This help page is ahow-to guide. It explains concepts or processes used by the Wikipedia community. It is not one ofWikipedia's policies or guidelines, and may reflect varying levels ofconsensus.

Shortcuts WP:GAIAVWP:GAIAV WP:GAIVWP:GAIV

This is a guide to reporting users toWikipedia:Administrator intervention against vandalism (shortcuts:WP:AIAV, andWP:AIV). This guide is intended to prevent invalid reports that needlessly take upadministrators' time, thereby allowing vandals more time to cause havoc before beingblocked.

First, read the policy atWikipedia:Vandalism andWikipedia:Spam. Administrator intervention against vandalism is for reporting userscurrently engaging in persistent, clear vandalism or spamming. See the section "When reporting at AIV is not appropriate" for handling common incidents that should not be reported here.

Report only clear violations that do not require discussion or detailed explanations. If there is a reasonable chance that something maynot be vandalism, it should probably be reported elsewhere, or not at all.

Vandals shouldalways receive enoughwarnings before being reported unless they arevandalism-only accounts. What constitutes "enough" is left to your best judgment. Consider the user's past edits, warnings and blocks, the severity of their offense, the likelihood that their edit(s) could have been made in error or otherwise ingood faith, and the type of user in question (IP addresses may be shared or dynamic, and old warnings could be irrelevant to the current situation).

Blocking is meant to be preventive, not punitive. Therefore, the user must show a strong likelihood of making further disruptive edits despite warnings and being informed of the blocking policy. Always give a final warning, and report only if the vandal has vandalized at least onceafter that. (A final warning is a "level 4" warning, usually{{uw-vandalism4}} or, in more extreme cases,{{uw-vandalism4im}}.) Administrators are likely to remove your report if they feel that the vandal has been insufficiently warned or has stopped after the final warning.

All reports should be placed at the bottom of the "User-reported" section ofWikipedia:Administrator intervention against vandalism, using the format described below:

To report a user, you should use the{{vandal}} template. Your report should look something like:
*{{vandal|Example user}} concise reason e.g. vandalised past 4th warning. ~~~~
This will appear as

• Example user (talk ·contribs ·deleted contribs ·nuke contribs ·logs ·filter log ·block user ·block log) concise reason e.g. vandalised past 4th warning.James086^Talk13:11, 13 March 2007 (UTC)[reply]

Minor caveat: if the username has an equals sign(=) in it, you'll need to use{{vandal|1=Username}}. Don't worry too much about broken reports, though!

• Any vandal who hasn't been warned properly should not be reported, except for egregious cases.
• Violations of thethree-revert rule should be reported toWikipedia:Administrators' noticeboard/3RR
• If you suspect someone ofsockpuppetry, file a report atWikipedia:Sockpuppet investigations. Obvious and malicious sockpuppets engaging in vandalism may be reported to AIV. A link to the sockpuppetry report should be included in the reason for reporting.
• Usernames that clearly violateusername policy should be reported atWikipedia:Usernames for administrator attention.
• Do not report edit wars or other disruptive behavior that doesn't fit the description atWikipedia:Vandalism. These can instead be reported to theadministrators' noticeboard or itsincidents subpage. AIV deals mainly with obviously malicious edits that require no discussion; complex cases should usually be referred to other boards.

If you reported a user or IP address to administrator intervention against vandalism and they weren't blocked, you should first check the page history; most administrators explain in their edit summary why they are removing an entry without blocking it. If no reason is given, you can (politely!) ask the administrator who removed the report from the page. Some of the more common reasons are listed below:

• The user hasn't been warned sufficiently.
• The user stopped making malicious edits since the final warning, especially if it was an IP address.
• The administrator deems the warnings inappropriate—for example, in the case of a content dispute.
• If it is an IP address, it may be shared; blocking could affect many users at once. Administrators are reluctant to block such IPs because doing so may causecollateral damage, especially in the case ofsensitive IP addresses.
• You haven't used the appropriate template, and the bots removed the report as a comment.

Also:

• If administrators don't act on reports within 4–8 hours, the reports are considered stale and are removed. If this happens you'll need to resubmit your report.

• User:Ritchie333/Plain and simple guide to vandalism

• Wikipedia how-to

• Noindexed pages