A special kind of troll
Posted on Tue 28 December 2010 in Vipers
Updated on Thu 07 Jul 2011
What happened?¶
Over the Christmas holiday, the Team Vipers forums were hit by "multiple" users who decided it was a good idea to use our community as a battle ground. A Viper member stepped in to "help" resolve the problem by attempting to play mediator. (Notice the air quotes. These are important later) The battling users turned on this member and escalated the matter to threats of violence. When the member stopped responding, the users got bored and began spamming the board.
Due to a combination of it being Christmas and the admins doing Christmas-y things with their families, this went on for hours. There were several rounds of clean ups, but the battle continued over nearly a 48 hour period.
Why is this troll different?¶
After Christmas festivities had ended and I had time to sit down in front of a computer to investigate what happened, I began piecing together a time line of events. It turns out that all of these "users" were coming from the same IP address. On top of that, they shared the same IP address as the member that attempted to "help". Odd...
A little more background¶
The member that was "helping" had recently been approached by the admin team in an effort to clarify some questions about their age. One of the admins had been presented evidence that the user was under the age of 16, which we all know if the minimum age to be a Vipers member.
The user took this as a threat that we were going to remove them from the community entirely via bans on the servers and forums. They posted a rant on their "sub-community". To mean this seems much more like a place where people that didn't like our rules go to complain about us in an unproductive manner. I'm still not sure why they set up this community in the first place, because they have always expressed a very keen interest in Vipers.
Follow up with the member¶
When I started seeing a pattern between the battling users and the member, I sent a Steam message to the member asking if they were around so that we could chat. The conversation began with me asking about the rant they posted and whether or not they were aware that we allowed players under 16 to play on the servers, but not be members. They said they were not aware of this and seemed pleased they'd still be around.
I thanked them for their attempt to help over the holiday. Then I mentioned that it was odd that all of the users were coming from the same IP address. It was agreed that was odd. When I said that there was another user that used that IP in the past, they stopped responding. A few hours later I got a message saying they were back and around to talk again but they'd closed the Steam chat window and lost the conversation.
A few minutes later they began complaining that their own forum had been spammed. I'll admit I was curious, so I went to take a look. There were multiple "users" having a very similar battle across the other forum. The member had posted messages as the voice of the community that it had to stop or they'd issue bans.
I was sick of the game at this point. I mentioned that I knew they were all of the users involved. I'd issued bans to the user accounts on the forum. I revoked their Viper membership and banned their main account. I also made a note that they could appeal the ban in 6 months time. I figured they'd forget about us.
It takes a special kind of troll to spam their own site to try and convince someone you aren't a spammer.
After effect of the bans¶
At this point the member was less than pleased. There were vague threats made against me, the server, and anything they could think of that would offend me. I simply ignored the user on Steam.
This didn't sit well, apparently. The user attempted a denial of service attack on the game servers, which our hosting provider mitigated. Part of this mitigation involves sending me a list of IP addresses that were attempting to connect to the server at the time of the attack, and part of the traffic that automatically triggered their counter measures.
Unsurprisingly, there were only a few IP addresses. Geolocation says they are all in the same city. One of those IP addresses is the IP of the user.
What is going to change?¶
The biggest problem I see out of all of this is that we didn't have active admins during the initial wave of spam. I can't fault the admin team, after all it was Christmas. However, there have been a few requests recently for a couple more game server admins. I feel this incident just confirms that we need a couple more. In the coming days, we'll announce who our new admins will be.
The member that has been removed has been banned from the servers and the forums. We've also destroyed two new user accounts they created since the spam wave. This is business as usual. I did offer them the chance to appear at the end of June. I suspect they will not.
The appeal¶
This section was added on July 7th, 2011 after the user appealed their ban
It seems I was wrong. They filed an appeal to their ban. Of course it took place over another holiday (4th of July). Fortunately, our two European admins were still around while the rest of us were out enjoying some fireworks.
The appeal was filed on the forums, as is usual. Community members stepped in to experess their unhappiness that the user would consider returning after what they did over Christmas. One of the admins that were around put a message in the admin area and asked for feedback from other admins.
When I returned home after some amazing fireworks, I found I had an email from our hosting provider. They'd blocked another attempted denial of service attack. I logged into the forums to see what was going on and noticed that the appeal thread was not going well. The user were getting more and more upset at the community members who were rallying against their return. It eventually ended with a note saying that they hope Vipers never recovers from the DDOS. At this point one of the other admins locked the thread.
A check of the IP address the user was utilizing to post the messages and the list of IPs involved in the attempted DDOS showed that the IP was on the list, and again they were all in the same city (and the same city as in December).
Their appeal was rejected. They were informed they would not be welcome back.
After this appeal, I don't believe anything will need to change on our side. The appeal process concluded faster than normal. Attempts to DDOS the community server makes the decision rather easy for the admins.