Legality of Cannabis by U.S. Jurisdiction

WikiProject on open proxies

The WikiProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.

  • If you've been blocked as an open proxy, please see: Help:blocked.
  • To report a proxy check or an incorrect block, see the #Reporting section.
Proxyblock.png
Open proxies may be blocked from editing


Reporting[edit]

Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.

File a new report here
I.
For block requests:

Verify that the following criterion has been met:

  • The IP has made abusive contributions within the past week
For unblock requests:

Verify that the following criteria has been met:

  • No current criteria
II.

For block requests Replace "IP" below with the IP address you are reporting.

For unblock requests Replace "IP" below with the IP address you are reporting.

III. Fill out the resulting page and fill-in the requested information.
IV. Save the page.
Verified Users/Sysops Templates
  • IP is an open proxy {{Proxycheck|confirmed}} for confirmed open proxies and Tor exit nodes.
  •  Likely IP is an open proxy {{Proxycheck|likely}} for likely open proxies and Tor exit nodes.
  •  Possible IP is an open proxy {{Proxycheck|possible}} for possible open proxies and Tor exit nodes.
  •  Unlikely IP is an open proxy {{Proxycheck|unlikely}} for unlikely open proxies and Tor exit nodes.
  • Not currently an open proxy {{Proxycheck|unrelated}} for IP's confirmed not to be an open proxy or Tor exit node.
  • Inconclusive {{Proxycheck|inconclusive}} for IP's that are inconclusive.
  •  Declined to run a check {{Proxycheck|decline}} to decline a check.
  • Open proxy blocked {{Proxycheck|blocked}} for open proxies and Tor nodes that have been blocked. Please add this if you block the IP.

Requests[edit]

This section is transcluded from /Requests. (edit | history)


125.166.12.128[edit]

Symbol wait old.png A user has requested a proxy check. A proxy checker will shortly look into the case.

125.166.12.128 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan

Reason: The socks4://103.144.209.98:3629 way for using the open proxy no longer works, and I was unable to find a different one. Martin Urbanec (talk) 09:34, 24 February 2022 (UTC)[reply]

175.143.95.18[edit]

Symbol comment vote.svg – This proxy check request is closed and will soon be archived by a bot.

Reason: I'm using a shadowsocks proxy. This is my IP address. — Preceding unsigned comment added by 175.143.95.18 (talk • contribs) 16:32, 6 May 2022 UTC) (UTC)

Do you have connection details or a reference to the proxy listing this came from? I cannot verify this externally. MarioGom (talk) 23:12, 13 May 2022 (UTC)[reply]
 Highly likely an open proxy. I have found a probable external signature for this open shadowsocks proxy network. This particular IP seems to be residential, so the proxy probably won't stay in the same IP indefinitely. Requesting a second opinion for the appropriate administative action. MarioGom (talk) 21:00, 23 May 2022 (UTC)[reply]
  • Proxy blocked for a month – that's usually my starting point for open proxies because I think it's a reasonable compromise between covering a good chunk of the expected lifespan and not incurring excessive collateral, though I guess it's mostly a matter of preference. Closing.​ --Blablubbs (talk) 06:39, 25 May 2022 (UTC)[reply]

2001:2d8::/32, 2001:e60::/32, 2001:4430::/32 (IPv6)[edit]

Symbol comment vote.svg – This proxy check request is closed and will soon be archived by a bot.

Reason: South Korean mobile network operator's LTE open proxy bands. These bands have a lot of block logs on kowiki (Typical reasons are page pranks, page vandalism, and avoiding of block through multiple accounts and IPs within the bands: 2001:2d8::/32, 2001:e60::/32, 2001:4430::/32), and these bands are violating policies and guidelines and vandalising through multi-accounts and IP adresses abuse. Also, these bands are habitual multi-account mass creation band and in the blocking log, the reason for 2 bands is "Long-term abuse". 2001:2d8::/32 and 2001:e60::/32 band is currently blocked on kowiki for 3 days. (2d8 and e60) If unblocked, there is a risk of causing problems in various wiki projects including Wikipedia. Please permanently block editing user talk page too and globally lock these LTE bands with IP adress only. Goondae (talk) 11:43, 9 May 2022 (UTC)[reply]

  •  Additional information needed. @Goondae: I'm confused – is there any evidence these ranges have proxies on them? If yes, could you please provide it? If no, I'm afraid this is not the right venue; WP:ANI or m:SRG would probably be your best bet. On a sidenote, @Girth Summit: I've added {{anonblock}} to the block mentioned by the filer; I hope that's alright. --Blablubbs (talk) 20:30, 10 May 2022 (UTC)[reply]
    Thanks Blablubbs, I should have done that in the first place. Cheers Girth Summit (blether) 05:34, 11 May 2022 (UTC)[reply]
These LTE bands are proxyed by mobile network operators. These bands, which are IPv6, are more anonymous because the IP address changes just by turning LTE off and on. This easily circumvents penalties and abuses policies and guidelines (e.g. changing an IPv6 address by turning LTE off and on on a blocked IPv6 address). Therefore, these bands can be considered as open proxy. Goondae (talk) 12:15, 15 May 2022 (UTC)[reply]
By that logic, shouldn't we block most mobile networks IP addresses? I can do exactly the same thing and jump around on a /13 IPv4 covering an entire city of 1.5 million. Mako001 (C)  (T)  🇺🇦 12:30, 15 May 2022 (UTC)[reply]
  • While dynamic IPs may be harder block targets sometimes, that does not make them proxies. no Closing without action. --Blablubbs (talk) 12:58, 15 May 2022 (UTC)[reply]

175.158.155.92[edit]

Symbol comment vote.svg – This proxy check request is closed and will soon be archived by a bot.

Reason: Editing corp article frequented by COI editors including logged-out UPE sockfarm [1] & spur indicates this is a call-back proxy. ☆ Bri (talk) 20:39, 31 May 2022 (UTC)[reply]

 Highly likely a residential proxy. Given the exact proxy service here (as seen in spur advanced API), the article target, and some other characteristics of this edit, I'm fairly sure this is the Yoodaba sockfarm. They have used this proxy network since June 2021. Usage by other sockfarms is very unusual. Note that they almost never use the same IP twice, and that residential proxies are highly dynamic, so a block is unlikely to be even noticed by them. MarioGom (talk) 18:39, 3 June 2022 (UTC)[reply]
Marking for a second opinion on the administrative action (or lack of thereof). MarioGom (talk) 18:40, 3 June 2022 (UTC)[reply]
  • This would have likely been an ineffective block if we had gotten to it at the time (the pool here is large and dynamic), and by now, the IP is functionally  Stale. Closing. --Blablubbs (talk) 10:01, 15 June 2022 (UTC)[reply]

92.53.0.0/18[edit]

Symbol comment vote.svg – This proxy check request is closed and will soon be archived by a bot.

I have noticed a continued string of poor quality edits from this IP range, usually on automotive pages or pages about windows software. The pattern is typically nonconstructive copyedits, unsourced info, and the like, which are often reverted. IP user only ever leaves the edit summary "New changes". Usually the edits will persist over several days until the IP is warned about using an edit summary on their talk page, and then a similar pattern will emerge with a different IP. IPBilly (talk) 23:01, 14 June 2022 (UTC)[reply]

It appears that nine IPs in that range are currently blocked by ST47ProxyBot as P2P VPN. That does suggest an issue. Malcolmxl5 (talk) 23:27, 14 June 2022 (UTC)[reply]
Looking at the /16, I see a host of /22, /23, /24 rangeblocks by ST47 as a colocation webhost. And three global /20, /22 blocks by Jon Kolbert. This might be more trouble than it’s worth. Malcolmxl5 (talk) 23:36, 14 June 2022 (UTC)[reply]
As far as this particular individual is concerned (the "New changes" guy), they are using 92.53.16.0/23. Malcolmxl5 (talk) 00:11, 15 June 2022 (UTC)[reply]
Might be this guy: User:Иван Стефановски. Malcolmxl5 (talk) 00:28, 15 June 2022 (UTC)[reply]
  • @IPBilly and Malcolmxl5: I vaguely remember that ISP because I recall having been annoyed by it in the past. They do offer some hosting, but they are primarily a broadband provider. Both the Shodan return for the /18 and spot checks of individual IPs that have edited don't show any clear signs of proxy presence, and the /23 mentioned above is part of a block assigned to "CableTEL DOOEL Macedonia Veles Triple Play Clients". The apparently fairly stable presence of this one user on a single range also speaks against the possibility of proxy use. Other bits of the /16 do seem to be hosting ranges, but those are owned by other providers. no Closing without action from a proxy perspective only; I haven't looked at the socking angle. Thanks for the report. --Blablubbs (talk) 10:16, 15 June 2022 (UTC)[reply]
    Should I open a report at SPI? IPBilly (talk) 15:50, 15 June 2022 (UTC)[reply]
    @IPBilly: Your call – if you think you can prove socking, sure. --Blablubbs (talk) 09:20, 16 June 2022 (UTC)[reply]

Automated lists and tools[edit]

  • User:AntiCompositeBot/ASNBlock maintained by User:AntiCompositeBot is a list of hosting provider ranges that need assessment for blocks that is updated daily. Admins are encouraged to review the list and assess for blocks as needed. All administrators are individually responsible for any blocks they make based on that list.
  • ISP Rangefinder is a tool that allows administrators to easily identify and hard block all ranges for an entire ISP. It should be used with extreme caution, but is useful for blocking known open proxy providers. All administrators are individually responsible for any blocks they make based on the results from this tool.
  • IPCheck is a tool that can help provide clues about potential open proxies.
  • Bullseye provides information about IPS, including clues about potential open proxies.
  • whois-referral is a generic WHOIS tool.
  • Range block finder finds present and past range blocks.

See also[edit]

Subpages
Related pages
Sister projects (defunct)
source: https://web.archive.org/web/20220617121800/http://en.wikipedia.org/wiki/Wikipedia:WikiProject_on_open_proxies