Wikipedia:Long-term abuse/Hydro dot net

Add links
From Wikipedia, the free encyclopedia
Hydro dot net
WikilifespanNovember 2014 – 2019
ISPMostly various Japanese ISPs
Known IPsOver 200 related IPs so far
Physical locationMostly Japan; some IPs in Bermuda and United Kingdom
InstructionsSuspected socks should be tagged and reported to sockpuppet investigations for confirmation. When reporting, please link to this long-term abuse report. When the active abuse has been taken care of, please update this report with the latest information.
StatusArchived

Basic information[edit]

The "hydro dot net" editor has been using IP-hopping since at least November 2014, to engage in disruptive editing. As of August 2018, contributors to this page have identified over 200 IP addresses that appear to have been involved.

As of August 2018, the editor is not known to have registered any usernames.

ISPs[edit]

c. August 2018, "hydro dot net"'s IP addresses are often in the range 126.0.0.0/8 (which, according to WHOIS, belongs to the SoftBank Group of Japan).

Targeted areas, pages, themes[edit]

The editor was given the nickname "hydro dot net" by Intgr (who created this LTA page), after Intgr had noticed that the editor had made several edits alleging that the hydro.net domain name had been hijacked. The allegations featured a conspiracy involving payment providers, domain registrars, ICANN, etc. (User:Intgr was not able, through Google searches, to find any WP:RS about these allegations. Despite many requests, the editor has not provided any useful ones.)

Additionally, the user has made contentious edits or edit summaries across numerous topics.

"Hydro dot net" often posts and wages edit wars for unsourced content or for content that misrepresents sources. The edits and edit summaries are often somewhat incomprehensible.

Also frequent is introducing references to "cybercrime", "domain hijacking" etc. into articles.

There have been a few other spurts of abuse by these IPs, adding content that misrepresents cited sources, but relatively infrequent.

The table below is a work in progress attempt to summarise the user's disruptive activities.

Page Page category (roughly) Topic of disruptive edit or edit summary
hydro.net Israel Police China Markham family
Axis Bank Financial [1]
EBS Financial [2]
Talk:EBS Financial [3] [4] [5]
Ingenico Financial [6]
Ingenico CEO Philippe Lazare Financial [7]
One Churchill Place Financial [8]
Amdocs Technology [9]
Endurance International Group Technology [10]
ICANN Technology [11] [12]
Sybase Technology [13]
Sybase CEO Mitchell Kertzman Technology [14]
Trustwave Holdings Technology [15] [16] [17]
Convention on Cybercrime Crime(-fighting) [18]
Talk:Convention on Cybercrime Crime(-fighting) [19]
Cybercrime Crime(-fighting) [20]
Talk:Cybercrime Crime(-fighting) [21] [22]
Domain hijacking Crime(-fighting) [23] [24]
Talk:Domain hijacking Crime(-fighting) [25] [26] [27]
Electronic Transaction Aggregation & Analysis Layer Crime(-fighting) [28]
European Arrest Warrant Crime(-fighting) [29] [30]
European Cybercrime Centre Crime(-fighting) [31]
Talk:Europol Crime(-fighting) [32] [33]
Illegal settlements Crime(-fighting) [34]
Talk:International_Cybercrime_Reporting_and_Cooperation_Act Crime(-fighting) [35]
Interpol Crime(-fighting) [36]
Talk:Interpol Crime(-fighting) [37] [38]
Edward Snowden Surveillance [39][40] [41]
News International phone hacking scandal Surveillance [42]
Beryl Markham Aviation [43][44][45]
Wikipedia talk:Community health initiative on English Wikipedia/Per-user page, namespace, and upload blocking Wikipedia itself [46]

Habitual behavior[edit]

Distinctive edit summaries. IPs occasionally post on each others' talk pages ([47], [48] [49]), revert each others' edits (e.g. [50]) or reply to each others' talk page messages to make it seem they are legitimate distinct editors. But it's not very plausible, the editing patterns are just too similar.

There are also some unrelated edits that look like good faith edits on the surface, but mostly they're not desirable and get reverted anyway.

The user's edits were:

  • mostly made in 2018;
  • often made to overlapping sets of articles;
  • often similar to each other in nature (e.g. inserting unrelated "See also" wikilinks; invoking conspiracy theories, especially re: surveillance, internet, police or military technologies, or about identity politics; expressing anti-Israel, anti-Blair, anti-Muslim, pro-Thatcher or pro-EDL opinions; making disparaging remarks about other editors; pretending to perform anti-vandalism activities; editing their own or each others' talk pages); sorting lists by alphabetical order; and
  • often disruptive (e.g. inserting unsourced or poorly-sourced claims; breaking links; disrupting sentence structure).

Cases[edit]

Other notes[edit]

  • A full range block for SoftBank's /8 would remove this editor's primary means of access to Wikipedia (as of August 2018). However, MediaWiki software does not allow IP rangeblocks on IPv4 ranges larger than /16.

The largest IPv4 range block that can be made is /16. The system will reject anything larger. The most common range block is /24. Anything larger usually requires extra scrutiny, although ranges vary widely in activity.

— Bbb23, talk page discussion, August 2018
  • User:Rich Farmbrough kindly created edit filter 929. It would probably benefit from having additional strings added to match more terms that are popular with the user, e.g. "Israel", "nation", etc.

Confirmed and suspected IP addresses[edit]

Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Long-term_abuse/Hydro_dot_net&oldid=1036978547"