Wikipedia:Abuse response/139.184.30.132

Discussion
 * Three month protracted period of vandalism, with two temp blocks which have failed to deter continued attacks against articles on Wikipedia. Although this IP is registered to University of Sussex it is clearly intended only for vandalism. ColdmachineTalk 16:41, 12 February 2008 (UTC)


 * Accept, blocked only four times, but in very recent history. Similar cases have been accepted in the past, so we'll see what we can do. GO-PCHS-NJROTC (talk) 01:33, 13 February 2008 (UTC)

Contact made
The following message was sent to central.sussex.ac.uk@abuse.net, ccfl1@central.sussex.ac.uk, J.S.Goodlet@sussex.ac.uk, mikel@central.sussex.ac.uk, and D.M.Lewney@sussex.ac.uk:

Hi, this is GO-PCHS-NJROTC writing you about abuse originating from one of you students or staff. I am a volunteer with the Wikipedia:Abuse reports project at http://en.wikipedia.org. Wikipedia is the free encyclopedia that everyone is welcome to edit in a constructive manner. However, some of your network's users have been making destructive edits. Below is a log of destructive edits made by your user(s). It is in GMT -05:00 format. A more complete version can be found at http://en.wikipedia.org/wiki/Special:Contributions/139.184.30.132

Log of 139.184.30.132: 2008-02-12T11:40:08 (hist) (diff) University of Oxford‎ (→Organisation) 2008-02-12T11:34:06 (hist) (diff) University of Oxford‎ (→History) 2008-02-11T20:41:23 (hist) (diff) Greatest Hits (Morrissey album)‎ (→Track listing) 2008-02-10T15:53:49 (hist) (diff) Lech Kaczyński‎ (→Personal life) 2008-02-10T14:25:10 (hist) (diff) Sheffield Wednesday F.C.‎ 2008-02-09T06:01:10 (hist) (diff) Roy Marsden‎ 2008-02-09T05:47:04 (hist) (diff) Roy Marsden 2008-02-08T13:47:18 (hist) (diff) Darren Bent‎ (→Tottenham Hotspur) 2008-02-08T10:04:03 (hist) (diff) Samuel Francis Du Pont‎ 2008-02-07T09:13:36 (hist) (diff) Sussex‎ (→Relief) 2008-02-07T08:30:27 (hist) (diff) Lech Kaczyński‎ (→Personal life) 2008-02-07T08:25:52 (hist) (diff) Sussex‎ (→Geography) 2008-02-05T08:09:41 (hist) (diff) Ladies College‎ 2008-02-05T08:07:17 (hist) (diff) Ladies College‎ 2008-02-05T06:18:52 (hist) (diff) Quantum mechanics‎ (→Overview) 2008-02-05T06:13:33 (hist) (diff) Quantum mechanics‎ (→Overview) 2008-01-28T08:51:49 (hist) (diff) Jason Scotland‎ 2008-01-28T08:51:18 (hist) (diff) Jason Scotland‎ 2008-01-24T17:54:34 (hist) (diff) Morwenna Banks‎ 2008-01-24T17:53:27 (hist) (diff) Morwenna Banks‎ 2008-01-24T17:52:49 (hist) (diff) Morwenna Banks‎ 2008-01-24T14:45:19 (hist) (diff) Ormskirk School‎ 2008-01-24T12:43:14 (hist) (diff) Khaemwaset (20th dynasty)‎ (top) 2008-01-24T12:42:38 (hist) (diff) Khaemwaset (20th dynasty)‎ 2008-01-21T16:59:00 (hist) (diff) Jon Bon Jovi‎ (→Early life) 2008-01-21T16:53:21 (hist) (diff) Jon Bon Jovi‎ (→1980s) 2008-01-21T16:52:30 (hist) (diff) Jon Bon Jovi‎ (→Early life) 2008-01-21T16:50:54 (hist) (diff) Jon Bon Jovi‎ (→Biography) 2008-01-21T16:49:41 (hist) (diff) Jon Bon Jovi‎ (→Biography)

j.maris@sussex.ac.uk
Hello,

Thank you for the report below.

I am investigating it.

Regards,

Jeremy Maris.

irt@csirt.ja.net (perhaps they were contacted by central.sussex.ac.uk@abuse.net)
Thank you for the report. I shall contact the site responsible and ask them to take action according to their AUP.

Regards,

James

James Davis       0870 8502340 JANET CSIRT Member

-- Mission successful! GO-PCHS-NJROTC (talk) 23:19, 15 February 2008 (UTC)

Vandalism resumed when prior block (of 6 mo. duration) expired
--Joe Sperrazza (talk) 16:03, 25 November 2008 (UTC)
 * IP has been blocked 5 times
 * Last block was in April 2008, with duration of 6 months (expired end of October)
 * Vandalism resumed when block expired
 * Numerous warnings given on IP's talk page; almost all (but not 100%) of edits from this IP are vandalism
 * Prior abuse report resulted in contact being made, but vandalism is escalating


 * The IP in question is a shared IP, so there may always be people using it to experiment and/or blatantly vandalize. If there's a particular pattern that leads you to believe that it's one individual vandalizing, please note that in your report. The only three ways that vandalism from a shared IP will totally cease due to an abuse report is 1> the report itself scares everybody 2> the network admin catches every incident before it is saved and logs the responsible user off the network or 3> the network administrator adds Wikipedia to the org's web filter (which is certainly not the goal here since we could hardblock the IP instead, causing less collateral damage to users just looking stuff up here). However, I'm going to file another complaint and try to reduce the vandalism problem. PCHS-NJROTC  (Messages) 00:06, 8 December 2008 (UTC)


 * Contact has been made. :) PCHS-NJROTC  (Messages) 00:41, 8 December 2008 (UTC)

SussexInfoSec (talk) 13:26, 8 December 2008 (UTC) We are investigating this abuse. It seems that many recent edits are OK but that some destructive edits are linked to the previous pattern of vandalism. We will take action according to our AUP. NB that 139.184.30.132 is our web proxy through which all posts from the University are routed, staff and student.
 * I response I received gives the appearance that they have everything under control. PCHS-NJROTC  (Messages) 19:02, 22 December 2008 (UTC)
 * Per the request on my talk by SussexInfoSec I've changed the block to allow account recreation and reset it to six months. It might be worth a shot to try and get them to enable XFF but I'm not too familiar with this area. BJ Talk 16:47, 30 January 2009 (UTC)