This page is an archive. Do not edit the contents of this page. Please direct any additional comments to the current main page.

{{ proxycheckstatus}}

New unblocked NordVPN addresses. Some possible UPE activity there too. MarioGom ( talk) 21:34, 10 May 2021 (UTC)

Blocked. GeneralNotability ( talk) 23:08, 20 May 2021 (UTC)

{{ proxycheckstatus}}

216.250.248.0/21 · contribs · block · log · stalk · Robtex · whois · Google

Webhost range with edits coming out of it. Can't find much about the ISP (not sure if hosting only or also colo), everything else in the ASN has been globally hardblocked by Jon Kolbert until 2025, so hardblocks seem warranted.  Awaiting administrative action – please hardblock the range for two years. Thanks. -- Blablubbs| talk 08:48, 21 May 2021 (UTC)

 Done -- Malcolmxl5 ( talk) 11:54, 24 May 2021 (UTC)

Thanks. Closing. -- Blablubbs| talk 13:09, 24 May 2021 (UTC)

{{ proxycheckstatus}}

192.42.116.0/27 · contribs · block · log · stalk · Robtex · whois · Google

Per whois, the range is a Tor exit node (TOR-EXIT-HVIV network name). Most IPs are individually blocked, 192.42.116.18 is not. Verified tor exit on Shodan. MarioGom ( talk) 15:14, 22 May 2021 (UTC)

 Confirmed, obviously. Hosted by this group. The ASN is an education network, so not good to block.  Awaiting administrative action: Please block the /27 above for two years, hard. -- Blablubbs| talk 10:10, 23 May 2021 (UTC)

 Done -- Malcolmxl5 ( talk) 14:53, 24 May 2021 (UTC)

Thanks, closing. -- Blablubbs| talk 15:36, 24 May 2021 (UTC)

{{ proxycheckstatus}}

67.53.214.86 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: (This user violates wikipedia rules by using proxy. The IP address is already blocked in several bases for using proxy. For example here https://www.rbls.org/) 77.37.160.57 ( talk) 12:58, 24 May 2021 (UTC)

• IP is  Not a proxy. Closing. -- Blablubbs| talk 15:27, 24 May 2021 (UTC)

{{ proxycheckstatus}}

37.120.234.211 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan au.lazerpenguin.com

37.120.234.212 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan au.lazerpenguin.com

37.120.234.213 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan au.lazerpenguin.com

37.120.234.215 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan au.lazerpenguin.com

37.120.234.216 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan au.lazerpenguin.com

37.120.234.227 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan au.lazerpenguin.com

37.120.234.228 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan au.lazerpenguin.com

The /24 is M247-LTD-Sydney, so probably good to hardblock:

37.120.234.0/24 · contribs · block · log · stalk · Robtex · whois · Google

-- MarioGom ( talk) 20:36, 24 May 2021 (UTC)

• Yep.  Awaiting administrative action – please hardblock the /24 for two years. Thanks. -- Blablubbs| talk 21:09, 24 May 2021 (UTC)

 Done -- Malcolmxl5 ( talk) 21:29, 24 May 2021 (UTC)

Thanks! Closing. -- Blablubbs| talk 21:42, 24 May 2021 (UTC)

{{ proxycheckstatus}}

2a07:23c0:9::/48 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Owned by Hosting Services Inc. who provides web hosting services [1] apparently running servers, public proxies and anonymizing VPNs [2]. Malcolmxl5 ( talk) 11:43, 24 May 2021 (UTC)

•  Confirmed webhost plus 209.126.88.0/22 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) on the same ASN (the subrange 209.126.88.0/24 is already globally hardblocked, as is the rest of the ASN). These providers technically also offer colocation and I don't see any clear VPN fingerprints, but everything else on the range is hardblocked, so I'd recommend matching that.  Awaiting administrative action – please block the /48 and the /22, hard, two years. No strong objections to a soft block if preferred by the closing admin. Thanks. -- Blablubbs| talk 15:35, 24 May 2021 (UTC)

 Done -- Malcolmxl5 ( talk) 16:26, 25 May 2021 (UTC)

{{ proxycheckstatus}}

38.146.57.253 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan ma.us.hma.rocks

-- MarioGom ( talk) 20:51, 24 May 2021 (UTC)

•  Confirmed. This is part of that huge Cogent /8, I don't see a possible rangeblock here.  Awaiting administrative action – please hardblock the single IP for a year. I usually recommend two-year blocks, but given the range, I think going for a shorter one and revisiting when it expires makes more sense. Thanks. -- Blablubbs| talk 21:40, 24 May 2021 (UTC)

 Done -- Malcolmxl5 ( talk) 16:17, 25 May 2021 (UTC)

{{ proxycheckstatus}}

119.8.115.183 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Appears to be a sock behind a VPS/VPN. No edit history until today; edit summary shows extensive knowledge of WP. Normchou  ^💬 18:31, 12 May 2021 (UTC)

The IP is a web server hosted at Huawei Cloud. Possibly a VPN node. And on top of that Spur flags it as a residential proxy. 119.8.96.0/19 should be good to block. Someone may want to block all other ranges from ISP: HUAWEI CLOUDS. MarioGom ( talk) 19:23, 12 May 2021 (UTC)

While Huawei Cloud doesn't appear to offer colocation, this specific IP doesn't really look like a conventional anonymiser to me. Given the region, I think it's likely that Huawei ranges are going to have a good number of corporate gateways on them, used by Chinese companies who need access to a less filtered internet for business purposes; I'm not comfortable hardblocking the lot. However, softblocks seem warranted. The ranges are a little unwieldy here, but I think the below should cover everything.  Awaiting administrative action – please block the following, soft, two years each:

• 114.119.0.0/17 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
• 114.119.128.0/18 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
• 119.8.0.0/16 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
• 159.138.0.0/16 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
• 2405:f080::/32 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))

Thanks. -- Blablubbs| talk 09:57, 13 May 2021 (UTC)

 Done Softblocks only. -- Malcolmxl5 ( talk) 15:59, 26 May 2021 (UTC)

Thanks! Closing. -- Blablubbs| talk 16:52, 26 May 2021 (UTC)

{{ proxycheckstatus}}

62.102.148.128/26 · contribs · block · log · stalk · Robtex · whois · Google (whois: KUSTBANDET-AIRVPN-NETWORK)

91.214.169.68 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan (hostname: airvpn.dserver.softronics.ch)

The invidial IP is probably only an entry IP and not exit IP, but it can't hurt to block it. -- MarioGom ( talk) 21:24, 24 May 2021 (UTC)

•  Confirmed.  Awaiting administrative action – please hardblock 62.102.148.128/26 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) and 91.214.168.0/22 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) ( softronics per WHOIS) for two years each. The ASN for the former also deserves a look, but I don't have the time right now. Thanks. -- Blablubbs| talk 09:09, 26 May 2021 (UTC)
  •  Done -- Malcolmxl5 ( talk) 16:05, 26 May 2021 (UTC)
    • Thanks! Closing. -- Blablubbs| talk 16:52, 26 May 2021 (UTC)

{{ proxycheckstatus}}

158.58.172.73 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan it.gw.ivpn.net

Per DNS and Spur. Responds to IKE handshake. MarioGom ( talk) 20:41, 24 May 2021 (UTC)

 In progress. Big ASN, checking for blockable ranges. -- Blablubbs| talk 09:17, 25 May 2021 (UTC)

There's a lot here.  Awaiting administrative action: Please block the following, hard, two years each:

• 45.91.250.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (Secured Servers LLC)
• 45.85.156.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) ( Bigbox Infosoft LLC)
• 86.105.1.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) ( Fastserv)
• 91.238.33.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) ( Bigbox)
• 91.238.112.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (Bigbox)
• 92.114.92.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (Fastserv)
• 95.141.32.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (SeFlow.it Dedicated Servers - wf2 - Milan)
• 158.58.168.0/22 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (CloudFlow Virtual Datacenter
• 158.58.172.0/23 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (Seflow dedicated servers)
• 158.58.175.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (Seflow VPS)
• 176.105.252.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) ( Breezle)
• 176.126.83.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) ( Oneprovider
• 193.187.152.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) ( zoneidc, google translate at [3])
• 2a0d:c740:1c::/48 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (Breezle)
• 2a0d:c740:1a::/48 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (Breezle)
• 2a02:29e0::/32 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (Seflow)
• 2a06:e881:6200::/44 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) ( Ranxplorer)
• 2a07:1c40:1020::/44 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (Ranxplorer)
• 2a0c:b642:1a00::/44 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (Ranxplorer)

There are a number of other ranges named with the pattern italy_network<number> – they all belong to Seflow (the entire ASN does), but I'm not sure what they're doing. Someone braver than me may want to just block those as well, but I'll leave that up to you. Thanks. -- Blablubbs| talk 09:34, 25 May 2021 (UTC)

 Done -- Malcolmxl5 ( talk) 11:56, 29 May 2021 (UTC)

Many thanks, closing. -- Blablubbs| talk 11:58, 29 May 2021 (UTC)

{{ proxycheckstatus}}

38.34.184.226 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

jp1.celo.net SSL cert on port 999. MarioGom ( talk) 21:34, 24 May 2021 (UTC)

•  Confirmed. This is Enzu, a webhost that also does colocation, but seems to host proxies fairly frequently.  Awaiting administrative action, please hardblock 38.34.160.0/19 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) for two years. Thanks. -- Blablubbs| talk 08:18, 31 May 2021 (UTC)

 Done -- Malcolmxl5 ( talk) 12:16, 31 May 2021 (UTC)

{{ proxycheckstatus}}

96.9.192.0/18 · contribs · block · log · stalk · Robtex · whois · Google

Nexeon range with a very high amount of VPN servers (NordVPN, WorldVPN).

-- MarioGom ( talk) 13:14, 29 May 2021 (UTC)

• Yep, that's a lot of proxies.  Awaiting administrative action: Please hardblock 96.9.240.0/20 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) given the proxies, and place a softblock on the underlying range, 96.9.192.0/18 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)), both for two years. Thanks. -- Blablubbs| talk 08:34, 31 May 2021 (UTC)

 Done Hardblock for the /20; softblock for the /18.-- Malcolmxl5 ( talk) 12:14, 31 May 2021 (UTC)

{{ proxycheckstatus}}

91.90.44.0/26 · contribs · block · log · stalk · Robtex · whois · Google

Mullvad range. 91.90.44.18 can be verified by DNS no-osl-008.mullvad.net, or do some spot checks in the contributions list to Spur. Alternatively, the full Blix /21 at 91.90.40.0/21 can be blocked. A few other ranges from this AS are already blocked, see ISP: Blix Solutions AS. MarioGom ( talk) 15:35, 30 May 2021 (UTC)

•  Confirmed, considering that I'm on it right now and not currently in Norway. 91.90.44.28 ( talk) 08:38, 31 May 2021 (UTC)
•  Awaiting administrative action – per my logged-out editing above, please hardblock 91.90.44.0/26 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) for two years. The entire ASN needs a look, but I don't have the time right now ( 91.90.40.0/21 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) is indeed fine to hard- or softblock depending on your preference as well). -- Blablubbs| talk 08:41, 31 May 2021 (UTC)

  We probably do want to hardblock the /21 Blix range, see User:MarioGom/sandbox/ProxyReport#AS50304: BLIX, NO. MarioGom ( talk) 10:55, 4 June 2021 (UTC)

   Done Hardblocked the /21. -- Malcolmxl5 ( talk) 15:57, 4 June 2021 (UTC)

  Thanks, closing. -- Blablubbs| talk 18:01, 4 June 2021 (UTC)

{{ proxycheckstatus}}

185.155.96.135 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan ee.windscribe.com

185.155.96.203 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan ee.windscribe.com

-- MarioGom ( talk) 20:53, 24 May 2021 (UTC)

•  Confirmed. This is fairyhosting – there are some additional ranges involved. The provider also does colocation.  Awaiting administrative action: Please block 185.155.96.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) for two years. Recommend hardblock given the presence of VPN nodes; soft + single IP blocks for the two above is an option too. In addition, please block the following two fairyhosting ranges, either soft or hard, as you prefer:
  • 5.253.176.0/22 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
  • 185.215.184.0/22 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
• Thanks. -- Blablubbs| talk 08:11, 31 May 2021 (UTC)
  •  Done -- Malcolmxl5 ( talk) 12:41, 6 June 2021 (UTC)
    • Thanks, closing. @ Malcolmxl5: Feel free to close requests yourself if you want (just change {{ proxycheckstatus|admin}} to {{ proxycheckstatus|close}}). -- Blablubbs| talk 12:44, 6 June 2021 (UTC)

{{ proxycheckstatus}}

82.103.181.179 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Spur says 82.103.181.179 is part of Mullvad VPN. ISP is ASERGO, which appears to be a web host; Scamalytics says "They operate 16,121 IP addresses, almost all of which are running anonymizing VPNs, servers, Tor exit nodes, and public proxies." [4] Malcolmxl5 ( talk) 00:09, 6 June 2021 (UTC)

•  Confirmed, and there's more on the /18 (my current IP is 82.103.140.213, for example).  Awaiting administrative action – please block 82.103.128.0/18 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) and 2A00:9080::/32 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (both ASERGO) hard, two years. Thanks. -- Blablubbs| talk 08:01, 6 June 2021 (UTC)
  •  Done -- Malcolmxl5 ( talk) 12:35, 6 June 2021 (UTC)
    • Thanks, closing. -- Blablubbs| talk 12:36, 6 June 2021 (UTC)

{{ proxycheckstatus}}

Unblocked ProtonVPN nodes. MarioGom ( talk) 18:11, 6 May 2021 (UTC)

 In progress, looking for blockable ranges. -- Blablubbs| talk 16:00, 7 May 2021 (UTC)

This is a bit of a rabbit hole, bear with me. The IPs above are  Confirmed and there's a bunch of different webhosts involved.

• The first lot is in 46.20.152.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)), which is Doratelekom, a Turkish webhost. There's a lot more in the ASN, but I'm hesitant to action it without reading up some more, as a previous CU-block on a dora range indicates that there are also legitimate residential ranges here.

The second group is on a range that has normal residential IPs on it, so the following will have to be blocked individually:

• 85.132.252.35 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
• 85.132.252.36 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
• 85.132.252.37 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
• 85.132.252.38 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))

The 162. group is this DS provider and covered by 162.12.206.0/23 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)). Looking at the ASN here turned up some other ranges that are good to block:

The 185. ones are in 185.246.128.0/22 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)), which belongs to ICME, a webhost that also offers colocation (given the VPN IPs, this one should probably be hardblocked, or soft with individual blocks on the VPN IPs). Other ranges belonging to that provider are:

The 194. group is also serverion and covered by

• 194.31.96.0/23 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
• 194.99.44.0/23 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))

 Awaiting administrative action, please Hardblock the IPs I linked here for 2 years each. I'll leave it up to you whether you want to soft- or hardblock the ones where I noted colocation (or just leave the additional ranges alone entirely). -- Blablubbs| talk 16:44, 7 May 2021 (UTC)

@ Blablubbs: I've addressed all of these, I believe and added some of these ISP's to ASNBlock, which should clean up some others too. ^{!ɘM γɿɘυϘ} ⅃ϘƧ 00:38, 7 June 2021 (UTC)

{{ proxycheckstatus}}

162.255.138.226 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan usmia.jumptoserver.com

185.123.102.57 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan tr-iz-pptp-01.jumptoserver.com

45.179.88.31 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan br.jumptoserver.com

202.239.38.147 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan jp-tk-pptp-01.jumptoserver.com

194.15.196.117 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan pl2.jumptoserver.com

91.199.50.131 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan ro.jumptoserver.com

Unblocked IPs from this shady VPN company. All of them verified with DNS, Spur and Shodan (see SSL cert), except 45.179.88.31 which has no HTTP service as the others, but Spur flags, seems a webhost and responds to IKEv2 (UDP). MarioGom ( talk) 09:18, 22 May 2021 (UTC)

 In progress, checking for blockable ranges. -- Blablubbs| talk 10:11, 23 May 2021 (UTC)

The above IPs are all  Confirmed VPNs.  Awaiting administrative action: See below

• The first IP belongs to Netrouting/Colohost. If someone wants to go through: Most ranges in the ASN should be good to softblock, but there is at least one sublet residential range.
• The second belongs to Bilrom Dedicated Server Network - 4, which is sublet from alastyr, a Turkish webhost. The entire ASN should be good for two-year hardblocks – the ranges in questions are

• 2a02:d9c0::/29 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (will probably have to stick with the /32 there)
• 185.123.102.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
• 185.150.130.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
• 185.8.128.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
• 185.8.32.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
• 5.2.80.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))

• The third is Hostzone Brazil. Can't find much about the ISP, but I'm going to go out on a limb and say it's a webhost; please block 45.179.88.0/22 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) for two years, either soft + single IP hardblock or hard for the range.
• The fourth has a pretty convoluted WHOIS. The ASN belongs to IDC Frontier data centres, no ranges are blocked. Might merit further investigation – I can say that 202.239.38.128/25 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) is ehost idc and should probably be hardblocked given the VPN on it – alternatively, you can softblock the range and hardblock the VPN IP.
• The fifth is BrainStorm Network aka oneprovider, which doesn't appear to do colocation, so 194.15.196.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) is good for a hardblock. The ASN is "Artnet" and has some of the most nondescript WHOIS outputs I've ever seen. Can't find much about this provider, but looking at this, the ranges are probably at least good for softblocks if someone wants to hand those out.
• The last one is netrouting again, see above. Recommend either hardblock for 91.199.50.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)), or single IP hardblock + soft for the range(s).

Best, -- Blablubbs| talk 10:31, 23 May 2021 (UTC)

@ Blablubbs: I've addressed all of these directly, and added a couple to ASNBlock. ^{!ɘM γɿɘυϘ} ⅃ϘƧ 00:49, 7 June 2021 (UTC)

{{ proxycheckstatus}}

136.144.33.0/24 · contribs · block · log · stalk · Robtex · whois · Google

136.144.33.206 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan usa-losangeles-1-ca-version-2.expressnetw.com

136.144.33.146 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan usa-losangeles-1-ca-version-2.expressnetw.com

Got the 2 individual IPs from DNS enumeration, but the whole /24 seems to be ExpressVPN per whois (PANQ-VPN) and random Spur spot checks. MarioGom ( talk) 20:49, 24 May 2021 (UTC)

•  Confirmed, plus a bunch of webnx ranges.  Awaiting administrative action, please hardblock the following for two years:
  • 136.144.33.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) (see above)
  • 103.11.67.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) ( HostUS VPS)
  • 172.86.144.0/21 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) ( Corgitech VPS
• The following are other webnx ranges; the provider also offers colocation – I'd go with softblocks, but hard is fine too, as you prefer:
  • 23.252.112.0/20 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
  • 100.42.208.0/20 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
  • 107.182.160.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
  • 142.4.32.0/19 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
  • 192.69.192.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
  • 216.158.64.0/19 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
  • 2607:f2d8::/32 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log))
• Thanks. -- Blablubbs| talk 15:46, 30 May 2021 (UTC)

  @ Blablubbs: I've blocked the 3  Confirmed ranges directly, and added a lot of the rest (plus a BIG haul on AS1239) to ASNBlock. ^{!ɘM γɿɘυϘ} ⅃ϘƧ 01:02, 7 June 2021 (UTC)

  @ SQL: Thanks for all your work. :) -- Blablubbs| talk 08:43, 7 June 2021 (UTC)

{{ proxycheckstatus}}

92.38.175.0/24 · contribs · block · log · stalk · Robtex · whois · Google

G-Core Labs , see whois. This ASN has many ranges blocked already. 92.38.175.0/27 is PureVPN (pointtoserver, see whois). MarioGom ( talk) 11:51, 30 May 2021 (UTC)

Blocked the range. GeneralNotability ( talk) 19:51, 6 June 2021 (UTC)

{{ proxycheckstatus}}

193.228.99.5 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test/lookup/193.228.99.5

213.162.73.160 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test/lookup/213.162.73.160

213.162.80.225 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test/lookup/213.162.80.225

I want to report proxies vpn doing vandal on pages. 112.172.112.143 ( talk) 08:35, 9 June 2021 (UTC)

I took the freedom to fix the formatting of your report. MarioGom ( talk) 09:10, 9 June 2021 (UTC)

IPs are  not proxies, closing. 112.172.112.143, please note that suspicion that an IP is a proxy is not grounds for reversion on its own. -- Blablubbs| talk 10:40, 9 June 2021 (UTC)

{{ proxycheckstatus}}

194.44.36.31 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: This proxy interfered with an SPI case [5] during which a number of other proxies were blocked. This is possibly the same person who used other proxies. My very best wishes ( talk) 03:38, 11 June 2021 (UTC)

Looking at it individually, I doubt this is currently a proxy. However, it might be worth to compare to other IPs in the SPI to have a clearer picture. MarioGom ( talk) 07:59, 11 June 2021 (UTC)

I checked this one at the time; I agree that it's pretty  Unlikely, maybe  Possible if you really stretch it. Even if I could confirm, this is not a type of proxy where there's all that much use in blocking. Closing. -- Blablubbs| talk 11:12, 11 June 2021 (UTC)

{{ proxycheckstatus}}

146.70.38.0/24 · contribs · block · log · stalk · Robtex · whois · Google

M247-LTD-ARGENTINA range. PIA servers on 146.70.38.131, 146.70.38.132, 146.70.38.141, 146.70.38.142. MarioGom ( talk) 19:23, 28 May 2021 (UTC)

I think the whole 146.70.0.0/16 is M247. MarioGom ( talk) 12:38, 31 May 2021 (UTC)

Here's a list of some of the PIA and CyberGhost servers I found in the /16. You can find more by cross-checking xwiki contributions of 146.70.0.0/16 with spur.

-- MarioGom ( talk) 18:17, 9 June 2021 (UTC)

• I checked random IPs in the /16; it's almost certainly all M247.  Awaiting administrative action – please hardblock 146.70.0.0/16 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) for two years. Thanks. -- Blablubbs| talk 11:57, 11 June 2021 (UTC)

   Done -- Malcolmxl5 ( talk) 08:13, 12 June 2021 (UTC)

{{ proxycheckstatus}}

176.67.85.0/24 · contribs · block · log · stalk · Robtex · whois · Google

The range belongs to Mudhook Marketing (IPVanish), see whois. There are many confirmed IPVanish nodes within the ranges. Also, hundreds of other VPN servers (already blocked) in the same ASN. MarioGom ( talk) 11:34, 29 May 2021 (UTC)

•  Confirmed.  Awaiting administrative action, please hardblock 176.67.85.0/24 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) for two years. The rest of the ASN is already whacked. Thanks. -- Blablubbs| talk 11:45, 11 June 2021 (UTC)

   Done -- Malcolmxl5 ( talk) 08:10, 12 June 2021 (UTC)

{{ proxycheckstatus}}

152.228.128.0/17 · contribs · block · log · stalk · Robtex · whois · Google

OVH, see whois. WorldVPN servers on 152.228.210.107 and 152.228.215.225. MarioGom ( talk) 11:48, 30 May 2021 (UTC)

I've learnt today about OVH's mess mixing DSL and hosting ranges. The /17 is probably not the best option and sub-ranges should be checked instead. MarioGom ( talk) 07:09, 7 June 2021 (UTC)

•  Confirmed both individual IPs. Concur about the complicated ranges – the /17 is too wide. However, 152.228.128.0/22 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser ( log)) is VPS-SBG6, so very likely safe to block.  Awaiting administrative action – please hardblock it for two years. Thanks. -- Blablubbs| talk 11:48, 11 June 2021 (UTC)

   Done -- Malcolmxl5 ( talk) 08:03, 12 June 2021 (UTC)

{{ proxycheckstatus}}

94.64.198.226 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: the proxy is engaged in edit warring, possibly on behalf of a named account. My very best wishes ( talk) 03:13, 11 June 2021 (UTC)

•  Confirmed, no details per BEANS.  Awaiting administrative action, please block the individual IP for two weeks. Thanks. -- Blablubbs| talk 11:14, 11 June 2021 (UTC)
• Since blocked 72h for edit warring. Should be enough for this one. Closing. -- Blablubbs| talk 17:22, 12 June 2021 (UTC)