Misplaced Pages

Revision as of 06:04, 19 October 2006

• ]

Misplaced Pages:Abuse reports is a centralized forum for the reporting and investigation of abuse complaints, related to IP-specific vandalism, to be reported to service providers, particularly schools and universities. Please be aware that this is not an official contact system put in place by the Wikimedia Foundation, but a volunteer-run process to counter vandalism.

Please note: You cannot report user accounts here (They'll be removed on sight)! Because the purpose of this is to report violators to their ISPs, usernames cannot be traced back to their providers and so will not work.

DO NOT LIST IPS WITHOUT A SIGNIFICANT HISTORY OF VANDALISM! We will not go through with these requests. Make sure that the IP in question has been blocked at least five times in recent history, or the request will be rejected. Please do not clog up this board with such requests, the report will not go through.

Process

Please read the guide to abuse reports, a detailed how-to on using this page.

AR cases are a three step process:

• Alert: An attentive user notices a trend of vandalism from a given IP, runs a whois, determines that the IP is registered to a school, a government agency, or other body that is likely to respond to an abuse report, and reports the IP here.

• Under investigation: Once made, an alert is picked up by an investigator, who creates a subpage, and begins an investigation. The investigator uses the information provided by the user who made the alert to determine if there is similar vandalism from other IP addresses registered to the same provider. The investigator then compiles a report.

• In Contact: Once a case has been investigated and a report prepared, the case is passed to a contactor. The contactor then attempts to contact the provider either by email or by telephone, with telephone being the preferred method (as it produces greater results on average). The contactor explains the situation to the provider, and points them to the AR report. The contact remains in contact with the provider, most likely by email, to answer any further questions or provide other information required by the provider.

Once the contactor has made contact with the provider, the case remains open as long as contact continues. If the provider successfully resolves the complaint, then the contactor closes the case, with a summary of the result. If the provider is unwilling to cooperate, the contactor notes the case, and closes it with a summary.

Volunteer groups

There are three classifications of AR volunteers. Users may volunteer to undertake as many roles as they like; the classification system is not intended to make users feel they cannot or should not "see a case all the way through." Rather, the intent is to allow those who are interested in one area (such as investigation) but not another (such as contacting), or who do not have the resources to serve as a contact, to participate. The classifications are:

• Attentive user: Everyone is an attentive user; anyone can notice a pattern and raise an alert. Some users may choose to be "professional" attentive users, specifically looking for potential cases.

• Investigators: Investigators are tasked with preparing a report on the case. They are expected to look for trends such as time of day/week/month, movement from one IP block to another, etc, and to prepare a report that can be used by the provider to identify the responsible party. The most important task in investigation is to determine if there are other IP addresses assigned to the same provider that are engaging in similar behavior, or if there are other addresses making productive contributions. This is to ensure that the provider has all the relevant information, and so legitimate contributors are not affected.

• Contactors: Contactors are tasked with actually making contact with the provider. Some contactors may choose to do so via email, although telephone is the preferred method, as a telephone call generally receives higher priority. Making telephone calls requires the contactor to have resources to expend in this manner; not everyone can be a contact, and no user should feel embarrassed or apologetic that they are unable to perform the contactor role. Users who have time to perform alerting and investigating tasks are needed just as much as contactors!

Current investigators

1. Essjay (talk · contribs) (admin: commons, en, meta, wikiquote; CheckUser) (Coordinating/supporting where I'm needed, but not doing full-time investigating or contacting right now.)
2. Snoutwood (talk · contribs) (admin: en) (Same as Essjay.)
3. Shanel (talk · contribs) (admin: en)
4. lightdarkness (talk · contribs) (admin: en, wikispecies)
5. Werdna648 (talk · contribs)
6. Drini (talk · contribs) (admin: en)
7. Petros471 (talk · contribs) (admin: en)
8. Kilo-Lima (talk · contribs) (admin: en; Quite busy right now with other articles, but will try and help out Iolakana| 14:11, 2 July 2006 (UTC))
9. User-multi error: "Can't sleep, clown will eat me" is not a valid project or language code (help). (admin: en)
10. Sceptre (talk · contribs) (admin: en)
11. Jaranda (talk · contribs)
12. Geo.plrd (talk · contribs)
13. User-multi error: "Knowing Is Half The Battle" is not a valid project or language code (help).
14. Voice of All (talk · contribs) (admin: en) (I can easily pull logged-out IP range contribs; I'll mainly just work with range issues.)
15. Deon555 (talk · contribs)
16. HawkerTyphoon (talk · contribs) Rather new at this, so keep an eye on me ;-)
17. TehBrandon (talk · contribs) New to this, point out the mistakes I make please :)
18. Nwwaew (talk · contribs) New also, please point out what I can improve!

Current contactors

1. Essjay (talk · contribs) (admin: commons, en, meta, wikiquote; CheckUser) Contact: phone (U.S.), e-mail (Coordinating/supporting where I'm needed, but not doing full-time investigating or contacting right now.)
2. Snoutwood (talk · contribs) (admin: en) Contact: e-mail (Same as Essjay.)
3. Deskana (talk · contribs) (admin: en) Contact: phone (UK), e-mail (very busy doing other things, regrettably)
4. Petros471 (talk · contribs) (admin: en) Contact: e-mail, possibly phone (UK)
5. Sunholm (talk · contribs) Contact: phone (UK), e-mail Note - account compromised and indefinitely blocked
6. User-multi error: "Can't sleep, clown will eat me" is not a valid project or language code (help). (admin: en) Contact: phone (US-all), e-mail
7. User-multi error: "Knowing Is Half The Battle" is not a valid project or language code (help). Contact: phone (US), e-mail, US postal service
8. Deon555 (talk · contribs) Contact: Email, possibly phone (australia)
9. HawkerTyphoon (talk · contribs) Contact:Email, UK Phone, in person UK Midlands
10. Nwwaew (talk · contribs) Contact: Email. I'm new, so please point out things that I can improve!

New Alerts

Please list your alert immediately below this message, in a new section using === ===. Please use the {{IPvandal}} template for all IP addresses, provide a link to the whois, list the name of the provider (from the whois report), and briefly summarize the situation. Please do not list IPs that have only made a few edits (unless they are part of a bigger case), as only severe, continuing vandalism should be listed here.

67.140.80.142 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)

WHOIS info: Windstream Communications Inc (NET-67-140-0-0-1) 67.140.0.0 - 67.141.255.255 Chardon Internet POP - Dynamic DSL Pool 67-140-80-0 (NET-67-140-80-0-1) 67.140.80.0 - 67.140.95.255

• Note: one the subjects of article lives in Chardon, OH. very possibly self-promoting.

Summary of abuse: Repeated and immediate reverting of band page NPOV article (up to 7 times in one day), to band's own version, which includes changing dates, changing context of what is true fact to text that is subtly misleading to promote new projects and remove credits of past members, removing credits and references of other contributor's past work, removing press references for my contributions to article (older press references tell of a different history than what band is currently promoting), attempts to actually change history in order to self-promote a different line-up (calling it clean up or claiming to be removing vandalism), advertising using wiki to cross-link with other businesses to self-promote.

Warnings posted to User_talk:67.140.80.142 are completely ignored. My nomination for NPOV by another signed user was also ignored and overwritten.

Other IPs that are also reverting from verifiable to promotional text with no other contribs include:

67.140.88.100 (whois indicates same name server as 67.140.80.142)

162.40.56.12 (cross-promo link added, no other contribs)

67.140.91.39 (cross-promo link added, no other contribs)

Recommend locking page to version until IP vandals go away. Oroboros 1 06:04, 19 October 2006 (UTC)

203.26.122.12 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)

Provider info from WHOIS: netname: SOUTHERNSYS-AU descr: Southern Systems (S.A. Government) person: Jim Greig address: Statelink address: P.O. Box 3036 address: Grenfell Street address: Adelaide 5000 country: AU phone: +61 8 226 7162

Summary of complaints: severe continuing vandalization over a long period of time (Since Oct 2005), continuing now with attempted password changes against random user. Fully detailed with LOTS of warnings and threats to block, at http://en.wikipedia.org/User_talk:203.26.122.12

213.249.155.251 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log)

Provider info from WHOIS: inetnum: 213.249.155.0 - 213.249.155.255 netname: EMBC-KCOM descr: East Midlands Broadband Consortium descr: Internet access for schools country: GB admin-c: KR2955-RIPE tech-c: KR2955-RIPE rev-srv: ibex.kcom.com rev-srv: bison.kcom.com status: ASSIGNED PA remarks: *** Please send abuse complaints to Email address protected from spam harvesters ONLY **

Summary of complaints: continuing low level vandalism since September 2006, 13 attacks so far today for example. Yorkshiresky 15:18, 18 October 2006 (UTC)

Open Cases

Under Investigation

Please do not move alerts into this section unless you are the investigator opening a new case.

61.69.12.11 - 61.69.12.20

• 61.69.12.11 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) 17 blocks, totalling 2,459 hours.
• 61.69.12.12 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) 17 blocks, totalling 1,581 hours.
• 61.69.12.13 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) 14 blocks, totalling 442 hours, (plus current 6 month block).
• 61.69.12.14 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) 16 blocks, totalling 1,813 hours.
• 61.69.12.15 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) 10 blocks, totalling 1,591 hours Indefinetly blocked.
• 61.69.12.16 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) 18 blocks, totalling 1,135 hours, (plus current 6 month block).
• 61.69.12.17 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) 14 blocks, totalling 1,381 hours, (plus current 3 month block).
• 61.69.12.18 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) 12 blocks, totalling 7,392 hours.
• 61.69.12.19 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) 14 blocks, totalling 1,350 hours, (plus current 6 month block).
• 61.69.12.20 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) 09 blocks, totalling 1,279 hours.

Total: 141 blocks, totalling 20,693 hours (plus various 3/6 month blocks (15120 hrs)): GRAND TOTAL: 35,813 HOURS

This has to be the worst case of range vandalism I've seen yet.. They have blanked, made nonsense edits, deleted info, been rude.. The entire range are school IP's are are registered to the Catholic Education Office, Melbourne. As a investigator and contactor here at AbRep, I would prefer if I was to handle this case. I have been a student at one of the aforementioned schools, and would be happy to take it. — Deon555_Review 02:08, 17 October 2006 (UTC)

Now gathering "evidence" in the form of diffs, and organising block logs etc.. — Deon555_Review 02:11, 17 October 2006 (UTC)

Refer to /61.69.12.xx range for details.

In Contact

Please do not move alerts into this section unless you are the investigator passing the case on to a contactor.

Rejected requests

These requests have been rejected, and will be archived after several days.

162.83.8.18

• 162.83.8.18 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) - Shared school IP. Been warned many times, only blocked once despite many warnings stating they would be blocked. Been actively vandalizing recently, having just vandalized the Solifugae page in a deceptive manner, that page requiring specific attention as I am not clear on the specific turnaround policies here (I apologize if I am doing this incorrectly).
  • Not a long-term problem. According to whois, it is a Verizon IP. —Centrx→talk • 19:20, 15 October 2006 (UTC)
  • Declined - Only Blocked Once Knowing Is Half The Battle 04:25, 17 October 2006 (UTC)

See also

• Misplaced Pages:Administrator intervention against vandalism
• Misplaced Pages:Vandalism

• Abuse reports