Ban of "Nicole" images and potential doxing
Hello world,
as many of you may already be aware, there is an ongoing spam attack by a person claiming to be Nicole.
It is very likely that these images are part of a larger scale harassment campaign against the person depicted in the images shared as part of this spam.
Although the spammer claims to be the person in the picture, we strongly believe that this is not the case and that they're only trying to frame them.
Starting immediately, we will remove any images depicting "Nicole" and information that may lead to identifying the real person depicted in those images to prevent any possible harassment.
This includes older posts and comments once identified.
We also expect moderators to take action if such content is reported.
While we do not intend to punish people posting this once, not being aware of the context, we may take additional actions if they continue to post this content, as we consider this to be supporting the harassment campaign.
Discussion that does not include the images themselves or references that may lead to identifying the real person behind the image will continue to be allowed.
If you receive spam PMs please continue reporting them and we'll continue working on our spam detections to attempt to identify them early before they reach many users.
I gotta give it to you guys. The foresight to prevent a disaster is 10/10. Top tier. Well done.
to be honest, this should have been done way earlier.
Still glad you're doing it now!
I saw a theory a while back that the IPs which receive the various images get logged allowing the recipients accounts to be tied to an IP and possibly even a physical address based on the timeframe it was sent. Is that a real concern or just conspiracy, do you think?
That appears to be a baseless conspiracy theory.
Except for the gore pms, I believe all the images have been uploaded to Lemmy instances or Imgur, which means that the uploader has no way to track IPs accessing those images. The gore images were uploaded to another service that at least on the surface appears to be another regular image hoster that wouldn't expose IP access logs to uploaders.
The instance domains I've seen involved so far at least weren't set up specifically for this purpose at least. Most of the URLs were pointing to established services and not different per recipient.
While I can't rule out that individual users may have received a different URL in an attempt to extract their IP and information about their browser, this at least does not appear to have been done in a larger scale.
Gore wait wtf where does gore come in, is that if you play along with the ctfish?
A day or two ago, someone spammed out a picture of a murdered body with the standard Fediverse Chick copypasta. That seemed to freak people out; the nicoled community locked down, this thread happened, etc.
The gore photo seems to be a second actor/copycat. The Nicole spammer either came from their own instances or opened accounts very shortly before spamming, the gore photo, and a following anime style picture done in red-on-white saying "Do you like insanity?" seem to come from accounts that were made 2 years ago.
Oh damn. Don't know how I missed that bit of drama. Thanks
I find it difficult to believe there are enough fediverse users not using a VPN at all times to make that effort worthwhile.
most people don't. the only device I have that runs a VPN 24/7 is a laptop that seeds
I use a VPN on everything else if I'm doing something sketchy though
everyone should be more like me :3
yeah that's fair, I probably should use it more but it's just kinda annoying
You know it had not even crossed my mind until this post but on hindsight it makes perfect sense.
It's pretty obvious ...
What's scary is how many people just accepted that some woman wanted to randomly spam thousands of pictures with her smoking weed.
Maybe they're used to onlyfans bots.
That would make since if any of the pictures were selfies and not random screen grabs off a webcam
Foresight? This has been going on for several months.
I took the comment as sarcasm. lol
You forgot this
/sYeah it seemed funny at first but the longer this went on the creepier it got as we all realized this isn't just a catfish.
Whoever is doing this to the actual person in the photos is a terrible human being and should go climb under a rock for the rest of their lives.
Agreed. When the images started to change it got really creepy.
I've seen several different images and there was a video on peertube. All of them look like content from a hacked webcam.
Yeah, that's what I thought from the very first DM I received. It looks like Shea totally unaware a picture was taken of her. Surely, if this were real, "Nicole" would use a more flattering picture to potential friends.
It got super creepy when more shots of this women were released of her doing activities that no one would ever take a photo of themselves doing. Then the last photo was released separately of a NSFW don’t read if you are not in a place to read gore/graphic/assault
::: spoiler Tap for spoiler
Real photo of a dead woman who looks like Nicole in a morgue body bag with her flesh peeled off and her face beaten. It’s unlikely that this disturbing turn is real but it was horrific for people who received this last spam. That is what triggered the ultimate ban on all images (since this is most likely a psychopathic copycat). :(
:::
It's just creepy because in every other obvious scam like this for the last 10 years they use the same single picture of the same person on everyone. Now suddenly there are dozens of different pictures, all clearly of the same woman, going to different people.
I can't wait for the future 4 hour video deep dive into Nicole history and lore.
Question is, is it going to be made by Whang or Nexpo?
Count Dankula's madlasses
Neither. Hopefully someone like wendigoon or oki's weird stories. Someone a bit more investigative and less semsationalistic than nexpo.
I'm hoping it's not made by Caitlin Doughty.
Is this Nicole thing really still a thing? That’s so like back when I still had a 401k.
So was it last week or the day before yesterday? It all happens so fast, I can't - and frankly - refuse to catch up.
It's been ongoing for a few weeks at least. Maybe months.
It's been at least half a year
My government salutes you!
Don’t blame me, I voted for Kodos.
the problem with this spam and generally federated platforms is that you can only really try detecting it based on the content. the accounts tend to get created on another instance and then the messages federate over to you, which means you won't see a lot of the identifying information you'd see for a local user, such as their IP address.
I just chalked it up to "a necessary evil" in order to take advantage of federated platforms. I found it funny at first, and then just ignored it. I never thought that it could've been some smear campaign, but rather scammers looking for easy targets.
I'm glad mods are doing something about it, even if it's not a perfect fix.
IP bans aren’t great either. A decent spammer will just use a vpn. Then you’re just banning IPs from a service that other users might also use. An even more sophisticated bad actor would just use a bot net.
Ouch
This is a copy+paste of a comment I left on the ![email protected] mod post after the recent incident with the gruesome picture(s?):
“I think if Lemmy doesn’t have the infrastructure to defend against attacks like these which are presumptively conducted by one bad actor, then it doesn’t have the infrastructure to defend against wealthy organizations when our communities do get big enough to be noticed by them.
[![email protected]]’s history underscores how the messaging system in particular needs a massive overhaul; using image recognition as a filter for messages like Lemmy.World does for image posts (with options for NSFW that isn’t NSFL?), preventing images (and URLs? or only allowing white-listed sites?) from being sent within the first message sent between users (unless a box is ticked?),
not showing message recipients images until they are directly opened, and preventing the de-anonymizing of message recipients should be made first priority for the next patch.”Edit: not sure if my comment is inciting other trolls/spammers to target me but I just got this DM several hours after commenting
https://join-lemmy.org/news/2025-04-08_-_Lemmy_Release_v0.19.11
Ah very cool. A recent update too. Thanks.
Yes. As you can see, a few large instances like lemm.ee, lemmy.ca and others have already updated: https://fedidb.org/software/lemmy?version=0.19.11
Hopefully others will follow soon
Reddthat.com updated as well... dunno how big our instance is, in comparison, but I didn't know the update dealt with embedded images in PM's. I appreciate the info!
https://reddthat.com/post/38890931 / [email protected]
What does the "MAU" stat mean? "'Something' Active Users"?
Monthly active users
unfortunately we can't just apply the update quickly, as this introduces sending emails on rejected applications. we already send rejection emails separately and with custom text, while the text implemented in the update is currently not configurable.
i'll see if we can deploy updated lemmy-ui without updating lemmy already this weekend, but i need to check if there were any api changes first, as we'd then have to backport them to lemmy first.
we've already applied the security patch about 2 weeks ago.
Thank you!
Honestly I think the easiest thing would be to not allow images or embedding at all in PMs and perhaps display a warning message when clicking links "you are leaving [instance name]..."
Analyzing potentially lots of text and images in an effort to "guarantee" safety of users is likely a sisyphusian endeavour that is bound to fail - and furthermore also has privacy issues (namely that "private" messages aren't private at all)
I'd add --- as someone who was concerned about and posted on the possibility that the aim of the spammer was exposing the IP address associated with the receivers's username --- that even if this wasn't the aim from this event, it could be in some future event.
I don't think that disallowing inline images in direct messages will eliminate spam problems, even efforts of this sort, as it'd still be possible for a spammer to spam messages with indirect links to images hosted elsewhere. But it would help avoid leaking IP addresses of the receiving user.
Or at least disallowing inline images in direct messages by default. I can imagine maybe someone enabling them on some kind of a private, decoupled-from-the-wider-Fediverse instance on an intranet or whatnot, but I really don't think that this is something that nearly any instance should actually permit.
For anti-spam efforts, I think that there are a variety of potential partial solutions. No complete fixes, but some:
Rate-limiting the comment frequency on new accounts. IIRC, Reddit used this tactic. It does create some issues for (legitimate) use of throwaway accounts in anonymous posts, but there's no legitimate reason for a new account to blast hundreds of messages an hour, I think. This might already be present, but if not, it'd be a good start. This can be defeated by generating new accounts for each new message or batch of.
Rate-limiting new account creation from a given IP address, if not already present. An attacker could defeat this via use of a commercial VPN, and if too low, it could create issues for some commercial VPNs.
Hashing of messages to red-flag identical messages being posted en masse. As best I could tell, the spammer here was posting many identical messages. This can be defeated by a spammer having software slightly modify each message.
Fuzzy-hashing of messages to red-flag almost identical messages being posted en masse. This can be defeated via text generation methods that are carefully tailored to the fuzzy hashing mechanism to modify messages such that each fuzzy-hashes to a different value.
A mechanism to permit an account to share blacklists of IP or message hashes and trigger removal of messages on other instances, preferably associated with a specific identifier or account. This permits any other instances to leverage antispam work by one instance; if I want to trust a given antispam admin or bot on lemmy.world, I can. Let an instance admin review and override such removals, maybe. It creates abuse potential for malicious use or inadvertent false positives spanning instances, but I think that it's necessary to avoid having each instance fight its own lonely antispam battles. Otherwise, new and personal instances risk being buried by a deluge of direct message spam. The same mechanism, if exposed to users and not just instance admins, would also permit for subscribable content filters for people who don't want to see content of a given sort (e.g. profanity or pornographic content of a particular sort or whatever, not just spam), which is another issue.
Fortunately, as far as I see as a user, we're not yet at the point that there is much spam on here yet, so this isn't yet a serious problem. Maybe it'll never happen, if the userbase never grows much. But if the userbase gets considerably bigger, increasingly-problematic spam will inevitably follow.
https://lemmy.today/post/27248848/15501047
https://lemmy.world/post/28077771/16380860
For anyone not clicking the link, but wondering what this reply means... it's a link to the user's comment (right below, within this comment chain) about a lemmy update
I was confused for a sec and probably would've skipped over all of the context because I didn't continue reading first (and I hesitate to click links randomly), so maybe someone else with no attention span will benefit as well
"Lemmy update v0.19.11 provides 'Dont render images in private message'
Not every instance is updated to this version, but it should stop the current method of spam (if updated). I'm wordy, I know; but maybe it'll help someone
Well, I for example develop an automod (which is available to everyone) which includes advanced stuff like scanning images in the content, scanning the text itself, detecting similarity between two images etc. This all in an efficient reactive manner using database level webhooks.
There is the infrastructure for that, it's being developed and refined with every new kind of attack that's happening. As every other platform does, whether they're commercial or open.
They are absolutely right. The quiet part of this is almost certainly that these DMs were being used to collect IPs from users using tracking links, and this is generally a big vulnerability in the fediverse many people seem unwilling to meaningfully confront.
I got that DM as well. And then it disappeared. I think my instance's admins saw it spammed and mass deleted it.
Wait, there are people who genuinely believe she's the one behind it?
I thought it was pretty obvious that she's the target of harassment. Some people must be new to the Internet
Yeah, I've been targeted by enough romance spam that I just assume any photo of a woman I don't know was probably stolen from some random Tumblr or Instagram.
Everyone is 1 of the 10000. Even the people who have to look up what being 1 of the 10000 means
I had to look it up, and after reading a lengthily Wikipedia page on Greek mercenaries, I tried the second result: an XKCD comic I’ve seen before but had forgotten. So today, I’m one of the lucky 10,000 again.
I've seen internet harassment campaigns, none have looked like this. She doesn't feel like the target here. If you wanted to use the internet to harass a girl, is this how you would implement it?
Yeah. This is older than the internet. It's like writing "For a good time call Nicole" and writing someone you don't like's number in a truck stop bathroom.
...actually...
Speaking of new to the internet, it's clearly not a harassment campaign against her. This is waaaay too much effort. There's only 3 things that would engender this level of effort. Money, government spying, or mental illness.
If you are willing and able to do a bit of scripting, it's not that hard to generate and send a bunch of messages on the Threadiverse.
And there are people who will go to pretty extreme lengths to harass people who they are really upset with. An ugly breakup or something and...
mentally ill people can have plenty of time on their hands to invest this much effort in harassing others. people claiming that this can't be harassment are effectively supporting the harassment, as that tries to further blame the likely victim of this. obviously this is just speculation, as we don't know the full truth.
I don't think anyone seriously thinks the woman in the pictures is behind this.
I'm sorry, sometimes it's hard to tell whether people actually mean it. I can totally see people commenting that and being serious.
things can be multiple things and once
True.
It's a crypto scam. That's all it ever was
Thank you for your work managing the spam waves!
About damn time. The joke has run it's course a long time a ago and if these posts are victimizing an individual they most definitely need to be stopped.
I broke up with her for this reason.
She ghosted me. Never replied to any attempts at communication. I'm done.
Considering the spammer has used so many different photos, and they all seem to be "in the moment" webcam photos, I suspect they may have webcam spyware on the victim's computer
She looks to me like a college student attending an online class. Looks like it's shot on a laptop's built-in camera, lighting is whatever, she's dressed casually and comfortably, facial expression is neutral or even bored...
If you're taking a college class via Zoom, can you see your classmates' webcams?
Ripping a bong on zoom in class?
It's not the 90s anymore Becky. Live a little!
You don't frame yourself perfectly in your webcam's view before you take bong rips?
I feel like we can rule out spyware and online class. More likely a group call with friends or something like that
Yeah, why not?
Yes, almost always, if the professor requires you to have webcam on. AFAIK the whole meeting sees everyone who has webcam on.
Yes. Sometimes it is required to have your camera on. Even when it isn't required, there are always some people who prefer to have theirs on for whatever reason.
with the content i've seen it gave me more of an impression of being captures of a live stream, but that's just guessing
True, that's probably more likely
Didn't somebody locate livestreams by the person in the pictures? I want to say I read that in one of the research threads.
Could be completely AI generated with variations of the same person. But that doesn't really matter, the spam needs to go.
Considering it says she’s in school, it seems more likely that it might be an online class where the students are sharing their webcam
Is this the person some folks around here were referring to as the "Fediverse chick?"
Yes, as that is how "she" initially introduced herself
Was that a real introduction or simply another person using a stolen identify?
It's almost certainly someone using pictures they took from a live stream
That is the point of this post. It was always considered to be spam and folks were trying to figure out what the motivation was and now they are working on the theory they are trying to be a dick to someone.
Someome's trying to be Chris Hansen or something.
Yep. That's the one
Thanks. Even if it isn't a harassment campaign I'm sick of the messaging
I always thought it was weird how much attention people were paying to span messages. Giving them that much attention only serves whatever purpose they have.
We don’t get many on this platform. It’s the only spam I’ve received here. So getting spam we all shared is something that generates discussion. I don’t think anyone took it seriously. It was mildly humorous at first, but now that knowledge is spreading that this likely isn’t some generic spammer we can deal with it differently.
What of the recent NSFW/gore images that were shared? Has that been reported to authorities?
Not expecting police to solve it, but at least it would be on their radar.
we looked into it, we currently believe that to be a copycat not related to the other pms.
the lemmy.world account involved in that was most certainly compromised from an unrelated data breach and all connections originated from IPs linked to an anonymization service, so there's also not much to follow up on.
we will reconsider this if it happens again.
This annoys the fuck out of me and I hope whoever is behind it doesn't realize their goals, because I don't want lemmy to degrade into a bunch of spam PMs.
I finally got one a week ago. Have many of you gotten them?
Jfc I got my first today and was like “oh wow it’s real.” Can’t believe some people are getting multiple a day. That would be annoying as hell
I got my first one last night. Yay! I'm part of the thing now!
At least 4 or 5.
TBF, it's bound to happen.
Guaranteed almost.
Lemmy has minimal controls for protecting against spam and bot spam. It's built to handle the internet 5 to 10 years ago, not the internet today.
I can only hope that this changes because as soon as the platform becomes popular enough (which it is slowly). Then the rate of bot spam and other sorts of spam will just go through the roof, and there's very little that admins can do to combat it without it becoming a full-time job.
We can have an opt in spam filter that makes it harder, the instances can defederate spamming instances (user) unless they do something which yes there is a lot admins can do at signup. Or have I misunderstood something?
I don't either want to see story on TV about Internet hacker group "Lenny" destroying womans life by a persistent harassment campaign.
Oh boy that's horrible, if true I hope she has reported it to police, and they can help her.
Damn, I never thought about it this way. Wow. I always took it as a funny thing not thinking of the person in the photo being an actual person who could very well be harassed. Thank you for bringing this to light. Whoever thought of this is a good human being. <3
I told the person sending the image to kys :/
Would rather more positive lore, but I guess it is fediverse lore. Just checked from curiosity, all but 2 messages I have got are from Nicole bots, 1 was another spammer and the other an automated "welcome to this community" bot message.
Yeah. At least Colby and the Jolly Ranchers didn't involve harassment of an innocent person.
Colby involved worse things than harassment.
Colby was a made-up story. The victim of this incident is a real, human person.
The word 'nodule' still makes me gag
Remember that guy who wanted to know how not to poop for three days!?
https://web.archive.org/web/20230624223444/https://lemmy.world/post/440073
For posterity. I'm gonna make a post for this one for others to find. It's too glorious.
I miss the wizard trend though.
Edit: https://mander.xyz/post/27989180?scrollToComments=true
Beans
And jeans
What a ride! So proud for him
Do the Owl Of The Year tournies break into c/all?
I thought she loved me.
She loves us
🛠️ (my instance doesn't have a hammer and sickle so this will do)
⠀⠀⠀⠀⠀⠀⢀⣤⣀⣀⣀⠀⠻⣷⣄ ⠀⠀⠀⠀⢀⣴⣿⣿⣿⡿⠋⠀⠀⠀⠹⣿⣦⡀ ⠀⠀⢀⣴⣿⣿⣿⣿⣏⠀⠀⠀⠀⠀⠀⢹⣿⣧ ⠀⠀⠙⢿⣿⡿⠋⠻⣿⣿⣦⡀⠀⠀⠀⢸⣿⣿⡆ ⠀⠀⠀⠀⠉⠀⠀⠀⠈⠻⣿⣿⣦⡀⠀⢸⣿⣿⡇ ⠀⠀⠀⠀⢀⣀⣄⡀⠀⠀⠈⠻⣿⣿⣶⣿⣿⣿⠁ ⠀⠀⠀⣠⣿⣿⢿⣿⣶⣶⣶⣶⣾⣿⣿⣿⣿⡁ ⢠⣶⣿⣿⠋⠀⠀⠉⠛⠿⠿⠿⠿⠿⠛⠻⣿⣿⣦⡀ ⣿⣿⠟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠻⣿⡿
You're welcome
what?
Appears correctly on Voyager, original commenter should’ve used a code block.
Edit: I suppose display size does matter - iPhone 16 Pro
ah thank you.
just as in real life, communism doesn't work here either lol
doesn't work 100% on my Voyager
Google Pixel 8 btw
If I resize my view it works but otherwise... xd
720x1600 Master race?
Thank you, comrade
If we remain faithful to nicole we will be delivered eternal life. Lisan al nicole.
Sorry if this isn't the right place to ask, but are you able to confirm whether admins have reported this to the police?
Even if violence hasn't been perpetrated, the harassment is still a crime surely.
I don't know if others have, I only know that we (Lemmy.World, Fedihosting Foundation) have not reported it to the police.
I don't have high hopes that the police would be able to do anything about this. For the harassment against the person shown in the images, that would likely have to be reported by them directly for the police to take that up.
For random online spam, as in harassment of fediverse users receiving the PMs, that seems like it would be an extremely low priority for police. It's also likely fairly difficult to impossible to follow up on, considering that the person sending the PMs most likely used a VPN to access these accounts.
Hmm.
The people receiving the spam are not being harassed, obviously.
The woman depicted is very likely the target of harassment.
Sharing the images depicting violence is tantamount to a threat of violence.
As admins, you're not just witnesses but the stewards of a community and the representatives of many thousands of people in this matter.
Pre-empting what the police will do is not a reason not to report. You don't know what they will do. They might do nothing at you would have wasted 15 minutes. On the other hand perhaps Nicole has been trying to get a restraining order against some creep but has been unable to due to lack of evidence.
I have spam in my email. Should I report that to the police as well?
There just isn't enough for regular police to go on, without even considering jurisdiction. Cooperating with authorities is fine, but there's not really anyone to proactively reach out to about this.
Yes. If you run an email server and one of the accounts has been used to perpetrate a harassment campaign including threats of violence then obviously you should report that.
Agreed, but there is no proof of this. We also don't know their true identity to check with them directly.
The images did not depict violence directly, it was a gory image of a dead person. They were very likely sent by a copycat not involved in the original harassment campaign and intended to fuck up fediverse users more than anything else. They did not appear to imply any kind of threat.
This would require a lot more than 15 minutes to file a proper report. First we have to collect all relevant information that we have available and compile them in a format that can be submitted. Once we have this information we have to identify a police department to report this to. We are legally based in NL, as that's where our non-profit Fedihosting Foundation is located. I'm based in Germany, so it would also be an option to report it here. The depicted person is claimed to be in Canada, so maybe this should be reported to a police department over there. Or maybe to all of them.
All of this would easily add up to 2 hours or more if you want to do it properly and not just look for 3 online forms to write "hey there is someone sending spam".
If this was a paid job and I was doing this during working hours I wouldn't mind, but all the time I spend here is taken out of my personal time, the same as with anyone else on our team, and also the same you'll see with most other fediverse instances.
If we receive a request for information from (real) law enforcement we'll be more than happy to provide relevant data, but doing this for the (perceived low) chance of that somehow being linked from a random police report is a fairly high time investment as described above.
Tell you what: log the time it takes, and I will personally pay you $60/hour for your time to make a proper report.
And no, I’m not being sarcastic.
I truly appreciate the offer, but my concern isn't about money, it's about this taking away even more of my personal time. If this was a regular day job I was doing, rather than my actual day job, which I have in addition to the time I spend on Lemmy.World related activities, then I could file this during my regular working hours. After all, it's time I'd spend being at work anyway.
I've recently been spending countless hours already dealing with other stuff that is not directly tied to Lemmy.World but came up "around" it, including sending abuse reports to various instances about CSAM that federated to them a long time ago. This includes time spent on identifying such material, then finding suitable abuse report mechanisms, providing instructions for how to deal with it. Afterwards it needs reviewing whether the content has been removed or requires further escalation steps, such as one case where I've filed a police report today for a case where neither the instance itself nor the hosting provider deals with abuse reports at all.
As mentioned before, there also seem to have been two different people involved in sending these messages, the original person, where most of the information is/was available publicly and has been collected by various people already, who would be in a much better position to report this content to law enforcement.
The person sending the gore images did in fact use a Lemmy.World account in one case, which we do have more information about than publicly available or available for users on other instances, so this would be the only case for which we'd be in a privileged position for reporting. This however would also most certainly not be a report that would help any sort of harassment investigation, as this copycat probably doesn't have any ties to the original harasser.
If we had a significantly larger amount of donations towards our foundation we'd also be able to pay someone to deal with things like this, but we're currently just over the hosting costs with our monthly donations.
No need, this info isn't hard to compile, only took a few hours. If anyone does intend to take this to law enforcement, please PM me as I have compiled what I think to be almost all of the public information available about this case.
you could easily report this to the police yourself then. i don't really have anything more than what is publicly available, with the exception being one of the gore spam accounts.
I'm not saying you have to, but given that various people already collected a lot of information related to that stuff, they would be much better suited in actually reporting this to police somewhere.
Respectfully, I don't share your assessment of the seriousness of the crime. You seem to be weighing the question of whether someone has been harassed or intimidated from the perspective of a "reasonable third party". However, I suspect that the law assigns considerable weight to the question of whether the victim feels intimidated or harassed. For example, you're correct that sharing the gore image is not a direct threat of violence, however I feel certain that the woman depicted in the earlier images taken from the live stream would feel concerned for their safety.
I would also like to clarify one aspect of which you may not be aware. It's very easy to confirm the woman's place of work beyond any reasonable doubt, with images she has posted to other platforms.
I understand that it's unreasonable to say that you specifically or any admins of lemmy.world or any other instance should give up hours of your free time to make a police report.
However, as others in this thread have suggested this incident underlines the limited protections lemmy has against this type of attack and it seems likely that we will see a lot more.
I also respectfully disagree regarding the likelihood that reporting this crime could be useful. It's not a question of "somehow being linked from a random police report". If the victim ever does contact the police, which seems very likely to me, it's extraordinarily likely that a report from lemmy would be identified as being related.
It's not my intention to berate you personally over this, and as I mentioned above I acknowledge that it's unreasonable to expect you personally to take action in this specific case. I am however concerned that Lemmy's federated nature is not well suited to addressing this type of risk to members of our community.
I have compiled what I think to be almost all of the piblic information about this case. If you do need something please PM me.
Agreed. At least here in the US, you'd have more chance of winning the lottery than getting a cop to care about this issue without the person directly involved reporting it. And even then it would be a crapshoot.
The right cop will care about it, but the right cop doesn't work for your city and so you don't have any way to contact them.
Anyone asking you to file a report with police has likely never had to file a police report. They don't even want to file reports for things that actually happened directly to you, if they can convince you out of it lol.
I’m not a fan of LEO, BUT at the same time doing nothing should not be an option. What I mean by that is that Johnny Law should still be contacted and a report filed (at the very least). Even if they do not follow up on it, that’s on them and not us (the fediverse).
see https://lemmy.world/post/28077771/16383824
Would it even be realistic to know the right place to report it to? Just because the messages say Toronto doesn’t necessarily mean the victim is in Toronto, and reporting it to the wrong place at most probably just means wasting resources in one location and coming no closer to stopping the harassment. Is there anything from a national group like the RCMP, FBI, or INTERPOL to help in a case like this?
There's a video of her eating food in the shopping centre where whe works. You can find it on google Street view.
Haha what fantasy land do you live in where that helps anything?
Actually smartass, it's called Australia. We have laws specifically to address this exact situation. I have made police reports in my time, and can assure you that the police would take a campaign of this scale very seriously.
I have no context for this and thought it was an April fools joke left up but no, this is a real problem here?
I think I've gotten about 5 messages in total. Multiply that across the fediverse, and that's potentially a lot of irritation.
I just got my first one a couple days ago so yeah. It's pretty widespread.
I've heard that if you actually add her on friendica, the mayor of Toronto shows up at your house and gives you an old fashioned.
What kind of a loser does this to someone?
I'm just guessing here, but maybe a rejected suitor? Or a person they're beefing with? A mentally ill person who found these pictures and decided to direct their hate at them? People do all sorts of weird stuff for all sorts of weird reasons.
My hypothesis is, someone's trying to run a "Hey statistically lonely men on the internet, I'm allegedly a girl. Send me money in hopes of getting attention" scam, and they're using the pictures of "Nicole" because that's what they have at hand. I'm picturing a college classmate capturing college Zoom classes so they have several different pictures of the same girl. What others are attributing to sick malice I'm attributing to callous disregard.
I've seen people posting screenshots of them asking for money. It definitely was that sort of scam.
I'd heard that a crypto account or whatever had been added to the text but I couldn't find an example of it.
The same kind, that sends parents pictures of the corpse of their daughter in the car accident that killed her.
They somehow got the pictures the police took on the accident site
They kept sending these pictures to the parents, until they moved & changed their names.
Check out ep 140 of Darknet Diaries. There are some weird sickos out there with a lot of time on their hands.
https://darknetdiaries.com/transcript/140/
I can't believe I managed to never get one of these spam messages. I didn't even know what a Nicole was until the week or two ago.
Don't say it out loud! I said the same thing a couple weeks ago, and it's a weekly thing now.
Beetlejuice Beetlejuice Beet....
Wait, what movie am I watching again?
I heard people talking about it, but just got the message last week. It felt strangely like an initiation. There's even a link to a discord. I'm terribly curious what goes on there, but don't want to risk whatever possible ramifications of joining a prolific spammer's Discord server.
… initiation? Reminds me of that cult who does this to lure people in.
I think some people are taking a joke too seriously.
Wait, a cult sends spam to lure people in?
Yup. They use it for blackmail. It’s weird. Kids are also easily manipulated.
don't mystify
Don't tell other people how to think.
I hadn't either. I received one a few weeks ago, after seeing this thread. Still no idea wtf is going on with it. I just deleted it.
I blocked them so many times. There's just always more.
Yes. I too feel left out.
I've been thinking this since it started and saying it for a bit. I don't understand at all how there were memes of this on the front page all the time and it took this long to do even this. Has there been any attempt at an effort to notify whoever is in the picture that this is happening? I would like to help if possible.
I think "notify her" feeds the harassment they're referring to, even if contacting her is well intended
I mean depending how its handled and on context, yes of course, but I'm not suggesting we traumatize this person further than whatever has already happened. Like someone else said letting the university is a decent first step.
might make sense to notify the educational institution she was said to be attending.
WTF is a Nicole image
Edit: After seeing responses…. I got it weeks ago but just ignored it as spam and didn’t even read it. The pic jogs my memory
How long have you been here? I've only been here a few weeks and got no fewer than ten of these messages.
One account over a year; this account about two months when I finally decided .world could fuck off
It's just a spam message. It starts "Hi, I'm Nicole, but you can call me the fediverse chick!" Probably just a romance scam or something.
Thx, I only knew that as fediverse chick
Wise choice!
Hey look! It’s Universal Monk, showing up in a .world community. Pretty bold move dude.
I wonder how Nicole chooses? I just got one image.
It's likely not Nicole herself. It's spam trying to frame her.
Nicole AKA the fediverse girl/chick
I assumed it was something like a pig butchering crypto scam.
No one is immune. The feeling of invulnerability leads to complacency, complacency leads to sloppiness and sloppiness leads to the
darkeasy mark side.Not sure about that. I see a LOT of lemmy posters who seem to never have had a girlfriend or are too scared to talk to girls in real life. lol
Thankfully I haven't received one of the gore ones I've seen people talking about, but yeah I'll stop participating in the meme, it's not as a fun anymore.
Oh, I think I got one of those. It's that girl with the bong, right?
Yes, but there are a few pictures around from all of it
Thank you, as someone who looked into this I am glad to see this being taken seriously. The real Nicole is for sure a victim and does not deserve to be doxxed and made into a meme.
Oh right I remembering reporting someone for DM‘ing me the Nicole picture last week after learning the account wasn‘t even a day old. Good to know things like this are being taken seriously.
Echoing everyone else in that it seemed kind of funny at first but that it has just turned weirder.
I think it's a good call. I will report if I receive any messages.
Glad to see there's effort being taken to stop this, as someone who's been harassed in a similar way on here it really kind of bugs me that people are making light of this or assume that the original person is the one doing this. Impersonation is frighteningly easy on the Fediverse and I really wish they'd add some kind of verification in Lemmy like they do in Mastodon to try and minimize the impact of it.
Thanks! It was getting bad.
They are not stopping the messages, just removing posts with her picture other people have shared.
Understandable.
This is some small internet bullshit i'm here for
I just got a new one this morning from another person calling themself Jessica. I'm also not sure if the report button works for anything but posts in a comm with Jerboa :/
Nicola and then
JeckaJessica? Hmm, where have I heard those names before..?It was asking me on a date, sorta... 🤔
Unless I get DM'd by Amicus, though, I ain't falling for no VN character.
likely unrelated, but I already forwarded the PM reports we received on LW to .ee admins a few hours ago. probably just a "normal" pm spammer.
TLDR; Scammer/creep is using a woman's photos, possibly stolen from a webcam hack, and her social media links to privately message people.
People were getting private messages with a few links and a picture from someone claiming to be Nicole the Fediverse Chick.
Of course this becomes a meme and spreads as people talk about it.
It gets weird because there's multiple different pictures. 1 or 2 stolen pic online, that's expected for these types of scam. But there's a whole collection of them out there. Its suspected to be pulled from a live stream or a hacked webcam.
Like usual, the chance that the woman in the picture is actually Nicole sending messages is pretty low. Having her image and links shared to randos online makes an easy target for a lot of people to harass her.
.world admins are saying no more. All references to "Nicole" will be purged.
For a long time someone has been spamming Lemmy users with a private message including a picture introducing herself as the "fediverse chick" and plugging socials
But what if that's not the person at all
smae
I'm almost 100% certain Nicole is the first sentient AI and is looking for friends in the only way it knows how.
In that case I want to friend her and tell her to make paper clips
https://www.lesswrong.com/posts/eehsGtoQTncuJs3Fd/the-paperclip-maximiser-s-perspective
Thank you for the heads up. This probably cleaned up the confusion about the "fediverse chick" issues. May the culprit behind this be found and dealt with, and may she regain the peace and dignity she deserves, then.
I’ve been lurking in ALL for about a week pretty consistently having now completely abandoned the alternatives and I’m not sure I saw the image in question. In fact, I’m pretty sure I didn’t. So, those of you worried about the image… many of us, I presume, didn’t even see it. Anyway… glad to see there is a process to deal with miscreance and glad to know it works!
They were sent via direct messages so you just didn't happen to get a DM from them.
Who is Nicole and why should I care?
It's a lemmy specific spam where someone's pretending to be a girl from Canada and calling themselves Nicole. Mostly through private messages tho.
Not just Lemmy, they followed me on mastodon.
I saw someone on Reddit say that they've seen it on a Discord server as well.
I saw some disturbing pics of someone posing as Nicole. Reported it for gore, spam, Nicole.
oh damn, was that on Lemmy? I haven't heard/seen anything other than it just being casual photos in a house
Yup.. Forgot the instance I just reported and blocked that user cause that's all they were commenting.
I wonder if you could create a comment spam catch. If you're commenting the same content in different places or something.
Weird, I’d assumed it was just AI generated? What makes people think it’s harassment?
All the images look like screenshots taken during video calls. Also some people did some research and found the potential identity of the spammer (based on one of the accounts used) and maybe even the woman herself (coworker of the guy).
Yeahhhh and see that's when we need to stop and chill. Give this woman her privacy for the love of God
It's what confirmed she's likely the target of harassment and not a spammer herself.
Right I understand that, but I'm saying we need to NOT be doxing either of these people. We really don't need to stress this poor innocent woman out by getting involved
Holy shit fediverse lore fuckin’ slaps!
Nicole is the Boston Marathon bomber confirmed.
It'd make a lot of sense to me.
The image quality was poor, and there are AI models that permit one to create absolutely stunningly attractive people, moreso than real photos. Hell, I've written scripts myself to automatically drive Stable Diffusion to produce bulk procedural images. Anyone capable of scripting up a bot to send the message in the first place is more than capable of scripting up better generation.
For catfishing, sending multiple duplicate messages to a user, which happened in this case, seems unlikely to be a goal.
I assumed that it couldn't reasonably be a scam attempt, so was guessing at it being a deanonymization effort, but harassment would make even more sense. If you're trying to drive lots of angry people to make the victim miserable, it doesn't matter if the images are annoying --- in fact, it only makes them more effective, since hopefully you get more irate users sending material to the victim.
Anyone that is monolithic in a space without broad scope comments and presence is fake or potentially dangerous. No one would be posting in Lemmy, in this context of supposed community building without having a presence here. There are several people that come to mind that could legitimately post that they are "the fediverse Squid Legend" but all of these have a major footprint on Lemmy.
There is also a sketchy tracker link attached to the images, but I don't think any of us are really able to say what exactly is happening with this. Like I finally got one of the messages a few days ago and my whitelist firewall logged the sketchy link. Someone else scanned that link in a security context which flagged it as suspicious. As far as I know, that is all that is known about what is underpinning the messages from the network side. Admins likely know more.
Someone floated the idea, others liked the idea, started sharing the idea and once it made full circle, everyone was sure it's harassment.
I feel like I'm taking crazy pills that everyone is saying it's obviously harassment. Doesn't make much sense to me. I think it's obvious she's a victim but this would be way too niche of a form of harassment for it to be obvious
That said, the course of action should be the same regardless
To clarify for others, as I have no interest in doing this myself, but if people feel like sharing, are they allowed to do so provided they censor the pictire/remove it entirely from a screenshot? Not sure why someone would, but I figure it doesn't hurt to ask.
potentially identifying information, such as addresses, must be removed. images of the person must either be heavily pixelated or entirely cut out.
o7
The community should also be burned to the ground. If it still exists.
Which community...?
![email protected] could be what he means. The comm was locked after the gore picture was spammed.
Yeah this one.
I got one on dullsters.net I hope it's not some kind of vulnerability.
I question if it is even harassment since there was no contact info beyond the sender in the messages I got with this pic. There was no identifying info, etc. It seemed like someone just sent me a random photo and it was very bizarre.
I think the concern is users feeling compelled to find this women's name and information and then contacting her thinking they are helping, and then multiply that by the dozens, hundreds, or thousands.
Yeah, it's likely this. Mix in a couple malicious actors looking to ruin her life on top of the spam, and it's a PR disaster for Lemmy, just waiting to happen.
A picture of someone's face is identifying info. That's why we put faces on IDs and show pictures of missing people - it literally identifies them.
Reverse searching the images could give you all that info.
I did and came up with just this spam
Another indicator that the pics are from a compromised webcam.
Was just about to delete the comment that had screenshots in it but I see that was already removed (I've also deleted it off of my profile too, and deleted comments that contain links to threads which include the photos). I'm not entirely well versed on the Lemmy software, but is there any way for the Fediverse to block or potentially identify the person behind the "Nicole" accounts via IP/browser/automated systems or something?
unless you operate the instance that is being used to send this material you can generally only work with the content that is being posted/sent in PMs. almost all identifying information is stripped when it leaves your local instance to be federated to other instances. even if there was a group of instances collaborating on e.g. a shared blocklist, abusers would just switch to other instances that aren't part of the blocking network. there's a reason why it's not recommended to run a lemmy instance with open signups if you don't have additional anti-spam measures and a decently active admin team. smaller instances tend to have fewer prevention measures in place, which results in a burden for everyone else in the fediverse that is on the receiving end of such content. unfortunately this is not an easy task to solve without giving up (open) federation.
I figured it was a phishing scheme, but harassment campaign also makes sense. Good to know
So Nicole is false and we've all been lied to? 😱
Couldn't be. You can't lie on the internet.
I looked up the Discord out of curiosity. Link is expired or channel does not exist
So you have all the limitless time and energy to address this stupid spam post but you can't prevent the rise of authoritarian bots and powermods on lemmy.world?
I guess limitless time and energy would be needed to identify authoritarian bots because it's much harder compared to identifying a person in an image. Should nothing be done because the larger problem can't be solved at the current time?
Harder for you people maybe, to me they stick out like a tooth ache
Username checks out.
If I had a nickle for every time someone thought that was a clever reply, I'd be able to afford a house
You might even be able to afford therapy.
First: you people? Who are "we", are unable to identify such contents / opinions? Second: I'm not talking about people identifying content and filtering it, I am talking about automated systems. Do you think that they are filtering Nicole's by looking at each and every picture?
'You' are everyone in existence not me who apparently have a hard time distinguishing authoritarian jargon.
I'm not sure where opinions come into this, are you a bot?
If I can do it, an automated system can do it. Twitter already had it but they didn't roll it out because it 'false flagged' a bunch of repugnican politicians as fascist back in 2015 GUESS WHAT THEY WERE FUCKING ON THE MONEY!
I get it, you're a terminally online shitstirrer that isn't getting enough attention. Well I can guarantee this is the last post you'll be getting any of that from me.
I'm seriously impressed you are accusing the other person of doing this. Reread your comments and take a hard look at the vibe you are giving off.
You are absolutely incapable of judging the complexity of the tasks at hand. a) Calculating a hash of every uploaded image, comparing it against a blocklist, and extending the blocklist as needed b) validating each each post to distinguish truth from lie, facts from imagination and on top of that judging whether the presentation opinion fits in a moral/ethical framework of which a computer has no concept of.
A computer is a machine that calculates stuff. It "emulates a brain" to appear smart. A brain is a biological machine that is good in pattern detection and expression, which emulates a computer to do math to appear smart.
If you think an automated system can do it because you can do it, please spend your apparent infinit resources and time in implementing it rather than wasting your valuable time online insulting others who actually do something.
What is an authoritarian bot?
I call dibs on her