Wiki.RIP

Wikipedia:WikiProject on open proxies

From Wikipedia, the free encyclopedia
Administration index MetaProject on open proxies (en-Wikipedia chapter)
 If you've been blocked as an open proxy, please see: Help:blocked.

The multiwiki MetaProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.

Proxyblock.png
Open proxies may be blocked from editing

Automated lists and tools

  • User:SQL/Non-blocked compute hosts maintained by User:SQLBot is a list of open proxy ranges that need assessment for blocks that is updated daily. Admins are encouraged to review the list and assess for blocks as needed. All administrators are individually responsible for any blocks they make based on that list.
  • ISP Rangefinder is a tool that allows administrators to easily identify and hard block all ranges for an entire ISP. It should be used with extreme caution, but is useful for blocking known open proxy providers. All administrators are individually responsible for any blocks they make based on the results from this tool.
  • IPCheck is a tool that can help identify open proxies.

Reporting

Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.

File a new report here
I. For block requests:
Verify that the following criteria has been met:
  • The IP has made abusive contributions within the past week
For unblock requests:
Verify that the following criteria has been met:
  • No current criteria
II. For block requests For unblock requests
Replace "IP" below with the IP address you are reporting.


Replace "IP" below with the IP address you are reporting.


III. Fill out the resulting page and fill-in the requested information.
IV. Save the page.
Verified Users/Sysops Templates
  • IP is an open proxy {{Proxycheck|confirmed}} for confirmed open proxies and TOR exit nodes.
  •  Likely IP is an open proxy {{Proxycheck|likely}} for likely open proxies and TOR exit nodes.
  •  Possible IP is an open proxy {{Proxycheck|possible}} for possible open proxies and TOR exit nodes.
  •  Unlikely IP is an open proxy {{Proxycheck|unlikely}} for unlikely open proxies and TOR exit nodes.
  • Not currently an open proxy {{Proxycheck|unrelated}} for IP's confirmed not to be an open proxy or TOR exit node.
  • Inconclusive {{Proxycheck|inconclusive}} for IP's that are inconclusive.
  •  Declined to run a check {{Proxycheck|decline}} to decline a check.
  • Open proxy blocked {{Proxycheck|blocked}} for open proxies and TOR nodes that have been blocked. Please add this if you block the IP.

Requests

12.89.35.14 and others

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

12.89.35.14 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk
145.15.244.25 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits, is flagged as proxy by IPQualityScore via wmflabs ipcheck Bri.public (talk) 22:14, 10 October 2019 (UTC)

Add 145.15.244.25. Same type of editing. It is indicated by wmflabs ipcheck as proxy & recent abuse. ☆ Bri (talk) 19:18, 11 October 2019 (UTC)
There are more Miss World/Miss Earth edits from this range last year. If action is taken on this, I'd ask that this be taken into consideration. [1][2][3] - Bri.public (talk) 20:54, 11 October 2019 (UTC)
@Bri: The first IP is linked to Fortinet, but does not seem to be an open proxy. The second IP is linked to Nederlandse Spoorwegen (Dutch national railway company) and is presumably a public Wifi network. Pinging Zzuuzz to confirm. --MrClog (talk) 21:37, 13 March 2020 (UTC)
I concur about the first one. The 145.15.244.25/22 network is an interesting one, with suspicious characteristics. The 145.15.244.0/24 range was blocked both recently and 2 years ago as WP:BKFIP, but I can't find evidence that it's an open proxy (other than being used in the context of Dutch trains). I'm going to say  Unlikely IP is an open proxy. -- zzuuzz (talk) 18:03, 15 March 2020 (UTC)

2a01:4f8:120:3247::2

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

2a01:4f8:120:3247::2 - talk - edits - block - log - current blocks - Robtex/whois- Google - [http://[2a01:4f8:120:3247::2] HTTP]

Reason: Requested unblock. Ivanvector (talk · contribs) blocked the 2A01:4F8:0:0:0:0:0:0/32 range but I can't find a history of abuses from this range. Also, what about using smaller ranges for blocking, like blocking some /48 instead of blocking a full /32? Carmelobrianza (talk) 10:28, 25 October 2019 (UTC)

  • The range is Hetzner, a German VPN/webhost/colocation provider. Per the checkuser logs this webhost has been used abusively by at least eight different long-term vandals, some of whom are extremely disruptive. I object to unblocking the range; it's impossible at this time to determine if a smaller subset of the range would make an effective block (WHOIS has /29 for the ISP). Please advise the user to disable their VPN or request an account. Ivanvector (Talk/Edits) 14:05, 25 October 2019 (UTC)

121.118.78.132

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

121.118.78.132 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits which can be checked against the Daryl Morey contributions by this now blocked proxy user. Lots of strong signs that they are the same person/people, which includesexactly the same way they write and sources they use. Flaughtin (talk) 18:37, 28 October 2019 (UTC)

 Likely IP is an open proxy: openvpn. It's probably a bit too stale to block at this point. -- zzuuzz (talk) 16:15, 15 November 2019 (UTC)

146.88.177.146

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

146.88.177.146 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits, high IPQualityScore fraud score and appears to be a data center called DataBank, according to whois. ☆ Bri (talk) 03:04, 1 November 2019 (UTC)

146.88.176.0/20 range blocked as a colocation webhost. NinjaRobotPirate (talk) 08:56, 3 November 2019 (UTC)

103.67.157.240

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

103.67.157.240 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: ACC check. High IPQuality fraud score, as shown at [4] OhKayeSierra (talk) 07:18, 1 November 2019 (UTC)

It's a mobile phone network. Abuseat lists it as currently infected (6 detections in the last 24 hours), which may point to it being a zombie proxy. However, it hasn't edited so no block is needed at the time imo. I'm going to assume that this check is too late to be useful for ACC. @Zzuuzz: what do you think? --MrClog (talk) 09:40, 27 March 2020 (UTC)

188.72.102.7

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

188.72.102.7 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: WHOIS reports this is PureVPN Bri.public (talk) 19:15, 6 November 2019 (UTC)

188.72.102.0/24 range blocked as a webhost. NinjaRobotPirate (talk) 04:52, 7 November 2019 (UTC)

37.190.128.0/17

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

37.190.151.98 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk
37.190.149.217 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk
‎37.190.150.185 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits by IPs noted above as if they are maintaining the Pier 1 Imports article financial data. Other weird edits from the Polish ISP range too, including possible promo on a Las Vegas concert residency [5]. ☆ Bri (talk) 23:17, 10 November 2019 (UTC)

154.160.xxx.yyy

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

154.160.11.77 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk
154.160.26.23 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk
154.160.30.55 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits; reported as proxy by proxycheck.io via wmflabs' ipcheck ☆ Bri (talk) 02:45, 11 November 2019 (UTC)

It was pointed out at COIN that ST47 blocked 154.160.26.23 based on long term abuse. The LTA [6] is not based in the ISP's geographic area, and routinely uses a proxy. ☆ Bri (talk) 15:34, 15 November 2019 (UTC)
I can tell you from experience (as well as looking at this) that among other things this network contains certified dynamic open proxies, several banned users, and CU-confirmed COI farms. There is however a lot of collateral when we block it. It is otherwise a normal network (and quite an important one). -- zzuuzz (talk) 16:04, 15 November 2019 (UTC)

185.83.71.18

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

185.83.71.18 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Used for sockpuppetry by Shingling334, reported as proxy by WhatIsMyIPAddress and IPQualityScore. IamNotU (talk) 17:57, 11 November 2019 (UTC)

Open proxy: 24 Shells hosting. Blocked by Favonian. -- zzuuzz (talk) 16:10, 15 November 2019 (UTC)

113.150.100.49

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

113.150.100.49 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious AfD nominations on high-profile pages. IPQualityScore gives an 89% chance of it operating as an open proxy, and it is blocked on ru.wiki and nl.wiki as an open proxy: [7]. 2601:1C0:4401:24A0:3C4C:2790:EFBB:586D (talk) 06:31, 12 November 2019 (UTC)

Open proxy: openvpn. It's probably expired by now, but I blocked it for a month anyway. -- zzuuzz (talk) 15:37, 15 November 2019 (UTC)

64.2.184.130

Symbol comment vote.svg – This proxy check request is closed and may now be archived.

64.2.184.130 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits. User at this IP address made a few edits today at Occupation of the Malheur National Wildlife Refuge that appear to be nothing more than vandalism, and those have been the only edits from this IP address in the last week. But looking at the contributions from this IP address shows a long history of vandalism. A few examples of many: [8] [9] [10] [11] [12] [13] Please investigate. Thanks in advance! Yompi20 (talk) 21:00, 25 November 2019 (UTC)

It has been blocked as a school. --MrClog (talk) 13:49, 14 March 2020 (UTC)

36.71.234.89

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

36.71.234.89 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

This IP is making the same suspicious political POV edits (placing a map) on several wiki pages (including on foreign Wikipedia's as well). I checked it on several sites. All of them give that it is indeed a proxy. Reason: Suspicious edits Casperti (talk) 15:20, 6 December 2019 (UTC)

Does not seem to be an open proxy. --MrClog (talk) 13:45, 14 March 2020 (UTC)

62.254.132.162

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

62.254.132.162 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Listed as proxy/blacklisted. Mainly vandalism. Seems to be Shingling334 using it today. IamNotU (talk) 20:07, 16 December 2019 (UTC)

IP is registered to Virgin Media Business. Doesn't seem to be an open proxy. However, the IP was CBL listed as infected with a virus/malware on March 10, but not anymore. May have been a zombie proxy. --MrClog (talk) 09:33, 27 March 2020 (UTC)

116.84.110.175

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

116.84.110.175 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

I'm pretty sure this is a proxy. I don't have the tools to know if it's an open proxy. I'm almost certain that the user is sock puppet. - MrX

What is Wiki.RIP There is a free information resource on the Internet. It is open to any user. Wiki is a library that is public and multilingual.

The basis of this page is on Wikipedia. Text licensed under CC BY-SA 3.0 Unported License..

Wikipedia® is a registered trademark of Wikimedia Foundation, Inc. wiki.rip is an independent company that is not affiliated with the Wikimedia Foundation (Wikimedia Foundation).

E-mail: wiki@wiki.rip
WIKI OPPORTUNITIES
Privacy Policy      Terms of Use      Disclaimer