Wikipedia:WikiProject on open proxies

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
←Administration index MetaProject on open proxies (en-Wikipedia chapter)
 If you've been blocked as an open proxy, please see: Help:blocked.

The multiwiki MetaProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.

Proxyblock.png
Open proxies may be blocked from editing

Automated lists and tools[edit]

  • User:SQL/Non-blocked compute hosts maintained by User:SQLBot is a list of open proxy ranges that need assessment for blocks that is updated daily. Admins are encouraged to review the list and assess for blocks as needed. All administrators are individually responsible for any blocks they make based on that list.
  • ISP Rangefinder is a tool that allows administrators to easily identify and hard block all ranges for an entire ISP. It should be used with extreme caution, but is useful for blocking known open proxy providers. All administrators are individually responsible for any blocks they make based on the results from this tool.
  • IPCheck is a tool that can help provide clues about potential open proxies.

Reporting[edit]

Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.

File a new report here
I. For block requests:
Verify that the following criteria has been met:
  • The IP has made abusive contributions within the past week
For unblock requests:
Verify that the following criteria has been met:
  • No current criteria
II. For block requests For unblock requests
Replace "IP" below with the IP address you are reporting.
Replace "IP" below with the IP address you are reporting.


III. Fill out the resulting page and fill-in the requested information.
IV. Save the page.
Verified Users/Sysops Templates
  • IP is an open proxy {{Proxycheck|confirmed}} for confirmed open proxies and TOR exit nodes.
  •  Likely IP is an open proxy {{Proxycheck|likely}} for likely open proxies and TOR exit nodes.
  •  Possible IP is an open proxy {{Proxycheck|possible}} for possible open proxies and TOR exit nodes.
  •  Unlikely IP is an open proxy {{Proxycheck|unlikely}} for unlikely open proxies and TOR exit nodes.
  • Not currently an open proxy {{Proxycheck|unrelated}} for IP's confirmed not to be an open proxy or TOR exit node.
  • Inconclusive {{Proxycheck|inconclusive}} for IP's that are inconclusive.
  •  Declined to run a check {{Proxycheck|decline}} to decline a check.
  • Open proxy blocked {{Proxycheck|blocked}} for open proxies and TOR nodes that have been blocked. Please add this if you block the IP.

Requests[edit]

138.43.96.0/20[edit]

Symbol comment vote.svg – This proxy check request is closed and will soon be archived by a bot.

138.43.96.0/20 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - IPQS - ipcheck - Google - HTTP - stalk

Reason: Seeing some edit filter hits on a few IPs within this range. WHOIS indicates some sort of colo. -- LuK3 (Talk) 18:29, 21 September 2020 (UTC)

Reading between the lines on the provider's website, it looks like some kind of fancy cloud VPN with monitoring. I see almost nothing constructive coming out of the range. Colo softblock is probably appropriate here, I'll give it a six month block. GeneralNotability (talk) 14:52, 12 October 2020 (UTC)
I updated the block to the standard. Iboss does seem like colocation. -- Amanda (aka DQ) 20:32, 21 October 2020 (UTC)

152.32.108.102[edit]

Symbol comment vote.svg – This proxy check request is closed and will soon be archived by a bot.

152.32.108.102 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - IPQS - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits, multiple sock farms active at article this IP has edited, likely block evasion. IPqualityscore reports IP Reported as Blacklisted & Proxy/VPN Detected. ☆ Bri (talk) 13:24, 26 September 2020 (UTC)

Ths IP appears to be a high-risk proxy based on the proxy checker. Firestar464 (talk) 06:44, 14 October 2020 (UTC)

Firestar464, you need to do a more in-depth search than just reading what the proxy checker says. Same for the below. GeneralNotability (talk) 22:35, 14 October 2020 (UTC)
GeneralNotability I'm not certified. I'm just presenting my findings. Firestar464 (talk) 01:57, 15 October 2020 (UTC)
Not currently an open proxy IPQS is the only one indicating. Some spam from March, but nothing to be concerning. -- Amanda (aka DQ) 20:36, 21 October 2020 (UTC)

Beauty pageant SPA proxies[edit]

Symbol comment vote.svg – This proxy check request is closed and will soon be archived by a bot.

108.21.69.90 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - IPQS - ipcheck - Google - HTTP - stalk IPQualityScore lists as proxy & VPN, fraud score 75
209.52.89.130 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - IPQS - ipcheck - Google - HTTP - stalk IPQualityScore lists as proxy & VPN, fraud score 75
202.80.213.234 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - IPQS - ipcheck - Google - HTTP - stalk IPqualityscore lists as a proxy

Reason: Suspicious single-purpose editing; edits in a common set of beauty pageant articles. ☆ Bri (talk) 22:09, 4 October 2020 (UTC)

209.52.89.130 resolves to w2kweb.pacificgroup.net, Nmap gives me two open ports - one is SSH, the other is 8080 but doesn't appear to be an open proxy (though it appears to be some kind of embedded management device).

The first one is not a proxy. The second is a high-risk proxy. The third is a low-risk proxy. Firestar464 (talk) 06:21, 14 October 2020 (UTC)

108.21.69.90 - Not currently an open proxy - IPQS is the only one flagging.
209.52.89.130 - Not currently an open proxy - IP is sublet from telus to Pacific Customs Brokers. IPQS is the only one flagging.
202.80.213.234 - Not currently an open proxy - 8080 requires login, therefore not an open proxy, and not blockable based on that alone.
-- Amanda (aka DQ) 20:46, 21 October 2020 (UTC)

76.85.70.60[edit]

Symbol comment vote.svg – This proxy check request is closed and will soon be archived by a bot.

76.85.70.60 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - IPQS - ipcheck - Google - HTTP - stalk

Likely an open proxy-other IPs used. Check for "loser". Likely from IPShark. --67.85.37.186 (talk) 21:22, 14 October 2020 (UTC)

Not likely to be an open proxy it is a low-risk IP from a guanine ISP (Spectrum) but should likely be blocked due to vandalism 🌸 1.Ayana 🌸 (talk) 22:22, 14 October 2020 (UTC)
1.Ayana, did you do any checking besides reading the output of the "proxy checker" link? You will need to do a more in-depth check than that. Open proxies can be operating from real ISPs. GeneralNotability (talk) 22:36, 14 October 2020 (UTC)
GeneralNotability I should have done a more in-depth check before posting so please disregard my post.🌸 1.Ayana 🌸 (talk) 22:49, 14 October 2020 (UTC)
It appears to be coming from IPSharkk. Abuse reported. See also extensive ANI thread. --67.85.37.186 (talk) 22:54, 14 October 2020 (UTC)
67.85.37.186 The proxy checker showed that this is a normal IP. Firestar464 (talk) 02:02, 15 October 2020 (UTC)
Not currently an open proxy IPQS is the only one flagging. Charter is not one to regularly host proxies either. -- Amanda (aka DQ) 20:49, 21 October 2020 (UTC)

2.181.49.113[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

2.181.49.113 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - IPQS - ipcheck - Google - HTTP - stalk
2.181.56.253 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - IPQS - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits, possible beauty pageant sockfarm block evasion & listed as proxy by IPQualityScore ☆ Bri (talk) 13:11, 22 October 2020 (UTC)

Note regarding the first IP: A quick curl -x session gives no responses for HTTP, SOCKS4 or SOCKS5 proxies running on ports 80, 1080, 8080, 8888, 3128 or 8000. Haven't done any other checks yet (and would appreciate for someone to re-check anyway, given my lack of experience). Blablubbs (talk • contribs) 14:43, 22 October 2020 (UTC)

See also[edit]

Subpages
Related pages
Sister projects
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:WikiProject_on_open_proxies&oldid=984761069"