My Instagram Stalker – Trampoline Trap

Before you read:

This article has been on Translate Reality for almost three years. According to analyses on this website, the word Piwox is the top hit and redirect that leads users to this website and has been since the article was posted. I mention that word once (now twice). Three years later, the TR usage statistics indicate this article has triggered something. What is piwox? And why is the most commonly linked search phrase that exact question. What. Is. Piwox. It seems I am not the only one with that question. 

Keep yourselves safe! 

We live in a world where technology is advancing more quickly than we can understand it. More and more, there are warnings about social media and how to keep children safe. A recent article about an investigative team acting as an eleven year old girl illuminated a very disturbing reality. The internet is like a world of its own. In the same way as we don’t allow children total freedom around the country, we need to look at the internet from the same lens of protection.

The Internet

An attempt to manipulate a child online is something we discuss often; it is very relevant today and we have seen significant losses because of online attacks. Sometimes an attempt to obtain information, photos or other private content is much more subtle than you would expect. I’m very cautious and attentive about my online activity; I would expect to be the last person tricked by an online predator. But I was.

I admit it; I love technology. I really do. Learning to use a new software program or solving a computer issue are some of my favourite hobbies. I had an unusual experience recently.  While I don’t know if I was or wasn’t in real danger, the circumstances surrounding this experience made me feel I could be. It was only after four days, however, that I realized how much danger I could be putting myself in. I can’t be certain though. Perhaps you can decide.

The trampoline

On Christmas Day I posted a photo of my daughter and niece on a trampoline; someone very, very cool bought it for them (me. It was me). It was a small, children’s trampoline where the logo and company were visible.  I received an Instagram Direct Message (DM) from someone I didn’t know. When I noticed it, I glanced at the top few lines and saw that it was a mother, Amy, asking for information about a trampoline. I didn’t think twice about answering questions and helping out a fellow parent.

I opened the message and answered her questions. We continued to go back and forth a few times. She had many questions and said she wanted to buy a trampoline for her 3 year old. A physiotherapist had recommended it so she wanted to ensure her purchase would work for increasing her daughter’s mobility skills. She asked how much weight it held, if I had stood on it and told me she was 125lbs and hoping to stand/jump with her daughter. I gave her what information I had, such as the maximum recommended weight being 50lbs, and said she could easily spot and help her daughter from the side.

Instagram messages

A short time later, I left my parents’ house where I had spent Christmas and went back to my place. I got my daughter settled in bed and set up a very fun play room in my unfinished basement with a special trampoline zone and a reading tent. I play inside it daily. That evening I received another message from Amy asking for a photo of the trampoline to see how much it dips with an adult on it. She told me she wanted to show the physiotherapist a photo. I didn’t have the trampoline at the time so I gave a bit more detail on it.

The next evening, I received another message from Amy. She asked if I had the trampoline set up and if I could take a photo. I told her I did not have it with me and couldn’t take a photo.  I admit this was a full lie. The trampoline was within my sight, however, the Winnipeg Jets game was on. Priorities. I almost got up and snapped a quick picture but decided I needed to focus. Because hockey.

Helicopter parent or stalker?

The next morning, I received another series of questions. I told Amy she should check the reviews online to get a bit more information. She asked if I was ‘with it now’, as in the trampoline. I said no, I was at work and not with it. She asked if she could make one more request. I said ok. She requested a photo of me standing on the trampoline so she could see how much it dips.

Prior to this message, I had been starting to get skeptical. No calibre of helicopter parent could possibly ask more questions about a child’s trampoline. I tried to keep Amy talking. I answered her questions and asked her a few as well. They were ‘test’ questions. Questions that all mothers know. How much does your child weigh? What city do you live in? Then I asked a few random questions. Do you practice yoga? Can I recommend a few stores around you? The answers were ignored or became less and less believable.

Instagram Amy

I looked at Amy’s profile. It was private, no followers, no posts and following 1 person. No description other than a first and last name, as well as a picture of a beautiful, blond woman on a swing. Well AmyJones6062019, I’m forced to investigate who the fuck you really are. I know you’re not a mom looking for a trampoline. Now I feel anger, Amy. And when I feel anger, it’s not good for anyone.

I started with a search to see if her username matched any other username, perhaps on another platform. After checking all the Amy Jones profiles I could find, I determined that none matched so I made a hard left turn on my investigation. I decided I needed to find out the IP address of the server that was used in order to make an estimate on where she lived. Using the URL of her Instagram account, I ran it through multiple software programs to back trace her profile. Germany. A nice little town in Germany. I have been to Germany before; great country. Anyway, back to investigating my friend Amy.

Amy’s Instagram photo

This meant that when her profile was created, it went through a server in Germany. IP addresses change often so it didn’t necessarily mean this individual was in Germany now. They could have used a proxy server in Germany (to hide their actual IP address) or another means of masking the location of their computer.

The next investigative step was the photo. She had a lovely photo up of a girl in a swing. I used the information from the image to do an online search of any other locations that the photo appeared. Success! Amy! You’re so famous! I found the photo on the website of a company based in London, England. The website appeared to have stock photos on each page, including our friend Amy. A possibility is that Amy actually works for this company.

Amy? Is that you?

A simple search of their employee directory showed one individual named Amy. Luckily there was a photo included. At first glance, she looked quite similar to the woman on the swing. I looked at her neck bones and compared the photos side by side, as well as her body position, how her shoulders slouched and then I zoomed in 500% to see her teeth and eyes. Company Website Amy had blue eyes and perfect teeth (nicely done Amy). Swing Fake-News Amy had a chipped right tooth and brown eyes. There were enough minor differences that I felt I could definitively say that Company Website Amy was not Swing Fake-News Amy. I searched the photo a bit more and found the original stock photo online.

Now that I had determined the profile was definitely fake news, I wanted to find out why Amy requested a photo so many times; what purpose would that serve? I ran the bullshit username through a few more programs and found a list of all other instances where that username was logged. On every website that you make a comment, like something, participate in some way then there is likely a log. Periodically, I run usage statistics with web server logs; they contain incredible amounts of information including usernames of anyone who ‘logged’ an action. I found about five instances.

Amy’s real life

Two instances were ‘likes’ from the Instagram account. Both were of children and not the same ones and both were places in Eastern Europe. I looked at the date of the first ‘like’. It was August 6^th, 2019. Not long ago and no posts, comments or followers. Unusual activity for a social media user given what a helicopter parent this seemed to be. For godssake just buy a fucking trampoline, Amy.

There were other instances online that the username had come up. One was a website called ‘Instagram Stalkers’. That was a very subtle hint so further investigation was required. The other instances were incredibly confusing websites.

Things got weird, Amy

One of them appeared to be a photo website called Piwox. I selected each photo category and it returned me to the homepage. In looking at the page source information, I found that there were no directories behind the images; they appeared to be categories but were simply images. I noticed there was a contact page. It was a fake. Then I saw that there was a privacy policy. It was written in extremely poor English and included the following statement:

“Children’s Information

Another part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and/or monitor and guide their online activity. Pictame does not knowingly collect any Personal Identifiable Information from children under the age of 13. If you think that your child provided this kind of information on our website, we strongly encourage you to contact us immediately and we will do our best efforts to promptly remove such information from our records.”

I found this disclaimer quite confusing and concerning. Like…WTF Amy. I had never read a Children’s Information privacy statement on a website of that nature. I was not able to find any other information, ways ‘in’ or content at all. This might be a good time to introduce something called the Dark Web. There isn’t simply one internet. There is the Deepnet and the Darknet (Dark Web) and others.

The Dark Web

The dark web is part of the internet that isn’t visible to search engines and requires the use of an anonymizing browser called Tor to be accessed.  They hide all online activity. This might be for fairly minor purposes such as looking at websites that are blocked or storing personal information. It’s also a way of hiding illegal activity.

What do people do on the dark web? In 2015, there were 2,723 live dark websites investigated by two researchers and 57% hosted illicit material. In 2019, the number of dark websites had risen by 20% compared to 2016 and 60% of the websites were harmful enterprises, NOT including selling drugs.

What is it for?

On the dark web, you can buy stolen credit card numbers, all drugs, guns, counterfeit money, stolen everything, hacked everything, login credentials to people’s bank accounts, trafficking and pornography. You can get computer viruses to disseminate and methods for hacking a webcam (webcam hijacking).

Everything is invisible from search engines and typically, one needs a very specific URL and to use a Tor Browser for access. Often a user will need to submit something. To ‘produce’ something for an administrator in order to access the dark sites. Basically, you pay but not with money. With content. Drugs. Proof you’re not a police officer. An illegal video or photo. The ‘something’ is related to what you’re doing on the dark web. When people are busted for child pornography, they didn’t just look at it. They likely produced it in order to submit ‘payment’ for access. That is what makes the crime even more heinous.

The dark web flourished thanks to Bitcoin. Every communication is encrypted, every log is anonymous and shutting down these websites is challenging for law enforcement. An example of the dark web is Silk Road; an online black market for selling illegal drugs. The founder was sentenced to life in prison and the total revenue from the site was approximately 1.2 million USD.

Investigation continues

After I searched the photo website, found nothing and then read the privacy policy, I became suspicious that this wasn’t a website. I didn’t want to find out how to get in, however, I wondered what would have happened if I did use a Tor Browser and accessed this same page. Was this a website or a portal to the dark web?

I moved on to the next link I found the username in and it took me to another very confusing website. There was one advertisement at the top; I would describe it as ‘soft-core’ porn. The rest of the page had ‘normal’ looking links to different categories. I selected them all and was continuously returned to the same homepage. Only one other option here. I clicked the soft-core link.

No Amy. No.

I arrived at a very confusing place. At first I did not touch anything and just looked at what my screen was doing. I looked for a menu or other features that typical websites had. Nothing appeared. The entire website appeared to be advertisements. There was a clause about using advertising and having no responsibility over what is posted. All of the ads were of a sexual nature. They shifted constantly. An ad appeared, then disappeared, then another and another. I didn’t go into any of the ads because I felt my investigation was almost complete.

No past history on the Instagram account, two potential porn websites, two photos of other people’s children, an IP address in Germany, a stock photo for a profile picture and in addition, I noticed a clear change of tone in the messages. The first messages I received from Amy the Big Fat Liar were polite and with proper English. As the conversation went on, it became a bit more like those phone calls you get asking you to purchase vacations over the phone completely free if you send your visa number.

Trampoline Trap

The previous evening I had almost gotten up to take a photo of me standing on the trampoline. I thought to myself ‘if this mother needs help, I’ll just take a picture with my feet on it’. I really didn’t see anything alarming. After my investigation, I wondered what would have happened if I had sent it? Aside from all of the information a person could figure out from my profile, what else could be found from a sent photo?

When a photo is posted on social media, it’s compressed and that removes a large portion of the metadata. Metadata is information that is a part of the image file. It’s not like back in the day where you needed to set the date on your camera and then it ran out of batteries so you had to do it again and again forever. When you send a photo from your phone, it contains your GPS location which would have been my home address. It also contains what camera setting was used, the date and time, the image file size, the operating system of the phone, etc.

Posting vs sending photos

These may seem like harmless details, however, metadata can say a lot about your personal habits, where you live, where you take photos, your full name (if you’ve listed yourself as the photographer in the phone), where the photo is stored (your iCloud drive, etc) and every single thing about your phone. Lens, exposure, focus length, metering mode, content creator, lens model as well as the last time you opened the file, modified it and the time you took it. Imagine all that data, combined with the amount of investigation I’ve done on our friend Amy. Imagine that, along with dozens of comments, photos, shares, likes, etc.

Let me put it this way. If I were a predator and I received a photo, I would have all the information I need to find that person, the layout of their home, their habits, their friends, I could go on and on. There have been instances of hackers getting into people’s Wi-Fi system and even hacking their phones. Amy liked photos of other people’s children. I found her username on very sketchy websites. She was desperate for a photo of me on the trampoline but how would she know the depth without a comparison photo? I would bet that was the next question. Can you take a photo of the trampoline with your daughter? Then I can compare…

*stalker*

Checkmate, Amy

The reason Amy the Asshole couldn’t obtain very much information from my original photo is because social media compresses and scrubs (wipes) most of the metadata when posting. A photo cannot be traced to a location unless it is sent directly, such as through Instagram Direct Message.

I finished off my investigation of AmyJones6062019 by sending him/her a link to the page where the stock photo was found. I told him/her that the photo, account and questions were clearly bullshit and added a bit of my own colourful language to scare this person. I’m good at that. I like tracking down scammers and then sending them a photo of themselves. It really messes with them. I blocked the fake account, took screen captures of all my interactions and reported it.

Instagram Safety

Amy was never Amy. She or he is someone who I don’t know and who really wanted a photo sent directly to them. Amy is an account with no obvious information. Amy is a beautiful blond woman. Or a pervert logged in to more than one concerning website, listed as an stalker online and has liked photos of children all over the world. I even looked at the hashtags of the photos that ‘Amy’ liked so I could find patterns. There was a clear pattern; a methodology, it seemed, for obtaining photos of children.

I don’t know what Amy is but Amy is not a mother who wants to buy a trampoline for her three year old.

I have had my fair share of scammers try to get me and I continue to offer them free life insurance. Despite my scammer fun, we need to be careful and vigilant especially when it comes to children. This time, it wasn’t fun. It was scary. Most scammers that I mess with are only trying to sell me lemons or free trips. It’s a fairly harmless façade that I engage in if I’m bored. It was exhilarating when I was selling my car. But this was different. Amy was different.

The technological world

Technology, social media and the World Wide Web are not going anywhere. Even if you keep yourself off of the internet entirely, you won’t be ‘off the grid’ unless everyone around you does the same. Even then, you’ll have a tough time evading the online world. Your family tree may appear. A cousin might have Facebook. You might be listed on an employee registry. If you’ve used a credit card, you can likely be found. Even if you have zero online interaction, I bet someone in your life does. It is for that reason that I’ve adopted a ‘learn the online world’ attitude rather than trying to push it away.

I absolutely don’t judge anyone who tries to stay off of social media; there is certainly wisdom there. If you are an online user then good judgment, extremely careful use by children and moderation are essential. Realistically, a child isn’t allowed to freely roam the planet until they are of age (18 in Canada). Before that, the expectation is that you’re under the guardianship of an adult and are monitored so that children are kept safe. An eleven year old isn’t given a plane ticket to Europe so they can backpack around for a couple of months. A twenty year old might be.

Street smarts and cyber smarts

The internet is a ‘world’. It is the same as the physical world. Dangers are different and we need different senses to notice them. I won’t turn away from  evolving technology but I also won’t sit back and allow myself to become uneducated about technological advances, the behavior of predators and how to use the internet safely. When we think of privacy, we think it is invisible data. Privacy is often a ‘state’ online unlike the physical world. When we’re in a private place, we assume no one can see us. When our online world is ‘private’, it is set to a state called Private. It is not really private; it is hidden from those you want it to be hidden from, however, nothing on the internet is EVER truly private. WikiLeaks proved that many times over.

Amy bytes the dust

After a few days, I searched again for Amy’s username and found that it had disappeared completely. I looked at the photos she had liked and although they still came up, her name was gone. The account had been deleted completely from Instagram and I was unable to find any instance anywhere that logged the username. Amy was gone. Even the conversation was gone from my direct message account. No trace of Amy… aside from the screen captures I took, then posted below and this entire article. Other than that, Amy is gone.

Amy Fake-News Jones

Don’t send a photo to anyone you don’t know or trust. Sending a photo and posting a photo are two very different things. Instagram and other social media profiles that are fake usually contain a photo of a woman or no photo at all, very few or no posts, are seemingly inactive or have a series of posts all within a short period of time, private with very few followers and/or very little engagement from other people. Sometimes there will be a much higher number of followers than those they are following or their first post (if they have any) will be recent. New fake accounts are created constantly.

Your relentless questions gave you away, Amy.

I decided to share this experience because it wasn’t like other scammers. It didn’t feel like I was being tricked. I didn’t think anything of it initially because it was such an authentic question. It played on my mom-role, my intention to help another person out and initially there didn’t seem to be red flags. There is a great deal of media attention on protecting children from internet predators and these measures are extremely important. I hope that this story brings another measure of caution so that we can enjoy the online world and use our ‘online senses’ to determine if something is not safe. Just like in life, if the alley looks dark and scary then you should probably not go down there. Take another route.

Online safety is not restrictive. It’s proactive and protective.

If you choose to give your child free access to the internet without restriction, ask yourself if you would do the same if they walked out the door to go travel the world without you. The internet is not a game. It’s a world. To stay safe in the online world, we need to learn to identify danger. Facebook purchased Instagram a while ago and since then, there have been significant changes to privacy, personal information and freedom to create as many fake, false or dangerous accounts as you’d like. Monitoring is via the public. There is no internet police.

There are ways to see every page your child views, turn on and off their devices and schedule allowable screen time. Use these features; they are there to ensure we protect our loved ones. We need to educate ourselves and notice the dark alley before we walk down it. Then teach our children to do the same.

I hope this article contributes to the ongoing safety of our children.