Wikipedia:WikiProject on open proxies

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
WikiProject on open proxies

The WikiProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.

  • If you've been blocked as an open proxy, please see: Help:blocked.
  • To report a proxy check or an incorrect block, see the #Reporting section.


Reporting[edit]

Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.

File a new report here
I.
For block requests:

Verify that the following criterion has been met:

  • The IP has made abusive contributions within the past week
For unblock requests:

Verify that the following criteria has been met:

  • No current criteria
II.

For block requests Replace "IP" below with the IP address you are reporting.


For unblock requests Replace "IP" below with the IP address you are reporting.


III. Fill out the resulting page and fill-in the requested information.
IV. Save the page.
Verified Users/Sysops Templates
  • IP is an open proxy {{Proxycheck|confirmed}} for confirmed open proxies and Tor exit nodes.
  •  Likely IP is an open proxy {{Proxycheck|likely}} for likely open proxies and Tor exit nodes.
  •  Possible IP is an open proxy {{Proxycheck|possible}} for possible open proxies and Tor exit nodes.
  •  Unlikely IP is an open proxy {{Proxycheck|unlikely}} for unlikely open proxies and Tor exit nodes.
  • Not currently an open proxy {{Proxycheck|unrelated}} for IP's confirmed not to be an open proxy or Tor exit node.
  • Inconclusive {{Proxycheck|inconclusive}} for IP's that are inconclusive.
  •  Declined to run a check {{Proxycheck|decline}} to decline a check.
  • Open proxy blocked {{Proxycheck|blocked}} for open proxies and Tor nodes that have been blocked. Please add this if you block the IP.

Requests[edit]


223.25.61.236[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: suspicious edits at article recently abused by LTA & spur reports callback proxy ☆ Bri (talk) 15:18, 2 July 2022 (UTC)Reply[reply]

90.167.174.0/24 and 90.167.177.0/24[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: The individual IPs listed above appear to be activity of some LTAs in the beauty pageant space in the last ten days, with the exception of one active in May and the first address which was active late last year. Just wanted a quick check on these for proxy use. The editing follows the pattern of LTAs believed to be in Southeast Asia, with topics related to that geography, not Basque region consistent with geolocation. ☆ Bri (talk) 18:41, 5 July 2022 (UTC)Reply[reply]

141.95.17.140[edit]

Symbol comment vote.svg – This proxy check request is closed and will soon be archived by a bot.

Reason: OVH VPS IP. For VPN/OP use - IPalyzer - RichT|C|E-Mail 02:41, 2 August 2022 (UTC)Reply[reply]

  •  Confirmed, blocked the /22. I'd usually go wider than that but OVH is pretty bad at labeling ranges, so I'm rather wary of collateral. Closing, thanks for the report. --Blablubbs (talk) 23:17, 4 August 2022 (UTC)Reply[reply]

93.189.6.34[edit]

Symbol comment vote.svg – This proxy check request is closed and will soon be archived by a bot.

Reason: Static web proxy,[1] abused for vote-stacking. CharlesWain (talk) 05:51, 5 August 2022 (UTC)Reply[reply]

83.137.6.163[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

83.137.6.163 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Looks to belong to a mobile operator, Lycamobile, could be softened? - RichT|C|E-Mail 18:53, 16 August 2022 (UTC)Reply[reply]

85.140.0.0/21[edit]

Symbol comment vote.svg – This proxy check request is closed and will soon be archived by a bot.

Reason: A fairly active Russian ISP that's looking like a proxy network. Blocked from talk space for two years. Every IP in the contribution history that I’ve checked is flagged by Spur as belonging to a call-back proxy network and as a 'possible proxy'. Malcolmxl5 (talk) 12:51, 17 August 2022 (UTC)Reply[reply]

  • Russia is a proxy hotbed, so it's not unlikely that there are some floating around on that range; the spur flags are mostly non-concerning in a Wikipedia context, though some signs point towards botnet activity. A Shodan check on the range doesn't reveal anything out of the ordinary, so I don't have anything specific to hone in on, and I can't see any clear indication that there are proxies on that range that are being abused on Wikipedia. Closing. --Blablubbs (talk) 13:02, 17 August 2022 (UTC)Reply[reply]

Automated lists and tools[edit]

  • User:AntiCompositeBot/ASNBlock maintained by User:AntiCompositeBot is a list of hosting provider ranges that need assessment for blocks that is updated daily. Admins are encouraged to review the list and assess for blocks as needed. All administrators are individually responsible for any blocks they make based on that list.
  • ISP Rangefinder is a tool that allows administrators to easily identify and hard block all ranges for an entire ISP. It should be used with extreme caution, but is useful for blocking known open proxy providers. All administrators are individually responsible for any blocks they make based on the results from this tool.
  • IPCheck is a tool that can help provide clues about potential open proxies.
  • Bullseye provides information about IPS, including clues about potential open proxies.
  • whois-referral is a generic WHOIS tool.
  • Range block finder finds present and past range blocks.

See also[edit]

Subpages
Related pages
Sister projects (defunct)