Wikipedia:Open proxies noticeboard
The Open proxies noticeboard seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.
- If you've been blocked as an open proxy, please see: Help:blocked.
- To report a proxy check or an incorrect block, see the #Reporting section.
Reporting
[edit]Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.
| Before reporting any suspected open proxies here, please remember that not all vandals are open proxies and vandals should not get an automatic check here; remember that it takes the volunteers here about 5-10 minutes to give a request a thorough check. |
| File a new report here | ||
| I. | For block requests:
Verify that the following criterion has been met:
For unblock requests:
Verify that the following criteria has been met:
| |
| II. | For block requests
Replace "IP" below with the IP address you are reporting. For unblock requests
Replace "IP" below with the IP address you are reporting. | |
| III. | Fill out the resulting page and fill-in the requested information. | |
| IV. | Save the page. | |
Verified Users/Sysops Templates
|
|---|
|
Requests
[edit]
4.59.86.250
[edit]
– This proxy check request is closed and will soon be archived by a bot.
- 4.59.86.250 · talk · contribs · block · block log · active blocks · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
This is suspected to be a VPN/open proxy, because it resolves to Level 3 Parent. Hostname STERLING-JE.ear1.Miami1.Level3.net SixaxisYes 23:45, 26 March 2026 (UTC)
Not currently an open proxy. Level 3 Parent is a Tier 1 ISP at the top of the ISP hierarchy. The hostname is a reverse DNS record for a specific network interface on a Level 3 router in Miami. This is a static IP address, perhaps for a business. I don’t see any of the usual VPN/proxy fingerprints. --Malcolmxl5 (talk) 21:41, 29 March 2026 (UTC)
207.109.54.133
[edit]
– This proxy check request is closed and will soon be archived by a bot.
- 207.109.54.133 · talk · contribs · block · block log · active blocks · stalk · Robtex · whois · Google · ipcheck · HTTP · geo · rangeblocks · spur · shodan
Reason: CenturyLink IP, IP info says IPIDEA proxy. Spur says 37 users SixaxisYes 16:43, 27 March 2026 (UTC)
No action. A likely proxy node. Spur says there is a proxy on this IP address but also not all traffic belongs to the proxy network. The single, recent edit suggest that it was made by a real user and was not proxy/bot activity. These types of proxies are typically short-lived and might be blocked for 24-48 hours but there is not a need here. --Malcolmxl5 (talk) 02:10, 28 March 2026 (UTC)
38.88.124.0/24
[edit]
– This proxy check request is closed and will soon be archived by a bot.
- 38.88.124.0/24 · contribs · block · block log · active blocks · stalk · Robtex · whois · Google
Reason: Hosting range (AS394256, Tech Futures) used by AirVPN. Xacaranda (talk) 18:42, 14 April 2026 (UTC)
Completed Blocked the /23 as colocation/webhost. --Malcolmxl5 (talk) 14:00, 20 April 2026 (UTC)
2A10:484:0:0:0:0:0:0/32
[edit]
– This proxy check request is closed and will soon be archived by a bot.
- 2A10:484:0:0:0:0:0:0/32 · contribs · block · block log · active blocks · stalk · Robtex · whois · Google
Reason: xTom range with Proton VPN hits. Note that range might be too wide. kline / talk / contribs 02:51, 17 April 2026 (UTC)
- It is a huge range. There’s two /64 being used, both are flagging as Proton VPNs so we can at least take care of those. A /63 block will do the job here, so blocked. Looking at the rest of the range. — Malcolmxl5 (talk) 19:46, 20 April 2026 (UTC)
Completed. xTom is a hosting provider offering services such as dedicated servers, VPS hosting and colocation to downstream providers one of which is Proton. It is very unlikely to carry any legitimate residential traffic. Blocking the entire /32 as a colocation/website. --Malcolmxl5 (talk) 21:19, 20 April 2026 (UTC)
176.208.32.0/23
[edit]
A user has requested a proxy check. A proxy checker will shortly look into the case.
- 176.208.32.0/23 · contribs · block · block log · active blocks · stalk · Robtex · whois · Google
Reason: Open proxy used by LTA Aydoh8[what have I done now?] 11:40, 30 April 2026 (UTC)
Automated lists and tools
[edit]- User:AntiCompositeBot/ASNBlock maintained by User:AntiCompositeBot is a list of hosting provider ranges that need assessment for blocks that is updated daily. Admins are encouraged to review the list and assess for blocks as needed. All administrators are individually responsible for any blocks they make based on that list.
- ISP Rangefinder is a tool that allows administrators to easily identify and hard block all ranges for an entire ISP. It should be used with extreme caution, but is useful for blocking known open proxy providers. All administrators are individually responsible for any blocks they make based on the results from this tool.
- IPCheck is a tool that can help provide clues about potential open proxies.
- Bullseye provides information about IPS, including clues about potential open proxies.
- whois-referral is a generic WHOIS tool.
- Range block finder finds present and past range blocks.
See also
[edit]- Subpages
- Related pages
- Policy on open proxies
Open proxy detection- Guide to checking open proxies
- Proxy check result templates
- Advice to users using Tor to bypass the Great Firewall
- meta:XFF project
- Sister projects (defunct)
| This is a WikiProject, an open group of Wikipedia editors. New participants are welcome; feel free to talk to us!
|