Wikipedia talk:WikiProject on open proxies/Archiv-Index 1

message: Since "no open proxies" has never been formally stated as Wikipedia policy; I've started a new page in the Wikipedia namespace to document this:
Wikipedia:No Open Proxies
--EngineerScotty 21:32, 20 January 2006 (UTC)
thread_title:  [[Wikipedia:No Open Proxies]] 

message: I wrote the following user script to help check IPs for potential open proxies.  Comments?

addOnloadHook(function () {
    var title;
    if (!(title = document.getElementById('t-contributions') )) return;
    if (!(title = title.getElementsByTagName('a')[0] )) return;
    if (!(title = title.href )) return;
    title = title.replace(/^.*\/wiki\/Special:Contributions\//, "");   
    if (!title.match(/^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/)) return;
    addLink('p-tb', 'http://rbls.org/?q='+title, 'RBL check', 't-rblcheck', 'Multi-RBL check');
});

Note that the script needs the addLink helper function to work.  —Ilmari Karonen (talk) 21:48, 11 February 2006 (UTC)
replies: text: Latest version available at Wikipedia:WikiProject User scripts/Scripts/RBL check (or User:Ilmari Karonen/rblcheck.js).  —Ilmari Karonen (talk) 14:13, 4 May 2006 (UTC)
thread_title:  RBL check script 

message: Someone on Wikipedia:Articles_for_deletion/Verbungula seems to be using a proxy in order to stack votes there, and to avoid 3RR elsewhere... but I'm not sure if it's an open proxy or if he's using lynx through the shell on his web hosting account.  I'm behind a firewall at my college right now and can't run proxy scanners and such, so I can't check if it's a 'public' proxy or not.  Could someone please check it for me?  It's 66.101.59.248, which hosts Young Zaphod's web site .  Since there's a chance that it's not an open proxy, and is limited to their hosting customers, what would be the appropriate action for that kind of thing (when they're not "open")?  Atari2600tim (talk • contribs) 19:17, 17 February 2006 (UTC)
replies: text: The IP doesn't seem to be an open proxy. No administrative action can be taken in that respect. // Pathoschild (admin / talk) 20:30, 17 February 2006 (UTC)
replies: text:  I figured.  I guess I'll have to point out that it's a paid private proxy every time that it participates in votes and such.  Oh well, thanks anyway.  --Atari2600tim (talk • contribs) 22:20, 17 February 2006 (UTC)
thread_title:  Suggestions for appropriate place to report non-public proxies 

message: More approporate place? --Cool CatTalk|@ 15:38, 9 March 2006 (UTC)
replies: text: The WikiProject is already on Meta. Note that the first link under Chapters is to the Wikimedia Meta-Wiki. This is the local chapter, where Wikipedians can report open proxies and where open proxies which haven't been blocked on this project can be listed. // Pathoschild (admin / talk) 19:38, 9 March 2006 (UTC)
thread_title: Move to meta?

message: Is this the correct place to ask for access? The project page doesn't make it clear whether to ask here or on Tawker's talk page. At the moment I'm running suspected proxies through my own perl script to test them, but an extra tool wouldn't hurt. --GraemeL (talk) 16:55, 25 March 2006 (UTC)
replies: text: In the future leave me a note on my talk page or go ask Pathoschild, (I trust he'll give the credentials to trusted users) -- Tawker 06:57, 15 May 2006 (UTC)
thread_title:  Access to the check tool 

message: So when someone in this project finds an open proxy, you block it here on Wikipedia, and maybe you list it on Meta, and maybe eventually it gets blocked on some other Wikimedia projects.  Obviously a much better method would be if Wikimedia could just block the open proxy from editing everywhere, all at once.  Is anyone working on such a solution?  It would save a lot of effort, and it would protect the smaller wikis from a lot of vandalism.  User:dbenbenn 23:42, 19 April 2006 (UTC)
replies: text: It's been proposed before. Feel free to submit the code to do so. :) // [admin] Pathoschild (talk/map) 23:50, 19 April 2006 (UTC)
thread_title:  Technical solution to block open proxies from all wikis at 

message: Down til I finish upgrades, probably a few hours. ShaunES 10:18, 16 July 2006 (UTC)
replies: text: Sigh, best laid plans... Down til... I dunno, maybe later tonight, maybe tommorow night. ShaunES 12:30, 16 July 2006 (UTC)
replies: text:  Hardware kersploded :( ShaunES 12:56, 19 July 2006 (UTC)
thread_title:  VCN Proxychecker down 

message: Here's osme idea. How about we get rid of the sectioning commands and start using the in-places comments on the main table, as t's being done now? It makes things easier to work with (no more moving around text snippets, just add the note), and the current system makes almost impossible to find archived stuff. --  Drini 02:29, 15 August 2006 (UTC)
replies: text: The sections streamline the process of dealing with open proxies. Using a single list would make moving confirmed reports to the MetaProject quite difficult, for example. // [admin] Pathoschild (talk/map) 03:45, 23 August 2006 (UTC)
thread_title:  REorganizing 

message: Is :Wikipedia:WikiProject on open proxies/result-closed even used anymore when reviewing an IP? --Signed and Sealed, JJJJust (T C) 08:31, 23 August 2006 (UTC)
replies: text: Ideally, it should be used to notify users who've placed an alert on this page of the result. In practice, I think I'm the only user who ever bothered to do so. // [admin] Pathoschild (talk/map) 23:30, 24 August 2006 (UTC)
thread_title:  Unused template? 

message: How would I become a verified user? Do I just add myself to the list? See User talk:Tawker#WP:OP Prodego talk 15:07, 27 August 2006 (UTC)
replies: text: Essentially, a member administrator verifies that you seem reliable. You should have a working knowledge of open proxies, anonymity networks, range blocking, et cetera. We're very short on administrators on sister projects, so it'd be nice if you administrated elsewhere. All that said, the only real qualification is to be reliable enough that we can block hundreds of addresses on your word. I've added you to the list. // [admin] Pathoschild (talk/map) 02:09, 6 September 2006 (UTC)
replies: text: I assume I'm going to need similar verification if people are to take my bot's postings as valid. -- Omicronpersei8 (talk) 06:38, 6 September 2006 (UTC)
thread_title:  Verified user 

message: ...a WoW sockpuppet (From back before he claimed to quit) said he worked for them. I'm paranoid, as you've probably noticed. 68.39.174.238 00:37, 9 September 2006 (UTC)
thread_title:  Be careful of the "gcapmedia" unblock requests... 

message: I would like to propose that we rangeblock all known IP addresses used by Google Web Accelerator because it is in effect, an open proxy. There's been a noticeable increase of unblock requests over the last week coming from people who've been autoblocked for vandalism by accounts using the accelerator. I've started a page at Wikipedia:Advice to Google Web Accelerator users (WP:GWA) which I hope to add screenshots and instructions detailing how users can exclude wikipedia.org from their accelerator settings soon. Perhaps we can use a link to this webpage as the block message? --   Netsnipe  ►  07:28, 28 September 2006 (UTC)
thread_title:  Google Web Accelerator 

message: This page's backlog is not helped by the fact that it is bloody intimidating.  Where's the usability study!  brenneman {L} 05:52, 7 October 2006 (UTC)
thread_title:  Backlog 

message: Even these IPs will eventually be re-assigned elsewhere. Why not block for 3 years? —Centrx→talk • 19:02, 14 October 2006 (UTC)
thread_title:  Indefinite blocking 

message: Hello. The WikiProject Council has recently updated the Wikipedia:WikiProject Council/Directory.  This new directory includes a variety of categories and subcategories which will, with luck, potentially draw new members to the projects who are interested in those specific subjects. Please review the directory and make any changes to the entries for your project that you see fit. There is also a directory of portals, at User:B2T2/Portal, listing all the existing portals. Feel free to add any of them to the portals or comments section of your entries in the directory. The three columns regarding assessment, peer review, and collaboration are included in the directory for both the use of the projects themselves and for that of others. Having such departments will allow a project to more quickly and easily identify its most important articles and its articles in greatest need of improvement. If you have not already done so, please consider whether your project would benefit from having departments which deal in these matters. It is my hope that all the changes to the directory can be finished by the first of next month. Please feel free to make any changes you see fit to the entries for your project before then. If you should have any questions regarding this matter, please do not hesitate to contact me. Thank you.   B2T2 14:38, 26 October 2006 (UTC)
thread_title:  Project directory 

message: There's been a guy from Australia vandalizing and posting complaints, each time from a new IP.  Many of them show up on Multi-RBL's redlists, but some are not listed and pass the VCN proxychecker too.  He said at one point, By the way, unsecured wireless and default admin router passwords are great. .  I can tell he is from Australia as his original contribs, before he got blocked and started acting out, are from Internode in Adeliade, Aus.  What should I do with US and UK IPs he posts from that are not on any blacklists?  They must be some kind of unsecured connection somewhere. Thatcher131 03:53, 11 November 2006 (UTC)
replies: text: Based on his comment, these would be simple home networks to which he is gaining access. A possibility is to send a message to the ISP informing them that one of their customers has this insecure network, and they should contact the customer to have them correct the problem. An obvious solution—and the ISP is not necessarily going to respond or do anything about your report—would be to ban the IP for a month or two; they are open proxies but which are non-trivially accessible. Unfortunately, however, this would only work for insecure wireless networks; presuming the vandal is intelligent, because he has admin access to the router, he can simply reset the connection to obtain a new IP address from the ISP, so a ban here would only work for a couple days perhaps. I guess informing the ISP is the only permanent solution, we can do this with a form letter sent to the e-mail address listed in whois, specifying the date&time and IP. —Centrx→talk • 04:31, 11 November 2006 (UTC)
replies: text: Do you have a form letter, and should I give you the IPs or should I do it myself? Thatcher131 05:01, 11 November 2006 (UTC)
replies: text: I looked at Wikipedia:Abuse reports, but Wikipedia:Abuse reports/Boilerplate messages is no good, though there must be others. It can be something as simple as:
----
Sir:
I am administrator on Wikipedia, a multilingual project to create a complete and accurate open-content encyclopedia. The English-language version may be viewed on the Web at http://en.wikipedia.org/.
It has come to our attention that a user of your network may be running an insecure wireless access point or a router with a manufacturer-default password, which has been used by a third party to submit bogus changes on a mass scale over a long period of time. 
As this is a security vulnerability under your network, coming from an otherwise anonymous IP, we ask that you please contact this customer and inform them how to properly secure their home network. The IP addresses and the dates and times on which it was used are as follows:
2005-06-18 14:37 (UTC): xxx.xxx.xxx.xxx
.
.
.
Yours sincerely,
Your real name
----
However, keep in mind this person may not be telling the truth. If it is the IPs in the temp page you created, these do not look like typical home computers. In fact, they all resolve to domain names of hosting providers or odd websites. Also,  is an open proxy of the typical kind; there may be others, I haven't checked them all yet. —Centrx→talk • 08:20, 11 November 2006 (UTC)

text: Then, this should still be reported to the others, but it would be a different letter. —Centrx→talk • 08:22, 11 November 2006 (UTC)
replies: text: Well, maybe it would be better in this case to just report it to his home ISP.  I'm pretty sure I know what that was, based on whre he was editing from before he got mad and started acting out.  This has got to be a TOS violation if not illegal.  Thatcher131 08:24, 11 November 2006 (UTC)
thread_title:  Unsecured routers 

message: Hi, could someone please look into the account being listed as an open proxy for DNS errors for the user name User:Snowolfd4 There are 3 cases pending, WP:PAIN, WP:AN/I and now under ArbComm. Kindly help as it is pending for quite some time. Thanks Sudharsansn (talk • contribs) 06:26, 23 November 2006 (UTC)
replies: text: I kindly request someone to look into it. Vandalism continues in WP:NCSLC page and also other member pages and it is strongly suspected that this could provide vital clues about who is behind this series of vandal attacks. Thanks Sudharsansn (talk • contribs) 12:58, 26 November 2006 (UTC)
thread_title: Need help

message: This doesn't quite fit the format here or at WP:RFCU, but... I notice that todays' contribs from  include a lot of backslashing, so he's probably using a proxy. Could someone find out the IP he's using and block it as an open proxy? FreplySpang 16:01, 23 November 2006 (UTC)
replies: text: I've reported this in the "Requests for IP check" section of WP:RFCU - thanks to user:pgk for sending me there. FreplySpang 16:16, 23 November 2006 (UTC)
replies: text:  I'm particularly amused that he's come back as 'Blancamant' to edit this page - with even more backslashes.... . FreplySpang 16:36, 23 November 2006 (UTC)
thread_title:  account using an open proxy? 

message: Please stop blocking IPs from the United Arab Emirates. The Regulatory Authority REQUIRES that internet connections go through the telecom providers proxy filter, so we have no legal choice in the matter. These IPs are assigned dynamically (and frequently change while connected) so if one user abuses an IP, by blocking it all that happens is that the next user on that IP is affected. Not the original spammer or abuser. I disconnected and reconnected several times to get through with an IP that is not blocked so I can edit this page. This admin appears to be particularly enthusiastic about blocking UAE based IPs with his/her name appearing several times when I attempted to edit pages...
"Your account or IP address has been blocked from editing.
You were blocked by Naconkantari for the following reason (see our blocking policy):
open proxy or zombie (see WikiProject on open proxies for information)
Your IP address is 195.229.241.182."
Thank you —The preceding unsigned comment was added by Localzuk (talk • contribs) 15:02, 10 December 2006 (UTC)
replies: text: Comment originally added by , moved from project page, by Localzuk. Aecis Dancing to electro-pop like a robot from 1984. 15:05, 10 December 2006 (UTC)
replies: text: FWIW, I think Saudi Arabia has a national firewall also. --A. B. (talk) 20:24, 13 December 2006 (UTC)
thread_title:  ISP Proxy in the UAE 

message: I am interested in becoming a verified user, and would like to know how you go about this, as it says you need to be added by a verified admin. Do I simply need to contact one of said admins, or is there another way? Thanks. ><RichardΩ612 ER 18:33, 11 December 2006 (UTC)
replies: text: P.S. I am able to check proxies efficiently by crossreferencing various tools, and am able to do so quickly. I have good knowledge of IT and open proxies, DNS, etc. ><RichardΩ612 ER 19:04, 11 December 2006 (UTC)
replies: text: I'm also leaning more about becoming a verified user and I imagine some other WikiProject Spam volunteers would be also.‎ For starters, do you have any material I could review? --A. B. (talk) 20:27, 13 December 2006 (UTC)
replies: text: Since I just added 82 103 new candidates to your backlog, I suppose I owe some sort of payback ... --A. B. (talk) 20:28, 13 December 2006 (UTC)
replies: text: Alternately, if you don't want to add me as a verified user, point me in the direction of how best to use the tools and I will try to "pre-digest" my reports to give you a higher rate of positives. --A. B. (talk) 16:24, 14 December 2006 (UTC)
replies: text: It is most likely that no admins have read this yet. DarthVader 22:12, 14 December 2006 (UTC)

text: If you understand the basics for open proxies or have a good set of service/port and port scanning then you may want to talk to a verified user on IRC or something. They can give you a green light. Preferably, you should let them add your name (though I added mine after talking to Tawker). Voice-of-All 19:36, 21 December 2006 (UTC)
thread_title:  Verified users 

message: See the talk page discussion at Talk:John Lott#Only 25 out of 94 open proxies hitting NPOV section were ever blocked indefinitely.
This represents many months worth of open proxy abuse of this page. The page was finally semi-protected again this week.
I am 99% confident that ≥95% of the IP addresses I've listed are open or anonymizing proxies. A look at the talk page's edit history and a few of the diffs for anon IPs editing the NPOV section will make this clear.
I'd start with these out of the 3 batches of IP addresses I recently added:
* 21 IP addresses flagged by Shadowbot; Completewhois excerpts at temporary user sandbox subpage
* 13 previously warned spam anon - Completewhois data warrants closer look - open proxies
* 69 open proxy suspects - John Lott talk page discussion
--A. B. (talk) 16:35, 14 December 2006 (UTC)
thread_title:  69 IP address added related to [[Talk:John Lott]] vandalism 

message: Shadowbot warns editors that add links to sites previously identified as spammy and then reverts their addition. Not every editor it flags is a bad faith spammer.
As part of WikiProject Spam, I listed the last 250 editors warned on a temporary user subpage (User:A. B./Sandbox3) and have been analyzing the data for trends.
146 of the editors used anonymous IP addresses. I ran them through Completewhois to come up with the 21 addresses I just added.
I am not a Completewhois wiz, so I listed excerpts from the reports on that subpage in this section. I suggested you check the Completewhois excerpts first to save yourself time; you may decide some aren't worth checking after looking at the excerpts.
Thanks for your valuable work: one abusive open proxy makes a lot of work to clean up until it's blocked. --A. B. (talk) 16:48, 14 December 2006 (UTC)
thread_title:  21 address added as a batch after flagging by [[User:Shadowbot|Shadowbot]] 

message: List of open web proxies. 24.50.211.226 05:07, 17 December 2006 (UTC)
thread_title:  Might be helpful... 

message: I've become interested in open proxies since noting that some of the more abusive spammers reported at WikiProject Spam use open proxies.
There are multiple lists of open proxy servers on the web -- I downloaded one the other day and have been working my way through the list I keep of repeat spammers and using Completewhois.
It's laborious and I'm happy to do it on an intermittent basis for a few minutes a day while I'm waiting on a boring conference call  or a coffee pot. It occurs to me, however, that there might be a way to automate all or much of the process. "All" might involve dumping a list into some sort of script that would run checks, evaluate them to some criteria, and post the confirmed guilty to a block list. "Much" might consist of "predigesting" a lot of the checking process to produce a list summarizing evidence for for the listed IP addresses into tables. A verified user might then be able to click a "proxy-block" link similar to the existing standard "block" link admins use but with the added functionality that it would trigger a bot to list the IP addresses as confirmed open proxies on the open proxy list and post notices on the talk/user pages.
If this could be done, verified users potentially could process hundreds or thousands of blocks a week or month. It wouldn't stop serious spammers, vandals and attackers from continuing to abuse Wikipedia using open proxies, but it up the ante and would slow them down. They'd spend more time hassling with getting an open proxy resulting in a little less time for writing diatribes, posting spam, etc.
This also would free up volunteers here to focus on less drudgery-oriented tasks and more on overall judgment and strategy issues. 
All this is just a thought. I'm not an admin, verified user or developer, just a guy that thinks the Wikipedia community has some really clever technical people who can probably figure out ways to do this without requiring a fundamental change to the Media-Wiki software. I know the use of the new spam IRC channel and the Shadowbot are increasing the productivity of the WikiProject Spam community, allowing them to look at more complex spam efforts. --A. B. (talk) 19:13, 17 December 2006 (UTC)
replies: text: I agree, it seems pretty silly to me that this hasn't been automated yet as someone could easily make a bot that monitors AIV and checks reported IP's to see if they are open proxies and of course checks OP and checks if the reported IP's are open proxies. Yonatanh 20:32, 26 January 2007 (UTC)
thread_title:  Automation 

message: I'd like to help out here on WP:OP, is it possible for a regular user like me to do that? I feel like I have sufficient knowledge in this area to help out. Yonatanh 20:36, 26 January 2007 (UTC)
replies: text: Go ahead and check some (3 or 4) (from the top down please), and I will check you. If know what you are doing, you can be added to the verified user list. I am not liking the prospect of going through the whole list alone, so... Prodego talk 02:28, 27 January 2007 (UTC)

text: A port scan revealed ports 21 and 22 were open. However, I couldn't connect, so because of the use for spamming, I consider it a possible open proxy.  Ehh, wrong one. It probably is the same as the others, a proxy on a dynamic range. Prodego talk 03:15, 27 January 2007 (UTC)
thread_title:  Helping out