Wikipedia:WikiProject on open proxies

From Wikipedia, the free encyclopedia
WikiProject on open proxies
Shortcuts

The WikiProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.

  • If you've been blocked as an open proxy, please see: Help:blocked.
  • To report a proxy check or an incorrect block, see the #Reporting section.
Proxyblock.png
Open proxies may be blocked from editing


Reporting[edit]

Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.

File a new report here
I.
For block requests:

Verify that the following criterion has been met:

  • The IP has made abusive contributions within the past week
For unblock requests:

Verify that the following criteria has been met:

  • No current criteria
II.

For block requests Replace "IP" below with the IP address you are reporting.


For unblock requests Replace "IP" below with the IP address you are reporting.


III. Fill out the resulting page and fill-in the requested information.
IV. Save the page.
Verified Users/Sysops Templates
  • IP is an open proxy {{Proxycheck|confirmed}} for confirmed open proxies and Tor exit nodes.
  •  Likely IP is an open proxy {{Proxycheck|likely}} for likely open proxies and Tor exit nodes.
  •  Possible IP is an open proxy {{Proxycheck|possible}} for possible open proxies and Tor exit nodes.
  •  Unlikely IP is an open proxy {{Proxycheck|unlikely}} for unlikely open proxies and Tor exit nodes.
  • Not currently an open proxy {{Proxycheck|unrelated}} for IP's confirmed not to be an open proxy or Tor exit node.
  • Inconclusive {{Proxycheck|inconclusive}} for IP's that are inconclusive.
  •  Declined to run a check {{Proxycheck|decline}} to decline a check.
  • Open proxy blocked {{Proxycheck|blocked}} for open proxies and Tor nodes that have been blocked. Please add this if you block the IP.

Requests[edit]

This section is transcluded from /Requests. (edit | history)


Unwired Broadband[edit]

Pictogram voting wait violet.svg – A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.

23.227.96.0/19 · contribs · block · log · stalk · Robtex · whois · Google
104.200.32.0/20 · contribs · block · log · stalk · Robtex · whois · Google
104.247.128.0/20 · contribs · block · log · stalk · Robtex · whois · Google
104.247.144.0/21 · contribs · block · log · stalk · Robtex · whois · Google
198.210.32.0/19 · contribs · block · log · stalk · Robtex · whois · Google
209.54.32.0/20 · contribs · block · log · stalk · Robtex · whois · Google

Reason: These ranges no longer appear to be used for hosting; the ones listed here are registered to Unwired Broadband (AS33548), which is a residential and business ISP. wizzito | say hello! 20:54, 22 August 2022 (UTC)Reply[reply]

I agree it looks like these blocks are now obsolete. It's been long since they were added, and they seem to have changed hands from hosting to broadband since. Awaiting administrative action: Please, consider unblocking these. MarioGom (talk) 22:42, 17 November 2022 (UTC)Reply[reply]
I have lifted the local blocks on these ranges, but two of them are globally locked. It may be worth asking for the global blocks to be removed. JBW (talk) 13:16, 13 January 2023 (UTC)Reply[reply]

187.62.33.220[edit]

Pictogram voting wait violet.svg – A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.

Reason: Abused by the same sockmaster as 196.44.39.130 above; this one looks a bit more obvious 74.73.224.126 (talk) 03:28, 6 December 2022 (UTC)Reply[reply]

 Likely IP is an open proxy,  Confirmed to be some a proxy of some sort. Flagging for an admin to consider a block. —‍Mdaniels5757 (talk • contribs) 03:40, 6 December 2022 (UTC)Reply[reply]

41.220.146.207[edit]

Pictogram voting wait violet.svg – A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.

Reason: used by a block evading sock and reported as a possible proxy by spur and a high risk proxy connection by IP quality store. M.Bitton (talk) 23:48, 6 December 2022 (UTC)Reply[reply]

 Likely IP is an open proxy; admin: please consider a block. —‍Mdaniels5757 (talk • contribs) 01:02, 7 December 2022 (UTC)Reply[reply]
I think there is a high chance that this IP is not being used as a proxy, just a regular mobile connection in Algeria. The Spur flag is related to a high-end residential proxy service that is certainly not being used for this. MarioGom (talk) 09:34, 9 December 2022 (UTC)Reply[reply]

192.155.80.0/20[edit]

Pictogram voting wait violet.svg – A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.

Reason: Linode range, already globally blocked. - RichT|C|E-Mail 03:35, 13 December 2022 (UTC)Reply[reply]

Indeed. Please, consider blocking the range. Thank you. MarioGom (talk) 19:24, 16 December 2022 (UTC)Reply[reply]
The range is already blocked. No action needed. ZsinjTalk 02:37, 2 January 2023 (UTC)Reply[reply]
Not locally. As far as I know, it is relatively common to block these ranges locally even if they are globally blocked, since GIPBE/IPBE requirements are different. But if any patrolling admin thinks that's not worth it here, feel free to close the report. MarioGom (talk) 18:56, 5 January 2023 (UTC)Reply[reply]

154.160.27.219[edit]

Pictogram voting wait violet.svg – A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.

154.160.27.219 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: Mobile network, probably CGNAT. - RichT|C|E-Mail 11:49, 8 January 2023 (UTC)Reply[reply]

Rich: The IP has a P2P proxy running behind it, so it got a temporary block. It will expire soon. Are you requesting an unblock for this particular IP? MarioGom (talk) 16:16, 8 January 2023 (UTC)Reply[reply]
@MarioGom: Yea, don't worry about it. It's for an ACC request but we will just let it expire, all good :) - RichT|C|E-Mail 12:23, 9 January 2023 (UTC)Reply[reply]
Rich: Ok. Looking at the block log, chances are that it gets re-blocked some time after it. IPs in this ISP are blocked quite frequently, so the user might need to request IPBE. I have marked this for admin attention, maybe we need to loosen the block to anon. only. MarioGom (talk) 18:26, 10 January 2023 (UTC)Reply[reply]
@MarioGom: It would be nice if ST47ProxyBot was slightly less... bitey(?) with these and set anon only unless there is good reason not to - RichT|C|E-Mail 18:37, 10 January 2023 (UTC)Reply[reply]
@Rich Smith: IPs with this type of vulnerability are routinely used by LTAs to conduct campaigns of harassment and other dangerous behavior using accounts created from different ranges that are not or can not be blocked with account creation disabled. ST47 (talk) 19:17, 10 January 2023 (UTC)Reply[reply]

216.194.96.0/20[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: IP range is a possible VPN server, belonging to Cato Networks. 73.67.145.30 (talk) 19:22, 9 January 2023 (UTC)Reply[reply]

88.80.145.0/24[edit]

Pictogram voting wait violet.svg – A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.

Reason: (IP belongs to a dedicated services provider (Belcloud, LTD)) Matthew Tyler-Harrington (aka mth8412) (talk) 00:45, 10 January 2023 (UTC)Reply[reply]

88.80.144.0/21 · contribs · block · log · stalk · Robtex · whois · Google is a hosting range by "RedCluster LTD", many web servers, proxies, etc, within the range. Please, consider blocking the /21. Thank you. MarioGom (talk) 17:34, 11 January 2023 (UTC)Reply[reply]

70.54.45.110[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

This IP is the latest in a string of widely varying IPs and locations that have been pushing a blatantly promotional draft at Draft:Netta Jenkins. It seems probable that they are all proxies, but only the above one has been used recently. The other IPs were:

Has also been removing the decline templates from the draft despite being told not to. Mako001 (C)  (T)  🇺🇦 13:09, 12 January 2023 (UTC)Reply[reply]

8.28.126.0/24[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: (Range belongs to Cloudflare, which is used on the WARP VPN network) Matthew Tyler-Harrington (aka mth8412) (talk) 10:19, 16 January 2023 (UTC)Reply[reply]

Automated lists and tools[edit]

  • User:AntiCompositeBot/ASNBlock maintained by User:AntiCompositeBot is a list of hosting provider ranges that need assessment for blocks that is updated daily. Admins are encouraged to review the list and assess for blocks as needed. All administrators are individually responsible for any blocks they make based on that list.
  • ISP Rangefinder is a tool that allows administrators to easily identify and hard block all ranges for an entire ISP. It should be used with extreme caution, but is useful for blocking known open proxy providers. All administrators are individually responsible for any blocks they make based on the results from this tool.
  • IPCheck is a tool that can help provide clues about potential open proxies.
  • Bullseye provides information about IPS, including clues about potential open proxies.
  • whois-referral is a generic WHOIS tool.
  • Range block finder finds present and past range blocks.

See also[edit]

Subpages
Related pages
Sister projects (defunct)
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:WikiProject_on_open_proxies&oldid=1133365728"