Publius & Co.

Troll Infestation, part two.

Earlier in the week, I mentioned a troll infestation at one of my rat discussion groups. Someone posted a link to an offensive video (and it would probably be offensive to pretty much anybody, but it was especially offensive to rat people), then other trolls started leaving droppings on the board.

It happened last Saturday, on the weekend , and the moderators choose weekends to have a life. With no moderators around, I took it on myself to try to limit views of that video. We have lots of kids on our forum, and they don't need to see that kind of shit. But...we started getting more troll droppings.

Eventually a mod showed up and deleted the offensive posts and threads. I realized we only had one chance to track the trolls down and put a stop to this, and we had to do it soon.

You see, I was an adolescent boy once. I had a strong feeling about what was going on (later turned out I was pretty much right). I also knew that if some action--some serious action--weren't taken PDQ, we'd have scores of trolls hitting the forum. One moderator wouldn't be able to handle it by herself (the admin was taking most of the weekend off to have a life).

I asked the mod, via the thread that was getting hit by trolls the most, to forward the IP's of the trolls to me, because I hoped that would make the kids back off: We get the IP's and they realize they're busted. (To be honest, no laws had really been broken--but kids frequently don't realize that.)

The mod posted the IP's in the troll warning thread, which I didn't expect her to do, but it worked out to our advantage. Brilliant stroke of luck, that.

Soon after the IP's were posted, someone posted this, under the username of one of the trolls:

I am (troll 1) and (troll 2) Father. I need our IP address taken down immediatly. I am extremly sorry for any sorrow or pain my sons have caused. I dont think that posting the IP was appropriate never the less. Please note that (troll 1) and (troll 2) only replied, and didn't mean to do anything wrong. They are 12 year old twins, with unsupervised acsess to the net. I am changing this now. Sorry again,
Jim (lastname).

I wondered if it was actually the troll father, but after he got flamed by some of our membership, he posted:

Yes, there was more than two of them. It was advertised on a Paintball forum, which both my sons belong to. I guess that theres no way to "prove" that I am telling the truth, but all that I ask is that I dont get hacked. I have business files on this computer, and that would pose a hazard for my business. Thanks, Jim (lastname)

and this:

They where sitting in the computer room laughing their heads off, so I looked in their history and found this site, then found their handels on the swimming rat thread. As I said before, they are being diciplined, and it wont happen again.

Sounded plausible, except for the misspellings. But if we really had a nervous businessman, afraid his computer might get hacked...I asked the IP's be taken down, and they were, but not before they were written down. Why, you may ask, did I want with their IP's?

Revenge. Sweet, sweet revenge.

You see, all ISP's have an Acceptable Use Policy (AUP) and all AUP's have something along the lines of this:

You are prohibited to use your (ISP) account in conducting activities that include, but are not limited to:
*Transmitting unsolicited messages which, in the sole judgement of your (ISP) Service provider, causes significant disruption or elicits complaints from other Internet users.
*Harassing users or groups in any way.
*Impersonating users from the (ISP) Service or any other Internet service providers in any way.

(That's taken from the AUP we tracked back via one of the IP's, by the way. Your ISP probably has something similar. Forewarned is forearmed and all that.)

I really only wanted the IP from the guy who posted the original link. If I got the others, great, but I didn't want them as badly as I wanted the original guy (Not that I'd let them off the hook--can't get even with one without getting even with the others. It's not fair, ya know?).

Sadly, we didn't have his IP--it disappeared when the mod deleted the messages. So I rolled up my sleeves: It was time for some serious detective work.

Like a lot of good detective work, though, I got a real lucky break. Remember how the mod posted the IP's on the warning thread, and a kid panicked and started acting like his father? If we had been hit by professional trolls and not a bunch of kids, the trolls wouldn't have mentioned they heard about this on a paintball forum, nor would they have registered on our board with the same names they use on the paintball forum. Finally, the original troll used the word paintball in his user name on the rat list. That made me think it really did start at a paintball forum.

I think I would've found them eventually, but all that info made it go a lot faster. Stupid amateurs--remind me not to rob a bank with them in the future!

The ISP's were all Canadian. The information had been posted on a paintball forum. I knew the name and URL of our rat forum and I suspected they were mentioned on the paintball forum (I was right). At the time, I didn't know the kids had registered on our board with the same username they used on the paintball forum, but I did know I was dealing with kids, and kids tend not to be original sometimes.

With Google, I found the paintball forum in less than an hour, and it was all there. The original discussion of the video. The post where someone posted, "Dude, you should go on a forum that is all into mice and hamsters and stuff like that, and post that video..." The bragging and links to posts on our forum, and the frustration when they discovered the threads had been deleted.

Even better was this:

BTW, they also called us "trolls" and have your IP as well as (troll 2), but it's all good they wouldn't do anything stupid.

...Which got this response:

Oh shit... I need my IP off there QUICK!

It was actually pretty enjoyable reading how those kids went from, "I'm da MAN!" to pooping in their pants when they discovered we had their IP's. Heh.

Thank God for FILE/SAVE AS. I still have my screen caps of their threads.

By the time I found the paintball forum, the thread had been locked by a moderator, who left the kids with this thought:

anywho. im (not) gonna delete this post.. why? you're gonna get what you deserve...

Lord, ain't it the truth?

***

In the meantime, the rat forum moderators recommended to the rat admin I be made a moderator.

So I joined the paintball forum. I had played paintball, rather frequently, back in the 80's, back when it was called The Survival Game and all we had were Nelspot paint markers and shop goggles. I figure that qualifies me to register. Besides, I had to get a note to the admin somehow--only this note would now be moderator-to-moderator...professional courtesy and all that...

The admins *loved* the note I sent them. I won't reprint my note here, but his reaction to it was priceless:

Well, here is a message i receive from the staff of (rat forum).

(Admin 1): My name is Victor, and I'm a co-moderator on the (rat forum) rat list.
[DELETEd stuff here--but I asked him for the IP's of several of his users.]
Any help you can give us would be appreciated. I am also sending this message to (Admin2).
--Victor

Now, i'm not going to give them the IPs, although i should. This will be handled here, and if anyone else from here starts causing trouble with other sites respresenting this site..... oh man, will you regret it.

You think we were strict before... now you watch.

Thanks for helping represent the (paintball forum) is such a great way.

That's what he told his users. What he told me was quite different, because I think he knew what a favor I was doing for him.

When all of that bragging was going back and forth on the original thread, all of those words became property of the paintball forum, and any actions became the responsibility of the forum. Think of the responsibility a company has for the actions of its employee's and you'll see what I mean.

Remember the user AUP's I referred to earlier? The forum has AUP's they have to abide by, too...and allowing that kind of stuff to go on left the paintball forum responsible to their ISP. One note and that forum would come crashing down so fast they'd have felt it in Australia.

In my note, I told them I know the moderators and forum were not responsible for the harrasment. What I think they read, and what I wanted them to read was Give me the IP's and your ISP won't hear a word from me.

So he told his forum members he wouldn't give them the IP's, and I'll respect that.

There's no need to really talk about what was in the private note he sent to me. I can make this comment, though: Professional courtesy is a wonderful thing.

Notes went out to a couple of Canadian ISP's the next morning.

Heh.

Posted by Victor at Octubre 4, 2003 05:13 PM