For just over a month, Twitch has been trying to track down a group of anonymous trolls who spammed the platform with violent footage of the Christchurch shooting in the wake of the attack. That hunt kicked off in earnest when Twitch filed suit against the trolls earlier in June, but new filings show the company has more clues to the perpetrators’ identity than anyone suspected, including specific email addresses for at least three people and Discord logs where the attack was organized.

The evidence was submitted in an ex parte filing on Thursday, which included a deposition from an incident response engineer at Twitch. According to the filings, Twitch has identified a specific user it believes to be responsible for coordinating the attack — a prior offender who uses the handle Skel or Sketyal — and linked that account to a series of email addresses, Twitter accounts, Discord channels, and at least one website. From its incident response work, Twitch also collected 35 different IP addresses used to operate the Twitch accounts performing the attack, provisioned to seven different providers.

Twitch still isn’t clear on the actual person behind all those accounts, so the company’s lawyers are seeking a court order requiring Twitter, Discord, and a variety of web hosts to turn over all the data they have linked to each account. In each case, the company’s looking for something linked to a real name, whether it’s an address, payment info, or even another account that can be subject to yet another court order. Once Skel is identified, Twitch is seeking a permanent injunction against them ever using the company’s services again, as well as unspecified monetary damages.

Notably, many of the Discord channels used to coordinate the attack were left open to any visitor with the link. Judging by the screenshots included alongside the depositions, Twitch security teams appear to have infiltrated the channels and recorded much of the activity.

The spam attack caused significant chaos when it was first launched, ultimately forcing Twitch to suspend new streams for the first seven days after an account was created. The most egregious spam was the video of the Christchurch attack, but trolls also streamed pornography and otherwise prohibited content, often using bot networks to upvote the streams so they would be promoted into other users’ feeds.

https://www.theverge.com/2019/6/29/19102840/twitch-troll-deanonmyzation-anonymous-lawsuit-christchurch-spam-attack