WikiProject on open proxies |
---|
The WikiProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.
|
Reporting
Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.
File a new report here | ||
I. | For block requests:
Verify that the following criterion has been met:
For unblock requests:
Verify that the following criteria has been met:
| |
II. | For block requests
Replace "IP" below with the IP address you are reporting. For unblock requests
Replace "IP" below with the IP address you are reporting. | |
III. | Fill out the resulting page and fill-in the requested information. | |
IV. | Save the page. |
Verified Users/Sysops Templates
|
---|
|
Requests
PLDT call-back proxies associated with sockfarm
– This proxy check request is closed and will soon be archived by a bot.
- 49.149.138.0 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan reference, blocked with sockmaster, call-back proxy
- 49.146.32.246 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan IPQualityScore fraud score 100, proxy
- 49.146.33.225 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan score 100, proxy
- 49.146.37.70 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan score 100, proxy
- 49.146.40.133 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan score 73, proxy
- 49.146.39.232 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan score 20, proxy
Reason: Suspicious edits, coincident with beauty pageant sockfarm [1][2][3], & IPQualityScore reports 100% fraud score & spur findings on each are "call-back proxy network". ☆ Bri (talk) 04:06, 21 October 2021 (UTC)
- Fairly Unlikely in the sense that while there are services running, they aren't the type that is likely to be used for socking, and the user in question is probably just a residential customer on an infected range. Closing without action. --Blablubbs (talk) 11:01, 22 October 2021 (UTC)
204.74.208.0/20
– This proxy check request is closed and will soon be archived by a bot.
- 204.74.208.0/20 · contribs · block · log · stalk · Robtex · whois · Google
Reason: Take 2 Hosting. Blocked twice before as proxy/webhost[4], for five and three years. Last block expired in January. Malcolmxl5 (talk) 10:43, 26 October 2021 (UTC)
- @Malcolmxl5: Confirmed the full /20 via whois; looks good to block. —Mdaniels5757 (talk • contribs) 15:25, 26 October 2021 (UTC)
- Holding for a bit, it looks like there might be more here, I can take a look in a bit. No objections to anyone blocking in the meantime. --Blablubbs (talk) 17:16, 26 October 2021 (UTC)
- The following are Take 2 Hosting:
- 50.115.128.0/20 · contribs · block · log · stalk · Robtex · whois · Google
- 74.82.160.0/19 · contribs · block · log · stalk · Robtex · whois · Google
- 173.252.192.0/18 · contribs · block · log · stalk · Robtex · whois · Google
- 198.144.240.0/20 · contribs · block · log · stalk · Robtex · whois · Google
- 204.74.208.0/20 · contribs · block · log · stalk · Robtex · whois · Google
- Same ASN, different ISP (
FEDERAL-ONLINE-GROUP-LLC
), almost certainly also hosting judging by shodan results and this:- 107.163.0.0/16 · contribs · block · log · stalk · Robtex · whois · Google
- 23.231.128.0/17 · contribs · block · log · stalk · Robtex · whois · Google
- Different ASN, also FEDERAL-ONLINE-GROUP:
- 192.155.160.0/19 · contribs · block · log · stalk · Robtex · whois · Google
- All blocked. I think there's some more for the latter ISP, will try to follow up. Closing. --Blablubbs (talk) 20:01, 26 October 2021 (UTC)
Unblock 89.38.160.43
– This proxy check request is closed and will soon be archived by a bot.
- 89.38.160.43 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: whois says Fiber to the Home/Business Network. Likely not an open proxy anymore? Can you review and unblock? I already removed the gblock. Martin Urbanec (talk) 11:29, 26 October 2021 (UTC)
- @Martin Urbanec: Possible IP is an open proxy. There is an open port (1723) that is used for VPN access. It requires a username and password for access. Admin: please decide appropriate action. —Mdaniels5757 (talk • contribs) 15:32, 26 October 2021 (UTC)
- Username and password makes it a closed (for authenticated-only users) proxy, unless anyone can obtain a valid combination. Or am I missing something? Martin Urbanec (talk) 16:18, 26 October 2021 (UTC)
- It's not uncommon for carrier grade routers to have 1723 open – and I also think Martin Urbanec' reasoning here is sound. This looks like it's collateral from an ASN block, since the /22 is registered to NFOrce, and that specific /24 is assigned to a home broadband provider; blocking the entire range would arguably be too wide anyway. I'm inclined to unblock; ping @ST47 as the blocking admin: Would you be okay with me lifting the block on the /24? --Blablubbs (talk) 19:04, 26 October 2021 (UTC)
- Username and password makes it a closed (for authenticated-only users) proxy, unless anyone can obtain a valid combination. Or am I missing something? Martin Urbanec (talk) 16:18, 26 October 2021 (UTC)
- Thanks. Unblocked the /22 and reblocked everything but that specific /24. Closing. --Blablubbs (talk) 10:41, 27 October 2021 (UTC)
220.86.0.33
– This proxy check request is closed and will soon be archived by a bot.
- 220.86.0.33 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: See below. —Mdaniels5757 (talk • contribs) 16:07, 26 October 2021 (UTC)
- Confirmed -- IP is an open proxy (OpenVPN port 1873). Admin: please consider a block. —Mdaniels5757 (talk • contribs) 16:07, 26 October 2021 (UTC)
- Yeah, that's a VPNgate node. Blocked, closing. --Blablubbs (talk) 17:10, 26 October 2021 (UTC)
Vpngate VPNs
– This proxy check request is closed and will soon be archived by a bot.
- 1.224.248.6 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 1.241.166.89 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 59.136.57.69 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 61.84.98.103 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 114.165.186.124 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 210.96.184.160 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
- 211.177.27.221 · talk · contribs · block · log · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: Vpngate VPNs per Spur. Malcolmxl5 (talk) 20:55, 26 October 2021 (UTC)
Automated lists and tools
- User:AntiCompositeBot/ASNBlock maintained by User:AntiCompositeBot is a list of hosting provider ranges that need assessment for blocks that is updated daily. Admins are encouraged to review the list and assess for blocks as needed. All administrators are individually responsible for any blocks they make based on that list.
- ISP Rangefinder is a tool that allows administrators to easily identify and hard block all ranges for an entire ISP. It should be used with extreme caution, but is useful for blocking known open proxy providers. All administrators are individually responsible for any blocks they make based on the results from this tool.
- IPCheck is a tool that can help provide clues about potential open proxies.
See also
- Subpages
- Related pages
- Policy on open proxies
- Open proxy detection
- Guide to checking open proxies
- Proxy check result templates
- Advice to users using Tor to bypass the Great Firewall
- meta:XFF project
- Sister projects (defunct)