check request is closed and will soon be archived by a bot.

117.211.83.18 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Recent disruptive edits and this IP has been blocked as a proxy twice before - see log. Geraldo Perez (talk) 13:42, 25 July 2016 (UTC)

This is certainly a proxy, with open ports at 3128 & 8021 but I have not yet been able to confirm that it's an open proxy. The editor who uses the pseudonym "JamesBWatson" (talk) 10:16, 26 July 2016 (UTC)

Static IP allocated to an Indian University. Although this technically is a proxy, it does not redirect requests. Regards—UY Scuti ^Talk 16:46, 6 August 2016 (UTC)

78.46.43.39

– This proxy check request is closed and will soon be archived by a bot.

78.46.43.39 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. 2607:FB90:4A3B:11E7:0:4B:E2D7:1501 (talk) 07:18, 28 July 2016 (UTC)

114.6.45.106

– This proxy check request is closed and will soon be archived by a bot.

114.6.45.106 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 1080. More details can be found here. 172.58.24.218 (talk) 00:44, 31 July 2016 (UTC)

177.11.136.138

– This proxy check request is closed and will soon be archived by a bot.

177.11.136.138 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 1080. More details can be found here. 172.58.24.218 (talk) 00:47, 31 July 2016 (UTC)

118.192.145.99

– This proxy check request is closed and will soon be archived by a bot.

118.192.145.99 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 1080. More details can be found here. 172.58.24.218 (talk) 00:50, 31 July 2016 (UTC)

31.192.104.216

– This proxy check request is closed and will soon be archived by a bot.

31.192.104.216 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: ru-02.tunnello.com Tunnello open proxy. See http://31.192.104.216:3129/, https://31.192.104.216/. --Antigng (talk) 01:36, 31 July 2016 (UTC)

(Non-administrator comment) Open on port 3129. 172.58.40.81 (talk) 03:44, 31 July 2016 (UTC)

 Comment::

from Hong Kong

hk-01.tunnello.com. -> 43.250.8.25 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

hk-03.tunnello.com. -> 43.250.9.26 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

hk-04.tunnello.com. -> 103.41.134.56 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

from Singapore

sg-01.tunnello.com. -> 188.166.237.14 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

from France

fr-01.tunnello.com. -> 149.202.90.174 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

fr-02.tunnello.com. -> 149.202.90.176 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

fr-03.tunnello.com. -> 149.202.90.177 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

from Britain

gb-01.tunnello.com. -> 89.36.222.183 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

gb-03.tunnello.com. -> 82.163.78.194 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

from US

us-01.tunnello.com. -> 198.8.86.84 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

us-02.tunnello.com. -> 198.8.86.93 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

us-03.tunnello.com. -> 162.243.78.134 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

us-04.tunnello.com. -> 108.62.49.17 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

us-05.tunnello.com. -> 45.32.161.68 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

from Italy

it-01.tunnello.com. -> 188.213.171.174 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

it-02.tunnello.com. -> 31.193.129.45 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

it-03.tunnello.com. -> 188.213.171.174 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

from Canada

ca-01.tunnello.com. -> 192.99.63.235 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

from Russia

ru-01.tunnello.com. -> 188.120.238.216 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

ru-02.tunnello.com. -> 31.192.104.216 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

from Germany

de-01.tunnello.com. -> 89.40.116.106 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

de-02.tunnello.com. -> 46.101.105.38 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

de-03.tunnello.com. -> 46.101.157.40 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

from Spain

es-01.tunnello.com. -> 212.231.130.37 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

es-02.tunnello.com. -> 185.140.114.100 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

The official website says there are Belgian proxies, but I can't find any of them. --Antigng (talk) 07:50, 31 July 2016 (UTC)

31.131.20.170

– This proxy check request is closed and will soon be archived by a bot.

31.131.20.170 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open proxy via web hosting system Tunnello.com. Open on port 3129. 172.58.40.81 (talk) 03:43, 31 July 2016 (UTC)

Blocked by Materialscientist. 172.58.41.237 (talk) 21:18, 31 July 2016 (UTC)

85.185.244.116

– This proxy check request is closed and will soon be archived by a bot.

85.185.244.116 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open at port 1080. More details can be found here. 172.56.42.174 (talk) 04:42, 31 July 2016 (UTC)

Confirmed, blocked. Materialscientist (talk) 22:23, 1 August 2016 (UTC)

114.252.68.87

– This proxy check request is closed and will soon be archived by a bot.

114.252.68.87 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open at port 1080. More details can be found here. 172.56.42.174 (talk) 04:43, 31 July 2016 (UTC)

173.189.25.73

– This proxy check request is closed and will soon be archived by a bot.

173.189.25.73 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open at port 10200. More details can be found here. 172.56.42.174 (talk) 04:44, 31 July 2016 (UTC)

Confirmed, blocked. Materialscientist (talk) 22:26, 1 August 2016 (UTC)

203.93.97.24

– This proxy check request is closed and will soon be archived by a bot.

203.93.97.24 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open at port 1080. More details can be found here. 172.56.42.174 (talk) 04:46, 31 July 2016 (UTC)

41.204.93.194

– This proxy check request is closed and will soon be archived by a bot.

41.204.93.194 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open at port 1080. More details can be found here. 172.56.42.174 (talk) 04:47, 31 July 2016 (UTC)

213.151.206.178

– This proxy check request is closed and will soon be archived by a bot.

213.151.206.178 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open at port 1080. More details can be found here. 172.56.42.174 (talk) 04:48, 31 July 2016 (UTC)

5.160.247.76

– This proxy check request is closed and will soon be archived by a bot.

5.160.247.76 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open on port 1080. More details can be found here. 172.58.41.237 (talk) 20:05, 31 July 2016 (UTC)

(See IP's Below)

– This proxy check request is closed and will soon be archived by a bot.

Reason: Mobile phone app web-hosting site. This seems to be a very wide IP range, but all may be of the same hosting network per WHOIS. Some of the proxies that I have found to be open are all on port 1080. Some of them include:

• 103.41.176.38 (talk · contribs · WHOIS) - Confirmed here
• 103.39.151.188 (talk · contribs · WHOIS) - Confirmed here
• 103.39.151.168 (talk · contribs · WHOIS) - Confirmed here

There is probably a better hidden CIDR sub-mask that I'm just not seeing...

172.56.42.18 (talk) 05:13, 2 August 2016 (UTC)

104.131.0.0/16

– This proxy check request is closed and will soon be archived by a bot.

104.131.0.0/16 · contribs · block · log · stalk · Robtex · whois · Google

Reason: IP range is almost at the end of it's current web-host-block. The IP range is still open. 172.58.41.186 (talk) 00:04, 4 August 2016 (UTC)

162.243.0.0/16

– This proxy check request is closed and will soon be archived by a bot.

162.243.0.0/16 · contribs · block · log · stalk · Robtex · whois · Google

Reason: IP range is currently open. Has been blocked in the past. 172.58.41.186 (talk) 00:04, 4 August 2016 (UTC)

114.6.45.106

– This proxy check request is closed and will soon be archived by a bot.

114.6.45.106 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open on port 1080. More details can be found here. 172.58.40.246 (talk) 03:51, 4 August 2016 (UTC)

5.160.247.76

– This proxy check request is closed and will soon be archived by a bot.

5.160.247.76 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open on port 1080. More details can be found here. 172.58.40.246 (talk) 03:51, 4 August 2016 (UTC)

118.192.145.99

– This proxy check request is closed and will soon be archived by a bot.

118.192.145.99 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open on port 1080. More details can be found here. 172.58.40.246 (talk) 03:51, 4 August 2016 (UTC)

95.188.77.233

– This proxy check request is closed and will soon be archived by a bot.

95.188.77.233 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open on port 1080. More details can be found here. 172.58.40.246 (talk) 03:51, 4 August 2016 (UTC)

81.30.116.103

– This proxy check request is closed and will soon be archived by a bot.

81.30.116.103 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open on port 1080. Runs through the same traffic as currently blocked proxy: 93.183.85.208 (talk · contribs · WHOIS). 172.58.40.246 (talk) 03:51, 4 August 2016 (UTC)

64.188.212.9

– This proxy check request is closed and will soon be archived by a bot.

64.188.212.9 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open on port 10200. More details can be found here. 172.58.40.246 (talk) 03:51, 4 August 2016 (UTC)

78.135.114.77

– This proxy check request is closed and will soon be archived by a bot.

78.135.114.77 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open on port 1080. Runs through the same traffic as currently blocked proxy: 78.135.114.76 (talk · contribs · WHOIS). See also the very first block entry for 78.135.114.76 (talk · contribs · WHOIS) blocked by ProcseeBot. 172.58.40.246 (talk) 04:13, 4 August 2016 (UTC)

Confirmed, blocked. Materialscientist (talk) 09:56, 4 August 2016 (UTC)

195.154.0.0/16

– This proxy check request is closed and will soon be archived by a bot.

195.154.0.0/16 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Block for this IP range is about to end, and it is still currently open through VPN serive "SaferVPN". 208.54.5.206 (talk) 20:56, 5 August 2016 (UTC)

192.184.48.10

– This proxy check request is closed and will soon be archived by a bot.

192.184.48.10 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Many edits that are obvious vandalism, even more edits that add information to articles without citation. Going to user's IP address redirects to Google. Running WHOIS on user's IP shows a virtual private server provider which is likely being used as a proxy.

Wave1453 (talk) 18:31, 7 August 2016 (UTC)

(Non-administrator comment) This IP appears to be one of many IP's registered to a private VPN network known as "Psychz Networks", from the following IP range: 192.184.32.0/19 (talk · contribs · WHOIS). Please see this link. 172.56.39.164 (talk) 03:44, 15 August 2016 (UTC)

192.95.0.0/18

– This proxy check request is closed and will soon be archived by a bot.

192.95.0.0/18 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Suspicious edits from 192.95.39.118 (talk · contribs · WHOIS) & 192.95.39.46 (talk · contribs · WHOIS). WHOIS shows that this is the range containing the open proxy(ies). Also is used by proxy web-hosting website known as "KProxy.com". 172.56.7.10 (talk) 13:44, 10 August 2016 (UTC)

82.117.163.74

– This proxy check request is closed and will soon be archived by a bot.

82.117.163.74 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open proxy with running traffic through already currently blocked proxy 109.202.15.100 (talk · contribs · WHOIS). 172.56.7.10 (talk) 13:53, 10 August 2016 (UTC)

Already blocked. Worthless it is to block the entry node. Regards—UY Scuti ^Talk 15:49, 10 August 2016 (UTC)

37.187.0.0/16

– This proxy check request is closed and will soon be archived by a bot.

37.187.0.0/16 · contribs · block · log · stalk · Robtex · whois · Google

Reason: This IP range is still currently open through dedicated OVH servers; current block is about to expire. 172.58.40.103 (talk) 03:02, 12 August 2016 (UTC)

Already blocked. Regards—UY Scuti ^Talk 16:10, 15 August 2016 (UTC)

87.98.128.0/17

– This proxy check request is closed and will soon be archived by a bot.

87.98.128.0/17 · contribs · block · log · stalk · Robtex · whois · Google

Reason: This IP range is still currently open through dedicated OVH servers. Has been blocked twice in the past. 172.58.40.103 (talk) 03:05, 12 August 2016 (UTC)

192.95.0.0/18

– This proxy check request is closed and will soon be archived by a bot.

192.95.0.0/18 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Open IP range through web-host cloud service through "KProxy.com". 172.56.42.156 (talk) 03:31, 12 August 2016 (UTC)

167.114.0.0/16

– This proxy check request is closed and will soon be archived by a bot.

167.114.0.0/16 · contribs · block · log · stalk · Robtex · whois · Google

Reason: OVH dedicated range through web-hosting proxy service "KProxy.com". 172.58.41.1 (talk) 18:40, 12 August 2016 (UTC)

Already blocked globally. Materialscientist (talk) 22:14, 14 August 2016 (UTC)

149.202.0.0/16

– This proxy check request is closed and will soon be archived by a bot.

149.202.0.0/16 · contribs · block · log · stalk · Robtex · whois · Google

Reason: OVH dedicated range through web-hosting proxy service "KProxy.com". 208.54.5.147 (talk) 21:54, 12 August 2016 (UTC)

205.157.66.4

– This proxy check request is closed and will soon be archived by a bot.

205.157.66.4 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Apparently involved in Vodkapoise LTA socking, reported by tools as confirmed proxy [1]. Brianhe (talk) 15:57, 14 August 2016 (UTC)

(Non-administrator comment) This IP is registered to Office Depot in Delray Beach, United States (which is not a proxy server) with the following IP range: 205.157.66.0/24 (talk · contribs · WHOIS). Also whatismyipaddress.com does not actually confirm open proxies, as is noted on the top of the edit notice when editing this noticeboard. 172.56.39.164 (talk) 03:51, 15 August 2016 (UTC)

74.120.222.234

– This proxy check request is closed and will soon be archived by a bot.

74.120.222.234 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Canadian server for Boleh VPN (https://www.bolehvpn.net/) Ronhjones  ^(Talk) 19:52, 14 August 2016 (UTC)

(Non-administrator comment) IP is registered to GloboTech Communications under the following IP range: 74.120.220.0/22 (talk · contribs · WHOIS). This appears to be a cloud hosting service. The IP range has also been blocked three times, with the latest block as six months. Please see this link. 172.56.38.211 (talk) 04:37, 15 August 2016 (UTC)

198.61.128.0/18

– This proxy check request is closed and will soon be archived by a bot.

198.61.128.0/18 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Belongs to Rackspace Cloud Servers in San Antonio, Texas. Also offered by proxy hosting site known as browserling.com. Please see this link. 172.56.38.211 (talk) 04:58, 15 August 2016 (UTC)

92.63.100.80

– This proxy check request is closed and will soon be archived by a bot.

92.63.100.80 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: IP was recently blocked as an open proxy. Current blocking period has almost expired. Registered to [Cohula.ru] and open on port 80. 172.56.38.211 (talk) 04:58, 15 August 2016 (UTC)

See #130—UY Scuti ^Talk 14:00, 24 August 2016 (UTC)

188.165.0.0/16

– This proxy check request is closed and will soon be archived by a bot.

188.165.0.0/16 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Dedicated OVH open IP proxy range. Has been blocked in the past. 172.56.38.211 (talk) 04:58, 15 August 2016 (UTC)

Already blocked. @172.56.38.211: As you can see, reporting IPs with no suspicious editing patterns makes things slow and is overwhelming to proxy checkers. It is quite hard to clear the current high backlog. There are a LOT of open proxies that haven't edited Wikipedia. It is also counter productive, should we choose to check and block them all individually. To ease things a bit, I'd suggest you to henceforth report IPs that only have suspicious editing patterns. Please also consider not reporting IP ranges unless you see a pattern of editing. Regardless, I appreciate your work to help defend Wikipedia. Regards—UY Scuti ^Talk 16:21, 15 August 2016 (UTC)

95.213.128.0/17

– This proxy check request is closed and will soon be archived by a bot.

95.213.128.0/17 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Dedicated OVH open IP proxy range. Has been blocked in the past. 172.56.38.211 (talk) 04:58, 15 August 2016 (UTC)

62.210.0.0/16

– This proxy check request is closed and will soon be archived by a bot.

62.210.0.0/16 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Dedicated OVH open IP proxy range. Has been blocked in the past. 172.56.38.211 (talk) 04:58, 15 August 2016 (UTC)

178.32.0.0/15

– This proxy check request is closed and will soon be archived by a bot.

178.32.0.0/15 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Dedicated OVH open IP proxy range. 172.56.38.211 (talk) 04:58, 15 August 2016 (UTC)

46.28.67.33

– This proxy check request is closed and will soon be archived by a bot.

46.28.67.33 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

• zenmate. See https://46.28.67.33 .--Antigng (talk) 14:57, 15 August 2016 (UTC)

(Non-administrator comment) IP range locates to Ukraine, and is likely a webhosting service with the IP range at 46.28.64.0/21 (talk · contribs · WHOIS). 172.56.38.228 (talk) 01:43, 16 August 2016 (UTC)

45.56.80.0/20

– This proxy check request is closed and will soon be archived by a bot.

45.56.80.0/20 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Suspicious edits at 45.56.87.119 (talk · contribs · WHOIS). The following IP with the given IP range locates it's ISP to Linode Cloud Hosting Services, which is a virtual private network. Please see this link. 172.56.38.228 (talk) 01:39, 16 August 2016 (UTC)

 Unlikely IP is an open proxy on the IP,  Declined to run a check on the range (No reason given)—UY Scuti ^Talk 15:20, 24 August 2016 (UTC)

185.104.186.10 & 185.104.186.11

– This proxy check request is closed and will soon be archived by a bot.

185.104.186.10 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

185.104.186.11 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

• zenmate. See https://185.104.186.10/ & https://185.104.186.11/ .--Antigng (talk) 05:06, 17 August 2016 (UTC)

(Non-administrator comment) The IP range for this network/IP address is 185.104.186.0/24 (talk · contribs · WHOIS) Please see this link. 172.58.41.120 (talk) 20:46, 17 August 2016 (UTC)

IP is an open proxy Zenmate exit nodes on port 443 (both IPs). Regards—UY Scuti ^Talk 14:41, 24 August 2016 (UTC)

193.182.144.73

– This proxy check request is closed and will soon be archived by a bot.

193.182.144.73 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: IP traffic through Zenmate VPN service. The IP is within the same network with the following IP range: 193.182.144.0/24 (talk · contribs · WHOIS). Please see this link. 193.182.144.73 (talk) 21:31, 17 August 2016 (UTC)

IP is an open proxy Zenmate exit nodes on port 443. Regards—UY Scuti ^Talk 14:04, 24 August 2016 (UTC)

178.255.42.234

– This proxy check request is closed and will soon be archived by a bot.

178.255.42.234 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: IP traffic through Zenmate VPN service. The IP is within the same network with the following IP range: 178.255.42.0/24 (talk · contribs · WHOIS). Please see this link. 178.255.42.234 (talk) 21:41, 17 August 2016 (UTC)

IP is an open proxy Zenmate exit nodes on port 443. Regards—UY Scuti ^Talk 14:04, 24 August 2016 (UTC)

31.192.111.201 & 31.192.111.234

– This proxy check request is closed and will soon be archived by a bot.

31.192.111.201 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

31.192.111.234 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: IP traffic through Zenmate VPN service. These IP's are within the same network with the following IP range: 31.192.111.0/24 (talk · contribs · WHOIS). Please see this link. 31.192.111.201 (talk) 21:45, 17 August 2016 (UTC)

IP is an open proxy Zenmate exit nodes on port 443 (both IPs). Regards—UY Scuti ^Talk 14:28, 24 August 2016 (UTC)

103.43.75.100

– This proxy check request is closed and will soon be archived by a bot.

103.43.75.100 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: IP traffic through Zenmate VPN service. The IP is within the same network with the following IP range: 103.43.72.0/22 (talk · contribs · WHOIS). Please see this link. 103.43.75.100 (talk) 22:08, 17 August 2016 (UTC)

 Likely IP is an open proxy port 443 was closed when I checked, but all other patterns indicate this is likely an exit node of Zenmate. Regards—UY Scuti ^Talk 14:35, 24 August 2016 (UTC)

185.9.19.66 & 185.9.19.67

– This proxy check request is closed and will soon be archived by a bot.

185.9.19.66 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

185.9.19.67 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Both IP's contain traffic through Zenmate VPN service, though these two IP's seem to be the only ones that are programmed within the server itself (no IP range detected here)... 185.9.19.66 (talk) 22:18, 17 August 2016 (UTC)

IP is an open proxy Zenmate exit nodes on port 443 (both the IPs). Regards—UY Scuti ^Talk 13:55, 24 August 2016 (UTC)

69.217.73.52

– This proxy check request is closed and will soon be archived by a bot.

69.217.73.52 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open proxy. Suspicious edits. Has been blocked in the past. 73.96.115.45 (talk) 05:06, 23 August 2016 (UTC)

 Declined to run a check No recent edits from the IP. Regards—UY Scuti ^Talk 13:21, 24 August 2016 (UTC)

89.100.41.32

– This proxy check request is closed and will soon be archived by a bot.

89.100.41.32 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open proxy on port 9987. Suspicious edits. 73.96.115.45 (talk) 05:06, 23 August 2016 (UTC)

 Declined to run a check No recent edits from the IP. I quote from my earlier statement, reporting IPs with no suspicious editing patterns makes things slow and is overwhelming to proxy checkers. It is quite hard to clear the current high backlog. There are a LOT of open proxies that haven't edited Wikipedia. It is also counter productive, should we choose to check and block them all individually. To ease things a bit, I'd suggest you to henceforth report IPs that only have suspicious editing patterns. Please also consider not reporting IP ranges unless you see a pattern of editing. Regards—UY Scuti ^Talk 13:19, 24 August 2016 (UTC)

92.63.100.80

– This proxy check request is closed and will soon be archived by a bot.

92.63.100.80 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Don't know much about open proxy's saw this when I noticed that a user was evading a block. This says it is a confirmed proxy server. -- GB fan 20:13, 23 August 2016 (UTC)

 Possible IP is an open proxy Although I wasn't able to connect, I'm pretty sure this warrants for a {{webhostblock}}. Regards—UY Scuti ^Talk 13:15, 24 August 2016 (UTC)

195.88.208.155

– This proxy check request is closed and will soon be archived by a bot.

195.88.208.155 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open proxy; VERY active and being used to evade block(s). Web proxy is from this service. A VERY long block duration is needed here. Regards. 208.54.5.133 (talk) 18:49, 26 August 2016 (UTC)

Open proxy blocked —UY Scuti ^Talk 20:37, 26 August 2016 (UTC)

2604:1380:1000:6E00:0:0:0:1

A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: http://whatismyipaddress.com/ip/2604:1380:1000:6e00::1 shows "Confirmed Proxy Server" Ronhjones  ^(Talk) 22:40, 30 August 2016 (UTC)

88.202.190.200

– This proxy check request is closed and will soon be archived by a bot.

88.202.190.200 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Open proxy at port 8080. --Antigng (talk) 10:11, 1 September 2016 (UTC)

 Possible IP is an open proxy on port 8080 (requiring authentication) . Regards—UY Scuti ^Talk 19:01, 7 September 2016 (UTC)

112.133.236.183

– This proxy check request is closed and will soon be archived by a bot.

112.133.236.183 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, is blacklisted by a number of open proxy detection/spammer detection services such as Barracuda Networks. Brianhe (talk) 04:59, 2 September 2016 (UTC)

Not currently an open proxy no open ports, all clear. Regards—UY Scuti ^Talk 19:08, 7 September 2016 (UTC)

37.48.86.212

– This proxy check request is closed and will soon be archived by a bot.

37.48.86.212 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open on port 80, currently editing from the proxy just for reporting here, please see this link. 37.48.86.212 (talk) 01:50, 9 September 2016 (UTC)

Open proxy blocked —UY Scuti ^Talk 18:43, 9 September 2016 (UTC)

108.162.245.78

– This proxy check request is closed and will soon be archived by a bot.

108.162.245.78 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Registered to CloudFlare, Inc. Web-hosting services. Open proxy. 37.48.86.212 (talk) 01:50, 9 September 2016 (UTC)

 Declined to run a check No recent suspicious edits —UY Scuti ^Talk 18:45, 9 September 2016 (UTC)

200.72.240.130

– This proxy check request is closed and will soon be archived by a bot.

200.72.240.130 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: ProcseeBot (talk · contribs) has previously blocked this IP twice; still open on port 8080. 37.48.86.212 (talk) 02:12, 9 September 2016 (UTC)

 Declined to run a check No recent suspicious edits —UY Scuti ^Talk 18:46, 9 September 2016 (UTC)

103.234.26.106

– This proxy check request is closed and will soon be archived by a bot.

103.234.26.106 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: ProcseeBot (talk · contribs) has previously blocked this IP; still open on port 1080. 37.48.86.212 (talk) 04:06, 9 September 2016 (UTC)

 Declined to run a check No recent suspicious edits —UY Scuti ^Talk 18:46, 9 September 2016 (UTC)

2001:1608:10:135::e3d8:f0a8 (Range: 2001:1608::/32)

– This proxy check request is closed and will soon be archived by a bot.

2001:1608:10:135::e3d8:f0a8 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · geo · rangeblocks · spur · shodan

Reason: Open proxy, currently using to report the proxy, this link confirms the IPV6 /32 range. 2001:1608:10:135:0:0:E3D8:F0A8 (talk) 23:14, 12 September 2016 (UTC)

91.108.68.215 (Range: 91.108.64.0/19)

– This proxy check request is closed and will soon be archived by a bot.

91.108.68.215 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: IPV4 traffic of the IPV6 report made above. this link confirms the IPV4 /19 range. 2001:1608:10:135:0:0:E3D8:F0A8 (talk) 23:14, 12 September 2016 (UTC)

108.161.136.29

– This proxy check request is closed and will soon be archived by a bot.

108.161.136.29 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open proxy through 0xproxy. 108.161.136.29 (talk) 23:58, 12 September 2016 (UTC)

Blocked. Materialscientist (talk) 10:40, 16 September 2016 (UTC)

195.154.126.106

– This proxy check request is closed and will soon be archived by a bot.

195.154.126.106 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open proxy through europroxy.pw and 8proxy.space. 172.58.40.148 (talk) 00:40, 13 September 2016 (UTC)

• Blocked. Materialscientist (talk) 10:38, 16 September 2016 (UTC)

103.11.78.21

– This proxy check request is closed and will soon be archived by a bot.

103.11.78.21 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Open proxy server at this web proxy hosting site. Mobile web-browser hosting. 2607:FB90:A62C:37CC:0:20:D6D8:B101 (talk) 02:37, 15 September 2016 (UTC)

188.61.207.58

– This proxy check request is closed and will soon be archived by a bot.

188.61.207.58 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 1024. 172.56.38.131 (talk) 04:12, 16 September 2016 (UTC)

92.98.150.82

– This proxy check request is closed and will soon be archived by a bot.

92.98.150.82 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 1024. 172.56.38.53 (talk) 04:18, 16 September 2016 (UTC)

2.136.129.12

– This proxy check request is closed and will soon be archived by a bot.

2.136.129.12 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. 172.56.38.53 (talk) 04:18, 16 September 2016 (UTC)

Not currently an open proxy no open ports, nothing suspicious. Regards—UY Scuti ^Talk 16:00, 15 October 2016 (UTC)

24.141.6.209

– This proxy check request is closed and will soon be archived by a bot.

24.141.6.209 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Lord Sjones23 (talk - contributions) 05:14, 16 September 2016 (UTC)

Not currently an open proxy Closed ports, I don't smell open proxy here. Regards—UY Scuti ^Talk 15:45, 15 October 2016 (UTC)

2.216.30.87

– This proxy check request is closed and will soon be archived by a bot.

2.216.30.87 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. 73.96.115.3 (talk) 00:02, 17 September 2016 (UTC)

Not currently an open proxy everything looks clear. Regards—UY Scuti ^Talk 15:36, 15 October 2016 (UTC)

196.40.43.74

– This proxy check request is closed and will soon be archived by a bot.

196.40.43.74 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

UNBLOCK: IP is no longer an open proxy, in fact, I don't even think it ever was an open proxy based on it's WHOIS credentials... 73.96.114.205 (talk) 23:01, 24 September 2016 (UTC)

Although it's closed now, I'm not convinced (Have a look at this list). However, the indef on this IP needs to be modified to something temporary. Regards—UY Scuti ^Talk 08:04, 25 September 2016 (UTC)

The IP address certainly has been in use as an open proxy, over a period extending from many years ago to this month. I don't know how anyone can possibly reach the conclusion that an IP address is unlikely ever to have hosted an open proxy "based on it's [sic] WHOIS credentials". As for replacing the indefinite block with a limited one, the reason for IP addresses not usually being blocked indefinitely is that their use may change, but considering the fact that this one's use has not changed in well over a decade, and that it is known to have hosted an open proxy at intervals covering the whole of that period, the likelihood that it's going to change within some arbitrary number of years that we choose is much lower than the likelihood that if the block ends it will still be hosting an open proxy. The editor who uses the pseudonym "JamesBWatson" (talk) 11:10, 26 September 2016 (UTC)

Fair enough. I've closed the request as unblocking is not possible at this time. Regards—UY Scuti ^Talk 16:23, 28 September 2016 (UTC)

199.212.86.0/23

– This proxy check request is closed and will soon be archived by a bot.

199.212.86.0/23 · contribs · block · log · stalk · Robtex · whois · Google

Range appears to be used by HexaTech VPN. Please investigate this claim! Thank you. 199.212.86.23 (talk) 22:26, 3 October 2016 (UTC) Reason: Suspicious edits

Why do you think so? Any suspicious edits, particular IPs? I see a lot of legitimate edits. Regards—UY Scuti ^Talk 15:27, 15 October 2016 (UTC)

Pinging Gilliam, as they have blocked the individual IP (199.212.86.23) for two years. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 18:38, 22 October 2016 (UTC)

I will unblock and let the investigation run its course.– Gilliam (talk) 20:39, 22 October 2016 (UTC)

Note: Suspicious IP's include: 199.212.86.109 (talk · contribs · WHOIS) & 199.212.86.23 (talk · contribs · WHOIS). 2601:1C0:4401:F360:4057:B87:4A96:758B (talk) 01:23, 26 October 2016 (UTC)

Individual IPs can be blocked as necessary. The range also has a lot of legitimate edits and I'm not seeing the need to implement a block at this range despite the range being allocated to a webhost provider. Regards—UY Scuti ^Talk 17:47, 29 October 2016 (UTC)

81.30.116.103

– This proxy check request is closed and will soon be archived by a bot.

81.30.116.103 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Confirmed open proxy. Please see this link. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 02:20, 19 October 2016 (UTC)

 Declined to run a check no recent suspicious edits. Before submitting, please see if the criteria for block requests has been met (The IP has made abusive contributions within the past week). Regards—UY Scuti ^Talk 06:08, 23 October 2016 (UTC)

118.192.145.99

– This proxy check request is closed and will soon be archived by a bot.

118.192.145.99 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Confirmed open proxy. Please see this link. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 02:20, 19 October 2016 (UTC)

 Declined to run a check no recent suspicious edits. Before submitting, please see if the criteria for block requests has been met (The IP has made abusive contributions within the past week). Regards—UY Scuti ^Talk 14:18, 23 October 2016 (UTC)

218.248.73.193

– This proxy check request is closed and will soon be archived by a bot.

218.248.73.193 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Confirmed open proxy. Please see this link. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 02:20, 19 October 2016 (UTC)

 Declined to run a check no recent suspicious edits. Before submitting, please see if the criteria for block requests has been met (The IP has made abusive contributions within the past week). Regards—UY Scuti ^Talk 14:20, 23 October 2016 (UTC)

204.52.135.204 (Range: 204.52.135.0/24)

– This proxy check request is closed and will soon be archived by a bot.

204.52.135.204 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Registered to SurfEasy Inc. I put the range here just in case if the patrolling admin decides to implement the rangeblock, per the WHOIS credentials. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 18:31, 22 October 2016 (UTC)

 Likely IP is an open proxy belongs to SurfEasy VPN. Please block the range 204.52.135.0/24 (block range · block log (global) · WHOIS (partial)) as {{blockedproxy}}. Regards—UY Scuti ^Talk 14:43, 23 October 2016 (UTC)

85.195.76.173 (Range: 85.195.64.0/18)

– This proxy check request is closed and will soon be archived by a bot.

85.195.76.173 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Registered to SurfEasy Inc. I put the range here just in case if the patrolling admin decides to implement the rangeblock, per the WHOIS credentials. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 18:31, 22 October 2016 (UTC)

Open proxy blocked —UY Scuti ^Talk 17:49, 29 October 2016 (UTC)

162.253.131.187 (Range: 162.253.128.0/22)

– This proxy check request is closed and will soon be archived by a bot.

162.253.131.187 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. The IP range listed above has already been blocked once for two years, by administrator Elockid. I put the range here just in case if the patrolling admin decides to implement the rangeblock, per the WHOIS credentials. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 18:31, 22 October 2016 (UTC)

 Possible IP is an open proxy Please block the IP as {{webhostblock}}. Regards—UY Scuti ^Talk 18:05, 29 October 2016 (UTC)

195.154.0.0/16

– This proxy check request is closed and will soon be archived by a bot.

195.154.0.0/16 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Open proxy IP range, highly used, previous 2 year block by Elockid has now expired. 2601:1C0:4401:F360:E136:8F9E:9ACF:27BB (talk) 23:23, 22 October 2016 (UTC)

 Completed Please block the range as a {{webhostblock}}—UY Scuti ^Talk 18:22, 29 October 2016 (UTC)

62.232.195.130 (Range: 62.232.195.0/24)

– This proxy check request is closed and will soon be archived by a bot.

62.232.195.130 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Registered to Donhost webhosting services. I put the range here just in case if the patrolling admin decides to implement the rangeblock, per the WHOIS credentials. 2601:1C0:4401:F360:4057:B87:4A96:758B (talk) 23:00, 23 October 2016 (UTC)

 Possible IP is an open proxy please block the IP as {{webhostblock}}. Regards —UY Scuti ^Talk 20:02, 29 October 2016 (UTC)

49.213.19.85 (Range: 49.213.16.0/21)

– This proxy check request is closed and will soon be archived by a bot.

49.213.19.85 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Registered to OneAsiaHost webhosting services. I put the range here just in case if the patrolling admin decides to implement the rangeblock, per the WHOIS credentials. 2601:1C0:4401:F360:4057:B87:4A96:758B (talk) 00:56, 27 October 2016 (UTC)

 Possible IP is an open proxy please block the IP as {{webhostblock}}. Regards —UY Scuti ^Talk 20:34, 29 October 2016 (UTC)

5.104.175.107 (Range: 5.104.175.0/24)

– This proxy check request is closed and will soon be archived by a bot.

5.104.175.107 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Registered to BelCloud Hosting Cooperation webhosting services. I put the range here just in case if the patrolling admin decides to implement the rangeblock, per the WHOIS credentials. 2601:1C0:4401:F360:4057:B87:4A96:758B (talk) 03:49, 28 October 2016 (UTC)

Open proxy blocked CGI proxy —UY Scuti ^Talk 20:13, 29 October 2016 (UTC)

2604:3400:dc1:43:216:3eff:fe6b:497f

– This proxy check request is closed and will soon be archived by a bot.

2604:3400:dc1:43:216:3eff:fe6b:497f · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Likely a sock of a recently blocked or topic banned user.- MrX 04:24, 7 November 2016 (UTC)

(Non-administrator comment) Blocked by DoRD. 2601:1C0:105:5C39:CD59:D092:A125:48F6 (talk) 01:13, 7 December 2016 (UTC)

104.254.215.90

– This proxy check request is closed and will soon be archived by a bot.

104.254.215.90 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Registered to Power Up Hosting, Inc. Yinf (talk) 22:55, 12 November 2016 (UTC)

(Non-administrator comment) Blocked by Materialscientist. 2601:1C0:2:3207:F9C4:CC2A:EB:3760 (talk) 00:26, 16 November 2016 (UTC)

45.115.25.68

– This proxy check request is closed and will soon be archived by a bot.

45.115.25.68 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits (spamming Binary options) & WHOIS shows this is a Korean cloud hosting service known as SoftLayer. - Brianhe (talk) 00:41, 15 November 2016 (UTC)

I scanned that one earlier when I saw the spam at binary options (and the pattern of the last few IPs adding that link). No proxies, open ports or recent logs of abuse in the usual places. Something up there; I just can't see it. Kuru (talk) 02:26, 15 November 2016 (UTC)

(Non-administrator comment) This is a webhost cloud server (not necessarily a single open proxy IP, which is still grounds for a block per WP:NOP. Should probably be blocked. 2601:1C0:102:E3E:A86E:8F4:1AB6:CDC (talk) 04:01, 30 November 2016 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:26, 19 October 2017 (UTC)

185.24.68.67 (Range: 185.24.68.0/22)

– This proxy check request is closed and will soon be archived by a bot.

185.24.68.67 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Registered to SurfEasy VPN, which is a webhost service. I put the range here just in case if the patrolling admin decides to implement the rangeblock, per the WHOIS credentials. 2601:1C0:2:3207:F9C4:CC2A:EB:3760 (talk) 00:26, 16 November 2016 (UTC)

Open proxy blocked -- zzuuzz ^(talk) 21:40, 19 November 2016 (UTC)

89.46.102.15

– This proxy check request is closed and will soon be archived by a bot.

89.46.102.15 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: sockpuppetry. Please see Wikipedia:Sockpuppet investigations/Internetwikier. Ivanvector (^Talk/_Edits) 21:28, 19 November 2016 (UTC)

 Likely IP is an open proxy. It's certainly a web server. I've colo-blocked the /24. -- zzuuzz ^(talk) 21:32, 19 November 2016 (UTC)

212.7.221.180 (Range: 212.7.221.0/24)

– This proxy check request is closed and will soon be archived by a bot.

212.7.221.180 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Appears to be registered to this dedicated server. The IP range appears to be 212.7.221.0/24 (block range · block log (global) · WHOIS (partial)). 2601:1C0:109:2557:11F8:BEF8:160B:24CC (talk) 06:12, 25 November 2016 (UTC)

Self-closing, the /24 range is already blocked by DeltaQuad. 71.237.141.40 (talk) 06:16, 25 November 2016 (UTC)

IP 14.139.183.220

– This proxy check request is closed and will soon be archived by a bot.

14.139.183.220 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: whatismyipaddress.com notes that it is a confirmed proxy server, while I know their word isn't gospel, and this doesn't mean that it's an open proxy, I'm curious if it is. An IP-hopping user from India appears to be using it to perpetuate an edit war, as can be seen here throughout November 2016. Thanks, Cyphoidbomb (talk) 00:56, 27 November 2016 (UTC)

 Unlikely IP is an open proxy There are a few open ports, but it's unlikely requests are redirected. The range 14.139.183.208/28 is allocated to C-DAC Thiruvananthapuram, a scientific society of the government of India. I also checked the other IPs that have edited the article in November. All of them belong to the range 111.92.0.0/17, allocated to the ISP Asianet Communications from the same geolocation and probably dynamic. Regards—UY Scuti ^Talk 07:59, 27 November 2016 (UTC)

@UY Scuti: Thanks for looking into it. Cyphoidbomb (talk) 22:07, 29 November 2016 (UTC)

199.212.87.98 (Range: 199.212.86.0/23)

– This proxy check request is closed and will soon be archived by a bot.

199.212.87.98 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Registered to Power Up Hosting. Included the range, too. 2607:FB90:A51A:3F75:0:48:261E:FB01 (talk) 17:18, 29 November 2016 (UTC)

(Non-administrator comment) Globally blocked. 2601:1C0:10D:8D92:CD59:D092:A125:48F6 (talk) 01:10, 7 December 2016 (UTC)

168.244.11.44

– This proxy check request is closed and will soon be archived by a bot.

168.244.11.44 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: clear sockpuppetry by a user who nearly always geolocates to Toronto, Canada. This IP belongs to Lowe's and geolocates to North Carolina. Ivanvector (^Talk/_Edits) 17:58, 30 November 2016 (UTC)

(Non-administrator comment) @Ivanvector: Lowe's (see article for more detail) is a retail and appliance store. Not a proxy or web hosting service. 2607:FB90:A757:51B9:0:4B:4B30:8901 (talk) 19:13, 30 November 2016 (UTC)

Okay, maybe I'm in the wrong place. I know Lowe's is a hardware store (they're in Canada too) but I think it's unlikely that a user who's been in Toronto for 9 months would be suddenly on a store's computer system in North Carolina, so it feels like a spoofed IP or hacked VPN or some such. It's quite likely I just don't know what I'm talking about. Ivanvector (^Talk/_Edits) 19:32, 30 November 2016 (UTC)

No, probably the right place.. Looking at the SPI it would just as unusual for them to use an open proxy as it would be for them to edit from the US. I also notice the IP geolocates to the same place as Lowe's headquarters, so the stores might funnel all store traffic through there, or the geolocation sites might not know where else to place it. Suspicious previous edits. However I'm not seeing anything immediately suggestive of an open proxy. -- zzuuzz ^(talk) 19:49, 30 November 2016 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 10:27, 19 October 2017 (UTC)

116.228.82.194

– This proxy check request is closed and will soon be archived by a bot.

116.228.82.194 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Many disruptive edits from "CHINANET" IP addresses, ProceeBot often blocks IP's from this ISP. Well for example, 115.203.95.239 (talk · contribs · WHOIS) which was just blocked minutes ago... Open on ports 22 and 443. 2601:1C0:102:B7:1511:5911:F6C6:FF50 (talk) 06:48, 3 December 2016 (UTC)

Open proxy blocked Jezebel's Ponyo^{bons mots} 23:42, 6 December 2016 (UTC)

202.69.12.0/24

A user has requested a proxy check. A proxy checker will shortly look into the case.

202.69.12.0/24 · contribs · block · log · stalk · Robtex · whois · Google

Reason:unblock request. this ip is range is blocked from long time and now must unblock. — Preceding unsigned comment added by John CS (talk • contribs)

This is a checkuser block and not a proxy block, so deferred to the blocking admin KrakatoaKatie to take a real close look at this request. -- zzuuzz ^(talk) 11:04, 6 December 2016 (UTC)

@Zzuuzz and John CS: It is not an open proxy. Rather, we have at least three prolific sockmasters operating from this range. The rangeblock is necessary to stop them from creating the dozens of new accounts they've been using to cause some pretty serious disruption and use of resources. Additionally, it's only been blocked since November 3 of this year, and I wouldn't call that a long time. Katie^talk 11:48, 6 December 2016 (UTC)

Welp, it looks like John CS was just another sock that was abusing this IP range in the first place, now blocked by DoRD. 2601:1C0:10D:8D92:6177:2722:C0EF:15C3 (talk) 01:08, 7 December 2016 (UTC)

210.211.122.214

– This proxy check request is closed and will soon be archived by a bot.

210.211.122.214 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Geolocate data says this ip is in Ho Chi Min City and is a suspected network sharing device. Beeblebrox (talk) 23:32, 6 December 2016 (UTC) Reason: Suspicious edits

• Open proxy blocked. Torguard outlet node on port 993; cheap anonymous proxy service. Kuru (talk) 23:38, 6 December 2016 (UTC)

198.135.124.219 (Range: 198.135.124.0/23)

– This proxy check request is closed and will soon be archived by a bot.

198.135.124.219 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Registered to "Blue Coat Systems, Inc". Webhost service. 2601:1C0:10D:8D92:6177:2722:C0EF:15C3 (talk) 01:06, 7 December 2016 (UTC)

Not currently an open proxy providing cloud security. Might provide access to some of its clients, but not an open proxy, no open ports. Regards—UY Scuti ^Talk 03:47, 7 December 2016 (UTC)

77.234.40.145 (Range: 77.234.40.0/24)

– This proxy check request is closed and will soon be archived by a bot.

77.234.40.145 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Check the edit filter log entries for this IP for their most recent edits. Webhosting cloud service "Avast". 73.96.115.2 (talk) 01:54, 7 December 2016 (UTC)

Not currently an open proxy Ditto, but Avast in this case. No open ports/proxy. Regards—UY Scuti ^Talk 03:57, 7 December 2016 (UTC)

199.85.208.19 (Range: 199.85.208.0/21)

– This proxy check request is closed and will soon be archived by a bot.

199.85.208.19 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Registered to MegaProxy.com. Highly visible proxy server. The /21 range specified above has been previously blocked before. 2601:1C0:10D:5E68:107A:41A1:58F4:7F73 (talk) 05:40, 8 December 2016 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:32, 19 October 2017 (UTC)

168.132.10.250

– This proxy check request is closed and will soon be archived by a bot.

168.132.10.250 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits - MrX 16:41, 8 December 2016 (UTC)

 Unlikely IP is an open proxy Looks like a closed proxy used by Air Services Australia. Callanecc (talk • contribs • logs) 10:33, 19 October 2017 (UTC)

137.74.1.203

– This proxy check request is closed and will soon be archived by a bot.

137.74.1.203 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious rDNS: service.brought.to.you.by.uk7.org – 🐈? (talk) 20:28, 8 December 2016 (UTC)

Open proxy blocked -- zzuuzz ^(talk) 20:33, 8 December 2016 (UTC)

219.159.82.26

{{proxycheckstatus}close}}

219.159.82.26 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Another "CHINANET" open proxy, see report for 116.228.82.194 above, which was blocked by Ponyo. 2601:1C0:104:51C4:915F:9EAD:1324:BC92 (talk) 23:41, 8 December 2016 (UTC)

 Unlikely IP is an open proxy Callanecc (talk • contribs • logs) 10:34, 19 October 2017 (UTC)

82.211.251.51

– This proxy check request is closed and will soon be archived by a bot.

82.211.251.51 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious, disruptive edits. Possibly related to this banned sockpuppet. Cathexis1349 (talk) 09:30, 9 December 2016 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 10:35, 19 October 2017 (UTC)

80.153.74.209

– This proxy check request is closed and will soon be archived by a bot.

80.153.74.209 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious, disruptive edits. Possibly related to this banned sockpuppet.Cathexis1349 (talk) 09:30, 9 December 2016 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 10:35, 19 October 2017 (UTC)

87.244.181.185

– This proxy check request is closed and will soon be archived by a bot.

87.244.181.185 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Highly visible proxy server. Open on port 8080. 87.244.181.185 (talk) 01:03, 12 December 2016 (UTC)

Open proxy blocked -- samtar ^{talk or stalk} 14:44, 12 December 2016 (UTC)

202.106.16.36

– This proxy check request is closed and will soon be archived by a bot.

202.106.16.36 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Highly visible proxy server. Open on port 3128. 202.106.16.36 (talk) 01:09, 12 December 2016 (UTC)

Open proxy blocked -- zzuuzz ^(talk) 18:04, 12 December 2016 (UTC)

122.248.121.184

– This proxy check request is closed and will soon be archived by a bot.

122.248.121.184 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Reason: Highly visible proxy server. Open on port 8080. 122.248.121.184 (talk) 04:50, 13 December 2016 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:38, 19 October 2017 (UTC)

110.77.215.181

– This proxy check request is closed and will soon be archived by a bot.

110.77.215.181 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan Reason: Highly visible proxy server. Open on port 8080. Note: The proxy/port to access this IP is 122.154.71.49:8080 but 110.77.215.181 is the external IP node, which is the one that should be blocked. 110.77.215.181 (talk) 05:03, 13 December 2016 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:38, 19 October 2017 (UTC)

104.238.64.0/18

– This proxy check request is closed and will soon be archived by a bot.

104.238.64.0/18 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Suspicious edits. Registered to GoDaddy. Often used by the LTA sandbox vandal. 2601:1C0:104:9A47:2C4F:1095:CDC4:24CD (talk) 23:52, 15 December 2016 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:38, 19 October 2017 (UTC)

178.18.201.95 and 178.18.201.96/27

– This proxy check request is closed and will soon be archived by a bot.

178.18.201.95 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

178.18.201.96/27 (block range · block log (global) · WHOIS (partial))

Reason: I want you to take note of that whois. "Avast Software Servers". Now, we can note that some of these IPs seem to all have odd, vandal behavior. However, Avast, an antivirus company, seems like an odd AS for that behavior. After doing some research, I quickly found out Avast hosts a VPN! And guess what: one of the locations they list is Istanbul, which is of course, in Turkey. I didn't go looking for the other ranges they might have because I didn't know if things like this would get blocked, but I thought I might as well try. – 🐈? (talk) ^{(ping me!)} 02:33, 18 December 2016 (UTC)

Note: I recently made a request that was also registered to "Avast", [see report for 77.234.40.145 (Range: 77.234.40.0/24)], and it was declined by UY Scuti. I guess "cloud security" services don't necessarily mean webhosts and/or VPN's. 2601:1C0:103:C62:648B:E102:9265:E802 (talk) 04:27, 20 December 2016 (UTC)

 Unlikely IP is an open proxy Callanecc (talk • contribs • logs) 10:38, 19 October 2017 (UTC)

192.168.100.1

– This proxy check request is closed and will soon be archived by a bot.

192.168.100.1 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock.

 Declined to run a check. This is a private IP address. Please list the public IP address if you want it looked at. -- zzuuzz ^(talk) 14:30, 18 December 2016 (UTC)

(Non-administrator comment) @Zzuuzz: The IP that they used to make this report was 59.166.63.209 (talk · contribs · WHOIS). Maybe that was what they wanted to be looked at? 73.96.113.71 (talk) 04:22, 20 December 2016 (UTC)

142.234.73.104

– This proxy check request is closed and will soon be archived by a bot.

142.234.73.104 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Registered here. 2601:1C0:10C:CF1C:9CB2:BA23:5AA4:2F1F (talk) 04:20, 20 December 2016 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:45, 19 October 2017 (UTC)

103.52.134.18

– This proxy check request is closed and will soon be archived by a bot.

103.52.134.18 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Although whatismyipaddress.com isn't as accurate, but it is claimed to be a confirmed proxy server, if not that it is a shared IP of some sort... 2601:1C0:10D:7EEA:C01A:87C:FE3B:8846 (talk) 06:32, 20 December 2016 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:45, 19 October 2017 (UTC)

173.227.74.5

– This proxy check request is closed and will soon be archived by a bot.

173.227.74.5 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Registered to HostGator. 2601:1C0:105:DE17:6973:298F:C092:ED0B (talk) 16:19, 20 December 2016 (UTC)

 Declined to run a check Not enough recent edits to worry about it this time. Callanecc (talk • contribs • logs) 10:47, 19 October 2017 (UTC)

80.72.94.177

– This proxy check request is closed and will soon be archived by a bot.

80.72.94.177 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. 176.54.93.202 (talk) 19:32, 27 December 2016 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 10:41, 19 October 2017 (UTC)

59.46.158.164

– This proxy check request is closed and will soon be archived by a bot.

59.46.158.164 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. "CHINANET" proxy. 2601:1C0:106:17FE:D5AF:4387:5D5F:D086 (talk) 03:54, 29 December 2016 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 10:42, 19 October 2017 (UTC)

104.153.108.126 (Range: 104.153.108.0/24)

– This proxy check request is closed and will soon be archived by a bot.

104.153.108.126 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. The entire range listed above is also webhosting service as well. 2601:1C0:10D:BF57:953B:1A26:5126:7B57 (talk) 04:39, 1 January 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:43, 19 October 2017 (UTC)

199.102.97.236 (Range: 199.102.96.0/21)

– This proxy check request is closed and will soon be archived by a bot.

199.102.97.236 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. The entire range is registered to Transvision Reseau webhosting services. 172.56.42.77 (talk) 18:30, 2 January 2017 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 10:48, 19 October 2017 (UTC)

77.51.77.191

– This proxy check request is closed and will soon be archived by a bot.

77.51.77.191 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits on jawp.--HotKorokke (talk) 23:21, 2 January 2017 (UTC)

 Unlikely IP is an open proxy. Sorry, I don't see anything open. Kuru (talk) 00:05, 3 January 2017 (UTC)

5.12.50.68

– This proxy check request is closed and will soon be archived by a bot.

5.12.50.68 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. The proxy is from "Romania" and its contributions reminds a sockmaster banned last year. Please check. 46.221.187.97 (talk) 23:55, 7 January 2017 (UTC)

 Unlikely IP is an open proxy. Sorry, nothing odd. It's not clear which sockmaster you're referring to, so I can't help you follow up. Kuru (talk) 00:54, 20 January 2017 (UTC)

209.87.206.17

– This proxy check request is closed and will soon be archived by a bot.

209.87.206.17 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Webhost/cloud server. Lots of long-term issues with this IP address, many warnings on their talkpage. 2601:1C0:102:B2A0:6B:B5FF:C620:7D13 (talk) 23:23, 10 January 2017 (UTC)

 Unlikely IP is an open proxy. Nothing fishy. As you note, the ISP bills as a webhost, but they also provide other services. One other administer notes it may be a school on a leased line. Kuru (talk) 00:47, 20 January 2017 (UTC)

64.94.31.206

– This proxy check request is closed and will soon be archived by a bot.

64.94.31.206 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, Geolocate says "Confirmed proxy server". Beyond My Ken (talk) 15:18, 18 January 2017 (UTC)

 Unlikely IP is an open proxy. Just one open port that looks like it is allowing only specific clients to connect. The "proxy" annotation on the geolocate summary is just noting that it acts as a connection point for other clients. In this case, the most likely function is what is shown on the talk page - it's an exit point for a bunch of wi-fi services on trains. Kuru (talk) 12:37, 19 January 2017 (UTC)

159.180.16.2

– This proxy check request is closed and will soon be archived by a bot.

159.180.16.2 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

123.30.130.215 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

191.234.183.150 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: A variety of near death threats and abusive behavior at Talk:Chelsea Manning, e.g., [[2]], started at 130.211.161.255, hopped after block to 159.180.16.2 (which geolocate says is a confirmed proxy), after block complained with dubious innocence on my talk page from 123.30.130.215, which is also marked as a confirmed proxy by geolocate. Request open proxy checks on the latter two addresses. Note the diff I gave has been revdel'd and may end up oversighted. --joe decker^talk 06:05, 19 January 2017 (UTC)

You might also want to look at 191.234.183.150. This ties into the above thread through my talk page (edited by .215) and the edits by .150 at Rosalind Franklin, and the timing, of course. --joe decker^talk 06:31, 19 January 2017 (UTC)

Open proxy blocked. All of these are confirmed and blocked. Kuru (talk) 12:24, 19 January 2017 (UTC)

115.249.229.41

– This proxy check request is closed and will soon be archived by a bot.

115.249.229.41 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Harassment related to previous request. Geolocate calls it a confirmed proxy. (I've done a short term block there, but if this is an open proxy you'll want to lengthen it.) --joe decker^talk 15:18, 19 January 2017 (UTC)

IP is an open proxy. Si, wide open squid proxy on 3128. Extended the block. Kuru (talk) 00:39, 20 January 2017 (UTC)

49.213.19.133

– This proxy check request is closed and will soon be archived by a bot.

49.213.19.133 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits

This IP address is currently used by SurfEasy, you guys might want to block it due to it being an open VPN. --49.213.19.133 (talk) 22:55, 23 January 2017 (UTC)

See http://oneasiahost.com. See the Whois. It appears to me that there should be a webhost block of 49.213.16.0/22 (block range · block log (global) · WHOIS (partial)), intended to cover 49.213.16.0 - 49.213.19.255. EdJohnston (talk) 03:34, 24 January 2017 (UTC)

Note: Report copied here from WP:ANI. I am planning to do the /22 as a webhost block unless someone here can advise me that it's not appropriate. This Robtex shows that there are a lot of websites hosted in the range. Is it possible that something wider than the /22 could be appropriate? Thanks, EdJohnston (talk) 04:11, 24 January 2017 (UTC)

 Done SQL^{Query me!} 04:15, 24 January 2017 (UTC)

I can't test the entire range, but that one is certainly Opera Proxy, presumably SurfEasy - the service makes no attempt to obscure its ID. Kuru (talk) 00:38, 25 January 2017 (UTC)

162.211.122.69

– This proxy check request is closed and will soon be archived by a bot.

162.211.122.69 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: I'm on SurfEasy VPN right now and I'm unblocked. --162.211.122.69 (talk) 21:44, 24 January 2017 (UTC)

Found another one right after. --185.80.220.40 (talk) 21:45, 24 January 2017 (UTC)

Confirmed both, Mr. Scientist beat me to the blocks. Kuru (talk) 00:50, 25 January 2017 (UTC)

146.0.229.30

– This proxy check request is closed and will soon be archived by a bot.

146.0.229.30 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: I'm on a SurfEasy VPN right now and unblocked. 146.0.229.30 (talk) 15:27, 26 January 2017 (UTC)

Personally confirmed and blocked -- Samtar ^{talk · contribs} 16:09, 27 January 2017 (UTC)

117.102.10.98

– This proxy check request is closed and will soon be archived by a bot.

117.102.10.98 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Someone from that IP address argues that while it might have been an open proxy back in December, it no longer is. My own rather primitive attempts at verification have yielded mixed results. Someone more experienced than me, possibly Ponyo, may want to take another look. Huon (talk) 14:43, 27 January 2017 (UTC)

Seeing elements suggesting this is still an open proxy or webhost

• Ports 22 (SSH), 8080 (HTTP), 10000 open
• SSH reports version `OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.6 (Ubuntu Linux; protocol 2.0)`
• HTTP reports `Squid http proxy 3.3.8`
• 10000 reports `MiniServ 1.810 (Webmin httpd)` (AKA http://www.webmin.com/)

-- Samtar ^{talk · contribs} 16:05, 27 January 2017 (UTC)

My results are the same as Samtar's, showing open ports on 22 and 8080.--Jezebel's Ponyo^{bons mots} 17:02, 27 January 2017 (UTC)

Samtar and Ponyo, sorry, but open ports does not mean open proxy. I was not able to connect to any of the open ports. Besides, the allocation does not belong to a webhosting company. Wikipedia:WikiProject on open proxies/Guide to checking open proxies#Duck test says, "..A common mistake is to block a legitimate closed caching proxy as an open proxy, simply because it has ports open." Regards—UY Scuti ^Talk 17:50, 27 January 2017 (UTC)

In addition to the ports being open, the IP was being used for vandalism and socking, which is how it came to my attention in the first place (via Checkuser). I've tentatively unblocked for now.--Jezebel's Ponyo^{bons mots} 18:03, 27 January 2017 (UTC)

Ugh. I ran a few scans earlier, but had to step away before I could post anything. Generally had the same results as Mr. Scuti. The server is owned by a school - University of Management and Technology, Lahore. The IP does show up on a few range blacklists, but that may be due to the location. There is a squid (usually caching) proxy on an open port (8080). It looks like it is locked now; I can't connect to it (I get a 403 or access denied boilerplate). This does not mean it wasn't open in the past, or that someone wasn't connecting and using it abusively, which Ponyo's checkuser pixie dust seems to confirm. Note that sometimes these proxies only work on a limited set of targets - the squid on 115.249.229.41:3128 (a few reports up) was and is an open squid proxy that lets me edit wikipedia, but denies imdb. Go figure. This is one of those fuzzy ones; maybe spot check it from time to time. Kuru (talk) 18:23, 27 January 2017 (UTC)

Interesting one that. Open proxy allows only SSL requests and blocks non-SSL requests (includes imdb). And the funny part, request a non-SSL website and you get access denied with weird reasons. The URL I requested was categorized as "Japanese pornography", I can assure it was not what I requested—UY Scuti ^Talk 18:48, 27 January 2017 (UTC)

190.10.8.6

– This proxy check request is closed and will soon be archived by a bot.

190.10.8.6 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits Sro23 (talk) 02:53, 3 September 2017 (UTC)

@Sro23: This proxy has been used by multiple sockmasters, including Jaredgk2008 (talk · contribs), PavelStaykov (talk · contribs), and Alexiulian25 (talk · contribs).  Proxy blocked for 2 years. GAB^gab 23:49, 4 September 2017 (UTC)

66.11.122.109, 103.75.116.125, 216.230.226.42

– This proxy check request is closed and will soon be archived by a bot.

66.11.122.109 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

103.75.116.125 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

216.230.226.42 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Adding promotion for Ismael Ogando (see Wikipedia:Sockpuppet investigations/Cocainaenvenenada) on Ezili Dantor ([3], [4], [5]; it's a fake source, added only to get Ogando's name into the article), like many socks before them (see page history of article), a sockpuppeteer whose known geolocation is Berlin, Germany, and who is also known to have used proxies before (a proxy they had used was blocked earlier today...). While these IPs geolocate to other continents, in spite of making one of the sockmaster's signature edits. - Tom | Thomas.W ^talk 23:44, 13 September 2017 (UTC)

All blocked. GAB^gab 23:51, 13 September 2017 (UTC)

216.218.131.143, 191.101.12.120, 51.15.136.216

– This proxy check request is closed and will soon be archived by a bot.

216.218.131.143 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

191.101.12.120 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

51.15.136.216 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: More Cocainaenvenenada/Ismael Ogando (see above), making Cocainaenvenenada's/Ogando's signature edits on their favourite targets but geolocating to somewhere other than where the sockmaster lives. Another IP used by him today (Special:Contributions/193.182.144.88) has already been blocked as a proxy by Zzuuzz. - Tom | Thomas.W ^talk 10:29, 14 September 2017 (UTC)

Reblocked the .143. GAB^gab 18:28, 14 September 2017 (UTC)

103.75.116.120, 217.64.127.113

– This proxy check request is closed and will soon be archived by a bot.

103.75.116.120 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

217.64.127.113 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Two more Cocainaenvenenada. They both posted on my talk page yesterday, in a thread started by Cocainaenvenenada/Ogando, and might be meat, but are most probably Ogando himself using proxies. - Tom | Thomas.W ^talk 19:25, 14 September 2017 (UTC)

Blocked. GAB^gab 19:59, 14 September 2017 (UTC)

185.212.170.103

– This proxy check request is closed and will soon be archived by a bot.

185.212.170.103 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

185.183.105.150 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

185.76.9.97 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

91.109.28.130 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: abusive edits coming from European IPs by a user likely located in California. Ivanvector (^Talk/_Edits) 14:06, 16 September 2017 (UTC)

Extended their block, since they're obvious proxies. GAB^gab 15:16, 16 September 2017 (UTC)

162.212.152.103

– This proxy check request is closed and will soon be archived by a bot.

162.212.152.103 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: IP geolocating to the US but used by obvious sock of Wikipedia:Sockpuppet investigations/Bosnipedian (who geolocates to Sarajevo, Bosnia). - Tom | Thomas.W ^talk 13:11, 17 September 2017 (UTC)

• Blocked 3 months for block evasion, but still worthy of a check. - Tom | Thomas.W ^talk 17:08, 17 September 2017 (UTC)

Open proxy blocked (re-blocked). -- zzuuzz ^(talk) 13:08, 23 September 2017 (UTC)

185.92.24.44

– This proxy check request is closed and will soon be archived by a bot.

185.92.24.44 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: related to the request above for 185.212.170.103, clearly the same user still on a closely related subnet. Ivanvector (^Talk/_Edits) 12:30, 23 September 2017 (UTC)

Open proxy blocked rangeblocked (/24) -- zzuuzz ^(talk) 13:06, 23 September 2017 (UTC)

216.126.225.254

– This proxy check request is closed and will soon be archived by a bot.

216.126.225.254 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Another sock of Wikipedia:Sockpuppet investigations/Cocainaenvenenada. An IP geolocating to California making the sockmasters signature edit on Vusamazulu Credo Mutwa (see page history). Cocainaenvenenada geolocates to Berlin, Germany, but almost a dozen open proxies in other countries were blocked as socks of his not long ago (see a number of previous reports here), so using open proxies is nothing new. - Tom | Thomas.W ^talk 12:52, 23 September 2017 (UTC)

Open proxy blocked by Widr. -- zzuuzz ^(talk) 13:04, 23 September 2017 (UTC)

203.112.76.74

– This proxy check request is closed and will soon be archived by a bot.

203.112.76.74 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: As of 24 Sep 2017, is being used for editwarring and other disruption on several articles. These edits are evidently part of a pattern involving a blocked user using more than one open proxy. IP address itself appears on several lists titled "Free Bangladesh proxy". Guliolopez (talk) 22:24, 24 September 2017 (UTC)

Open proxy blocked by Zzuuzz. GAB^gab 22:40, 25 September 2017 (UTC)

62.12.114.214

– This proxy check request is closed and will soon be archived by a bot.

62.12.114.214 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: The IP has been used by Wikipedia:Sockpuppet investigations/PavelStaykov (the edits about Bulgarians), but has also been used for childish vandalism, which I've never seen from Staykov, the geolocation (Nairobi, Kenya) also matches neither Staykov nor the other edits, making me believe it's an open proxy, one of many in that country it seems. It's currently blocked for three months, but if it is an open proxy it ought to get a longer block. - Tom | Thomas.W ^talk 18:57, 27 September 2017 (UTC)

 Proxy blocked 6 months. GAB^gab 22:38, 27 September 2017 (UTC)

109.185.139.177

– This proxy check request is closed and will soon be archived by a bot.

109.185.139.177 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits.
Reported for edit warring at Sinn Féin at WP:AN3. Previously blocked two months by User:ProcseeBot as an open proxy, port 53281. EdJohnston (talk) 03:15, 5 October 2017 (UTC)

IP is an open proxy: port 62225 confirmed (highly variable). I'll just extend the block a bit. -- zzuuzz ^(talk) 03:22, 5 October 2017 (UTC)

27.131.175.126

– This proxy check request is closed and will soon be archived by a bot.

27.131.175.126 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. IP's host is a clear indicator of a VPN. 172.56.39.241 (talk) 03:20, 1 February 2017 (UTC)

 Possible IP is an open proxy My suspicion is that it's actually a closed VPN/proxy network. Callanecc (talk • contribs • logs) 10:53, 19 October 2017 (UTC)

83.143.27.122

– This proxy check request is closed and will soon be archived by a bot.

83.143.27.122 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. IP's host is a clear indicator of a VPN. 172.56.39.241 (talk) 05:33, 1 February 2017 (UTC)

 Possible IP is an open proxy. My suspicion is that it's actually a closed VPN/proxy network. Callanecc (talk • contribs • logs) 10:54, 19 October 2017 (UTC)

210.212.148.38

– This proxy check request is closed and will soon be archived by a bot.

210.212.148.38 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Spotted vandalism here, looked them up here and saw the hostname indicates a proxy of some kind. Thanks. Cyphoidbomb (talk) 19:11, 2 February 2017 (UTC)

There is an open squid cache proxy on 3128, but it looks secured (password challenged). This looks like a college proxy for Indian Institute of Information Technology, Design and Manufacturing, Jabalpur; it's a proxy for school traffic. I'd just "schoolblock" it if problems persist. Kuru (talk) 03:56, 3 February 2017 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 05:15, 21 October 2017 (UTC)

27.151.195.131

– This proxy check request is closed and will soon be archived by a bot.

27.151.195.131 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Clearly the LTA flag vandal. They will almost definitely return after the short block... 172.58.41.13 (talk) 03:33, 3 February 2017 (UTC)

 Unlikely IP is an open proxy. Sorry, I don't see anything odd. Kuru (talk) 03:42, 3 February 2017 (UTC)

2.50.39.9

– This proxy check request is closed and will soon be archived by a bot.

2.50.39.9 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Blocked proxy; host offline unable to verify if this is IP is still a proxy or concern. Looking for guidance on this IP.— Preceding unsigned comment added by Dane (talk • contribs)

The host appears to be up and I can't connect to the port ProxseeBot identified. I don't see anything else open. What concerns do you have? Kuru (talk) 12:41, 8 February 2017 (UTC)

No further concerns. This can be closed. -- Dane ^talk 21:51, 10 February 2017 (UTC)

206.225.83.234

– This proxy check request is closed and will soon be archived by a bot.

206.225.83.234 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Possible webhosting service. 172.58.41.122 (talk) 01:16, 9 February 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:17, 21 October 2017 (UTC)

207.154.193.38

– This proxy check request is closed and will soon be archived by a bot.

207.154.193.38 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Digital Ocean webhosting services. 172.58.40.66 (talk) 01:43, 10 February 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:18, 21 October 2017 (UTC)

86.96.201.69

– This proxy check request is closed and will soon be archived by a bot.

86.96.201.69 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Long block log of proxy blocks. Most recent edits can be found in the edit filter log. 172.58.41.58 (talk) 18:40, 10 February 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:19, 21 October 2017 (UTC)

199.58.85.239 (Range: 199.58.84.0/22)

– This proxy check request is closed and will soon be archived by a bot.

199.58.85.239 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Webhosting service. The /22 range is the network used. 172.58.40.51 (talk) 00:50, 14 February 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:19, 21 October 2017 (UTC)

12.4.17.3 (Range: 12.4.17.0/24)

– This proxy check request is closed and will soon be archived by a bot.

12.4.17.3 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Registered VPN service. 172.58.40.139 (talk) 17:54, 14 February 2017 (UTC)

 Unlikely IP is an open proxy Looks like it's a closed proxy for the AFL-CIO. Callanecc (talk • contribs • logs) 05:20, 21 October 2017 (UTC)

79.101.145.204

– This proxy check request is closed and will soon be archived by a bot.

79.101.145.204 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. 172.58.41.131 (talk) 18:48, 16 February 2017 (UTC)

Not currently an open proxy or not anymore at least. Callanecc (talk • contribs • logs) 05:21, 21 October 2017 (UTC)

162.221.202.16 (Range: 162.221.200.0/21)

– This proxy check request is closed and will soon be archived by a bot.

162.221.202.16 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Registered VPN service. 172.58.41.30 (talk) 03:45, 21 February 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:22, 21 October 2017 (UTC)

202.74.160.30 (Range: 202.74.160.0/19)

– This proxy check request is closed and will soon be archived by a bot.

202.74.160.30 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. The /19 range includes the entire webhost service. 172.58.40.170 (talk) 04:36, 24 February 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:24, 21 October 2017 (UTC)

62.201.211.76

– This proxy check request is closed and will soon be archived by a bot.

62.201.211.76 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Open on port 8080. (Note: I was testing the connection of this proxy yesterday and made some edits with it...) 172.58.40.173 (talk) 23:25, 27 February 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:25, 21 October 2017 (UTC)

8.37.225.0/24

– This proxy check request is closed and will soon be archived by a bot.

8.37.225.0/24 · contribs · block · log · stalk · Robtex · whois · Google

8.37.224.0/20 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Requested unblock at User talk:8.37.225.78. עוד מישהו Od Mishehu 06:46, 5 March 2017 (UTC)

Not sure on this one. This is a "web acceleration" service, Quantil, formerly known as Mileweb. All kinds of shady practices there, but some real products use them as well (accelerated mobile web browsers, etc). There are actually two independent range blocks, both triggered by someone using the service poorly. I would not recommend unblocking; the "hard" range block expires in a few weeks, they can create an account then, or simply turn off their accelerator/connect with another service. Kuru (talk) 14:30, 5 March 2017 (UTC)

146.247.0.0/16

– This proxy check request is closed and will soon be archived by a bot.

146.247.0.0/16 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Requested unblock at User talk:146.247.83.91. עוד מישהו Od Mishehu 06:51, 5 March 2017 (UTC)

 Unlikely IP is an open proxy. The individual IP looks like part of a regular ISP. As the requester notes, it does belong to Universal Broadband, leased through AllTele. Looks like the original range block was targeting abusive edits from 146.247.25.49 and 146.247.25.50 - a very different situation. @DoRD:, do you think it would be okay to release this range block, or can we narrow it to 146.247.25.0/24? I know Sro23 is frequently targeted, so wanted to make sure there isn't something I cant see. Kuru (talk) 14:04, 5 March 2017 (UTC)

@Kuru: After review, I decided to unblock the /16 for now. ​—DoRD (talk)​ 14:43, 5 March 2017 (UTC)

107.151.128.0/18

– This proxy check request is closed and will soon be archived by a bot.

107.151.128.0/18 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Requested unblock at User talk:W33dscoper. עוד מישהו Od Mishehu 06:55, 5 March 2017 (UTC)

 Completed. This is indeed a webhost - Zenlayer cloud hosting. The range block is technically correct, the hard block is intentional. This would be a candidate for IPBE if he really needs to connect through a remote server. Kuru (talk) 13:46, 5 March 2017 (UTC)

191.187.242.227

– This proxy check request is closed and will soon be archived by a bot.

191.187.242.227 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Appeal at User talk:Saturnalia0. Block log. Please check whether indeed open proxy.

 Completed. There is no longer an open proxy on the port Procseebot identified. One other odd open port that looks like a router, but I an't connect to it. I removed the block. Kuru (talk) 12:40, 7 March 2017 (UTC)

185.80.220.42

– This proxy check request is closed and will soon be archived by a bot.

185.80.220.42 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Part of Opera's SurfEasy VPN. --185.80.220.42 (talk) 03:43, 11 March 2017 (UTC)

The range 185.80.220.0/22 (block range · block log (global) · WHOIS (partial)) has been indefinitely blocked on 1 March 2017 on the Turkish Wikipedia as “Anonymous and open proxies : Virtual Internet (UK) Limited (United Kingdom)” by tr:Kullanıcı:Vito Genovese. See also the Wikipedia page on the UK2 Group and the reference to http://www.vps.net. Per this Techcrunch article the UK2 Group is a webhosting provider. It looks to me that that a web host block of the /22 may be justified. EdJohnston (talk) 04:09, 11 March 2017 (UTC)

 Completed These are part of AS13213 (UK-2 Limited) (uk2group.com)'s allocations. They're a colocation provider that already has numerous blocks because of abusive VPN and web proxy hosting. I'm blocking their ranges presently. --slakr^\ talk / 05:26, 25 March 2017 (UTC)

104.145.235.41

– This proxy check request is closed and will soon be archived by a bot.

104.145.235.41 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: I sometimes use a VPN (for gaming). This is a new one on NordVPN, and not blocked. Ronhjones  ^(Talk) 20:43, 12 March 2017 (UTC)

 Completed — blocked all of AS64245 (DigitalFyre Internet Solutions, LLC.) as a colocation / webhost provider. --slakr^\ talk / 05:01, 25 March 2017 (UTC)

138.26.90.37

– This proxy check request is closed and will soon be archived by a bot.

138.26.90.37 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Probably a proxy sock-the same article was targeted a notorious sockmaster before. 46.154.45.179 (talk) 12:52, 17 March 2017 (UTC)

 Unlikely IP is an open proxy. I don't see anything obvious; college POP. Kuru (talk) 14:08, 17 March 2017 (UTC)

45.72.133.95

– This proxy check request is closed and will soon be archived by a bot.

45.72.133.95 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Likely a proxy sock-the same article was targeted by a notorious sockmaster before.46.154.45.179 (talk) 13:03, 17 March 2017 (UTC)

 Unlikely IP is an open proxy. I don't see anything. Kuru (talk) 14:02, 17 March 2017 (UTC)

202.136.88.99

– This proxy check request is closed and will soon be archived by a bot.

202.136.88.99 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Some random troll or other used it to vandalize my talk page, geolocate says it's a confirmed proxy server. Beeblebrox (talk) 19:54, 22 March 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:27, 21 October 2017 (UTC)

212.31.100.218

– This proxy check request is closed and will soon be archived by a bot.

212.31.100.218 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: IP already blocked for vandalism; WHOIS confirms as proxy server. Thank you, <<< SOME GADGET GEEK >>> (talk) 01:50, 23 March 2017 (UTC)

 Unlikely IP is an open proxy / blocked as a school by another admin. slakr^\ talk / 04:47, 25 March 2017 (UTC)

91.223.106.152

– This proxy check request is closed and will soon be archived by a bot.

91.223.106.152 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Vandalism and admittance by user it's a proxy server Ronhjones  ^(Talk) 17:14, 25 March 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:29, 21 October 2017 (UTC)

69.63.114.66

– This proxy check request is closed and will soon be archived by a bot.

69.63.114.66 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

User claims in this appeal on UTRS that the IP address is a proxy that requires authorization, not an open proxy. ~Anachronist (talk) 00:56, 5 April 2017 (UTC) Reason: Requested unblock.

IP is an open proxy. Wide open squid proxy on 3128; was able to connect and attempt to edit. This is blocked (correctly) on meta at any rate. Kuru (talk) 01:33, 5 April 2017 (UTC)

49.145.219.199

– This proxy check request is closed and will soon be archived by a bot.

49.145.219.199 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Vandalism as editing on List of programs broadcast by UNTV. LG-Gunther :  Talk  04:28, 5 April 2017 (UTC)

Please provide evidence of an open proxy. I see none. Materialscientist (talk) 04:35, 5 April 2017 (UTC)

No evidence has been provided since April so I'm closing this. De728631 (talk) 21:10, 15 August 2017 (UTC)

IP 180.148.211.21

– This proxy check request is closed and will soon be archived by a bot.

180.148.211.21 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Noticed a bit of vandalism coming from this IP. I've blocked them for 72 hours, but I noticed that What's My IP Address thinks they might be a proxy and a forum spam source. Granted, I know that this doesn't always mean anything, but my other option was to do nothing, which I didn't think would be helpful. Thanks for looking into this. Cyphoidbomb (talk) 16:03, 7 April 2017 (UTC)

Not sure. There's an open port (8291), but I can't figure out what's there. Can't connect to it, so it's not a simple open proxy. The IP has been used abusively in the past - it's on several blacklists for spam and attacks. Looks like it belongs to "stargatebd.com", which is an established ISP in Dhaka. May be leased to local internet cafes, etc. Suggest treating it like any other IP and increase as you go, unless someone else can see more than I'm seeing? Kuru (talk) 17:43, 7 April 2017 (UTC)

My checks only confirm what Kuru says, so I am closing this case. The editor who uses the pseudonym "JamesBWatson" (talk) 12:02, 26 April 2017 (UTC)

76.169.240.143

– This proxy check request is closed and will soon be archived by a bot.

76.169.240.143 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious and disruptive edits. The ip is blacklisted at dnsbl.sorbs.net, dul.dnsbl.sorbs.net, 12.apews.org. The ip is static like many proxies and is apparently used by the same person since december. Plus, its edit conduct is resembling a notorious sockmaster involved in ip-socking before. I know this project cannot detect all the proxies any time but it would be nice if someone check this highly dubious ip. 46.221.192.32 (talk) 12:40, 18 April 2017 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 05:30, 21 October 2017 (UTC)

123.243.214.185

– This proxy check request is closed and will soon be archived by a bot.

123.243.214.185 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Some recent disruptive editing coming from this IP. Per the IP's block log, ProcseeBot issued a block in 2010 on the basis that the IP was a proxy of some kind. Thought it could use another look. Thanks, Cyphoidbomb (talk) 15:46, 20 April 2017 (UTC)

I can't find any evidence that this is currently an open proxy, nor even that it has been since 2010. However, I am leaving this open in case anyone else can find evidence. The editor who uses the pseudonym "JamesBWatson" (talk) 11:56, 26 April 2017 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 05:31, 21 October 2017 (UTC)

111.88.0.0/16

– This proxy check request is closed and will soon be archived by a bot.

111.88.0.0/16 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Requested unblock at User talk:111.88.115.104. עוד מישהו Od Mishehu 09:47, 23 April 2017 (UTC)

I can find no evidence at all that 111.88.115.104 is an open proxy. @Callanecc: You placed the block, can you offer any useful information? The editor who uses the pseudonym "JamesBWatson" (talk) 11:46, 26 April 2017 (UTC)

Callanecc has not edited for two weeks, so I am going ahead with this. I have checked a number of IP addresses in the range, including all those which have most recently edited, and I can find no evidence that any of them is currently hosting an open proxy. However, almost all of the edits from the blocked range are vandalism or other unconstructive editing, so I am not going to unblock, but I shall reduce the block to an anon-block. The editor who uses the pseudonym "JamesBWatson" (talk) 13:09, 5 May 2017 (UTC)

110.21.0.7

– This proxy check request is closed and will soon be archived by a bot.

110.21.0.7 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Not currently an open proxy Callanecc (talk • contribs • logs) 05:32, 21 October 2017 (UTC)

85.17.24.76

– This proxy check request is closed and will soon be archived by a bot.

85.17.24.76 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Used Hide.me, then asked google "what's my ip?". -barrelroll.dev (talk) 23:33, 1 May 2017 (UTC)

IP is an open proxy Callanecc (talk • contribs • logs) 05:33, 21 October 2017 (UTC)

34.201.164.129

– This proxy check request is closed and will soon be archived by a bot.

34.201.164.129 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Vandalism from Amazon EC cloud IP

Open proxy blocked Callanecc (talk • contribs • logs) 05:33, 21 October 2017 (UTC)

151.240.233.46

– This proxy check request is closed and will soon be archived by a bot.

[[User:|]] · contribs · block · log · stalk · Robtex · whois · Google

Reason: Requested unblock.

 Declined to run a check. Not clear what you're asking; I don't see an unblock request associated with this IP, nor do I see an active block. Kuru (talk) 14:01, 20 May 2017 (UTC)

173.236.128.0/17

– This proxy check request is closed and will soon be archived by a bot.

173.236.128.0/17 · contribs · block · log · stalk · Robtex · whois · Google

Webhosting service; continued to cause disruption after recent release from block. 2A00:1838:37:C1:0:0:0:6A9D (talk) 01:44, 16 June 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:35, 21 October 2017 (UTC)

198.15.64.0/18

– This proxy check request is closed and will soon be archived by a bot.

198.15.64.0/18 · contribs · block · log · stalk · Robtex · whois · Google

Webhosting service; continued to cause disruption after recent release from block. Specifically from 198.15.118.143 (talk · contribs · WHOIS). 2601:1C0:10E:B297:1056:9979:D4E9:73AE (talk) 01:45, 19 June 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:36, 21 October 2017 (UTC)

196.52.2.97

– This proxy check request is closed and will soon be archived by a bot.

196.52.2.97 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

See [6]. Web check reveals it to be a network sharing device or proxy. GAB^gab 21:02, 23 June 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:36, 21 October 2017 (UTC)

54.236.45.171

– This proxy check request is closed and will soon be archived by a bot.

54.236.45.171 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: This IP has been used by a proxy hopping troll on another wiki I am a checkuser on, and it belongs to Amazon. Amazon has hosting services, and if this is an open proxy being used for wiki vandalism, it's only a matter of time until someone uses it to vandalize Wikipedia. PCHS-NJROTC ^{(Messages)Have a blessed day.} 21:30, 5 July 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:37, 21 October 2017 (UTC)

122.8.141.171

– This proxy check request is closed and will soon be archived by a bot.

122.8.141.171 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits; long-term prolific sockfarm Wikipedia:Sockpuppet investigations/OfficialPankajPatidar. The IP geolocates to Beijing but here they claim to be in Pakistan, which is consitent with the sockfarm's profile. _ Bri (talk) 18:55, 7 July 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:38, 21 October 2017 (UTC)

68.168.119.230

– This proxy check request is closed and will soon be archived by a bot.

68.168.119.230 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Managed to edit user:Ronhjones/Proxy, while connected through Nord vpn Canada  Ronhjones  ^(Talk) 19:40, 23 July 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:39, 21 October 2017 (UTC)

107.77.165.6

– This proxy check request is closed and will soon be archived by a bot.

107.77.165.6 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, web check reveals it to be a confirmed proxy server. Probably User:Accopulocrat. GAB^gab 00:46, 31 July 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:40, 21 October 2017 (UTC)

94.242.62.112

– This proxy check request is closed and will soon be archived by a bot.

94.242.62.112 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, "Network sharing device or proxy server... Likely mail server". GAB^gab 00:03, 1 August 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:41, 21 October 2017 (UTC)

210.95.217.175

– This proxy check request is closed and will soon be archived by a bot.

210.95.217.175 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits Beyond My Ken (talk) 14:25, 31 August 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 05:42, 21 October 2017 (UTC)

190.79.25.143

– This proxy check request is closed and will soon be archived by a bot.

190.79.25.143 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits Beyond My Ken (talk) 14:25, 31 August 2017 (UTC)

 Unlikely IP is an open proxy Callanecc (talk • contribs • logs) 05:42, 21 October 2017 (UTC)

124.215.138.169

– This proxy check request is closed and will soon be archived by a bot.

124.215.138.169 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Disruptive edits over the past year, this says it's a network sharing device or proxy server. -★- PlyrStar93. _{→Message me. ←} 00:09, 23 October 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:31, 23 October 2017 (UTC)

41.209.50.225

– This proxy check request is closed and will soon be archived by a bot.

41.209.50.225 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Began making same pattern of disruptive edits to fast food mascot articles after a prior IP (200.76.184.163) was given a level 4 warning. IP Quality Score lists as a proxy. RA0808 ^talk_contribs 15:20, 24 October 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 07:53, 25 October 2017 (UTC)

173.224.116.233

– This proxy check request is closed and will soon be archived by a bot.

173.224.116.233 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: ISP is server4you, indicating a web hosting service. Edit warring on some pages. -★- PlyrStar93. _{→Message me. ←} 14:52, 28 October 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 01:24, 29 October 2017 (UTC)

69.223.191.136

– This proxy check request is closed and will soon be archived by a bot.

69.223.191.136 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Disruptive edits adding deliberate misinformation, IP Quality Score flags as a proxy. RA0808 ^talk_contribs 21:12, 28 October 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 01:26, 29 October 2017 (UTC)

2404:C800:9002:8:0:0:0:13

– This proxy check request is closed and will soon be archived by a bot.

2404:C800:9002:8:0:0:0:13 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · geo · rangeblocks · spur · shodan

Reason: Suspicious edits 222.167.166.187 (talk)

 Unlikely IP is an open proxy Callanecc (talk • contribs • logs) 00:13, 31 October 2017 (UTC)

12.110.218.178

– This proxy check request is closed and will soon be archived by a bot.

12.110.218.178 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, vandalism, School block.222.167.166.187 (talk)

Inconclusive It might be open, but also possible that it's a closed proxy used by the school system. The two year school block will do the job anyway. Callanecc (talk • contribs • logs) 00:18, 31 October 2017 (UTC)

182.253.125.7

– This proxy check request is closed and will soon be archived by a bot.

182.253.125.7 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, blocked proxy. 222.167.166.187 (talk)

Open proxy blocked Callanecc (talk • contribs • logs) 00:19, 31 October 2017 (UTC)

52.168.135.254

– This proxy check request is closed and will soon be archived by a bot.

52.168.135.254 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: vandalism from this IP. ISP is Microsoft Corporation and organization is listed as Microsoft Azure, which is a cloud computing platform to deploy applications as well as web hosts. Geolocation shows up as East Coast of US, which is not where Microsoft's corporate office is at, but rather a Microsoft datacenter (Boydton, VA). -★- PlyrStar93. _{→Message me. ←} 19:33, 29 October 2017 (UTC)

Open proxy blocked While the range is registered to MS Azure, it's too big to block so it'll be whack-a-mole. Callanecc (talk • contribs • logs) 00:22, 31 October 2017 (UTC)

113.160.55.242

– This proxy check request is closed and will soon be archived by a bot.

113.160.55.242 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Vandalism, blocked proxy 222.167.166.187 (talk) 21:06, 30 October 2017 (UTC)

 Completed Already blocked. Callanecc (talk • contribs • logs) 00:22, 31 October 2017 (UTC)

185.17.132.66

– This proxy check request is closed and will soon be archived by a bot.

185.17.132.66 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: 185.17.132.66:53281 is an open proxy which was used for a vandalbot attack on Commons. —Guanaco 08:12, 31 October 2017 (UTC)

•  Proxy blocked. GAB^gab 15:08, 31 October 2017 (UTC)

165.225.96.61

– This proxy check request is closed and will soon be archived by a bot.

165.225.96.61 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, appears to be Zscaler proxy ☆ Bri (talk) 14:41, 1 November 2017 (UTC)

 Proxy blocked. GAB^gab 15:06, 1 November 2017 (UTC)

77.247.85.102

– This proxy check request is closed and will soon be archived by a bot.

77.247.85.102 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. whatismyipaddress.com says that it is a VPN server. Even though the IP address is already blocked, it should be hard-blocked and possibly for a longer duration. 24.51.86.102 (talk) 18:07, 1 November 2017 (UTC)

 Completed. Range blocked. NinjaRobotPirate (talk) 04:39, 2 November 2017 (UTC)

103.4.164.204

– This proxy check request is closed and will soon be archived by a bot.

103.4.164.204 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Recently started editing again within the last few days. Blocked by the proxy bot, still an open proxy. 159.89.10.188 (talk) 15:54, 2 November 2017 (UTC)

 Completed Already blocked. Callanecc (talk • contribs • logs) 05:35, 3 November 2017 (UTC)

104.129.198.115

– This proxy check request is closed and will soon be archived by a bot.

104.129.198.115 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Zscaler open proxy. 116.220.7.10 (talk) 20:43, 3 November 2017 (UTC)

 Proxy blocked. GAB^gab 21:26, 3 November 2017 (UTC)

202.134.13.135

– This proxy check request is closed and will soon be archived by a bot.

202.134.13.135 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. whatismyipaddress.com reports it as a spam source (within the last 30 days, etc.). 82.0.113.79 (talk) 18:30, 5 November 2017 (UTC)

Actually, I'm not really sure if it's a proxy per se, it may be a shared IP address at a coorporation. The "spam source" was the original indicator that made me think that this is a proxy server, but I may be incorrect here... 82.0.113.79 (talk) 18:34, 5 November 2017 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 09:00, 7 November 2017 (UTC)

66.160.199.60

– This proxy check request is closed and will soon be archived by a bot.

66.160.199.60 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Hurricane Electric open proxy. 176.103.48.38 (talk) 16:18, 9 November 2017 (UTC)

(Non-administrator comment)  Done Open proxy blocked Already rangeblocked. 61.245.229.113 (talk) 05:03, 19 November 2017 (UTC)

104.129.196.206

– This proxy check request is closed and will soon be archived by a bot.

104.129.196.206 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Zscaler open proxy. 122.197.215.184 (talk) 17:59, 10 November 2017 (UTC)

Not currently an open proxy It's a closed proxy, not open for anyone from what I can tell. Callanecc (talk • contribs • logs) 10:28, 19 November 2017 (UTC)

52.173.74.241

– This proxy check request is closed and will soon be archived by a bot.

52.173.74.241 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious (promotional) edits; socking; has been identified as Microsoft Azure host. ☆ Bri (talk) 18:02, 10 November 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:25, 19 November 2017 (UTC)

185.104.185.239

– This proxy check request is closed and will soon be archived by a bot.

185.104.185.239 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

185.104.185.50 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

78.129.130.230 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

45.41.135.130 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: sockpuppetry, IPs in France, England, and Japan, being used by a banned user located in the United States who has used open proxies for abuse in the past. (NOTE: I combined a few open reports) Ivanvector (^Talk/_Edits) 15:35, 18 November 2017 (UTC)

All blocked. GAB^gab 15:52, 18 November 2017 (UTC)

95.153.132.82

– This proxy check request is closed and will soon be archived by a bot.

95.153.132.82 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits — Preceding unsigned comment added by 95.153.132.82 (talk • contribs) 01:28, 17 November 2017 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 10:26, 19 November 2017 (UTC)

92.53.105.52

– This proxy check request is closed and will soon be archived by a bot.

92.53.105.52 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: edit war-ish edit summaries. Host name is vds-holanet.timeweb.ru and ISP is TimeWeb Ltd., a Russian web hosting company. -★- PlyrStar93. _{→Message me. ←} 03:07, 19 November 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:27, 19 November 2017 (UTC)

2a02:c207::/32

– This proxy check request is closed and will soon be archived by a bot.

2a02:c207::/32 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Suspicious edits. Recently blocked as a webhost on meta.wiki, and was once blocked on en.wiki too. This /32 IPv6 range still appears to be a webhosting service. 219.98.8.174 (talk) 22:40, 19 November 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:43, 20 November 2017 (UTC)

2A03:EFC0:900:0:0:0:0:252

– This proxy check request is closed and will soon be archived by a bot.

2A03:EFC0:900:0:0:0:0:252 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · geo · rangeblocks · spur · shodan

Reason: Fanciful hoaxing & BLP violations in the style of Jaredgk2008.—Odysseus1479 05:34, 21 November 2017 (UTC)

Open proxy blocked, /40 range. -- zzuuzz ^(talk) 07:18, 21 November 2017 (UTC)

198.27.128.0/17 incorrectly identified as colocationwebhost

– This proxy check request is closed and will soon be archived by a bot.

198.27.128.0/17 · contribs · block · log · stalk · Robtex · whois · Google

I work for the ISP which owns this netblock and can confirm that this is a range of DHCP addresses handed out to residential customers and has no connection to our colocation facilities. Refer to this discussion if you want to know why I posted this request here. Reason: Incorrectly blocked as colocationwebhost. Opsftw (talk) 18:38, 27 November 2017 (UTC)

@Opsftw: I'm changing the block reason to something more generic, but I will leave the block on unregistered users for the time being, as there has been some vandalism from the range. Users who log in will be able to edit, and no user will be presented with a message about colos. I will also drop a note to Ks0stm with regards to removing the block entirely. -- zzuuzz ^(talk) 19:09, 27 November 2017 (UTC)

@Zzuuzz: Thanks for your attention to this issue and for making the change you made. I still don't understand why the anonblock is wanted - looking at the relevant user page when I use "Hide probably good edits" there are no "probably bad" edits shown. I'm guessing you are using a different tool to spot vandalism from that range. Further, is it policy to anonblock an entire /17 of residential internet customers because somebody in that range was committing vandalism? Remember, we are talking about roughly thirty two thousand households (or approximately 75,000 human beings) being anonblocked because somebody within that range has acted inappropriately. That seems a bit extreme IMHO. Opsftw (talk) 19:30, 27 November 2017 (UTC)

@Opsftw: Unfortunately I have special access to the relevant tools. We have had problems with a long term vandal creating accounts from throughout this range throughout this year. They have been active in just the last few hours (though probably from other ranges). One or two occurrences may possibly have been explained by compromised hosts, but there does seem to be a theme. -- zzuuzz ^(talk) 19:54, 27 November 2017 (UTC)

@Zzuuzz: Would you be willing to share some examples of vandalism edits from the user in this range that you're concerned about? Again, still trying to understand how one person's inappropriate conduct should justify an anonblock of this magnitude (75,000 or so human beings are impacted).Opsftw (talk) 20:47, 27 November 2017 (UTC)

@Opsftw: I'm going to have to decline due to the Privacy policy and the nature of the vandalism. Don't get me wrong I don't take /17 blocks lightly, and they're usually reserved for severe disruption. Whether or not it's justified is something I'm currently pondering, but also bear in mind this isn't technically my block. -- zzuuzz ^(talk) 22:06, 27 November 2017 (UTC)

@Zzuuzz: Understood perfectly re: privacy. My role here is to advocate on behalf of our users, the vast majority of whom are not abusing our service to cause disruption to Wikipedia.

I'm leaving the block in place at this time. I've left further advice at User talk:Ks0stm. -- zzuuzz ^(talk) 07:12, 28 November 2017 (UTC)

98.239.113.209

– This proxy check request is closed and will soon be archived by a bot.

98.239.113.209 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: WP:DUCK test matches Wikipedia:Long-term abuse/109.151.65.218, behavior matches that one almost spot on. However, this IP's WHOIS data indicates a US-based IP address, while all of the others indicate UK-based IP addresses. Asking for a proxy check to see if they are using an open proxy to mask their location. IP is already blocked a short time based on behavioral evidence. --Jayron32 20:07, 27 November 2017 (UTC)

Already blocked, but not an open proxy. Callanecc (talk • contribs • logs) 03:41, 2 December 2017 (UTC)

103.23.29.253

– This proxy check request is closed and will soon be archived by a bot.

103.23.29.253 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. I'm not sure how to check which port the IP is open on, but whatismyipaddress.com labels it as a "confirmed proxy server".

Looks like this is a closed proxy. Callanecc (talk • contribs • logs) 03:42, 2 December 2017 (UTC)

190.226.154.234

– This proxy check request is closed and will soon be archived by a bot.

190.226.154.234 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, listed as problem host by Barracuda. ☆ Bri (talk) 18:38, 28 November 2017 (UTC)

@Bri: Based on behavioral evidence, it seems more probable than not that this is not a proxy. GAB^gab 16:57, 30 November 2017 (UTC)

Agreed, Not currently an open proxy Callanecc (talk • contribs • logs) 03:42, 2 December 2017 (UTC)

173.9.233.41

– This proxy check request is closed and will soon be archived by a bot.

173.9.233.41 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: All edits are vandalism/unconstructive. Also some other edits in other wikis: frwiki/simplewiki are the same type of vandalism. Proxy checker shows as VPN/proxy. Based on behavior, this is the Pikepass vandal at frwiki, who is known to abuse proxies (e.g. previous blocked IP 96.92.203.45 now globally blocked 1 year as open proxy). -★- PlyrStar93. _{→Message me. ←} 04:11, 29 November 2017 (UTC)

Already blocked, and I'm not sure it is an open proxy. Callanecc (talk • contribs • logs) 03:44, 2 December 2017 (UTC)

192.240.127.78

– This proxy check request is closed and will soon be archived by a bot.

192.240.127.78 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Dedicated server proxy IP. May need to be rangeblocked as {{webhostblock}}. 116.123.126.79 (talk) 10:05, 29 November 2017 (UTC)

 Range blocked by Zzuuzz. GAB^gab 16:56, 30 November 2017 (UTC)

147.91.1.43

– This proxy check request is closed and will soon be archived by a bot.

147.91.1.43 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. IP address is back to being a proxy once again per whatismyipaddress.com (refer to block log). 203.128.191.50 (talk) 18:04, 29 November 2017 (UTC)

Doesn't appear to be an open proxy. Warn and report to WP:AIV as normal for a 'school'. Callanecc (talk • contribs • logs) 03:48, 2 December 2017 (UTC)

2001:42C8:0:301:41:206:188:206

– This proxy check request is closed and will soon be archived by a bot.

2001:42C8:0:301:41:206:188:206 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. User has admitted that this IP address is a Tor exit node. 60.36.225.155 (talk) 13:10, 30 November 2017 (UTC)

 IP blocked. GAB^gab 16:54, 30 November 2017 (UTC)

46.166.176.0/21 (46.166.176.169)

– This proxy check request is closed and will soon be archived by a bot.

46.166.176.169 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. Hostname is: "hosted-by.seedvps.com" which is registered to this VPN hosting service. According to the WHOIS links, 46.166.176.0/21 (block range · block log (global) · WHOIS (partial)) would be the correct range to block if a {{webhostblock}} would be performed. 76.109.126.61 (talk) 05:59, 4 December 2017 (UTC)

• Blocked. Callanecc (talk • contribs • logs) 10:55, 4 December 2017 (UTC)

77.234.46.177

– This proxy check request is closed and will soon be archived by a bot.

77.234.46.177 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits, address query reports Webhosting cloud service Avast "Network sharing device or proxy server", poss proxy thing ☆ Bri (talk) 04:48, 5 December 2017 (UTC)

Note: 77.234.40.0/24 (block range · block log (global) · WHOIS (partial)) is currently blocked as a webhost, which is in the same ISP as 77.234.46.177. 118.153.81.72 (talk) 05:21, 5 December 2017 (UTC)

• Blocked. Callanecc (talk • contribs • logs) 07:11, 5 December 2017 (UTC)

130.180.122.138

– This proxy check request is closed and will soon be archived by a bot.

130.180.122.138 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock.

See User talk:130.180.122.138 Ronhjones  ^(Talk) 00:18, 9 December 2017 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 07:12, 18 December 2017 (UTC)

108.171.159.47

– This proxy check request is closed and will soon be archived by a bot.

108.171.159.47 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Recently used by sockpuppeteer; whatismyaddress.com says it's a proxy server. Trivialist (talk) 21:10, 17 December 2017 (UTC)

 Range blocked by NinjaRobotPirate. GAB^gab 01:21, 18 December 2017 (UTC)

208.87.237.201

– This proxy check request is closed and will soon be archived by a bot.

208.87.237.201 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. confirmed proxy server and webhosting service. 180.47.118.156 (talk) 18:58, 18 December 2017 (UTC)

Not currently an open proxy SQL^{Query me!} 00:06, 12 January 2018 (UTC)

62.255.118.6

– This proxy check request is closed and will soon be archived by a bot.

62.255.118.6 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits

See a complaint of disruptive editing at WP:Administrators' noticeboard#Editor being bullied. User:Berean Hunter tried checking the IP at one of the IP lookup sites, and that site reports it to be an open proxy. I am unsure whether to trust this verdict. EdJohnston (talk) 00:34, 21 December 2017 (UTC)

(non-admin closure) Blocked for 1 year by Yamla. 213.231.118.93 (talk) 17:48, 21 December 2017 (UTC)

110.77.181.148

– This proxy check request is closed and will soon be archived by a bot.

110.77.181.148 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: See discussion, the final section at WP:ANI. In short, someone created a couple of attack accounts, and when they were blocked, this IP continued the disruption. According to checkuser NinjaRobotPirate, the accounts are using proxies, so I suppose it's likely that this one also might be. It was previously blocked by Procseebot, but that block expired without being renewed, so I'm not clear if that means that the bot hadn't gotten around to reblocking it yet or if it means that it's not a proxy anymore. I gave it a short block for the disruption, but please lengthen the block if it's a proxy. Nyttend (talk) 14:05, 23 December 2017 (UTC)

 Proxy blocked. GAB^gab 17:06, 23 December 2017 (UTC)

121.225.25.197

– This proxy check request is closed and will soon be archived by a bot.

121.225.25.197 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

A few minutes after I made the block referenced in the previous section, I got this friendly notice from an IP with no previous edits. This is the first logged action I've made in several days, aside from unprotecting a page (can't imagine anyone objecting to that in such a manner), so I strongly suspect that it's related. Seeing that 110.77.181.148 is Thai, and this one's Chinese, I strongly suspect that they're both open proxies. Nyttend (talk) 14:24, 23 December 2017 (UTC)

 Proxy blocked. GAB^gab 17:07, 23 December 2017 (UTC)

203.81.71.25

– This proxy check request is closed and will soon be archived by a bot.

203.81.71.25 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Suspicious edits. IP has been blocked twice in the past as an open proxy. 14.190.44.204 (talk) 17:47, 28 December 2017 (UTC)

 Proxy blocked. GAB^gab 19:19, 28 December 2017 (UTC)