View source for Wiki143:Abuse response/Guide to abuse response

{{redirect|WP:GTAR|Guide to Arbitration|Wikipedia:Arbitration/Guide to arbitration}}
{{AbuseNavigation}}
{{shortcut|WP:GTAR}}

When extensive [[Wikipedia:Vandalism|vandalism]] comes from an [[IP address]], sometimes the approach is to contact the systems administrator of that IP directly to inform them of the problem. This approach works best for IPs belonging to organizations that have a high likelihood of responding to abuse complaints, such as schools and government agencies.

'''This is a last resort, NOT''' something to do after a brief, small spate of vandalism. This is ''only'' for when there is an '''established trend of vandalism''' from an IP that can't be dealt with without larger repercussions, such as blocking a massive range of IPs. If there have been multiple blocks and warnings with an indefinite block determined to be inappropriate and the vandalism resumes after block expiry, then this the right location.

==Case process==
[[File:Abuse response case processing.png]]

==How you can help==
If you want to help the Abuse project, there are several different ways:
* You can pre-process reports:
** mark cases as preliminarily approved using {{tl|ARPrelim}} in the "Case log" area of the case page if the case meets filing criteria (see below).
** reject cases by placing <nowiki>{{</nowiki>[[Template:ARA|ARA<nowiki>|r|#</nowiki>]]<nowiki>}}</nowiki>, where # is the number for a common reject reason (see [[Template:ARA]] for more information) then change status to "Rejected" on the top of the case.
* You can investigate cases (see below).
* You can make contact on cases which have already been investigation but are awaiting contact (see below).

===Filing criteria===
The criteria for filing an abuse report:
* The IP must have been blocked a minimum of '''FIVE''' times
* There must be current and ongoing abuse from the IP
* There must be a block within the last year

A report will be considered stale, and may be rejected if:
* The IP has had no activity in the past five months AND
* The IP is not subject to a current block

===Processing a case===
{| style="width: 100%; border: 0px ridge #81BEF7; padding: 0em; background-color: white;"
| bgcolor=#FFFF99 width="10px" rowspan="2" | <big>'''I'''</big>
| colspan="2" style="background-color: #FFFF99" | <div class="center"><big>'''Open the case for investigation.'''</big></div>
|-
| colspan="2" |1. Go to [[:Category:Abuse response - Waiting for Investigation]] and find a suitable report to open a case.
:* You can also find suitable cases which have been marked as preliminarily approved in [[:Category:Abuse response - Preliminarily Approved]].  These cases were approved but for whatever reason that person reviewing was not able to open the case themselves.

2. Verify that the report meets the initial filing criteria.
:*If the report does not meet the criteria:
::a. Reject the report by placing {{tlx|ARA|rejected}} in the case log, followed by a reason and your signature. Alternatively you can use {{tlx|ARA|rejected|#}} where # is a pre-defined reject reason (see [[Template:ARA]] for more information).
::b. Change status of the report to "Rejected".
::c. Place <nowiki>{{subst:ARA top}}</nowiki> at the top of the page and <nowiki>{{subst:ARA bottom}}</nowiki> at the bottom of the page to archive the case.

3. Verify that the IP(s) is a habitual offender.  Note that it is especially important that for vandalism, the it meets the criteria in [[Wikipedia:Vandalism]].

4. Verify that the IP(s) has been [[Wikipedia:Vandalism#Dealing with vandalism|warned]] suitably.  This does not apply to multiple IP addresses if you can link them to the same user and other IPs have previously been suitably warned.

5. Verify that for multiple IPs that they are all under the jurisdiction of the same provider.

6. That [[Wikipedia:Blocking policy|blocking]], [[Wikipedia:Semi-protection|semi-protection]], or a similar recourse has not resolved the behavior of the user because the user continues to abuse from new IP addresses.
:*If the report does not meet any of the above criteria:
::a. Reject the report by placing {{tlx|ARA|rejected}} in the case log, followed by a reason and your signature. Alternatively you can use {{tlx|ARA|rejected|#}} where # is a pre-defined reject reason (see [[Template:ARA]] for more information).
::b. Change status of the report to "Rejected".
::c. Place <nowiki>{{subst:ARA top}}</nowiki> at the top of the page and <nowiki>{{subst:ARA bottom}}</nowiki> at the bottom of the page to archive the case.

7. If all of the above criterion are met change the status of the case to "Open" on the top of the case page, and add {{tlp|ARA|approved}}
|-
| bgcolor=FFFF88 width="10px" rowspan="2" | <big>'''II'''</big>
| bgcolor=FFFF99 width="100px" | <div class="center"><big>'''Notify&nbsp;the&nbsp;parties.'''</big></div>
|-
| colspan="2" |8. Place {{tlx|AR talk|IP Owner|IP Address|open}} at the top of the IP's talk page to inform other users of the investigation. It is not necessary to place a notice on all IP pages for multi-IP reports, usually the most recent suffices. ''IP Owner'' is the ISP/host, and ''IP Address'' is the IP address in the title of the Abuse Response case. ''Open'' can be left as is.

9. Notify the filer of the report by placing {{tlx|artb|IP|thanks|subst=yes}} replacing ''IP'' with the IP address.
|-
| bgcolor=FFFF77 width="10px" rowspan="2" | <big>'''III'''</big>
| bgcolor=FFFF99 width="100px" | <div class="center"><big>'''Investigate&nbsp;the&nbsp;case.'''</big></div>
|-
| colspan="2" |10. Edit the case page to include the results of your investigation.  This should include registry information from the WHOIS report, contact information for the abuse department or network administrator, a report containing the address(es), an abuse summary, links to the vandalism, and a summary of all previous blocks. It's also helpful if you can generalize the abuse by time of day, day of week, or other general patterns that would help the organization identify the responsible user or users.

11. When you complete your investigation and your report is ready, add {{tl|ARA|contact}} to the case log.
|-
| bgcolor=FFFF66 width="10px" rowspan="2" | <span style="font-family:verdana,arial;"><big>'''IV'''</big></span>
| bgcolor=FFFF99 width="100px" | <div class="center"><big>'''Contact&nbsp;the&nbsp;responsible&nbsp;organization.'''</big></div>
|-
| colspan="2" |12. Find the appropriate contact information for the owner of the IP address. This information should be listed in the prepared report. Please see [[Wikipedia:Abuse response/Responsible organizations|responsible organizations]] for important information on looking up WHOIS records and full instructions.

13. E-mail is the preferred method of communication for Abuse Response because it can easily be recorded and documented for future reference. Additionally, it has become the de-facto standard for reporting abuse for most organizations.

{{ambox|type = content|text = When communicating with responsible organizations via e-mail, please use the approved contact templates at [[Wikipedia:Abuse response/Contact templates]].}}

:a. Our primary function is ''reporting'' abuse, not instigating action. Therefore, you should accept their response, whether it is helpful or otherwise, and thank them for their time.

:b. If you receive a response that requests more information, do your best to be helpful and comply with their request.  If you cannot comply for whatever reason, because it would need the attention of the foundation, you should refer the person to contact the Wikipedia Foundation at [[WP:CONTACT]].  If you need assistance, feel free to contact a project coordinator at any time.

14. Each time you make contact, keep a log of the activity in the case log.

:a. If you are contacting a major ISP (i.e., Verizon) and you receive an automated reply, you do not need to await a reply as it is not reasonable to expect that a reply will be received from major organizations for each case.

15. When contact has ceased, whatever the result, record in the contact history.
|-
| bgcolor=FFFF55 width="10px" rowspan="2" | <big>'''V'''</big>
| bgcolor=FFFF99 width="100px" | <div class="center"><big>'''Close&nbsp;and&nbsp;archive&nbsp;the&nbsp;case.'''</big></div>
|-
| colspan="2" |16. Once the case has closed, add the {{tlx|ARA|actioned}} template to case log, followed by a brief summary of the final result and your signature then change the case status to "Closed".

17. Add {{tlsp|ARA top}} to the top and {{tlsp|ARA bottom}} to the bottom of the case page in order to archive the case.

18. On the IP's talk page, change {{tl|AR talk}} to {{tlx|AR talk|closed}}.

19. Notify the filer that the case was closed by placing {{tlx|Artb|IP|close|subst=yes}} <nowiki>~~~~</nowiki> on their talk page, replacing ''IP'' with the suffix of the report.  Don't forget to sign your post.
|}

==Userbox==
Project members can display this userbox on their userpage(s):

{{tlu|Wikipedia:Abuse response/UserBox}}{{Wikipedia:Abuse_response/UserBox}}

==External links==
;[[WHOIS]] websites

* [http://www.dnsstuff.com/ DNSstuff]
* [http://www.domaintools.com/ Domain Tools]
* [http://toolserver.org/~overlordq/cgi-bin/whois.cgi OverlordQ's WHOIS Tool]
* [http://www.samspade.org Sam Spade]

;[[Regional Internet registry|Regional Internet registries]]
* [http://www.arin.net American Registry for Internet Numbers (North America)]
* [http://www.ripe.net/ Réseaux IP Européens Network Coordination Centre (Europe)]
* [http://www.afrinic.net African Internet Numbers Registry (Africa)]
* [http://www.apnic.net Asia Pacific Network Information Center (Asia-Pacific)]
* [http://lacnic.net/en Latin American and Carribean Internet Addresses Registry (Latin America/Carribean)]

;Other
* [http://www.abuse.net/ Network Abuse Clearinghouse]

==See also==
* [[Wikipedia:Abuse response]]
* [[Wikipedia:Blocking policy]]
* [[Wikipedia:ISP contact information]]
* [[Wikipedia:AOL|Dealing with AOL vandals]]

[[Category:Wikipedia abuse response documentation]]