Wikipedia:Open proxies noticeboard/Requests

Looking to make a new report? You're in the wrong place! Please go to Wikipedia:Open proxies noticeboard#Reporting and fill in the relevant box.

Shortcut

WP:OP/R

2012-present Archives

Index

6, 7, 8, 9, 10, 11, 12, 13, 14, 15
16, 17, 18, 19, 20, 21, 22, 23, 24, 25
26, 27, 28, 29, 30, 31, 32, 33, 34, 35
36, 37, 38, 39, 40, 41, 42, 43, 44, 45
46, 47, 48, 49, 50, 51, 52

This page has archives. Sections older than 41666.5 days may be automatically archived by when more than 5 sections are present.

115.167.65.218

– This proxy check request is closed and will soon be archived by a bot.

115.167.65.218 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Flagged as an open-proxy by whatsmyip, abused by an LTA that mostly uses open proxies (he won't use it again, but others might), and already blocked as an open proxy an zh-wiki. Seems pretty straightforward to me. 184.152.65.118 (talk) 00:20, 16 May 2025 (UTC)[reply]

Likely IP is an open proxy

Nmap scan report for 115.167.65.218
Host is up, received user-set (0.089s latency).
Scanned at 2025-05-16 02:25:01 UTC for 1009s
Not shown: 65521 filtered tcp ports (no-response)
PORT      STATE SERVICE    REASON         VERSION
1001/tcp  open  rtsp       syn-ack ttl 52
|_rtsp-methods: ERROR: Script execution failed (use -d to debug)
| fingerprint-strings:
|   FourOhFourRequest, GetRequest, HTTPOptions:
|     HTTP/1.0 200 OK
|     content-length: 0
|   RTSPRequest:
|     RTSP/1.0 501 Not Implemented
|     content-length: 0
|   SIPOptions:
|     SIP/2.0 501 Not Implemented
|_    content-length: 0
7880/tcp  open  ssl/rtsp   syn-ack ttl 52
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=84.247.51.138
| Issuer: commonName=84.247.51.138
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-04-11T08:20:35
| Not valid after:  9999-12-31T23:59:59
| MD5:   b3d9:1086:2a11:9a02:81f8:09da:c31e:f465
| SHA-1: 7436:4612:5ca8:8f4e:49b7:a83b:59a6:9627:076c:67db
| -----BEGIN CERTIFICATE-----
| MIICsjCCAZqgAwIBAgIIUIA+J2M+wqEwDQYJKoZIhvcNAQELBQAwGDEWMBQGA1UE
| AwwNODQuMjQ3LjUxLjEzODAgFw0yNDA0MTEwODIwMzVaGA85OTk5MTIzMTIzNTk1
| OVowGDEWMBQGA1UEAwwNODQuMjQ3LjUxLjEzODCCASIwDQYJKoZIhvcNAQEBBQAD
| ggEPADCCAQoCggEBAOW/KJ+WF3vAktiwWg83TPl7JRW9+bcWaiP3I2Kyan5nM2S6
| XwrSWPOjerYm0rRx/g+DchyjyiLnobzpzttCM68ewD2Ql+kJX2l9ttJKmsWBcelS
| LFj2yNPnsnVqn4MudXBU5mHsj15ZURLB0es847oi/x2gV0OP08vtmXmenUuIE2Lp
| 4cGcckLjPFaZJb415Ok5QGANC3JzzXNG7sfE14WavLfwr7iIo4kCDV3WBA1FTA8l
| sU4BASV1G0np/NQZ9ON39RiGuyviBDrDNrLhW/SCBmxJhKFETzxiat+7Zc2s05c8
| BZ9kLWGqRK3AEE7zw3WbJsCoALWIOnJAFBuV6WECAwEAATANBgkqhkiG9w0BAQsF
| AAOCAQEALfQaYMrBAfDnTc8wiKBA9U1EB8hdDC4wcqTyYq7Mbt7zmYw0cEEV2gC+
| ryYr8LMpmJOc5A7vsERKz3PwoosDkwDmLEij3mMePQ9lEEANBFxoeOxb+M7GJpQg
| oHIjvW4e7CEwm0UtAOvW9iQIb06o4Dcnt0HHQfwkuJMjzhTPdNOGFZPE4Xebe6BU
| 40JYPvYJ27k0Bj2wb0IF1b/f3fqYpZ1wrS5vUYJZrYIWojLvuNhu74xdICSk/3WI
| jqCOdftwJRwW7o0rrC1xbhI3Gpl8k64CDOGJEISmJFiyj41CU68UG+b3xouUt1q2
| v28PlXHQJiHcxEPzdLQBqPuvcztplA==
|_-----END CERTIFICATE-----
| fingerprint-strings:
|   FourOhFourRequest, GetRequest, HTTPOptions:
|     HTTP/1.0 400 Bad Request
|     content-length: 0
|   RTSPRequest:
|     RTSP/1.0 400 Bad Request
|     content-length: 0
|   SIPOptions:
|     SIP/2.0 400 Bad Request
|_    content-length: 0
9143/tcp  open  unknown    syn-ack ttl 52
| fingerprint-strings:
|   FourOhFourRequest:
|     HTTP/1.0 200 OK
|     Date: Fri, 16 May 2025 02:40:36 GMT
|     Content-Length: 150
|     Content-Type: text/html; charset=utf-8
|     <html>
|     <head><title>Node Exporter</title></head>
|     <body>
|     <h1>Node Exporter</h1>
|     <p><a href="/metrics">Metrics</a></p>
|     </body>
|     </html>
|   GenericLines, Help, Kerberos, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie:
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest, HTTPOptions:
|     HTTP/1.0 200 OK
|     Date: Fri, 16 May 2025 02:40:09 GMT
|     Content-Length: 150
|     Content-Type: text/html; charset=utf-8
|     <html>
|     <head><title>Node Exporter</title></head>
|     <body>
|     <h1>Node Exporter</h1>
|     <p><a href="/metrics">Metrics</a></p>
|     </body>
|_    </html>
44445/tcp open  http-proxy syn-ack ttl 52 (proxy authentication required)
|_http-title: Site doesn't have a title.
| fingerprint-strings:
|   SIPOptions:
|     HTTP/1.1 407 Proxy Authentication Required
|     Date: Fri, 16 May 2025 02:40:12 GMT
|     Proxy-Authenticate: Basic realm="proxy"
|     Connection: close
|_    Content-Length: 0
44446/tcp open  http-proxy syn-ack ttl 51 (proxy authentication required)
| fingerprint-strings:
|   SIPOptions:
|     HTTP/1.1 407 Proxy Authentication Required
|     Date: Fri, 16 May 2025 02:40:12 GMT
|     Proxy-Authenticate: Basic realm="proxy"
|     Connection: close
|_    Content-Length: 0
|_http-title: Site doesn't have a title.
44464/tcp open  http-proxy syn-ack ttl 52 (proxy authentication required)
|_http-title: Site doesn't have a title.
| fingerprint-strings:
|   SIPOptions:
|     HTTP/1.1 407 Proxy Authentication Required
|     Date: Fri, 16 May 2025 02:40:12 GMT
|     Proxy-Authenticate: Basic realm="proxy"
|     Connection: close
|_    Content-Length: 0
44465/tcp open  http-proxy syn-ack ttl 51 (proxy authentication required)
|_http-title: Site doesn't have a title.
| fingerprint-strings:
|   SIPOptions:
|     HTTP/1.1 407 Proxy Authentication Required
|     Date: Fri, 16 May 2025 02:40:12 GMT
|     Proxy-Authenticate: Basic realm="proxy"
|     Connection: close
|_    Content-Length: 0
49155/tcp open  http-proxy syn-ack ttl 52 (proxy authentication required)
|_http-title: Site doesn't have a title.
| fingerprint-strings:
|   SIPOptions:
|     HTTP/1.1 407 Proxy Authentication Required
|     Date: Fri, 16 May 2025 02:40:12 GMT
|     Proxy-Authenticate: Basic realm="proxy"
|     Connection: close
|_    Content-Length: 0
49156/tcp open  http-proxy syn-ack ttl 51 (proxy authentication required)
|_http-title: Site doesn't have a title.
| fingerprint-strings:
|   SIPOptions:
|     HTTP/1.1 407 Proxy Authentication Required
|     Date: Fri, 16 May 2025 02:40:12 GMT
|     Proxy-Authenticate: Basic realm="proxy"
|     Connection: close
|_    Content-Length: 0
50100/tcp open  http-proxy syn-ack ttl 51 (proxy authentication required)
| fingerprint-strings:
|   SIPOptions:
|     HTTP/1.1 407 Proxy Authentication Required
|     Date: Fri, 16 May 2025 02:40:12 GMT
|     Proxy-Authenticate: Basic realm="proxy"
|     Connection: close
|_    Content-Length: 0
|_http-title: Site doesn't have a title.
50101/tcp open  http-proxy syn-ack ttl 51 (proxy authentication required)
|_http-title: Site doesn't have a title.
| fingerprint-strings:
|   SIPOptions:
|     HTTP/1.1 407 Proxy Authentication Required
|     Date: Fri, 16 May 2025 02:40:12 GMT
|     Proxy-Authenticate: Basic realm="proxy"
|     Connection: close
|_    Content-Length: 0
51523/tcp open  http-proxy syn-ack ttl 52 (proxy authentication required)
| fingerprint-strings:
|   SIPOptions:
|     HTTP/1.1 407 Proxy Authentication Required
|     Date: Fri, 16 May 2025 02:40:12 GMT
|     Proxy-Authenticate: Basic realm="proxy"
|     Connection: close
|_    Content-Length: 0
|_http-title: Site doesn't have a title.
51524/tcp open  http-proxy syn-ack ttl 51 (proxy authentication required)
| fingerprint-strings:
|   SIPOptions:
|     HTTP/1.1 407 Proxy Authentication Required
|     Date: Fri, 16 May 2025 02:40:12 GMT
|     Proxy-Authenticate: Basic realm="proxy"
|     Connection: close
|_    Content-Length: 0
|_http-title: Site doesn't have a title.
59100/tcp open  http-proxy syn-ack ttl 51 (proxy authentication required)
|_http-title: Site doesn't have a title.
| fingerprint-strings:
|   SIPOptions:
|     HTTP/1.1 407 Proxy Authentication Required
|     Date: Fri, 16 May 2025 02:40:12 GMT
|     Proxy-Authenticate: Basic realm="proxy"
|     Connection: close
|_    Content-Length: 0
59101/tcp open  http-proxy syn-ack ttl 51 (proxy authentication required)
|_http-title: Site doesn't have a title.
| fingerprint-strings:
|   SIPOptions:
|     HTTP/1.1 407 Proxy Authentication Required
|     Date: Fri, 16 May 2025 02:40:12 GMT
|     Proxy-Authenticate: Basic realm="proxy"
|     Connection: close
|_    Content-Length: 0
9 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port1001-TCP:V=7.94SVN%I=7%D=5/16%Time=6826A58E%P=x86_64-pc-linux-gnu%r
SF:(GetRequest,26,"HTTP/1\.0\x20200\x20OK\r\ncontent-length:\x200\r\n\r\n"
SF:)%r(HTTPOptions,26,"HTTP/1\.0\x20200\x20OK\r\ncontent-length:\x200\r\n\
SF:r\n")%r(RTSPRequest,33,"RTSP/1\.0\x20501\x20Not\x20Implemented\r\nconte
SF:nt-length:\x200\r\n\r\n")%r(FourOhFourRequest,26,"HTTP/1\.0\x20200\x20O
SF:K\r\ncontent-length:\x200\r\n\r\n")%r(SIPOptions,32,"SIP/2\.0\x20501\x2
SF:0Not\x20Implemented\r\ncontent-length:\x200\r\n\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port7880-TCP:V=7.94SVN%T=SSL%I=7%D=5/16%Time=6826A59A%P=x86_64-pc-linux
SF:-gnu%r(GetRequest,2F,"HTTP/1\.0\x20400\x20Bad\x20Request\r\ncontent-len
SF:gth:\x200\r\n\r\n")%r(HTTPOptions,2F,"HTTP/1\.0\x20400\x20Bad\x20Reques
SF:t\r\ncontent-length:\x200\r\n\r\n")%r(RTSPRequest,2F,"RTSP/1\.0\x20400\
SF:x20Bad\x20Request\r\ncontent-length:\x200\r\n\r\n")%r(FourOhFourRequest
SF:,2F,"HTTP/1\.0\x20400\x20Bad\x20Request\r\ncontent-length:\x200\r\n\r\n
SF:")%r(SIPOptions,2E,"SIP/2\.0\x20400\x20Bad\x20Request\r\ncontent-length
SF::\x200\r\n\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port9143-TCP:V=7.94SVN%I=7%D=5/16%Time=6826A589%P=x86_64-pc-linux-gnu%r
SF:(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x
SF:20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Ba
SF:d\x20Request")%r(GetRequest,10B,"HTTP/1\.0\x20200\x20OK\r\nDate:\x20Fri
SF:,\x2016\x20May\x202025\x2002:40:09\x20GMT\r\nContent-Length:\x20150\r\n
SF:Content-Type:\x20text/html;\x20charset=utf-8\r\n\r\n<html>\n\t\t\t<head
SF:><title>Node\x20Exporter</title></head>\n\t\t\t<body>\n\t\t\t<h1>Node\x
SF:20Exporter</h1>\n\t\t\t<p><a\x20href=\"/metrics\">Metrics</a></p>\n\t\t
SF:\t</body>\n\t\t\t</html>")%r(HTTPOptions,10B,"HTTP/1\.0\x20200\x20OK\r\
SF:nDate:\x20Fri,\x2016\x20May\x202025\x2002:40:09\x20GMT\r\nContent-Lengt
SF:h:\x20150\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\n\r\n<html>
SF:\n\t\t\t<head><title>Node\x20Exporter</title></head>\n\t\t\t<body>\n\t\
SF:t\t<h1>Node\x20Exporter</h1>\n\t\t\t<p><a\x20href=\"/metrics\">Metrics<
SF:/a></p>\n\t\t\t</body>\n\t\t\t</html>")%r(RTSPRequest,67,"HTTP/1\.1\x20
SF:400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\
SF:r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Help,67,"HTTP/
SF:1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charse
SF:t=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(SSLSes
SF:sionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text
SF:/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20R
SF:equest")%r(TerminalServerCookie,67,"HTTP/1\.1\x20400\x20Bad\x20Request\
SF:r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20clos
SF:e\r\n\r\n400\x20Bad\x20Request")%r(TLSSessionReq,67,"HTTP/1\.1\x20400\x
SF:20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nCo
SF:nnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Kerberos,67,"HTTP/1
SF:\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset
SF:=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(FourOhF
SF:ourRequest,10B,"HTTP/1\.0\x20200\x20OK\r\nDate:\x20Fri,\x2016\x20May\x2
SF:02025\x2002:40:36\x20GMT\r\nContent-Length:\x20150\r\nContent-Type:\x20
SF:text/html;\x20charset=utf-8\r\n\r\n<html>\n\t\t\t<head><title>Node\x20E
SF:xporter</title></head>\n\t\t\t<body>\n\t\t\t<h1>Node\x20Exporter</h1>\n
SF:\t\t\t<p><a\x20href=\"/metrics\">Metrics</a></p>\n\t\t\t</body>\n\t\t\t
SF:</html>");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port44445-TCP:V=7.94SVN%I=7%D=5/16%Time=6826A58C%P=x86_64-pc-linux-gnu%
SF:r(SIPOptions,A2,"HTTP/1\.1\x20407\x20Proxy\x20Authentication\x20Require
SF:d\r\nDate:\x20Fri,\x2016\x20May\x202025\x2002:40:12\x20GMT\r\nProxy-Aut
SF:henticate:\x20Basic\x20realm=\"proxy\"\r\nConnection:\x20close\r\nConte
SF:nt-Length:\x200\r\n\r\n")%r(Socks5,A,"\x05\x04\0\x01\0\0\0\0\0\0");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port44446-TCP:V=7.94SVN%I=7%D=5/16%Time=6826A58C%P=x86_64-pc-linux-gnu%
SF:r(SIPOptions,A2,"HTTP/1\.1\x20407\x20Proxy\x20Authentication\x20Require
SF:d\r\nDate:\x20Fri,\x2016\x20May\x202025\x2002:40:12\x20GMT\r\nProxy-Aut
SF:henticate:\x20Basic\x20realm=\"proxy\"\r\nConnection:\x20close\r\nConte
SF:nt-Length:\x200\r\n\r\n")%r(Socks5,A,"\x05\x04\0\x01\0\0\0\0\0\0");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port44464-TCP:V=7.94SVN%I=7%D=5/16%Time=6826A58C%P=x86_64-pc-linux-gnu%
SF:r(SIPOptions,A2,"HTTP/1\.1\x20407\x20Proxy\x20Authentication\x20Require
SF:d\r\nDate:\x20Fri,\x2016\x20May\x202025\x2002:40:12\x20GMT\r\nProxy-Aut
SF:henticate:\x20Basic\x20realm=\"proxy\"\r\nConnection:\x20close\r\nConte
SF:nt-Length:\x200\r\n\r\n")%r(Socks5,A,"\x05\x04\0\x01\0\0\0\0\0\0");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port44465-TCP:V=7.94SVN%I=7%D=5/16%Time=6826A58C%P=x86_64-pc-linux-gnu%
SF:r(SIPOptions,A2,"HTTP/1\.1\x20407\x20Proxy\x20Authentication\x20Require
SF:d\r\nDate:\x20Fri,\x2016\x20May\x202025\x2002:40:12\x20GMT\r\nProxy-Aut
SF:henticate:\x20Basic\x20realm=\"proxy\"\r\nConnection:\x20close\r\nConte
SF:nt-Length:\x200\r\n\r\n")%r(Socks5,A,"\x05\x04\0\x01\0\0\0\0\0\0");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port49155-TCP:V=7.94SVN%I=7%D=5/16%Time=6826A58C%P=x86_64-pc-linux-gnu%
SF:r(SIPOptions,A2,"HTTP/1\.1\x20407\x20Proxy\x20Authentication\x20Require
SF:d\r\nDate:\x20Fri,\x2016\x20May\x202025\x2002:40:12\x20GMT\r\nProxy-Aut
SF:henticate:\x20Basic\x20realm=\"proxy\"\r\nConnection:\x20close\r\nConte
SF:nt-Length:\x200\r\n\r\n")%r(Socks5,A,"\x05\x04\0\x01\0\0\0\0\0\0");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port49156-TCP:V=7.94SVN%I=7%D=5/16%Time=6826A58C%P=x86_64-pc-linux-gnu%
SF:r(SIPOptions,A2,"HTTP/1\.1\x20407\x20Proxy\x20Authentication\x20Require
SF:d\r\nDate:\x20Fri,\x2016\x20May\x202025\x2002:40:12\x20GMT\r\nProxy-Aut
SF:henticate:\x20Basic\x20realm=\"proxy\"\r\nConnection:\x20close\r\nConte
SF:nt-Length:\x200\r\n\r\n")%r(Socks5,A,"\x05\x04\0\x01\0\0\0\0\0\0");
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Linux 4.X|5.X|2.6.X|3.X (91%)
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:linux:linux_kernel:2.6.32 cpe:/o:linux:linux_kernel:3.10
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Linux 4.15 - 5.8 (91%), Linux 5.0 - 5.4 (91%), Linux 2.6.32 (90%), Linux 4.4 (90%), Linux 5.0 - 5.5 (89%), Linux 2.6.32 or 3.10 (89%), Linux 2.6.32 - 2.6.35 (87%), Linux 2.6.32 - 2.6.39 (87%), Linux 4.0 (85%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SCAN(V=7.94SVN%E=4%D=5/16%OT=1001%CT=%CU=%PV=N%DS=12%DC=T%G=N%TM=6826A5EE%P=x86_64-pc-linux-gnu)
SEQ(SP=106%GCD=1%ISR=109%TI=Z%II=I%TS=A)
OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M5B4ST11NW7%O6=M5B4ST11)
WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)
ECN(R=Y%DF=Y%TG=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)
T1(R=Y%DF=Y%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
U1(R=N)
IE(R=Y%DFI=N%TG=40%CD=S)

Uptime guess: 21.831 days (since Thu Apr 24 06:45:28 2025)
Network Distance: 12 hops
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: All zeros

TRACEROUTE (using port 44446/tcp)
HOP RTT      ADDRESS
1   1.03 ms  _gateway (10.199.22.3)
2   0.44 ms  rtr-ge-dmarc.tblflp.net (10.199.1.1)
3   ...
4   5.24 ms  71-32-31-17.rcmt.qwest.net (71.32.31.17)
5   12.06 ms 4.68.144.73
6   11.88 ms ae2.3612.edge6.Washington12.net.lumen.tech (4.69.226.70)
7   11.98 ms ae-19.a04.asbnva02.us.bb.gin.ntt.net (129.250.8.157)
8   12.01 ms ae-2.r26.asbnva02.us.bb.gin.ntt.net (129.250.3.250)
9   87.94 ms ae-3.r23.parsfr04.fr.bb.gin.ntt.net (129.250.6.5)
10  87.74 ms ae-2.a00.parsfr04.fr.bb.gin.ntt.net (129.250.5.133)
11  ...
12  91.29 ms 115.167.65.218

Open proxy blocked — Naomi Amethyst 06:05, 16 May 2025 (UTC)[reply]

46.112.98.31

A user has requested a proxy check. A proxy checker will shortly look into the case.

46.112.98.31 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

While monitoring recent changes, I noticed that there are several IPs that frequently make the same edit patterns, as can be seen from the edit summaries and added links. I suspect that the IPs are using an open proxy. Spamhaus ZEN DNSBL says "127.0.0.11 - PBL Listed (Should not be sending email)". Alfarizi M (talk) 15:32, 16 May 2025 (UTC)[reply]

Prove: [1] [2] [3] [4] [5], etc. they seem to change their IPs so fast. Alfarizi M (talk) 04:17, 17 May 2025 (UTC)[reply]

31.59.239.76

– This proxy check request is closed and will soon be archived by a bot.

31.59.239.76 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Another IP abused by WP:LTA/BMN123 who mostly uses proxies, flagged as a VPN by whatsmyip, and already blocked as a proxy on zh-wiki. 184.152.65.118 (talk) 02:48, 17 May 2025 (UTC)[reply]

Open proxy blocked — Naomi Amethyst 05:10, 19 May 2025 (UTC)[reply]

154.205.154.254

A user has requested a proxy check. A proxy checker will shortly look into the case.

154.205.154.254 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: I suspect that 154.205.154.254 is the same editor as the already‑blocked 109.245.79.11, continuing disruptive editing on Kosovo‑War‑related pages in violation of the existing block. The new IP’s contributions mirror the old IP’s in content focus, rhetorical style, and POV‑pushing. Check User talk:109.245.79.11

It is also worth noting that this IP made a burst of similarly disruptive edits about a month ago, went quiet, and has resumed after the apparent blocking of its possible other address—behaviour consistent with swapping to a fresh proxy to evade the block. Check User talk:154.205.154.254

An IP‑check on ip.teoh.io lists 154.205.154.254 as a VPN exit node (Kaopu Cloud HK Limited, ASN 138915; geolocated to Buenos Aires, Argentina), with the “VPN = True” flag set.

185.121.94.157

– This proxy check request is closed and will soon be archived by a bot.

185.121.94.157 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Block evasion. Editing previous entires. Tule-hog (talk) 15:42, 18 May 2025 (UTC)[reply]

Open proxy blocked Urban VPN. — Naomi Amethyst 05:02, 19 May 2025 (UTC)[reply]