WikiProject on open proxies |
---|
The WikiProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.
|
Reporting
Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.
File a new report here | ||
I. | For block requests:
Verify that the following criterion has been met:
For unblock requests:
Verify that the following criteria has been met:
| |
II. | For block requests
Replace "IP" below with the IP address you are reporting. For unblock requests
Replace "IP" below with the IP address you are reporting. | |
III. | Fill out the resulting page and fill-in the requested information. | |
IV. | Save the page. |
Verified Users/Sysops Templates
|
---|
|
Requests
223.25.61.236
– This proxy check request is closed and will soon be archived by a bot.
- 223.25.61.236 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: suspicious edits at article recently abused by LTA & spur reports callback proxy ☆ Bri (talk) 15:18, 2 July 2022 (UTC)
- Not currently an open proxy. Since residential proxies often rotate quickly, it is possible it was a proxy when you reported, and it stopped acting as one now. Closing without action. MarioGom (talk) 19:35, 25 August 2022 (UTC)
90.167.174.0/24 and 90.167.177.0/24
– This proxy check request is closed and will soon be archived by a bot.
- 90.167.174.127 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 90.167.174.146 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 90.167.174.178 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 90.167.177.99 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 90.167.177.173 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 90.167.177.177 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: The individual IPs listed above appear to be activity of some LTAs in the beauty pageant space in the last ten days, with the exception of one active in May and the first address which was active late last year. Just wanted a quick check on these for proxy use. The editing follows the pattern of LTAs believed to be in Southeast Asia, with topics related to that geography, not Basque region consistent with geolocation. ☆ Bri (talk) 18:41, 5 July 2022 (UTC)
- Inconclusive. Given the pattern you describe, it might be possible there's some proxy hopping around 90.167.160.0/19 · contribs · block · log · stalk · Robtex · whois · Google, but I saw no technical evidence. Looking at activity in Spanish Wikipedia, it looks like a crowded range with actual activity from Spain (some vandalism, maybe some school, but it looks activity not coming from a proxy). Closing without action. I would suggest reporting elsewhere for vandalism if disruption continues. MarioGom (talk) 11:20, 26 August 2022 (UTC)
83.137.6.163
– This proxy check request is closed and will soon be archived by a bot.
- 83.137.6.163 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Looks to belong to a mobile operator, Lycamobile, could be softened? - RichT|C|E-Mail 18:53, 16 August 2022 (UTC)
- The IP was a P2P proxy at the time of the block. The block expired already. You can see some more info at {{Blocked p2p proxy}}. Closing. MarioGom (talk) 11:22, 26 August 2022 (UTC)
85.140.0.0/21
– This proxy check request is closed and will soon be archived by a bot.
- 85.140.0.0/21 · contribs · block · log · stalk · Robtex · whois · Google
Reason: A fairly active Russian ISP that's looking like a proxy network. Blocked from talk space for two years. Every IP in the contribution history that I’ve checked is flagged by Spur as belonging to a call-back proxy network and as a 'possible proxy'. Malcolmxl5 (talk) 12:51, 17 August 2022 (UTC)
- Russia is a proxy hotbed, so it's not unlikely that there are some floating around on that range; the spur flags are mostly non-concerning in a Wikipedia context, though some signs point towards botnet activity. A Shodan check on the range doesn't reveal anything out of the ordinary, so I don't have anything specific to hone in on, and I can't see any clear indication that there are proxies on that range that are being abused on Wikipedia. Closing. --Blablubbs (talk) 13:02, 17 August 2022 (UTC)
Unwired Broadband
A user has requested a proxy check. A proxy checker will shortly look into the case.
- 23.227.96.0/19 · contribs · block · log · stalk · Robtex · whois · Google
- 104.200.32.0/20 · contribs · block · log · stalk · Robtex · whois · Google
- 104.247.128.0/20 · contribs · block · log · stalk · Robtex · whois · Google
- 104.247.144.0/21 · contribs · block · log · stalk · Robtex · whois · Google
- 198.210.32.0/19 · contribs · block · log · stalk · Robtex · whois · Google
- 209.54.32.0/20 · contribs · block · log · stalk · Robtex · whois · Google
Reason: These ranges no longer appear to be used for hosting; the ones listed here are registered to Unwired Broadband (AS33548), which is a residential and business ISP. wizzito | say hello! 20:54, 22 August 2022 (UTC)
45.167.1.43
A user has requested a proxy check. A proxy checker will shortly look into the case.
- 45.167.1.43 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: suspicious edits in sockfarm infested pageants space, IPQualityScore comes through as 100% fraudulent, proxy ☆ Bri (talk) 04:22, 16 September 2022 (UTC)
Automated lists and tools
- User:AntiCompositeBot/ASNBlock maintained by User:AntiCompositeBot is a list of hosting provider ranges that need assessment for blocks that is updated daily. Admins are encouraged to review the list and assess for blocks as needed. All administrators are individually responsible for any blocks they make based on that list.
- ISP Rangefinder is a tool that allows administrators to easily identify and hard block all ranges for an entire ISP. It should be used with extreme caution, but is useful for blocking known open proxy providers. All administrators are individually responsible for any blocks they make based on the results from this tool.
- IPCheck is a tool that can help provide clues about potential open proxies.
- Bullseye provides information about IPS, including clues about potential open proxies.
- whois-referral is a generic WHOIS tool.
- Range block finder finds present and past range blocks.
See also
- Subpages
- Related pages
- Policy on open proxies
- Open proxy detection
- Guide to checking open proxies
- Proxy check result templates
- Advice to users using Tor to bypass the Great Firewall
- meta:XFF project
- Sister projects (defunct)