 | This page is an archive. Do not edit the contents of this page. Please direct any additional comments to the current main page. |
Colocation America Corporation & Kvchosting.com LLC
– This proxy check request is closed and will soon be archived by a bot.
- 216.74.107.5 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 38.131.148.84 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits, WHOIS (ip #1) gives Colocation America Corporation: could be webhost type proxy. IP #2 gives Kvchosting.com LLC; similar edits to same artcle in same time frame. ☆ Bri (talk) 20:05, 27 August 2018 (UTC)
Range blocked 216.74.104.0/21 (talk · contribs) as a colo. GABgab 01:32, 28 August 2018 (UTC)
Not done on the second IP. Cogent / PSINet provides connectivity. Based on other checks, I don't think this is a colocation host. SQLQuery me! 08:41, 2 September 2018 (UTC)
192.155.96.0/20
– This proxy check request is closed and will soon be archived by a bot.
Reason: Possibly a webhosting server. Belongs to "HEG US". 2601:1C0:4401:24A0:75E3:C82B:A5D1:606B (talk) 05:59, 28 August 2018 (UTC)
- Yep, Heg / godaddy. Blocked all the non-blocked heg and godaddy ranges as well. SQLQuery me! 08:38, 2 September 2018 (UTC)
104.37.168.0/22
– This proxy check request is closed and will soon be archived by a bot.
Reason: Reprise Hosting: [1]. 73.240.4.160 (talk) 05:41, 30 August 2018 (UTC)
– This proxy check request is closed and will soon be archived by a bot.
Reason: Using NuclearWarfare's mark-blocked script, a majority of these IP address to not appear to be blocked nor locked anywhere, but I'm not sure how to actually access them. If someone could check and verify (even just one), that'd be great. Zeke Essiestudy (talk) 21:11, 31 August 2018 (UTC)
122.155.168.20
– This proxy check request is closed and will soon be archived by a bot.
- 122.155.168.20 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Evading scrutiny on WP:ANI. GenuineArt (talk) 05:15, 6 September 2018 (UTC)
38.142.216.42
– This proxy check request is closed and will soon be archived by a bot.
- 38.142.216.42 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Only disruptive editing, vandalism. Used by obvious sock of user:shingling334, but also for vandalism that doesn't fit shinging334's pattern. IamNotU (talk) 21:52, 6 September 2018 (UTC)
- This has now been blocked for a year, so I'll close the request, hope that's ok... IamNotU (talk) 01:45, 12 September 2018 (UTC)
38.122.207.34
– This proxy check request is closed and will soon be archived by a bot.
- 38.122.207.34 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Used today by obvious sock of user:shingling334. Previous uses all vandalism/disruptive. IamNotU (talk) 16:52, 7 September 2018 (UTC)
- This has now been blocked so I marked it as closed. IamNotU (talk) 01:47, 12 September 2018 (UTC)
38.30.28.202
– This proxy check request is closed and will soon be archived by a bot.
- 38.30.28.202 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Currently in use by obvious sock of user:shingling334. Previous uses all vandalism/disruptive. IamNotU (talk) 16:57, 7 September 2018 (UTC)
- Blocked by User:Zzuuzz, marking it closed. IamNotU (talk) 01:49, 12 September 2018 (UTC)
46.29.2.111
– This proxy check request is closed and will soon be archived by a bot.
- 46.29.2.111 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Sock Puppetry Ryanoo (talk) 19:12, 7 September 2018 (UTC)
- This is pretty clearly a webhost. I've blocked the range, as well as all the other Lertas ranges. SQLQuery me! 23:27, 7 September 2018 (UTC)
45.123.118.159
– This proxy check request is closed and will soon be archived by a bot.
- 45.123.118.159 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits, whatismyipaddress.com reports network sharing device or proxy. ☆ Bri (talk) 15:42, 22 September 2018 (UTC)
- Range blocked as a colo. GABgab 16:04, 22 September 2018 (UTC)
- thx. Note to self, WHOIS = SERVERFIELD (Taiwan colo or cloud compute center). ☆ Bri (talk) 16:22, 22 September 2018 (UTC)
184.175.64.0/18
– This proxy check request is closed and will soon be archived by a bot.
Reason: Disruptive edits coming from 184.175.102.29 (talk · contribs · WHOIS). Per WHOIS, the IP block range for this webhost is 184.175.64.0/18. Belongs to Cybercon dedicated webhosting servers. 49.142.7.206 (talk) 17:57, 24 September 2018 (UTC)
5.2.200.163
– This proxy check request is closed and will soon be archived by a bot.
- 5.2.200.163 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Reported possible open proxy: RCS-RDS («mail.bjmures.ro») which is located in Mures County. Thanks! 109.102.200.16 (talk) 18:34, 25 September 2018 (UTC)
Checking... SQLQuery me! 16:42, 26 September 2018 (UTC)
Likely IP is an open proxy SQLQuery me! 16:47, 26 September 2018 (UTC)
194.0.64.0/22
– This proxy check request is closed and will soon be archived by a bot.
Reason: Ricoh Hosting. Dedicated webhosting servers. 98.151.240.200 (talk) 19:57, 25 September 2018 (UTC)
197.220.169.151
– This proxy check request is closed and will soon be archived by a bot.
- 197.220.169.151 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits. First edit in a long time is to my talkpage apparently suddenly interested in harrassing me and another editor--sock or evasion behavior but I don't know the master and CU can't just blindly fish there. whatismyipaddress reports:
Services: Network sharing device or proxy server Type: Wireless Broadband Assignment: Static IP
which sounds like open-proxy (static but shared/proxy-server). But I don't know anything about that provider if that is reliable info. DMacks (talk) 06:28, 24 September 2018 (UTC)
- Checking... SQLQuery me! 16:42, 26 September 2018 (UTC)
- DMacks - There are some indicators that a proxy is/was operating somewhere in the /19 surrounding that IP (lots of DNSBL hits - [2]), but at this time that host does not appear to be an open proxy. This appears to be a cellular range, and it's common for IP's to change rapidly in this case. SQLQuery me! 16:58, 26 September 2018 (UTC)
158.106.91.4
– This proxy check request is closed and will soon be archived by a bot.
- 158.106.91.4 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits on ro.wikipedia. Per https://www.ip2location.com/demo/158.106.91.4 Thank you. --37.6.109.144 (talk) 19:58, 27 September 2018 (UTC)
- Without a doubt that's a VPN. The entire range also appears to be a webhost. /18 Blocked. SQLQuery me! 21:06, 30 September 2018 (UTC)
41.164.30.218
– This proxy check request is closed and will soon be archived by a bot.
- 41.164.30.218 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: These two proxy checkers: [3] and [4] both state that this is an open proxy. Not sure how reliable those are, though. Nmap also found a bunch of open ports on this IP address as well... 124.122.90.177 (talk) 18:48, 4 October 2018 (UTC)
- It appears to be a residential connection, running a VPN. When I google it, it does appear on some proxy lists, but none of the ports mentioned appear to be open. It appears to be on some spambl's as well, but it's possible at this point that the proxy customer has moved on / been disconnected. Unfortunately, for now it's
Inconclusive SQLQuery me! 21:56, 4 October 2018 (UTC)
188.2.135.66
A user has requested a proxy check. A proxy checker will shortly look into the case.
- 188.2.135.66 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits on en.wikipedia and ro.wikipedia --Pafsanias (talk) 18:24, 9 October 2018 (UTC)
- Never mind. IP address already blocked on Romanian Wikipedia. No other edits within the past week. Thank you. --Pafsanias (talk) 00:05, 21 October 2018 (UTC)
69.193.69.244
– This proxy check request is closed and will soon be archived by a bot.
- 69.193.69.244 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Vandalistic edits since October 13, 2015, even after many warnings
--14:50, 15 October 2018 (UTC)Gpkp (u • t • c)
1.10.189.91
– This proxy check request is closed and will soon be archived by a bot.
- 1.10.189.91 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits Beyond My Ken (talk) 15:40, 23 October 2018 (UTC)
177.85.90.33
– This proxy check request is closed and will soon be archived by a bot.
- 177.85.90.33 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits Beyond My Ken (talk) 15:42, 23 October 2018 (UTC)
190.64.147.18
– This proxy check request is closed and will soon be archived by a bot.
- 190.64.147.18 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits Beyond My Ken (talk) 15:44, 23 October 2018 (UTC)
185.247.136.200
– This proxy check request is closed and will soon be archived by a bot.
- 185.247.136.200 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits Beyond My Ken (talk) 15:47, 23 October 2018 (UTC)
45.119.91.111
– This proxy check request is closed and will soon be archived by a bot.
- 45.119.91.111 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Only 1 post, but by comment made in that post, clearly seems to be recent ref-desk troll who has been disrupting the reference desk and causing all of the problems that led to them being shut down. --Jayron32 15:12, 29 October 2018 (UTC) Reason: Suspicious edits Jayron32 15:12, 29 October 2018 (UTC)
139.180.192.0/19
– This proxy check request is closed and will soon be archived by a bot.
Reason: Choopa/webhosting servers 119.18.174.67 (talk) 06:23, 1 November 2018 (UTC)
88.12.3.152
– This proxy check request is closed and will soon be archived by a bot.
- 88.12.3.152 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: This proxy check indicates that it's an open proxy, not to mention that it has been blocked by the proxy bot in the past as well. 47.149.143.100 (talk) 19:29, 4 October 2018 (UTC)
- I've checked this repeatedly over the last month, and I've not seen any technical evidence that this is currently a proxy. There do appear to be some lingering RBL entries, but those are likely stale. SQLQuery me! 08:22, 19 November 2018 (UTC)
185.180.196.0/22
– This proxy check request is closed and will soon be archived by a bot.
Reason: All IP addresses from 185.180.196.0 to 185.180.199.255 belong to King Servers (dedicated webhosting servers). 2601:1C0:4401:24A0:F427:6E8F:5237:1F6F (talk) 05:23, 11 October 2018 (UTC)
79.115.41.253
– This proxy check request is closed and will soon be archived by a bot.
- 79.115.41.253 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Apparent proxy/attack source. 2601:1C0:4401:24A0:7D2D:D646:4903:9614 (talk) 05:42, 12 October 2018 (UTC)
151.237.192.0/19 & 176.56.96.0/19
– This proxy check request is closed and will soon be archived by a bot.
- 151.237.192.0/19 · contribs · block · log · stalk · Robtex · whois · Google
- 176.56.96.0/19 · contribs · block · log · stalk · Robtex · whois · Google
Reason: Both IP ranges belong to "ServiHosting Networks S.L." (webhosting/dedicated server networks). 73.240.4.160 (talk) 05:51, 12 October 2018 (UTC)
103.254.208.0/22
– This proxy check request is closed and will soon be archived by a bot.
Active IP range that was recently active on 103.254.208.148 (talk · contribs · WHOIS). This range has been blocked in the past. 2601:1C0:4401:24A0:D30:1D07:A2EE:90DB (talk) 07:14, 22 October 2018 (UTC)
172.83.40.67
– This proxy check request is closed and will soon be archived by a bot.
- 172.83.40.67 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits
- WHOIS states that the /24 range at 172.83.40.0/24 is operated by Total Server Solutions. From their web site they are a web hosting company. Edits from this range have been reported at WP:AN3. I've blocked the range for three months anon-only as ((webhostblock)). Offering this for review here to be sure I did it correctly. If confirmed, a block of one year or more might be reasonable. EdJohnston (talk) 20:55, 23 October 2018 (UTC)
- EdJohnston, Yep - that's a hosting range. I've re-blocked it as a 1-year long hardblock, and cleaned up the other non-blocked TSS ranges. SQLQuery me! 23:08, 8 November 2018 (UTC)
192.93.8.156
– This proxy check request is closed and will soon be archived by a bot.
- 192.93.8.156 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Used by country-hopping spammer. IamNotU (talk) 22:33, 2 November 2018 (UTC)
- IamNotU -
Unlikely IP is an open proxy. Unfortunately, I wasn't able to find any technical evidence that this IP is presently an open proxy. SQLQuery me! 03:03, 9 November 2018 (UTC)
80.179.42.39 Comment
– This proxy check request is closed and will soon be archived by a bot.
- 80.179.42.39 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Used by obvious sock of Shingling334 known to use proxies, ipqualityscore.com score 95 "Proxy/VPN Detected" IamNotU (talk) 22:52, 8 November 2018 (UTC)
- IamNotU, HQServ indeed appears to be a VPS. Blocked, and I'll try to find more ranges belonging to this hosting provider to block. SQLQuery me! 02:57, 9 November 2018 (UTC)
107.77.249.6 Comment
– This proxy check request is closed and will soon be archived by a bot.
- 107.77.249.6 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Long history of vandalism and blocks, "confirmed proxy server" by whatismyipaddress.com, proxy score 100 at ipqualityscore.com. IamNotU (talk) 22:23, 14 November 2018 (UTC)
46.229.160.0/20
– This proxy check request is closed and will soon be archived by a bot.
Reason: Webhosting server. Most recently active on 46.229.172.183 (talk · contribs · WHOIS). Range was blocked for 1 year in September 2017 as a webhosting server. 73.110.138.115 (talk) 08:02, 19 November 2018 (UTC)
- Yep, that's a webhost. I've blocked all the relevant ranges. SQLQuery me! 08:11, 19 November 2018 (UTC)
77.247.80.0/21
– This proxy check request is closed and will soon be archived by a bot.
Reason: SysEleven webhosting servers. Was blocked for 1 year in November 2017. 211.202.138.37 (talk) 18:51, 26 November 2018 (UTC)
77.247.64.0/20
– This proxy check request is closed and will soon be archived by a bot.
Reason: Rackhosting cloud servers. 211.202.138.37 (talk) 18:51, 26 November 2018 (UTC)
95.168.177.215
– This proxy check request is closed and will soon be archived by a bot.
- 95.168.177.215 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Used by obvious sock of User:Shingling334. IamNotU (talk) 23:38, 26 November 2018 (UTC)
- IamNotU, Yep, colocation host Leaseweb. Blocking 95.168.176.0/21, and I'll start looking for more leaseweb ranges. SQLQuery me! 23:43, 26 November 2018 (UTC)
177.21.103.136
– This proxy check request is closed and will soon be archived by a bot.
- 177.21.103.136 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Ongoing weird ref desk questions –Deacon Vorbis (carbon • videos) 05:17, 28 November 2018 (UTC)
165.161.16.45
– This proxy check request is closed and will soon be archived by a bot.
- 165.161.16.45 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits. Probably banned editor HarveyCarter. Beyond My Ken (talk) 17:38, 28 November 2018 (UTC)
62.215.100.42
– This proxy check request is closed and will soon be archived by a bot.
- 62.215.100.42 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Suspicious edits, causing disruption at both Catgirl and Template:Furry fandom. A proxy has been used before to cause similar disruption back in October. Protection might be needed on affected pages for persistent sock puppetry. 66.87.149.92 (talk) 02:13, 18 December 2018 (UTC)
185.117.89.70
– This proxy check request is closed and will soon be archived by a bot.
- 185.117.89.70 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Currently being used by blocked user Shingling334. ipqualityscore.com reports it as a proxy. IamNotU (talk) 21:44, 19 December 2018 (UTC)
- Now blocked as colocation webhost by zzuuzz. --IamNotU (talk) 23:19, 21 December 2018 (UTC)