The WikiProject on open proxies seeks to identify, verify and block
open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by
verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.
If you've been blocked as an open proxy, please see:
Help:blocked.
To report a proxy check or an incorrect block, see the
#Reporting section.
Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.
Before reporting any suspected open proxies here, please remember that not all vandals are open proxies and vandals should not get an automatic check here; remember that it takes the volunteers here about 5-10 minutes to give a request a thorough check.
File a new report here
I.
For block requests:
Verify that the following criterion has been met:
The IP has made abusive contributions within the past week
For unblock requests:
Verify that the following criteria has been met:
No current criteria
II.
For block requests
Replace "IP" below with the IP address you are reporting.
For unblock requests
Replace "IP" below with the IP address you are reporting.
III.
Fill out the resulting page and fill-in the requested information.
IV.
Save the page.
Verified Users/Sysops Templates
IP is an open proxy{{
Proxycheck|confirmed}} for confirmed open proxies and Tor exit nodes.
LikelyIP is an open proxy{{
Proxycheck|likely}} for likely open proxies and Tor exit nodes.
PossibleIP is an open proxy{{
Proxycheck|possible}} for possible open proxies and Tor exit nodes.
UnlikelyIP is an open proxy{{
Proxycheck|unlikely}} for unlikely open proxies and Tor exit nodes.
Not currently an open proxy{{
Proxycheck|unrelated}} for IP's confirmed not to be an open proxy or Tor exit node.
Inconclusive{{
Proxycheck|inconclusive}} for IP's that are inconclusive.
Declinedto run a check{{
Proxycheck|decline}} to decline a check.
Open proxy blocked{{
Proxycheck|blocked}} for open proxies and Tor nodes that have been blocked. Please add this if you block the IP.
This page has an administrative backlog that requires the attention of willing administrators. Please replace this notice with {{
no admin backlog}} when the backlog is cleared.
Reason: Amazon AWB. 165.85.64.0 - 165.85.66.255 are all registered to Amazon AWB, hence the /22 range in this report. BLP disruption caught by
filter log.
73.67.145.30 (
talk) 16:45, 28 April 2023 (UTC)reply
I've checked the three /24s separately here (165.85.64.0/24·contribs·block·log·stalk·Robtex·whois·Google - 165.85.65.0/24·contribs·block·log·stalk·Robtex·whois·Google - 165.85.66.0/24·contribs·block·log·stalk·Robtex·whois·Google). While the ISP is Amazon, all three ranges are currently allocated to
Palo Alto Networks. The first range, 165.85.64.0/24, appears to be used for part of their
GlobalProtect VPN service per Spur's data. This seems similar to the
McAfee WGCS and
Zscaler ranges currently reported on this page, and any hardblock on these ranges would have some collateral on legitimate users. A softblock/{{
Colocationwebhost-soft}} might be appropriate here. The other two ranges in the /22 seem to be in the same data centre, and don't seem to be part of the same service, but the filter log linked above is from an IP on the third /24 so it clearly has some use somewhere. Not sure what to recommend here, and I've not been able to easily search to see if any other IPs in the range have triggered any filters, though none have any recorded contributions.
Sideswipe9th (
talk) 18:17, 17 July 2023 (UTC)reply
209.35.227.0/24
– A proxy checker has requested a second opinion on this case.
Confirmed While the range is announced by Perimeter 81, and a large portion of it seems to be empty per Spur and Shodan, there are IP ranges within that are active on Perimeter 81's VPN product. However that product is aimed at businesses, with
pricing to match. This seems similar to the Zscaler, McAfee WGCS cases that are also open at present. A softblock on the range might be appropriate however, the one contributor who was
active on 15 May 2023 was using an IP that's part of their VPN range. While I've tried to pin down the exact range for just the IPs that are part of their VPN offering, it seems somewhat spread out throughout it with gaps, so it might be more expedient to just block it in its entirety. Flagging this for a 2O though, while we figure out how to handle this particular type of VPN provider.
Sideswipe9th (
talk) 00:22, 19 July 2023 (UTC)reply
157.167.128.0/24
A user has requested a proxy check. A proxy checker will shortly look into the case.
Reason: Cloud server/VPN. This is an odd one, because the IP range geolocates to Turkey, and is listed as a VPN network; but most of the edits are to Turkish-related articles. Is this some sort of corporate cloud network?
2601:1C0:4401:F60:8C11:4CC3:7E71:B4CE (
talk) 20:54, 13 August 2023 (UTC)reply
My reading is that this is a user or users in Turkey editing via a connection belonging to an enterprise, perhaps a business or a public body, that subscribes to cybersecurity services offered by Forcepoint. It looks to me like a corporate proxy. The contributions suggest a stable connection with largely unproblematic edits and I would not be inclined to take any action at this time.
Malcolmxl5 (
talk) 02:05, 20 January 2024 (UTC)reply
202.134.9.141
A user has requested a proxy check. A proxy checker will shortly look into the case.
Reason: Same proxy sock that got blocked earlier for both ban evasion and editing with proxy.
[1] He is still socking to restore the same article.
[2][3]Ratnahastin (
talk) 15:22, 8 March 2024 (UTC)reply
There’s a lot of blocks in the history, the most recent is a 3 month /12 block in September for block evasion.
Malcolmxl5 (
talk) 11:06, 13 March 2024 (UTC)reply
192.189.187.125
A user has requested a proxy check. A proxy checker will shortly look into the case.
Reason:Listed ISP is FedEx which is not a legitimate provider, in addition these various FedEx proxy ranges are used by a LTA and extensive sock puppeteer
HaughtonBrit to block evade and push tendentious edits in various South Asian topics.
Southasianhistorian8 (
talk) 21:13, 3 April 2024 (UTC)reply
104.151.103.93
A user has requested a proxy check. A proxy checker will shortly look into the case.
Reason: Requested unblock. This IP address is the public facing IP address of the Wikimedia Deutschland (WMDE) office. The IP address belongs to an IP range of 1&1 Versatel, our internet provider, who statically assigned this address to our fiber optics uplink. We often have events where we introduce future volunteers into editing Wikipedia or their sister projects. Among our colleagues are also many volunteers who get affected by this block.
Masin Al-Dujaili (WMDE) (
talk) 10:10, 11 April 2024 (UTC)reply
There's certainly something fishy going on in other parts of the range. Courtesy ping for
NinjaRobotPirate. Maybe split the range in half, i.e. block the lower /18? --
zzuuzz(talk) 12:21, 11 April 2024 (UTC)reply
Sure, sounds fine. I don't remember the exact details of this block any more, but I usually block 1&1 on sight. From
Ionos, it looks like they're branching out of just web hosting now, though.
NinjaRobotPirate (
talk) 16:27, 11 April 2024 (UTC)reply
Automated lists and tools Information
User:AntiCompositeBot/ASNBlock maintained by
User:AntiCompositeBot is a list of hosting provider ranges that need assessment for blocks that is updated daily. Admins are encouraged to review the list and assess for blocks as needed. All administrators are individually responsible for any blocks they make based on that list.
ISP Rangefinder is a tool that allows administrators to easily identify and hard block all ranges for an entire ISP. It should be used with extreme caution, but is useful for blocking known open proxy providers. All administrators are individually responsible for any blocks they make based on the results from this tool.
IPCheck is a tool that can help provide clues about potential open proxies.
Bullseye provides information about IPS, including clues about potential open proxies.