Wikipedia:WikiProject on open proxies

←Administration index

MetaProject on open proxies (en-Wikipedia chapter)

If you've been blocked as an open proxy, please see: Help:blocked. The multiwiki MetaProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.

Open proxies may be blocked from editing

Automated lists and tools

• User:SQL/Non-blocked compute hosts maintained by User:SQLBot is a list of open proxy ranges that need assessment for blocks that is updated daily. Admins are encouraged to review the list and assess for blocks as needed. All administrators are individually responsible for any blocks they make based on that list.
• ISP Rangefinder is a tool that allows administrators to easily identify and hard block all ranges for an entire ISP. It should be used with extreme caution, but is useful for blocking known open proxy providers. All administrators are individually responsible for any blocks they make based on the results from this tool.
• IPCheck is a tool that can help identify open proxies.

Reporting

Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.

File a new report here
I.	For block requests:
	Verify that the following criteria has been met: The IP has made abusive contributions within the past week
	For unblock requests:
	Verify that the following criteria has been met: No current criteria
II.	For block requests	For unblock requests
	Replace "IP" below with the IP address you are reporting.	Replace "IP" below with the IP address you are reporting.
III.	Fill out the resulting page and fill-in the requested information.
IV.	Save the page.

Verified Users/Sysops Templates

IP is an open proxy {{Proxycheck|confirmed}} for confirmed open proxies and TOR exit nodes.  Likely IP is an open proxy {{Proxycheck|likely}} for likely open proxies and TOR exit nodes.  Possible IP is an open proxy {{Proxycheck|possible}} for possible open proxies and TOR exit nodes.  Unlikely IP is an open proxy {{Proxycheck|unlikely}} for unlikely open proxies and TOR exit nodes. Not currently an open proxy {{Proxycheck|unrelated}} for IP's confirmed not to be an open proxy or TOR exit node. Inconclusive {{Proxycheck|inconclusive}} for IP's that are inconclusive.  Declined to run a check {{Proxycheck|decline}} to decline a check. Open proxy blocked {{Proxycheck|blocked}} for open proxies and TOR nodes that have been blocked. Please add this if you block the IP.

Requests

12.89.35.14 and others

– This proxy check request is closed and may now be archived.

12.89.35.14 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

145.15.244.25 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits, is flagged as proxy by IPQualityScore via wmflabs ipcheck Bri.public (talk) 22:14, 10 October 2019 (UTC)

Add 145.15.244.25. Same type of editing. It is indicated by wmflabs ipcheck as proxy & recent abuse. ☆ Bri (talk) 19:18, 11 October 2019 (UTC)

There are more Miss World/Miss Earth edits from this range last year. If action is taken on this, I'd ask that this be taken into consideration. [1][2][3] - Bri.public (talk) 20:54, 11 October 2019 (UTC)

@Bri: The first IP is linked to Fortinet, but does not seem to be an open proxy. The second IP is linked to Nederlandse Spoorwegen (Dutch national railway company) and is presumably a public Wifi network. Pinging Zzuuzz to confirm. --MrClog (talk) 21:37, 13 March 2020 (UTC)

I concur about the first one. The 145.15.244.25/22 network is an interesting one, with suspicious characteristics. The 145.15.244.0/24 range was blocked both recently and 2 years ago as WP:BKFIP, but I can't find evidence that it's an open proxy (other than being used in the context of Dutch trains). I'm going to say  Unlikely IP is an open proxy. -- zzuuzz ^(talk) 18:03, 15 March 2020 (UTC)

2a01:4f8:120:3247::2

– This proxy check request is closed and may now be archived.

2a01:4f8:120:3247::2 - talk - edits - block - log - current blocks - Robtex/whois- Google - [http://[2a01:4f8:120:3247::2] HTTP]

Reason: Requested unblock. Ivanvector (talk · contribs) blocked the 2A01:4F8:0:0:0:0:0:0/32 range but I can't find a history of abuses from this range. Also, what about using smaller ranges for blocking, like blocking some /48 instead of blocking a full /32? Carmelobrianza (talk) 10:28, 25 October 2019 (UTC)

• The range is Hetzner, a German VPN/webhost/colocation provider. Per the checkuser logs this webhost has been used abusively by at least eight different long-term vandals, some of whom are extremely disruptive. I object to unblocking the range; it's impossible at this time to determine if a smaller subset of the range would make an effective block (WHOIS has /29 for the ISP). Please advise the user to disable their VPN or request an account. Ivanvector (^Talk/_Edits) 14:05, 25 October 2019 (UTC)

121.118.78.132

– This proxy check request is closed and may now be archived.

121.118.78.132 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits which can be checked against the Daryl Morey contributions by this now blocked proxy user. Lots of strong signs that they are the same person/people, which includesexactly the same way they write and sources they use. Flaughtin (talk) 18:37, 28 October 2019 (UTC)

 Likely IP is an open proxy: openvpn. It's probably a bit too stale to block at this point. -- zzuuzz ^(talk) 16:15, 15 November 2019 (UTC)

146.88.177.146

– This proxy check request is closed and may now be archived.

146.88.177.146 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits, high IPQualityScore fraud score and appears to be a data center called DataBank, according to whois. ☆ Bri (talk) 03:04, 1 November 2019 (UTC)

146.88.176.0/20 range blocked as a colocation webhost. NinjaRobotPirate (talk) 08:56, 3 November 2019 (UTC)

103.67.157.240

A user has requested a proxy check. A proxy checker will shortly look into the case.

103.67.157.240 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: ACC check. High IPQuality fraud score, as shown at [4] OhKayeSierra (talk) 07:18, 1 November 2019 (UTC)

188.72.102.7

– This proxy check request is closed and may now be archived.

188.72.102.7 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: WHOIS reports this is PureVPN Bri.public (talk) 19:15, 6 November 2019 (UTC)

188.72.102.0/24 range blocked as a webhost. NinjaRobotPirate (talk) 04:52, 7 November 2019 (UTC)

37.190.128.0/17

A user has requested a proxy check. A proxy checker will shortly look into the case.

37.190.151.98 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

37.190.149.217 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

‎37.190.150.185 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits by IPs noted above as if they are maintaining the Pier 1 Imports article financial data. Other weird edits from the Polish ISP range too, including possible promo on a Las Vegas concert residency [5]. ☆ Bri (talk) 23:17, 10 November 2019 (UTC)

154.160.xxx.yyy

A user has requested a proxy check. A proxy checker will shortly look into the case.

154.160.11.77 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

154.160.26.23 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

154.160.30.55 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits; reported as proxy by proxycheck.io via wmflabs' ipcheck ☆ Bri (talk) 02:45, 11 November 2019 (UTC)

It was pointed out at COIN that ST47 blocked 154.160.26.23 based on long term abuse. The LTA [6] is not based in the ISP's geographic area, and routinely uses a proxy. ☆ Bri (talk) 15:34, 15 November 2019 (UTC)

I can tell you from experience (as well as looking at this) that among other things this network contains certified dynamic open proxies, several banned users, and CU-confirmed COI farms. There is however a lot of collateral when we block it. It is otherwise a normal network (and quite an important one). -- zzuuzz ^(talk) 16:04, 15 November 2019 (UTC)

185.83.71.18

– This proxy check request is closed and may now be archived.

185.83.71.18 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Used for sockpuppetry by Shingling334, reported as proxy by WhatIsMyIPAddress and IPQualityScore. IamNotU (talk) 17:57, 11 November 2019 (UTC)

Open proxy: 24 Shells hosting. Blocked by Favonian. -- zzuuzz ^(talk) 16:10, 15 November 2019 (UTC)

113.150.100.49

– This proxy check request is closed and may now be archived.

113.150.100.49 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious AfD nominations on high-profile pages. IPQualityScore gives an 89% chance of it operating as an open proxy, and it is blocked on ru.wiki and nl.wiki as an open proxy: [7]. 2601:1C0:4401:24A0:3C4C:2790:EFBB:586D (talk) 06:31, 12 November 2019 (UTC)

Open proxy: openvpn. It's probably expired by now, but I blocked it for a month anyway. -- zzuuzz ^(talk) 15:37, 15 November 2019 (UTC)

64.2.184.130

– This proxy check request is closed and may now be archived.

64.2.184.130 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits. User at this IP address made a few edits today at Occupation of the Malheur National Wildlife Refuge that appear to be nothing more than vandalism, and those have been the only edits from this IP address in the last week. But looking at the contributions from this IP address shows a long history of vandalism. A few examples of many: [8] [9] [10] [11] [12] [13] Please investigate. Thanks in advance! Yompi20 (talk) 21:00, 25 November 2019 (UTC)

It has been blocked as a school. --MrClog (talk) 13:49, 14 March 2020 (UTC)

36.71.234.89

A user has requested a proxy check. A proxy checker will shortly look into the case.

36.71.234.89 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

This IP is making the same suspicious political POV edits (placing a map) on several wiki pages (including on foreign Wikipedia's as well). I checked it on several sites. All of them give that it is indeed a proxy. Reason: Suspicious edits Casperti (talk) 15:20, 6 December 2019 (UTC)

Does not seem to be an open proxy. --MrClog (talk) 13:45, 14 March 2020 (UTC)

62.254.132.162

A user has requested a proxy check. A proxy checker will shortly look into the case.

62.254.132.162 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Listed as proxy/blacklisted. Mainly vandalism. Seems to be Shingling334 using it today. IamNotU (talk) 20:07, 16 December 2019 (UTC)

116.84.110.175

A user has requested a proxy check. A proxy checker will shortly look into the case.

116.84.110.175 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

I'm pretty sure this is a proxy. I don't have the tools to know if it's an open proxy. I'm almost certain that the user is sock puppet. - MrX 🖋 14:03, 20 December 2019 (UTC)

Based on my search, this IP is linked to Incheon International Airport, possibly a public Wifi there. Doesn't seem to be an open proxy. --MrClog (talk) 14:49, 13 March 2020 (UTC)

8.8.8.8

– This proxy check request is closed and may now be archived.

8.8.8.8 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

8.8.4.4 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: These IPs are Google Public DNS servers. Similar DNS servers such as 1.1.1.1 and 1.0.0.1 provided by Cloudflare through its service are also blocked (and globally locked). If applicable, the person doing the proxy check should do a range block. —BeyWHEELZ • T • C 16:27, 11 February 2020 (UTC)

 Declined to run a check They are blocked for colocation purposes, not because they are proxies. DNS != proxy. -- Amanda (aka DQ) 03:19, 15 February 2020 (UTC)

8.36.116.204/24

A user has requested a proxy check. A proxy checker will shortly look into the case.

8.36.116.204 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: The 8.36.116.0/24 IP range is registered to collocation webhost. The 8.36.116.204 IP has been used to make edits to Richard Grenell (edit | talk | history | links | watch | logs) that are similar to those made by sock puppets of Mmoates (talk · contribs). See SPI casepage.  — BillHPike (talk, contribs) 18:52, 25 February 2020 (UTC)

196.201.201.236

– This proxy check request is closed and may now be archived.

196.201.201.236 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

Reason: Suspicious edits (see WP:COIN), blacklisted at barracudacentral.org - Bri.public (talk) 19:04, 25 February 2020 (UTC)

I couldn't find any evidence that this is an open proxy. Pinging Zzuuzz to confirm. --MrClog (talk) 14:30, 13 March 2020 (UTC)

I'd agree with that. There is some evidence a trojan-infected computer might have been on the IP at some point, which might explain the blacklisting, but that appears to have been many years ago and we can't really draw any conclusions from that. The edit by this IP was also some time ago. If the article is to be believed, the geolocation is probably not too outrageous either. At least at this point in time, I don't see us doing anything about it. -- zzuuzz ^(talk) 15:36, 13 March 2020 (UTC)

115.178.251.127

A user has requested a proxy check. A proxy checker will shortly look into the case.

115.178.251.127 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - ipcheck - Google - HTTP - stalk

This IP address is connected to an ACC request and currently affected by 115.178.224.0/19 rangeblock. I am not sure about the whole range however this very IP seems to belong to a legit Indonesian ISP and I see no reason to assume that it is an open proxy right now. Please check it out. -- Kostas20142 (talk) 01:18, 18 March 2020 (UTC)

@Kostas20142: I couldn't find evidence that it is currently an open proxy. Pinging ST47 (ping!) to confirm, as (s)he blocked the account. MrClog (talk) 09:46, 18 March 2020 (UTC)

See also

Subpages

• Blacklist of open or zombie proxies
• Information for blocked users
• List of users who can verify proxies
• Preventing access to Wikipedia from your Tor node

Related pages

• Policy on open proxies
• Open proxy detection
• Guide to checking open proxies
• Proxy check result templates
• Advice to users using Tor to bypass the Great Firewall
• meta:XFF project
• Tor exit checker

Chapters

• Meta-Project
• Wikisource
• Wikiversity
• Wiktionary