Banning the unbannable - I really need help here

by Kingbry December 26th 2008, 8:46 am

Over the past two years my forum, which is mostly girls in their early teens, has been targetted by a very persistent and aggressive bully that we simply can not rid ourselves of. He has been banned at least 3 times, although I suspect the number is at least double that.

He has a non-static IP address, so I can't IP ban him. I've banned each and every one of his accounts, and temporarily ban accounts I even suspect of being him. But he just gets a new account again and keeps attacking us and our members.

There has to be a way of making it so that he can't keep attacking our members. It's getting really bad. We had to shut down our forum for several months in hopes that he would move on to somewhere else, but he just wont stop.

As an additional security measure, I would also like to know if there is a way of making it so that new members don't have the ability to send PMs until we get to know them. This would make it so that he (or anyone else) is not able to bully people through PMs before we can catch him (I can usually recognize him by doing an IP search, with the location and the ISP info that appears after the I number, but I can't IP search until he makes a post.) He has also sent friends of his after us, and this would solve that problem too.

by Voltinova December 26th 2008, 9:41 am

To my knowledge, there is only 1 way to deal with Hackers. Report them to their Government. That will easily do the job, because they will call on the police, and they will be arrestted. Especially if your forum is all mostly Girls, in their teens that also comes under Pedifiling.
There is no way you can stop his friend, unless you do the same thing.
There is no way, unless I belive you use the Credits for the Templates, to do so. But correct me if I am wrong, because I haven't been in the upgrade area, as no one wants to Donate to our forum lol Razz

I really do hope some of this Info. help a bunch.
Cheers,
V~

by nimiel December 26th 2008, 10:41 am

hi. i suggest you to approve the members Wink

admin panel >> user and groups >> user options >> new accounts activation.
so that you can know who is signing up Wink

also, try to make a forum where guests can post so they may tell u they registered. hope i helped

by Kingbry December 26th 2008, 11:12 am

That might work, if there was any way of knowing that it was him (or his friends) signing up, but I can't uncover them until I can trace their IP. (Since they could just make up profile info).

As for involving the government, that would be rather complicated because the bully is Canadian, the owner of my forum is Canadian, I'm Canadian, but most of the members are from the US, and all of his favourite targets are from the US. I wouldn't know which government would be the one to involve. The other problem with that is that he appears to be the same age as a typical member of my forum, and he's either a way better actor than I think, or he's really a punk kid that just won't give up. I have considered involving his ISP, but unfortunately, I have deleted his original inflamatory posts in order to try and stop it from escalating (his bullying often seemed to be an attention seeking thing). He also did a lot of his bullying in the Chatbox, which was gone from the archives ages ago (and copy paste posts from the archives don't really prove anything objectively).

Eventually, because my members were (and still are) incredibly disturbed by him, he was tormenting the members by just being there, so there is nothing that you could really take to someone objective and show as 'proof'. It's possible there is something I could use in his PMs, but as an Admin, I don't have access to them.

I'm hoping there is some way within Forumotion that I can solve the problem.

by nimiel December 26th 2008, 11:33 am

hi, why not try to talk to him? it might solve the problem

by Kingbry December 26th 2008, 12:21 pm

yeah... tried that one already... many times over the past two years. In fact, just yesterday I exchanged a few PMs with him on another site. But the more attention he gets, the more determined he becomes.

But thanks anyway. Very Happy

by Nelsaidi December 26th 2008, 12:48 pm

Heres an idea, why not ban the whole IP range? - Thats the last 2, so for example 255.255.***.*** would ban him, and anyone from his isp from joining.

Another way would be add all the members to a group, which you manually add them to, and only people in that group can use the forums. Enable activation so you have to activate them too, and you can disable their pm when you activate the account.

by Kingbry December 26th 2008, 1:23 pm

Hmmm... that sounds like a somewhat risky idea... banning an entire ISP. I'd do it if it was something random, like Joe's Internet, but it is one of the biggest ISP's in Canada, so it would probably end up banning quite a few innocent people by accident.

But is there any way of knowing something slightly more narrow? So that it's more likely that it is only him that would get the boot?

But thank you, those are very helpful suggestions. I will definitely try to see if that works.

by Kingbry December 26th 2008, 1:44 pm

okay, I looked into his IPs a bit closely and there is nothing that is completely common in all of them, but it's possible he went on at his school or something for the odd one, and all the others are linked not by any numbers in the IP, but in a domain that you see beside the IP in most of his posts.

this domain looks like this:
CPE00e06112582f-CM0011aec55344.cpe.net.cable.rogers.com

The part that goes CPE00.... is different for every post, but the cpe.net.cable.rogers.com part is the same for the majority of his posts. (with the exception of a separate account that only has one known IP, so hopefully that one is static, and banning that IP and the domain will work.

So is it possible to ban "cpe.net.cable.rogers.com"? From my investigating, I don't think that all Rogers IP's are in that domain....

by Kingbry December 26th 2008, 2:04 pm

Sorry for all this posting but I am digging further and further into this. When I do the IP search from the site that comes up when you click on "search this IP" in the Moderator Control Panel... it turns out that all the IPs he's used actually come from the same IP.

I search for the IP, and then click on the "Personal Informations" tab. This is what comes up:

IP address : Some IP Address
Referer : https://ipgetinfo.com/?mode=ip〈=en&ip=The IP I Searched For

The one I call "Some IP Address" is always the same for each one I search for.

SO.... Can I ban "Some IP Address" and keep him out completely? Smile

by Kingbry December 26th 2008, 8:55 pm

Well that was nearly a disaster...

turns out the "Personal Informations" pane was about me, not the IP I searched for. So the IP that did change was my own IP. I almost banned myself. O.O

So I still really need help. Does Typlo or someone from FM have any ideas?

by Guest December 26th 2008, 9:12 pm

You can report this person directly to hi/her isp,check further down when you do an ip search usually there is an email address eg abuse@isp.com relating to their isp.
Report all of his activity to them as they have the ability to pull his internet fully, they will also put his/her name on a blacklist which means any other isp will be reluctant to take his/her custom.

by Kingbry December 26th 2008, 9:28 pm

Yeah, I was thinking that going through the ISP would be easiest, but I don't have any objective proof, because I deleted his bullying related posts so that the members he was abusing didn't see them and so that he didn't get attention for acting that way.

The only way I can think of is if someone at Forumotion can look into his PMs to see if there is something I can bring to the ISP. I can't read them as an Admin, and though I respect the concept of protecting his privacy, getting to his PMs is better than letting this guy back in (in hopes of getting new evidence against him that I can bring to his ISP). Doing that would be like using my members, who I am trying to protect, as bait.

by Voltinova December 26th 2008, 11:13 pm

1) You may want to Restore your board to a different time slot when he did post

2) There should be a Rubbish Bin where you can retrive the posts.

3) You can say to the ISP Providers that you had deleted his posts, as reasoning of breaking rules. It is to my knowledge that they have either special tools or specialists who can actually tell either way. It's exactly how we got rid of a hacker on our forum. They do have ways to check this. I can't belive I thought of this earlier.

by Kingbry December 27th 2008, 1:10 am

Thank you so much. Those are really helpful, especially number 3. I'll definitely send them an email on Monday. Our forum is big enough that I have the basket set to auto delete old topics.

About resoring the board, that sounds like it would work too. But I do have one question... can you restore the board back again, once I have retrieved the data, or would what the board looks like now be lost in the process?

Once again, thanks for the ideas. I am actually leaving the board in a few months, so I really want to deal with this guy once and for all before I leave.

by Voltinova December 27th 2008, 1:35 am

You can go to the day before, so say
Tomorow = W
Today = X
Day Before Yesterday = Y
Back-Up Day = Z

X you do the backup to Z
W you can go to Y

I hope that kind of makes sense.
Here are the Utils
www.forumotion.com/en/utils/
Hope That Helps

by Kingbry December 27th 2008, 4:39 am

is it only the Founder who can use those utilities?

by Sweetheart1 December 27th 2008, 4:55 am

I'm not sure how it works in Canada hun but down here if you report someone for something like that but find it hard to show proof....an undercover joins the forum and they collect the info they need....it's a form of pedaphilia so they should come down hard on this..... Mad

Report to your police if all else fails...surely they have means of helping you Confused

by nimiel December 27th 2008, 5:07 am

^ don't you think that's too much?
the only solution i got for you is to stop the members growing for a while. don't allow members for a month or something.

by Kingbry December 27th 2008, 10:43 pm

Thank you everyone. I have begun to take action according to your suggestions.

I'm sending an email to his ISP on Monday, and I sent a newsletter warning all our members about him in case he tries to contact them. I've also sent him a final message explaining that I will contact his ISP and that if he does not stop immediately, I will pursue things with the police. I hope the warning finally sinks in where all the others haven't, because I only want to involve the police as a last resort, especially since I really do believe that he really is a 13 year old kid and not some wrinkled sicko pretending to be 13.

But after a year of being powerless against this person, I need this thing to be over once and for all.

by Kingbry December 29th 2008, 10:38 am

Here is the email I am sending to Rogers today. (I seem to not be able to send email from where I am, even though I can access the internet... but that's beside the point.)

Hello, my name is [my name],

I am the administrator of a forum which can be found at the following address: http://jordantodosey.editboard.com. A member calling himself "Derian" and describing himself as a 13 year old male (of course, on the internet, I have know way of knowing if any of his profile information is accurate) registered an account at our site on October 1 and was banned for harassing and insulting members of our forum. Many of these abusive posts were deleted according to our policy because we want our members to have a safe experience on our site, and not have to see harrassing and abusive posts. Much of his harassing behaviour was also in our chat room, and these conversations are not retrievable by me.

It is the policy of the host of our board software that we not issue bans on IPs because the dynamic IP system creates situations where two people may use the same IP. If one person using a given is banned, another innocent user may happen to be assigned that IP and the system will inform them that they are banned, even though this was not intended. This situation has happened on at least one occaision with Derian's IPs, so Derian was able to create a new account and continue his actions.

These are the IPs that this individual has used:

99.227.132.98
99.229.86.25
99.240.49.158
72.140.235.208

Over the span of a year, from December 3, 2007 to this past week, Derian has continued to make new accounts and continue to harass certain members of our forum. Most of his actions have been focussed on four members, all girls from age 12 to 14. I have been in contact with Forumotion, the company that hosts our forum, and they have advised me to email you and report his abuse of the Acceptable Use Policy. They have also told me that it is possible for you to trace his actions that I can not verify, such as messages in the chatbox or deleted posts. Use of the service for illegal purposes is a violation of this policy. I will now describe how Derian's behaviour has been a violation of Section 264 of the Criminal Code of Canada (Criminal Harassment.

Section 264 (2) describes actions that are considered criminal harassment. Here is a copy of the section in question:

(2) The conduct mentioned in subsection (1) consists of

(a) repeatedly following from place to place the other person or anyone known to them;

(b) repeatedly communicating with, either directly or indirectly, the other person or anyone known to them;

(c) besetting or watching the dwelling-house, or place where the other person, or anyone known to them, resides, works, carries on business or happens to be; or

(d) engaging in threatening conduct directed at the other person or any member of their family.

Derian has been repeatedly violating subsections (a) and (b) by creating new accounts on our site, and repeatedly commuicating with the other person(s) despite being told in no uncertain terms to stop both by the indivduals in question, and the forum staff which includes myself as well as being banned from my site. Derian also followed the users who he has been harassing to other sites and attempted to resume communication with them. Sites where this behaviour can be seen include YouTube and Gaia Online.

He is also involved in threatening conduct, directed at the persons in question when he made threats to hack our site after one of his attempts to re-insert himself in the community was stopped. This threat was alternately a threat that he himself would hack our site, and that he has a friend who will hack the site for him, which violates subsection (d). He has gone back on this threat, saying that he was joking, proving at the very least that his words are completely untrustworthy and at worst that he is potentially a danger to our community.

One of the communications that Derian has attempted is with an individual he knows only as "Stephanie". He started PMing her account on Gaia Online, and asked for email addresses of members of our forum. Stephanie blocked further communication from him using Gaia's software to 'block' his account from contacting hers. He then contacted me using my account and began to ask me to "let" him "talk to her". This once again is a violation of subsection (b) and an attempt at futher violating the same subsection.

When I told him that I would never comply with his request, he repeatedly asked several times over the period of several days. I then communcated with him, according to the advice I had been given by other Forumotion forum administrators, to inform him that I was going to be contacting his ISP (you) and describing his behavior to them and if he did not stop, I would be calling the police because his action were criminal. Despite this, he asked one more time to be allowed to talk to "Steph" because according to his words, he was in love with her. I repeated that such communication would never happen and that if he continued I was calling the police. He replied that he would stop, but as I have already described, he has proven himself to be untrustworthy, so I can not take it on faith that he really is going to stop.

Please, please, investigate this person's behaviour thoroughly. His behaviour over the past year is really disturbing to me and several members of my forum. I need to this person from contacting us ever again - especially since comments like his claim for being "in love" with a person he has barely spoken to, and his perserverance are really begining to scare me. It is my job to keep my members safe, but I haven't been able to keep our forum safe from this person on my own.

I very much appreciate your help in this matter. Please don't hesitate to email me at this address if you require anything further.

Sincerely,

[my name]