Jump to content

Wikipedia:WikiProject on open proxies/Requests/Archives/48

Add links
From Wikipedia, the free encyclopedia
The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.


107.115.16.0/20

{{proxycheckstatus}}

Norton Securiy Suite IP. Reason: (add your reason here) Idesyest (talk) 20:51, 20 December 2022 (UTC)

OP blocked. Lemonaka (talk) 15:07, 28 December 2022 (UTC)
This looks like a regular AT&T range. no Closing without action. MarioGom (talk) 21:20, 8 January 2023 (UTC)

185.69.144.0/22

{{proxycheckstatus}}

Reason: Several recent VPN proxies running on this IP range. IP range has been blocked in the past (see block log) for LTA disruption. 73.67.145.30 (talk) 21:22, 8 January 2023 (UTC)

No sign of VPN exits here. This is a mobile range and edits are consistent with that. The possible residential proxies that are present here are unlikely to be used by vandals/trolls. no Closing without action. MarioGom (talk) 06:46, 9 January 2023 (UTC)

Unwired Broadband

{{proxycheckstatus}}

23.227.96.0/19 · contribs · block · log · stalk · Robtex · whois · Google
104.200.32.0/20 · contribs · block · log · stalk · Robtex · whois · Google
104.247.128.0/20 · contribs · block · log · stalk · Robtex · whois · Google
104.247.144.0/21 · contribs · block · log · stalk · Robtex · whois · Google
198.210.32.0/19 · contribs · block · log · stalk · Robtex · whois · Google
209.54.32.0/20 · contribs · block · log · stalk · Robtex · whois · Google

Reason: These ranges no longer appear to be used for hosting; the ones listed here are registered to Unwired Broadband (AS33548), which is a residential and business ISP. wizzito | say hello! 20:54, 22 August 2022 (UTC)

I agree it looks like these blocks are now obsolete. It's been long since they were added, and they seem to have changed hands from hosting to broadband since. Pink clock Awaiting administrative action: Please, consider unblocking these. MarioGom (talk) 22:42, 17 November 2022 (UTC)
I have lifted the local blocks on these ranges, but two of them are globally locked. It may be worth asking for the global blocks to be removed. JBW (talk) 13:16, 13 January 2023 (UTC)
Thanks! Closing. MarioGom (talk) 22:15, 31 January 2023 (UTC)

154.160.27.219

{{proxycheckstatus}}

154.160.27.219 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Mobile network, probably CGNAT. - RichT|C|E-Mail 11:49, 8 January 2023 (UTC)

Rich: The IP has a P2P proxy running behind it, so it got a temporary block. It will expire soon. Are you requesting an unblock for this particular IP? MarioGom (talk) 16:16, 8 January 2023 (UTC)
@MarioGom: Yea, don't worry about it. It's for an ACC request but we will just let it expire, all good :) - RichT|C|E-Mail 12:23, 9 January 2023 (UTC)
Rich: Ok. Looking at the block log, chances are that it gets re-blocked some time after it. IPs in this ISP are blocked quite frequently, so the user might need to request IPBE. I have marked this for admin attention, maybe we need to loosen the block to anon. only. MarioGom (talk) 18:26, 10 January 2023 (UTC)
@MarioGom: It would be nice if ST47ProxyBot was slightly less... bitey(?) with these and set anon only unless there is good reason not to - RichT|C|E-Mail 18:37, 10 January 2023 (UTC)
@Rich Smith: IPs with this type of vulnerability are routinely used by LTAs to conduct campaigns of harassment and other dangerous behavior using accounts created from different ranges that are not or can not be blocked with account creation disabled. ST47 (talk) 19:17, 10 January 2023 (UTC)

Rich: is this request still relevant? MarioGom (talk) 22:19, 31 January 2023 (UTC)

@MarioGom: Nope, all good - RichT|C|E-Mail 22:27, 31 January 2023 (UTC)
Thanks. Closing. MarioGom (talk) 22:32, 31 January 2023 (UTC)

192.155.80.0/20

{{proxycheckstatus}}

Reason: Linode range, already globally blocked. - RichT|C|E-Mail 03:35, 13 December 2022 (UTC)

Indeed. Please, consider blocking the range. Thank you. MarioGom (talk) 19:24, 16 December 2022 (UTC)
The range is already blocked. No action needed. ZsinjTalk 02:37, 2 January 2023 (UTC)
Not locally. As far as I know, it is relatively common to block these ranges locally even if they are globally blocked, since GIPBE/IPBE requirements are different. But if any patrolling admin thinks that's not worth it here, feel free to close the report. MarioGom (talk) 18:56, 5 January 2023 (UTC)

88.80.145.0/24

{{proxycheckstatus}}

Reason: (IP belongs to a dedicated services provider (Belcloud, LTD)) Matthew Tyler-Harrington (aka mth8412) (talk) 00:45, 10 January 2023 (UTC)

88.80.144.0/21 · contribs · block · log · stalk · Robtex · whois · Google is a hosting range by "RedCluster LTD", many web servers, proxies, etc, within the range. Please, consider blocking the /21. Thank you. MarioGom (talk) 17:34, 11 January 2023 (UTC)

8.28.126.0/24

{{proxycheckstatus}}

Reason: (Range belongs to Cloudflare, which is used on the WARP VPN network) Matthew Tyler-Harrington (aka mth8412) (talk) 10:19, 16 January 2023 (UTC)

187.62.33.220

{{proxycheckstatus}}

Reason: Abused by the same sockmaster as 196.44.39.130 above; this one looks a bit more obvious 74.73.224.126 (talk) 03:28, 6 December 2022 (UTC)

 Likely IP is an open proxy,  Confirmed to be some a proxy of some sort. Flagging for an admin to consider a block. —‍Mdaniels5757 (talk • contribs) 03:40, 6 December 2022 (UTC)
Since it was a residential proxy, and it has been inactive for some time, it doesn't make sense to block it at this point. Closing. MarioGom (talk) 12:59, 19 February 2023 (UTC)

41.220.146.207

{{proxycheckstatus}}

Reason: used by a block evading sock and reported as a possible proxy by spur and a high risk proxy connection by IP quality store. M.Bitton (talk) 23:48, 6 December 2022 (UTC)

 Likely IP is an open proxy; admin: please consider a block. —‍Mdaniels5757 (talk • contribs) 01:02, 7 December 2022 (UTC)
I think there is a high chance that this IP is not being used as a proxy, just a regular mobile connection in Algeria. The Spur flag is related to a high-end residential proxy service that is certainly not being used for this. MarioGom (talk) 09:34, 9 December 2022 (UTC)
Since it was a residential proxy, and it has been inactive for some time, it doesn't make sense to block it at this point. Closing. MarioGom (talk) 12:59, 19 February 2023 (UTC)

70.54.45.110

{{proxycheckstatus}}

This IP is the latest in a string of widely varying IPs and locations that have been pushing a blatantly promotional draft at Draft:Netta Jenkins. It seems probable that they are all proxies, but only the above one has been used recently. The other IPs were:

Has also been removing the decline templates from the draft despite being told not to. Mako001 (C)  (T)  🇺🇦 13:09, 12 January 2023 (UTC)

 Possible IP is an open proxy per spur data, but it says few connections, so I'm not sold on it. — Mdaniels5757 (talk • contribs) 18:55, 29 January 2023 (UTC)
Mako001: Requesting temporary semi-protection for Draft:Netta Jenkins will be more effective. Closing. MarioGom (talk) 12:57, 19 February 2023 (UTC)

41.210.30.70

{{proxycheckstatus}}

Reason: I just blocked this IP for 48 hours for vandalism, but it might need a longer block, the proxy bot seems to have targeted it in the past and it seems to be assigned to the same provider. – filelakeshoe (t / c) 🐱 10:36, 10 February 2023 (UTC)

Very crowded range with P2P proxies. Other than manual blocks for specific disruption, it's better to leave the proxy blocks to the bot in this case. MarioGom (talk) 12:52, 19 February 2023 (UTC)

89.17.214.10

{{proxycheckstatus}}

Reason: This is an open proxy being used by a blocked sock-puppet Belteshazzar. The same user has used open proxies before. The proxy is listed at scrapingant.com as a free proxy [1] Psychologist Guy (talk) 14:00, 25 February 2023 (UTC)

Already blocked. Closing. MarioGom (talk) 15:55, 12 March 2023 (UTC)

116.206.253.169

{{proxycheckstatus}}

Multiple proxy blocks in past. Ran into this IP because of their pov editing. Reason: (add your reason here) Doug Weller talk 08:57, 5 March 2023 (UTC)

119.160.59.82

{{proxycheckstatus}}

119.160.59.82 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Requested unblock. Says it's not a proxy, just what their mobile provider assigned. Daniel Case (talk) 07:35, 3 March 2023 (UTC)

Daniel Case: That's likely the case. These P2P proxies run on residential ISPs, often in crowded ranges. I don't think the person posting that appeal is any of the usual suspects who abuse this type of proxy. Changing the block to anon. only might make sense. But it'd be better if the user signed up and requested WP:IPBE and WP:GIPBE. MarioGom (talk) 21:16, 7 March 2023 (UTC)
Not currently blocked. Looking at the block log, I'm sure it'll be blocked again soon. There's not much more to here. Closing. MarioGom (talk) 21:24, 26 April 2023 (UTC)

150.101.252.89

{{proxycheckstatus}}

Reason: I reverted vandalism on this IP editor, and they responded by saying that it could have been anyone since it's a TOR IP and that the edits on this IP could be from anyone... here's the link. Marleeashton (talk) 07:31, 11 March 2023 (UTC)

I'm not sure it's a Tor node, but it's definitely a VPN node. MarioGom (talk) 15:54, 12 March 2023 (UTC)
Now blocked. Closing. MarioGom (talk) 21:24, 26 April 2023 (UTC)

110.93.84.151

{{proxycheckstatus}}

Reason: Lots of logged-out beauty pageant article editing from IPs hopping around the 110.93.84.0/24 range, a selection shown in this report. This article space (pageants) is general sanction-ed and full of blocked SPAs, this provider offers proxy/VPN services: https://www.crn.com/news/security/18828398/clearpath-preps-managed-vpn.htm ☆ Bri (talk) 15:52, 27 March 2023 (UTC)

Forgot to mention that whatismyipaddress.com says something about a datacenter. ☆ Bri (talk) 05:14, 3 April 2023 (UTC)
These seem regular residential connections. Closing. MarioGom (talk) 21:27, 26 April 2023 (UTC)

80.79.145.161

{{proxycheckstatus}}

Reason:Long-time disruptive edits on Volvo-related articles. Sjö (talk) 15:13, 3 April 2023 (UTC)

It might be a residential proxy. A block is likely to be pointless, since these usually rotate quickly. Closing. MarioGom (talk) 21:29, 26 April 2023 (UTC)

185.100.217.90

{{proxycheckstatus}}

Reason: LTA disruptive editing on Volvo-related articles. Sjö (talk) 20:53, 5 April 2023 (UTC)

It might be a residential proxy. A block is likely to be pointless, since these usually rotate quickly. Closing. MarioGom (talk) 21:29, 26 April 2023 (UTC)

208.185.0.0/15

{{proxycheckstatus}}

Reason: Proxy server; see stalktoy. Firestar464 (talk) 16:53, 17 April 2023 (UTC)

/15 is too broad. There are already narrower blocks for problematic individual addresses and ranges. Closing. MarioGom (talk) 21:40, 26 April 2023 (UTC)

195.210.104.0/22

{{proxycheckstatus}}

Range owned by iproyal.com (see whois). Used by WP:ABTACH. MarioGom (talk) 18:58, 21 March 2023 (UTC)

45.84.39.35

{{proxycheckstatus}}

Reason: NordVPN exit node, and a likely residential proxy based on Spur data. I've done a quick check on the /24, and it looks like the NordVPN range starts at .39.6 and continues until .39.254. I've not had the time to check the entire range though to see if it's continuous NordVPN all the way through, but every IP I did check seems to be a NordVPN exit node and active on one or more residential proxy services.

Note, became aware of this IP after seeing disruptive editing/vandalism on Gender-affirming surgery. Sideswipe9th (talk) 22:27, 3 April 2023 (UTC)

 Confirmed, also "Packethub S.A." is a common identifier for them. Please, block the /24. MarioGom (talk) 12:57, 6 April 2023 (UTC)

31.31.72.0/21

{{proxycheckstatus}}

Wedos hosting services (wedos.com), lots of abused proxies here. MarioGom (talk) 16:02, 27 April 2023 (UTC)

38.240.224.0/21

{{proxycheckstatus}}

Reason: Web hosting server run by Tech Futures Interactive. Used by LTA twice wizzito | say hello! 04:42, 8 April 2023 (UTC)

Which LTA? 38.240.226.92 (talk) 21:49, 14 April 2023 (UTC)
You. wizzito | say hello! 00:57, 20 April 2023 (UTC)
Who's me? Check here: https://en.wikipedia.org/wiki/Special:Contributions/38.240.224.0/21
I have no idea what you're referring to. Who exactly is abusing this range? From the looks of it I see that not just one person is using it. 38.240.226.60 (talk) 21:43, 20 April 2023 (UTC)
A few IPs in the range, including the ones that signed the comments above, are Mullvad VPN exit nodes according to Spur. The /21 range is a hosting provider, since it's full of webhost and mail servers. Please, block the range as a webhost block. Thank you. MarioGom (talk) 21:37, 26 April 2023 (UTC)

198.140.141.0/24

{{proxycheckstatus}}

Reason: VPN/Dedicated servers. 73.67.145.30 (talk) 19:06, 22 April 2023 (UTC)

This was blocked as proxy on ru.wiki and zh.wiki ☆ Bri (talk) 21:11, 22 April 2023 (UTC)

46.44.180.230

{{proxycheckstatus}}

Reason: https://eu-browse.startpage.com/av/proxy --46.44.180.230 (talk) 15:19, 17 March 2023 (UTC)

Indeed. This is startpage's proxy: [3]. MarioGom (talk) 00:20, 19 March 2023 (UTC)
Blocked. firefly ( t · c ) 10:29, 10 June 2023 (UTC)

216.24.45.0/24

{{proxycheckstatus}}

Reason: VPN server (Menlo or Supervpn360). Fraud Score: 75 from IPQualityScore. Also see stalktoy - 216.24.45.0/24 blocked at ru.wiki. ☆ Bri (talk) 17:05, 19 April 2023 (UTC)

I'd recommend blocking the /24. The full range is, indeed, Menlo Security, which provides some sort of VPN service. See whois and spur. MarioGom (talk) 21:45, 26 April 2023 (UTC)
Blocked the range for 2 years. firefly ( t · c ) 10:32, 10 June 2023 (UTC)

176.112.144.0/20

{{proxycheckstatus}}

Reason: Public proxy server run by Astrec Data OU wizzito | say hello! 00:56, 20 April 2023 (UTC)

Yep. It's some sort of cloud provider, see astrec.data / pilvio.com. The range could get a webhost block. MarioGom (talk) 21:49, 26 April 2023 (UTC)
Blocked 2 years. firefly ( t · c ) 10:33, 10 June 2023 (UTC)

45.86.231.0/24

{{proxycheckstatus}}

Reason: Confirmed VPS hosting IP range (see Blue VPS). 73.67.145.30 (talk) 03:18, 8 May 2023 (UTC)

Blocked 2y. firefly ( t · c ) 10:48, 10 June 2023 (UTC)

138.124.187.0/24

{{proxycheckstatus}}

Reason: Webhosting/VPN range. 73.67.145.30 (talk) 17:14, 10 May 2023 (UTC)

Blocked 2y. firefly ( t · c ) 10:49, 10 June 2023 (UTC)

213.104.126.185

{{proxycheckstatus}}

Reason: LTA at this IP and others on 213.104.126.0/24, including:

This LTA frequently targets Eliza Scanlen and Bebe Bettencourt and many films, where the LTA adds "Nova Lee LeClair" as a cast member with no sourcing.

This LTA is also hopping around on IPs on 213.107.0.0/17 and 62.254.0.0/18.  — Archer1234 (t·c) 08:25, 10 June 2023 (UTC)

Not seeing any indications that these are proxies. firefly ( t · c ) 10:37, 10 June 2023 (UTC)

198.252.153.0/24, 199.254.238.0/24, and 204.13.164.0/24

{{proxycheckstatus}}

Reason: These three ranges belong to Riseup Networks, which is a VPN service for "censorship circumventation". [4][5] Deauthorized. (talk) 21:13, 2 July 2023 (UTC)

  • Globally blocked by AmandaNP a few days ago, so I will self-close this request.

2A0C:5C84:1:6004:0:0:0:32B5

{{proxycheckstatus}}

Reason: VPN. 73.67.145.30 (talk) 04:20, 26 May 2023 (UTC)

Open proxy blocked IP range was globally blocked as an open proxy/webhost a few hours ago. Closing. Sideswipe9th (talk) 04:14, 15 July 2023 (UTC)

135.148.233.0/17: Veepn VPN

{{proxycheckstatus}}

Spur reports it is Veepn VPN; whatismyipaddress.com states it is a VPN server, "Recently reported forum spam source" Dubious AfD voting here. ☆ Bri (talk) 15:08, 12 July 2023 (UTC)

Looked a little more at the range 135.148.128.0/17 and found some more dubious AfD votes. We might have either UPE editors or a UPE scammer or scam ring here; this talkpage comment makes it clear they are aware of such things. ☆ Bri (talk) 15:41, 12 July 2023 (UTC)
BTW this whole thing came to my attention when one of the IPs tagged a draft in my userspace for notability (!), consistent with preparation for a UPE effort. ☆ Bri (talk) 17:32, 12 July 2023 (UTC)
You are one of the most obvious cases of UPE on this platform.. 1300 articles and at least a quarter of them are obvious paid editing. There are so many promotional hemp companies, I just about fell on the floor looking at them all.. 135.148.233.37 (talk) 02:34, 14 July 2023 (UTC)
The range has been globally blocked. Deauthorized. (talk) 03:09, 14 July 2023 (UTC)
The range has been globally blocked for a year as a possible proxy. Closing the case for archiving. Sideswipe9th (talk) 03:55, 15 July 2023 (UTC)

81.25.28.1

{{proxycheckstatus}}

Reason: Disruption. Marked as a public proxy server. 73.67.145.30 (talk) 18:25, 30 April 2023 (UTC)

  • This is likely a residential proxy based on the data available. These usually rotate quickly, and this particular IP hasn't been active since the report in April. If it becomes active again, in theory ST47ProxyBot should catch this. Not seeing any evidence of public proxy use so no Closing without action Sideswipe9th (talk) 18:49, 17 July 2023 (UTC)

103.111.0.0/16 and 103.119.0.0/16

{{proxycheckstatus}}

Suspicious beauty pageant SPA edits in range.

103.119.62.2 103.119.62.15 almost certainly the same operator, I think there is a second range. ☆ Bri (talk) 17:55, 25 April 2023 (UTC)
103.111.143.41 another. IPcheck says it is a proxy, 100% abuse score. Blocked on ru.wiki (expanded range to match). ☆ Bri (talk) 18:50, 25 April 2023 (UTC)
Here are edits showing probably the same operator using both ranges on the same article in a ~half hour time span. First pair, IP on 103.111 range at 10:41 followed by IP on 103.119 range [6]. Second pair, same day, different article – same IP on 103.111 range at 10:42 followed by IP on 103.119 range [7]. ☆ Bri (talk) 21:08, 25 April 2023 (UTC)
  • ☒N Stale / no Declined Had a quick look at the three IPs listed, and I'm not seeing any evidence of current proxy activity through Spur and Shodan. Any block that was on 103.111.143.41 seems to have expired and may possibly have been a range block. Were these IPs more spread apart I would suspect they might have been part of a residential proxy service at the time of this report, and have since left it. But because of the relative closeness of these IPs, I suspect this might have just been CGNAT related. Closing without action. Sideswipe9th (talk) 21:58, 18 July 2023 (UTC)

133.114.163.71

{{proxycheckstatus}}

Reason: Possible VPN. 73.67.145.30 (talk) 17:33, 9 May 2023 (UTC)

Not currently an open proxy ip address used for so-net, an japanese internet service provider Notrealname1234 (talk) 16:31, 21 June 2023 (UTC)
Not currently an open proxy Confirm what Notrealname1234 has said, this doesn't appear to be a proxy and is an average connection on a residential ISP. Closing without action. Sideswipe9th (talk) 22:08, 18 July 2023 (UTC)

103.135.39.174

{{proxycheckstatus}}

Reason: Listed as a Public proxy server at whatismyipaddress.com/ip/103.135.39.174 and proxy with recent abuse at ipcheck.toolforge.org/index.php?ip=103.135.39.174. Mojoworker (talk) 03:57, 11 May 2023 (UTC)

  • Not currently an open proxy While I can confirm that whatismyipaddress and IPQualityScore is listing it as a public proxy, the IP doesn't appear to currently be a proxy after checking through other means. However it's part of a /23 range that was softblocked for 2 years starting on 2 June 2023. Closing without further action. Sideswipe9th (talk) 22:27, 18 July 2023 (UTC)

202.125.32.0/20 webhost plus smaller PIA VPN range

{{proxycheckstatus}}

ftools on Toolforge is telling me that 202.125.43.0/25 · contribs · block · log · stalk · Robtex · whois · Google would cover the whole range for the subset of PIA VPN IPs, which it would but with some overlap. But I guess that's fine with the /20 being a webhost anyway? Sideswipe9th (talk) 21:02, 18 July 2023 (UTC)
@Sideswipe9thBlocked the /20 for three years. Courcelles (talk) 20:57, 18 July 2023 (UTC)
@Courcelles: Awesome, thanks! If we're happy to leave it with a 3 year block on the /20 then I'll close this off. Sideswipe9th (talk) 21:03, 18 July 2023 (UTC)
@Sideswipe9thI am, I can’t see anything else being a beneficial use of our time. Courcelles (talk) 21:08, 18 July 2023 (UTC)
@Courcelles: No worries. Closed as resolved. Thanks again :) Sideswipe9th (talk) 21:09, 18 July 2023 (UTC)

144.178.6.38

{{proxycheckstatus}}

Reason: WHOIS returns Apple Inc. data center, spur confirms; sus edits ☆ Bri (talk) 23:53, 5 June 2023 (UTC)

More disruptive edits from the IP today [8] ☆ Bri (talk) 22:55, 7 June 2023 (UTC)
I don't think this is a colo/hosting datacentre, my suspicion is that it's one of Apple's corporate offices (or the datacentre that their connections route through). firefly ( t · c ) 10:44, 10 June 2023 (UTC)
@Firefly: I'd agree with that assessment. I'm also not seeing any evidence of proxy or VPN services through the usual sources. If there's no objection, I'll mark this as closed without action. Sideswipe9th (talk) 23:39, 18 July 2023 (UTC)
Sideswipe9th closed! :) firefly ( t · c ) 08:48, 21 July 2023 (UTC)

216.194.96.0/20

{{proxycheckstatus}}

Reason: IP range is a possible VPN server, belonging to Cato Networks. 73.67.145.30 (talk) 19:22, 9 January 2023 (UTC)

  •  Confirmed I can confirm the /20 is allocated to Cato Networks, and many of the IPs within seem to be active on Cato's VPN product, as well as at least one IP being active on a residential proxy service according to Spur. While the residential proxies are typically non-legitimate, Cato's primary VPN product seem to be akin to similar products also aimed at corporate customers like McAfee WGCS, Zscaler, and GlobalProtect (examples of which are currently under discussion elsewhere here). There's also some webservers hosted within the range as well. A softblock on the /20 might be appropriate in the circumstances. Sideswipe9th (talk) 21:32, 18 July 2023 (UTC)

61.220.170.133

{{proxycheckstatus}}

Reason: Open proxy IP being used by a blocked user Belteshazzar, also mentioned at their SPI [9] Psychologist Guy (talk) 17:47, 31 January 2023 (UTC)

45.134.110.0/24

{{proxycheckstatus}}

Reason: Data center run by Kuroit (web hosting company) wizzito | say hello! 01:04, 20 April 2023 (UTC)

  •  Confirmed I'm seeing many web servers, some mail servers, and other services within this range per Shodan. Also seeing some IPs, including the only one to have made enwiki contributions, being active on a handful of common residential proxy services per Spur data. The range is currently being announced by LevelOneServers/DotTechLLC. The /24 should be safe to {{webhostblock}}. Sideswipe9th (talk) 22:45, 18 July 2023 (UTC)

209.80.128.102

{{proxycheckstatus}}

Reason: Possible VPN server per WHOIS. 73.67.145.30 (talk) 15:36, 1 May 2023 (UTC)

  •  Likely Shodan showed something interesting, and upon a little digging this does appear to be a VPN server. The IP is assigned to a cloud hosting provider, with the full range being 209.80.128.0/17. However within that range, 209.80.128.0/27 is assigned to a public school district. Not sure if a range block on either would be appropriate, but I think we might be able to give this specific IP a webhost block. Sideswipe9th (talk) 21:00, 17 July 2023 (UTC)

185.69.144.152

{{proxycheckstatus}}

Reason: This IP address has two prior short blocks for being a proxy. I have blocked it again for 31 hours due to recent vandalism. Please check if it is still a proxy. ~Anachronist (talk) 13:33, 14 July 2023 (UTC)

  • Based on what I can see currently, this is unlikely to be a proxy. The two block log entries suggest a type of proxy that expires relatively quickly, and ST47ProxyBot hasn't blocked this specific IP in about two years. Sideswipe9th (talk) 03:53, 15 July 2023 (UTC)
    P2P proxy blocks should generally be left to the bot unless there is ongoing disruption. Obviously any admin can do escalating blocks, but there's not much to do in terms of proxy blocking. Closing. MarioGom (talk) 21:23, 27 July 2023 (UTC)

103.221.55.106

{{proxycheckstatus}}

Reason: IP address has several short-term proxy blocks in its block log. I just blocked it for a month for spam activity that has lasted about as long, but given the numerous past proxy blocks, I wondered if it would be worthwhile to check again. ~Anachronist (talk) 13:40, 16 July 2023 (UTC)

  • I think this is likely a residential proxy, and that would match up with the blocks by ST47ProxyBot in August 2022. Not sure why they weren't autoblocked when they edited recently though. Marking for a second opinion in case I missed something obvious. Sideswipe9th (talk) 22:30, 16 July 2023 (UTC)
    P2P proxy detection is not exhaustive. Detection can be delayed or missed, or it can be an unsupported proxy service. Just as above, feel free to escalate blocks based on disruption. Closing. MarioGom (talk) 21:27, 27 July 2023 (UTC)

205.253.38.215

{{proxycheckstatus}}

Reason: This user is making unnecessary changes to some living persons filmographies and spamming the changes which is not related to the person. Arctic Writer (talk) 12:04, 25 July 2023 (UTC)

Not a proxy. Closing. MarioGom (talk) 21:28, 27 July 2023 (UTC)

207.188.154.0/24

{{proxycheckstatus}}

207.188.154.0/24 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Just globally unblocked the range after an UTRS appeal. From WHOIS data this seems to belong now to Xfera Móviles S.A.U, from the MasMovil group ISP (Yoigo). Thanks, —MarcoAurelio (talk) 14:39, 16 February 2023 (UTC)

I'm not so sure. Whois data certainly looks like MásMóvil (mobile ISP), but the IP that appealed, 207.188.154.103, seemed to be a VPN node as recently as January 21st (see shodan). ST47: Do you have any input on this? I guess it can be unblocked and reviewed again in a few weeks. MarioGom (talk) 12:43, 19 February 2023 (UTC)
I took another look at the range. Services in that range are mostly Synology, HomeAssist, domestic routers, etc. So it is, indeed, a residential range. MarioGom (talk) 21:23, 7 March 2023 (UTC)

76.9.240.0/20

{{proxycheckstatus}}

Reason: Possible VPN server per WHOIS. 73.67.145.30 (talk) 17:25, 2 May 2023 (UTC)

117.210.138.86

{{proxycheckstatus}}

Suspected Nord VPN ip Reason: Suspected Nord VPN ip Tonyinman (talk) 18:20, 15 May 2023 (UTC)

  • @Tonyinman: I was wondering if you could give some information as to why you suspect that this, and the other IPs you listed at the same time as this are NordVPN server IPs? All of these IP's geolocate to India, and according to NordVPN's website they haven't operated any servers in that country since the end of June 2022. Sideswipe9th (talk) 17:17, 17 July 2023 (UTC)
  • Given the absence of any evidence that these are proxies and the absence of a response, I'm no Closing without action. --Blablubbs (talk) 20:55, 18 August 2023 (UTC)

59.91.229.198

{{proxycheckstatus}}

Reason: Suspected NordVPN address Tonyinman (talk) 18:21, 15 May 2023 (UTC)

117.210.142.151

{{proxycheckstatus}}

Reason: suspected NordVPN ip address Tonyinman (talk) 18:22, 15 May 2023 (UTC)

59.91.224.115

{{proxycheckstatus}}

Reason: suspected NordVPN ip address Tonyinman (talk) 18:22, 15 May 2023 (UTC)

61.1.23.137

{{proxycheckstatus}}

Reason: suspected NordVPN ip address Tonyinman (talk) 18:23, 15 May 2023 (UTC)

59.91.229.17

{{proxycheckstatus}}

Reason: suspected NordVPN ip address Tonyinman (talk) 18:24, 15 May 2023 (UTC)

66.168.171.57

{{proxycheckstatus}}

Reason: Suspected NordVPN ip address Tonyinman (talk) 18:25, 15 May 2023 (UTC)

59.91.227.166

{{proxycheckstatus}}

Reason: suspected NordVPN ip address Tonyinman (talk) 18:25, 15 May 2023 (UTC)

45.248.44.0/23

{{proxycheckstatus}}

Reason: Webhost server. Was previously blocked for 1 year. 2601:1C0:4401:F60:758F:D0D6:53AE:83C1 (talk) 18:13, 29 June 2023 (UTC)

  •  Confirmed Range is still assigned by a web hosting provider. The IPs that were actively contributing through this recently are also all active on multiple residential proxy services and at least one VPN provider according to Spur's data. The range itself was webhostblocked by Daniel Case on 17 July 2023, however I would recommend additionally hardblocking 45.248.45.90 through 45.248.45.99 inclusive due to being active on a VPN service and multiple residential proxy services. Sideswipe9th (talk) 23:35, 18 July 2023 (UTC)

92.40.199.51

{{proxycheckstatus}}

Reason: API-confirmed P2P VPN. Obviously used by a LTA. Blocked previously. LilianaUwU (talk / contributions) 22:46, 15 August 2023 (UTC)

I haven't run extensive checks, but I consider this to be unlikely. -- zzuuzz (talk) 22:54, 15 August 2023 (UTC)
@Zzuuzz: Check the Spur data on Bullseye. It's a cell/mobile connection, but it's reported active on multiple residential proxy services. Sideswipe9th (talk) 23:11, 15 August 2023 (UTC)
Its current usage is not proxy usage. -- zzuuzz (talk) 23:19, 15 August 2023 (UTC)

208.87.236.201

{{proxycheckstatus}}

Reason: IPs 208.87.232.0 - 208.87.239.255 belong to ForcePoint Cloud Services which operate HTTP/HTTPS proxy servers, per https://www.websense.com/content/support/library/web/hosted/getting_started/how_wsc_works.aspx. Range has been blocked before and specific IP has recently voted in an RfD. TarnishedPathtalk 09:04, 18 August 2023 (UTC)

Note, this is Brooklyn Public Library; see Wikipedia:Administrators'_noticeboard/Archive351#Editing_from_the_Brooklyn_Public_Library. -- zzuuzz (talk) 15:49, 18 August 2023 (UTC)
That's merely an assertion as far as I can tell and looking at this gives a good indication why proxies shouldn't by allowed. TarnishedPathtalk 16:15, 18 August 2023 (UTC)
You can disagree with that assertion as much as you like. No one has looked at that address more than me. I am going to anonblock it for a long time forthwith; discussion may of course continue. -- zzuuzz (talk) 16:19, 18 August 2023 (UTC)
No comment on you. Comment on now blocked editor previously requesting the unblock. TarnishedPathtalk 16:30, 18 August 2023 (UTC)
Having blocked that user I can assure you that I've also closely examined them, their motivations, their activity, and their IP addresses. So look I maintain this is Brooklyn Public Library (think of that what you will, there are also librarians there). Other addresses in the /21 do get used, and there is quite a lot of potential collateral. I count something like 50 accounts within the last few months. -- zzuuzz (talk) 16:48, 18 August 2023 (UTC)
I understand. What happens if a public library somewhere else decides to use NordVPN or ExpressVPV? TarnishedPathtalk 17:06, 18 August 2023 (UTC)
I've never seen that happen and consider it unlikely :) Forcepoint is basically equivalent to Zscaler, and my views on Zscaler have been previously well declared, and there's a general consensus not to hard block them unless you have to. They're mostly used by big boring corporates, or similar groups with lots of money, big rulebooks, and high risks. The people using them are usually highly educated and in expert niches. On the whole they're pretty well behaved. NordVPN and other bargain VPNs are frequently used by trash. Brooklyn Public Library is something of a special case with quite a few considerations to balance including the socks who sometimes visit and the nature of the high collateral. I'd consider it a well-studied address. -- zzuuzz (talk) 17:32, 18 August 2023 (UTC)
Thanks for your explanation. TarnishedPathtalk 17:55, 18 August 2023 (UTC)
notably the user that requested that IP range be unblocked is now blocked indef. TarnishedPathtalk 16:21, 18 August 2023 (UTC)
Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=Wikipedia:WikiProject_on_open_proxies/Requests/Archives/48&oldid=1171112601"