Wikipedia:Abuse reports/Guide to abuse reports

From Wikipedia, the free encyclopedia

Shortcut: WP:GAR

When extensive vandalism comes from an IP address, sometimes the best way to handle it is to contact the systems manager of that address directly to inform them of the problem. This approach works best for addresses that have a high likelihood of responding to abuse complaints, such as schools, government agencies, or others.

This is a last resort! This is not something to do after a brief, small spate of vandalism. This is only for when there is an established trend of vandalism coming from an IP that can't be dealt with another way without larger repercussions (such as blocking a massive range of addresses). If there have been multiple blocks, multiple sets of warnings, an indefinite block is either impossible or inappropriate, and the vandalism keeps coming as soon as the blocks expire, then this is the place to come to.

1 How to begin an investigation
2 How to make contact
3 List of WHOIS sources
- 3.1 List of regional Internet registries
4 See also
5 External links

[edit] How to begin an investigation

Take the oldest report on the list that you are capable of dealing with. Don't take a report if you can't finish it.
Double check the following. If one of these criterions hasn't been fulfilled, reject the request.
1. That the IP(s) has been responsible for a trend of vandalism. Note that it's especially important here that it is in fact vandalism as defined in Wikipedia:Vandalism. Other edits may be frustrating, but are not a reason to contact an ISP.
2. That the IP(s) has been warned fully,
3. And that blocking, semi-protection, or similar recourse wouldn't, or repeatedly hasn't, solved the problem. If the IP has been blocked ten times and is still vandalising, it's worthy of an abuse report.
List the case in the under investigation section noting that you're investigating the case.
Create a subpage for the case, in the fashion of /OWNER_OF_IP_ADDRESS. Include registry information, contact information for the systems administrator, the initial report containing the address(es), an abuse summary, links to the vandalism, and a summary of all previous blocks. (See: Example case.) Use the {{AR Links}} template to provide quick links and the {{AR report}} template to provide a framework for a case. Put {{AR talk}} onto the IP's talk page to inform other users of the investigation.
When your report is ready, move the case into the queue for a contactor to take over.

[edit] How to make contact

First, find the owner of the IP address. (This information should be listed in the prepared report). This can be easily done through a WHOIS lookup (a list of sites who offer this are can be found below). In the readout there should be, among other things, a telephone number and an e-mail address for contacts (and sometimes, even better, an e-mail address specifically for complaints). If you don't see a contact e-mail, the address is almost always abuse@domainname.

Telephone contacts are the best way to get an administrator's attention, as it's person to person and very direct. If that's not available or you feel uncomfortable calling, then e-mail is the next best thing.

Always be polite (remember that you're representing Wikipedia, and that rude people don't get helped). Give a brief explanation of who you are, what Wikipedia is, and a summation of the problem. Explain that you're a volunteer and are not acting in an official capacity, but are concerned about the contributions of an IP address that is under their domain. Provide a link to the investigation subpage (which should contain links to the vandalism, and links to warnings that have been given to the vandal). Accept their response, whether it's helpful or otherwise, and thank them for their time.

For a boilerplate e-mail message, see here.

When you have made contact:

Keep a log of your contact; each time you speak to someone, keep a record of whom you spoke to and a summary of what was said on the report page. (See: Example case.)
When contact has ceased, whatever the result, list it at the bottom of the page.
Once the case closed, remove the like from the main abuse reports page and archive it.