Wikipedia:Open proxy detection/Explanation: Difference between revisions

Revision as of 11:16, 3 July 2007

Latest revision as of 10:57, 8 April 2022

(20 intermediate revisions by 12 users not shown)

Line 1:

When an [[IP- address]] has doneperformed an edit, a database with open proxy addresses is automatically searched. This database is periodically maintained and consists of more than 200.000half a million IP- addresses and IP ranges. If a match is found, it is reported on [[Wikipedia:Open proxy detection|this page]].

This automatic reporting only takes place if the server of [[w:nl:Overleg_Gebruiker:RonaldB|RonaldB]] (this links to nl:wikipedia) is on-lineonline. This is close to 24/7/24, but there mightmay be dropdowntime from time-to-outstime.

The system isreceives fedinput byfrom the <span class="plainlinks">[irc://irc.wikimedia.org/en{{CONTENTLANGUAGE}}.wikipedia{{SITENAME}} irc-stream of recent changes]</span>. If the system is operational, it is logged- in with the name: vfop-nnnnn, in which nnnnn is a 5-digit number.

For background info, look [[w:nl:Gebruiker:RonaldB/Open proxy fighting|Look here]] for more (technical) background info.

===Explanation of information provided===

;type

;Info

:This provides further info on the type of open proxy. If this is preceededpreceded by ''probably'', it means that the IP- address has evernever been published as open proxy, but the scanning module has not been able to confirm this to be the case.

:Following types are discerned:

:* '''open proxy''' - a "normal" [[w:en:Open proxy|open proxy]]. The system does not provide the sub type (e.g. transparent, anonymous, etc.).

:* '''TOR exit node''' - an IP address of the [[w:en:Tor (anonymity network)|TOR]] network, by which servers on the internet can be accessed (which is not the same as a TOR onion node).

:* '''TOR exit node'''

:* '''exit server''' –- thissome isopen theproxies enduse nodeanother ofIP address (possibly a cascadezombie) ofto openaccess proxiesservers on the internet.

:* '''anonymizer''' - an [[w:en:Anonymizer|anonymizing service]], generally using a web interface (also called CGI or PHP proxy). The IP address, by which that service is accessing the internet to request pages, is reported. This is not necessarily the same as the IP address hosting the service.

:* '''anonymizer''' – IP-address used by a CGI/PHP (web based) proxy.

:* '''web server''' - The IP address, or the range it belongs to, is solely used for web hosting. It may be hacked or is hosting a CGI/PHP proxy.

:* '''JAP''' - also called [[w:en:Java Anon Proxy|JonDo]], a rarely used and relatively small anonymizing network.

:* '''SSH''' - the IP address supports the [[w:en:Secure Shell|Secure Shell]] protocol. If an attacker knows the login data, he may use the IP address as a proxy, which probably occurs in 15-20% of the reported cases.

:If the type designation is followed by an asterisk, this means that the IP address is known in the database with multiple types. The type is shown with the most recent confirmed date.

;in db since

:The date the IP- address was first contained in the database.

;first confirmed

:The first date the scanner confirmed this IP- address to be an open proxy.

;last confirmed

:The most recent date the scanner confirmed this IP- address to be an open proxy. If the indication is '''Now !''', this means that the open proxy behaviour has been confirmed by an "on-the-fly" check at the moment of editing. This can only be accomplished for "normal" open proxies.

;ip has multiple roles

The date information is used for the background-colouring of the entry. The darker the color, the more likely the IP address is indeed an open proxy at the moment of editing.

:The IP-address appears multiple times in the database as different types. Only one type is reported here.