Joshua Moon, the infamous internet troll known for running stalker website Kiwi Farms, has been complaining that he is the ‘victim’ of credit card fraud. According to a post by Josh on his forum, around Thursday his payment service Lolcow.us started to receive thousands of dollars worth of fraudulent transactions. I have no idea if this is the case, but during his protestations of being an innocent victim, Josh made statements that clearly contradict earlier remarks (archive here) he is not tracking his donors.

Josh’s current, Nazi themed avatar from Kiwi Farms next to the misspelt disclaimer on his donation site claiming not to track users. Click for full size.

By his own admission, Joshua Conner Moon’s websites have been removed from several hosting companies and payment providers, including Paypal. Most have bowed to the inevitable as soon as they are notified of the site and its nature, but a few talked tough until there was legal action. All removed the site. Now, Kiwi Farms hides its host and payment provider using Cloudflare. Furthermore, the payment provider is hidden by the use of an intermediary website called lolcow.us. Users who wish to donate to Kiwi Farms must type their credit or debit card numbers into code written by Josh and the card number will be forwarded on.

Moon’s website lolcow.email has repeatedly been used for terror threats, leading to multiple police and FBI visits to his home. Whilst I have not seen all of the mails, those I have seen follow a pattern – there is an enemies list and / or a set of links and some sort of threat. The mails are signed in the name of Moon or Dynastia, or use text in their context. The emails sometimes use language similar to mine also.

Moon has repeatedly insisted that I or a supporter sent the messages – until he was forced to admit that in fact he sent one of them. Recently an anonymous paper letter was sent to Kiwi Farms critic Oliver Smith’s home (Oliver is not a relation of mine). The letter was posted from England by signed for delivery and had the same elements as an email sent to Oliver a few weeks before. It bore neither address nor signature. The email before it had threatened to stalk a child at a local school.

The anonymous letter sender had slipped up however, because in the United Kingdom signed for letters have the time of sending tracked and all UK post offices have CCTV. When this was circulated, Moon admitted to sending the letter via a UK intermediary – as set out it my article at the time. He still denies sending the emails. Even so, the letter was nearly identical in style to all the terror and murder threats. Since then, there have been no further terror emails this site is aware of.

On Thursday night, UK time I was on the way home from an event when I received an email. Someone was impersonating me on the notorious Candice Lynn Potter website. The impersonator was soon banned and their posts deleted. The next day, I started getting messages about alleged credit card fraud on Kiwi Farms.

At the same time someone was impersonating me on Candice Lynn Potter, Josh claims (in a post on his forum) that someone started putting fraudulent debit card transactions through his payment service, using 5 different credit cards (archive). According to Moon the payments started at $200, and each increased doubling until the card was declined. The highest payment was $3,200 which means that according to Josh $6,200 was put through on one card alone ($200 + $400 + $800 + $1,600 + $3,200). If there were 5 cards, someone gave Josh up to $18,000 or so.

Josh then alleges it was me, because I had said that I had a “plan for lolcow.us”. He then admits he has no evidence. Whilst I certainly intend to deal with Josh’s latest funding platform, none of my plans involve illegal activity. As is well known I have already taken legal action against one of Josh’s associates and I was thinking more along the lines of seizure. Furthermore, I am not the one who has been repeatedly interviewed by police and FBI. If I was criminally minded and had near twenty thousand dollars of stolen credit card cash I can think of better uses than giving it to Joshua Moon.

However, it is clear that Josh has an agenda – why not blame (for example) the users of the several bulletin boards who openly admit to harassing Josh and his family?

Null claims fraudulent transactions were put through his site from 5 different credit cards, proving he must track enough details about donors to separate their cards. Click for full size.

Josh goes on to claim that he has logging enabled on the server, but was unable to prove who made the payments because they used TOR – just like the ‘anonymous’ emails. The anonymous emails sent through TOR that were written just like the letter Josh eventually confessed to sending.

Null admits to having IP logging enabled on the donor server and demonstrates a good knowledge of the mechanics of credit card fraud. Click for full size.

If we believe Joshua Moon and take him at his word then whoever sent the payments, Josh clearly was not telling the truth about tracking. By his own admission the site logs IP addresses and enough information to distinguish cards. Donors face a number of serious risks now. Firstly, clearly it is possible lolcow.us does in fact log information that might be used by hackers or via a subpoena to identify members. Any payments to lolcow.us may also come under police or bank scrutiny. Donating to Kiwi Farms is clearly a risk.

I personally find it unlikely that any enemies of Kiwi Farms are trying to hand Josh thousands of dollars of stolen cash. I suspect this is one of his small number of anonymous supporters. However, it would be easy to see how this could distress Moon. He is, by his own admission, in severe financial straits after being forced to leave his mother’s home after she departed her job (archive here). Certainly, if his story is true it must be a cruel temptation – seeing those thousands of dollars so close and being forced to hand it all back.

However, I suspect that this is unlikely to be the last such incident. Joshua Conner Moon runs a harassment forum and as a result several rival forums have been set up to engage in retaliatory harassment. Doubtless the users on Moon’s own site and the opposing forums are aware that stolen debit cards are easily available on Darknet markets (archive here) and can be purchased with relative impunity using Bitcoins. As Moon himself says in the posts above, it is not possible to trace donors using TOR.

Moon has revealed what made him ‘suspicious’ of the transactions. Doubtless, whether by supporters or opponents there will be many more fraudulent transactions using this information. Presumably they will use lower value and lower frequency, (perhaps $50 to $200) and this will greatly increase the challenges of running Moon’s website. He will have to scrutinise all payments with greater care. Donors also will fear greater law enforcement scrutiny and enhanced risk of being identified, or simply having their credit records tainted by their financial links to the site. Donating to a site associated with credit card fraud can get a person’s cards cancelled and their bank accounts closed.

I have tried to be kind to Joshua Conner Moon but he increasingly reminds me of the Black Knight from Monty Python and the Holy Grail. His life is falling apart and he has fled his home and alienated his family clinging to a hate forum. Making wild and false allegations is what got him into this mess – not a solution. He faces regular legal action and public criticism. There is open and ongoing organised harassment by his less law-abiding victims (which I condemn, of course). Josh’s sites will go down, the only question is how much time Josh will waste trying to defend it and whether he will have anything left when it finally falls.