Wikipedia:Requests for checkuser/Case/Chakabuh

[edit] Chakabuh

• Chakabuh (talk • contribs • logs • block user • block log • checkuser)
• Newssourceusa (talk • contribs • logs • block user • block log • checkuser)
• Qed-news (talk • contribs • logs • block user • block log • checkuser)
• 72.224.170.144 (talk • contribs • WHOIS • block user • block log • checkip)
• 68.165.190.33 (talk • contribs • WHOIS • block user • block log • checkip)
• 66.167.180.248 (talk • contribs • WHOIS • block user • block log • checkip)
• 166.70.177.1 (talk • contribs • WHOIS • block user • block log • checkip)

Several user accounts and IP addresses have recently vandalized articles related to email spam fighters -- people and organizations that track down and stop spammers. Vandalized articles include The Spamhaus Project, Steve Linford, and SPEWS. User:Chakabuh has been trying to insert libellous claims into Brian J. Bruns and may be the same person.

The user in question is probably affiliated with spammers, and may be abusing Wikipedia for other purposes (e.g. to promote a spam business). There may be other puppets I've missed above, too. --FOo 04:03, 2 June 2006 (UTC)

Did some Googleling/whois/traceroutes/calls. 166.70.177.1 appears to be based out of Salt Lake City, Utah (it looks like a library if the rdns is to be believed). The comment in the edit 166.70.177.1 made to the page on me is very very close style/wording wise to what Barbara Schwarz posts on usenet. However, as far as I know, she has been banned from the SLC Public Library, so it may be a sockpuppet or similar.Brian 19:30, 2 June 2006 (UTC)

• 84.115.71.45 (talk • contribs • WHOIS • block user • block log • checkip)
• 89.36.88.2 (talk • contribs • WHOIS • block user • block log • checkip)

These addresses vandalized the Spamhaus article and put ads for spamming servies on Bullet proof hosting, an article describing ISPs that host spammers. Possibly part of the same crew. --FOo 20:29, 3 June 2006 (UTC)

Additional information needed What exactly am I supposed to be checking here? Whether the accounts listed are associated with the IPs? Whether they're coming from the same area? This request seems to involve several different issues, and leaves out the connections. Could someone put together a concise summary of exactly what has gone on here? Essjay (Talk • Connect) 17:59, 4 June 2006 (UTC)

Thanks for your response. To answer your questions:

What exactly am I supposed to be checking here? Are the accounts and IP addresses being used by the same people? In dealing with the vandalism and harassment that these accounts and addresses have been committing, are we dealing with one person, or several? Whether they're coming from the same area is also relevant, particularly given Brian Bruns' brief investigation above suggesting that one is from the Salt Lake City area and could be a known harasser.

Exactly what has gone on here? I noticed on WP:AN/I that User:Chakabuh and User:Bruns were having a dispute over Chakabuh's creation of an article about Bruns, Brian J. Bruns, which contained false and malicious claims. Bruns wished the article to be deleted, or at least the libels removed from it.

(Bruns is a noted spamfighter; that is, a system administrator who does volunteer work to help other sysadmins reduce email spam for their users. Spamfighters often become victims of harassment by spammers, who naturally resent their work; as well as by cranks such as Brad Jesness and the aforementioned Barbara Schwarz.)

Around the same time, I had been dealing with vandalism on other articles related to spam and spamfighting tools, such as The Spamhaus Project and Steve Linford. (Linford is another spamfighter; Spamhaus is the international effort he founded.) The nature of the vandalism was similar in scope: it was to insert false and malicious claims about the person in question, and to direct users to off-Wiki sites containing more such claims and concocted or misrepresented "evidence" of them.

It occurred to me that Bruns and I could be dealing with the same offender here: a spammer or crank engaged in a pattern of Wikipedia abuse for the purpose of spreading derogatory falsehoods about spamfighters. This is a tactic that specific individual spammers have used before in other forums, the goals being (a) to harass the spamfighters into giving up their efforts; or (b) to convince others to distrust the spamfighters so that their efforts will be futile.

Wikipedia needs to resist being abused for this purpose, which clearly goes beyond simple vandalism into persistent and malicious harassment. (Some comparison could be drawn between this sort of harassment and that perpetrated by "Wikipedia Review" users to drive away or sow distrust against Wikipedia administrators.)

All I'm looking for is some determination which of these accounts and addresses represent the same offender. --FOo 18:57, 4 June 2006 (UTC)

Ahh, just noticed this on Usenet... I think the following post confirms that Chakabuh (166.70.177.1) is probably Barbara Schwarz or a sockpuppet/shill for her. [1] Brian 18:37, 7 June 2006 (UTC)

Note::

• Qed-news is 72.224.170.144; Newssourceusa is 72.224.169.2. Both are RoadRunner IPs registered to main; the same user, obviously.
• 84.115.71.45 has been used by SpamhausSucks. It's an Austrian IP.
• 89.36.88.2 has a single edit, not used by any contributor. It is a Romanian IP.
• 166.70.177.1 is a Salt Lake City IP, registered to XMission.com, a hosting company. It has been used by a number of different types of unsavory users; I've blocked it, as little good traffic comes from hosting companies. This IP has been used by Chakabuh.
• 66.167.180.248 and 68.165.190.33 are registered to Covad Communications Co. in San Jose, California, a combination hosting company/DSL/T1 provider. Each has only a few edits, and no logged in editors; if they continue to be a problem, they can be blocked.
• The Rest of Chakabuh's traffic has come from Electric Lightwave Inc, a hosting company in Vancouver.

In short, it seems the only common thread here is the subject matter (spammers/spamming). Essjay (Talk • Connect) 21:22, 4 June 2006 (UTC)