Wikipedia:WikiProject on open proxies

Administration index MetaProject on open proxies (en-Wikipedia chapter)
 If you've been blocked as an open proxy, please see: Help:blocked.

The multiwiki MetaProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.

Proxyblock.png
Open proxies may be blocked from editing

Automated lists and tools[edit]

  • User:SQL/Non-blocked compute hosts maintained by User:SQLBot is a list of open proxy ranges that need assessment for blocks that is updated daily. Admins are encouraged to review the list and assess for blocks as needed. All administrators are individually responsible for any blocks they make based on that list.
  • ISP Rangefinder is a tool that allows administrators to easily identify and hard block all ranges for an entire ISP. It should be used with extreme caution, but is useful for blocking known open proxy providers. All administrators are individually responsible for any blocks they make based on the results from this tool.
  • IPCheck is a tool that can help identify open proxies.

Reporting[edit]

Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.

File a new report here
I. For block requests:
Verify that the following criteria has been met:
  • The IP has made abusive contributions within the past week
For unblock requests:
Verify that the following criteria has been met:
  • No current criteria
II. For block requests For unblock requests
Replace "IP" below with the IP address you are reporting.


Replace "IP" below with the IP address you are reporting.


III. Fill out the resulting page and fill-in the requested information.
IV. Save the page.
Verified Users/Sysops Templates
  • IP is an open proxy {{Proxycheck|confirmed}} for confirmed open proxies and TOR exit nodes.
  •  Likely IP is an open proxy {{Proxycheck|likely}} for likely open proxies and TOR exit nodes.
  •  Possible IP is an open proxy {{Proxycheck|possible}} for possible open proxies and TOR exit nodes.
  •  Unlikely IP is an open proxy {{Proxycheck|unlikely}} for unlikely open proxies and TOR exit nodes.
  • Not currently an open proxy {{Proxycheck|unrelated}} for IP's confirmed not to be an open proxy or TOR exit node.
  • Inconclusive {{Proxycheck|inconclusive}} for IP's that are inconclusive.
  •  Declined to run a check {{Proxycheck|decline}} to decline a check.
  • Open proxy blocked {{Proxycheck|blocked}} for open proxies and TOR nodes that have been blocked. Please add this if you block the IP.

Requests[edit]

8.37.154.122[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

8.37.154.122 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: geforce now ip, using the steam browser to type this, can be used for disruptive editing so iam requesting a block. 8.37.154.122 (talk) 14:13, 4 May 2019 (UTC)

Only edit from the IP was the one above, no other edits on Special:Contributions/8.37.154.122/21, no bad edits on Special:Contributions/8.37.154.122/19 --DannyS712 (talk) 20:47, 20 July 2019 (UTC)
 Completed I am not sure if the IP is still used by the Steam browser—at the moment closing with no action per lack of abuse. MrClog (talk) 16:39, 6 September 2019 (UTC)

45.121.208.0/22[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

45.121.210.211 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits located during Japanelemu sockfarm cleanup. Edits from 45.121.208.0/22, WHOIS lists an Australian server farm provider ☆ Bri (talk) 19:54, 18 May 2019 (UTC)

Good catch, sorry about the delay. I have added this ISP to NBCH, and they should be blocked shortly. SQLQuery me! 20:55, 22 July 2019 (UTC)

91.207.171.121, 81.200.17.161, 91.027.170.240[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

91.207.171.121 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk
81.200.17.161 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk
91.027.170.240 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

We've had an ongoing massive campaign to insert the same reference spamming type edit into a range of machine learning articles. I'd estimate at least 30 attempts over the year that I've been closely watching. The pattern is a batch / rash of edits by brand new ip's in a single geographic area. I see that the source of a previous batch is now blocked. They just started another burst, the same edit edits as before, this from three new (single edit) IP's in the same area in Russia, triple entering the same edit on one article in 2 days. Sincerely, North8000 (talk) 01:39, 21 May 2019 (UTC)

3rd IP is invalid, assuming you mean 91.207.170.240. All IPs seem to be dynamic IPs connected to Seven Sky/IskraTelecom (same company nowadays it seems--https://www.iskratelecom.net/ redirects you to Seven Sky's website). (The first IP is registered as SEVEN-SKY Dynamic broadband customers, other two as ISKRATELECOM.)  Unlikely IP is an open proxy. Closing. --MrClog (talk) 17:53, 8 September 2019 (UTC)
Thanks for checking!North8000 (talk) 08:01, 9 September 2019 (UTC)

5.34.66.26[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

5.34.66.26 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Not sure if it's an open proxy or not, but the host name "client.fttb.2day.kz" seems a bit suspicious. 123.218.188.28 (talk) 17:13, 21 May 2019 (UTC)

 Unlikely IP is an open proxy SQLQuery me! 20:49, 22 July 2019 (UTC)

67.226.220.0/22[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

67.226.220.0/22 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Amazon AWS webhosting. 123.218.188.28 (talk) 18:59, 21 May 2019 (UTC)

While IPQS Says that the ISP name is Amazon, actually checking the whois says differently. SQLQuery me! 20:42, 22 July 2019 (UTC)

185.97.92.116/29[edit]

Pictogram voting wait violet.svg – A proxy checker has placed this case on hold pending further information or developments.

185.97.92.116/29 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Used by a pretty determined editor (who uses others as well, including 185.104.253.51 ) and keeps on including unverified information/data without explanation. See for instance disruption at Religion in Lebanon. Drmies (talk) 16:25, 9 June 2019 (UTC)

 Completed: Checked IPs at abuseat.org and it appears to be a botnet using the Special:Contribs/185.97.92.113/28 range (C2 domain: mtmdj33s0.ru). Please block for a year (incl. logged in users) using block reason {}: <!-- botnet -->. MrClog (talk) 19:11, 7 September 2019 (UTC)
@MrClog: I've put this on hold pending something a bit stronger. Lebanon is one of those countries where almost every IP is going to end up on a blacklist at some point. From what I can see, the edits are geo-appropriate, and combine exclusively with other dynamic IPs from the same region. Maybe I've missed something, But I don't think there's enough for a zombie block here. -- zzuuzz (talk) 19:38, 7 September 2019 (UTC)
@Zzuuzz: The IPs were all logged as part of the same botnet yesterday by abuseat.org. Besides that, there was one thing I noticed, which is that the IP is registered to Mazraa-Barbrour-STAR CENTER in Beirut, yet I wasn't able to find anything with this name. I am not sure what that would indicate. --MrClog (talk) 19:51, 7 September 2019 (UTC)

72.52.64.0/18[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

72.52.64.0/18 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Hurricane Electric. 60.133.229.157 (talk) 05:02, 18 June 2019 (UTC)

 Completed: Hurricane Electric does more than just colocation services, it is also a global ISP. I looked at some IPs in the range, and they are connected to various companies. I found a few connected to Sophidea, all of which were already globally locked as LTA. Some were connected to Blue Rim Networks, which provides internet services to multi-family communities. I see no reason to block the entire range. --MrClog (talk) 18:08, 8 September 2019 (UTC)

2a01:4f9:2a:6d5::/64[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

2a01:4f9:2a:6d5::/64 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Open proxy/web hosting. Most recently abused from 2a01:4f9:2a:6d5::2 (talk · contribs · WHOIS). 92.17.91.122 (talk) 22:41, 23 July 2019 (UTC)

 Completed: IP registered to Hetzner, who assigns each of its customers their own /64 range.[1] Please block for 1–2 years (incl. logged in users) with blockreason {}: <!-- Hetzner --> MrClog (talk) 18:19, 7 September 2019 (UTC)
Hosting provider range blocked 2 years. –Darkwind (talk) 09:33, 12 September 2019 (UTC)

102.129.224.2[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

102.129.224.2 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits; recently blocked 31 hrs. Stalk toy also indicates two blocks on other wikis. Zaxxon0 (talk) 06:50, 6 August 2019 (UTC)

(non-clerk comment) IP Quality reports "This IP address appears to be a high risk proxy connection." --DannyS712 (talk) 06:59, 6 August 2019 (UTC)
Open proxy blocked 2 years on this specific IP. Leaving open in case someone wants to check the range. –Darkwind (talk) 09:41, 12 September 2019 (UTC)
@Darkwind: To make sure that it can be later confirmed that an IP is still an open proxy, and to allow anyone to confirm this is a good block, could you which port or website can be used to access this open proxy? --MrClog (talk) 16:31, 12 September 2019 (UTC)
This was based on the Proxy API Check tool results, which showed positive ID as a proxy from proxycheck.io, IPQualityScore, and teoh.io, as well as hits from StopForumSpam, and open ports 80, 220, and 443. –Darkwind (talk) 06:13, 13 September 2019 (UTC)
@Darkwind: Please (re)read the Guide to checking open proxies. It states: "Do not use [blacklists] for this purpose, as they are often stale and often misinterpreted". In additition, none of the ports you mentioned allowed me to use the proxy. In my opinion,  Unlikely IP is an open proxy. I have placed the request on hold awaiting further evidence. --MrClog (talk) 15:10, 13 September 2019 (UTC)
@MrClog: Excellent advice about the blacklists, however, running nginx on port 80 combined with Host1Plus is a clear duck. Additionally, it's hosting a SSL certificate from diltwo.com, and that domain is related to Hoxx VPN. I'm not seeing anything else on nearby ranges - closed as a webhost and duck VPN. -- zzuuzz (talk) 21:26, 15 September 2019 (UTC)

212.71.250.215[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

212.71.250.215 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Linode cloud server, used by obvious sock of Shingling334, listed as high-risk blacklisted proxy by IPQualityScore. IamNotU (talk) 14:20, 11 August 2019 (UTC)

Range blocked. NinjaRobotPirate (talk) 14:36, 7 September 2019 (UTC)

198.57.27.142[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

198.57.27.142 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Another socking proxy. GlobalTeleHost, IPQualityScore lists as blacklisted/proxy. Same thing as now-blocked Special:Contributions/198.57.27.196. IamNotU (talk) 12:18, 14 August 2019 (UTC)

 Completed Colo used for vandalism (multiple IPs). Please block Special:Contribs/198.57.26.0/23 for 2 years (incl. logged in users) with block reason {} <!-- gthost.com -->. MrClog (talk) 14:05, 7 September 2019 (UTC)
Range blocked. NinjaRobotPirate (talk) 14:42, 7 September 2019 (UTC)

107.77.253.12[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

107.77.253.12 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Reported as blacklisted, high-risk proxy; long edit history of little but vandalism. --IamNotU (talk) 21:01, 26 August 2019 (UTC)

Second opinion requested. In my opinion  Unlikely IP is an open proxy MrClog (talk) 13:48, 7 September 2019 (UTC)
Concur this is unlikely an open proxy (but the usual definition). It appears to be a normal proxy from a mobile network IP. -- zzuuzz (talk) 21:32, 17 September 2019 (UTC)

172.105.28.198[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

172.105.28.198 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Another obvious Shingling334 sock on another linode host... IamNotU (talk) 22:23, 31 August 2019 (UTC)

 Completed IP is registered to Linode. Please block for 1 year (incl. prevent logged in users from editing) with block reason: {} <!-- Linode -->. MrClog (talk) 13:30, 7 September 2019 (UTC)
/15 range blocked. NinjaRobotPirate (talk) 14:33, 7 September 2019 (UTC)

198.98.48.0/20[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

198.98.48.0/20 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: IP is by "FranTech Solutions" Zaxxon0 (talk) 09:36, 10 September 2019 (UTC)

Web host range blocked 2 years. –Darkwind (talk) 09:49, 12 September 2019 (UTC)

IP 81.162.224.114[edit]

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

[[User:|]] - [[User Talk:|talk]] - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - [http:// HTTP] - stalk

Reason: Requested unblock. 81.162.224.114 (talk) 14:45, 14 September 2019 (UTC)

There's not enough information here to respond to this request. The reporting IP is obviously not blocked. -- zzuuzz (talk) 21:04, 17 September 2019 (UTC)

202.80.213.234[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

202.80.213.234 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk
49.146.2.201 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits & address is listed at Composite Blocking List (abuseat.org). GetIPIntel returns p=0.985. Further context at this COIN thread. More IPs are listed there as well. - ☆ Bri (talk) 04:15, 18 September 2019 (UTC)

Added second IP from the COIN case, also with GetIPIntel p=0.985 ☆ Bri (talk) 04:45, 18 September 2019 (UTC)

See also[edit]

Subpages[edit]

Related pages[edit]

Chapters[edit]