I'm interested in this. I think that is helpful for mitigation massive attacks via Open Proxy. WMF wikis having massive attacks via Open Proxy in some times (e.g. P5117 ru.wiktionary, HEAVY PAGE: ja.wikipedia).

In Japanese Wikipedia and SWMT wikis ("#cvn-sw"@freenode), PxyBot are checking Open proxy connectability (some ports) for each posts per IP users.
If that is an Open proxy, In case of detected from Japanese Wikipedia: PxyBot have been block it automatically. In case of detected from SWMT channel : Report it as Open Proxy detection at that channel and adding black list to CVN Bots.
if not so, simply cache as 'not detected' That result is cached for few months, and cached IP are not re-scanning.
(Note: I'm now planning PxyBot migrating to CVN.)

Hi @Rxy — Thanks for finding this ticket and commenting! I wasn't aware of PxyBot — it's good to find other examples of how this problem is being solved. It seems like the big difference between PxyBot and ProcseeBot is that PxyBot is reactive (checks IPs that make edits) while ProcseeBot is proactive (routinely harvests potential proxy IPs and checks if they are proxies.) They both seem like sane approaches — do you have any thoughts about ProcseeBot's methodology?

Also, can you please clarify for me what happens on SWMT wikis? What happens when it is reported at the channel and added to the blacklist?

In T166817#3823722, @TBolliger wrote:

Hi @Rxy — Thanks for finding this ticket and commenting! I wasn't aware of PxyBot — it's good to find other examples of how this problem is being solved. It seems like the big difference between PxyBot and ProcseeBot is that PxyBot is reactive (checks IPs that make edits) while ProcseeBot is proactive (routinely harvests potential proxy IPs and checks if they are proxies.) They both seem like sane approaches — do you have any thoughts about ProcseeBot's methodology?

I think ProcseeBot's blocking logs can be used as an Open Proxies list functionally (e.g. An attacking to a non-WMF web sites using Open Proxies from that bot's blocking log via MediaWiki API).

I think better for implemented of anti-robot mechanism to showing that bot's blocking logs, or doesn't input the port number in that blocking.

Also, can you please clarify for me what happens on SWMT wikis? What happens when it is reported at the channel and added to the blacklist?

When user (or IP address) have been added in CVN blacklist, that user's edit are highlighted in Red text at IRC channel.

example: m:User:Rxy/T166817-CVN-Highlighted

Additionally, User of the CVNSimpleOverlay script are can be highlighted at wiki for that blacklisted user.

Ahh, thank you. I agree that the block log could be potentially used to assemble a list of proxy IPs, but I know the value of transparency for the block log is held to a higher importance on English Wikipedia than this potential for abuse.

I think @Zppix also has a working anti open proxy bot that appears to work. Do correct me if I'm wrong.

@Xaosflux: Hmm, what/who exactly is this stalled on ("waiting for further input (e.g. from the task author or a third party like upstream)")?

Similar to what I wrote in T380917#10370204, I'd suggest that this stays "Stalled" until we can see if T354599: [EPIC] WE4.2.14b Provide IP reputation variables in AbuseFilter will be a satisfactory solution.

@Aklapper as this asking to "Enable ProcseeBot" - seem as it is stalled on the third party of the processbot operator. Perhaps this should be refactored to a generic feature request after refining the user story instead, although the task author is gone so that may also be stuck.

In T166817#10431965, @kostajh wrote:

Similar to what I wrote in T380917#10370204, I'd suggest that this stays "Stalled" until we can see if T354599: [EPIC] WE4.2.14b Provide IP reputation variables in AbuseFilter will be a satisfactory solution.

This is now available: https://www.mediawiki.org/wiki/Extension:IPReputation/AbuseFilter_variables

That said, I would suggest not creating blocking actions based solely on these variables, but instead looking at ways to combine the IP reputation signals with other AbuseFilter variables to mitigate abuse as needed.