Wikipedia:WikiProject on open proxies

From Wikipedia, the free encyclopedia
  (Redirected from Wikipedia:ROP)
Jump to: navigation, search
Administration index MetaProject on open proxies (en-Wikipedia chapter)
 If you've been blocked as an open proxy, please see: Help:blocked.

The multiwiki MetaProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.


Proxyblock.png
Open proxies may be blocked from editing

Reporting[edit]

Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.

File a new report here
I. For block requests:
Verify that the following criteria has been met:
  • The IP has made abusive contributions within the past week
For unblock requests:
Verify that the following criteria has been met:
  • No current criteria
II. For block requests For unblock requests
Replace "IP" below with the IP address you are reporting.


Replace "IP" below with the IP address you are reporting.


III. Fill out the resulting page and fill-in the requested information.
IV. Save the page.

Requests[edit]

217.115.10.133[edit]

Symbol merge vote.svg – A user has requested a proxy check. A proxy checker will shortly look into the case.

217.115.10.133 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Blocked same as above, but seems to be a tor exit node (see whois info and https://www.ccc.de/anonymizer/). Tijfo098 (talk) 06:02, 18 October 2012 (UTC)

Blocked as tor. This is a small part of a wide tor project resolving to anonymizer.ccc.de, anonymizer.hamburg.ccc.de, torXX.anonymizer.ccc.de (where XX is a number from 1 to at least 33), etc., i.e., again, the tip of an iceberg. Materialscientist (talk) 05:54, 20 October 2012 (UTC)
Indeed. A few random tests:
  • tor5.anonymizer.ccc.de -> 80.237.226.75
  • tor10.anonymizer.ccc.de -> 62.113.219.3
  • tor15.anonymizer.ccc.de -> not registered
  • tor20.anonymizer.ccc.de -> 31.172.30.3
  • tor25.anonymizer.ccc.de -> not registered
  • tor30.anonymizer.ccc.de -> 77.244.254.230
They belong to various IPSs, but all are rented out to "Chaos Computer Club e.V." Tijfo098 (talk) 06:17, 20 October 2012 (UTC)
It's a bit more tricky: you can type the url into robtext and get their ranges, but those ranges are shared and the tor takes only a small part. For example, for 217.115.10.133, only 3 nearby IPs (trial-and-error check, not 100% sure) clearly relate to tor33.anonymizer.ccc.de, many others from the range belong to something else. And as usual, such shared ranges often host other semilegal services. Materialscientist (talk) 06:21, 20 October 2012 (UTC)
The whois info in this case is more helpful: 217.115.10.128 - 217.115.10.143 (a /28 it would seem) are all registered to CCC.de, although this is indeed less than the whole 217.115.0.0/20 Netsign PA Route. So you could issue a more discerning range block to the CCC /28. In the 80.237.226.72 - 80.237.226.79 case it's a /29 that is leased by CCC (out of the whole /17 route). If we go by the 80.237 precedent, the tor node(s) are eventually moved around the range(s) CCC rents. And it looks like the same R&I banned user was the sole editor from both of these. Tijfo098 (talk) 06:59, 20 October 2012 (UTC)

Known CCC.de ranges[edit]

Tijfo098 (talk) 07:07, 20 October 2012 (UTC)

Thanks. /29 contains only 6 IPs. If you check them individually in [1] you'll find that most of them (if not all) are already blocked one way or another, or don't clearly belong to the targeted tor. Materialscientist (talk) 07:17, 20 October 2012 (UTC)
Which ones do not? Tijfo098 (talk) 07:21, 20 October 2012 (UTC)
I judge that by robtex, which shows a different server for some nearby IPs in the range. Those tors usually take about 4 IPs/range, but ranges are many. Off course, we can always rangeblock a wider range if it is inactive, but then we might get justified unblock requests. Materialscientist (talk) 07:32, 20 October 2012 (UTC)
It looks to me like the only controversy here is over the 217.115.10.135 - 217.115.10.142 range (because you blocked the lower IPs of the last /28 I listed above) The 135-142 range is listed as allocated to CCC.de in whois, but none of those IPs respond to ping (unlike the lower IPs), so it looks like there's simply no hardware behind them, just yet. Tijfo098 (talk) 08:11, 20 October 2012 (UTC)

67.142.168.22 et al[edit]

Symbol merge vote.svg – A user has requested a proxy check. A proxy checker will shortly look into the case.

67.142.168.22 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
67.142.168.23 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
67.142.168.25 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
67.142.168.27 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

All 3 4 IPs' geolocation data says "Confirmed proxy server". This, combined with several suspicious edits seem to suggest that something else is in play here.—Ryulong (琉竜) 20:42, 9 November 2012 (UTC)

  • The range 67.142.168.16/28 has been blocked by User:Coren - "Webhost/server farm hosting proxies". - Mike Rosoft (talk) 20:57, 24 November 2012 (UTC)
    • Being a confirmed proxy server isn't a problem by itself. This is a very odd range to have for farming, owned by DirecPC. Dennis Brown - © Join WER 14:43, 12 December 2012 (UTC)


69.22.184.113[edit]

Symbol redirect vote.svg – A proxy check has been completed and it is now awaiting administration and close.

69.22.184.113 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Requested unblock.--Jezebel'sPonyobons mots 20:29, 25 July 2013 (UTC)

Sooooo..... this one is an oddball. It definitely belonged to the notorious anchorfree vpn service at one point. Now however, it seems like it's been passed on to a colo/backbone company. However, that doesn't mean it isn't a proxy. There's nothing saying it's not still in posession of anchorfree, nor is there any reason an editor would normally be editing from a colocation/internet backbone IP. Sooooo, could the editor maybe provide more information on why they need to be unblocked on this IP? Sailsbystars (talk) 01:38, 26 July 2013 (UTC)
I can see the associated user has access to a regular (unblocked) IP. As such I'm going to decline to unblock the possible proxy and advise them to edit through their regular IP only.--Jezebel'sPonyobons mots 17:25, 26 July 2013 (UTC)

User talk:Ukexpat[edit]

Symbol merge vote.svg – A user has requested a proxy check. A proxy checker will shortly look into the case.

5.56.23.148 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
62.152.39.158 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
176.53.45.15 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
200.53.156.244 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
31.3.154.189 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
62.152.39.188 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
128.127.107.49 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
185.25.87.20 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
Posting not to forget, can't check myself now. Looks like VPN, all have http (80) and pptp (1723) ports open, altushost.com, but not only. Materialscientist (talk) 09:01, 26 July 2013 (UTC)

212.74.97.221[edit]

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

212.74.97.221 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits/editing from a confirmed corporate proxy. — Preceding unsigned comment added by GabeMc (talkcontribs)

 Unlikely IP is an open proxy Does not appear to be an open proxy. The only source claiming proxy is the hopelessly useless (for proxy status) whatismyipaddress.com. It looks like a regular broadband ISP IP as far as I can tell, and the host was down when I investigated. Sailsbystars (talk) 04:33, 21 April 2014 (UTC)

178.162.193.199[edit]

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

178.162.193.199 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Requested unblock via UTRS.--Jezebel'sPonyobons mots 16:38, 24 April 2014 (UTC)

Part of a VPN service offering a free trial. Also has weird behavior on port 80 (doesn't seem exploitable as an open proxy though). I thought VPN with free trial IPs were generally treated as open proxies, ergo remain blocked. Incidentally the IP is softblocked globally, so if we wait 4 months it will switch from a hard to a soft block on en.wiki when the current en.wiki block expires. Sailsbystars (talk) 04:37, 26 April 2014 (UTC)

TheREALCableGuy[edit]

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

178.21.175.159 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
178.21.175.169 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
81.10.82.107 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
94.252.21.225 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: There are suspicions at Wikipedia:Sockpuppet investigations/TheREALCableGuy that some of these may be open proxies. I was not able to find evidence for any of them; maybe people here can do better. -- King of ♠ 06:33, 6 June 2014 (UTC)

Just close this; I've waited a week waiting for a response and TRCG has moved on to yet another range of IP's. Nate (chatter) 04:24, 15 June 2014 (UTC)
The 178's look like a colocation serverfarm, so likely a proxy. The exact mechanism isn't available. The other IPs don't appear to be proxies. Sorry for slow response. Sailsbystars (talk) 05:47, 15 June 2014 (UTC)
178.21.160.0/20 blocked. Thanks for the check. -- King of ♠ 08:05, 15 June 2014 (UTC)

IP66.54.67.166[edit]

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

66.54.67.166 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits

I did not see any edits from the IP, it has yet to edit anything. 41.58.92.163 (talk) 03:28, 12 June 2014 (UTC)
Looks like a server for the nokia/Microsoft maps program. Given lack of edits, there's not need to block. Sailsbystars (talk) 06:08, 15 June 2014 (UTC)

148.64.124.142[edit]

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

148.64.124.142 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Likely proxy-using ref-desk troll we've been having lots of trouble from lately, based on edits. --Jayron32 03:54, 13 June 2014 (UTC)

Satellite ISP. It might be a caching proxy but it doesn't seem to be an open proxy. Not open on any of the standard proxy ports... I've seen satellite IPs come up here before, but they never seem to be a proxy. Sailsbystars (talk) 06:15, 15 June 2014 (UTC)

216.120.248.30[edit]

Symbol merge vote.svg – A user has requested a proxy check. A proxy checker will shortly look into the case.

216.120.248.30 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP Part of an 0/19 range. Says it's a closed proxy he uses himself. Daniel Case (talk) 21:21, 19 June 2014 (UTC)
Well, the proxy that I found on that range back in 2011 seems to have moved on to another blocked range, but the original range should probably stay blocked. I'd explain that the software only allows rangeblocks, not rangeholes so we can't safely allow one vouched for server to edit from a rotten range (and the ownership of the range is the same as before). The user is welcome to edit wikipedia with his or her proxy disabled, though. Sailsbystars (talk) 02:21, 21 June 2014 (UTC)
We can make it a soft block and see how that progresses, if problematic, we reblock. The spammers will still be held out as the creation bit will still be on. Remember that we are meant to be looking to let people edit, and to be reasonable in our blocks. — billinghurst sDrewth 07:07, 21 June 2014 (UTC)
That's true, and I don't object to that interpretation either. There weren't any other edits at all from that range for four years before the block.... IPBE is also an option. But my reading of M:NOP is basically if your webhost isn't blocked carryon. If it is, then meh. Most people seem to forget proxies exist and I don't really think the policy has been vigorously debated in quite some time. Sailsbystars (talk) 13:59, 21 June 2014 (UTC)
While being reasonable is something we should be as administrators, let me shine a different light on to it. This could be a blocked user who has obtained proxy services from this company, and is playing the innocent game. I know, it's assuming bad faith but time and time again I come across it with CU, and socks turn up. There should be a exceptional circumstance in which he absolutely needs to use a proxy to edit. If not, what is the issue with using a normal IP. Also why we have {{webhostblock}} -- DQ (ʞlɐʇ) 16:53, 23 June 2014 (UTC)

────────────────────────────────────────────────────────────────────────────────────────────────────I asked him this and he says "Because it gives me a stable machine on a stable IP." Daniel Case (talk) 02:13, 26 June 2014 (UTC)

161.112.232.111[edit]

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

161.112.232.111 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Says servers are a university's that were incorrectly blocked. Daniel Case (talk) 21:50, 24 June 2014 (UTC)

Not an open proxy I can verify their statement is accurate. The proxy is closed and legit. Unblock away! Sailsbystars (talk) 06:15, 25 June 2014 (UTC)
I've unblocked the IP.--Jezebel'sPonyobons mots 18:18, 25 June 2014 (UTC)

175.28.15.91[edit]

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

175.28.15.91 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: See these recent edits to Wikipedia:Sockpuppet investigations/L'Aquotique ([2], [3]) from 175.28.15.91 (talk+ · tag · contribs · filter log · WHOIS · RBLs · block user · block log · cross-wiki contribs · checkuser (log)) impersonating Materialscientist. Additionally, per http://ping.eu/proxy/ 175.28.15.91 (talk · contribs · WHOIS) is a proxy for port 80. JoeSperrazza (talk) 21:20, 25 June 2014 (UTC)

Confirmed, blocked, thanks. Materialscientist (talk) 21:45, 25 June 2014 (UTC)

190.102.28.173[edit]

Pictogram voting wait violet.svg – A user has requested administrator assistance for action regarding the case below. The requested action is below.

190.102.28.173 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
92.46.132.40 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits

See 3RR report closed on 29 June (permalink). The first IP who joined in the edit war, 190.102.28.173 (talk · contribs · deleted contribs · logs · edit filter log · block user · block log) is advertised on the web as being a proxy server offered by http://letushide.com, though I wasn't able to activate it. The second IP, 92.46.132.40 (talk · contribs · deleted contribs · logs · edit filter log · block user · block log) is on various anti-spam lists but not widely advertised as a proxy. EdJohnston (talk) 02:25, 30 June 2014 (UTC)

Verified and blocked 190.102.28.173, but 92.46.132.40 is unlikely. Materialscientist (talk) 04:26, 30 June 2014 (UTC)
IP is an open proxy 92.46.132.40 (talk · contribs · WHOIS) is a wide open proxy, I just left a message as that IP on its talk page. I'd recommend blocking the IP for 3 months or so. Sailsbystars (talk) 05:45, 30 June 2014 (UTC)
No wait, it's jumping around that son of a bitch. I came out as 92.46.158.203 (talk · contribs · WHOIS). A website listed the original IP as the outlet earlier today. I don't know if we can block the whole range without collateral or if maybe we just want to block the 2 /24s.... it's the same ISP on both ranges... Sailsbystars (talk) 05:49, 30 June 2014 (UTC)
Looking at 92.46.132.0/24 [4] I only see that one edit, so not sure of the utility of a range block. 190.102.28.173/24 only has a half dozen edits outside of this one IP [5], all from 2012 or older, but not sure any of those were problematic. I'm inclined to not range block unless there is shown to be a larger problem on the range. Suggest leaving open and monitoring these ranges. I would note that .40 does have one port open but it isn't relaying. Dennis Brown |  | WER 10:40, 24 July 2014 (UTC)

178.76.152.89[edit]

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

178.76.152.89 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Requested unblock via UTRS #11262.--Jezebel'sPonyobons mots 16:21, 2 July 2014 (UTC)

Not an open proxy No longer functions as a proxy. It was in a lot of proxy lists, but it seems to have been closed at some point in March/April. Safe to unblock. Sailsbystars (talk) 21:30, 6 July 2014 (UTC)
Cheers for that. Unblocked.--Jezebel'sPonyobons mots 20:49, 10 July 2014 (UTC)

182.52.118.23[edit]

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

182.52.118.23 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: blocked by Procseebot on 30 June; unblock requested at User talk:1above. JohnCD (talk) 16:10, 6 July 2014 (UTC)

Hesitant about this. On the one hand, it looks like it's a dynamic range, and that the proxy was only there for a few days (until ~July 1). The proxy is not open now. On the other hand there's currently a horribly unsecured router at that IP. If I had to decide, I'd say unblock on the benefit of the doubt. Sailsbystars (talk) 21:25, 6 July 2014 (UTC)
Wow, you weren't kidding. I would consider that an open proxy only because of the security problems that could turn it on and off in a matter of seconds. I will leave a note on the users page that they need to secure their router if they want to get unblocked. Dennis Brown |  | WER 23:09, 23 July 2014 (UTC)
The block also will expire in one month. But I think your solution is a fair one as well.... you might add mentioning the expiry time of the block. I got pretty wide eyed when I realized just how insecure that router was.... Anyway, closing as there's nothing more to do here until another unblock request comes through. Sailsbystars (talk) 01:49, 24 July 2014 (UTC)
That isn't so uncommon, sadly, and if you understand default vs. brands, well....WP:BEANS. Regardless, in the past, I think we've always required someone to fix their gear if it can be easily abuse. Dennis Brown |  | WER 10:44, 24 July 2014 (UTC)

93.115.95.6[edit]

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

93.115.95.6 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Suspicious edits. Edit warring, inserting identical content as a recentnly blocked IP editor. Likely an open proxy (see also [6].- MrX 15:19, 13 July 2014 (UTC)

  • Not an open proxy but a web host, I've already blocked for evading blocks. Closing. Dennis Brown |  | WER 22:21, 13 July 2014 (UTC)

Anti-semitic troll[edit]

Symbol merge vote.svg – A user has requested a proxy check. A proxy checker will shortly look into the case.

190.204.146.169 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
186.88.193.144 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
190.77.253.38 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
186.93.160.116 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
190.36.56.215 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP
200.219.239.11 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Previously blocked open proxies spewing anti-semitic things. Fast IP hopping and past history of open proxies indicate that these are still open proxies, but I will leave it up to the experts to determine. -- Gogo Dodo (talk) 05:32, 14 July 2014 (UTC)

Reblocked four, can't check 200.219.239.11 and 190.77.253.38 at the moment. Materialscientist (talk) 06:16, 14 July 2014 (UTC)
200.219.239.11 is now globally blocked. Can't verify 190.77.253.38 but it looks like it was active as of a week ago when this report was submitted. Sailsbystars (talk) 01:56, 24 July 2014 (UTC)

173.58.171.174[edit]

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

173.58.171.174 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP Says it's not a proxy in their unblock request. Daniel Case (talk) 19:57, 23 July 2014 (UTC)
The proxy is apparently gone, I've unblocked. Materialscientist (talk) 21:28, 23 July 2014 (UTC)
Just double checking out of boredom, found nothing, so closing. Dennis Brown |  | WER 23:05, 23 July 2014 (UTC)

154.20.35.245[edit]

Symbol comment vote.svg – This proxy check request is closed and will shortly be archived by a bot.

154.20.35.245 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: Very old proxy block that is likely no longer needed. Double checking prior to unblocking.--Jezebel'sPonyobons mots 22:58, 23 July 2014 (UTC)

Not an open proxy Looks remarkably clean to me. There was a tor node at one point but it seems to be long gone. Sailsbystars (talk) 01:45, 24 July 2014 (UTC)
I've unblocked the IP. --Jezebel'sPonyobons mots 22:37, 29 July 2014 (UTC)

208.87.233.180[edit]

Symbol merge vote.svg – A user has requested a proxy check. A proxy checker will shortly look into the case.

208.87.233.180 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

See User talk:Bobamnertiopsis. IP was blocked by Procseebot on 22 July. If this is a proxy, any objection to my giving this editor IPBE? Here since 2007, clean block log. JohnCD (talk) 14:09, 28 July 2014 (UTC) Reason: Requested unblock.

115.112.64.30[edit]

Symbol merge vote.svg – A user has requested a proxy check. A proxy checker will shortly look into the case.

115.112.64.30 - talk - edits - block - log - current blocks - Robtex/WHOIS - Google - HTTP

Reason: ACC check. My testing shows a web filtering firewall which may spark off proxy issues. but other then that, no ports open. - RichT|C|E-Mail 11:56, 29 July 2014 (UTC)

See also[edit]

Subpages[edit]

Related pages[edit]

Chapters[edit]

Directory Directory of WikiProjects

 

Council WikiProject Council

 

Guide Guide to WikiProjects