the vandalism was coming from autoconfirmed users the pages had been semi protected ages ago so the problem was not ips and very new editors unfortunately talk