Wikipedia:Abuse response/117.204.1xx.xxx

Requester comments
Persistent and peculiarly insidious vandal from a range of IPs in India has been damaging articles on a daily basis. Characteristic edits include randomly falsifying or inventing birthdates, release dates, and other data across a swath of articles related to Indian entertainment; the falsified dates are often harmless-looking and are especially difficult to detect as vandalism, so they easily slip by unnoticed. Repeated checks against the articles' references confirm that the user's edits are consistently spurious. The IP address has varied within a certain range from day to day. Many warnings have been issued, and the user has been blocked at least 6 times, to no effect.

IPs that were warned and blocked include:
 * 117.204.112.173 (talk page) (history)
 * 117.204.115.223 (talk page) (history)
 * 117.204.116.141 (talk page) (history)
 * 117.204.118.153 (talk page) (history)
 * 117.204.119.249 (talk page) (history)
 * 117.204.122.31 (talk page) (history)
 * 117.207.160.139 (talk page) (history)

Note: the last IP above is slightly different from the others. The following message appears on its talk page: "This IP address, 117.207.160.139, is registered to Bharat Sanchar Nigam Limited, India. In the event of persistent vandalism from this address, efforts may be made to contact Bharat Sanchar Nigam Limited, India to report abuse... Contact information can be viewed in the WHOIS report. If you are an unregistered user operating from this address, note that it is possible for the owner of the IP, Bharat Sanchar Nigam Limited, India, to determine who was making contributions from this address at a given time."

The same unique signature of vandalism has also appeared from the following IPs, among others, though they were never blocked:


 * 117.204.113.134 (history)
 * 117.204.113.194 (history)
 * 117.204.114.38 (history)
 * 117.204.115.2 (history)
 * 117.204.117.191 (history)
 * 117.204.118.142 (history)
 * 117.204.118.161 (history)
 * 117.204.120.147 (history)
 * 117.204.121.93 (history)
 * 117.204.121.244 (history)
 * 117.204.123.214 (history)
 * 117.204.124.71 (history)

The user often visits the same page more than once, so additional IP addresses may be tracked down by checking the recent history of his targets.

This is my first time reporting abuse here. I have tried to be as thorough as possible, hoping we can stop cleaning up this user's daily messes soon. AtticusX (talk) 19:08, 25 February 2010 (UTC)

Discussion

 * Opened case, and started to investigate the incidents, it does seem to be a deliberate and malicious act by this person or persons...Recommending block, any additional information would be very helpful! thanks...Rockyman512 21:59, 26 April 2010 (UTC)


 * Thanks for your investigation into this vandalism. Since I filed this report, the date change vandal has gone on to do an enormous amount of damage from the following IPs, among others (in numerical order):


 * 117.204.112.13
 * 117.204.112.30
 * 117.204.112.173
 * 117.204.112.178
 * 117.204.113.134
 * 117.204.113.143
 * 117.204.113.194
 * 117.204.113.243
 * 117.204.114.38
 * 117.204.114.97
 * 117.204.114.119
 * 117.204.114.183
 * 117.204.114.244
 * 117.204.114.255
 * 117.204.115.0
 * 117.204.115.2
 * 117.204.115.203
 * 117.204.115.223
 * 117.204.115.233
 * 117.204.116.141
 * 117.204.117.49
 * 117.204.117.88
 * 117.204.117.191
 * 117.204.117.211
 * 117.204.118.63
 * 117.204.118.141
 * 117.204.118.142
 * 117.204.118.153
 * 117.204.118.161
 * 117.204.119.3
 * 117.204.119.147
 * 117.204.119.153
 * 117.204.119.249
 * 117.204.120.23
 * 117.204.120.56
 * 117.204.120.135
 * 117.204.120.142
 * 117.204.120.147
 * 117.204.120.239
 * 117.204.121.93
 * 117.204.121.145
 * 117.204.121.161
 * 117.204.121.241
 * 117.204.121.244
 * 117.204.121.247
 * 117.204.122.31
 * 117.204.123.29
 * 117.204.123.172
 * 117.204.123.197
 * 117.204.123.214
 * 117.204.124.62
 * 117.204.124.71
 * 117.204.125.13
 * 117.204.125.113
 * 117.204.127.10
 * 117.204.127.45

A discussion of this vandal's numerical scrambling ensued at Wikipedia talk:Noticeboard for India-related topics/Archive 43 and as a result of that discussion, a month-long range block for IPs 117.204.112.0 - 117.204.127.255 is currently in effect (117.204.112.0/20), thanks to administrator Tim Song. So for the moment, the tidal wave of damage is under control. When the current range block expires, however, if the date change vandal returns, it is hoped that we won't have to wait another two months for a sympathetic administrator to come along and take blocking action. AtticusX (talk) 05:13, 27 April 2010 (UTC)

Registry information
(Asked whois.apnic.net:43 about 117.204.112.173)
 * WHOIS report
 * Summarized WHOIS report:

inetnum:     117.192.0.0 - 117.255.255.255 netname:     BSNLNET descr:       NIB (National Internet Backbone) descr:       Bharat Sanchar Nigam Limited descr:       8th Floor 148-B Statesman House  Barakhamba Road  descr: New Delhi-110001 country:     IN  admin-c:       NC83-AP tech-c:       CDN1-AP remarks:     IP Addresses for Multiplay network remarks:     -- remarks:     This object can only be updated by APNIC hostmasters. remarks:     To update this object  please contact APNIC remarks:     hostmasters and include your organisation's account remarks:     name in the subject line. remarks:     -- changed:     hm-changed@apnic.net 20070801 mnt-by:        APNIC-HM mnt-lower:    MAINT-IN-DOT status:      ALLOCATED PORTABLE source:      APNIC route:       117.204.112.0/20 descr:       BSNL Internet country:     IN  origin:       AS9829 mnt-lower:    MAINT-IN-DOT mnt-routes:   MAINT-IN-DOT mnt-by:       MAINT-IN-AS9829 changed:     dnw_jtotech@bsnl.in 20070914 source:      APNIC route:       117.204.64.0/18 descr:       BSNL Internet country:     IN  origin:       AS9829 mnt-lower:    MAINT-IN-DOT mnt-routes:   MAINT-IN-DOT mnt-by:       MAINT-IN-AS9829 changed:     dnw_jtotech@bsnl.in 20071207 source:      APNIC route:       117.204.0.0/16 descr:       BSNL Internet country:     IN  origin:       AS9829 mnt-lower:    MAINT-IN-DOT mnt-routes:   MAINT-IN-DOT mnt-by:       MAINT-IN-AS9829 changed:     dnw_jtotech@bsnl.in 20071207 source:      APNIC role:        NS Cell address:     Internet Cell address:     Bharat Sanchar Nigam Limited address:     8th Floor 148-B Statesman House address:     Barakhamba Road  New Delhi - 110 001 country:     IN  phone:        91-11-23734057 phone:       91-11-23710183 fax-no:      91-11-23734052 e-mail:      hostmaster@sancharnet.in admin-c:       CGMD1-AP tech-c:       DT197-AP nic-hdl:      NC83-AP mnt-by:       MAINT-IN-DOT changed:     dnwplg@sancharnet.in 20030120 changed:     hm-changed@apnic.net 20071227 source:       APNIC role:        CGM Data Networks address:     CTS Compound address:     Netaji Nagar address:     New Delhi- 110 023 country:     IN  phone:        91-11-24106782 phone:       91-11-24102119 fax-no:      91-11-26116783 fax-no:      91-11-26887888 e-mail:      dnwplg@sancharnet.in e-mail:       hostmaster@sancharnet.in admin-c:       CGMD1-AP tech-c:       DT197-AP tech-c:       BH155-AP nic-hdl:      CDN1-AP mnt-by:       MAINT-IN-DOT changed:     dnwplg@sancharnet.in 20030120 changed:     hm-changed@apnic.net 20071227 source:       APNIC route:       117.192.0.0/10 descr:       BSNL-VSNL Route Object origin:      AS4755 mnt-by:       MAINT-VSNL-IN changed:     ip.admin@vsnl.co.in 20070917 source:      RADB route:       117.192.0.0/10 descr:       Reliance customer-BSNL origin:      AS9829 mnt-by:       MAINT-AS18101 changed:     ip.nnoc@relianceada.com 20071207 06: 04: 30(UTC) source:      RADB

Abuse summary
Person has maliciously edited articles to include nonsensical characters using several IP addresses Rockyman512 22:19, 26 April 2010 (UTC)

Contact summary
 {| class="wikitable" ! colspan="2" |

Case history

 * Investigated by: || Rockyman512
 * Contacted by: || Investigator
 * Closed on: ||Rockyman512 (talk) 05:49, 1 May 2010 (UTC)
 * Disposition: ||
 * Closed on: ||Rockyman512 (talk) 05:49, 1 May 2010 (UTC)
 * Disposition: ||
 * Disposition: ||
 * Disposition: ||


 * valign="top" | Case log: || ARPrelim Rockyman512 22:05, 26 April 2010 (UTC)
 * Rockyman512 22:05, 26 April 2010 (UTC)
 * 117.204.112.173, is behind a firewall and cannot be traced back has a block on the packets...Contacting the ISP in the WHOIS report. Rockyman512 22:19, 26 April 2010 (UTC)
 * Investigations Completed, ISP contacted. Rockyman512 23:09, 26 April 2010 (UTC)
 * Closed Rockyman512 (talk) 05:49, 1 May 2010 (UTC)
 * }
 * }