User:NDKilla/x-wiki spam

91.200.12.0/22
The range of 91.200.12.0/24 has tripped Global filter #1 repeatedly on ATT and once on Public Test Wiki.

According to [//ripe.net Ripe.net], the problematic /24 range, but also the /22 range it is a part of (91.200.12.0-91.200.15.255) is registered to "VHOSTER-NET" which appears to be [//vhoster.net a website] that offers VPS/web(?) hosting in Ukraine. I'm not sure if they have any english support lines, but I sent an email to abuse9at)vhoster(dot)net, an address listed in the whois results.

Related local/global blocks and locks
The following are copy/pasted RC logs (from multiple wikis) relating to the IP range in question:
 * 02:58, April 25, 2016: NDKilla (publictestwiki.com) globally blocked 91.200.12.0/24 (expires on October 25, 2016 at 02:58, anonymous only) (x-wiki spam, november 2015 to now 11 diff addresses. Pending reply from abuse(at)vhoster.net) (remove | modify)
 * (Global block log); 00:46 . . NDKilla (Talk | contribs | block) removed global block on User:91.200.12.143 ‎(IP covered by rangeblock)
 * (Global block log); 00:46 . . NDKilla (Talk | contribs | block) globally blocked User:91.200.12.0/24 (anonymous only, expires 00:46, July 25, 2016) ‎(Long term abuse from november 2015 to now, editing from 91.200.12.7-91.200.12.143)
 * (Global block log); 00:33 . . NDKilla (Talk | contribs | block) globally blocked User:91.200.12.143 (expires 00:33, October 25, 2016) ‎(IP has been used by a spambot since november '15)

CU data (accounts only, no public IP information)
None currently.

46.161.9.20/24
Below is some information about the range in question. Globally blocked 2 individual IP addresses (not the range). Spam actually appears to be limited to spiral.wiki (iirc, check abuse logs).

Related local/global blocks and locks
The following are copy/pasted RC logs (from multiple wikis) relating to the IP range in question:
 * (Global block log); 21:02 . . NDKilla (Talk | contribs | block) globally blocked User:46.161.9.20 (anonymous only, expires 21:02, May 24, 2016) ‎(spambot)
 * (Global block log); 21:02 . . NDKilla (Talk | contribs | block) globally blocked User:46.161.9.24 (anonymous only, expires 21:02, May 24, 2016) ‎(spambot)

CU data (accounts only, no public IP information)
None currently.