Wikipedia:WikiProject on open proxies

←Administration index

MetaProject on open proxies (en-Wikipedia chapter)

If you've been blocked as an open proxy, please see: Help:blocked. The multiwiki MetaProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.

Open proxies may be blocked from editing

Reporting

Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.

File a new report here
I.	For block requests:
	Verify that the following criteria has been met: The IP has made abusive contributions within the past week
	For unblock requests:
	Verify that the following criteria has been met: No current criteria
II.	For block requests	For unblock requests
	Replace "IP" below with the IP address you are reporting.	Replace "IP" below with the IP address you are reporting.
III.	Fill out the resulting page and fill-in the requested information.
IV.	Save the page.

Verified Users/Sysops Templates

IP is an open proxy {{Proxycheck|confirmed}} for confirmed open proxies and TOR exit nodes.  Likely IP is an open proxy {{Proxycheck|likely}} for likely open proxies and TOR exit nodes.  Possible IP is an open proxy {{Proxycheck|possible}} for possible open proxies and TOR exit nodes.  Unlikely IP is an open proxy {{Proxycheck|unlikely}} for unlikely open proxies and TOR exit nodes. Not an open proxy {{Proxycheck|unrelated}} for IP's confirmed not to be an open proxy or TOR exit node. Inconclusive {{Proxycheck|inconclusive}} for IP's that are inconclusive.  Declined to run a check {{Proxycheck|decline}} to decline a check. Open proxy blocked {{Proxycheck|blocked}} for open proxies and TOR nodes that have been blocked. Please add this if you block the IP.

Requests

199.19.250.123

– This proxy check request is closed and will shortly be archived by a bot.

199.19.250.123 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits, involved with logged-in editor suspected of COI [1]; host lookup says "Blue Coat Systems, Inc cloud services".

Nothing obvious, sorry for the delay. Kuru (talk) 00:44, 25 October 2015 (UTC)

198.136.25.82

– This proxy check request is closed and will shortly be archived by a bot.

198.136.25.82 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits at article prone to autobio [2], host lookup said Gorilla Servers

Gorillaservers webhost; blocked. Kuru (talk) 02:30, 15 August 2015 (UTC)

69.87.100.1

– This proxy check request is closed and will shortly be archived by a bot.

69.87.100.1 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits associated with COI editor; host lookup at whatismyip.com says IP is a known proxy.

The is the exit node for a corporate proxy, not an open proxy or webhost. I can see all sorts of interesting COI edits related to some of the entities in that "family" which sort of confirms this. Just block like a regular shared IP if there's too many bad edits. Kuru (talk) 02:15, 16 August 2015 (UTC)

145.226.158.81 / 145.226.158.82

– This proxy check request is closed and will shortly be archived by a bot.

145.226.158.81 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

145.226.158.82 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Used to evade active block in zhwiki, and the IP also edit here. The IP is from France but other IPs used by that zhwiki user is from Germany.--GZWDer (talk) 02:02, 20 August 2015 (UTC)

Sorry, I don't see anything obvious on either IP. Kuru (talk) 02:22, 20 August 2015 (UTC)

46.20.71.233

– A user has requested a proxy check. A proxy checker will shortly look into the case.

46.20.71.233 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Requested unblock.

• The user impacted by this block sent in an OTRS ticket indicating that they verified the proxy, and it is not open. ProcseeBot detected an open port on the IP two days ago. I'd like someone to verify this and unblock the IP if it indeed isn't (or is no longer) an open proxy. Thanks in advance! ☺ · Salvidrim! · ✉ 19:21, 25 August 2015 (UTC)

• Sorry to bug you directly Materialscientist but could I ask you a big favour and get you to look at this when you have a moment? I still have the user's OTRS ticket waiting on this. I'll owe you a big one. :) 13:34, 8 September 2015 (UTC)

This is also the IP address of magenta-medical.com. It is puzzling that anybody would find themselves needing to log into Wikipedia from a web server. That is a technique for hiding your true IP address. This normally qualifies for {{webhostblock}}. EdJohnston (talk) 13:49, 8 September 2015 (UTC)

• Comment: This looks  Likely to me. It's a webhost (magenta-medical.com & magenta-technology.ru) and there are a bunch of suspicious open ports. Mww113 (talk) 04:54, 29 October 2015 (UTC)

2C0F:F930:0:3:0:0:0:221

– This proxy check request is closed and will shortly be archived by a bot.

2C0F:F930:0:3:0:0:0:221 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

I just reverted some vandalism which does not need any follow up, but when I looked at the IP's talk (User talk:2C0F:F930:0:3:0:0:0:221) is saw a claim "This is a Tor exit node.2C0F:F930:0:3:0:0:0:221 (talk) 13:01, 16 August 2015". I'm hoping someone will take any action necessary, but it's a not a problem at the moment. Johnuniq (talk) 02:33, 26 August 2015 (UTC)

Can't do much checking now. Their global contributions indeed suggest international sharing. This tool doesn't identify the IP as Tor; the tool used to work well with ipv4, but I'm not sure about ipv6. Materialscientist (talk) 03:06, 26 August 2015 (UTC)

I'm not seeing it; no open ports there. It seems most tor exit nodes are easy to spot, like 5.9.123.81:9001. Kuru (talk) 12:10, 26 August 2015 (UTC)

104.238.83.28

– This proxy check request is closed and will shortly be archived by a bot.

104.238.83.28 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits. A persistent sockpuppet of user: Asdisis hiding behind a proxy. - MrX 17:50, 27 August 2015 (UTC)

Open proxy ip-104-238-83-28.ip.secureserver.net - port 443 (confirmed) and probably some other ports. -- zzuuzz ^(talk) 18:00, 27 August 2015 (UTC)

91.207.105.12

– A user has requested a proxy check. A proxy checker will shortly look into the case.

91.207.105.12 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits. Apparently another anonymous proxy used by user:Asdisis to EVADE. - MrX 19:29, 27 August 2015 (UTC)

Comment: Looks  Unlikely to me. A few open ports and blacklist listings but no open proxies that I can see. Mww113 (talk) 05:29, 29 October 2015 (UTC)

52.8.126.110

– A user has requested a proxy check. A proxy checker will shortly look into the case.

52.8.126.110 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits. - MrX 21:08, 27 August 2015 (UTC)

Comment: Seems to be  Confirmed webhost. WHOIS and DNS show it belongs to Amazon AWS. Mww113 (talk) 05:37, 29 October 2015 (UTC)

2001:41D0:8:B330:0:0:0:1

– This proxy check request is closed and will shortly be archived by a bot.

2001:41D0:8:B330:0:0:0:1 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits. Sock of Asdisis (talk · contribs · logs). - MrX 22:39, 27 August 2015 (UTC)

Already blocked by Bbb23 Kuru (talk) 13:28, 30 August 2015 (UTC)

95.172.74.63

– This proxy check request is closed and will shortly be archived by a bot.

95.172.74.63 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits. WHOIS reports this is an open proxy from Zscaler. Brianhe (talk) 04:38, 30 August 2015 (UTC)

• Open proxy blocked, 95.172.74.63:8080, already blocked by MaterialScientist. Kuru (talk) 13:01, 30 August 2015 (UTC)

109.192.2.224

– This proxy check request is closed and will shortly be archived by a bot.

109.192.2.224 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Appears to be connected to company called Wittenstein that sells a product called Fitbone - they trying to edit war PROMO content about that product into several articles. Reported at COIN here and was referred to this board. Jytdog (talk) 10:03, 31 August 2015 (UTC) Reason: Suspicious edits

I don't see an open proxy there, but anonblocked per spam. Materialscientist (talk) 10:16, 31 August 2015 (UTC)

It was reported as an open proxy here: http://whatismyipaddress.com/ip/109.192.2.224 — Brianhe (talk) 18:58, 31 August 2015 (UTC)

It's actually reported as a 'confirmed proxy server', of which open proxies are possibly a subset. Likewise, I don't see that it's open (in fact I don't agree it's even a proxy), more like a relatively static broadband IP in Germany. -- zzuuzz ^(talk) 19:11, 31 August 2015 (UTC)

Thanks, I'll be more careful with labels in future. — Brianhe (talk) 21:48, 31 August 2015 (UTC)

IP 220.255.3.185

– This proxy check request is closed and will shortly be archived by a bot.

220.255.3.185 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits

This IP was asking some questions about socking at WP:AN#Sock abuse under protection, as well as talking back to User:Drmies about an SPI case. A web search for 220.255.*.* shows some generally-advertised proxy services based in Singapore. May not be this exact range, though. This IP gets some hits from a spam finder at Cleantalk. There are seven hits in the SPI directory for cases that contain the string '220.255'. EdJohnston (talk) 02:39, 3 September 2015 (UTC)

 It looks like a duck to me. I recognise this proxy user. Apart from that, getting close, 220.255.3.170:80 exits at 220.255.3.186. A few more rolls of the dice might nail it. If not, it's a duck. -- zzuuzz ^(talk) 03:07, 3 September 2015 (UTC)

I can't proxy-check it now (and would leave this to zzuuzz anyway), but CU scan shows that this IP is shared, is not particularly active, and was abused by an unrelated spambot yesterday. Materialscientist (talk) 03:13, 3 September 2015 (UTC)

Blocked 220.255.3.170 (over ssl) -- zzuuzz ^(talk) 03:28, 3 September 2015 (UTC)

112.79.38.210

– This proxy check request is closed and will shortly be archived by a bot.

112.79.38.210 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits

See this AN/I thread. BMK (talk) 02:58, 5 September 2015 (UTC)

Block evasion, yes, but I don't see an open proxy there. Materialscientist (talk) 03:07, 5 September 2015 (UTC)

104.238.169.86

– This proxy check request is closed and will shortly be archived by a bot.

104.238.169.86 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

• Per http://whatismyipaddress.com/ip/104.238.169.86, "Confirmed proxy server, Recently reported forum spam source."
• Trolling User talk:Jimbo Wales: [3], [4]

Reason: Suspicious edits

Blocked. Materialscientist (talk) 12:18, 8 September 2015 (UTC)

IP190.37.0.0/16

– A user has requested a proxy check. A proxy checker will shortly look into the case.

190.37.0.0/16 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Block reason given is Blocked_proxy for the entire range. A lot of collateral damage when such a wide range is blocked as an open proxy. If all of the ISP's servers are actually misconfigured and usable as open proxies, can a user or admin fluent in Spanish contact them to recommend better configuration and XFF? WhoIs shows CANTV Servicios, Venezuela located at Venezuela, Bolivarian Republic Of Caracas Cantv Servicios Venezuela. Thanks, DocTree (ʞlɐʇ·ʇuoɔ) WER 17:51, 9 September 2015 (UTC)

Reason: Requested unblock.

• Comment: The two IPs with the most edits on this range don't seem to have any proxies on them. There's really only a handful of edits on the entire range and yet this block affects up to 65,536 IPs. This seems like some pretty major overkill to me. @NawlinWiki: do you have any comments as the blocking admin? Mww113 (talk) 05:49, 29 October 2015 (UTC)

119.81.135.18

– This proxy check request is closed and will shortly be archived by a bot.

119.81.135.18 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits BMK (talk) 13:09, 10 September 2015 (UTC)

Blocked. Materialscientist (talk) 23:25, 10 September 2015 (UTC)

217.165.22.88

– A user has requested a proxy check. A proxy checker will shortly look into the case.

217.165.22.88 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits and traceroute goes through cogentco.com who describe theselves: "Cogent Data Centers also host Cogent's Utility Computing servers". — Brianhe (talk) 23:12, 14 September 2015 (UTC)

146.23.3.250

– A user has requested a proxy check. A proxy checker will shortly look into the case.

146.23.3.250 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

This IP is owned by Chevron Corporation, located in their San Ramon, California, office. It is reported as a confirmed open proxy. People operating the proxy have made personal attacks[5] and have violated the 1RR limitation set at the Abortion and mental health article. (All abortion topics have a 1RR limitation.) Since May 2015, other edits have been made by this proxy to disputed and controversial topics such as Conversion therapy (to convert gays) and Beginning of human personhood (a debate point in the abortion topic.) Binksternet (talk) 06:29, 17 September 2015 (UTC)

• Comment: Looks  Unlikely to me. Mww113 (talk) 05:57, 29 October 2015 (UTC)

122.3.238.242

– A proxy check has been completed and it is now awaiting administration and close.

122.3.238.242 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Disruptive edit of WP:OR by a sockpuppet using OpenVPN as Open proxy.[6]

Blocked, thanks. Materialscientist (talk) 22:57, 18 September 2015 (UTC)

174.142.138.234

– A user has requested a proxy check. A proxy checker will shortly look into the case.

174.142.138.234 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits. WHOIS→iWeb Technologies Inc.. Google→"iWeb: Cloud Hosting, Server Hosting & Hosted Solutions". Brianhe (talk) 15:06, 21 September 2015 (UTC)

168.1.23.79

– A user has requested a proxy check. A proxy checker will shortly look into the case.

168.1.23.79 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits. - MrX 12:01, 25 September 2015 (UTC)

I can't check it for proxy at the moment, but blocked it as an (abused) webhost. Materialscientist (talk) 12:06, 25 September 2015 (UTC)

95.141.31.6

– This proxy check request is closed and will shortly be archived by a bot.

95.141.31.6 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

95.141.31.8 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

95.141.31.9 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

95.141.31.22 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

95.141.31.23 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

95.141.31.24 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

95.141.31.25 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Cyberghost proxy. 95.141.31.6 to 9 and 95.141.31.22 to 25

Verified. It looks like this was picked up by Mr. Ponyo and blocked for a month as 95.141.31.0/27. Will probably need to be re-applied when it expires. Kuru (talk) 03:06, 12 October 2015 (UTC)

110.78.187.104

– This proxy check request is closed and will shortly be archived by a bot.

110.77.221.89 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

110.78.187.104 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

110.77.221.193 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Disruptive edits & reported as "Confirmed proxy server" by http://whatismyipaddress.com/ip/110.78.187.104. They may be using 110.77.221.89 which is also reported as confirmed proxy, and 110.77.221.193. — Brianhe (talk) 03:40, 4 October 2015 (UTC)

• 104 is a proxy of some kind, but I'd guess it's a corporate or civil proxy used to aggregate back end clients. While there are several open ports, I could not connect to any of them (one prompted a log in screen). There were a couple of ports that I could not puzzle out what they were, but nothing that indicated an actual open proxy.
• 89 has a few open ports, but nothing odd and I could not connect to anything.
• 193 had nothing open at all.

That being said, it's clearly the same editor using all three. Likely from three different locations in or near Bangkok (work, school, home, etc). Nothing super suspicious. I didn't immediately see the disruptive behavior, but I didn't look too deep. If there something wrong with the editor, or if this is a sock, then I'd approach the problem through those channels. Kuru (talk) 23:35, 4 October 2015 (UTC)

213.163.92.164

– This proxy check request is closed and will shortly be archived by a bot.

213.163.92.164 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Requesting unblock; says they're not an open proxy. Daniel Case (talk) 15:54, 4 October 2015 (UTC)

Notes: I don't see anything on that IP (nothing open or odd). It does trace to the firm the editor claims and it makes sense that it was a recent 32 address carve-out in that range. I would also note that NewIPNow no longer offers an exit node in that range per their open list, but the other VPN noted in MS's block text does not have an open list to verify. He also used "etc" at the end inferring there was other weirdness. The range contribution tool I like to use at labs is down at the moment, so I can't spot check abusive IPs in the range; can do that later. One more problem: @Materialscientist: is a checkuser and may have been acting on more information than is visible. Kuru (talk) 18:35, 4 October 2015 (UTC)

Unblocked (note, I wasn't a checkuser when I've blocked that range :-P). Materialscientist (talk) 22:22, 4 October 2015 (UTC)

Meh. Seems like thousands of years ago. Kuru (talk) 22:53, 4 October 2015 (UTC)

186.93.0.0/16

– This proxy check request is closed and will shortly be archived by a bot.

186.93.0.0/16 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

I'm not quite sure I understand this block. This is a huge IP range that appears to belong to a Venezuelan ISP. Why is the whole range blocked as a proxy? Maybe there's one or 2 IPs running a proxy, but given that this is an ISP and not a webhost, I don't understand why the whole range was blocked. Mww113 (talk) 01:07, 5 October 2015 (UTC) Reason: Requested unblock.

I don't see obvious proxies on a random sampling of IPs that were used disruptively. The target of he block is pretty obvious; the range has been blocked many times previously, almost always targeting the same troll. You may want to contact the blocking administrator with the context of the unblock request and some assurance that the troll has ceased using the range. Kuru (talk) 01:57, 5 October 2015 (UTC)

Unfortunately, there are things that I can't discuss per the confidentiality agreement or I would give more context. This is helpful information though. Thank you. Mww113 (talk) 04:30, 5 October 2015 (UTC)

62.113.227.63

– This proxy check request is closed and will shortly be archived by a bot.

62.113.227.63 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: IPsock of Gabucho181 who uses open proxies. Also this says "Confirmed proxy server". Geraldo Perez (talk) 21:45, 5 October 2015 (UTC)

I see a couple of suspicious open ports and a lot of abuse by various socks in CU log, thus blocked. Materialscientist (talk) 21:50, 5 October 2015 (UTC)

Port 25302 is a luminati.io exit node (seven day free trial!). Good block. Kuru (talk) 02:11, 6 October 2015 (UTC)

212.76.11.80

– This proxy check request is closed and will shortly be archived by a bot.

212.76.11.80 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits. Same editor had used a different IP yesterday (208.54.4.246, in California) for block evasion. It's unlikley that they're from Khazakstan. BMK (talk) 23:09, 5 October 2015 (UTC)

Not sure if this is any help: 212.76.11.80 looks clean, and I can see three other IPs from Kazakhstan poking around Why Be Good? and Gold Diggers of Broadway on two different local ISPs. Probably not a proxy; some other oddness afoot. Kuru (talk) 02:04, 6 October 2015 (UTC)

Thos are all the same editor. BMK (talk) 15:32, 6 October 2015 (UTC)

2.75.239.135

– A user has requested a proxy check. A proxy checker will shortly look into the case.

2.75.239.135 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits, same editor as above, Khazakstan location. BMK (talk) 15:32, 6 October 2015 (UTC)

Just to be clear: the editor involved is User:Jakeleereed, He got a 60 hour block for disruptive editing from Bishonen, and immediately socked with an IP from California, which Bishonen blocked. The next day he was back, editing the same articles, with the IP I reported above, 212.76.11.80. from Kazakhstan. Today he's editing from this IP, also from Khazakhstan. There was a vague possibility that yesterday's edits might not have been him (same suite of articles, but not the same edit), but today he's reverting to his previous material, which was deleted because it went against consensus (the reason for Bishonen's block).

I am by no means knowledgable about this kind of stuff, but when an editor from California (consistent with JLR's hours of editing) shows up in Kazakhstan, it seems highly likely that the IPs involved are open proxies. Can I suggest a second look at 212.76.11.80? BMK (talk) 17:00, 6 October 2015 (UTC)

Certainly! Here are the five IPs from Kazakhstan:

• 2.75.239.135 (talk · contribs · WHOIS), no open ports, traceroute to ISP of record (Kcell).
• 176.222.154.51 (talk · contribs · WHOIS), no open ports, traceroute to ISP of record (2day.kz).
• 176.222.136.85 (talk · contribs · WHOIS), no open ports, traceroute to ISP of record (2day.kz).
• 212.76.11.80 (talk · contribs · WHOIS), no open ports, traceroute to ISP of record (2day.kz); host is a bank, though (ftp.kisc.kz).
• 109.239.44.201 (talk · contribs · WHOIS), no open ports, ISP is Llp Alma-tv.

None of these have open ports to analyze (the main way of spotting these), at least not any that I can see. None of these IPs show up on public open proxy lists. These could be webhosts, but they just seem to be normal ISPs (and cable providers). I've seen enough really odd proxies to know there's no magic pixie dust in verifying them, though. Will leave this in case someone else wants to take a crack at it. Seems obvious that it's your boy, though, proxy or not. Kuru (talk) 01:25, 7 October 2015 (UTC)

Yeah, I took a look at the contribs, and there's little doubt that it's him. So, just assuming for the moment that my scenario above is right, how did an editor from California get access to an IP from Kazakhstan? BMK (talk) 01:27, 7 October 2015 (UTC)

Don't answer if WP:BEANS is a concern. BMK (talk) 01:31, 7 October 2015 (UTC)

Unclear, but considering he's editing from work (kisc.kz), home (2day ISP), cable/TV (alma-tv) and his cell phone (kcell), I'd probably flip the question and ask how a Kazakhstan resident edited from a t-mobile wireless IP in California. S/he's not a master of english communication skills, although there's not much to go on. Lots of comical seething for Mr. Ken and Ms. Bish, lots of love for the roaring 20's film. Interesting. Kuru (talk) 02:18, 7 October 2015 (UTC)

Hmmm. That flip is interesting, I hadn't thought about that. It might explain the communication problem a bit. BMK (talk) 03:48, 7 October 2015 (UTC)

So today he's using 176.222.136.233, also from Kazakhstan. Maybe you'd better check the California IP he used to see of it is an OP: 208.54.4.246 BMK (talk) 19:51, 7 October 2015 (UTC)

First thing I did in your previous report. :) It's a bog standard t-mobile wireless IP; nothing odd, other than the fact that people apparently still use t-mobile. Before you ask, 176.222.136.233 (talk · contribs · WHOIS) is another 2day IP with no open ports and nothing funny. I realize how spectacularly unhelpful all this is. Kuru (talk) 00:13, 8 October 2015 (UTC)

No, not "unhelpful", just a bit mystifying. I do appreciate your checking these things out. I guess I won't post any further Kazakhstan-based IPs here (I'm assuming he'll be back tomorrow), I'll only come back if he starts using something different. In the meantime, I'm reverting and Bishonen is blocking. BMK (talk) 00:27, 8 October 2015 (UTC)

One or two more from that 176.222.* range and we can calculate a good range block. I suspect the traffic from that ISP is close to zero except for him. Kuru (talk) 00:44, 8 October 2015 (UTC)

Today he made an account, User:Keydy iphone, but I did find an old Kazakhstan IP, 37.99.109.87 Too bad it's not in the 176 range. I'm beginning to think that the California IP is another person, who just got caught up in the net accidentally. BMK (talk) 21:28, 8 October 2015 (UTC)

Here's another 176 for you: 176.222.186.94 Also, 212.76.24.24 from Kazakhstan. BMK (talk) 01:40, 9 October 2015 (UTC)

CU logs suggest a simple picture: no proxies, and no obvious socking - just two (or more) IP hoppers with access to several IP ranges, one hopper in the US and one in Kazakhstan. Materialscientist (talk) 02:12, 9 October 2015 (UTC)

Behaviorally the Kazakhstan IPs all appear to be identical to the named accounts, Jakeleereed (blocked for disruption) and today's Keydy iphone. The California IP I now believe to be someone else, which I guess means no necessity for there to be open proxies involved. BMK (talk) 02:33, 9 October 2015 (UTC)

A note of caution - many movie fans have similar editing patterns (for example, there are hundreds of different wikieditors, registered or not, who tweak boxoffice data for Indian movies, in an apparently "coordinated" fashion). CU logs suggest (no certainty) a couple of similarly mistaken assumptions in this case too. Materialscientist (talk) 03:17, 9 October 2015 (UTC)

OK, maybe a group of American silent movie fans in Kazakhstan, I dunno. The edits are non-consensual, so it hardly matters, except in terms of blocks. BMK (talk) 04:43, 9 October 2015 (UTC)

115.115.222.123

– This proxy check request is closed and will shortly be archived by a bot.

115.115.222.123 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious/promo edits, reported as confirmed proxy server by http://whatismyipaddress.com/ip/115.115.222.123 - Brianhe (talk) 19:26, 7 October 2015 (UTC)

I was not able to connect to any of the open ports, and did not see any open proxies, but this seems to a mail server for Informatics India which provides some webhost-like services. There's a Zimbra login on port 80. Could webhost block, but I'm not seeing the abusive edits. Did you mean the "Kunal Bhardwaj" COI-like edits a year ago? Kuru (talk) 00:42, 8 October 2015 (UTC)

188.166.8.88

– This proxy check request is closed and will shortly be archived by a bot.

188.166.8.88 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Vandalistic edits to a page in my user space. (Other similar edits have turned out to be OPs.) BMK (talk) 01:40, 12 October 2015 (UTC)

Open proxy blocked, Free Proxy operating on port 80. Blocked for six months and retained the talk page block. Kuru (talk) 02:03, 12 October 2015 (UTC)

216.177.129.188

– A user has requested a proxy check. A proxy checker will shortly look into the case.

216.177.129.188 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

203.122.8.2 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits alongside blocked undisclosed paid editor at Delhi Poetry Festival and Poets Corner Group. Reported as a confirmed proxy by http://whatismyipaddress.com/ip/216.177.129.188 and http://whatismyipaddress.com/ip/203.122.8.2 — Brianhe (talk) 06:46, 13 October 2015 (UTC)

I don't see proxies on these two IPs, no open ports too. Materialscientist (talk) 08:22, 13 October 2015 (UTC)

107.167.107.245

– This proxy check request is closed and will shortly be archived by a bot.

107.167.107.245 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits and listed as pera Mini Proxy ISP and confirmed proxy server by http://whatismyipaddress.com/ip/107.167.107.245

Brianhe (talk) 13:53, 14 October 2015 (UTC)

Clearly a part of Opera's mini-proxy service, and already blocked three months ago as such. Kuru (talk) 00:02, 15 October 2015 (UTC)

77.243.189.227

– This proxy check request is closed and will shortly be archived by a bot.

77.243.189.227 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits - Had trouble with IP 50.65.161.197, who was leaving hostile comments about sourcing at Scooby Doo. IP geolocates to St. Albert Canada. I blocked them for disruption, they returned as 77.243.189.227, which geolocates to the Netherlands. A fast trip for one user to make so quickly. The info at WhatIsMyIPAddress.com says that it's a confirmed proxy server—I know the site isn't always reliable for this info, but I thought I'd run it past y'all. Thanks, Cyphoidbomb (talk) 19:56, 17 October 2015 (UTC)

• Open proxy blocked. Blocked a range of Cyberghost proxies. Kuru (talk) 20:07, 17 October 2015 (UTC)

54.193.24.151

– This proxy check request is closed and will shortly be archived by a bot.

54.193.24.151 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Requested unblock. Block reason: {{webhostblock}}. עוד מישהו Od Mishehu 19:02, 19 October 2015 (UTC)

• It's am Amazon Web Services IP so I've declined the unblock request.--Jezebel's Ponyo^{bons mots} 20:37, 19 October 2015 (UTC)

106.51.133.200

– A user has requested a proxy check. A proxy checker will shortly look into the case.

106.51.133.200 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Continuously editing racist and unwarranted edits on Newar people, Shrestha, Shresthas pages with absolutely no reference or citations. Nepalichoro255 (talk) 04:16, 21 October 2015 (UTC)

63.143.226.248

– A user has requested a proxy check. A proxy checker will shortly look into the case.

63.143.226.248 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: A whois of this IP address indicates this is an open proxy.[7] Likely sock account of User:IHeardFromBob, who had previously used optonline servers editing the same article. TuvaluEditor3 (talk) 09:00, 21 October 2015 (UTC)

173.231.123.130

– This proxy check request is closed and will shortly be archived by a bot.

173.231.123.130 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP (entertainment company spamming)

173.231.123.134 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP (same entertainment company)

173.231.112.190 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP (Search Engine Marketing spam)

173.231.116.114 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP (spamming)

173.231.157.72 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP (editing a specific Hollywood person article/talkpage)

173.231.157.74 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP (ditto)

173.231.157.91 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP (ditto)

173.231.157.100 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP (ditto)

173.231.157.101 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP (ditto)

173.231.157.116 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP (ditto)

Reason: Suspicious edits as shown. Brianhe (talk) 00:27, 25 October 2015 (UTC)

I don't see anything. Just seems to be a dynamically allocated IP. Kuru (talk) 00:38, 25 October 2015 (UTC)

121.52.154.98

– A user has requested a proxy check. A proxy checker will shortly look into the case.

121.52.154.98 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Disruptive editing [8] following identical disruption from other US based IPs [9][10][11][12]; reported by whatismyipaddress.com as a confirmed proxy server in Pakistan [13], which is geo-unlikely for this particular topic. Brianhe (talk) 17:26, 27 October 2015 (UTC)

38.95.108.246

– This proxy check request is closed and will shortly be archived by a bot.

38.95.108.246 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Requested unblock. Block reason: {{blocked proxy}}. עוד מישהו Od Mishehu 21:30, 28 October 2015 (UTC)

Open proxy: cypberghostvpn -- zzuuzz ^(talk) 18:46, 9 November 2015 (UTC)

8.37.224.0/20

– A user has requested a proxy check. A proxy checker will shortly look into the case.

8.37.224.0/20 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: We've blocked several of these IPs as open proxies already. A quick whois of this range shows that it belongs to some sort of mobile content accelerator. A search of the range contribs reveals several blocks and loads of problematic edits. I know that this IP range uses XFF headers but as of yet they are not part of the trusted list at the XFF project on meta. For now I think it might be wise to block the whole range, contact the owners of the range, and hope they have themselves added to the trusted list. It seams to me that every IP on this range is probably a proxy, and if we're going to block some of them, we might as well just block the range. Mww113 (talk) 03:57, 29 October 2015 (UTC)

67.55.34.248

– A user has requested a proxy check. A proxy checker will shortly look into the case.

67.55.34.248 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Webhost. Previously blocked for a long history of problematic edits. Easily confirmed by simple whois. Mww113 (talk) 04:34, 29 October 2015 (UTC)

#wikipedia-en-help harassment IPs

– A user has requested a proxy check. A proxy checker will shortly look into the case.

86.151.10.183 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

95.211.214.81 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

162.219.178.170 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

95.213.157.141 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

5.196.109.149 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

94.242.228.122 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

46.148.17.210 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

193.106.30.156 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

178.175.138.10 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

190.97.163.209 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

31.210.123.217 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

5.196.106.212 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: All are IPs which, all within the span of two hours, have been used to spam/harass helpers in #wikipedia-en-help on IRC. Given all the disparate IPs and speed with which the user behind them switches IPs open proxies/anonymising services are suspected. —Jeremy v^_^v ^Bori! 21:51, 3 November 2015 (UTC)

93.110.xx.xx

– A user has requested a proxy check. A proxy checker will shortly look into the case.

93.110.60.207 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

93.110.110.216 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

93.110.119.124 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits from 93.110.xx.xx -- geolocates to Iran, but virtually all editing from this range is on Asian beauty pageants [14]. General topic is under discussion on COIN. Brianhe (talk) 21:22, 5 November 2015 (UTC)

Note, 93.110.32.0/19 is listed on the Spamhaus Policy Block List (PBL) [15]. Brianhe (talk) 12:00, 6 November 2015 (UTC)

24.246.127.180

– This proxy check request is closed and will shortly be archived by a bot.

24.246.127.180 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits Address belongs to a school system. Geolocate reports it as an open proxy.[16] Donatetom (talk) 18:27, 9 November 2015 (UTC)

Nice account you have there. Please note that a confirmed proxy server is not a confirmed open proxy, however in this case, Open proxy port 8080, blocked. -- zzuuzz ^(talk) 18:52, 9 November 2015 (UTC)

‎104.42.106.203

– This proxy check request is closed and will shortly be archived by a bot.

104.42.106.203 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

71.162.154.162 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits, has similar edits to a long-time sock puppet that primarily targets this page, and particularly this edit. According to this it is a Confirmed Proxy Server.--Peaceworld 18:59, 10 November 2015 (UTC)

104.42.106.203 confirmed port 8080 and Open proxy blocked

71.162.154.162:  Likely IP is an open proxy exit point, possibly from 71.162.154.163:3130, but not confirmed at this time. -- zzuuzz ^(talk) 19:41, 10 November 2015 (UTC)

71.162.154.162, exit for 71.162.154.163:3130, now confirmed Open proxy blocked -- zzuuzz ^(talk) 11:49, 11 November 2015 (UTC)

95.141.29.38

– A user has requested a proxy check. A proxy checker will shortly look into the case.

95.141.29.38 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Vandal account, Suspicious edits

@Agent AX: That IP address and several nearby IP addresses have numerous open ports, and the one you mention was listed on a proxy-listing site back in March, but I have not been able to connect to any of them. That is not enough evidence to justify a proxy block, but it is enough to be suspicious. If you see any more evidence, please let me know. The editor who uses the pseudonym "JamesBWatson" (talk) 16:49, 12 November 2015 (UTC)

45.33.130.46

– A user has requested a proxy check. A proxy checker will shortly look into the case.

45.33.130.46 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits

Corrected the IP number per James's comments below. EdJohnston (talk) 21:21, 11 November 2015 (UTC)

Reported on my talk page for making unsubstantiated sock charges against User:Athenean and User:SilentResident. Another part of the same /20 range was used in a revert war at Greeks per this 3RR complaint from August. (Search the report for 45.33).

This range belongs to cloudmosa.com, which appears to operate server farms. To my knowledge they are not an ISP, though they sell a mobile app called Puffin. I am tempted to do a softblock of 45.33.128.0/20 with the tag 'webhostblock'.

The range contributions from the /20 are short on any good faith work. EdJohnston (talk) 15:24, 11 November 2015 (UTC)

This IP is probably a proxy of some sort, though it doesn't appear to be open. It could be their free browser app, which is probably similar to Template:OperaMiniBlock, which is currently blocked at 107.167.96.0/19 (talk · contribs · block log). Maybe just a vague 'anonblock' would do? -- zzuuzz ^(talk) 18:31, 11 November 2015 (UTC)

Is the IP address at the top of this section a typo? 45.33.130.37 has not edited since June (though its edits then were all vandalism), and the IP address reported on EdJohnston's talk page was 45.33.130.46. Of course it's not important, as they are both within the range mentioned, but it might confuse someone. "Puffin" is clearly a proxy, and since it is apparently available to anyone who chooses to buy the app, it is an open proxy, as far as I can see. Its publisher claims that its purpose is "to enhance web browser speed and features on mobile and tablet devices", in which case I don't see that blocking it prevents any legitimate editor from editing Wikipedia: it just makes them have to wait a bit longer for edits to take. I don't know whether it is Puffin that is involved here, but either way it seems to me we are probably dealing with something which qualifies for a webhost block or proxy block. The one outstanding question is whether to make the block anon-only. The editor who uses the pseudonym "JamesBWatson" (talk) 21:10, 11 November 2015 (UTC)

I fixed the IP number above. The IP that edited on 11 November and made the bogus sock charge was 45.33.130.46 as noted by James. Suggest at least anonblock and at least for six months. EdJohnston (talk) 21:21, 11 November 2015 (UTC)

Whether to block anon-only really depends, to me, on whether there's any associated sock accounts, or any genuine accounts. A checkuser might be able to help scope the range. However I agree with James that people are unlikely to be inconvenienced much - they will have an alternative browser on the same machine. I suggested an anonblock block reason, as users of a browser app are likely to be confused by the real reasons of proxy- or webhost-block. I think of the block appeals from people keen to prove they are using an app, and not using an open proxy or a web server. -- zzuuzz ^(talk) 06:00, 12 November 2015 (UTC)

For the present I have blocked the /20 range anon-only for a year, but I am by no means committed to that being the best decision, so if either of you wishes to amend the block then please go ahead. I can see a case for at least preventing account creation, even if not preventing logged-in editing. Is it worth consulting a CheckUser to see if there seems to be any reason for or against doing one or both of those? The editor who uses the pseudonym "JamesBWatson" (talk) 16:24, 12 November 2015 (UTC)

See User talk:Bbb23#Can this range be hard blocked? for a comment from a checkuser. Based on Bbb23's opinion I think leaving this as a one-year anonblock is reasonable. EdJohnston (talk) 17:26, 13 November 2015 (UTC)

41.164.163.114

– A user has requested a proxy check. A proxy checker will shortly look into the case.

41.164.163.114 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

This relates to an unblock request at User talk:Baharini, where it is stated that there is an open proxy block, but that the IP address is not an open proxy. The IP address was blocked by ProcseeBot on 7 November, for a year, as an exit IP for 169.255.77.27:8080. I have connected via 169.255.77.27:8080, confirming that it is an open proxy, but the connection went directly to 169.255.77.27, not 41.164.163.114 or any other IP address. Nmap shows that 41.164.163.114 has no open ports. My feeling is that the IP address is no longer an open proxy, and that it should be unblocked, but I have an element of doubt, so if anyone else can contribute anything relevant I shall be grateful. If nobody comes up with anything I shall probably unblock. The editor who uses the pseudonym "JamesBWatson" (talk) 12:28, 15 November 2015 (UTC)

IP 83.220.237.58

– A user has requested a proxy check. A proxy checker will shortly look into the case.

83.220.237.58 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits - Mrschimpf filed an SPI on Gabucho181, who is known to harass Geraldo Perez. Mrschimpf's comments: "Seems like an open Russian proxy; obvious behavior with a usual goad on Geraldo Perez's talk page and their usual attempt to insert the Dan Vs. "comeback" on Pop (U.S. TV network)." Cyphoidbomb (talk) 16:03, 21 November 2015 (UTC)

63.92.227.169

– A user has requested a proxy check. A proxy checker will shortly look into the case.

63.92.227.169 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

IP check indicates proxy server [17].

Reason: Suspicious edits. TuvaluEditor3 (talk) 13:02, 23 November 2015 (UTC)

See also

Subpages

• Blacklist of open or zombie proxies
• Information for blocked users
• List of users who can verify proxies
• Preventing access to Wikipedia from your Tor node

Related pages

• Policy on open proxies
• Open proxy detection
• Guide to checking open proxies
• Proxy check result templates
• Advice to users using Tor to bypass the Great Firewall
• meta:XFF project
• Tor exit checker

Chapters

• Meta-Project
• Wikisource
• Wikiversity
• Wiktionary