Wikipedia talk:Abuse response/Archive 4

Archive 1

Archive 2

Archive 3

Archive 4

Archive 5

Telephone vs. email

I cannot see why it is prefered to call the ISPs when a great many of them demand that complaints be sent to their abuse departments via email. GO-PCHS-NJROTC (talk) 17:50, 26 January 2008 (UTC)

Telephoning is friendlier.Cuddlyable3 (talk) 05:57, 6 May 2008 (UTC)

Actually, in some cases, calling ISPs and ITS departments is better when they'll accept a report over the phone, but a great many major ISPs insist on using the email system or mailing them a complaint when issues can't be resolved by email. One exception is Embarq. — Preceding unsigned comment added by PCHS-NJROTC (talk • contribs) 18:50, 22 December 2008 (UTC)

Peremptory pruning

The sudden relegation of many volunteers (myself included) to the ranks of suspected duds seems uncalled for and is incompatible with WP:AGF. Has any of these persons who have volunteered their valuable time and effort, and who in many cases are active wikipedians, been asked to do anything and failed to do so? I have not. Cuddlyable3 (talk) 14:45, 27 August 2008 (UTC)

The list needed pruning, the idea of being a volunteer is that you are not asked but instead use initiative and take on cases on a regular basis, this is the vast majority is not being done so it was easier to restart from scratch but keep the inactive volunteers for archive purposes in case they need to be called upon. Some of those archived are active Wikipedia’s, but are not active here, which is the idea of a volunteers page as such > to show who is currently doing work at this forum (without being asked). Raising AGF as a argument is itself is an example of not assuming good faith :P (see WP:AAGF for a full essay). I do not regret the pruning and will continue to do so on a frequent basis.   «l| Ψrometheăn ™|l»  (talk) 02:06, 16 October 2008 (UTC)

I see 33 volunteer contacters and assume they all volunteered in good faith.

I see 1 person claiming here that volunteer contacters should take initiative to act i.e. present a complaint in Wikipedia's name without necessarily any preceding information from an investigator. Apparently this is the vast majority is not being done[sic] which is hardly surprising.

I see that same person declaring The list needed pruning coupled with a promise to go on pruning.

I see that same person makes no attempt to answer my single question Has any of these persons...been asked to do anything and failed to do so?. Instead that person presents a defence of the pruning that person has done.

I see that same person expressing an interesting slant on WP:AGF. I mentioned compatibility with WP:AGF of an action and not a person. Now the implicated person has surfaced wrapped in the WP:AAGF flag guaranteed to deflect any questioning of that person's ethical responsibility. The fact is that person posted The volunteers section was re-started fro[sic] scratch to get rid of all the in-active duds... That person went on to make sure everyone could link to duds described as...fails to fire or detonate, respectively, on time or on command. Duds are still dangerous and have to be de-activated and disposed of carefully. Cuddlyable3 (talk) 11:07, 14 December 2008 (UTC)

References

Other methods of contact

What ever happened to FAX and postal complaints? I see that it was noted that I'll also contact for Canada, but that's only true for FAX, email, and online complaints with consumer protection agencies, not phone. I'll contact anyone world wide by email or through consumer protection agencies. Faxes will be sent using FaxZero which allows me to send up to two faxes with up to three pages per day to anywhere in the USA or Canada, and I might try TPC which allows faxes to be sent for free to a limited number of locations worldwide. PCHS-NJROTC ^(Messages) 18:58, 22 December 2008 (UTC)

Template for user talk page?

Is there a template that gets put on a user's talk page when a case involving them has been opened? If there isn't currently such a template, would it be appropriate for us to create one? It would be helpful when investigating vandalism to have some reference to the fact that a report is open for a user. —Zach425 ^talk/contribs 07:59, 10 December 2009 (UTC)

There is in fact a talk back template, as discussed on Wikipedia_talk:Abuse_response/2009_Revamp/Archive_1#Notifying_Filers and in addition, MacMed created a form for doing this at Wikipedia:ABUSENOTIFY. Cheers.   bsmithme  05:58, 19 December 2009 (UTC)

Related discussion

Wikipedia_talk:Administrator_intervention_against_vandalism#Outreach_to_school_network_administrators has been discussing AR without (until now) knowing of the page's existence. Comments welcome. LeadSongDog come howl 06:14, 2 January 2010 (UTC)

Coordinators/Project Managers

It has seemed that two of our coords are not very active or have left Wiki. I will notify one of them as the other one is gone from Wiki. I would like to nominate myself for any open positions that come. I am also trying to get this project back on track. -- /MWOAP|Notify Me\ 01:34, 6 May 2010 (UTC)

Nevermind, I will send a contact list email as the other is also Wiki inactive. -- /MWOAP|Notify Me\ 01:47, 6 May 2010 (UTC)

Help with reporting multiple IPs

I want to submit a report about serial abuse from a large number of IPs. The case currently involves at least 27 IPs, but more are being added daily. All the IPs appear to belong to the same ISP. The case does not exactly fit the criteria, in that the IPs are not being used by several vandals, but by one serial abuser, who drops each and takes up another as soon as the first is blocked. The identity of the vandal is known, since he has frequently stated his name and place of residence. He is an indefinitely blocked registered editor, who has apparently participated in Wikimania in the past. How do I proceed with this? RolandR (talk) 11:38, 10 May 2010 (UTC)

Hello RolandR. On the main page, put the most recent abusive IP in the box. When the page takes you to the corresponding form, please add the multiple IP addresses that have been used under requester comments. Here is an example. If you have any questions please just respond here. Thank You and Happy Editing! -Fumitol (talk) 17:33, 11 May 2010 (UTC)

Removal of Prelim approve

I am going to be removing this tag from all of the reports that are not actually in that stage anymore. Happy Editing! --Fumitol (talk) 18:54, 11 May 2010 (UTC)

Ok, and I've gone ahead and removed the contact template that was used to publish the contact records. I think it would be better if everyone just did a CC to our mailing list whenever a report was sent. The information would still be accessible on demand, but it wouldn't be viewed by potential vandals. Netalarmpoke 06:00, 15 May 2010 (UTC)

Updated volunteer page

I've updated the volunteer page according to the 2009 revamp guidelines. I've transferred active users to the new list unchanged, but I removed all inactive users. If you wish to participate again, please follow the instructions on that page. Netalarmpoke 04:02, 17 May 2010 (UTC)

I disagree that I haven't participated in 3 months :P Just always been on IRC when people needed help or had questions especially recently ;) but I'm fine to keep doing that without official positions :) Just happy to see it getting active again and as always feel free to contact me if you need help/have questions or need admin intervention. James (T C) 20:16, 17 May 2010 (UTC)

Aww sorry James >.< I did the whole thing based on contribution histories on Wikipedia. Well, good thing we're active again. Netalarmpoke 21:03, 17 May 2010 (UTC)

New Central Email Address

Something that has been repeatedly proposed was to have a Wikimedia email address for WP:ABUSE so that reports look more official. Although creating an @wikimedia.org address is beyond my ability, I just made a new email address for WP:ABUSE for now: wikipedia.abuse.response@hotmail.com. If anyone wants to use this, just email me using the email feature within Wikipedia and I will send you the password. PCHS-NJROTC ^(Messages) 22:34, 17 May 2010 (UTC) Spammers who send unsolicited commercial email to that address will absolutely be reported to SpamCop

Thank you for your efforts, we actually already have an email address "wikimedia-en-abuse@lists.wikimedia.org" and we use that. If you could forward your reports to that, that would be awesome. -- /MWOAP|Notify Me\ 23:03, 17 May 2010 (UTC)

GLPI internal site

We've created an internal site located at http://wikiabuse.generation-host.com/ for team members to coordinate investigations and seek assistance in a secure environment. If you do not have access to this site, please email the mailing list so an account can be set up for you. Netalarmpoke 00:53, 18 May 2010 (UTC)

IP vandal

Hello. There's been a long run (about six months or so) of persistent vandalism from a fellow originating near Birmingham, England. The person likes to user their mobile phone (with Orange as their service provider. The vandal primarily uses IP addresses but there are a few user accounts that may be related.

Articles vandalized

There are just a few articles that this person gravitates towards. There's Input/output, Input, and Solihull College. Many of the specific instances of vandalism have been suppressed.

Blocks

Over the course of time that we've noticed this particular problem there have been around ten blocks placed on the IP range. This has the specific addresses used and a few of the suspected user names.

AN/I report

I posted an AN/I report earlier about this problem and a user pointed me in this direction.

Sock report

There has only been this one sock puppet report filed and that was done on July 7 by Qwrk.

Helping

Thanks for looking at this. I will probably remember more details in the coming hours and am active on Wikipedia daily for questions. Dawnseeker2000 04:34, 8 July 2010 (UTC)

Discussion regarding a report should be held in the "Discussion" section of the report, but I've looked into this and your information will allow us to compile a detailed report with dates/IPs for the ISP to action. Of course, If you have any more IP information, it would help. Thanks for reporting! Netalarm^talk 15:40, 8 July 2010 (UTC)

Requested BOT functions

• Count and list blocks across an IP range
• Count edits across an IP range
• Count warnings across an IP range

Developing...   Thorncrag  00:20, 17 August 2010 (UTC)

I just found a new way to do these lol, I still have to look into what is possible without killing the toolserver. Are we looking for these on IRC or onwiki? (Wiki is going to be a heck of a lot longer just because of BRFA and other programing delays. -- DQ (t) (e) 01:18, 5 September 2010 (UTC)

Surely some mistake?

I just saw this and I'm confused. The IP is blocked until June 28 of 2011 so there won't be any vandalism originating there. What do you hope to accomplish with this? Delicious carbuncle (talk) 04:09, 21 August 2010 (UTC)

Not certain, but I believe it was linked to a long-term abuse case making it reasonable to assume that the abuse will continue.   Thorncrag  05:50, 21 August 2010 (UTC)

How will vandalism continue from a blocked IP? Delicious carbuncle (talk) 14:51, 21 August 2010 (UTC)

As I am sure you are no doubt aware, a block of a single IP address only prevents an intent user from abusing from that IP address.   Thorncrag  19:04, 21 August 2010 (UTC)

There was likely sufficient evidence that a user from that IP was continually abusing Wikipedia, and someone filed a report. Vandalism can continue by the same user, from a different IP (through a proxy, tor, or other IP masking service). An investigator is looking in to this now. ANowlin ^talk 19:07, 21 August 2010 (UTC)

The IP belonged to long-term recidivist sockpuppeteer User:Swamilive. I think we're all agreed that Swamilive could be continuing to use other ISPs and/or proxies to continue their dastardly deeds, and we're all agreed that the IP is blocked and that no vandalism will be coming from that IP. So, back to my question - what do you hope to accomplish with this? Delicious carbuncle (talk) 19:20, 21 August 2010 (UTC)

Yes, but in that we hit some innocent bypassers. If we get the ISP to block them from doing what ever they do, (socking, vandals, whatever) then we don't have to use the range block and we don't have to use IP block exemptions for the legit users. -- DQ (t) (e) 20:29, 21 August 2010 (UTC)

Sorry, I'm not sure what you are trying to say. It is a single, apparently non-shared IP. Where did range blocks and IP block exemptions come into this? Delicious carbuncle (talk) 20:41, 21 August 2010 (UTC)

>Sorry, what I meant to sat is that we don't have to go back and block this IP time and time again. If we contact the ISP, they can hopefully stop the abuse in it's tracks. -- DQ (t) (e) 14:25, 24 August 2010 (UTC)

I must be slow or something, because none of the answers relating to the rationale for doing this have made much sense. I'll leave aside the question of why you're doing this and try rephrasing my question - what is the desired result of contacting the user's ISP? What do you want the ISP to do? Delicious carbuncle (talk) 21:11, 24 August 2010 (UTC)

If you are confused about the purpose, please refer to Guidelines, which should sufficiently answer your questions.   Thorncrag  22:29, 24 August 2010 (UTC)

Ok, I've read it - can you please answer my question about this specific case now? Thanks. Delicious carbuncle (talk) 02:56, 25 August 2010 (UTC)

Delicious carbuncle, I am sorry that you still do not grok the purpose behind reporting egregious abusive users with an ongoing history of using multiple accounts and IP addresses to abuse Wikipedia, to their internet service provider or responsible organization. Regretfully, if you have not been able to formulate an answer to your own question with the information you have been referred to, then no answer any of us posts in reply to your questions will ever suffice. Sorry.   Thorncrag  04:09, 25 August 2010 (UTC)

Thorncrag, perhaps if you try to answer my question in your own words rather than pointing me at the guideline, I will be able to understand. Would you be so kind as to give it a try? Thanks. Delicious carbuncle (talk) 05:13, 25 August 2010 (UTC)

It works like this:

• We have a problem with a person who is not permitted to (ab)use Wikipedia. It is not the IP address that is banned; it is the human to whom the IP address is currently assigned that is banned.
• Our methods of enforcing this ban are proving inadequate. That is, we block the IP, and s/he uses a proxy, or finds some other way of editing Wikipedia from some system that the wiki servers believe is not the blocked IP, even though it is (probably) coming from the same computer/physical location.

This is the problem we are trying to fix. We need help fixing this problem. Who can help us?

Answer: The people who control the relevant human's link to the entire internet, the ones who own the copper, the ones who can say "If anything containing 'en.wikipedia.org' and '&action=edit' ever comes through this particular piece of copper, then just drop it -- and the order is in force until this particular known, identifiable (to the ISP) human decides to get a new ISP."

This is not difficult from a technical perspective (if you're the ISP/school network administrator/person in charge of the hardware between the banned human and the internet), and it is fairly effective (until the person decides to get a new ISP, go to the library, or borrow the neighbor's unsecured wifi network). It is analogous to putting a dial lock on a senile person's telephone so that they can't keep making prank calls: The goal is to get help from the carrier to stop serious disruption instead of trying to do it all ourselves. WhatamIdoing (talk) 07:03, 25 August 2010 (UTC)

Length of Reports waiting to hear back

I know there are a whole bunch of ideas floating around about how long we wait till we close. Can I ask the team to come up with a number please? I think one month (which I have been doing) might be a little to big. Opinions? -- DQ (t) (e) 14:35, 24 August 2010 (UTC)

This warrants further discussion. I think overall contacting guidelines needs to be discussed as well, such as re-sending reports, escalating methods of contact, and generation of a physical informational package that we can send to ROs (schools in particular). We need to schedule an IRC conference.   Thorncrag  19:04, 24 August 2010 (UTC)

I am heading back to school soon, maybe a proposal, then once that is setup we can get a meeting? It would probably have to be a weekend for most of us to be around. -- DQ (t) (e) 01:19, 5 September 2010 (UTC)

Abuse is outside article space

On WP:RD we have a persistent troll IP and sock. This user is clearly well aware they are unwelcome [3]. When they edit from IP, their edits are usually in the 79.75, 79.76, 88.104, or 88.105 ranges (see Wikipedia talk:Reference desk#Proposal) and also Wikipedia:Sockpuppet investigations/Light current, which are large enough ranges we've never come to a consensus for a range block. Considering this is outside article space is it worth filing a report? Nil Einne (talk) 04:33, 6 September 2010 (UTC)

Actually I see this was tried before Wikipedia:Abuse reports/Tiscali DSL but it's not clear if anyone followed up. BTW as you may guess from the previous case, this has been ongoing for 3 years Nil Einne (talk) 04:36, 6 September 2010 (UTC)

I would go ahead and file a report and one of us will take a look at it again. If you file a new report, please do so under the most recently used IP address. Thanks!  :-)   Thorncrag  04:38, 6 September 2010 (UTC)