Frequent IP hopping vandalism

Hi. Over at WP:F1 we are having some problems with a persistent IP vandal. Unfortunately, their list of IP addresses used is longer than your arm, covers an extremely wide range, and never seems to be repeated twice. However, almost all of them trace back to Plusnet Technologies Ltd. in the UK (see most recent: User:46.208.151.111). Having had quite a few of the used addresses blocked it rapidly became clear that this was wasting our time, as they would be back within minutes using a different IP. Obviously, they had worked out that logging off and logging on again was enough to evade any block that we could impose. We were hoping that they would get bored, but this doesn't seem to be the case. I have a hunch that this may be the place to bring this issue, but I thought I'd check first. Any ideas on how to proceed from people with more experience than us, please? Many thanks. Pyrope 13:05, 17 May 2012 (UTC)

Blocks are futile... I would like to have a complete list of the IPs on User:Ebe123/F1 Vandal. It would make it much easier for me. Thanks. ~~Ebe123~~ → report 22:33, 17 May 2012 (UTC)

I would as well. When blocks are completely futile, the ISP will sometimes intervene. Worth a try. Someguy1221 (talk) 01:01, 18 May 2012 (UTC)

List compiled as requested: User:Ebe123/F1 Vandal. Pyrope 02:36, 18 May 2012 (UTC)

Looks like most edits are to a short list of articles. Semi-protection of all of them might be justified when he's active. LeadSongDog come howl! 03:08, 18 May 2012 (UTC)

Good idea. ~~Ebe123~~ → report 10:59, 18 May 2012 (UTC)

Range blocking would be ineffective and will have collateral damage. ~~Ebe123~~ → report 10:59, 18 May 2012 (UTC)

Semi-protection for articles is something we considered. The type of articles that the vandal is targeting include all F1 races since 1980, F1 season summary articles since 1980, F1 driver articles and the occasional race article. That's quite a lot of individual pages. A couple of months semi-protection would be a good idea, just to see if we can't break the back of this, but I have a strong suspicion (based on how they've responded in the past) that they may simply fish around and switch attention to unprotected articles. Worth trying though. Pyrope 12:12, 18 May 2012 (UTC)

It might be useful to build a timeline of edits from the different IPs. Are there tools to help with this? A quick examination shows that he uses one IP for up to 30 hours but usually much less. All IPs geolocate within GB. Some of the IPs have been used for constructive edits on other topics, but not within the time span of the F1 edits, so they are likely dynamically assigned. Most, but not all edits are to specific parts of YYYY PLACE Grand Prix articles. Most are within one hour of the previous edit. I would think any reverted edit matching this pattern should meet the duck test enough to justify a one-hour block. If we have to play whack-a-mole until he tires, we can at least stack the odds in our favour.LeadSongDog come howl! 14:06, 18 May 2012 (UTC)

mw:Extension:EasyTimeline may be useful. I know about the other edits. ~~Ebe123~~ → report 15:05, 18 May 2012 (UTC)

Just for the record: right now someone behind User:‎221.91.30.126 is filling in (pre-) qualification tables for races between 1989 and 1991. If you are going to semi-protect these pages, we may lose a new (and enthusiastic) contributor. Contrary, if the pages don't become protected, then there already are 5 or 6 contributors (including me) reverting vandalism on these pages very soon after it is committed, and though I don't know about others, I myself is not going to stop watching these pages. Please keep this in mind. Ximaera (talk) 10:02, 19 May 2012 (UTC)

That's definitely a factor. If there are many watchers on each page, alert to the pattern of vandalism, then it can be locally handled on each page.LeadSongDog come howl! 14:53, 19 May 2012 (UTC)

Could we give semi-protection a try? We tried "handling it locally" for about 2 months before coming here, and there's no sign of the vandalism decreasing. It's pretty discouraging knowing that every day there are going to be a dozen or more vandalised articles to repair; often the same article over and over again, e.g. this one. In order to avoid scaring off the "qualification tables" editor, perhaps we could leave 1989-1992 articles unprotected? (they have finished 1991 now; presumably they'll move on to 1992) I have left a message on their talk page encouraging them to create an account. DH85868993 (talk) 00:52, 20 May 2012 (UTC)

Indeed, I'll second that. Attracting new editors is all well and good, but if this vandalism continues we seriously risk pissing off established, highly-productive editors, and it may be sufficient that they leave. Pyrope 13:28, 20 May 2012 (UTC)

I don't mean to nag, but is anything further happening on this? DH85868993 (talk) 02:55, 23 May 2012 (UTC)

{od} I wasn't thinking of a graphic, so much as a table with sortable columns: IP, datetime (UTC), target page, difflink. Easy in a spreadsheet, not so easy in wiki syntax. Could include convenience links to whois, RDNS etc.LeadSongDog come howl! 18:59, 18 May 2012 (UTC)

Make a spreadsheet, and send it to me. I'll get it to wiki markup. ~~Ebe123~~ → report 22:12, 18 May 2012 (UTC)

For the information of all who have contributed to this discussion, this matter is now the subject of a formal report: Wikipedia:Abuse response/2.30.196.109. Thanks for your input so far. Pyrope 15:10, 28 May 2012 (UTC)

Could you complete the list of IPs? ~~Ebe123~~ → report 00:12, 29 May 2012 (UTC)

I'm attempting to keep it up to date, but the very nature of this vandal's editing pattern means that I'll likely miss one or two, and some of the earlier acts also likely are beyond my tracking down without going through the individual edit histories of 200-300 separate articles and cross referencing with the known list. Pyrope 00:33, 29 May 2012 (UTC)

We now have a tool per this to spot new instances. Quiet kudos to Scotty. LeadSongDog come howl! 16:11, 4 June 2012 (UTC)

Seeing as how I can characterize the vandal's edits with no false positives, it wouldn't be difficult to create a bot which detects the vandal's edit as he is making them, instantly reverts it, and auto-blocks the IP for an hour or two. However, I don't want to step on anyone's toes if there are other measures being put in place, and I'm also not positive if BAG would approve such a bot. Let me know if there is any interest in this. -Scottywong| squeal _ 20:59, 4 June 2012 (UTC)

I think it's a good idea, and it would prevent the vandalism, even if not the same group of IPs. ~~Ebe123~~ → report 21:46, 4 June 2012 (UTC)

Call me crazy, I still think it's worth trying to get this guy to register an account. The problem with IPhoppers isn't that they're intransigent. It's that they're incommunicado. Our first response should be to invite them to register, per {{signup}}. Short of that they usually don't have a clue why their edits keep getting reverted. LeadSongDog come howl! 05:30, 5 June 2012 (UTC)

I admire your assumption of good faith, but it's my belief they don't want to communicate. Consider this sequence of edits. After the 5th edit, I left a message on their talk page asking them not to continue changing F1 race results without reliable sources and/or edit summaries, asking them to discuss their proposed changes and offering my talk page if they had questions. Thirteen minutes later they resumed editing under the same IP address, exactly as before. Of course there's a chance they didn't see (or couldn't understand) my message, but I think it's more likely they saw it and ignored it. DH85868993 (talk) 08:40, 5 June 2012 (UTC)

I have had very similar experiences. Even when approached, perfectly reasonably, with a tailored message (not a boilerplate vandalism template) right in the middle of an editing spree I get no response. Pyrope 11:51, 5 June 2012 (UTC)

FYI - I've filed a bot request at Wikipedia:Bots/Requests for approval/Snotbot 11. -Scottywong| spill the beans _ 14:23, 5 June 2012 (UTC)

I still think that leaving a way out that isn't deleterious to the encyclopedia is a better choice in the long run. Otherwise he's likely to get more creative and harder to shut down.LeadSongDog come howl! 15:30, 5 June 2012 (UTC)

If you can get any sort of response out of them, anything at all, even an edit summary, then be my guest. I don't predict that you'll have much joy though. Pyrope 15:48, 5 June 2012 (UTC)

I think its unnecessary except if he moves to a different range of IPs. Yesterday was just two IPs, so we might be getting somewhere.LeadSongDog come howl! 04:22, 6 June 2012 (UTC)

I've added an entry to the edit filter to prevent future vandalism. It's not currently enabled because I'd like to test it for a few days first, to make sure it catches all of the edits with no false positives. It is dependent on the IP address that is used to make the edit, so please let me know if you find any future edits from IP ranges that don't already appear in User:Ebe123/F1 Vandal, and I will add them to the filter. -Scottywong| prattle _ 23:34, 7 June 2012 (UTC)

Thanks for all your work on this, Scotty (and Ebe123 and LeadSongDog). DH85868993 (talk) 00:29, 8 June 2012 (UTC)

Yes, impressive. Many thanks all of you. Pyrope 03:08, 8 June 2012 (UTC)

Ok, edit filter seems to be working perfectly so I've enabled it. Be sure to let me know if he changes up his IP range or his editing pattern to get around the filter. -Scottywong| confer _ 13:31, 8 June 2012 (UTC)

• Odd. It almost seems as if the guy is running some sort of automated program to make these edits. I don't know if you guys can see the edit filter log, but he's just plugging away as if the edit filter isn't preventing his edits. He's making the same number of edits (or at least, he's trying to) as if he's not aware of the giant edit filter notice that pops up each time he tries to commit an edit. Bizarre. -Scottywong| express _ 15:37, 12 June 2012 (UTC)

  Cannot even see the log. Put "disallow" on. ~~Ebe123~~ → report 19:25, 12 June 2012 (UTC)

  That's my point: disallow is on (and has been for several days), yet he is continuing as if nothing has changed. -Scottywong| confabulate _ 19:33, 12 June 2012 (UTC)

Once in a while an edit is slipping through, but otherwise I'd agree, I have a feeling that there is something very odd going on here. Pyrope 19:36, 12 June 2012 (UTC)

Get your bot to block. ~~Ebe123~~ → report 20:01, 12 June 2012 (UTC)

Please let me know when you see edits that slip through, and I can tweak the edit filter to catch them. You can let me know here or on my talk page. The one linked above slipped through because he left the edit summary completely blank that time. He may be evolving his strategy, or it might have just been an unintended deviation in behavior. -Scottywong| confess _ 20:26, 12 June 2012 (UTC)

I'll be moving this section to the talk page of Wikipedia:Abuse response/2.30.196.109 and contacting the (many involved) ISPs. One thing that I would like is that they may see the abuse log. ~~Ebe123~~ → report 12:15, 26 June 2012 (UTC)

Clarification

Apologies if I have not done this right, this is my first time using this section of Wikipedia. I need clarification on what way I should go about a user abuse, or whether that even needs to be handled that way. A user is frequently editing a page and deleting all content except for barebones claiming the original page is not allowed, however the Wikipedia rules clearly state the innoculous page is not in violation and linking to the section of the rules in the page edit comments section, doesn't stop the user from doing the same thing again & again. A standard Wikipedia person such as myself would find a violation ,fix it and go about their business, but this user keeps coming back repeatedly, every day; there's some kind of grudge going on here. The Abuse page of Wikipedia suggested it was not hte appropriate place for reporting a user in this regard, and it directed me to the "Long-term abuse" page, but on that page the criteria suggests this isn't Long-term abuse report material. How should I handle this? — Preceding unsigned comment added by 24.96.223.38 (talk)

A person reverting your edits is not abuse, it's fairly common and usual; not everybody will agree to your interpretation of policy, and are free to have their own. There's a limit on how many times any one can undo the other ones' changes, the three revert rule, that neither you nor the other guy should trespass. The appropriate way to handle the situation is discussing the problem at the article's talk page, as described at WP:Consensus. Diego (talk) 23:06, 21 January 2013 (UTC)

Thanks for the prompt reply. I would liek to note that I must not have clarified: user is not reverting my edits, user is reverting an entire page edited by multiple people over time, back to their preference. Is it common for a user to taget a certain page in claims unfounded, meanwhile multiple pages linked on the page do the exact same thing, yet user ignores all those? Something smells fishy. — Preceding unsigned comment added by 24.96.223.38 (talk) 23:19, 21 January 2013 (UTC)

Hi, folks. When the criteria instruct that the IP must have been blocked for 'over a period of a year', is it referring to a one year sum time of all of its blocks, or a one year restriction through a single block? (And it's 'one year or more', as opposed to 'over a year', right?) Best, NTox · talk 06:54, 31 May 2012 (UTC)

Yes, a year or more, not over a year. The IP will have to be blocked 4 more times and not nessesarily 1 year (execpt for IAR cases). ~~Ebe123~~ → report 10:01, 31 May 2012 (UTC)

Okay. So, to be certain: one of the IP's five+ blocks must have been imposed for a year or more to qualify? Strictly speaking (non-IAR), you wouldn't allow someone to add two six month blocks together and count that as a year, correct? NTox · talk 14:57, 31 May 2012 (UTC)

Yes. ~~Ebe123~~ → report 21:03, 31 May 2012 (UTC)

Sounds good. I'm going to go ahead and clarify that on the main page. NTox · talk 22:04, 31 May 2012 (UTC)

One more question: the instructions template requires the most recent block to have been imposed in the last three months. Yet, the editnotice when actually filing a report requires 'abusive edits in the last 2 weeks'. I assume the rule of reason here is 'recent', but seeing as those are very different, can this be clarified? NTox · talk 22:23, 31 May 2012 (UTC)

It should be 3 months everywhere. Unfortunately, I can't change it. ~~Ebe123~~ → report 22:47, 31 May 2012 (UTC)

No worries. I fixed it for you. The notice was at Template:AbRep1. NTox · talk 00:28, 1 June 2012 (UTC)

Request for comment on unblocking policy

A request has been opened at Wikipedia talk:Blocking policy#Proposal: third party request for unblock

Should the proposed change, "A third party may request the review of a block at the Administrators' noticeboard," or some variation of that change, be added to the unblocking policy. Penyulap ☏ 23:11, 27 Jun 2012 (UTC)

Collateral Damage

An IP-hopping vandal from ISP Bezeq International in Tel Aviv-Yafo, Israel decided to repeatedly vandalize Jimbo's talk page, along with many other targets. There is a list of the known IPs the vandal has used at Wikipedia:Sockpuppet_investigations/Nenpog/Archive#21_July_2012.

As a result of this abuse, Jimbo's talk page was semi-protected and 109.65.192.0/18 and 79.182.192.0/18 were rangeblocked for two weeks. The semiprotection of Jimbo's talk page is especially significant -- a lot of newbie IP editors end up asking questions there.

I am thinking that perhaps someone should contact them ([email protected]) and tell them that abuse by one of their users just got 32,768 of their IP addresses blocked from editing Wikipedia. --Guy Macon (talk) 10:48, 23 July 2012 (UTC)

emailing the ISP. Étienne Beaulé (~~Ebe123~~ → report) at 22:20, 24 July 2012 (UTC)

Nominations

May I ask someone to review the nomination please? There are 2 waiting response. Mdann52 (talk) 06:40, 11 August 2012 (UTC)

This has become a problem again and there are several nominations awaiting review. Andrew³²⁷ 11:57, 2 July 2013 (UTC)

What to do in case of a registered user?

A registered user is reverting to the old version with distorted citation in an article. I think this is an abuse of the article. What should I do? ĶŞĶ-ŴĀŘ (talk) 19:10, 28 August 2012 (UTC)

This is a noticeboard to contact ISPs of IP abuse. Raise the problem at the talk page, then I suggest WP:DRN. If you need more help, I'm always at my talk page. ~~Ebe123~~ → report 21:05, 28 August 2012 (UTC)

Albanian range with years of data vandalism

Hello,

Special:Contributions/79.106.109.221 this IP-adress, and tens of other adresses in this range have around 10 edits. So that's like a thousand edits. A lot of edits I've checked are data vandalism. The user changes charts on songs to position 1 (when this is not the case). The user is active on soccer topics and on music topics. It's quite a lot and I'm not a regular here on Wikipedia so I'm not planning on reverting or checking all these edits. There's still a lot of vandalism not reverted yet. There are also edits which seem to be correct. But if there's vandalism it's pretty sneaky so it's hard to differ between the correct and incorrect edits. The edits from this user will need quite some attention, much more then I can give them with my bad knowledge of how the English wiki works. I know this is not the exact perfect place for this. But I couldn't find the place where I can ask help with a very big vandalist with more edits than I can deal with myself. Please make sure these hunderds of vandalism edits will get reverted. It would be a shame if my lack of understanding from the English wiki will keep all this vandalism alive in the articles. Mvg, Basvb (talk) 22:35, 20 October 2012 (UTC)

the hole range

• edits like this are the most clear examples. These kind of edits are spread over all IP-adresses in this range. The hole range has like 5000 edits, so this is quite heavy. Mvg, Basvb (talk) 22:43, 20 October 2012 (UTC)

With some edits dating back to 2009. Basvb (talk) 22:49, 20 October 2012 (UTC)

Nomination ordering

Should new nominations go at the top or the bottom of the list? Scrolling through the existing ones, I don't see any particular order, nor do I see any explicit instructions at the top of the page or in the editnotice. ⁓ Hello71 02:54, 31 October 2012 (UTC)

Help requested by User:MomsHugs

I don't know anything about editing Wiki, which I use all the time for quick research into a lot of topics ranging from history, science (biology & botony), etc. Right after looking something up this morning, the next access showed a warning that an EDIT of mine was reversed by something called Cluebot (whatever), and referred to "Anonymou" as my Username & an IP# 70.#.#.# as my IP address, which was dated last Sept. 2012.

The edit referred to was NOT done by me! I don't even know how to edit & would not be editing something about South American, which I know nothing about! Has my IP address been "grabbed" for vandalism or what?

I did purchase a "refurbished" MiFi (JetPac) from Verizon in Jan. 2013, which is my IP address, but perhaps it belonged to a previous owner.

In any event, how can I get rid of that editing message & how can my IP address be removed from whatever database is doing this?

Thank you so very much for whatever help you can give! MomsHugs (talk) 14:54, 2 May 2013 (UTC)

That's unfortunately a problem you're going to have with most wireless ISPs because their IP addresses are highly dynamic (I've been caught up in hardblocks myself when trying to edit from my smartphone). If you get caught up in a block, you can use the {{unblock}} template to requeset unblocking, but otherwise, I would just ignore such messages. Additionally, this isn't really the place for questions like this; WP:Help Desk is. PCHS-NJROTC ^(Messages) 23:33, 16 June 2013 (UTC)

Help request by User:Sb101

Could someone please help with misconduct from an IP account on Talk:Patient_Protection_and_Affordable_Care_Act? See: recent edits by User:71.32.122.15 (ignoring policy, verbal abuse in edit summaries). Also, personal attacks on my User page. Thank you. Sb101 (talk|contribs) 07:39, 1 October 2013 (UTC)

Backlog for new members

Wikipedia:Abuse response/Nominate has a massive backlog. Is this project even active anymore, or has the lure of new people to help worn off? --Mdann52talk to me! 12:41, 23 October 2013 (UTC)

It's ridiculous. There are "Open" cases that date to 2011. Liz ^{Read! Talk!} 21:26, 6 November 2013 (UTC)

Help requested by User:Alexyflemming

There is a complete disastrous damages to "Trikomo, Cyprus" article. User Trikomitis deletes almost all the data about the town: "Population", "Mayor's name", "municipality's website", "Sister cities", "Skyline image of town", other specific info relevant to town ("Bafra Tourism Region", "Karpas peninsula" etc.).

See the huge difference via this disruption: https://en.wikipedia.org/w/index.php?title=Trikomo,_Cyprus&diff=592145576&oldid=592141875 became
https://en.wikipedia.org/w/index.php?title=Trikomo,_Cyprus&diff=592546968&oldid=592544554 .

So, I request from the wiki authorities to reply properly to the user Trikomitis if repeating the same deletions.Alexyflemming (talk) 23:58, 26 January 2014 (UTC)

Once more, Trikomitis damaged hugely the "Trikomo, Cyprus" article:
https://en.wikipedia.org/w/index.php?title=Trikomo,_Cyprus&diff=592764797&oldid=592690564
Trikomitis deleted "Population","Mayor's name","municipality's website","Sister cities","Skyline image of town", "municipality status" info, "Bafra Tourism Region" info, "Karpas peninsula info" etc.

Wikipedia authorities should do something. I am an ordinary wiki user and having no ability to prevent this disruption.Alexyflemming (talk) 11:29, 28 January 2014 (UTC)

Help requested by User:Trikomitis

There is a complete disastrous damages to "Trikomo, Cyprus" article. User Alexyflemming deletes all data relating to the true history of the town. You cannot possibly delete a people from the history books or indeed Wikipedia. I would ask that you respect the legal owners and occupiers of the town and stop posting regarding an internationally recognised illegal occupation.

I henceforth request from the wiki authorities or any user willing to assist in rectifying this page to accurately reflect history Trikomitis —Preceding undated comment added 18:28, 27 January 2014 (UTC)

Trikomitis deleted almost everything in "Trikomo, Cyprus" article:
https://en.wikipedia.org/w/index.php?title=Trikomo,_Cyprus&diff=592764797&oldid=592690564
Trikomitis deleted "Population","Mayor's name","municipality's website","Sister cities","municipality status" info, "Skyline image of town","Bafra Tourism Region" info, "Karpas peninsula info". He also deleted Turkish Cypriot municipality website whereas keeping the only Greek Cypriot page. Neutrality is wikipedia's no.1 principle. Observe that my edit ( https://en.wikipedia.org/w/index.php?title=Trikomo,_Cyprus&diff=592685575&oldid=592674688 ) included both the Greek Cypriot and Turkish Cypriot websites together. In Wikipedia, all towns in Northern Cyprus has this neutral application: including both of the municipalities websites.

Trikomitis' abuse already declared by me in this abuse declarations page on 26.01.2014. See above. Alexyflemming (talk) 11:40, 28 January 2014 (UTC)

The real reason AR failed

AR didn't fail because ISPs wouldn't work with us, AR failed because it seems the vast majority of Wikipedians are clueless as to how the internet works. For example, if I call a school district with 50,000 and tell them someone wrote "hi my name is amber" on an article, the fact that someone wrote "penis" on a different article a week later doesn't mean they didn't discipline the girl, it just means a boy at an entirely different school using the same IP address messed with Wikipedia. The same thing applies to companies like Hospital Corporation of America and AutoZone that have thousands of employees at multiple locations piped through one IP. PCHS-NJROTC ^{(Messages)Have a blessed day.} 23:46, 12 April 2018 (UTC)