View source for Wiki143:Blocking IP addresses

{{pp-vandalism|small=yes}}
{{Supplement|interprets=[[Wikipedia:Blocking policy|blocking policy]]}}
Blocking of [[IP address]]es on Wikipedia is a special case of [[IP address blocking]]. This page contains guidelines for [[WP:Administrators|administrators]] carrying out such blocks.
==Guidelines==
===Sensitive IP addresses===
{{shortcut|WP:SIP}}

====Sensitive due to public relations implications====
If you block an IP address in any of the following ranges, you are required to immediately notify the [[meta:Communications committee|Wikimedia Foundation Communications Committee]]. These ranges are allocated to major governmental organizations and blocks of these organizations have political and public relations implications that must be managed by the Foundation's press relations team. Avoid long blocks of these addresses and be especially careful in formulating your block messages, which may appear in the press. Make doubly sure you're blocking the right address.

Note that the [[IPv6]] list is ''not'' complete. Therefore, always be sure to look up an IPv6 address in [[WHOIS]] to make sure it isn't that of a sensitive organization, and if so add the range to this list.

{{#invoke:Sensitive IP addresses/summary|table
| reason = political
| class = wikitable sortable
}}

If the IP address belongs to anything that might be closely related to the above, or a major corporation, for example [[UnitedHealth Group]] or [[Berkshire Hathaway]] (both of which are in the top ten of the [[Fortune 100]] and unlikely to have data centers for lease attributed directly to them), or others, it may be a good idea to notify the committee.

====Sensitive for other reasons====
Blocking an IP address listed in this section can cause undesired effects on Wikipedia, which vary depending on the IP address in question.
Please issue soft blocks on any bot coming from this address. If you are unsure as to how to do this correctly, please do not issue the block, but contact another admin.

{{#invoke:Sensitive IP addresses/summary|table
| reason = technical
| class = wikitable sortable
}}
Note: 192.0.2.0/24 is not actually a sensitive address.  It is included in this list for testing and training purposes and may safely be blocked with no requirement to notify the WMF. Other [[Private network|private network]] addresses (127.0.0.1, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) are sometimes used by Wikimedia infrastructure, sometimes intentionally. These should not generally be blocked without good reason or consultation as there may be unintended consequences.

===Addresses of organizations with a responsive IRT===
Some organizations have an Incident Response Team that has demonstrated willingness and ability to be responsive to reports of abuse at the source (the user).  In those cases, it is preferable to contact their response team through the provided contact information rather than blocking all or part of their IP ranges&nbsp;– although it remains appropriate to place short blocks to interrupt ''ongoing'' vandalism or disruption.
{|class="wikitable sortable"
! IP address or range !! Description !! Email capability
|-
| 193.113.57.160/27 || British Telecommunications plc ([[User:BT Security Investigations|response team]]) || No
|-
| 129.127.0.0/16 || University of Adelaide ([[User:University of Adelaide IT security|response team]]) || No
|-
| (TBD) || University of Cambridge ([[User:Cambridge CERT|response team]]) || No
|-
| 71.0.0.0/14, 65.40.0.0/15, 76.0.0.0/13 || [[CenturyLink]] / [[Lumen Technologies|Lumen]] (email {{no spam|abuse|aup.lumen.com}}) || Yes
|}
Organizations should be encouraged to be involved in managing disruption caused by their users to avoid the inconvenience to their other users.  When placing a long block on an IP or IP range, a politely worded email to the organization's IT suggesting that they participate this way would be a good idea, and it is important to be liberal in unblocking ranges of organizations that collaborate.

===Block lengths===
{{shortcut|WP:IPBLENGTH}}
Blocks should be based on the protection of Wikipedia rather than the punishment of offenders. Most IP addresses should not be blocked more than a few hours, since the malicious user will probably move on by the time the block expires. If there is persistent disruption or vandalism from an IP address, the block should be extended (with the 'anon-only' option selected) as long as is necessary to prevent further disruption.

However, '''IP addresses should almost never be indefinitely blocked.''' Many IP addresses are dynamically assigned and change frequently from one person to the next, and even static IP addresses are periodically reassigned or have different users. In cases of long-term vandalism from an IP address, consider blocks over a period of months or years instead. Long-term blocks should ''never'' be used for isolated incidents, regardless of the nature of their policy violation. IP addresses used by blatant vandals, sockpuppets and people issuing legal threats should never be blocked for long periods unless there is evidence that the IP address has been used by the same user for a long time.

Open proxies should generally be reported to the [[Wikipedia:Open proxies noticeboard|Open proxies noticeboard]] and blocked for the length of time they are likely to remain open on the same IP address, which in most cases is likely to be only a few months.<ref>See [[:nl:Gebruiker:RonaldB/Open_proxy_fighting#Lifetime_of_OP.27s]] (in English) for more information on the lifetimes of open proxies</ref> Many open proxies have been blocked indefinitely, but this is no longer considered good practice. A large proportion of indefinitely blocked proxies are no longer open proxies.

If you ''do'' indefinitely block an IP address, place {{[[template:blocked proxy|blocked proxy]]}} (do not substitute) on its user or user talk page for tracking purposes.

===Shared IP addresses===
Before implementing a long-term block on an IP address with a long history of vandalism, please check if it is shared by performing a [[WHOIS]] and [[Reverse DNS lookup]] query on the IP address to determine if it belongs to a school or an [[ISP]]. If a Shared IP address' talk page is not already identified or tagged as such, use either the {{tl|Shared IP}}, {{tl|Shared IP edu}}, or any one of the templates at [[:Category:Shared IP header templates]] to do so. For anonymous-only blocks of shared IP addresses, please consider using {{tl|anonblock}} or {{tl|schoolblock}} as your blocking reason as it causes less offence to innocent users.

Note that [[IPv6]] addresses are almost ''never'' shared, even for large organizations, because [[network address translation]] is typically not used with IPv6.

===Range blocks===
{{shortcut|WP:RANGE}}
Administrators can block ranges of IP addresses (commonly called ''rangeblocking''). Use careful judgement and make them as brief as possible; they can affect up to 65,536 IPv4 addresses (for /16 blocks) or 649,037,107,316,853,453,566,312,041,152,512 (roughly 649 [[wiktionary:nonillion|nonillion]], ~6.49&times;10<sup>32</sup>, 2<sup>109</sup>) IPv6 addresses (for /19 blocks) each, potentially affecting millions of users. These should be reserved as an absolute last resort, especially very large rangeblocks.

For more information, see [[mw:Help:Range blocks]] ([[mw:Help:Range blocks/IPv6]] for IPv6). You need some knowledge of how networks and IP address numbering work, and of binary arithmetic. If you don't, [[:Category:Wikipedia administrators willing to make range blocks|many other administrators do]]&nbsp;— ask on the [[WP:AN|Administrators' noticeboard]] or on {{IRC|wikipedia-en}}. [[User:TonyBallioni/Just block the /64|This essay]] contains advice for dealing with disruption by users on IPv6 addresses.

If you propose to block a significant range, or for a significant time, consider asking a user with [[WP:CHECKUSER|checkuser]] access to check for [[WP:COLLATERAL|collateral damage]]&nbsp;– that is, for the presence of other users who may be unintentionally affected by the range block.  Alternately, if you are unsure whether disruptive edits from a specific range are a specific user, you can post a request at [[WP:SPI|sockpuppet investigations]] where another editor will attempt to match users with IP addresses.

There are several tools that can help you calculate a rangeblock, including [[toolforge:ftools/general/ip-range-calc.html|FTools]], [[toolforge:galaxybots/iprangecalculator|GalaxyBot]], [[toolforge:iprange|WikiBayer]], [https://nativeforeigner.com/calc/ NativeForeigner] or {{tl|IP range calculator}}.

==Problems and solutions==

===Shared and dynamic IP addresses===
Many users operate from '''shared IP addresses''', often those belonging to [[Proxy server|proxies]] used by large networks or home users with their [[Internet service providers]]. Since it is impossible to distinguish between individual users operating from shared IP addresses, blocking one may affect a very large number of legitimate users (ranging up to millions). Users operating from '''dynamic IP addresses''' change IP addresses periodically. This can compound the [[Wikipedia:autoblock|autoblock problem]], particularly when they are also shared, because a block targeted at a malicious user may shift to a legitimate user while the target shifts to an unblocked IP address.

Note that [[IPv6]] addresses are almost ''never'' shared, even for large organizations, because [[network address translation]] is typically not used with IPv6. Although IPv6 addresses can be highly dynamic, possibly changing even more often than IPv4 addresses, a single user will generally use the same /64 range, and their IPv6 address is unlikely to be shared with other devices (although multiple people can use a single device, e.g. a shared computer).
''See [[Wikipedia:WikiProject on XFFs]]''

===Open proxies===
{{main|Wikipedia:Open proxies}}
[[Open proxy|Open proxies]] may be blocked on sight according to the [[Wikipedia:Open proxies|policy on open proxies]]. The IP should be unblocked once the proxy has been closed. Since the IPs may eventually be reassigned or the proxies closed, blocks should not be indefinite, but in some particular cases can be very long term. Block lengths should typically range from several weeks for dynamic IPs and short term Tor nodes, up to several years for long term proxies hosted on static IP addresses.

Administrators who block open proxies should attempt to record in the block log or on the user talk page how to verify whether the IP address is still an open proxy at a future date. Administrators who deal with unblock requests from blocked open proxies should typically seek advice from either the blocking admin or the WikiProject on open proxies before unblocking.

===Indefinite blocks===
Some behaviour by users, for example egregious threats and harassment, is so extreme that an indefinite block of the user is warranted. There are also some Wikipedia policies, for example [[Wikipedia:No legal threats]] and [[Wikipedia:Sock puppetry]] where an indefinite block of the user is suggested. These indefinite periods apply to users and not their IP addresses. While the user may be considered indefinitely blocked and subsequently blocked on sight, the IP addresses they use should only be blocked for as long as they are likely to remain assigned to the same user.

===Blocking account creation but permitting editing===
In some cases administrators may wish to block account creation within an IP range, but permit editing. This can be accomplished by imposing a [[Wikipedia:Partial blocks|partial block]] and leaving the "Pages" and "Namespaces" fields blank.

==Notes==
<references/>
*[[Special:PermaLink/730725448#Sensitive_IP_Addresses|WMF reply that management of the list of sensitive IPs for the English Wikipedia is the responsibility of the community, under WMF guidance]]

==See also==
* [[:Category:Wikipedia administrators willing to make range blocks]]
* [[Wikipedia:Autoblock]]
* [[Wikipedia:Blocking Policy]]
* [[Wikipedia:WikiProject Open proxies/Guide to checking open proxies|Guide to checking open proxies]]
* [[MediaWiki:Blockiptext]], which provides the introductory text at [[Special:Block]].
*[[:MW:Help:Range blocks|Mediawiki:Help:Range blocks]]
{{Wikipedia accounts|collapsed}}
[[Category:Wikipedia blocking|{{PAGENAME}}]]