Wikipedia:Open proxy detection/Explanation: Difference between revisions

Revision as of 00:22, 6 May 2008

Latest revision as of 10:57, 8 April 2022

(13 intermediate revisions by 12 users not shown)

Line 1:

When an [[IP- address]] has doneperformed an edit, a database with open proxy addresses is automatically searched. This database is periodically maintained and consists of more than half a million IP- addresses and IP- ranges. If a match is found, it is reported on [[Wikipedia:Open proxy detection|this page]].

This automatic reporting only takes place if the server of [[w:nl:Overleg_Gebruiker:RonaldB|RonaldB]] is on-lineonline. This is close to 7/24/7, but there mightmay be dropdowntime from time-to-outstime.

The system receives input from the <span class="plainlinks">[irc://irc.wikimedia.org/{{CONTENTLANGUAGE}}.{{SITENAME}} irc-stream of recent changes]</span>. If the system is operational, it is logged- in with the name: op-nnnnn, in which nnnnn is a 5-digit number.

[[w:nl:Gebruiker:RonaldB/Open proxy fighting|Look here]] for more (technical) background info.

Line 9:

===Explanation of information provided===

;type

:This provides further info on the type of open proxy. If this is preceded by ''probably'', it means that the IP- address has evernever been published as open proxy, but the scanning module has not been able to confirm this to be the case.

:Following types are discerned:

:* '''open proxy''' - a "normal" [[w:en:Open proxy|open proxy]]. The system does not provide the sub type (e.g. transparent, anonymous, etc.).

:* '''TOR exit node''' - an IP- address of the [[w:en:Tor (anonymity network)|TOR]] network, by which servers on the internet can be accessed (which is not the same as a TOR onion node).

:* '''exit server''' - some open proxies use another IP- address (possibly a zombie) to access servers on the internet.

:* '''anonymizer''' - an [[w:en:Anonymizer|anonymizing service]], generally using a web interface (also called CGI or PHP proxy). The IP- address, by which that service is accessing the internet to request pages, is reported. This is not necessarily the same as the IP- address hosting the service.

:* '''web server''' - The IP- address, or the range it belongs to, is solely used for web hosting. It may be hacked or is hosting a CGI/PHP proxy.

:* '''JAP''' - also called [[w:en:Java Anon Proxy|JonDo]], a rarely used and relatively small anonymizing network.

:* '''SSH''' - the IP address supports the [[w:en:Secure Shell|Secure Shell]] protocol. If an attacker knows the login data, he may use the IP address as a proxy, which probably occurs in 15-20% of the reported cases.

:If the type designation is followed by an asterisk, this means that the IP- address is known in the database with multiple types. The type is shown with the most recent confirmed date.

;in db since

:The date the IP- address was first contained in the database.

;first confirmed

:The first date the scanner confirmed this IP- address to be an open proxy.

;last confirmed

:The most recent date the scanner confirmed this IP- address to be an open proxy. If the indication is '''Now !''', this means that the open proxy behaviour has been confirmed by an "on-the-fly" check at the moment of editing. This can only be accomplished for "normal" open proxies.

The date information is used for the background-colouring of the entry. The darker the color, the more likely the IP- address is indeed an open proxy at the moment of editing.