12.16 — The underground internet of 1995-2010: forums, tools, banalization of cruelty#

To understand the rage running through Ocarina’s Holy Book, you have to understand what the internet really was before Facebook (2006-2008), before Cloudflare became the gatekeeper (2010+), before moderation was taken seriously. It was a Wild West where state-level capabilities developed in teenagers’ bedrooms, where an adversary’s privacy could be demolished in 48 hours, and where classical legal recourse was inoperative. This page describes the mechanics, without complacency, without heroization.

⚠️ This page documents historical techniques for educational purposes and to contextualize the manifesto. It does not provide a modus operandi and does not endorse illegal acts. The cruelty described has produced real victims.

1. Archaeology#

Successive layers#

Usenet (~1979-2002)#

Usenet is a decentralized system of newsgroups: no central server, each server runs by peering with others, messages propagate by replication.

• Group hierarchy: comp.lang.c, alt.hacker, rec.games.*, sci.crypt, alt.binaries.* (warez, scans, etc.).
• No central moderation: each server can be cut, but the others replicate.
• Persistence: a well-posted Usenet message stays indefinitely archived.
• Killfiles: the user moderates themselves by ignoring authors.
• Flame wars: arguments could last weeks, hundreds of messages, and resurface 10 years later when someone found a thread.

BBS (Bulletin Board Systems, 1979-mid-1990s)#

BBS = a dial-up server you connect to with a modem to read/post on themed boards. Local: no internet, just a phone line from your PC to another teenager’s PC bedroom.

It’s the original matrix of US hacker culture. All the actors documented in this primer (YTCracker, kayos, Sys64738, etc.) passed through there or its direct heirs.

IRC (Internet Relay Chat, 1988-today)#

IRC = text chat protocol, multi-channel, multi-server, strongly decentralized. See 04-zoneh-irc-efnet.md

• Thematic channels (#hack, #warez, #cracking, #defcon, #anonymous…).
• Pseudos modifiable.
• Ops (channel admins) deciding kick/ban.
• DCC (Direct Client-to-Client) to transfer files without going through the server.
• Omnipresent bots: eggdrop, channel bots watching, kicking flooders, sharing files.

2. The harmful toolkit#

What follows is a documentary catalog — each term corresponds to a practice actually common on underground forums of the era.

Doxing#

Doxing (from documents → dox): publication of all a target’s personal info. Legal name, address, phone, employer, parents, children, schools, car plate, social-security numbers, leaked passwords, photos. Regularly garnished with defamation (pedophilia accusations, etc.).

1. Pivot from a unique pseudo to an account on another poorly anonymized forum.
2. Cross-reference available data leaks (Have I Been Pwned, LinkedIn 2012, Yahoo 2013, et al.).
3. OSINT (Open Source Intelligence): aggregating everything public — commercial registry, municipal archives, LinkedIn/Facebook/Instagram profiles, domain whois, EXIF-GPS photos.
4. Social engineering: calls to telecom carrier support, fake customer service, use of pretexts.
5. Publication: doxbin, pastebin, forums, or equivalent.

Effect on the victim: physical harassment (pizza deliveries at best, mass illicit-products orders to trigger a customs alert at worst, fake death notices to relatives, blackmail, etc.), swatting, identity theft, employer harassment.

Swatting#

Swatting: lying call to law enforcement posing as the victim, a family member, or a spouse, declaring an ongoing hostage-taking or murder at their address, triggering deployment of the SWAT (armed assault team).

Mechanics:

• Spoofed Caller ID or Skype call with credits obtained via carding.
• Voice tone adjusted, credible details (references to the exact address, descriptions of weapons and/or emergency situations).
• Police break down the door, sometimes shoot. There have been confirmed deaths following swattings (Andrew Finch, Wichita Kansas, the evening of December 28, 2017, shot at his door, then 28 years old).
• Cost to the victim: major psychological shock, sometimes physical injury, sometimes death.
• Cost to the perpetrator: real prison sentences if identified (Tyler Barriss: 20 years for the Finch swatting).

Caller ID spoofing via SIP#

SIP (Session Initiation Protocol) is the standard VoIP protocol since ~2003. With a low-cost SIP provider (overseas, light KYC), you can send a call with an arbitrary caller ID — any phone number in the world appears on the recipient’s display.

Malicious uses:

• Swatting (see above).
• Voice phishing (vishing): impersonating bank customer service.
• Fake emergency calls to a target to force a public reaction.
• Harassing others by impersonating the target’s number to provoke score-settling.
• Caller ID poisoning: spamming different numbers every hour to saturate the victim.

Legally: heavily regulated since 2019 in the US (STIR/SHAKEN), still largely usable from abroad.

Malware signed on a machine named after the enemy#

Operational technique: you compile a malware on a machine whose hostname, username, and build path contain a journalist’s, a security researcher’s, or a community member’s name you want to humiliate or implicate. When the malware is analyzed by a sandbox or AV, the build artifacts (string Built on: /home/journalist_X/...) hang around the binary and trigger attribution algorithms toward the wrong person.

It’s a false flag operation in the literal sense. Russian APT (Advanced Persistent Threat) groups popularized it at state scale (cf. Olympic Destroyer, 2018, wrongly attributed to North Korea for months). This technique was learned in 2000s underground forums.

Identity theft + credit subscriptions#

With a complete dox, one can:

1. Open online bank accounts with the loosest KYC.
2. Subscribe to consumer credit with lax institutions.
3. Make online purchases delivered to drops (third-party addresses).
4. Destroy the victim’s credit score by piling up payment defaults.

Consequences for the victim: years of paperwork to restore solvency, sometimes a banking ban, sometimes inability to rent an apartment.

Hacktivism#

Hacktivism = activism through hacking. Examples:

Hacktivism is dual:

• Public: actions claimed with manifestos, Guy Fawkes-masked videos, communiqués.
• Backstage: IRC coordination, internal doxing, infiltrated traitors (Sabu / Hector Monsegur, FBI informant 2011-2012), cross-accusations.

Swatting + doxing + harassment combined#

The maximum attack combines all three: you dox the target, call their employer to reveal their past, harass their relatives, swat their home. Publicly documented cases:

• Brianna Wu, Anita Sarkeesian, Zoë Quinn (Gamergate, 2014-2015): publicly documented combination.
• Aaron Swartz (2010-2013): not swatting but equivalent harassment, suicide January 2013.

Fake accounts, double accounts, lurk#

• Lurking: being present on a forum without posting. Lets one observe dynamics, spot social vulnerabilities, identify targets, archive evidence.
• Fake accounts: account with an invented identity, sometimes maintained for years. Used to credibilize a narrative (false witness, false support).
• Sockpuppet / double account: several accounts controlled by the same person. Lets one, for example, reply to oneself to create the illusion of consensus.

Flame, griefers, trolls#

DB leaks#

Database leaks: exfiltration and publication of a complete service database — Ashley Madison (2015), LinkedIn (2012, republished 2016), Yahoo (2013), Adobe (2013), Equifax (2017).

Effect: users of these services see their email + passwords (sometimes plaintext due to poor DB security) + private data published and indexed. Have I Been Pwned (Troy Hunt, 2013+) lists 12+ billion records at this point.

Shodan + cameras and servers#

Shodan (John Matherly, 2009, shodan.io) is a search engine for devices connected to the internet. IP cameras, routers, industrial ICS/SCADA, FTP servers, MQTT servers, et cetera:

• webcamxp → IP cameras with default web interface, often passwordless.
• port:23 → open Telnet servers (typically misconfigured IoT).
• default password → flags devices identified as using default passwords.

Before Shodan, enumeration required massive, expensive portscans. With Shodan, in 5 seconds, you have 200 unprotected cameras in any city.

Shodan can also be used for various harassment purposes — detecting poorly secured Minecraft servers to go destroy them “with griefer friends”.

3. BOFH — Bastard Operator From Hell (Simon Travaglia)#

BOFH is a series of short stories written by Simon Travaglia (New Zealand), published on Usenet starting in 1992, then in Datamation and The Register.

The narrator is a sysadmin who:

• Despises his users.
• Sabotages annoying coworkers’ machines.
• Falsifies logs.
• Literally kills overly tiresome users (with black humor: elevator accident, server-room trap).
• Enriches himself through internal fraud.

The BOFH became a cultural archetype:

• Known throughout the sysadmin community.
• Quotes integrated into the vocabulary (PEBKAC = Problem Exists Between Keyboard And Chair, RTFM, ID-10-T error).
• Idealized by sysadmins who ironically identify with it.

Ocarina’s author partly inherits this tradition: “slipologue” is, in a way, the 2020s version of PEBKAC.

In the same vein, also read: Master Foo and the Script Kiddie (2003)

4. ViolVocal — the French-speaking case#

ViolVocal was a French-speaking community of organized harassers, active in the 2000s. Forum + voice server (Mumble / TeamSpeak) where members:

• Coordinated group calls to targets (rivals, ex-members, anonymous people photographed).
• Used SIP spoofing to call from impersonated numbers.
• Filmed targets’ voice reactions and rebroadcast them in public streams.
• Practiced harassment in the criminal sense: targets harassed for weeks, including minors and vulnerable people.

It’s one of the francophone incarnations of no-limit culture. VV eventually shut down, some members were identified and prosecuted, but nothing repaired the damage done to victims.

Why mention ViolVocal: to show that underground cruelty was not an Anglo-only phenomenon. The same mechanics operated in France, on francophone Mumble servers, in francophone MMO subforums, in #fr.* IRC channels. The francophonie wasn’t spared.

5. 4chan and /b/ — radical anonymity#

4chan, founded in 2003 by Christopher “moot” Poole (then 15), a copy of the Japanese 2chan (Hiroyuki Nishimura).

• /b/ (random): board with no rules, no archive (threads disappear after a number of pages), total anonymity (no persistent pseudo), massive volume (millions of messages/day at peak).
• Anonymous as a collective entity literally emerged from /b/ around 2006-2008.
• Mass-produced memes: Pepe, LOLcats, Rickroll, Distracted Boyfriend, came out of /b/ and were picked up by the mainstream.
• Cruelty documented: organized raids against targets (sometimes suicidal children, anorexics, etc.).
• Pedo-criminality documented on certain minor boards, which justified serial arrests of moot and his successors.

On April 14, 2025, 4chan was massively hacked:

• Admin access
• Source code and other internal data
• Identities
• …

Today (2025-2026), 4chan still exists but has lost its centrality to Discord, Reddit, Telegram, et al.

6. The “no limit” culture — impunity through anonymity#

The subjective perception#

For underground forum harmful actors of the era:

1. Apparent technical anonymity (proxy, VPN, Tor).
2. Distance between author (at home) and victim (on the other side of the world).
3. No immediate physical reaction: the screen filters, you don’t see the victim cry.
4. Peer validation on the forum: others congratulate the most “daring” acts, building hunt lists, exchanging “harassment kits”.
5. Systematic failure of law enforcement to intervene quickly, especially when harasser and victim aren’t in the same country.

Why this creates dangerous profiles#

This combination produces individuals with:

• Real technical skills (up to state-level).
• Zero empathy toward victims (never seen, “don’t know them”).
• Structural contempt for institutions (seen as slow, stupid, corrupt).
• Identity built around anti-system “prowess”.

7. Inoperability of classical recourse#

“Filing a complaint against your neighbor” no longer works#

The European and American legal arsenal was built for societies where:

• The neighbor is identifiable (postal address, civil identity).
• The harm is geographically circumscribed.
• Evidence is physical (testimony, photos, letters).
• The state has jurisdiction over the perpetrator.

None of these assumptions hold for online underground harassment:

• The perpetrator is anonymous by construction.
• The harm is globalized: the victim may be in France, the perpetrator in Russia, the server in the Bahamas.
• Evidence is digital, hence fabricable, deletable, contestable.
• The victim’s state has no jurisdiction over the foreign perpetrator.

A doxing/harassment victim who files a complaint often ends up with:

1. Complaint shelved for lack of identification.
2. Complaint transferred to another jurisdiction that shelves it too.
3. Complaint rejected for territorial incompetence.
4. Moral and financial cost of having tried the procedure.

Private vendetta becomes the norm#

When the judicial system is inoperative, conflict is resolved by:

• Counter-doxing: the victim, or an ally, doxes the perpetrator back.
• Technical counter-attack: DDoS, deface, exfiltration.
• Public shaming: public exposure on Twitter, Reddit, media (call-out).
• Informal hacker tribunals/syndicates: a group respected in the scene judges and excommunicates the author.

These resolutions are violent, non-reversible, and as violent as possible — they exist because nothing else works.

8. Marketplace forums#

From ~2005-2008, underground forums shifted from a sharing logic to a commerce logic:

Brains and operators#

Marketplace forums separate:

1. The brain: the one who develops the technique.
2. The operator: the one who pays to use the technique on their target.

This separation exploded the number of victims: before, you had to be technically capable to do harm. Since then, anyone with a few dollars could launch a targeted attack.

The same pattern appears with The Anarchist Cookbook (William Powell, 1971), which published instructions for making homemade bombs — except the Anarchist Cookbook produced a few isolated cases, while underground marketplace forums produced thousands of victims per month.

Anarchist Cookbook parallel#

The common point is the democratization of harm-capability that previously required years of learning.

9. Why this universe produced state-intelligence-level skills#

To survive as an active member of an underground forum, you had to develop:

These skills are identical to a state intelligence operator’s. Agencies (NSA, FSB, MSS, DGSI, GCHQ) recruit in this scene since at least 2005, and the best profiles come from there.

10. Why “enemies”?#

The Holy Book’s author uses the word enemy — and it’s not a metaphor.

In this world, you have enemies in the operational sense:

• People who doxed the author or their relatives.
• People who publicly denounced, who lied about his acts, who tried to humiliate him.
• Communities that organized coordinated raids against the scene he belongs to.
• Law enforcement that’s useless.

When you’ve lived these operations, you no longer use the word adversary or opponent. You say enemy, because that’s what it is: someone who wants to provoke a destruction (social, professional, sometimes physical) and acts to achieve it.

See 17-survivor-psyche-programming.md

Is it any better today?
To have your own opinion, see also: 764 (organization)

11. Connections with the rest of the primer#

• 02-lulzsec-lulzboat-antisec.md — LulzSec / AntiSec, organized hacktivism.
• 03-ytcracker-nerdcore-digital-gangster.md — DG, the reference forum.
• 04-zoneh-irc-efnet.md — IRC, EFnet, Zone-H.
• 05-indonesian-hackers.md — YogyaCarderLink, carding & defacement.
• 17-survivor-psyche-programming.md — psychological and technical consequences.