Wikipedia:Abuse response/Karmaisking

Abuse Response
Abuse Response
Report Status
IP Address	NO IP SPECIFIED
Contributions	NO IP SPECIFIED
Page Moves	NO IP SPECIFIED
Block Log	NO IP SPECIFIED
Contribution History	NO IP SPECIFIED
Status	Closed
Requestor	Netalarmtalk
Date	04:11, 4 August 2010 (UTC)
Investigator	ANowlin talk
Contactor	«l\| Promethean ™\|l» (talk)

Report status

Case Brief

This case investigates the IP of several socks of User:Karmaisking, in an attempt to build a report, and request action by the ISP. The sockmaster in question has a significant record of long term abuse, and has numerous socks.

Requester comments

Deferred from long-term abuse for contact with Internet service provider. The most recent socks include AffirmativeInaction (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) and Gaynomics (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log). As this is a deferred report, the investigation on the account is already done and may be reviewed at Wikipedia:Long-term abuse/Karmaisking. A checkuser would be needed to get the IP for the latest socks for contact. Netalarm^talk 04:11, 4 August 2010 (UTC)[reply]

There are more recent socks at the SPI. These are the 2 most recently listed. ANowlin ^talk 04:36, 16 August 2010 (UTC)[reply]

LocustsCan'tPlan (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
EvilPays (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)

Discussion

[Discussion is on the talk page.]

Case opened

Definitely needs to be investigated, and ISP contacted. User has been recently active, and is currently blocked. Requesting a CU to verify the IP reported was the most recent IP. --ANowlin: talk 03:08, 16 August 2010 (UTC)[reply]

Investigation

Preparing a report before reporting to the ISP. User seems to be active primarily from 3 or so IPs. Reporting the most active, so they should be able to figure out who it is easily. ANowlin ^talk 06:10, 16 August 2010 (UTC)[reply]

Registry information

<ip removed> WHOIS report
Summarized WHOIS report:

NetRange:       114.0.0.0 - 114.255.255.255
CIDR:           114.0.0.0/8
OriginAS:       
NetName:        APNIC-114
NetHandle:      NET-114-0-0-0-1
Parent:         
NetType:        Allocated to APNIC
NameServer:     TINNIE.ARIN.NET
NameServer:     SEC1.AUTHDNS.RIPE.NET
NameServer:     NS4.APNIC.NET
NameServer:     NS3.APNIC.NET
NameServer:     NS1.APNIC.NET
NameServer:     NS2.LACNIC.NET
Comment:        This IP address range is not registered in the ARIN database.
Comment:        For details, refer to the APNIC Whois Database via
Comment:        WHOIS.APNIC.NET or http://wq.apnic.net/apnic-bin/whois.pl
Comment:        ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
Comment:        for the Asia Pacific region. APNIC does not operate networks
Comment:        using this IP address range and is not able to investigate
Comment:        spam or abuse reports relating to these addresses. For more
Comment:        help, refer to 
http://www.apnic.net/apnic-info/whois_search2/abuse-and-spamming
RegDate:        2007-10-29
Updated:        2010-07-30
Ref:            http://whois.arin.net/rest/net/NET-114-0-0-0-1

OrgName:        Asia Pacific Network Information Centre
OrgId:          APNIC
Address:        PO Box 2131
City:           Milton
StateProv:      QLD
PostalCode:     4064
Country:        AU
RegDate:        
Updated:        2004-03-01
Ref:            http://whois.arin.net/rest/org/APNIC

ReferralServer: whois://whois.apnic.net

OrgTechHandle: AWC12-ARIN
OrgTechName:   APNIC Whois Contact
OrgTechPhone:  +61 7 3858 3188 
OrgTechEmail:  
OrgTechRef:    http://whois.arin.net/rest/poc/AWC12-ARIN

== Additional Information From whois://whois.apnic.net ==

inetnum:      114.78.0.0 - 114.78.255.255
netname:      OPTUSINTERNET-AU
descr:        OPTUS INTERNET - RETAIL
descr:        INTERNET SERVICES
descr:        1 Lyonpark Road, Macquarie Park, NSW - 2113
country:      AU
admin-c:      OI3-AP
tech-c:       OI3-AP
mnt-by:       APNIC-HM
mnt-lower:    MAINT-AU-OPTUSINTERNET
status:       ALLOCATED PORTABLE
remarks:      -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
remarks:      This object can only be updated by APNIC hostmasters.
remarks:      To update this object, please contact APNIC
remarks:      hostmasters and include your organisation's account
remarks:      name in the subject line.
remarks:      -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
changed:       20080514
source:       APNIC

role:           Optus Internet
address:        1 Lyonpark Rd.
address:        Macquarie Park, NSW 2113
country:        AU
phone:          +61-2-8085-8279
fax-no:         +61-2-8085-5107
e-mail:         
admin-c:        OI1-AP
tech-c:         OI1-AP
nic-hdl:        OI3-AP
notify:         
mnt-by:         MAINT-AU-OPTUSINTERNET
changed:         20040502
changed:         20041020
changed:         20100226
changed:         20100406
source:         APNIC

Abuse analysis

Target Page or Category: Articles dealing with economics.

Actions against all socks
Type of action	Count
No. of abusive edits (blatant)	>1000
No. of warnings	>100
No. of blocks	>100
Other edits (non-blatant violations)	Undetermined (~ < 5% of all contribs)
Blanked own userpage	Undetermined

SPI Archived Reports: See Wikipedia:Sockpuppet investigations/Karmaisking/Archive.

Abuse summary

From LTA: Some sockpuppets have been numbered in numerical order. The list of sockpuppets that follow this pattern may be found in the sockpuppet category. A few other sockpuppets also include "karma" in the username, which may be used to identify the user.

User:Lagrandebanquesucre was a particularly egregious devious approach, which began by attacking User:Karmaisking.

Edits primarily on pages related to fractional reserve banking (e.g. criticism of fractional-reserve banking), the Austrian school of economics, and various other pages related to libertarian issues. He has also started editing articles on Keynesian economics and Keynesian economists in order to attack them.

Extensive use of multiple sockpuppets at the same time. (See Sockpuppets of Karmaisking and Suspected sockpuppets of Karmaisking.)

Uses throwaway accounts or anon IPs that geolocate to Australia.

Often claims to be a new user, starting off with innocuous edits, sometimes even attacking or reverting a previous known sock.

Uses misleading edit summaries, sometimes claims to revert the edit of another sock in order to hide the edits.

Contact summary

Case history
Investigated by:	*ANowlin ^talk*
Contacted by:	«l\| Promethean ™\|l» (talk)
Closed on:	19:50, 17 August 2010 (UTC)
Disposition:
Case log:	Approved for investigation. *ANowlin ^talk* 04:32, 16 August 2010 (UTC)[reply] Additional information needed Need the IP from the most recent confirmed sock, listed above (or at the time of CU check). *ANowlin ^talk* 04:44, 16 August 2010 (UTC)[reply] Note: Checkuser sent IP info to mailing list. Most recent (and most active IP) has been selected for the contact. IPs from all users mention tie back to Sydney's Optus Internet. *ANowlin ^talk* 05:48, 16 August 2010 (UTC)[reply] Note: Estimates added to the abuse and edit analysis areas. Due to the extensive number of socks, this information would be very difficult to accurately determine. I'm going to take another look over it before I submit to ISP. *ANowlin ^talk* 06:39, 16 August 2010 (UTC)[reply] Note: This may be best done with a phonecall as it would better convey the extensiveness and seriousness of the abuse. Seeing as I'm in Australia I'm more than happy to make a call. «l\| Promethean ™\|l» (talk) 17:26, 16 August 2010 (UTC)[reply] Report done, ISP being contacted. Report Done. Promethean: Contact when ready! *ANowlin ^talk* 21:45, 16 August 2010 (UTC)[reply] Per Promethean: After discussion with the NOC at Optus, they have opened a ticket, and have received a copy of this report. *ANowlin ^talk* 19:50, 17 August 2010 (UTC)[reply]