Wikipedia:SNEAKY

Vandalism is prohibited. While editors are encouraged to warn and educate vandals, warnings are by no means necessary for an administrator to block (although administrators usually only block when multiple warnings have been issued).

Even if misguided, willfully against consensus, or disruptive, any good-faith effort to improve the encyclopedia is not vandalism. For example, edit warring over how exactly to present encyclopedic content is not vandalism. Careful consideration may be required to differentiate between edits that are beneficial, edits that are detrimental but well-intentioned, and edits that are vandalism. Mislabeling good-faith edits as vandalism can be considered harmful.

Upon discovering vandalism, revert such edits, using the undo function or an anti-vandalism tool. Once the vandalism is undone, you should warn the vandalizing editor. Notify administrators at the vandalism noticeboard of editors who continue to vandalize after multiple warnings, and administrators should intervene to preserve content and prevent further disruption by blocking such editors. Users whose main or sole purpose is clearly vandalism may be blocked indefinitely without warning.

Useful ways to detect vandalism include:

In all the three methods above, examples of suspicious edits are those performed by IP addresses, red linked, or obviously improvised usernames. A good way to start is to click on every edit in watchlists, histories etc. with the least suspicion of being vandalism. Increased experience will probably give a sense of which edit descriptions are worth to check further and which may likely be ignored. IP editors should not be approached with the assumption that they are vandals. Although many vandals do vandalize without registering an account, there are many IP editors who are . Always read the actual changes made and judge on that, rather than who made the changes or what was entered in the edit summary.

...
Wikipedia