Wikipedia:WikiProject on open proxies

←Administration index

MetaProject on open proxies (en-Wikipedia chapter)

If you've been blocked as an open proxy, please see: Help:blocked. The multiwiki MetaProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.

Open proxies may be blocked from editing

Reporting

Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.

File a new report here
I.	For block requests:
	Verify that the following criteria has been met: The IP has made abusive contributions within the past week
	For unblock requests:
	Verify that the following criteria has been met: No current criteria
II.	For block requests	For unblock requests
	Replace "IP" below with the IP address you are reporting.	Replace "IP" below with the IP address you are reporting.
III.	Fill out the resulting page and fill-in the requested information.
IV.	Save the page.

Verified Users/Sysops Templates

IP is an open proxy {{Proxycheck|confirmed}} for confirmed open proxies and TOR exit nodes.  Likely IP is an open proxy {{Proxycheck|likely}} for likely open proxies and TOR exit nodes.  Possible IP is an open proxy {{Proxycheck|possible}} for possible open proxies and TOR exit nodes.  Unlikely IP is an open proxy {{Proxycheck|unlikely}} for unlikely open proxies and TOR exit nodes. Not currently an open proxy {{Proxycheck|unrelated}} for IP's confirmed not to be an open proxy or TOR exit node. Inconclusive {{Proxycheck|inconclusive}} for IP's that are inconclusive.  Declined to run a check {{Proxycheck|decline}} to decline a check. Open proxy blocked {{Proxycheck|blocked}} for open proxies and TOR nodes that have been blocked. Please add this if you block the IP.

Requests

66.160.199.60

– This proxy check request is closed and may now be archived.

66.160.199.60 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Hurricane Electric open proxy. 176.103.48.38 (talk) 16:18, 9 November 2017 (UTC)

(Non-administrator comment)  Done Open proxy blocked Already rangeblocked. 61.245.229.113 (talk) 05:03, 19 November 2017 (UTC)

104.129.196.206

– This proxy check request is closed and may now be archived.

104.129.196.206 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits. Zscaler open proxy. 122.197.215.184 (talk) 17:59, 10 November 2017 (UTC)

Not currently an open proxy It's a closed proxy, not open for anyone from what I can tell. Callanecc (talk • contribs • logs) 10:28, 19 November 2017 (UTC)

52.173.74.241

– This proxy check request is closed and may now be archived.

52.173.74.241 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious (promotional) edits; socking; has been identified as Microsoft Azure host. ☆ Bri (talk) 18:02, 10 November 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:25, 19 November 2017 (UTC)

185.104.185.239

– This proxy check request is closed and may now be archived.

185.104.185.239 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

185.104.185.50 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

78.129.130.230 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

45.41.135.130 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: sockpuppetry, IPs in France, England, and Japan, being used by a banned user located in the United States who has used open proxies for abuse in the past. (NOTE: I combined a few open reports) Ivanvector (^Talk/_Edits) 15:35, 18 November 2017 (UTC)

All blocked. GAB^gab 15:52, 18 November 2017 (UTC)

95.153.132.82

– This proxy check request is closed and may now be archived.

95.153.132.82 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits — Preceding unsigned comment added by 95.153.132.82 (talk • contribs) 01:28, 17 November 2017 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 10:26, 19 November 2017 (UTC)

92.53.105.52

– This proxy check request is closed and may now be archived.

92.53.105.52 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: edit war-ish edit summaries. Host name is vds-holanet.timeweb.ru and ISP is TimeWeb Ltd., a Russian web hosting company. -★- PlyrStar93. _{→Message me. ←} 03:07, 19 November 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:27, 19 November 2017 (UTC)

2a02:c207::/32

– This proxy check request is closed and may now be archived.

2a02:c207::/32 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits. Recently blocked as a webhost on meta.wiki, and was once blocked on en.wiki too. This /32 IPv6 range still appears to be a webhosting service. 219.98.8.174 (talk) 22:40, 19 November 2017 (UTC)

Open proxy blocked Callanecc (talk • contribs • logs) 10:43, 20 November 2017 (UTC)

2A03:EFC0:900:0:0:0:0:252

– This proxy check request is closed and may now be archived.

2A03:EFC0:900:0:0:0:0:252 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Fanciful hoaxing & BLP violations in the style of Jaredgk2008.—Odysseus1479 05:34, 21 November 2017 (UTC)

Open proxy blocked, /40 range. -- zzuuzz ^(talk) 07:18, 21 November 2017 (UTC)

198.27.128.0/17 incorrectly identified as colocationwebhost

– This proxy check request is closed and may now be archived.

198.27.128.0/17 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

I work for the ISP which owns this netblock and can confirm that this is a range of DHCP addresses handed out to residential customers and has no connection to our colocation facilities. Refer to this discussion if you want to know why I posted this request here. Reason: Incorrectly blocked as colocationwebhost. Opsftw (talk) 18:38, 27 November 2017 (UTC)

@Opsftw: I'm changing the block reason to something more generic, but I will leave the block on unregistered users for the time being, as there has been some vandalism from the range. Users who log in will be able to edit, and no user will be presented with a message about colos. I will also drop a note to Ks0stm with regards to removing the block entirely. -- zzuuzz ^(talk) 19:09, 27 November 2017 (UTC)

@Zzuuzz: Thanks for your attention to this issue and for making the change you made. I still don't understand why the anonblock is wanted - looking at the relevant user page when I use "Hide probably good edits" there are no "probably bad" edits shown. I'm guessing you are using a different tool to spot vandalism from that range. Further, is it policy to anonblock an entire /17 of residential internet customers because somebody in that range was committing vandalism? Remember, we are talking about roughly thirty two thousand households (or approximately 75,000 human beings) being anonblocked because somebody within that range has acted inappropriately. That seems a bit extreme IMHO. Opsftw (talk) 19:30, 27 November 2017 (UTC)

@Opsftw: Unfortunately I have special access to the relevant tools. We have had problems with a long term vandal creating accounts from throughout this range throughout this year. They have been active in just the last few hours (though probably from other ranges). One or two occurrences may possibly have been explained by compromised hosts, but there does seem to be a theme. -- zzuuzz ^(talk) 19:54, 27 November 2017 (UTC)

@Zzuuzz: Would you be willing to share some examples of vandalism edits from the user in this range that you're concerned about? Again, still trying to understand how one person's inappropriate conduct should justify an anonblock of this magnitude (75,000 or so human beings are impacted).Opsftw (talk) 20:47, 27 November 2017 (UTC)

@Opsftw: I'm going to have to decline due to the Privacy policy and the nature of the vandalism. Don't get me wrong I don't take /17 blocks lightly, and they're usually reserved for severe disruption. Whether or not it's justified is something I'm currently pondering, but also bear in mind this isn't technically my block. -- zzuuzz ^(talk) 22:06, 27 November 2017 (UTC)

@Zzuuzz: Understood perfectly re: privacy. My role here is to advocate on behalf of our users, the vast majority of whom are not abusing our service to cause disruption to Wikipedia.

I'm leaving the block in place at this time. I've left further advice at User talk:Ks0stm. -- zzuuzz ^(talk) 07:12, 28 November 2017 (UTC)

98.239.113.209

– This proxy check request is closed and may now be archived.

98.239.113.209 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: WP:DUCK test matches Wikipedia:Long-term abuse/109.151.65.218, behavior matches that one almost spot on. However, this IP's WHOIS data indicates a US-based IP address, while all of the others indicate UK-based IP addresses. Asking for a proxy check to see if they are using an open proxy to mask their location. IP is already blocked a short time based on behavioral evidence. --Jayron32 20:07, 27 November 2017 (UTC)

Already blocked, but not an open proxy. Callanecc (talk • contribs • logs) 03:41, 2 December 2017 (UTC)

103.23.29.253

– This proxy check request is closed and may now be archived.

103.23.29.253 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits. I'm not sure how to check which port the IP is open on, but whatismyipaddress.com labels it as a "confirmed proxy server".

Looks like this is a closed proxy. Callanecc (talk • contribs • logs) 03:42, 2 December 2017 (UTC)

190.226.154.234

– This proxy check request is closed and may now be archived.

190.226.154.234 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits, listed as problem host by Barracuda. ☆ Bri (talk) 18:38, 28 November 2017 (UTC)

@Bri: Based on behavioral evidence, it seems more probable than not that this is not a proxy. GAB^gab 16:57, 30 November 2017 (UTC)

Agreed, Not currently an open proxy Callanecc (talk • contribs • logs) 03:42, 2 December 2017 (UTC)

173.9.233.41

– This proxy check request is closed and may now be archived.

173.9.233.41 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: All edits are vandalism/unconstructive. Also some other edits in other wikis: frwiki/simplewiki are the same type of vandalism. Proxy checker shows as VPN/proxy. Based on behavior, this is the Pikepass vandal at frwiki, who is known to abuse proxies (e.g. previous blocked IP 96.92.203.45 now globally blocked 1 year as open proxy). -★- PlyrStar93. _{→Message me. ←} 04:11, 29 November 2017 (UTC)

Already blocked, and I'm not sure it is an open proxy. Callanecc (talk • contribs • logs) 03:44, 2 December 2017 (UTC)

192.240.127.78

– This proxy check request is closed and may now be archived.

192.240.127.78 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits. Dedicated server proxy IP. May need to be rangeblocked as {{webhostblock}}. 116.123.126.79 (talk) 10:05, 29 November 2017 (UTC)

Range blocked by Zzuuzz. GAB^gab 16:56, 30 November 2017 (UTC)

147.91.1.43

– This proxy check request is closed and may now be archived.

147.91.1.43 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits. IP address is back to being a proxy once again per whatismyipaddress.com (refer to block log). 203.128.191.50 (talk) 18:04, 29 November 2017 (UTC)

Doesn't appear to be an open proxy. Warn and report to WP:AIV as normal for a 'school'. Callanecc (talk • contribs • logs) 03:48, 2 December 2017 (UTC)

2001:42C8:0:301:41:206:188:206

– This proxy check request is closed and may now be archived.

2001:42C8:0:301:41:206:188:206 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits. User has admitted that this IP address is a Tor exit node. 60.36.225.155 (talk) 13:10, 30 November 2017 (UTC)

 IP blocked. GAB^gab 16:54, 30 November 2017 (UTC)

46.166.176.0/21 (46.166.176.169)

– This proxy check request is closed and may now be archived.

46.166.176.169 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits. Hostname is: "hosted-by.seedvps.com" which is registered to this VPN hosting service. According to the WHOIS links, 46.166.176.0/21 (XTools ·block range · block log (global) · WHOIS (partial)) would be the correct range to block if a {{webhostblock}} would be performed. 76.109.126.61 (talk) 05:59, 4 December 2017 (UTC)

• Blocked. Callanecc (talk • contribs • logs) 10:55, 4 December 2017 (UTC)

77.234.46.177

– This proxy check request is closed and may now be archived.

77.234.46.177 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits, address query reports Webhosting cloud service Avast "Network sharing device or proxy server", poss proxy thing ☆ Bri (talk) 04:48, 5 December 2017 (UTC)

Note: 77.234.40.0/24 (XTools ·block range · block log (global) · WHOIS (partial)) is currently blocked as a webhost, which is in the same ISP as 77.234.46.177. 118.153.81.72 (talk) 05:21, 5 December 2017 (UTC)

• Blocked. Callanecc (talk • contribs • logs) 07:11, 5 December 2017 (UTC)

130.180.122.138

– This proxy check request is closed and may now be archived.

130.180.122.138 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Requested unblock.

See User talk:130.180.122.138 Ronhjones  ^(Talk) 00:18, 9 December 2017 (UTC)

Not currently an open proxy Callanecc (talk • contribs • logs) 07:12, 18 December 2017 (UTC)

108.171.159.47

– This proxy check request is closed and may now be archived.

108.171.159.47 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Recently used by sockpuppeteer; whatismyaddress.com says it's a proxy server. Trivialist (talk) 21:10, 17 December 2017 (UTC)

Range blocked by NinjaRobotPirate. GAB^gab 01:21, 18 December 2017 (UTC)

208.87.237.201

A user has requested a proxy check. A proxy checker will shortly look into the case.

208.87.237.201 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits. confirmed proxy server and webhosting service. 180.47.118.156 (talk) 18:58, 18 December 2017 (UTC)

62.255.118.6

– This proxy check request is closed and may now be archived.

62.255.118.6 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits

See a complaint of disruptive editing at WP:Administrators' noticeboard#Editor being bullied. User:Berean Hunter tried checking the IP at one of the IP lookup sites, and that site reports it to be an open proxy. I am unsure whether to trust this verdict. EdJohnston (talk) 00:34, 21 December 2017 (UTC)

(non-admin closure) Blocked for 1 year by Yamla. 213.231.118.93 (talk) 17:48, 21 December 2017 (UTC)

110.77.181.148

– This proxy check request is closed and may now be archived.

110.77.181.148 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: See discussion, the final section at WP:ANI. In short, someone created a couple of attack accounts, and when they were blocked, this IP continued the disruption. According to checkuser NinjaRobotPirate, the accounts are using proxies, so I suppose it's likely that this one also might be. It was previously blocked by Procseebot, but that block expired without being renewed, so I'm not clear if that means that the bot hadn't gotten around to reblocking it yet or if it means that it's not a proxy anymore. I gave it a short block for the disruption, but please lengthen the block if it's a proxy. Nyttend (talk) 14:05, 23 December 2017 (UTC)

Proxy blocked. GAB^gab 17:06, 23 December 2017 (UTC)

121.225.25.197

– This proxy check request is closed and may now be archived.

121.225.25.197 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

A few minutes after I made the block referenced in the previous section, I got this friendly notice from an IP with no previous edits. This is the first logged action I've made in several days, aside from unprotecting a page (can't imagine anyone objecting to that in such a manner), so I strongly suspect that it's related. Seeing that 110.77.181.148 is Thai, and this one's Chinese, I strongly suspect that they're both open proxies. Nyttend (talk) 14:24, 23 December 2017 (UTC)

Proxy blocked. GAB^gab 17:07, 23 December 2017 (UTC)

203.81.71.25

– This proxy check request is closed and may now be archived.

203.81.71.25 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits. IP has been blocked twice in the past as an open proxy. 14.190.44.204 (talk) 17:47, 28 December 2017 (UTC)

Proxy blocked. GAB^gab 19:19, 28 December 2017 (UTC)

61.204.102.120

A user has requested a proxy check. A proxy checker will shortly look into the case.

61.204.102.120 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits

61.204.102.117

A user has requested a proxy check. A proxy checker will shortly look into the case.

61.204.102.117 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits

210.230.140.88

A user has requested a proxy check. A proxy checker will shortly look into the case.

210.230.140.88 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits

210.230.140.125

A user has requested a proxy check. A proxy checker will shortly look into the case.

210.230.140.125 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits

210.230.140.234

A user has requested a proxy check. A proxy checker will shortly look into the case.

210.230.140.234 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits

210.251.24.7

A user has requested a proxy check. A proxy checker will shortly look into the case.

210.251.24.7 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits

61.204.102.196

A user has requested a proxy check. A proxy checker will shortly look into the case.

61.204.102.196 - talk - edits - block - log - current blocks - ipinfo - Robtex - WHOIS - proxy checker - Google - HTTP

Reason: Suspicious edits

See also

Subpages

• Blacklist of open or zombie proxies
• Information for blocked users
• List of users who can verify proxies
• Preventing access to Wikipedia from your Tor node

Related pages

• Policy on open proxies
• Open proxy detection
• Guide to checking open proxies
• Proxy check result templates
• Advice to users using Tor to bypass the Great Firewall
• meta:XFF project
• Tor exit checker

Chapters

• Meta-Project
• Wikisource
• Wikiversity
• Wiktionary