User:NDKilla/x-wiki spam

From Miraheze Meta, Miraheze's central coordination wiki

91.200.12.0/22[edit source]

The range of 91.200.12.0/24 has tripped Global filter #1 (private) repeatedly on ATT, BGO Wiki and Public Test Wiki. Also, all but one of the entries in the PFL Wiki Abuse Log were from this range for the same global filter.

According to Ripe.net, the problematic /24 range, but also the /22 range it is a part of (91.200.12.0-91.200.15.255) is registered to "VHOSTER-NET" which appears to be a website that offers VPS/web(?) hosting in Ukraine. I'm not sure if they have any english support lines, but I sent an email to abuse(at)vhoster(dot)net, an address listed in the whois results. I never received a reply from the web host, so any abusive activity from this range may be blocked as needed.

Related local/global blocks and locks[edit source]

The following are copy/pasted RC logs (from multiple wikis) relating to the IP range in question:

  • (Block log); 02:56 . . NDKilla (Talk | contribs | block) unblocked 91.200.12.106 (Talk) ‎(covered by range block)
  • (Block log); 02:56 . . NDKilla (Talk | contribs | block) unblocked 91.200.12.141 (Talk) ‎(covered by range block)
  • (Block log); 02:56 . . NDKilla (Talk | contribs | block) blocked 91.200.12.0/24 (Talk) with an expiry time of 6 months (anonymous users only) ‎(anon only local block of globally blocked ip until I get a reply from the domain's abuse@ or they request an unblock (with reason))
  • (Block log); 20:12 . . NDKilla (Talk | contribs | block) blocked 91.200.12.141 (Talk) with an expiry time of 6 months (account creation disabled) ‎(gbl blocked IP. Please use your talk page only to appeal the block.)
  • (Block log); 20:12 . . NDKilla (Talk | contribs | block) blocked 91.200.12.106 (Talk) with an expiry time of 6 months (account creation disabled) ‎(gbl blocked IP. Please use your talk page only to appeal the block.)
  • (Global block log); 04:58 . . NDKilla (Talk | contribs | block) modified the global block on User:91.200.12.0/24 (anonymous only, expires 02:58, October 25, 2016) ‎(x-wiki spam, november 2015 to now 11 diff addresses. Pending reply from abuse(at)vhoster.net)
  • (Global block log); 00:46 . . NDKilla (Talk | contribs | block) removed global block on User:91.200.12.143 ‎(IP covered by rangeblock)
  • (Global block log); 00:46 . . NDKilla (Talk | contribs | block) globally blocked User:91.200.12.0/24 (anonymous only, expires 00:46, July 25, 2016) ‎(Long term abuse from november 2015 to now, editing from 91.200.12.7-91.200.12.143)
  • (Global block log); 00:33 . . NDKilla (Talk | contribs | block) globally blocked User:91.200.12.143 (expires 00:33, October 25, 2016) ‎(IP has been used by a spambot since november '15)

CU data (accounts only, no public IP information)[edit source]

A get-users CheckUser on loginwiki revealed that there are currently no users with accounts that are affected by the global block on 91.200.12.0/24

Other misc stuff[edit source]

  • (Abuse Filter log); 03:43 . . NDKilla (Talk | contribs | block) modified Special:AbuseFilter/9 (details) ‎
    • This filter has a regex that logs any time the username of an editor matches the /22 block in question. It is global, hidden, and only logs the filter trips (it allows actions etc).

46.161.9.20/24[edit source]

Below is some information about the range in question. Globally blocked 2 individual IP addresses (not the range). Spam actually appears to be limited to spiral.wiki (iirc, check abuse logs).

After the initial block expired, a few abuse logs happened to show up again, additionally from others in the range.

Related local/global blocks and locks[edit source]

The following are copy/pasted RC logs (from multiple wikis) relating to the IP range in question:

  • (Global block log); 14:03 . . NDKilla (talk | contribs | block) globally blocked User:46.161.9.0/24 (anonymous only, expiration 14:03, March 20, 2017) ‎(Spambots (some of which are already blocked))
  • (Global block log); 21:02 . . NDKilla (Talk | contribs | block) globally blocked User:46.161.9.20 (anonymous only, expires 21:02, May 24, 2016) ‎(spambot)
  • (Global block log); 21:02 . . NDKilla (Talk | contribs | block) globally blocked User:46.161.9.24 (anonymous only, expires 21:02, May 24, 2016) ‎(spambot)

CU data (accounts only, no public IP information)[edit source]

No CUs performed.

Retrieved from "https://meta.miraheze.org/wiki/User:NDKilla/x-wiki_spam?oldid=19295"