Jump to content

Wikipedia:Abuse response: Difference between revisions

From Wikipedia, the free encyclopedia
Content deleted Content added
add information on not banning users - outwith process and certainly outwith our remit
No edit summary
Line 3: Line 3:
{{editabuselinks}}
{{editabuselinks}}
{{shortcut|[[WP:AbRep]]<br>[[WP:ABUSE]]}}
{{shortcut|[[WP:AbRep]]<br>[[WP:ABUSE]]}}
'''Wikipedia:Abuse reports''' is a centralized forum for the reporting and investigation of abuse complaints, related to [[IP address|IP]]-specific vandalism, to be reported to service providers, particularly schools and universities. Please be aware that this is ''not'' an official contact system put in place by the [[Wikimedia Foundation]], but a volunteer-run process to counter vandalism. As we are not an official system, we are '''unable to ban''' users and any requests for such a ban will be removed on site.
'''Wikipedia:Abuse reports''' is a centralized forum for the reporting and investigation of abuse complaints, related to [[IP address|IP]]-specific vandalism, to be reported to service providers, particularly schools and universities. Please be aware that this is ''not'' an official contact system put in place by the [[Wikimedia Foundation]], but a volunteer-run process to counter vandalism. As we are not an official system, we are '''unable to block''' users and any requests for such a ban will be removed on site.
<center>
<center>
{| style="margin-left: 1em; margin-bottom: 0.5em; border: #99B3FF solid 1px; clear: right" width: "730px"
{| style="margin-left: 1em; margin-bottom: 0.5em; border: #99B3FF solid 1px; clear: right" width: "730px"

Revision as of 21:16, 10 January 2007

    Wikipedia:Abuse reports is a centralized forum for the reporting and investigation of abuse complaints, related to IP-specific vandalism, to be reported to service providers, particularly schools and universities. Please be aware that this is not an official contact system put in place by the Wikimedia Foundation, but a volunteer-run process to counter vandalism. As we are not an official system, we are unable to block users and any requests for such a ban will be removed on site.

    Recently actioned    Rejected requests (since Nov 2006)

    Please note: You cannot report user accounts here (They'll be removed on sight)! Because the purpose of this is to report violators to their ISPs, usernames cannot be traced back to their providers and so will not work.

    DO NOT LIST IP ADDRESSES WITHOUT A SIGNIFICANT HISTORY OF VANDALISM! We will not go through with these requests. Make sure that the IP in question has been blocked at least five times in recent history, or the request will be rejected. Please do not clog up this board with such requests; the report will not go through.

    Process

    Please read the guide to abuse reports, a detailed how-to on using this page.

    AR cases are a three step process:

    • Alert: An attentive user notices a trend of vandalism from a given IP, runs a whois, determines that the IP is registered to a school, a government agency, or other body that is likely to respond to an abuse report, and reports the IP here.
    • Under investigation: Once made, an alert is picked up by an investigator, who creates a subpage, and begins an investigation. The investigator uses the information provided by the user who made the alert to determine if there is similar vandalism from other IP addresses registered to the same provider. The investigator then compiles a report.
    • In Contact: Once a case has been investigated and a report prepared, the case is passed to a contactor. The contactor then attempts to contact the provider either by email or by telephone, with telephone being the preferred method (as it produces greater results on average). The contactor explains the situation to the provider, and points them to the AR report. The contact remains in contact with the provider, most likely by email, to answer any further questions or provide other information required by the provider.

    Once the contactor has made contact with the provider, the case remains open as long as contact continues. If the provider successfully resolves the complaint, then the contactor closes the case, with a summary of the result. If the provider is unwilling to cooperate, the contactor notes the case, and closes it with a summary.

    Volunteer groups

    There are three classifications of AR volunteers. Users may volunteer to undertake as many roles as they like; the classification system is not intended to make users feel they cannot or should not "see a case all the way through." Rather, the intent is to allow those who are interested in one area (such as investigation) but not another (such as contacting), or who do not have the resources to serve as a contact, to participate. The classifications are:

    • Attentive user: Everyone is an attentive user; anyone can notice a pattern and raise an alert. Some users may choose to be "professional" attentive users, specifically looking for potential cases.
    • Investigators: Investigators are tasked with preparing a report on the case. They are expected to look for trends such as time of day/week/month, movement from one IP block to another, etc, and to prepare a report that can be used by the provider to identify the responsible party. The most important task in investigation is to determine if there are other IP addresses assigned to the same provider that are engaging in similar behavior, or if there are other addresses making productive contributions. This is to ensure that the provider has all the relevant information, and so legitimate contributors are not affected.
    • Contactors: Contactors are tasked with actually making contact with the provider. Some contactors may choose to do so via email, although telephone is the preferred method, as a telephone call generally receives higher priority. Making telephone calls requires the contactor to have resources to expend in this manner; not everyone can be a contact, and no user should feel embarrassed or apologetic that they are unable to perform the contactor role. Users who have time to perform alerting and investigating tasks are needed just as much as contactors!

    Current investigators

    1. Geo.plrd (talk · contribs)
    2. Voice of All (talk · contribs) (admin: en) (I can easily pull logged-out IP range contribs; I'll mainly just work with range issues.)
    3. Deon555 (talk · contribs)
    4. HawkerTyphoon (talk · contribs) Rather new at this, so keep an eye on me ;-)
    5. ST47 (talk · contribs) Also new, but I'd be happy to help out
    6. Dave (talk · contribs) Adding myself, can't see any other way of joining ;)
    7. Heligoland (talk · contribs) Adding myself, a bit involved already, it would seem :-)
    8. Centrx (talk · contribs)
    9. Andrew4010 (talk · contribs) New, but on the lookout for vandals

    Current contactors

    1. Deon555 (talk · contribs) Contact: Email, possibly phone (australia)
    2. HawkerTyphoon (talk · contribs) Contact:Email, UK Phone, in person UK Midlands
    3. SMC (talk · contribs) Contact: Email.
    4. ST47 (talk · contribs) I can do this(via email) if there's a backlog
    5. Dave (talk · contribs) Adding myself, can't see any other way of joining ;)
    6. Wikimachine (talk · contribs) I can write elaborate and formal letters.
    7. Colin Keigher (talk · contribs) Contact: phone (N. America), e-mail, direct to certain ISPs (I work for a few)
    8. Cnota (talk · contribs) Contact: phone (US) and email worldwide. Here to help!
    9. Heligoland (talk · contribs) Contact: post and phone (UK) and e-mail (worldwide).
    10. Davidjk (talk · contribs) Contact: UK phone/fax, UK post, e-mail
    11. Rgenung (talk · contribs) Contact: Canada/US phone, email, possible postal in North America
    12. CyclePat (talk · contribs) AMA upon request. Phone: Canada. Email: Yes Postal: I hope not! (Since Dec 2006)

    New Alerts

    Please follow the instructions below. Please do not list IPs that have only made a few edits (unless they are part of a bigger case), as only severe, continuing vandalism should be listed here.

    To report an IP address

    1. Replace IP with the IP address you are reporting in the box below and click the button.
    2. For a range of IP addresses, use the format 127.0.0.x Range and for two or more ranges use the format 127.0.0.x and 192.168.0.x Ranges however when filling in {{IPvandal}} you will need to add each IP address one by one. When reporting ranges, unless every IP in that range has vandalised, please replace the last digits with an x. There's no need to report different ranges if the IP addresses are sufficently similar or run consecutively, 192.168.0.1 and 192.168.10.1 as an example.
    3. Edit the resulting page and provide a summary of why you believe the IP address requires attention. Please use the {{IPvandal}} template for all IP addresses, provide a link to the whois, list the name of the provider (from the whois report), and briefly summarize the situation. Save the page.
    4. Edit this page, adding the following text above the most recent nomination (replacing IP with the IP address you're reporting):
      ===={{IPvandal|IP}}====
      {{Wikipedia:Abuse reports/IP}}

    Continuous vandalism to over 10 articles in the past 3 months. See the user:talk page for the history. This is a shared IP from a public library in Danville, Illinois, but the vandalism has been so continuous from this IP, that I think it's time to block it permanently.jeff.lopez-stuit 19:51, 5 January 2007 (UTC)[reply]

    This is an archived case at Abuse Response.
    The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes.
    You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.


    Continuous vandalism despite history of blocks and final warning. Vandalism includes about 100 edits from April 2006 to January 4, 2007. The IP is registered to "Orleans Parish Public School" in New Orleans, LA. as well as "Cox Communications Inc."



    Discussion

    Registration Information

    Orleans Parish Schools, Louisiana, Phone # 504-304-5680

    Initial Report

    The users seem to be on around 1500-1800 UT. There have been over 100 edits in the last 8 months. Per above, the provider is Cox Communications. The IP has been blocked four times. There have been many warnings, and the articles that are vandalised have no known pattern.

    WHOIS Report

    Using 1 day old cached answer (or, you can get fresh results). Hiding E-mail address (you can get results with the E-mail address).

    Cox Communications Inc. COX-NET-2BLK (NET-66-210-0-0-1)

                                     66.210.0.0 - 66.210.255.255
    

    Orleans Parish Public School OFF-66-210-229-0 (NET-66-210-229-0-1)

                                     66.210.229.0 - 66.210.229.255
    
    1. ARIN WHOIS database, last updated 2007-02-02 19:10
    2. Enter ? for additional hints on searching ARIN's WHOIS database

    Abuse Report

    Blocked four times, the least three hours, the most one week. Persistent vandalism.

    This case was investigated by Wikipedian27 (talk · contribs).

    Contact summary

    Contact being made by Darkwind (talk · contribs).

    1. Email sent to abuse AT nops.k12.la.us based on Google search results. If no response, will e-mail abuse@cox.net. 22:13, 5 September 2007 (UTC)
    2. Email bounced. Re-sent to webmaster AT nops.k12.la.us. 22:43, 5 September 2007 (UTC)
    3. Email bounced again, re-sent to abuse AT cox.net. 01:23, 6 September 2007 (UTC)
    4. Received reply from abuse AT cox.net, advising that they do not see this to be a cox.net IP address. Reply sent back to abuse AT cox.net clarifying the WHOIS information and asking for a more specific contact. 02:04, 6 September 2007 (UTC)
     no response to second e-mail to ISP, can reopen if vandalism continues. --Darkwind (talk) 22:43, 12 September 2007 (UTC)[reply] 
    
    This is an archived case at Abuse Response.
    The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes.
    You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.



    Discussion Anonymous IP used to vandalize multiple pages. Vandalized World of Warcraft Trading Card Game most recently after multiple warnings on their talk page against abuse. Dugwiki 17:37, 4 January 2007 (UTC)[reply]

    I've looked at the blocklog, and, I only see one block which was issued on 24 January 2007 by User:Can't sleep, clown will eat me. - Nick125 05:57, 9 February 2007 (UTC)[reply]
    This is an archived case at Abuse Response.
    The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes.
    You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.



    Discussion This user has been warned many times for vandalism. ArthurWeasley 20:58, 3 January 2007 (UTC)[reply]

    This is an archived case at Abuse Response.
    The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes.
    You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.


    and User:89.0.167.76 and User:89.0.143.220 see dif: [1]


    Discussion

    Repeated vandalism of articles and personal attacks of User:Nwwaew. Openly flaunts his ability to change IPs to avoid blocking. See dif: [2]. --Jayron32 04:46, 30 December 2006 (UTC)[reply]

    This is an archived case at Abuse Response.
    The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes.
    You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.



    Discussion

     IP was indefinitely blocked back in February '07. --Darkwind (talk) 22:20, 5 September 2007 (UTC)[reply]
    
    This is an archived case at Abuse Response.
    The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes.
    You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.


    Long term history of vandalism. Maybe a soft block or something. -- ßottesiηi (talk) 16:35, 20 December 2006 (UTC)[reply]


    Discussion


    Report Location Investigator & When commenced ISP Name ISP Location Comments
    Wikipedia:Abuse reports/72.1.206.10  Thorncrag  07:57, 6 January 2010 (UTC)[reply] Ottawa Carleton District School Board Ottawa, Canada


    Blocked eight times.

    {{SharedIPEDU|Ottawa Carleton District School Board}}

    Accepted 16:20, 30 August 2007 (UTC), placed on hold until vandalism resumes. --ST47Talk·Desk 16:20, 30 August 2007 (UTC)[reply]

    This is an archived case at Abuse Response.
    The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes.
    You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.



    Discussion Added a bunch of false information to articles on Friday, and added similar false information to some of the same articles today. Joltman 14:06, 18 December 2006 (UTC)[reply]

    This is an archived case at Abuse Response.
    The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes.
    You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.



    Discussion This IP is only ever used for vandalism. It is registered to the Gilford School District. Can something further be done? --Bob 18:41, 13 December 2006 (UTC)[reply]

    Registration Information

    Gilford School District- gsd@gilford.k12.nh.us

    Initial Report

    Upon investigation, this IP address has been blocked five times, and it is registered to the Gilford School District in New Hampshire. It has very few positive contributions, and many warnings. The IP is registered to Gilford, but the organization is called the Destek Group. The users seem to be on around 1200-1900 UT, but more often 1300-1700 UT.

    WHOIS report

    OrgName: Friends of Synergytics OrgID: DTEK Address: The Destek Group Inc. Address: 1 Indian Head Plaza City: Nashua StateProv: NH PostalCode: 03060 Country: US

    NetRange: 207.228.192.0 - 207.228.223.255 CIDR: 207.228.192.0/19 NetName: DESTEK-207BLK NetHandle: NET-207-228-192-0-1 Parent: NET-207-0-0-0-0 NetType: Direct Allocation NameServer: NS.DESTEK.NET NameServer: NS2.DESTEK.NET Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE RegDate: 1996-10-31 Updated: 2000-04-24

    RTechHandle: DH3-ORG-ARIN RTechName: The Destek Group, Inc. RTechPhone: +1-603-594-9630 RTechEmail: **********@destek.net

    OrgTechHandle: DH3-ORG-ARIN OrgTechName: The Destek Group, Inc. OrgTechPhone: +1-603-594-9630 OrgTechEmail: **********@destek.net

    1. ARIN WHOIS database, last updated 2007-02-03 19:10
    2. Enter ? for additional hints on searching ARIN's WHOIS database.

    Abuse report

    This case was investigated by Wikipedian27 (talk · contribs).

    This IP has been blocked five times, and received many warnings.

    Contact

    Emailed gsd@gilford.k12.nh.us ST47Talk 18:22, 4 February 2007 (UTC)[reply]

    Blocked by overzealous spam filter, trying hostmaster@destek.net ST47Talk 21:16, 4 February 2007 (UTC)[reply]
    Received reply asking for exact dates and times ST47Talk 21:36, 4 February 2007 (UTC)[reply]
    Sent reply with part of the user's contribution log and with the block log. ST47Talk 11:36, 5 February 2007 (UTC)[reply]
    This is an archived case at Abuse Response.
    The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes.
    You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.



    Discussion Another vandalistic school IP, has incurred more than a dozen blocks, the latest ones for a month each. Registered to Oakland Schools, Michigan. ([3]) Fut.Perf. 13:19, 6 December 2006 (UTC)[reply]

    Registration Information

    Register to Oakland County, Michigan Schools.

    • Contact-

    Oakland Schools 2111 Pontiac Lake Road Waterford, MI 48328 or

    Phone #(248)209-2000

    Initial Report

    The IP has been blocked 20 times, and unblocked without completing ban by an administrator once. You must understand that the county has 1,214,361 in it, thus having a high number of schools; we have not been able to determine how many IPs the system has, but it is possible that this is the only one. It has a long history of editing abuse, its most recent negative contribution being to the article Janet Jackson. Seems to like to vandalise from 1300-1800 UT. So far, I haven't found one positive contribution.

    WHOIS Report

    • OrgName: Oakland Schools
    • OrgID: OAKLAN-5
    • Address: 2111 Pontiac Lake Rd
    • City: Waterford
    • StateProv: MI
    • PostalCode: 48328
    • Country: US
    • NetRange: 216.11.0.0 - 216.11.255.255
    • CIDR: 216.11.0.0/16
    • NetName: 2000ONE-NET
    • NetHandle: NET-216-11-0-0-1
    • Parent: NET-216-0-0-0-0
    • NetType: Direct Assignment
    • NameServer: DONALDD.OAKLANDSCHOOLS.NET
    • NameServer: DARWIN.OAKLANDSCHOOLS.NET
    • Comment:
    • RegDate: 1999-10-05
    • Updated: 2007-02-02
    • OrgTechHandle: NOC2107-ARIN
    • OrgTechName: Network Operation Center
    • OrgTechPhone: +1-248-209-2060
    • OrgTechEmail: noc@oakland.k12.mi.us

    Abuse Summary

    Blocked 20 times, multiple warnings, 3 blocks in the last two months. Copy of all contributions can be viewed here.

    This case was investigated by Wikipedian27 (talk · contribs).

    Contact summary

    Contact being made by Darkwind (talk · contribs).

    1. E-mail sent to OrgTechEmail. 21:53, 5 September 2007 (UTC)
      1. No response to e-mail; marking actioned due to the age of the report. 22:42, 12 September 2007 (UTC)
     no response to e-mail, can reopen if vandalism continues. --Darkwind (talk) 22:42, 12 September 2007 (UTC)[reply]
    
    This is an archived case at Abuse Response.
    The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes.
    You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.

    User is disrupting many pages with the same kinds of vandalisation. The common theme is either "insert-user-name-here" is a Federal CLOWN (usually caps) followed by random additional accuations of being federal agents. This has morphed into "insert-user-name-here" is fellating George W. Bush. IP-drifts to avoid blocks, and also moves through various pages to avoid sprotect. Most recent activity on various pages of the Village Pump. --Jayron32 07:06, 1 December 2006 (UTC)[reply]

    I have contacted the ISP, and awaiting a response. (CC'ed the foundation) Will keep pursuing this. --Aude (talk) 23:18, 1 December 2006 (UTC)[reply]
    Additionally, there appears to be another sockpuppet for this user, specifically User:VIUlyanov. The evidence that this user is the same as the above is found at this discussion at ANI --Jayron32 06:45, 3 December 2006 (UTC)[reply]

    You may want to call in the checkusers on this one, see Wikipedia:Requests for checkuser/Case/Cplot. MER-C 10:00, 19 December 2006 (UTC)[reply]

    For my first case, I attempted a phone call to:
    TechHandle: DRW52-ARIN
    TechName: Williams, David R
    TechPhone: +1-913-315-4685
    TechEmail: ****************@sprint.com
    There is no voice box capability. So I called his superior:
    AdminHandle: MBB14-ARIN
    AdminName: Bengero, Mirella B
    AdminPhone: +1-703-689-8632
    AdminEmail: *****************@sprint.com
    I just left a voice message with my contact information "regarding" abuse. Someone should continue further investigation on the ISP's contract agreements with special attention to "abusive behaviour and internet trolling." --CyclePat 00:41, 31 December 2006 (UTC)[reply]
    This is an archived case at Abuse Response.
    The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes.
    You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.



    Discussion Talk page shows long history of abuse warnings, user contributions history shows recent active vandalism, block log shows a 3-month block of this IP starting in May. Peter G Werner 19:21, 11 December 2006 (UTC)[reply]

    not a priority, but when the backlog dies down someone should take this one. ST47Talk 15:22, 29 December 2006 (UTC)[reply]

    Open Cases

    This is an archived case at Abuse Response.
    The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes.
    You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.



    Discussion All the edits of this IP are changing names and dates in random articles, sometimes adding silly obsenities. It may be school IP, I can't check it out. If this is not the proper place to report this, please help report it to the appropriate place. Hoverfish 14:14, 29 November 2006 (UTC)[reply]

    Students from Jefferson Schools, whose website is here.[4]. Basically looked up their IP and the name "Jefferson Schools" popped up. Googled it. Found a website. Pinged the website to get their IP. Matched it. Sorry about posting this all here, but i didn't know what else to do. This is my first time doing this. Quite exciting. Gab.popp 11:03, 22 January 2007 (UTC)[reply]

    This is an archived case at Abuse Response.
    The page you are viewing is an archived case (or possibly other) page located at Abuse Response. It is no longer used but is preserved for archival purposes.
    You may observe anomalies, inconsistencies, or other general weirdness, which is to be expected. No warranty of usefulness or satisfaction implied.



    Discussion
    Not available at this time. Andrew4010 00:57, 22 January 2007 (UTC)[reply]

     Stale.   bsmithme  01:05, 22 August 2009 (UTC)[reply]
    

    User replacing legitimite content with jokes. EOBeav 04:40, 3 December 2006 (UTC)[reply]

    Under Investigation

    Please do not move alerts into this section unless you are the investigator opening a new case.


    Report Location Investigator Contact Status Update
    Wikipedia:Abuse reports/72.10.100.34 User:Andrew4010 Awaiting Contactor Assignment Done Investigating 26-Nov-06

    Report Location Investigator Contact Status Update
    Wikipedia:Abuse reports/142.240.200.10 User:Andrew4010 Investigating 27-Nov-06

    Report Location Investigator Contact Status Update
    Wikipedia:Abuse reports/193.63.62.188 User:Andrew4010 Investigating 27-Nov-06

    Report Location Investigator Contact Status Update
    Wikipedia:Abuse reports/216.11.222.21 User:Andrew4010 Investigating 27-Nov-06

    In Contact

    Please do not move alerts into this section unless you are the investigator passing the case on to a contactor.


    Report Location Investigator Contact Status Update
    Wikipedia:Abuse reports/209.122.160.124 User:ST47 User:ST47 Investigation in progress 122906


    ISP - TV Cable S.A

    Report Location Investigator Contact Status Update
    Wikipedia:Abuse reports/TV Cable S.A User:Heligoland Spanish speaking user needed to contact ISP Not Contacted ISP
    Report Location Investigator Contact Status Update
    Wikipedia:Abuse reports/213.249.155.251 User:ST47 User:SMC Pending 22-Oct-06

    Rejected requests

    All rejected requests are now archived here for easy retrieval as necessary - Wikipedia:Abuse reports/Rejected

    See also