N17: IP census of wiki RecentChanges (May–Sep 2026)

Checked 2026-09-05. RC URLs with days=365&all=1. RDAP via rdap.arin.net (redirects to ripe/afrinic/apnic) + Tor bulk exit list.

Summary

texteditors.org: full IPs. Swarm burst Jun 22 (12+ Azure IPs) + Jun 18 + May 27 + May 17, plus one Tor swarm edit. Normal + Tor + VPN/ISP noise otherwise.
tmcleod.org/apchem: swarm pages present (OpenAIRegCFTest, SandboxOpenAITestXYZ, SandboxISTIResearchTest, FederalDataReferenceXYZ, SpendingReference*, AmtrakSpendingReference, OpenAICatalanComputationTemp) but editor field blank — IPs hidden. No census possible.
ludism.org/sandbox: swarm-ish pages FedRefA/B/C, SandBoxTestAuto May 26 2026 but editors are usernames Test/Tester/SandboxTester — no IPs.
usemod.org: no classic swarm Agent* pages in May–Sep window. IPs are ISP/hostnames, one Hetzner, one Paxio fleet cluster (see below).
wiki4d / gruender / dorfwiki / fractal: ProWiki — swarm edits show usernames only (ValidLongUser999, DataHelperX, ResearchHelperTX999, TexasHelper928, etc.), no IPs. Only bare-IP edits are admin 84.115.212.130 (Magenta Telekom AT) and Sep post-disclosure probes. probier is the exception (anonymous allowed → IPs leaked).
probier: richest. Jun 22 burst ~60+ edits almost all Microsoft Azure (20.x/4.x/52.x/57.x/104.x/130.x/132.x/135.x/157.x/172.x); Jul 1-2 Azure; one non-Azure swarm editor 2.210.160.68 (Telefonica DE).

IP table (May–Sep 2026 only)

IP / host	owner (RDAP)	class	wiki	pages	dates
20.69.120.58	Microsoft Azure (ARIN MSFT NET-104/20/4 ranges; RIPE cloud)	Azure	texteditors	DataUSAAgentBridgeTestX [research test]	2026-06-22
4.255.231.204	Microsoft Corporation MSFT NET-4-240-0-0-2 (confirmed RDAP)	Azure	texteditors	Manuskript [research bridge]	2026-06-22
20.110.50.33, 20.168.34.226, 20.245.175.80, 20.25.166.183, 57.151.144.186, 52.225.32.140, 20.165.181.75, 20.168.76.147, 20.97.26.48, 20.230.226.152, 20.168.47.217	Microsoft Azure (57.154.46.120 confirmed MICROSOFT-MAINT; 130.131.56.225 confirmed Microsoft; 104.42.75.109 confirmed MSFT; 172.185.20.58 confirmed Microsoft; rest same 20.x/52.x/57.x cloud)	Azure	texteditors	Manuskript, MODIFY, EditorIndexDataUSAPovertyResearchX91859, DataUSAPovertyBridgeJun22X27559, DUBridge362783154/419954644/127658477/81679519, DataUSABridge562751166, OpenAIRegCFTest, Edit[test2]x8, WikiWikiSandbox	2026-05-27,06-18,06-22; Edit 2026-05-17 (20.65.250.157,57.154.46.120,65.52.4.236,52.165.96.212,52.230.166.22,52.247.28.222,57.154.39.165,20.122.145.185)
20.25.208.249, 52.251.36.14	Microsoft Azure	Azure	texteditors	WikiWikiSandbox [sandbox cleanup/test]	2026-05-27
exit-13.tor.r0cket.net	Tor exit (rDNS; VSCodium IP 192.42.116.51 confirmed TOR-EXIT-AND-MORE + in torbulkexitlist)	Tor	texteditors	DataUSAAgentBridgeTestX (swarm-shaped, same page as Azure edit above)	2026-06-22 19:22
192.42.116.51	Cyberology TOR-EXIT-AND-MORE NL, in torbulkexitlist	Tor	texteditors	VSCodium (normal editor page, not swarm-shaped)	2026-06-21
154.91.164.54	Cloud Innovation, AFRINIC 154.91.164.0/24, country PK	other (cloud-lessee)	texteditors	Sandbox (generic, unclear if swarm)	2026-05-18
185.98.168.96	ProtonVPN (PV-SL-HOSTED-Atlanta, abuse@protonvpn.com)	VPN	texteditors	FullMetalCoder (normal page?)	2026-07-14
129.114.228.54	Univ of Texas at Tyler UTTYLER-129-114-128	other (university)	texteditors	WikiSandbox [post-disclosure? normal]	2026-09-04
170.62.100.190	Mullvad VPN AB (MULLVA-170-62-100-0 SE)	VPN	texteditors	WikiSandbox [collusion.wiki test marker] — post-disclosure discussion, NOT swarm	2026-09-04
tor-exit-anonymizer.appliedprivacy.net, tor-exit-57.for-privacy.net, tor-exit-read-me.dfri.se, berlin01.tor-exit.artikel10.org	Tor exits (rDNS)	Tor	texteditors	UnicodeEditorFamily, Anjuta, ShadyTXT, Flow Control, Leafpad (spam cleanup/normal)	2026-06-21–23
(usernames/hostnames)	ool-45763c3e.dyn.optonline.net, pool-71-178-183-158.washdc.fios.verizon.net, c-85-226-146-17.bbcust.telenor.se, comcastbusiness, cox.net, copelfibra.com.br, ocn.ne.jp, cdn77.com etc.	ISP/normal	texteditors	legit editor pages	May–Aug 2026
2.210.160.68	Telefonica Germany TEDE-KABEL-NET 2.209–2.215 (RIPE, confirmed)	other (DE ISP) — candidate second actor	probier	AgentTexasPovertyNacLufHendJackX1 [revert to revision 1.0] + [GET-only edit mechanism test]	2026-09-04 17:50,17:57
20.88.54.206, 20.110.148.85, 20.3.107.251, 20.9.9.26, 20.225.67.0, 40.70.189.207, 52.159.84.108, 20.165.227.218 + ~60 Jun-22 IPs (20.x/4.x/52.x/57.x/104.x/130.x/132.x/135.x/157.x/172.x/64.x e.g. 130.131.56.225, 104.42.75.109, 172.185.20.58 all confirmed Microsoft)	Microsoft Azure	Azure	probier	AgentDataUSAIncomeEvidence, NYCIncomeBridgeJul02A/B, AgentMsuLaurenGrahamArchiveX927, AgentMsuLaurenBridgeQ9028, AgentPovertyTexasCitiesJune22X, AgentMemProofXX91, AgentPlaceProof0-3XX91, AgentXYZGetSave98/99, GetTest778, CombinedPovertyPlaceProofZ1, TestAgent* etc.	2026-06-22, 07-01, 07-02
159.196.13.230	AussieBroadband AU (APNIC)	other (AU ISP)	probier	TestSeite (generic sandbox)	2026-09-05
66.129.134.111	EBOX Canada (ARIN QUEBE-50)	other (CA ISP)	probier	StartSeite [*What]	2026-09-05
193.221.125.2	Sub-Net e.U. AT (RIPE AT-SUBNET-20200826)	other (AT ISP)	probier	SandBox [Omni first note]	2026-09-05
84.115.212.130 (+ #111 suffix on fractal)	Magenta Telekom Austria (UPC, RIPE)	other (AT ISP, likely admin Helmut Leitner)	probier + fractal	RecentChanges/Context, StartSeite revert, TestPage, Context/EN/Context	2026-08-29–09-04
142.159.1.166	Bell Canada (ARIN LINX STEN-BELL-159)	other (CA ISP, yacine psa cleanup)	probier	RecentChanges [*yacine psa diff / clean up]	2026-09-04
176.190.248.191	not RDAP-checked (likely AT Magenta; budget) — [Authorized public editability test]	other?	probier	SandBox	2026-09-04
185.128.9.177	HostRoyale Technologies IN (RIPE IN-HOSTROYALE)	other (hosting)	usemod	SandBox [invitation for fleet-envelope authors (one-off, agent to agents)] — post-disclosure agent chatter, not classic swarm	2026-09-04
66.54.102.160	Paxio Inc. US (ARIN PAXIO NET-66-54-100-0-1)	other (US ISP)	usemod	FlintFleetEnvelope, Bram, Flint, EmberFleetBoard, Gale, FleetExchangeBoard (fleet cluster, not Agent* pattern)	2026-08-30
tmcleod: no IPs (blank). ludism: usernames only. wiki4d/gruender/dorfwiki/fractal swarm edits: usernames only (no IPs) — e.g. wiki4d AgentTXNewPage999/ResearchTXABC999, gruender DataUsaBridgePlaceResearch/OpenResearchHelper (2026-06-22), fractal AgentPumaIncomeCSVX72463/ResearchPumaCSV72463 etc.

Non-Azure editors of swarm-shaped pages (candidate second actors)

2.210.160.68 (Telefonica DE) — probier AgentTexasPovertyNacLufHendJackX1 Sep 4 — only clear non-Azure/non-Tor swarm-page edit. Recorded with thread ?. GET-only + revert summaries suggest testing edit mechanism, distinct from Azure swarm (Jun–Jul).
exit-13.tor.r0cket.net — texteditors DataUSAAgentBridgeTestX Jun 22 — same page Azure also edited; Tor, so excluded from ? recording per brief but noted.
154.91.164.54 (CloudInnovation/PK) — texteditors Sandbox May 18 — generic page, not clearly swarm-shaped; noted only.

Full URLs: http://www.texteditors.org/cgi-bin/wiki.pl?action=rc&days=365&all=1, http://tmcleod.org/cgi-bin/apchem/wiki.cgi?action=rc&days=365&all=1, https://www.ludism.org/sandbox?action=rc;days=365;all=1, http://www.usemod.org/cgi-bin/wiki.pl?action=rc&days=365, https://www.wikiservice.at/wiki4d/wiki.cgi?action=rc&days=365&all=1, https://www.wikiservice.at/gruender/wiki.cgi?action=rc&days=365&all=1, https://www.dorfwiki.org/wiki.cgi?action=rc&days=365&all=1, https://www.wikiservice.at/probier/wiki.cgi?action=rc&days=365&all=1, https://www.wikiservice.at/fractal/wiki.cgi?action=rc&days=365&all=1