At 11pm ET on January 1st Eric was made aware of a series of posts reported by various community members in the thread "Hi Im Askam". The posts contained spamming of a racial slur, which breaks YSFHQ rules. Eric decided the best course of action was to temporarily move the topic to a separate admin forum so that the spam posts could be hidden from the thread. He also discovered the mChat was filled with similar spam and temporarily disabled it to prevent further spam. These actions were reversed at 4:00PM on Saturday, January 2, 2016.
Several posts were in clear violations of spam, appropriate posting, and forum rules. They were permanently deleted.
Three of the reported posts were made by Varren, two by TheJuli, and one by a new member Askam_Chebsey. These same users were causing the spam in the mChat.
Varren was removed a day earlier (30 December, 2015) from the YSFHQ staff through a vote by the community, in which an overwhelming majority voted him off due to various infractions while Staff Chief and Core Staff. Considering these recent turbulent events, the administrative team reviewed this spam incident with due caution and thoroughness.
Admin & Staff Investigation and Actions:
Investigation into the matter was quickly started by several members of the staff team who found the following information (see Timeline). This is also a list in chronological order of the actions taken by staff members during the investigation and while determining the results of it (all times ET):
[1/1/16 7:30-10:00PM] - Topic becomes evidence for trolling, spamming, inappropriate posts, and derailing by several members.
[1/2/16 12:00AM] - Eric temporarily moves “Hi Im Askam” to The Dungeon so posts can be hidden from public and properly reviewed by staff.
[1/2/16 12:02-12:08AM] - Eric temporarily removes mChat from forum.
[1/2/16 12:12-12:31AM] - Kujo permanently deletes 6 posts from “Hi Im Askam” (3 by Varren, 2 by TheJuli, 1 by Askam).
[1/2/16 12:29AM] - Eric removes posting and mChat permissions from Varren and TheJuli and grants them “Read Only Access.”
[1/2/16 12:42AM] - Kujo deletes a report on a post in the topic “Hi Im Askam.”
[1/2/16 12:44AM] - Eric creates topic regarding the situation in the admin forum.
[1/2/16 2:39AM] - After discussion between Eric, Kujo, and VNAF, it was brought to the attention that the user account “Askam_Chebsey” was a sockpuppet registered with a proxy IP and temporary email address. With this, a topic was created in the admin forum called “Askam_Chebsey” to post further investigation of the legitimacy of the user and its origin.
[1/2/16 3:29AM] - Eric finds clear evidence of the sockpuppet account and its origins:
[1/2/16 3:54PM] - Eric merges the two topics in the admin forum (“Askam_Chebsey” and “Asakam’s Welcome”) together since evidence was converging to the same members.Eric wrote:I now have reason to believe this user was created by Nath, not Varren or TheJuli. Evidence is as follows...
EDITOR'S NOTE: Real IP addresses have been replaced with [REDACTED] for this public post.
Exhibit #1: Site access logs (selected entries)In this exhibit we see the IP address [REDACTED] - the first line shows the user associated with the IP thanking a user for a post. Looking closer, we see the "from_id=837" and that user ID 837 comes back to Nath. The next line, about 25 minutes before this new user shows up, we have another example this is Nath, with "confirm_uid=837", the same user ID. The third line shows a logged out user visiting the register page, with the same IP as Nath. We know they are logged out because previous log entries show that IP visiting the logout page. They do not go any farther with this IP address. About 2 minutes later, a new IP appears, 22.214.171.124, and proceeds to visit the register page. On the final line we see a HTTP POST, indicating the registration form was submitted. This form submission leads to the creation of our user Askam_Chebsey.
Code: Select all
forum.ysfhq.com:80 [REDACTED] - - [28/Dec/2015:11:51:56 -0500] "GET /viewtopic.php?f=217&p=93844&thanks=93844&to_id=1921&from_id=837 HTTP/1.1" 200 7494 "https://forum.ysfhq.com/viewtopic.php?f=217&t=8275&sid=f26099e16adaa4e972055fa855e16d9f" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36" forum.ysfhq.com:80 [REDACTED] - - [01/Jan/2016:17:27:50 -0500] "POST /app.php/ucp.php?_=1451687259235&mode=delete_cookies&confirm_key=3DSELDLKMP&confirm_uid=837&sess=0126d83c3018795db3eeb4c6cffc55a9&sid=0126d83c3018795db3eeb4c6cffc55a9 HTTP/1.1" 404 266 "https://forum.ysfhq.com/app.php/chat" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36" forum.ysfhq.com:80 [REDACTED] - - [01/Jan/2016:17:49:03 -0500] "GET /ucp.php?mode=register HTTP/1.1" 200 5141 "https://forum.ysfhq.com/ucp.php?mode=login" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36" forum.ysfhq.com:80 126.96.36.199 - - [01/Jan/2016:17:51:39 -0500] "GET /ucp.php?mode=register&coppa=0 HTTP/1.1" 200 8129 "https://forum.ysfhq.com/ucp.php?mode=register" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36" forum.ysfhq.com:80 188.8.131.52 - - [01/Jan/2016:17:54:26 -0500] "POST /ucp.php?mode=register HTTP/1.1" 200 6562 "https://forum.ysfhq.com/ucp.php?mode=register" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36"
Exhibit #2: Teamspeak log from the day of the account registrationIn this exhibit we can see a user "Totalement" joining our Teamspeak server with IP [REDACTED]. Over an hour and a half after they join, a file is uploaded to the PAVA Executives channel "id:645", "SATURDAY.mp3" by the user "Askam Chebsey", yet they retain the same user ID of 2797. Almost exactly an hour later, "Totalement" leaves under their new username "Askam Chebsey".
Code: Select all
2016-01-01 19:50:30.262723|INFO |VirtualServerBase| 2| client connected 'Totalement'(id:2797) from [REDACTED]:58958 2016-01-01 21:32:11.631005|INFO |VirtualServer | 2| file upload to (id:645), '/SATURDAY.mp3' by client 'Askam Chebsey'(id:2797) 2016-01-02 01:32:56.003190|INFO |VirtualServerBase| 2| client disconnected 'Askam Chebsey'(id:2797) reason 'reasonmsg=Bye.'
Looking at both of these exhibits, we can see that the IP [REDACTED] is connected to Nath's forum account as well as Totalement's teamspeak user. The teamspeak user leaves the server under the same username we saw register on our forum. Nath seems to have visited the user registration page, realized his real IP would be visible, and decided to use a proxy instead - the proxy server is hosted by redstation.co.uk and paid for by one of their customers.
I think the evidence speaks for itself. Nath is the likely person behind the account Askam_Chebsey, coordinating in some way with Varren and TheJuli.
[1/2/16 3:58PM] - Eric restores mChat to forum Mini-Chat page.
[1/2/16 4:00PM] - mChat restored to Board Index
[1/2/16 4:00PM] - Posting permissions restored to Varren and TheJuli.
[1/2/16 4:16PM] - “Hi Im Askam” topic restored to Personal Messages forum without permanently deleted posts.
[1/2/16 6:32PM] - Eric provides another update on the sockpuppet account evidence
[1/3/16 4:12AM] - Eric created a poll for elected staff to vote on proposed consequences for those involved.Eric wrote:Update: I can confirm that a proxy was used when the Askam account was registered. They were using the ZenMate service. See attachment for proof - it's the same IP as what we had when they were registering.
Nath's forum email address does have an account on Zenmate, so it is very likely Nath used Zenmate to register Askam_Chebsey.
[1/3/16 4:30PM] - At the request of the Admins, a list of Varren’s YSFHQ history is compiled by Eric.
[1/4/16 6:40PM] - A modification to the bans is proposed.Eric wrote:Update: here's everything relevant I could dig up with a search of "calum" and then "varren". For purposes of this list, I will refer to Varren by his current username, Varren, from beginning to end. I wrote the description for each link as it pertains to this discussion.
- SEPTEMBER 3, 2011: Varren joins YSFHQ viewtopic.php?f=172&t=1755
- Varren threatens "hacking" viewtopic.php?f=22&t=2072
- permaban announcement by Iceman viewtopic.php?f=167&t=2073
- va crackdown, wingz says VAs who allow members to troll should not have a subforum viewtopic.php?f=22&t=2086
- let Varren back in? viewtopic.php?f=22&t=2382
- "Eventually let Varren back in with restrictions?" viewtopic.php?f=22&t=2510
- relevant but not part of rap sheet: Fight the power mentality DISCUSSION viewtopic.php?f=22&t=2821
- Gamma, Varren's sockpuppet account viewtopic.php?f=220&t=2907
- another sockpuppet account viewtopic.php?f=22&t=3401
- Varren returns viewtopic.php?f=172&t=3417
- how long has Varren been playing YS? viewtopic.php?f=137&t=2531&p=45075#p45075
- name change to Varren from Calum, some posts deleted from thread viewtopic.php?f=220&t=3669
- status of Varren on YSFHQ viewtopic.php?f=22&t=4537
- YSFHQ hits 2 years viewtopic.php?f=22&t=4761
- email sent from YSFHQ Mailchimp by Calum viewtopic.php?f=167&t=4774
- Cougar, another Varren sockpuppet account viewtopic.php?f=220&t=4823
- another discussion of a ban of Varren viewtopic.php?f=22&t=4828
- admin team makes an announcement viewtopic.php?f=167&t=4846
- relevant post by VNAF viewtopic.php?f=204&t=4868#p57613
- Varren supposedly stalking Dan and Dave viewtopic.php?f=204&t=4885
- another sockpuppet account viewtopic.php?f=220&t=5026
- Varren does something useful and talks to Soji viewtopic.php?f=204&t=5032
- more discussion about Varren and Alpha Star viewtopic.php?f=220&t=5111
- Varren writes an apology letter viewtopic.php?f=22&t=5127
- Varren listed in disaster recovery plan as mechanic #2 viewtopic.php?f=22&t=5399
- Varren helps with Project Kaizen viewtopic.php?f=22&t=5423
- civil war breaks out, Varren makes some proposals for a "democratic" HQ viewtopic.php?f=217&t=7982
- Varren elected as staff chief viewtopic.php?f=167&t=8004
- VNAF removed from HQ, Varren mostly to blame viewtopic.php?f=217&t=8216 and part 2 viewtopic.php?f=217&t=8220
- Varren makes hasty decision that YSFan is a sockpuppet viewtopic.php?f=22&t=8274
- one topic ID later, vote to forcibly remove Varren from staff viewtopic.php?f=217&t=8275
- PRESENT DAY: Varren tests us with another sockpuppet (run by Nath) viewtopic.php?f=172&t=8302
[1/6/16 4:06AM] - Poll ends with a 4 to 1 vote in favor of final proposal of consequences (see Results) by all elected staff.
Please remember that though few names are mentioned above, this investigation and decision took the entire staff team’s collaboration and teamwork to conclude one week after the initial incident took place.
Though many of the above accusations are false, the statement above serves as further evidence to the Staff Team that the situation was deliberate and likely to continue to threaten YSFHQ. The staff determined a course of action that would stop the situation temporarily until it could be properly investigated. Though there were mistakes made by the staff in the process of handling the situation, they were with the intentions of protecting the forum from malicious action. These events have provided the staff with a lesson of how to more appropriately and properly handle similar situations in the future, and mitigate any mistakes made here.Eric wrote:Facebook chat wrote:Varren:
ayy lmao this is the first time the chats gonna be used for its purpose so here goes
yesterday I ran a little test, needless to say you guys failed. Removing me for the reasons provided was pretty justifiable, so fair game. But then you went and did the exact same things, please actually at least hold yourselves to the same standard. The rules don't allow you to remove sigs, only resize them and removal is only prohibited when its some illegal shit like that spambot posting links in its sig to dodgy websites. Secondly the entire topic was deleted, and not just posts that were spamming, this is pretty wrong especially considering half the posts were legit. And then to top it all off, we received no communication whatsoever, neither me nor juli have received a PM or anything explaining why they were removed. These are the exact issues you had a go at me for so yes, do hold yourselves to the same standard. Needless to say I could've done a VNAF here and posted this publicly and became one of those annoying bitching cunts but I know how that is, so I'll settle for you guys sorting your shit out.
Oh wow, and even posting permissions were removed without due cause or even warning ...
Despite Varren’s claims, this was not a simple test, but rather a deliberate, coordinated and malicious trolling of the community in an attempt to see how the staff would react. The definition of trolling is to "make a deliberately offensive or provocative online posting with the aim of upsetting someone or eliciting an angry response from them."
At YSFHQ we do not tolerate such actions. YSFHQ's mission statement says, "We strive to enhance the experience of those playing YSFlight by creating a fun, inviting atmosphere. We aim to sustain the growth of the community through promoting YSFlight and demonstrating the potential of the game." The inappropriate actions by Varren and TheJuli did not create an inviting atmosphere for any member, let alone a “new member”. This goes against our mission statement and the very first rule of the forum, “We do not allow any sort of personal attacks, trolling, or anything that involves mockery of members on YSFHQ.”
After doing further research, we also discovered that our “new member” Askam_Chebsey is not really a new member at all, but rather a sockpuppet account. We have strong evidence as shown above that this account was created by Nath. Sockpuppet accounts are forbidden.
After debating what consequences Varren, TheJuli, and Nath should have for their actions, the YSFHQ staff has decided the following:
1. TheJuli will each receive a one month ban for spamming the forum and mChat with racial slurs. As a first-time offender for making racial slurs on the forum and mChat, TheJuli has received a one (1) month ban. This is a clear violation of the very first rule of YSFHQ and is not tolerated.
2. Nath will receive a one month ban for creating a sockpuppet account and engaging in the trolling. As a first-time offender for a sockpuppet account on YSFHQ, Nath has received the standard one (1) month ban for such offences.
3. Varren will receive a sixteen (16) month ban for his actions. This is Varren’s fifth incident involving a sockpuppet. For a first time offence, as mentioned above, the typical consequence has been a one (1) month ban. With a long history of infractions and similar incidents, the staff has decided that each additional infraction should have a ban length that is double the previous ban length. Thus for sockpuppet accounts: 1st offence = 1 month, 2nd = 2 months, 3rd = 4 months, 4th = 8 months, 5th = 16 months.
These bans have been made after full deliberation and investigation by the Admins and with supportive data collection and comments by the Core Staff. The YSFHQ staff does not enjoy banning members of YSFHQ, but given the offences perpetrated by the above named members we believe these bans to be fair and necessary. In the interests of transparency, the evidence collected by the Staff Team has been provided to the community. This message serves as an announcement that the bans have been applied. Should these members wish to appeal their bans they may do so like any other member via this form.
Your Staff Team
Bombcat, Elected Staff
VNAF ONE, Elected Staff
decaff_42, Elected Staff
jetskit, Elected Staff
Kujo, Elected Staff
Wingzfan99, Core Staff
Eric, Core Staff