Wikipedia:WikiProject on open proxies
WikiProject on open proxies |
---|
The WikiProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.
|
ReportingEdit
Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.
![]() | Before reporting any suspected open proxies here, please remember that not all vandals are open proxies and vandals should not get an automatic check here; remember that it takes the volunteers here about 5-10 minutes to give a request a thorough check. |
File a new report here | ||
I. | For block requests:
Verify that the following criterion has been met:
For unblock requests:
Verify that the following criteria has been met:
| |
II. | For block requests
Replace "IP" below with the IP address you are reporting. For unblock requests
Replace "IP" below with the IP address you are reporting. | |
III. | Fill out the resulting page and fill-in the requested information. | |
IV. | Save the page. |
Verified Users/Sysops Templates
|
---|
|
RequestsEdit
216.194.96.0/20Edit
A user has requested a proxy check. A proxy checker will shortly look into the case.
Reason: IP range is a possible VPN server, belonging to Cato Networks. 73.67.145.30 (talk) 19:22, 9 January 2023 (UTC)
61.220.170.133Edit
– A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.
- 61.220.170.133 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Open proxy IP being used by a blocked user Belteshazzar, also mentioned at their SPI [1] Psychologist Guy (talk) 17:47, 31 January 2023 (UTC)
- Since it's an open proxy, it would make sense to hardblock and extend the expiration date. MarioGom (talk) 22:23, 31 January 2023 (UTC)
188.215.95.0/24Edit
– A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.
Reason: The range seems to be announced by IPXO (per Hurricane Electric), an "IP marketplace" according to their website. All IPs in the range who have made contributions since 1 January 2023 are active on ExpressVPN, as well as a handful of varying residential proxies according to Spur. I've not done a fully exhaustive check on the range yet, but the only IPs I've seen not flagged as ExpressVPN on the Spur data are .251-.255, though they are still listed as data centre IPs.
It may also be worth the other /24s listed on HE as being announced by IPXO as well for any that haven't yet been blocked (some have) but probably should be. Sideswipe9th (talk) 20:56, 4 February 2023 (UTC)
- Ok, I've checked through the other /24s listed. Most are either locally or globally blocked (sometimes both), but I did find a list of 20 /24 ranges that are not currently blocked. I'll check through that list now and see if I can categorise them briefly before posting them. Sideswipe9th (talk) 21:32, 4 February 2023 (UTC)
- Done some spot checks on the other /24s, alas I don't have the tools or time to do a full check on each range. Results below split into three categories; ExpressVPN, data centre and possible unknown proxy, and unknown. The four ExpressVPN ranges are the ones I'm most confident on, there was only a few IPs in each range for which all were at a consistent last octet that weren't showing as ExpressVPN exit nodes, and the unknown ones at the end are the ones I'm least confident on.
- With all of the ranges currently being assigned by IPXO, I suspect the potential for any individual IP in a range to become a proxy or VPN exit node at random is high, even if the range itself is largely not proxy or VPN exit nodes at this time.
- ExpressVPN:
- 45.132.227.0/24 · contribs · block · log · stalk · Robtex · whois · Google - last active january 2023 - ExpressVPN on Spur and IPQS, unknown VPN on ProxyCheck,
- 163.5.123.0/24 · contribs · block · log · stalk · Robtex · whois · Google - last active january 2023 - ExpressVPN on Spur and IPQS, compromised servers on ProxyCheck
- 188.215.95.0/24 · contribs · block · log · stalk · Robtex · whois · Google - last active february 2023 - ExpressVPN on Spur and IPQS, unknown proxy on ProxyCheck
- 192.101.67.0/24 · contribs · block · log · stalk · Robtex · whois · Google - last active february 2023 - ExpressVPN and callback proxy on Spur, ExpressVPN on IPQS, unknown VPN on ProxyCheck
- Data centre and possible unknown proxy:
- 45.62.162.0/24 · contribs · block · log · stalk · Robtex · whois · Google - never active locally - datacenter range, no proxys on Spur, unknown VPN detected on ProxyCheck and IPQS
- 45.151.1.0/24 · contribs · block · log · stalk · Robtex · whois · Google - never active locally - datacenter range, no proxies on Spur, unknown VPN detected on ProxyCheck and IPQS
- 89.47.15.0/24 · contribs · block · log · stalk · Robtex · whois · Google - last active locally 2017 - datacentre range? no VPN usage on Spur, some on IPQS and ProxyCheck
- 89.116.202.0/24 · contribs · block · log · stalk · Robtex · whois · Google - never active locally - datacenter on Spur, ExpressVPN on IPQS, unknown VPN on ProxyCheck
- 103.163.221.0/24 · contribs · block · log · stalk · Robtex · whois · Google - never active locally - datacenter on Spur, unknown VPN on IPQS and ProxyCheck
- 104.234.140.0/24 · contribs · block · log · stalk · Robtex · whois · Google - never active locally - datacenter on Spur, unknown VPN on IPQS and ProxyCheck
- 115.167.79.0/24 · contribs · block · log · stalk · Robtex · whois · Google - never active locally - datacenter on Spur, ExpressVPN on IPQS, unknown VPN on ProxyCheck
- 141.11.98.0/24 · contribs · block · log · stalk · Robtex · whois · Google - never active locally - datacenter on Spur, unknown VPN on IPQS and ProxyCheck
- 158.51.110.0/24 · contribs · block · log · stalk · Robtex · whois · Google - never active locally - datacenter on Spur, no proxy on IPQS, unknown on ProxyCheck
- 185.118.78.0/24 · contribs · block · log · stalk · Robtex · whois · Google - never active locally - datacenter on Spur, unknown VPN on IPQS and ProxyCheck
- 193.68.85.0/24 · contribs · block · log · stalk · Robtex · whois · Google - never active locally - datacenter on Spur, unknown proxy on IPQS and ProxyCheck
- 194.105.21.0/24 · contribs · block · log · stalk · Robtex · whois · Google - last active february 2012 - datacenter on Spur, unknown proxy on IPQS and ProxyCheck
- Unknown:
- 86.38.235.0/24 · contribs · block · log · stalk · Robtex · whois · Google - last active locally 2014 - some webhosts, some random servers belonging to various domains, no VPN usage on Spur and IPQualityScore, some on Proxycheck
- 89.116.76.0/24 · contribs · block · log · stalk · Robtex · whois · Google - never active locally - assigned by IPXO, no VPN usage on SPUR, ExpressVPN on IPQS, unknown proxy on ProxyCheck
- 89.116.96.0/24 · contribs · block · log · stalk · Robtex · whois · Google - never active locally - random servers on various domains, no VPN or datacenter flags on Spur, ExpressVPN on IPQualityScore and ProxyCheck
- 89.116.123.0/24 · contribs · block · log · stalk · Robtex · whois · Google - never active locally - random servers on various domains, no VPN or datacenter flags on Spur, ExpressVPN on IPQualityScore and ProxyCheck
- Sideswipe9th (talk) 22:53, 4 February 2023 (UTC)
- Flagging this for admin attention. At least for the VPN and datacenter ranges. MarioGom (talk) 12:54, 19 February 2023 (UTC)
- Could someone please action this? There's a proxy hopping editor on the 192.101.67.0/24 · contribs · block · log · stalk · Robtex · whois · Google range who's just made two disruptive edits against a long standing consensus on Irreversible Damage. Sideswipe9th (talk) 21:24, 7 March 2023 (UTC)
- Flagging this for admin attention. At least for the VPN and datacenter ranges. MarioGom (talk) 12:54, 19 February 2023 (UTC)
207.188.154.0/24Edit
– A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.
Reason: Just globally unblocked the range after an UTRS appeal. From WHOIS data this seems to belong now to Xfera Móviles S.A.U, from the MasMovil group ISP (Yoigo). Thanks, —MarcoAurelio (talk) 14:39, 16 February 2023 (UTC)
- I'm not so sure. Whois data certainly looks like MásMóvil (mobile ISP), but the IP that appealed, 207.188.154.103, seemed to be a VPN node as recently as January 21st (see shodan). ST47: Do you have any input on this? I guess it can be unblocked and reviewed again in a few weeks. MarioGom (talk) 12:43, 19 February 2023 (UTC)
119.160.59.82Edit
A user has requested a proxy check. A proxy checker will shortly look into the case.
- 119.160.59.82 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Requested unblock. Says it's not a proxy, just what their mobile provider assigned. Daniel Case (talk) 07:35, 3 March 2023 (UTC)
- Daniel Case: That's likely the case. These P2P proxies run on residential ISPs, often in crowded ranges. I don't think the person posting that appeal is any of the usual suspects who abuse this type of proxy. Changing the block to anon. only might make sense. But it'd be better if the user signed up and requested WP:IPBE and WP:GIPBE. MarioGom (talk) 21:16, 7 March 2023 (UTC)
150.101.252.89Edit
– A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.
- 150.101.252.89 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: I reverted vandalism on this IP editor, and they responded by saying that it could have been anyone since it's a TOR IP and that the edits on this IP could be from anyone... here's the link. Marleeashton (talk) 07:31, 11 March 2023 (UTC)
- I'm not sure it's a Tor node, but it's definitely a VPN node. MarioGom (talk) 15:54, 12 March 2023 (UTC)
46.44.180.230Edit
– A proxy checker has requested administrator assistance for action regarding the case below. The requested action is below.
- 46.44.180.230 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: https://eu-browse.startpage.com/av/proxy --46.44.180.230 (talk) 15:19, 17 March 2023 (UTC)
Automated lists and toolsEdit
- User:AntiCompositeBot/ASNBlock maintained by User:AntiCompositeBot is a list of hosting provider ranges that need assessment for blocks that is updated daily. Admins are encouraged to review the list and assess for blocks as needed. All administrators are individually responsible for any blocks they make based on that list.
- ISP Rangefinder is a tool that allows administrators to easily identify and hard block all ranges for an entire ISP. It should be used with extreme caution, but is useful for blocking known open proxy providers. All administrators are individually responsible for any blocks they make based on the results from this tool.
- IPCheck is a tool that can help provide clues about potential open proxies.
- Bullseye provides information about IPS, including clues about potential open proxies.
- whois-referral is a generic WHOIS tool.
- Range block finder finds present and past range blocks.
See alsoEdit
- Subpages
- Related pages
- Policy on open proxies
- Open proxy detection
- Guide to checking open proxies
- Proxy check result templates
- Advice to users using Tor to bypass the Great Firewall
- meta:XFF project
- Sister projects (defunct)
This is a WikiProject, an area for focused collaboration among Wikipedians. New participants are welcome; please feel free to participate!
|