Persistent and peculiarly insidious vandal from a range of IPs in India has been damaging articles on a daily basis. Characteristic edits include randomly falsifying or inventing birthdates, release dates, and other data across a swath of articles related to Indian entertainment; the falsified dates are often harmless-looking and are especially difficult to detect as vandalism, so they easily slip by unnoticed. Repeated checks against the articles' references confirm that the user's edits are consistently spurious. The IP address has varied within a certain range from day to day. Many warnings have been issued, and the user has been blocked at least 6 times, to no effect.

IPs that were warned and blocked include:

• 117.204.112.173 ( talk page) ( history)
• 117.204.115.223 ( talk page) ( history)
• 117.204.116.141 ( talk page) ( history)
• 117.204.118.153 ( talk page) ( history)
• 117.204.119.249 ( talk page) ( history)
• 117.204.122.31 ( talk page) ( history)
• 117.207.160.139 ( talk page) ( history)

Note: the last IP above is slightly different from the others. The following message appears on its talk page: "This IP address, 117.207.160.139, is registered to Bharat Sanchar Nigam Limited, India. In the event of persistent vandalism from this address, efforts may be made to contact Bharat Sanchar Nigam Limited, India to report abuse... Contact information can be viewed in the WHOIS report. If you are an unregistered user operating from this address, note that it is possible for the owner of the IP, Bharat Sanchar Nigam Limited, India, to determine who was making contributions from this address at a given time."

The same unique signature of vandalism has also appeared from the following IPs, among others, though they were never blocked:

• 117.204.113.134 ( history)
• 117.204.113.194 ( history)
• 117.204.114.38 ( history)
• 117.204.115.2 ( history)
• 117.204.117.191 ( history)
• 117.204.118.142 ( history)
• 117.204.118.161 ( history)
• 117.204.120.147 ( history)
• 117.204.121.93 ( history)
• 117.204.121.244 ( history)
• 117.204.123.214 ( history)
• 117.204.124.71 ( history)

The user often visits the same page more than once, so additional IP addresses may be tracked down by checking the recent history of his targets.

This is my first time reporting abuse here. I have tried to be as thorough as possible, hoping we can stop cleaning up this user's daily messes soon. AtticusX ( talk) 19:08, 25 February 2010 (UTC) reply

• WHOIS report
• Summarized WHOIS report:

(Asked whois.apnic.net:43 about 117.204.112.173)

 inetnum:      117.192.0.0 - 117.255.255.255 
 netname:      BSNLNET 
 descr:        NIB (National Internet Backbone) 
 descr:        Bharat Sanchar Nigam Limited 
 descr:        8th Floor 148-B Statesman House  Barakhamba Road  descr: New Delhi-110001 
 country:      IN 
 admin-c:       NC83-AP 
 tech-c:        CDN1-AP 
 remarks:      IP Addresses for Multiplay network 
 remarks:      -------------------------- 
 remarks:      This object can only be updated by APNIC hostmasters. 
 remarks:      To update this object  please contact APNIC 
 remarks:      hostmasters and include your organisation's account 
 remarks:      name in the subject line. 
 remarks:      -------------------------- 
 changed:      hm-changed@apnic.net
 20070801 
 mnt-by:        APNIC-HM 
 mnt-lower:     MAINT-IN-DOT 
 status:       ALLOCATED PORTABLE 
 source:       APNIC 
 route:        117.204.112.0/20 
 descr:        BSNL Internet 
 country:      IN 
 origin:       AS9829 
 mnt-lower:     MAINT-IN-DOT 
 mnt-routes:    MAINT-IN-DOT 
 mnt-by:        MAINT-IN-AS9829 
 changed:      dnw_jtotech@bsnl.in
 20070914 
 source:       APNIC 
 route:        117.204.64.0/18 
 descr:        BSNL Internet 
 country:      IN 
 origin:       AS9829 
 mnt-lower:     MAINT-IN-DOT 
 mnt-routes:    MAINT-IN-DOT 
 mnt-by:        MAINT-IN-AS9829 
 changed:      dnw_jtotech@bsnl.in
 20071207 
 source:       APNIC 
 route:        117.204.0.0/16 
 descr:        BSNL Internet 
 country:      IN 
 origin:       AS9829 
 mnt-lower:     MAINT-IN-DOT 
 mnt-routes:    MAINT-IN-DOT 
 mnt-by:        MAINT-IN-AS9829 
 changed:      dnw_jtotech@bsnl.in
 20071207 
 source:       APNIC 
 role:         NS Cell 
 address:      Internet Cell 
 address:      Bharat Sanchar Nigam Limited 
 address:      8th Floor 148-B Statesman House 
 address:      Barakhamba Road  New Delhi - 110 001 
 country:      IN 
 phone:        91-11-23734057 
 phone:        91-11-23710183 
 fax-no:       91-11-23734052 
 e-mail:       hostmaster@sancharnet.in
 
 admin-c:       CGMD1-AP 
 tech-c:        DT197-AP 
 nic-hdl:       NC83-AP 
 mnt-by:        MAINT-IN-DOT 
 changed:      dnwplg@sancharnet.in
 20030120 
 changed:      hm-changed@apnic.net
 20071227 
 source:       APNIC 
 role:         CGM Data Networks 
 address:      CTS Compound 
 address:      Netaji Nagar 
 address:      New Delhi- 110 023 
 country:      IN 
 phone:        91-11-24106782 
 phone:        91-11-24102119 
 fax-no:       91-11-26116783 
 fax-no:       91-11-26887888 
 e-mail:       dnwplg@sancharnet.in
 
 e-mail:       hostmaster@sancharnet.in
 
 admin-c:       CGMD1-AP 
 tech-c:        DT197-AP 
 tech-c:        BH155-AP 
 nic-hdl:       CDN1-AP 
 mnt-by:        MAINT-IN-DOT 
 changed:      dnwplg@sancharnet.in
 20030120 
 changed:      hm-changed@apnic.net
 20071227 
 source:       APNIC 
 route:        117.192.0.0/10 
 descr:        BSNL-VSNL Route Object 
 origin:       AS4755 
 mnt-by:        MAINT-VSNL-IN 
 changed:      ip.admin@vsnl.co.in
 20070917 
 source:       RADB 
 route:        117.192.0.0/10 
 descr:        Reliance customer-BSNL 
 origin:       AS9829 
 mnt-by:        MAINT-AS18101 
 changed:      ip.nnoc@relianceada.com
 20071207  06: 04: 30(UTC) 
 source:       RADB 

Person has maliciously edited articles to include nonsensical characters using several IP addresses Rockyman512 22:19, 26 April 2010 (UTC)

Case history
Investigated by:	Rockyman512
Contacted by:	Investigator
Closed on:	Rockyman512 ( talk) 05:49, 1 May 2010 (UTC) reply
Disposition:
Case log:	ARPrelim Rockyman512 22:05, 26 April 2010 (UTC)	OpenedRockyman512 22:05, 26 April 2010 (UTC)	117.204.112.173, is behind a firewall and cannot be traced back has a block on the packets...Contacting the ISP in the WHOIS report. Rockyman512 22:19, 26 April 2010 (UTC)	Investigation CompleteInvestigations Completed, ISP contacted. Rockyman512 23:09, 26 April 2010 (UTC)	Closed Rockyman512 ( talk) 05:49, 1 May 2010 (UTC) reply