User:ST47ProxyBot

This is a Wikipedia Bot operated by User:ST47, an admin on the English Wikipedia. It blocks IP addresses which are known to be open proxies, which are prohibited from editing, such as SOCKS proxies and OpenVPN nodes which are open to the public, from editing Wikipedia. This is done to prevent disruption caused by evading blocks. The IP addresses blocked by this bot would otherwise be used for widespread ip-hopping vandalism and harassment, which is difficult or impossible to halt. If you are blocked by this bot, you are probably not the direct target of the block, but you will need to disable your VPN or proxy in order to edit. Sometimes web browsers and computer security software will automatically connect you to a VPN or proxy without you even knowing, so check those types of software and disable any proxy or VPN features before proceeding.

If you believe that you have disabled your VPN but you are still not able to edit, and the IP address shown on the block message is completely different from your actual IP address (check your IP address here), you may be affected by an automatic cookie block. This will automatically expire after 24 hours, however, you can also clear your cookies for `en.wikipedia.org` in order to attempt to clear the block. Wikipedia Administrators can not see or do anything about this type of block, so you should try this easy self-service step first, before requesting a formal unblock. This type of block does not affect registered users.

If you believe that you have been blocked in error, you can request an unblock by editing your User talk page and adding the message. In your explanation, include your current IP address, and the reason you believe the block is in error. For example, if you are sure that you are not using a VPN, tell us that. If you would prefer to make the request in private, you can also use WP:UTRS.

SOCKS Proxies


These types of block message indicate that the bot successfully used a SOCKS proxy or HTTP proxy to access Wikipedia from your IP address. This type of proxy may have been installed intentionally, but is more commonly a sign of some form of malware. In addition to disabling any proxy you might be using, you may want to perform a virus scan on your network and verify that the firewall on your router is enabled and configured correctly. The IP address and port that the proxy was detected on is shown in the block message. However, please note that it is very common for a SOCKS proxy like this to move between ports to avoid detection - so finding that the port in question is currently closed is not a guarantee that the issue has been completely resolved.

Note that a small minority of these proxies have a different entrance IP than exit IP. The IP that is listed in the block reason is the one that the bot scanned and connected to. The IP that is actually blocked is the one that Wikipedia's Userinfo API reported when the bot tested the proxy.

OpenVPN Nodes


These types of block message indicate that the bot found an OpenVPN node on this IP address. This type of proxy usually is installed on purpose, usually to help users bypass the Great Firewall and other restrictive government policies. While users are free to use those to read Wikipedia, they are still blocked from editing while doing so. The first block message indicates that the bot successfully connected to the proxy's advertised IP and port, and was able to confirm that the software that answered was an OpenVPN server. (It does not attempt to actually access Wikipedia through this type of proxy.) The second indicates that the bot wasn't able to connect, but that the IP address in question was still confirmed to be a proxy via multiple methods, including APIs that provide information about proxies.

If you are running this software on your own computer, we cannot tell the difference between you and someone else who is using your VPN maliciously. You will need to disable the VPN software and request that the IP address be unblocked.

Peer to Peer Proxies


These types of block message indicate that the bot found an peer to peer VPN or proxy service on this IP address. This type of proxy usually is provided by proprietary software which purports to provide an "IP changing" service. It's usually only when you read the fine print that you realize that downloading that program or app allows the company to sell access to your IP address and network to their other customers. The block message indicates that we verified this with the assistance of our partner APIs.

If you are running this software on your own computer or cell phone, you should be aware that it is sharing your internet connection with other people. You will need to remove this software and request that the IP address be unblocked.

Many "IP changing" or "free security" applications - both for PCs and for phones - will surreptitiously allow other customers of their service to route their internet traffic through your IP address. If you have determined that the IP address issued by your ISP is being blocked with this type of block, you probably have a user on your network with such an application on their computer or cell phone.

If you are able to identify and remove this application, you should apply for an unblock. Admins can include the text  in their unblock message. This is a signal to this bot that the IP address's owner believes that the IP is no longer a proxy. The bot will refrain from issuing further blocks for one week after the unblock with that message.

Webhosts


This type of block message is not based on automatic detection, but on manual review. The owner of the network in question operates a business like web hosting, datacenter, or cloud, which allows their customers to run servers within that IP space. Because every IP in this type of range can be assigned to a customer who will use it as an open proxy at any time, and because these ranges are never used by normal residential or mobile customers, they are blocked.

If you are sure that you aren't using a proxy or VPN, not even one provided by your work or school, but you're actually just using your normal home, mobile, or work internet connection, it is possible that we either misunderstood what type of business your ISP was running, or made a block that was too wide. Make an unblock request as described above and tell us your IP address, and what type of internet connection you are using. We will investigate and get back to you as soon as possible.

Information for Administrators
The blocks that this bot makes are based on multiple sources of data. To avoid spilling the beans, I'll only say that it relies on a combination of open-source intelligence, blocklist APIs, and port scanning/fingerprinting. Nevertheless, if you are handling an unblock request for a blocked proxy and you believe that it was either a false positive, or a dynamic IP address that has since been re-assigned, you may unblock the IP address. You are not required to consult me before doing so, however, if you are not confident in your ability to check for a proxy and in the results you have seen, I recommend you check with someone who is. In addition to the information at the WHOIS gateway and the proxy checker, you may want to consider the length of the block log of the IP in question. This bot starts with a short block and ramps the duration up for each previous block that has "proxy" in the block description. If the IP address has a long block log, it is likely that this has long been a problematic IP address.

Instead of unblocking an IP address, you can also issue IP Block Exemption to the registered account which is being affected by a block. We recommend referring such requests to Checkusers, however, it is not mandatory that you do so. Please align the duration of the permission, with the level of trust you would place in the user: 1 year grants of IP block exemption are usually the maximum, though it may be issued longer in significant and exceptional circumstances.

For colocationwebhost and webhostblock blocks, the block is based on the WHOIS data - usually, it is an company that I looked up and found that they operate data centers or some sort of hosting provider. These should be relatively uncontroversial. However, these ranges often change hands. If you have investigated and found that a range is no longer operated by a hosting service or cloud service provider, please feel free to unblock.

If you unblock an IP address or range, and this bot detects it again, this bot will not reblock that address without me manually reviewing it first. If you want to temporarily unblock an IP (for example, if the user is NOT behind CGNAT and claims that the proxy issue has been resolved), include the text  in your unblock message. The bot will not automatically reblock the IP address unless it is still detected as a proxy or VPN one week after your unblock.