As many of us know, Dennis Markuze, a Canadian with problems, used to send tons of bizarre and threatening emails to many atheists. I’d often get several per day, some threatening removal of my head. See here and here for a discussion of his behavior. Here’s a photo of him taken by Tessa Brown at the October 2010 AAI convention and posted, I recall, by P. Z. Myers:
So I started a bit this morning when I saw this post up for approval, which I of course put into the trash. What freaked me out was that it was from “drmabus”, for “Davis Mabus” was Markuze’s pseudonym for many of his threats.
Submitted on 2012/08/20 at 10:39 pm5000 whining atheists vs the Great Prophet
clubconspiracy.com/forum/showthread.php?p=81388
youtube.com/watch?v=s3lwG4MytSI
one applicant right here…
get the POINT, Randi….
That style is pure Markuze. The video links to the atheist discussion hosted by Cara Santa Maria (a nice one; watch it), while the other links to a “David Mabus” post, which notes “what if I told you that I am not who you think I am….Not Dennis Markuze – but a FAN!”
I’m a bit suspicious, though, and so, given the history of the real Markuze, will put up the information associated with the post:
drmabus
ftbully@rushpost.com
81.94.201.82
The IP address appears to be from the UK, and the email address is probably fake, but if anyone can trace these things, I’d appreciate any help. Markuze is noted for his facility in changing IP addresses, which made it almost impossible to keep him out of websites or email spam filters.
As RationalWiki notes:
After an August 2011 online petition attracted more than 5000 signatures, each resulting in an e-mail to the Montreal police,the police took action and announced they were finally investigating years of complaints (after pleading with people to stop sending them emails) and arrested Markuze on August 16. The story of how the petition came about, with organization taking place via Twitter, has been documented in a detailed blog post that includes much of the history. Markuze was charged with 16 counts of criminal harassment on August 15 and August 17, 2011. To the relief of many concerned for his well-being, the criminal court ordered him to undergo a 30 days psychological evaluation. After being diagnosed with bipolar disorder, compounded by alcohol and substance abuse, Markuze was sent to rehab while awaiting the next court date but may now be out and doing his usual stuff. After pleading guilty to issuing threats, he received a suspended sentence of 18 months. Less than two months from the news of his sentencing, Markuze now appears to be violating the terms of his suspended sentence, which required him to abstain from internet discussions and forums.
My guess is that this is indeed Markuze, pretending to be a “fan”. If it is, then he still needs help.
It reeks of Markuze, no question.
You should know. Markuze has hit you twice in the last few days over at your blog.
Same thing at my discussion board recently and numerous other places.
See this post from ‘The Atheist Experience’ at Freethought Blogs.
http://freethoughtblogs.com/axp/2012/07/26/is-dennis-markuze-already-violating-the-terms-of-his-suspended-sentence/
David B
Sad. They guy needs help.
That ‘5000 whining atheists’ message is now on RDF too. Posted by ‘thepoint2’…
Shortly after Markuze was released from custody, someone claiming to be his “fan” hit our boards several times in a 2-day period, using various pseudos inclulding ftbuly, freethoughtbullies, and xjusticexxx. I intuit that this is indeed Markuze, violating the terms of his legal obligations (useful links at Patheos:http://www.patheos.com/blogs/friendlyatheist/2012/06/01/an-update-on-dennis-markuzedavid-mabus/). He’s but a nuisance for us, but those sufficiently bothered by the postings/emails should report usernames, IP’s, and content to the relevant authorities.
He’s been popping up at the Slyme Pit a lot, mostly people ignore him. If you respond, it just encourages him and it will probably result in him being re-arrested, which may or may not be a good thing. I’d rather he just took his meds and followed his parole restrictions.
I have to ask: your avatar is a corn snake?
I hope for his sake it isn’t, but it sure looks like his style. No-one else posts like that, and for heaven’s sake – he never had any fans.
If he has a real fan, then this fan is not doing him any service. Imagine if DM is just trying to cope with his rehab stuff, and some jackass decides to mess it all up. I kinda feel for the guy.
If it’s him, though, suspended sentence might be unsuspended.
That IP address belongs to a server hosting company, so he’s probably using it to bounce off of and spoof most back tracing attempts. He either rented the server himself, or else there is an “anonymity” webpage hosting on that server.
In any case, he could realistically be anywhere.
http://www.redstation.com/ is the hosting service in case he becomes more trouble and an investigation is in order.
Markuze almost never used the same email or IP address twice, and always used one that was spoofed. It’s not hard to do – all you have to do is frequent internet cafes and make use of email providers that supply addresses that can’t be replied to or tracked by conventional means. I used to be an admin on a site he used to hit regularly, although nothing to the extent to which he used to frequent other places. He never used the same IP or email address more than once.
So it could be a meticulous copycat. But seeing as he never had an “admirers” in the past, it doesn’t seem likely that he has any now.
Oh, it’s much easier than that to fake a sender address. All you have to do is from a terminal type:
and after you have a connection type:
Sorry I left the “25” out – the port address but you get my gist.
redstation.com I think is where IPRivo users appear to come from. Not that I’ve ever browsed anonymously but I have a friend who may have once or twice.
This past spring various buildings at the U of Pittsburgh were emptied on a daily basis over the course of nearly a month because of threats that came via these bouncing services. Very recently an unusually unlikely perp has been identified – a 64y/o Scottish separatist with multiple sclerosis operating in Dublin. Totally bizarre and with no apparent connection with or motive for targeting Pitt. The Federales are not talking much about how they cracked this; the only reason for noting it here is that these apparently impregnable reforwarding sites are not entirely impregnable.
You should immediately forward anything disturbing from this person to the Montreal police and ask them to follow up. They did a good job last time and are well aware of Markuze and the restrictions he is supposed to be operating under.
I dispute whether the Montreal police could be characterized as having done a “good job”. They were aware of Markuze’s threats for years and were only prodded into acting after public scrutiny in a local paper and an online petition that flooded their e-mail address with thousands of signatures.
rushpost.com exists but there isn’t a mailserver configured on that address. If there were it would be possible to connect to it on port 25. (This is the first thing a remote machine does when it forwards an email to the server) Attempting to do this by hand yields:
As you can see the connection was refused. So the address is definitely fake. Even if it were a real email adderess it doesn’t follow that it would be his. My mailserver checks to see that all the email addresses in the envelope or the header actually exist before accepting an email, but this is a relatively expensive operation and I get the impression that most large providers of email services don’t bother. Many spammers regularly use other people’s email addresses to get round things like this.
To reliably find out where an email comes from you have to have access to a data structure called the envelope. Because of the way mail servers are configured this can normally only be done while the email is being transferred to your server, once it has arrived it’s too late, and in any case only reliably gives you an IP address.
The email is almost certainly not valid; however, telneting to port 25 of rushpost.com isn’t going to work since (A) that host is not the MX site for rushpost.com and it is MX sites that handle mail
Instead those are
rushpost.com mail is handled by 10 in1-smtp.messagingengine.com.
rushpost.com mail is handled by 20 in2-smtp.messagingengine.com.
(the first has first dibs)
and these expand out to
in1-smtp.messagingengine.com has address 66.111.4.71
in1-smtp.messagingengine.com has address 66.111.4.72
in1-smtp.messagingengine.com has address 66.111.4.73
in1-smtp.messagingengine.com has address 66.111.4.70
in2-smtp.messagingengine.com has address 82.145.212.141
in2-smtp.messagingengine.com has address 82.145.212.142
(B) It is also likely that there are firewalls either on their end or your IP provider end that prohibit contact on port 25 except from legitimate mail servers (for instance at work I cannot directly telnet to port 25 except to internal machines unless I’m on one of the handful machines authorized to do so).
Dr. Coyne seemed to be indicating it was sourced from a “post” to his not-a-blog website (much like these remarks) with an email for attribution, rather than given in an email per se.
A quick check of http://Rushpost.com makes it seem fastmail.fm is the underlying Email host.
This nut is truly dangerous, and is not about to stop what he’s doing. I sincerely hope that he ends up in jail or a mental facility before he begins acting out his threats.
Thanks to everyone else on this post that were able to comment about this person, who has a diagnosed mental condition, without calling him demeaning names. He has issues, he needs help, but calling him names says more about you than him.
From what I can make out, the dnsbl.tornevall.org blacklist currently lists the 81.94.201.82 address as a scanned, working, “abusive host”-type anonymous HTTP proxy server.
In something nearer English: it’s a relay station, for hiding the true source.
Yes, we have been tracking his posts for months now. I have quite a file of IP addresses and emails that someone (who sure does appear to be him) has been using. Unfortunately last week he started using proxy servers again, which is why you see a non-Montreal IP address on this post.
I have been in touch with the police personally, along with others of the people listed in the eight counts he pled to on May 22. The problem has been that the police were denying that any restrictions were put on him when he was released.
That was quite frustrating, but we managed to interest a reporter up there (who was present in court for the plea on May 22) in this as a story in itself – that the police and court are not communicating. They were on the verge of printing a story to that effect last Thursday when the newspaper’s lawyer intervened.
The latest news is that the police, in part because of this prodding from the newspaper, now admit that there ARE restrictions on Markuze based on his May 22 plea. We have renewed our requests that they investigate, but I haven’t been contacted since then. We’re in “wait and see” mode right now.
If anyone has evidence (including IP address, date+time, TIME ZONE of your system, and email) they want to send somewhere, you can send it to me at webmaster at whatstheharm dot net. But frankly, these non-Montreal IP addresses that lead to proxy servers are not all that useful from an investigative standpoint.
The good news is we got plenty of Montreal IPs logged in late July and early August before this person started using proxies, so that should be enough to get the police started. I hope.
From a purely selfish standpoint, it seems that Markuze’s volume is waaaaay down, so in terms of immediate effect he’s not really any worse than any other run-of-the-mill troll at this point.
But it’s good people are pursuing it, because it is not a good indicator for Markuze’s own personal mental health.
I had 4 Tweets in a row from this guy just last week. Am glad he’s getting help but as with so many things, he has to learn to want to stop this behaviour before he’s able to stop. A combination of mental illness * religion rarely ends well.☮
There is now a Google+ account making the rounds, and posting the same stuff at, for instance Sandwalk .
The google+ ID is “David Mabus”,
https://plus.google.com/109869167877202648591/posts
As an update for anyone finding this post, Markuze was arrested again on November 16, 2012. I have all the details in this post at my blog, at this link:
http://skeptools.wordpress.com/2012/11/20/operation-archangel-david-mabus-dennis-markuze-montreal-arrested/