Wikipedia:WikiProject on open proxies

From Wikipedia, the free encyclopedia
(Redirected from Wikipedia:OP)
WikiProject on open proxies
Shortcuts

The WikiProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.

  • If you've been blocked as an open proxy, please see: Help:blocked.
  • To report a proxy check or an incorrect block, see the #Reporting section.
Proxyblock.png
Open proxies may be blocked from editing


Reporting[edit]

Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.

File a new report here
I.
For block requests:

Verify that the following criterion has been met:

  • The IP has made abusive contributions within the past week
For unblock requests:

Verify that the following criteria has been met:

  • No current criteria
II.

For block requests Replace "IP" below with the IP address you are reporting.


For unblock requests Replace "IP" below with the IP address you are reporting.


III. Fill out the resulting page and fill-in the requested information.
IV. Save the page.
Verified Users/Sysops Templates
  • IP is an open proxy {{Proxycheck|confirmed}} for confirmed open proxies and Tor exit nodes.
  •  Likely IP is an open proxy {{Proxycheck|likely}} for likely open proxies and Tor exit nodes.
  •  Possible IP is an open proxy {{Proxycheck|possible}} for possible open proxies and Tor exit nodes.
  •  Unlikely IP is an open proxy {{Proxycheck|unlikely}} for unlikely open proxies and Tor exit nodes.
  • Not currently an open proxy {{Proxycheck|unrelated}} for IP's confirmed not to be an open proxy or Tor exit node.
  • Inconclusive {{Proxycheck|inconclusive}} for IP's that are inconclusive.
  • no Declined to run a check {{Proxycheck|decline}} to decline a check.
  • Open proxy blocked {{Proxycheck|blocked}} for open proxies and Tor nodes that have been blocked. Please add this if you block the IP.

Requests[edit]

This section is transcluded from /Requests. (edit | history)


216.194.96.0/20[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: IP range is a possible VPN server, belonging to Cato Networks. 73.67.145.30 (talk) 19:22, 9 January 2023 (UTC)Reply[reply]

61.220.170.133[edit]

Pictogram voting wait violet.svg – A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.

Reason: Open proxy IP being used by a blocked user Belteshazzar, also mentioned at their SPI [1] Psychologist Guy (talk) 17:47, 31 January 2023 (UTC)Reply[reply]

  • Since it's an open proxy, it would make sense to hardblock and extend the expiration date. MarioGom (talk) 22:23, 31 January 2023 (UTC)Reply[reply]

188.215.95.0/24[edit]

Pictogram voting wait violet.svg – A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.

Reason: The range seems to be announced by IPXO (per Hurricane Electric), an "IP marketplace" according to their website. All IPs in the range who have made contributions since 1 January 2023 are active on ExpressVPN, as well as a handful of varying residential proxies according to Spur. I've not done a fully exhaustive check on the range yet, but the only IPs I've seen not flagged as ExpressVPN on the Spur data are .251-.255, though they are still listed as data centre IPs.

It may also be worth the other /24s listed on HE as being announced by IPXO as well for any that haven't yet been blocked (some have) but probably should be. Sideswipe9th (talk) 20:56, 4 February 2023 (UTC)Reply[reply]

Ok, I've checked through the other /24s listed. Most are either locally or globally blocked (sometimes both), but I did find a list of 20 /24 ranges that are not currently blocked. I'll check through that list now and see if I can categorise them briefly before posting them. Sideswipe9th (talk) 21:32, 4 February 2023 (UTC)Reply[reply]
Done some spot checks on the other /24s, alas I don't have the tools or time to do a full check on each range. Results below split into three categories; ExpressVPN, data centre and possible unknown proxy, and unknown. The four ExpressVPN ranges are the ones I'm most confident on, there was only a few IPs in each range for which all were at a consistent last octet that weren't showing as ExpressVPN exit nodes, and the unknown ones at the end are the ones I'm least confident on.
With all of the ranges currently being assigned by IPXO, I suspect the potential for any individual IP in a range to become a proxy or VPN exit node at random is high, even if the range itself is largely not proxy or VPN exit nodes at this time.
ExpressVPN:
Data centre and possible unknown proxy:
Unknown:
Sideswipe9th (talk) 22:53, 4 February 2023 (UTC)Reply[reply]
Flagging this for admin attention. At least for the VPN and datacenter ranges. MarioGom (talk) 12:54, 19 February 2023 (UTC)Reply[reply]
Could someone please action this? There's a proxy hopping editor on the 192.101.67.0/24 · contribs · block · log · stalk · Robtex · whois · Google range who's just made two disruptive edits against a long standing consensus on Irreversible Damage. Sideswipe9th (talk) 21:24, 7 March 2023 (UTC)Reply[reply]
ExpressVPN ranges done, hoping to circle back to the rest. --Blablubbs (talk) 16:00, 12 March 2023 (UTC)Reply[reply]

207.188.154.0/24[edit]

Pictogram voting wait violet.svg – A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.

207.188.154.0/24 · contribs · block · log · stalk · Robtex · whois · Google

Reason: Just globally unblocked the range after an UTRS appeal. From WHOIS data this seems to belong now to Xfera Móviles S.A.U, from the MasMovil group ISP (Yoigo). Thanks, —MarcoAurelio (talk) 14:39, 16 February 2023 (UTC)Reply[reply]

I'm not so sure. Whois data certainly looks like MásMóvil (mobile ISP), but the IP that appealed, 207.188.154.103, seemed to be a VPN node as recently as January 21st (see shodan). ST47: Do you have any input on this? I guess it can be unblocked and reviewed again in a few weeks. MarioGom (talk) 12:43, 19 February 2023 (UTC)Reply[reply]
I took another look at the range. Services in that range are mostly Synology, HomeAssist, domestic routers, etc. So it is, indeed, a residential range. MarioGom (talk) 21:23, 7 March 2023 (UTC)Reply[reply]

46.44.180.230[edit]

Pictogram voting wait violet.svg – A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.

Reason: https://eu-browse.startpage.com/av/proxy --46.44.180.230 (talk) 15:19, 17 March 2023 (UTC)Reply[reply]

Indeed. This is startpage's proxy: [2]. MarioGom (talk) 00:20, 19 March 2023 (UTC)Reply[reply]

161.69.116.0/24[edit]

Symbol move vote.svg – A proxy checker has requested a second opinion on this case.

Reason: VPN server. 73.67.145.30 (talk) 18:38, 17 April 2023 (UTC)Reply[reply]

McAfee WGCS is a corporate gateway, technically a VPN, but last time it was discussed here, it was not blocked. Requesting a second opinion. MarioGom (talk) 21:43, 26 April 2023 (UTC)Reply[reply]
Not an admin, so feel free to ignore. Looking at the two prior discussions on this (March 2021, May 2022) it seems that softblocking might be appropriate in this case? There are some McAfee WGCS ranges that we do currently softblock (eg 185.221.70.0/24, 208.81.64.0/21) so this would at least be consistent with them, though there are other ranges that we don't currently softblock (eg 185.125.227.0/24).
Whatever the decision is from this discussion, we may want to look at making things consistent across all of the known ranges. Sideswipe9th (talk) 21:56, 26 April 2023 (UTC)Reply[reply]

216.24.45.0/24[edit]

Pictogram voting wait violet.svg – A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.

Reason: VPN server (Menlo or Supervpn360). Fraud Score: 75 from IPQualityScore. Also see stalktoy - 216.24.45.0/24 blocked at ru.wiki. ☆ Bri (talk) 17:05, 19 April 2023 (UTC)Reply[reply]

I'd recommend blocking the /24. The full range is, indeed, Menlo Security, which provides some sort of VPN service. See whois and spur. MarioGom (talk) 21:45, 26 April 2023 (UTC)Reply[reply]

176.112.144.0/20[edit]

Pictogram voting wait violet.svg – A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.

Reason: Public proxy server run by Astrec Data OU wizzito | say hello! 00:56, 20 April 2023 (UTC)Reply[reply]

Yep. It's some sort of cloud provider, see astrec.data / pilvio.com. The range could get a webhost block. MarioGom (talk) 21:49, 26 April 2023 (UTC)Reply[reply]

212.69.160.0/19[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Datacenter run by Zayo Infrastructure France SA wizzito | say hello! 01:01, 20 April 2023 (UTC)Reply[reply]

45.134.110.0/24[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Data center run by Kuroit (web hosting company) wizzito | say hello! 01:04, 20 April 2023 (UTC)Reply[reply]

103.111.0.0/16 and 103.119.0.0/16[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Suspicious beauty pageant SPA edits in range.

103.119.62.2 103.119.62.15 almost certainly the same operator, I think there is a second range. ☆ Bri (talk) 17:55, 25 April 2023 (UTC)Reply[reply]
103.111.143.41 another. IPcheck says it is a proxy, 100% abuse score. Blocked on ru.wiki (expanded range to match). ☆ Bri (talk) 18:50, 25 April 2023 (UTC)Reply[reply]
Here are edits showing probably the same operator using both ranges on the same article in a ~half hour time span. First pair, IP on 103.111 range at 10:41 followed by IP on 103.119 range [3]. Second pair, same day, different article – same IP on 103.111 range at 10:42 followed by IP on 103.119 range [4]. ☆ Bri (talk) 21:08, 25 April 2023 (UTC)Reply[reply]

165.85.64.0/22[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Amazon AWB. 165.85.64.0 - 165.85.66.255 are all registered to Amazon AWB, hence the /22 range in this report. BLP disruption caught by filter log. 73.67.145.30 (talk) 16:45, 28 April 2023 (UTC)Reply[reply]

81.25.28.1[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Disruption. Marked as a public proxy server. 73.67.145.30 (talk) 18:25, 30 April 2023 (UTC)Reply[reply]

2a00:f48:1003:22dd::1[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: VPN network/Webhosting service. 73.67.145.30 (talk) 08:05, 1 May 2023 (UTC)Reply[reply]

209.80.128.102[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Possible VPN server per WHOIS. 73.67.145.30 (talk) 15:36, 1 May 2023 (UTC)Reply[reply]

76.9.240.0/20[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Possible VPN server per WHOIS. 73.67.145.30 (talk) 17:25, 2 May 2023 (UTC)Reply[reply]

125.212.241.0/24[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Disruption. Possible VPN server. 73.67.145.30 (talk) 19:22, 7 May 2023 (UTC)Reply[reply]

149.7.65.129[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Possible VPN. 73.67.145.30 (talk) 03:21, 8 May 2023 (UTC)Reply[reply]

45.86.231.0/24[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Confirmed VPS hosting IP range (see Blue VPS). 73.67.145.30 (talk) 03:18, 8 May 2023 (UTC)Reply[reply]

133.114.163.71[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Possible VPN. 73.67.145.30 (talk) 17:33, 9 May 2023 (UTC)Reply[reply]

138.124.187.0/24[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Webhosting/VPN range. 73.67.145.30 (talk) 17:14, 10 May 2023 (UTC)Reply[reply]

103.135.39.174[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Listed as a Public proxy server at whatismyipaddress.com/ip/103.135.39.174 and proxy with recent abuse at ipcheck.toolforge.org/index.php?ip=103.135.39.174. Mojoworker (talk) 03:57, 11 May 2023 (UTC)Reply[reply]

117.210.138.86[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Suspected Nord VPN ip Reason: Suspected Nord VPN ip Tonyinman (talk) 18:20, 15 May 2023 (UTC)Reply[reply]

59.91.229.198[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Suspected NordVPN address Tonyinman (talk) 18:21, 15 May 2023 (UTC)Reply[reply]

117.210.142.151[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: suspected NordVPN ip address Tonyinman (talk) 18:22, 15 May 2023 (UTC)Reply[reply]

59.91.224.115[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: suspected NordVPN ip address Tonyinman (talk) 18:22, 15 May 2023 (UTC)Reply[reply]

61.1.23.137[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: suspected NordVPN ip address Tonyinman (talk) 18:23, 15 May 2023 (UTC)Reply[reply]

59.91.229.17[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: suspected NordVPN ip address Tonyinman (talk) 18:24, 15 May 2023 (UTC)Reply[reply]

66.168.171.57[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Suspected NordVPN ip address Tonyinman (talk) 18:25, 15 May 2023 (UTC)Reply[reply]

59.91.227.166[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: suspected NordVPN ip address Tonyinman (talk) 18:25, 15 May 2023 (UTC)Reply[reply]

209.35.227.0/24[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: VPN. Perimeter 81. 73.67.145.30 (talk) 18:43, 15 May 2023 (UTC)Reply[reply]

165.225.192.0/18[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Webhost/VPN. 73.67.145.30 (talk) 16:23, 17 May 2023 (UTC)Reply[reply]

156.255.1.0/24[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: Webhost. 73.67.145.30 (talk) 18:12, 25 May 2023 (UTC)Reply[reply]

2A0C:5C84:1:6004:0:0:0:32B5[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

Reason: VPN. 73.67.145.30 (talk) 04:20, 26 May 2023 (UTC)Reply[reply]

Automated lists and tools[edit]

  • User:AntiCompositeBot/ASNBlock maintained by User:AntiCompositeBot is a list of hosting provider ranges that need assessment for blocks that is updated daily. Admins are encouraged to review the list and assess for blocks as needed. All administrators are individually responsible for any blocks they make based on that list.
  • ISP Rangefinder is a tool that allows administrators to easily identify and hard block all ranges for an entire ISP. It should be used with extreme caution, but is useful for blocking known open proxy providers. All administrators are individually responsible for any blocks they make based on the results from this tool.
  • IPCheck is a tool that can help provide clues about potential open proxies.
  • Bullseye provides information about IPS, including clues about potential open proxies.
  • whois-referral is a generic WHOIS tool.
  • Range block finder finds present and past range blocks.

See also[edit]

Subpages
Related pages
Sister projects (defunct)
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:WikiProject_on_open_proxies&oldid=1141701811"