Wikipedia:Abuse response/117.204.1xx.xxx

Abuse Response
Report Status
IP Address117.204.1xx.xxx
ContributionsContributions
Page MovesPage moves
Block LogBlock log
Contribution HistoryContribution history
StatusClosed
RequestorAtticusX (talk)
Date19:08, 25 February 2010 (UTC)
InvestigatorRockyman512 (talk)
ContactorRockyman512 (talk)



Requester comments

Persistent and peculiarly insidious vandal from a range of IPs in India has been damaging articles on a daily basis. Characteristic edits include randomly falsifying or inventing birthdates, release dates, and other data across a swath of articles related to Indian entertainment; the falsified dates are often harmless-looking and are especially difficult to detect as vandalism, so they easily slip by unnoticed. Repeated checks against the articles' references confirm that the user's edits are consistently spurious. The IP address has varied within a certain range from day to day. Many warnings have been issued, and the user has been blocked at least 6 times, to no effect.

IPs that were warned and blocked include:

Note: the last IP above is slightly different from the others. The following message appears on its talk page: "This IP address, 117.207.160.139, is registered to Bharat Sanchar Nigam Limited, India. In the event of persistent vandalism from this address, efforts may be made to contact Bharat Sanchar Nigam Limited, India to report abuse... Contact information can be viewed in the WHOIS report. If you are an unregistered user operating from this address, note that it is possible for the owner of the IP, Bharat Sanchar Nigam Limited, India, to determine who was making contributions from this address at a given time."

The same unique signature of vandalism has also appeared from the following IPs, among others, though they were never blocked:

The user often visits the same page more than once, so additional IP addresses may be tracked down by checking the recent history of his targets.

This is my first time reporting abuse here. I have tried to be as thorough as possible, hoping we can stop cleaning up this user's daily messes soon. AtticusX (talk) 19:08, 25 February 2010 (UTC)[reply]

Discussion

Discussion
#FBFBFB
Opened case, and started to investigate the incidents, it does seem to be a deliberate and malicious act by this person or persons...Recommending block, any additional information would be very helpful! thanks...Rockyman512 21:59, 26 April 2010 (UTC)
Thanks for your investigation into this vandalism. Since I filed this report, the date change vandal has gone on to do an enormous amount of damage from the following IPs, among others (in numerical order):
  • 117.204.112.13
  • 117.204.112.30
  • 117.204.112.173
  • 117.204.112.178
  • 117.204.113.134
  • 117.204.113.143
  • 117.204.113.194
  • 117.204.113.243
  • 117.204.114.38
  • 117.204.114.97
  • 117.204.114.119
  • 117.204.114.183
  • 117.204.114.244
  • 117.204.114.255
  • 117.204.115.0
  • 117.204.115.2
  • 117.204.115.203
  • 117.204.115.223
  • 117.204.115.233
  • 117.204.116.141
  • 117.204.117.49
  • 117.204.117.88
  • 117.204.117.191
  • 117.204.117.211
  • 117.204.118.63
  • 117.204.118.141
  • 117.204.118.142
  • 117.204.118.153
  • 117.204.118.161
  • 117.204.119.3
  • 117.204.119.147
  • 117.204.119.153
  • 117.204.119.249
  • 117.204.120.23
  • 117.204.120.56
  • 117.204.120.135
  • 117.204.120.142
  • 117.204.120.147
  • 117.204.120.239
  • 117.204.121.93
  • 117.204.121.145
  • 117.204.121.161
  • 117.204.121.241
  • 117.204.121.244
  • 117.204.121.247
  • 117.204.122.31
  • 117.204.123.29
  • 117.204.123.172
  • 117.204.123.197
  • 117.204.123.214
  • 117.204.124.62
  • 117.204.124.71
  • 117.204.125.13
  • 117.204.125.113
  • 117.204.127.10
  • 117.204.127.45

A discussion of this vandal's numerical scrambling ensued at Wikipedia talk:Noticeboard for India-related topics/Archive 43#Date change vandal and as a result of that discussion, a month-long range block for IPs 117.204.112.0 - 117.204.127.255 is currently in effect (117.204.112.0/20), thanks to administrator Tim Song. So for the moment, the tidal wave of damage is under control. When the current range block expires, however, if the date change vandal returns, it is hoped that we won't have to wait another two months for a sympathetic administrator to come along and take blocking action. AtticusX (talk) 05:13, 27 April 2010 (UTC)[reply]

Registry information

(Asked whois.apnic.net:43 about 117.204.112.173) inetnum:      117.192.0.0 - 117.255.255.255  netname:      BSNLNET  descr:        NIB (National Internet Backbone)  descr:        Bharat Sanchar Nigam Limited  descr:        8th Floor 148-B Statesman House  Barakhamba Road  descr: New Delhi-110001  country:      IN  admin-c:       NC83-AP  tech-c:        CDN1-AP  remarks:      IP Addresses for Multiplay network  remarks:      --------------------------  remarks:      This object can only be updated by APNIC hostmasters.  remarks:      To update this object  please contact APNIC  remarks:      hostmasters and include your organisation's account  remarks:      name in the subject line.  remarks:      --------------------------  changed:      hm-changed@apnic.net 20070801  mnt-by:        APNIC-HM  mnt-lower:     MAINT-IN-DOT  status:       ALLOCATED PORTABLE  source:       APNIC  route:        117.204.112.0/20  descr:        BSNL Internet  country:      IN  origin:       AS9829  mnt-lower:     MAINT-IN-DOT  mnt-routes:    MAINT-IN-DOT  mnt-by:        MAINT-IN-AS9829  changed:      dnw_jtotech@bsnl.in 20070914  source:       APNIC  route:        117.204.64.0/18  descr:        BSNL Internet  country:      IN  origin:       AS9829  mnt-lower:     MAINT-IN-DOT  mnt-routes:    MAINT-IN-DOT  mnt-by:        MAINT-IN-AS9829  changed:      dnw_jtotech@bsnl.in 20071207  source:       APNIC  route:        117.204.0.0/16  descr:        BSNL Internet  country:      IN  origin:       AS9829  mnt-lower:     MAINT-IN-DOT  mnt-routes:    MAINT-IN-DOT  mnt-by:        MAINT-IN-AS9829  changed:      dnw_jtotech@bsnl.in 20071207  source:       APNIC  role:         NS Cell  address:      Internet Cell  address:      Bharat Sanchar Nigam Limited  address:      8th Floor 148-B Statesman House  address:      Barakhamba Road  New Delhi - 110 001  country:      IN  phone:        91-11-23734057  phone:        91-11-23710183  fax-no:       91-11-23734052  e-mail:       hostmaster@sancharnet.in  admin-c:       CGMD1-AP  tech-c:        DT197-AP  nic-hdl:       NC83-AP  mnt-by:        MAINT-IN-DOT  changed:      dnwplg@sancharnet.in 20030120  changed:      hm-changed@apnic.net 20071227  source:       APNIC  role:         CGM Data Networks  address:      CTS Compound  address:      Netaji Nagar  address:      New Delhi- 110 023  country:      IN  phone:        91-11-24106782  phone:        91-11-24102119  fax-no:       91-11-26116783  fax-no:       91-11-26887888  e-mail:       dnwplg@sancharnet.in  e-mail:       hostmaster@sancharnet.in  admin-c:       CGMD1-AP  tech-c:        DT197-AP  tech-c:        BH155-AP  nic-hdl:       CDN1-AP  mnt-by:        MAINT-IN-DOT  changed:      dnwplg@sancharnet.in 20030120  changed:      hm-changed@apnic.net 20071227  source:       APNIC  route:        117.192.0.0/10  descr:        BSNL-VSNL Route Object  origin:       AS4755  mnt-by:        MAINT-VSNL-IN  changed:      ip.admin@vsnl.co.in 20070917  source:       RADB  route:        117.192.0.0/10  descr:        Reliance customer-BSNL  origin:       AS9829  mnt-by:        MAINT-AS18101  changed:      ip.nnoc@relianceada.com 20071207  06: 04: 30(UTC)  source:       RADB 

Abuse summary

Person has maliciously edited articles to include nonsensical characters using several IP addresses Rockyman512 22:19, 26 April 2010 (UTC)


Contact summary

Communication sent:

26 April 2010

Wikipedia:Abuse response/Contact templates.
Reply received:

Awaiting Repsonse

Not yet recieved.

Case history

Investigated by:Rockyman512
Contacted by:Investigator
Closed on:Rockyman512 (talk) 05:49, 1 May 2010 (UTC)[reply]
Disposition:


Case log:ARPrelim Rockyman512 22:05, 26 April 2010 (UTC) OpenedRockyman512 22:05, 26 April 2010 (UTC)117.204.112.173, is behind a firewall and cannot be traced back has a block on the packets...Contacting the ISP in the WHOIS report. Rockyman512 22:19, 26 April 2010 (UTC) Investigation CompleteInvestigations Completed, ISP contacted. Rockyman512 23:09, 26 April 2010 (UTC)Closed Rockyman512 (talk) 05:49, 1 May 2010 (UTC)[reply]