Eisspeedway

Wikipedia:WikiProject Open proxies/Requests/Archives/51


2602:FFE4:C0D:801E:0:0:0:D101

{{proxycheckstatus}}

Reason: Another IP possibly using open proxies, continuing an edit-war started by two recently blocked IPs (for three years each one) for the same reason in Jüri Lina. PedroAcero76 (talk) 22:32, 12 December 2024 (UTC)

no Declined to run a check. 2602:ffe4:c0d::/48 is globally blocked until 20 December 2026. — Malcolmxl5 (talk) 13:09, 21 December 2024 (UTC)

94.156.149.0/24

{{proxycheckstatus}}

Reason: Packethub VPN range in active use. Kline • talk • contribs 14:10, 16 December 2024 (UTC)

Open proxy blocked. /24 blocked as a web host provider with multiple Nord VPN nodes. Malcolmxl5 (talk) 14:35, 20 December 2024 (UTC)

103.73.166.137

{{proxycheckstatus}}

Reason: I suspect block evasion from 202.84.62.34 (talk · contribs · WHOIS) who was blocked as a Vpngate proxy. This IP is probably also one. Nobody (talk) 06:35, 20 December 2024 (UTC)

Open proxy blocked. Spur identifies this as part of the VPN Gate anonymization network. Malcolmxl5 (talk) 11:35, 20 December 2024 (UTC)

195.216.176.19

{{proxycheckstatus}}

Recently abused, by WP:LTA/BMN123; they do tend to use a lot of p2p and short term residential stuff, but this one is showing up as a VPN server. So while they are unlikely to reuse it, someone else might; zh-wiki has actually blocked the entire /23 so its probably worth looking into. 184.152.68.190 (talk) 00:51, 21 December 2024 (UTC)

no Declined to run a check. 195.216.176.0/23 is globally blocked until 21 December 2026. Malcolmxl5 (talk) 11:43, 21 December 2024 (UTC)

81.168.120.217

{{proxycheckstatus}}

As with my report immediately above recently abused by WP:LTA/BMN123, reads as a datacenter and nlwiki has blocked the entire /24 184.152.68.190 (talk) 00:56, 21 December 2024 (UTC)

Open proxy blocked. Wikimedia IP information tool identifies this IP address as associated with a Proxy Seller proxy. Malcolmxl5 (talk) 12:00, 21 December 2024 (UTC)

23.88.240.21

{{proxycheckstatus}}

Same user as my previous report for 140.233.143.222. Also reported as a VPN proxy. Meters (talk) 02:29, 14 December 2024 (UTC)

Open proxy blocked. 23.88.224.0/19 has been blocked as a web host provider. Malcolmxl5 (talk) 16:53, 21 December 2024 (UTC)

23.88.248.210

{{proxycheckstatus}}

Yet another proxy being used by the same user as previously reported 23.88.240.21 and 140.233.143.222 Meters (talk) 04:42, 14 December 2024 (UTC)

Open proxy blocked. 23.88.224.0/19 has been blocked as a web host provider. Malcolmxl5 (talk) 16:52, 21 December 2024 (UTC)

2A0B:E40:1:0:0:0:0:0/48

{{proxycheckstatus}}

Reason: VPN by MEGA Cloud Services. Used by block-evading user. wizzito | say hello! 20:41, 21 December 2024 (UTC)

no Declined to run a check. 2a0b:e40:1::/48 is globally blocked until 21 December 2026. Malcolmxl5 (talk) 21:04, 21 December 2024 (UTC)
Yup, people at Metawiki are pretty quick wizzito | say hello! 21:47, 21 December 2024 (UTC)
Very quick! — Malcolmxl5 (talk) 01:00, 22 December 2024 (UTC)

190.90.160.164

{{proxycheckstatus}}

Reason: I highly suspect this is yet another proxy IP used by User:TyMega to evade their block. Looking at the page history of Tom Morello discography, the previous IPs used by this person such as 94.198.96.96, 5.42.206.146 and 179.27.200.45 are all blocked as "Urban VPN" proxies. — AP 499D25 (talk) 01:53, 24 December 2024 (UTC)

Open proxy blocked. Yes, this is very typical TyMega behaviour and another Urban VPN proxy. — Malcolmxl5 (talk) 02:05, 24 December 2024 (UTC)

140.233.143.222

{{proxycheckstatus}}

School page vandal. https://ipcheck.toolforge.org/index.php?ip=140.233.143.222 reports it as a VPN proxy. Meters (talk) 02:25, 14 December 2024 (UTC)

This IP address is owned by Middlebury College according to Robtex. — Malcolmxl5 (talk) 12:38, 21 December 2024 (UTC)
I'd imagine it's pretty similar to the situation at my school, where they use a provider that is marked as a proxy (which happens to be blocked, thanks Netskope!). Kline • talk • contribs 21:55, 21 December 2024 (UTC)
The user subsequently moved on to two other web hosts, now range blocked as 23.88.224.0/19 Meters (talk) 22:30, 22 December 2024 (UTC)
Open proxy blocked. /21 webhost blocked. IP 140.233.143.222 falls into the range 140.233.136.0/21, a net block owned by Internet Utilities Europe and Asia Limited[1], identified as a hosting provider[2][3]; spot checks in that range shows multiple IPs flagged as potential VPNs. --Malcolmxl5 (talk) 17:47, 31 December 2024 (UTC)

212.222.197.114

{{proxycheckstatus}}

Reason: Reported as a proxy via ProxyChecker and as a datacenter via whatismyipaddress. Kline • talk • contribs 13:54, 16 December 2024 (UTC)

 Unlikely IP is an open proxy. This IP is owned by GTT Communications Inc. and is hosted in Cork, IE. It is assigned to Stryker, a medical technology company with a manufacturing hub in Cork[4]. There are two edits to a Cork related article. This looks like someone editing from their workplace. --Malcolmxl5 (talk) 11:41, 1 January 2025 (UTC)

8.4.120.239

{{proxycheckstatus}}

Reason: Reported as a proxy/vpn via IPCheck and as a datacenter via whatismyipaddress.com Kline • talk • contribs 01:32, 21 December 2024 (UTC)

 Unlikely IP is an open proxy. This IP is owned by San Diego Broadband (8.4.120.0/22), a Wireless Internet Service Provider serving rural areas of San Diego County. IPQS flags the IP as a VPN connection but is known to also flag up datacenter ranges. There is no corroboration from other proxy/VPN detection services. Contributions seem unproblematic. --Malcolmxl5 (talk) 13:03, 1 January 2025 (UTC)

38.146.56.0/23

{{proxycheckstatus}}

Reason: VPN; cf. Spur. Eryk Kij (talk) 03:53, 21 December 2024 (UTC)

Open proxy blocked. 38.146.57.192/26 blocked. Multiple Hide My Ass VPNs in this range. No contributions in the rest of the /23 and spot checks with Spur revealed nothing. --Malcolmxl5 (talk) 15:05, 1 January 2025 (UTC)

8.227.213.58

{{proxycheckstatus}}

Reason: Reported as proxy/vpn via IPCheck and datacenter via whatismyipaddress Kline • talk • contribs 18:58, 22 December 2024 (UTC)

 Unlikely IP is an open proxy. Flagged by IPQS only; no corroboration by other proxy/VPN detection services. No indication of abuse. --Malcolmxl5 (talk) 15:32, 1 January 2025 (UTC)

2409:4089:a180:5ec::25c:78ad

{{proxycheckstatus}} 

https://en.wikipedia.org/w/index.php?title=Maharaja_Kam_Dev_Misir&action=history

Reason: (vandalizing and edit warring and putting unauthorized and wrong data on the page) Shaurya Singh Sikarwar (talk) 16:09, 30 December 2024 (UTC)

no Declined to run a check. Not on the basis of vandalism and edit warring. It’s caught up in a rangeblock 2409:4089:a000::/35 for one month anyway. --Malcolmxl5 (talk) 15:40, 1 January 2025 (UTC)

86.62.29.101

{{proxycheckstatus}}

Reason: Have seen a bunch of socking from this /24. The geolocate link shows it as a VPN. I don't know what the exact range is, but it looks like at least that much. 35.139.154.158 (talk) 16:45, 6 January 2025 (UTC)

Your instincts are good. Spur identifies the IP as belonging to the Nord VPN anonymization network. I’ll have a look at the range as there seems to be a web host provider in the mix. Thanks, — Malcolmxl5 (talk) 17:02, 6 January 2025 (UTC)
Open proxy blocked 86.62.29.0/24 is blocked as a web host provider with multiple Nord VPNs in this range also blocked. — Malcolmxl5 (talk) 17:47, 6 January 2025 (UTC)
Also blocked 86.62.30.0/24 for the same reason. — Malcolmxl5 (talk) 18:06, 6 January 2025 (UTC)

91.239.6.150

{{proxycheckstatus}}

Reason: Showed up at the same AFD that's been getting hit with these, and the geolocate link reports it as a VPN server. 35.139.154.158 (talk) 16:48, 8 January 2025 (UTC)

Open proxy blocked. Another Nord VPN. 91.239.6.0/24 is blocked as a web host provider with multiple Nord VPNs in this range also blocked. Malcolmxl5 (talk) 22:28, 8 January 2025 (UTC)

2001:550:9801:4C82:2229:C327:2800:7834

{{proxycheckstatus}}

2001:550:9801:4C82:2229:C327:2800:7834 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · geo · rangeblocks · spur · shodan

Reason: Appears to be a rangeblock. A registered user says this is their IP and it is not an open proxy. I used the proxy checker feature but I'm not very experienced in this sort of thing and to my eye the result was "mixed" in that one part of the report said this was not a proxy and another segment appeared to indicate that it is. Lil' help? (noting for the record that the block was by ST47, who has not edited in five months.) Beeblebrox Beebletalks 19:59, 16 January 2025 (UTC)

@Beeblebrox: Cogent Communications does offer colocation services, but I don't see evidence that the specific IP is an issue. We can probably knock the block back to anon only as opposed to a hard block unless there is evidence that the range is being used for socking or disruption. Just my 2c.-- Ponyobons mots 17:05, 17 January 2025 (UTC)
@Ponyo: Sounds good to me. I think I've got it for this specific address, but rangeblocks are another area I pretty much don't mess with. Beeblebrox Beebletalks 18:14, 17 January 2025 (UTC)
What I did apparently did not work, the user is saying they still can't edit. Beeblebrox Beebletalks 20:20, 18 January 2025 (UTC)
They will still be getting caught up in the rangeblock, I think. You should change the block settings for 2001:550:0:0:0:0:0:0/32 to a soft block. The range was not busy - 150+ edits between August 2012 and April 2021 - and I don’t see any disruption so it ought to be OK. My 2c. — Malcolmxl5 (talk) 22:53, 18 January 2025 (UTC)
That was my suggestion, sorry if I wasn't clear. The entire range block would need to be reduced to a soft block as soft blocking the single IP won't release it from the hardblocked /32 range.-- Ponyobons mots 23:15, 20 January 2025 (UTC)
@Beeblebrox. I have reduced the range block to a soft block and removed the block on the individual IP as that serves no purpose. Can you check that the user can now edit? — Malcolmxl5 (talk) 15:40, 21 January 2025 (UTC)
Thanks, I've dropped them a note. Beeblebrox Beebletalks 18:58, 21 January 2025 (UTC)
 Completed. Rangeblock reduced to a soft block.Malcolmxl5 (talk) 03:10, 25 January 2025 (UTC)
Quelle: https://en.wikipedia.org/wiki/Wikipedia:WikiProject_Open_proxies/Requests/Archives/51