btw, this made me laugh. I had to pull up the access log for his IP because it includes information police would need. These are the last few entries I see:
Code:
50.92.113.235 - - [09/Aug/2019:05:21:51 +0000] "GET /forums/jonathan-yaniv.99/ HTTP/1.1" 200 43922 "https://kiwifarms.net/threads/business-yaniv-trustednerd-jy-knows-it-former-employers.59322/page-2" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15"
50.92.113.235 - - [09/Aug/2019:05:22:01 +0000] "GET /threads/suspected-yaniv-visits-the-farms-8-9-19.59437/preview?_xfRequestUri=%2Fforums%2Fjonathan-yaniv.99%2F&_xfWithData=1&_xfToken=1565328111%2C0d2cc4ec24bddc6fcd1d1fe52ee3629e&_xfResponseType=json HTTP/1.1" 200 612 "https://kiwifarms.net/forums/jonathan-yaniv.99/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15"
50.92.113.235 - - [09/Aug/2019:05:22:03 +0000] "GET /threads/suspected-yaniv-visits-the-farms-8-9-19.59437/unread HTTP/1.1" 303 0 "https://kiwifarms.net/forums/jonathan-yaniv.99/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15"
50.92.113.235 - - [09/Aug/2019:05:22:04 +0000] "GET /threads/suspected-yaniv-visits-the-farms-8-9-19.59437/ HTTP/1.1" 200 35424 "https://kiwifarms.net/forums/jonathan-yaniv.99/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15"
50.92.113.235 - - [09/Aug/2019:05:22:22 +0000] "GET /threads/suspected-yaniv-visits-the-farms-8-9-19.59437/page-2 HTTP/1.1" 200 35947 "https://kiwifarms.net/threads/suspected-yaniv-visits-the-farms-8-9-19.59437/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15"
50.92.113.235 - - [09/Aug/2019:05:23:54 +0000] "GET /forums/jonathan-yaniv.99/ HTTP/1.1" 200 44017 "https://kiwifarms.net/threads/suspected-yaniv-visits-the-farms-8-9-19.59437/page-2" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15"
50.92.113.235 - - [09/Aug/2019:05:24:02 +0000] "GET /threads/jonathan-yaniv-jessica-yaniv-trustednerd-trustednerd-com-jy-knows-it-jy-british-columbia.49790/page-656 HTTP/1.1" 200 23032 "https://kiwifarms.net/forums/jonathan-yaniv.99/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15"
50.92.113.235 - - [09/Aug/2019:05:24:16 +0000] "GET /threads/jonathan-yaniv-jessica-yaniv-trustednerd-trustednerd-com-jy-knows-it-jy-british-columbia.49790/page-655 HTTP/1.1" 200 34561 "https://kiwifarms.net/threads/jonathan-yaniv-jessica-yaniv-trustednerd-trustednerd-com-jy-knows-it-jy-british-columbia.49790/page-656" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15"
50.92.113.235 - - [09/Aug/2019:05:24:39 +0000] "GET /forums/jonathan-yaniv.99/ HTTP/1.1" 200 43869 "https://kiwifarms.net/threads/jonathan-yaniv-jessica-yaniv-trustednerd-trustednerd-com-jy-knows-it-jy-british-columbia.49790/page-655" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15"
Line-by-line:
1. JY leaves the thread about his former employer where the small business owner disavowed him to the main index.
2. JY hovers over the link to this new thread his posts were moved to, which would yield a preview popup. The AJAX bubble that shows up is from /preview.
3. JY opens the thread 2 seconds later
4. ... and is redirected from /unread to the OP.
5. Navigates to the 2nd page 18 seconds later.
6. Returns to the board index.
7. Checks the page 656 (at the time, the newest page).
8. Goes back to page 655 and realizes all the stuff he's posted is now in this thread marked as having been made by him.
End of session. There's been no subsequent activity from that IP.