April 18, 2012

th3j35t3r/Tom Ryan: The final dox #TickTock #told #ya

To th3j35t3r/Tom Ryan: you are one and the same person. You have been well and truly doxed. If by some miracle I am wrong, by all means enlighten me. I’d love to hear you explain these coincidences away. Go on – do it faggot: either prove me wrong or GTFO.

On 11th April, I posted the following lengthy dox on Jester: http://pastebin.com/A5iiTAJS
It contains 20 separate connections between the pair. In the ensuing days, @TomRyanBlog fielded questions on Twitter from various parties who were pressing him about his dox as @ th3j35t3r. I was planning to post a follow-up dox, exposing the lameness of Tom’s rebuttals, but when I went to look back over Jester and TR’s timelines, I found something interesting: many of the tweets in response to my dox had been deleted. That’s right, Jester – who’s previously railed against @atopiary and @anonymouSabu for deleting tweets – had gone and done just that – and so had his real life persona, Tom Ryan.

Y U delete your shit bro?

In line 356 of my previous dox, I posted the following:

take a look at the timeline for Jester and Tom Ryan’s tweets. Notice how they often tweet at almost exactly the same time as one another? For example, take Tuesday 10th April. After two hours without activity from either account, Thomas posts the following at 15:30pm:
“Now I feel really special. Someone created a hidden stream about me and monitors it.”
One minute later, at 15:31, Jester tweets “@alemarahweb‏ – ‎http://www.alemara1.com‏ – TANGO DOWN - أنا كنت”
Observe any two Twitter accounts for long enough and you’ll find timing coincidences of course. However, compare Jester and Tom Ryan’s accounts on any given day and you’ll spot a predictable pattern: they always broadly correlate i.e. there is a short burst of tweets, followed by a 45 minute break while Jester/Ryan goes for a wank or to chow down some beef jerky.

---------------------------------------------------

Look through Jester’s timeline for 10th April now, however, and you’ll find that his tweet from 15:31 has been deleted. Scared that you’ve been spotted tweeting at the same time as Thomas, perhaps?

But wait, there’s more...

Check this Twitter conversation TR had on 13th April, beginning with a tweet from @kennethlipp:

“@TomRyanBlog but the hack that supposedly d0xxed him as you did not match the mobile API you tweet from. @RepDan_Gordon”

“@TomRyanBlog so I suspect the d0x is bunk. wish I'd never heard of a d0x. fuck, I was once an academic.”

“@kennethlipp yes I know. Anthropology correct?”

“@TomRyanBlog yeah. I do believe in this, so I don't mind. But I miss it sometimes. Living wages to read and chase muff.”

https://twitter.com/#!/kennethlipp/status/190660135755071488

Click on the above link and you’ll see @kennethlipp’s initial tweet. Click on the following tweet and you should see TR’s response to his dox:

https://twitter.com/#!/TomRyanBlog/status/190660603298328576

Only you won’t find it, because that tweet has been deleted. What about the following tweet, in which TR also discusses his dox:

https://twitter.com/#!/TomRyanBlog/status/190659775787302913

Strange, that appears to have been deleted as well. Someone trying to cover their tracks?

Tom’s few surviving tweets in which he discusses his dox are completely fatuous i.e he doesn’t debunk any of the damning similarities I raised, but instead tries to sidetrack the argument:

@TomRyanBlog it does state different phones used, and different time line's, even so... some points do hit home.

@maxmousedll I know of 20 other males and females that fit the same grouping too. It's called contextual analysis for counter intelligence !

https://twitter.com/#!/TomRyanBlog/status/190159933902290945

@TomRyanBlog yea... I gave that a read, and although much of it is bull (trailing periods... etc) some of it hits home.. sup jester ;)

@maxmousedll then you didn't do as the document told you. The analysis would show different phones used. Different timelines besides the few

@agentdarkapple @AsherahResearch@TheYearof2525 @bitchiest @revmagdalen@LauraWalkerKC why do they always rule out that@th3j35t3r = female?

https://twitter.com/#!/TomRyanBlog/status/190216971986542592

-----------------------------

I’m not even gonna waste my breath bothering to prove that th3j35t3r is male. However, I will address TR’s previous tweet, in which he suggests that our gruesome twosome have ‘different timelines’. (His earlier comment about ‘different phones used’ can be discounted – my first dox explained why Jester and TR use separate phones.)

If Jester and Tom Ryan *do* share different timelines, then could someone please explain this conundrum to me: there follows a list of the only days when Tom Ryan *hasn’t* tweeted since he opened his account three months ago. Alongside each ‘silent’ date, I’ve noted what Jester was up to at the same time:

Jan: 14, 15, 16–25: Tom Ryan only posts RTs. Jester is silent.

Feb 17-20: Tom Ryan is silent. So is Jester.

March 2-4: There are only RTs from both accounts. (Suggesting they’re too busy to post their own tweets).

March 5: Tom Ryan is silent. So is Jester.

March 18-22: Tom Ryan is silent. For two of these days – 19th & 20th – Jester is also silent.

March 24-25: Tom Ryan is silent. Jester is also silent on the 24th.

March 28 & 31: Tom Ryan is silent. Jester tweets once on each of those days.

So there you have it: 85% of the time when TR is off Twitter, so is Jester. Curious...

On 11th April when I dropped Tom Ryan’s dox, the following log was published, detailing a recent chat with Jester:

http://www.infosecisland.com/blogview/20975-Transcript-Patriot-Hacker-th3j35t3r-Addresses-USM-Students.html

Note this extract:

-----------------------------------

VVookie Or you could be Robin Sage....
th3j35t3r Robin Sgae was created by Tom Ryan, another fine operator.
------------------------------------

In my first dox, I made the following observation:

“Tom Ryan has form for assuming false identities – such as ‘Robin Sage’. See here for the full story:
http://www.darkreading.com/insider-threat/167801100/security/privacy/225702468/index.html
INTERESTING FACT: @RobinSage joined Twitter on 26th December 2009 – exactly one week after @th3j35t3r joined.”

-----------------------------

Notice Jester patting Tom Ryan on the back when asked whether he could be the same character as Robin Sage?

I’ve also discovered that on 17th June 2011, @RobinSage tweeted @ th3j35t3r – who retweeted it:

“@th3j35t3r looks like you hit the @LulzSec button. No word for 13 hours. The pastebin explains why their account was created May 6th.”
https://twitter.com/#!/robinsage/status/81704449172701185

So now we have a direct connection between Tom Ryan, Robin Sage and Jester. In my previous dox, I suggested that Jester chose the Twitter nick ‘Boondock Saint’ because of his Irish connections. Here’s a few tweets involving Tom Ryan that reiterate that Irish affinity:

@TomRyanBlog btw, we'll be in the City around the 1st. First round's on me, know a great Irish pub a few blocks from Zuccotti. cc @sabzbrach

Hope Everyone Has A Great Saint Patty's Day! Time to go celebrate, you know how to get me! Erin Go Bragh!

#Anonymous Happy Saint Patrick's Day! Here's a Gift since You wanted proof TOR was insecure, ;)@LibertyLynx


OK, one final point before I stop obsessing over the Jester and go do something useful with my life, like take a shit:

On 11th April, Jester tweeted the following:

“@th3raptor A few months back, a follower dedicated this to me >>http://www.youtube.com/watch?v=9ky3krLTLrY<< I dedicate it to u. Take 5 mins 33 seconds out.”

https://twitter.com/#!/th3j35t3r/status/190165643067273216

The video in question is called 21st Century Superheroes. A day later, Tom Ryan tweeted the following:

“What a week the internet has @th3raptorhttp://www.foxnews.com/us/2012/04/11/patriot-hacker-raptor-gains-flock-followers-after-foxnewscom-report/ and NYC has SnackManhttp://www.youtube.com/watch?v=Br9L7nyoAhAthe country is turning superhero!!!!”

https://twitter.com/#!/TomRyanBlog/status/190279149116592128

The video he links to depicts a real-life vigilante superhero.

For the 9,000th time, coincidence much?


------------------------------------------------------------

I’ve no wish to keep assailing a dead horse here, but please, for the love of God: Jester! Thomas! Robin! Can one of you please tell set the record straight here? Of course, you’re under no obligation to deny your dox – the uncanny links between your Twitter absences, your identical writing styles, your similar tweeting times and numerous other idiosyncrasies. Your silence on this matter, however, will prove to be your downfall.

You don’t have to say a word; you can let the public decide for themselves if you like. I’ve laid the evidence out. Now let’s leave it to the internet to decide:

Tom Ryan = Jester. Y/N?

----------------------------------------------------------

Original dox here: http://pastebin.com/A5iiTAJS

pwned by @spoolfiend

Hey Thomas – I got your dox. U jelly bro?


#TickTock ;)


PS: If you really mad, feel free to dox me back. I ain't in this for the glory, but IDGAF if my name ends up linked to this. I got nothing to hide. You? I'm not so sure...

http://pastebin.com/HaT42sig th3j35t3r/Tom Ryan: The final dox

http://legionnet.inc.nl.eu.org/2012/03/th3j35t3r-jester-dox-antisec-ohaaii_13.html

No comments:

Post a Comment

-