Wikipedia:Guide to administrator intervention against vandalism

From Wikipedia, the free encyclopedia

Vandalism
Dealing with vandalism
Obvious vandalism Long term abuse Open proxies
Resources & assistance
Counter-vandalism tools Cleaning up vandalism Counter-vandalism unit IP WHOIS tools
Further information
Blocking IP addresses Vandalism studies ISP contact information Do not provoke vandals  v • d • e

This is a guide to reporting users to Wikipedia:Administrator intervention against vandalism (shortcuts WP:AIAV and WP:AIV). This guide is intended to prevent invalid reports that needlessly take administrators' time, thereby allowing vandals more time to cause havoc before being blocked.

Contents 1 What to report 2 When to report 3 How to report a user to AIV 3.1 Accounts 3.2 Anonymous users / IP addresses 4 When reporting at AIV is not appropriate 5 Why hasn't the user or IP address I reported been blocked?

[edit] What to report

First, read the policy at Wikipedia:Vandalism. Administrator intervention against vandalism is for reporting users currently engaging in persistent vandalism. See the section "When reporting at AIV is not appropriate" for handling common incidents that should not be reported here.

Report only clear violations that do not require discussion or detailed explanations. If there is a reasonable chance that something may not be vandalism, it probably should be reported elsewhere, or not at all.

[edit] When to report

Vandals should always receive enough warnings before being reported. What constitutes "enough" is left to your best judgment. Consider the user's past edits, warnings and blocks, the severity of their offense, the likelihood that their edit(s) could have been made in error or otherwise in good faith, and the type of user in question (IP addresses may be shared or dynamic, and old warnings could be irrelevant to the current situation).

Blocking is meant to be preventive, not punitive. Therefore, the user must show a strong likelihood of making further disruptive edits despite warnings and being informed of the blocking policy. Always give a final warning, and report only if the vandal has vandalized at least once after that. (A final warning is a "level 4" warning, usually {{uw-vandalism4}} or, in more extreme cases, {{uw-vandalism4im}}.) Administrators are likely to remove your report if they feel that the vandal has been insufficiently warned or has stopped after the final warning.

[edit] How to report a user to AIV

All reports should be placed at the bottom of the "User-reported" section of Wikipedia:Administrator intervention against vandalism, using one of the formats described below. One easy way to do this and to avoid edit conflicts is to use the "+" link, which appears to the right of "edit this page" in the tabs across the top of the page (in the default skin). Just leave the "Subject/headline" field blank, and place your report in the big empty text box; it will automatically be appended to the end of the page.

[edit] Accounts

To report a user, you should use the {{vandal}} template. Your report should look something like:
*{{vandal|Example user}} concise reason eg vandalised past 4th warning. ~~~~
This will appear as

• Example user (talk · contribs · deleted contribs · logs · block user · block log) concise reason e.g. vandalised past 4th warning. James086^Talk 13:11, 13 March 2007 (UTC)

Minor caveat: if the username has an equals sign (=) in it, you'll need to use {{vandal|1=Username}}. Don't worry too much about broken reports, though!

[edit] Anonymous users / IP addresses

Anonymous users' contributions are logged by their IP addresses so they may be traced to check whether it is a shared IP (for example, a school). Reporting is the same, except with a different template ({{IPvandal}}) that has a few extra links:
*{{IPvandal|127.0.0.1}} concise reason e.g. vandalised past 4th warning. ~~~~
Which will appear as

• 127.0.0.1 (talk • contribs • deleted contribs • WHOIS • RDNS • trace • RBLs • http • block user • block log) concise reason e.g. vandalised past 4th warning. James086^Talk 13:11, 13 March 2007 (UTC)

[edit] When reporting at AIV is not appropriate

• Any vandal who hasn't been warned properly should not be reported.
• Violations of the three-revert rule should be reported to Wikipedia:Administrators' noticeboard/3RR
• If you suspect someone of sockpuppetry, file a report at Wikipedia:Suspected sock puppets. Obvious and malicious sockpuppets may be reported to AIV. A link to the sockpuppetry report should be included in the reason for reporting.
• Usernames that clearly violate of username policy should be reported at Wikipedia:Usernames for administrator attention.
• Do not report edit wars or other disruptive behavior that doesn't fit the description at Wikipedia:Vandalism. These can instead be reported to the adminstrators' noticeboard or its incidents subpage. AIV deals mainly with obviously malicious edits that require no discussion; complex cases should usually be referred to other boards.

[edit] Why hasn't the user or IP address I reported been blocked?

If you reported a user or IP address to administrator intervention against vandalism and they weren't blocked, you should first check the page history; most administrators explain in their edit summary why they are removing an entry without blocking it. If no reason is given, you can (politely!) ask the administrator who removed the report from the page. Some of the more common reasons are listed below:

• The user hasn't been warned sufficiently.
• The user stopped making malicious edits since the final warning, especially if it was an IP address.
• The administrator deems the warnings inappropriate—for example, in the case of a content dispute.
• If it is an IP address, it may be shared; blocking could affect many users at once. Administrators are reluctant to block such IPs because doing so may cause collateral damage, especially in the case of sensitive IP addresses.
• You haven't used the appropriate template, and the bots removed the report as a comment.