Wikipedia:WikiProject on open proxies

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
Administration index MetaProject on open proxies (en-Wikipedia chapter)
 If you've been blocked as an open proxy, please see: Help:blocked.

The multiwiki MetaProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.

Proxyblock.png
Open proxies may be blocked from editing

Automated lists and tools[edit]

  • User:SQL/Non-blocked compute hosts maintained by User:SQLBot is a list of open proxy ranges that need assessment for blocks that is updated daily. Admins are encouraged to review the list and assess for blocks as needed. All administrators are individually responsible for any blocks they make based on that list.
  • ISP Rangefinder is a tool that allows administrators to easily identify and hard block all ranges for an entire ISP. It should be used with extreme caution, but is useful for blocking known open proxy providers. All administrators are individually responsible for any blocks they make based on the results from this tool.
  • IPCheck is a tool that can help identify open proxies.

Reporting[edit]

Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.

File a new report here
I. For block requests:
Verify that the following criteria has been met:
  • The IP has made abusive contributions within the past week
For unblock requests:
Verify that the following criteria has been met:
  • No current criteria
II. For block requests For unblock requests
Replace "IP" below with the IP address you are reporting.


Replace "IP" below with the IP address you are reporting.


III. Fill out the resulting page and fill-in the requested information.
IV. Save the page.
Verified Users/Sysops Templates
  • IP is an open proxy {{Proxycheck|confirmed}} for confirmed open proxies and TOR exit nodes.
  •  Likely IP is an open proxy {{Proxycheck|likely}} for likely open proxies and TOR exit nodes.
  •  Possible IP is an open proxy {{Proxycheck|possible}} for possible open proxies and TOR exit nodes.
  •  Unlikely IP is an open proxy {{Proxycheck|unlikely}} for unlikely open proxies and TOR exit nodes.
  • Not currently an open proxy {{Proxycheck|unrelated}} for IP's confirmed not to be an open proxy or TOR exit node.
  • Inconclusive {{Proxycheck|inconclusive}} for IP's that are inconclusive.
  •  Declined to run a check {{Proxycheck|decline}} to decline a check.
  • Open proxy blocked {{Proxycheck|blocked}} for open proxies and TOR nodes that have been blocked. Please add this if you block the IP.

Requests[edit]

12.89.35.14 and others[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

12.89.35.14 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk
145.15.244.25 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits, is flagged as proxy by IPQualityScore via wmflabs ipcheck Bri.public (talk) 22:14, 10 October 2019 (UTC)

Add 145.15.244.25. Same type of editing. It is indicated by wmflabs ipcheck as proxy & recent abuse. ☆ Bri (talk) 19:18, 11 October 2019 (UTC)
There are more Miss World/Miss Earth edits from this range last year. If action is taken on this, I'd ask that this be taken into consideration. [1][2][3] - Bri.public (talk) 20:54, 11 October 2019 (UTC)

2a01:4f8:120:3247::2[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

2a01:4f8:120:3247::2 - talk - edits - block - log - current blocks - Robtex/whois- Google - [http://[2a01:4f8:120:3247::2] HTTP]

Reason: Requested unblock. Ivanvector (talk · contribs) blocked the 2A01:4F8:0:0:0:0:0:0/32 range but I can't find a history of abuses from this range. Also, what about using smaller ranges for blocking, like blocking some /48 instead of blocking a full /32? Carmelobrianza (talk) 10:28, 25 October 2019 (UTC)

  • The range is Hetzner, a German VPN/webhost/colocation provider. Per the checkuser logs this webhost has been used abusively by at least eight different long-term vandals, some of whom are extremely disruptive. I object to unblocking the range; it's impossible at this time to determine if a smaller subset of the range would make an effective block (WHOIS has /29 for the ISP). Please advise the user to disable their VPN or request an account. Ivanvector (Talk/Edits) 14:05, 25 October 2019 (UTC)

121.118.78.132[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

121.118.78.132 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits which can be checked against the Daryl Morey contributions by this now blocked proxy user. Lots of strong signs that they are the same person/people, which includesexactly the same way they write and sources they use. Flaughtin (talk) 18:37, 28 October 2019 (UTC)

 Likely IP is an open proxy: openvpn. It's probably a bit too stale to block at this point. -- zzuuzz (talk) 16:15, 15 November 2019 (UTC)

146.88.177.146[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

146.88.177.146 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits, high IPQualityScore fraud score and appears to be a data center called DataBank, according to whois. ☆ Bri (talk) 03:04, 1 November 2019 (UTC)

146.88.176.0/20 range blocked as a colocation webhost. NinjaRobotPirate (talk) 08:56, 3 November 2019 (UTC)

103.67.157.240[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

103.67.157.240 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: ACC check. High IPQuality fraud score, as shown at [4] OhKayeSierra (talk) 07:18, 1 November 2019 (UTC)

188.72.102.7[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

188.72.102.7 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: WHOIS reports this is PureVPN Bri.public (talk) 19:15, 6 November 2019 (UTC)

188.72.102.0/24 range blocked as a webhost. NinjaRobotPirate (talk) 04:52, 7 November 2019 (UTC)

37.190.128.0/17[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

37.190.151.98 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk
37.190.149.217 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk
‎37.190.150.185 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits by IPs noted above as if they are maintaining the Pier 1 Imports article financial data. Other weird edits from the Polish ISP range too, including possible promo on a Las Vegas concert residency [5]. ☆ Bri (talk) 23:17, 10 November 2019 (UTC)

154.160.xxx.yyy[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

154.160.11.77 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk
154.160.26.23 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk
154.160.30.55 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits; reported as proxy by proxycheck.io via wmflabs' ipcheck ☆ Bri (talk) 02:45, 11 November 2019 (UTC)

It was pointed out at COIN that ST47 blocked 154.160.26.23 based on long term abuse. The LTA [6] is not based in the ISP's geographic area, and routinely uses a proxy. ☆ Bri (talk) 15:34, 15 November 2019 (UTC)
I can tell you from experience (as well as looking at this) that among other things this network contains certified dynamic open proxies, several banned users, and CU-confirmed COI farms. There is however a lot of collateral when we block it. It is otherwise a normal network (and quite an important one). -- zzuuzz (talk) 16:04, 15 November 2019 (UTC)

185.83.71.18[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

185.83.71.18 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Used for sockpuppetry by Shingling334, reported as proxy by WhatIsMyIPAddress and IPQualityScore. IamNotU (talk) 17:57, 11 November 2019 (UTC)

Open proxy: 24 Shells hosting. Blocked by Favonian. -- zzuuzz (talk) 16:10, 15 November 2019 (UTC)

113.150.100.49[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

113.150.100.49 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious AfD nominations on high-profile pages. IPQualityScore gives an 89% chance of it operating as an open proxy, and it is blocked on ru.wiki and nl.wiki as an open proxy: [7]. 2601:1C0:4401:24A0:3C4C:2790:EFBB:586D (talk) 06:31, 12 November 2019 (UTC)

Open proxy: openvpn. It's probably expired by now, but I blocked it for a month anyway. -- zzuuzz (talk) 15:37, 15 November 2019 (UTC)

64.2.184.130[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

64.2.184.130 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits. User at this IP address made a few edits today at Occupation of the Malheur National Wildlife Refuge that appear to be nothing more than vandalism, and those have been the only edits from this IP address in the last week. But looking at the contributions from this IP address shows a long history of vandalism. A few examples of many: [8] [9] [10] [11] [12] [13] Please investigate. Thanks in advance! Yompi20 (talk) 21:00, 25 November 2019 (UTC)

36.71.234.89[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

36.71.234.89 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

This IP is making the same suspicious political POV edits (placing a map) on several wiki pages (including on foreign Wikipedia's as well). I checked it on several sites. All of them give that it is indeed a proxy. Reason: Suspicious edits Casperti (talk) 15:20, 6 December 2019 (UTC)

See also[edit]

Subpages[edit]

Related pages[edit]

Chapters[edit]