Wikipedia:WikiProject on open proxies/Guide to checking open proxies

Open proxies are IP addresses that can be used by anyone anywhere with an Internet connection, usually with the intention of hiding the real origin. They are often used by vandals and sockpuppets to evade blocks, or sometimes it's just useful to know if the IPs you are dealing with are open proxies. This will tell you how to confirm whether an IP address really is an open proxy, in most cases using only your browser.

How to confirm open proxies

Step one: You would normally first have reason to suspect that an IP is an open proxy. There may be a banned user or sockpuppets using IP addresses from different countries, or the vandal or other users might mention it directly. There might be an IP already blocked as an open proxy requesting unblock.[1] The edit might malform some wikitext.[2] Proper spambots and vandalbots will also usually use open proxies.[3] If there are no suspects around then you might want to find a recently blocked open proxy for testing.
Identify the access point. You are hopefully going to use it yourself. Google the IP address. Do rDNS and WHOIS lookups. Be creative if you have to, like looking at neighbouring IP addresses (Tool). While you're there check if it looks dynamic. The first question to ask is whether it's a web proxy or an HTTP proxy.
1. Does it look like a web server? Keywords to look for in search results are PHP-proxy, CGI-proxy, Glype, and NPH, as well as domain names. Do the rDNS and WHOIS suggest it's a dedicated server or hosting range? Open the IP address in your browser. Is there a holding page, or even a web proxy there? Find which sites are hosted on it using rDNS and Google. Nmap will almost always say that port 80 is open on webservers, but this does not necessarily mean there is an open proxy there.
2. Or does it look like an HTTP/SOCKS proxy? Such proxy IPs are always associated with a port number. The most usual ones are 80, 1080, 3128, 8000, 8080, 8888, but it could be any number up to 65535. These ports are usually displayed in search results following the IP address and a colon, for example 111.282.3.1:3128. They are, in so far as they obfuscate e.g. the user's original IP address and other data, sometimes referred to as "Transparent" or "Elite". Use the IP address with colon and port number in your browser's address bar. If the port is open there will usually be some response, but probably nothing very interesting. If a normal Nmap-portscan is used the ports will be said to be open, but this does not necessarily mean there is an open proxy. Nmap can, however, check via its scripts http-open-proxy and socks-open-proxy.
  1. An example would be: nmap -P0 --script=socks-open-proxy --script=http-open-proxy.nse -p<ports to check> <host>
3. Or is it another type of anonymiser? They are beyond this article's scope, but the same principles apply. For examples see Category:Anonymity networks.
Connect to the proxy. If it's a web proxy go to its page in a browser. If it's an HTTP proxy change the network settings in your browser options.
Find your new IP address. Using your new proxy connection, visit one of those sites that tell you about your IP address. It might tell you you're now in China. Make sure you are not logged in and go to Special:Mytalk on Wikipedia. This will confirm you can use the same IP address to read Wikipedia. On any page (like your new talkpage) click edit, add a signature, and click preview. This will confirm without a doubt that you (and any other person) can use this IP to edit Wikipedia. Some people make confirmation edits to a sandbox, but since the IP user could be anyone this isn't as helpful as mentioning how you are accessing it so others can check.
Use your new found powers to check some IPs in CAT:OP. Hopefully this will show you both the open proxy attrition rate, and that confirming that an IP address isn't an open proxy isn't always as straightforward.

Blocking

Block the IP if you think that's appropriate. Make a note about how to confirm it in the block log or on its talk page. HTTP proxies are typically open for shorter periods of time. The usual causes are a misconfigured caching proxy, or a trojan/virus, and they get cleaned up eventually. HTTP proxies are also more likely to be dynamic IP addresses, typically home users. Web servers often stay static for years, and while the open proxies hosted on it may eventually disappear, the collateral is not going to be huge if a dedicated web server stays blocked from editing. However, people can and do edit legitimately from web servers which are not open proxies. Depending on the nature of the IP address, block lengths are typically a few months for HTTP proxies and a few years for web proxies.

Port scans

Port scanning, and nmap, may help to identify which ports are open on suspect IPs, however, even when it says that proxy ports are open the default scan does not check to see if it is an open proxy using that port. It could be a closed proxy expecting authentication, or even a normal website. Open proxies cannot be properly confirmed by scanning, but only by using the proxy to fetch a page for you, in a similar way to that described above. Port scanning may have legal implications in some jurisdictions, your network provider may have rules against it, and it's generally considered a bad thing. Moreover it's usually completely unnecessary. If you must use nmap, consider using the -F flag.

Exit servers

It is possible in some cases for HTTP proxies to edit from a different IP address than the one you connect to. This means that scans of the IP which makes the edits do not detect any open ports, while scans of the IP you connect to do not show what address it will use to edit (i.e. which IP to block). A common scenario is where an ISP routes all their web traffic through a central caching server, and one of the IPs using it is running an open proxy. They are generally not easy to confirm. Caution should be exercised with blocking in these cases, as these blocks may affect many innocent users, and the proxies don't tend to last long. See also: Wikipedia:WikiProject on XFFs.

Duck test

It is not unheard of for admins to only use the duck test when considering whether an IP is an open proxy. For example sometimes just being used by a banned user and having a holding page on port 80 is sometimes considered good enough. Use the duck test wisely. Keep the blocks relatively short unless you know what you're dealing with. Do not use DNSBLs (blacklists) for this purpose, as they are often stale and often misinterpreted. A common mistake is to block a legitimate closed caching proxy as an open proxy, simply because it has ports open. Test the suspected open proxy by connecting to it as explained above.

Legitimate users

Not everyone who uses an open proxy is a vandal or sockpuppet, and there are many legitimate reasons to use them. It is always worth considering whether an immediate block of an open proxy being used constructively is necessary. Shared IP addresses, such as universities, schools, and ISPs are often badly affected by open proxies on their networks; in some cases it may be worth considering a softblock and/or a checkuser instead of a hardblock. Wikipedia:IP block exemption is also available for legitimate registered users.

v t e Administrators' guide
Articles	Advice for new administrators Blocking Cleaning backlogs Dealing with disputes Dealing with spam Deleting Edit filters Granting and revoking user rights History merging Protecting Reading list Rollback Tools, scripts and gadgets Viewing deleted pages and contributions
Policies	Administrator policy (WP:ADMIN) Banning policy (WP:BAN) Blocking policy (WP:BLOCK) Deletion policy (WP:DEL) Protection policy (WP:PROTECT) Revision deletion policy (WP:REVDEL)