Observations from the Depths #1

This week, I want to share some of my observations from my research. I do not always have time for in-depth analysis of what I am observing, researching, or reporting to law enforcement. So, I decided to start a new format called Observations from The Depths, where I will share brief highlights, findings, and observations I am making as part of my daily research.

1) Com Network Group Purgatory is Responsible for the Active Shooter swats at University of Tennessee at Chattanooga and at Villanova University

“Swatting” is a term used to describe a criminal incident in which an individual contacts emergency services and falsely reports an emergency, often involving an act of violence that reportedly has or will occur at a particular location to elicit an armed law enforcement response to that location. 

“Doxxing” is a term used to describe the practice of — searching for and publishing on the Internet — personal, private, or identifying information about an individual with malicious intent, such as providing the information for the purpose of facilitating the swatting of the individual.

August 21, 2025 campus “active shooter” reports at the University of Tennessee at Chattanooga (UTC) and at Villanova University (VU) were hoaxes consistent with coordinated swatting campaigns. UTC received a 12:29 p.m. 911 call reporting an on-campus shooter; the campus locked down and then issued an all-clear at 1:55 p.m. after no threat was found. VU responded to a later 911 call and locked down, which the university later described as a “cruel hoax.” No victims were identified at either site.

While these swatting incidents were occurring the Com Group Purgatory (who specialize in swatting) were hosting a Discord Stage, where five of their members (with Gores leading the swatting calls) in front of an audience of 41 individuals, were streaming their successful attempts at swatting UV and UTC, but also their attempts at swatting individual victims of the Com Network.

The Com Group Behind the Swatting: Purgatory

Purgatory is a swatting and doxxing group that formed on Telegram and Discord, using shared scripts and VOIP tools to mask identities and make coordinated false emergency calls to provoke armed police responses. I previously wrote about the group when three members were arrested in 2024. A federal superseding indictment unsealed on 9 May 2024 detailed attacks in 2023–2024 against a trailer park in Alabama, a Delaware high school, Albany International Airport, an Ohio casino, and a private residence in Georgia. In 2025, members Owen Jarboe (Hagerstown, MD), Brayden Grace (Columbus, OH), and Evan Strauss (Moneta, VA) pleaded guilty to conspiracy, cyberstalking, interstate threats, and threatening to damage property with fire or explosives.

Impact of the SWATs

Campus disruptions yesterday forced a multi-agency deployment, city facility lockdowns, and canceled instruction. Panic spread as students, teachers, and staff locked themselves in closets or barricaded classrooms. The prevalence of school shootings in the United States makes these swatting calls especially traumatic for those on site. Swatting also aims to provoke large-scale tactical responses and drain public safety resources.

Each successful swatting incident carries the risk of secondary harms. The Villanova lockdown shows how true-crime amplification compounds the damage. TikTok influencers circulated a CCTV still and speculated about a “suspect” in what was in fact a hoax. This misidentification created additional harms, including defamation, doxxing, and targeted harassment of an uninvolved person, as well as acute safety risks if audiences engage in vigilantism or police act on false tips.

These dynamics also impose psychosocial costs on the wider campus community by heightening fear, normalizing rumor as evidence, and displacing official risk communication. Tertiary harms emerge as the content economy rewards rapid, sensational posts with reach and monetization, incentivizing copycat coverage and degrading the information environment for future incidents. Institutions face eroded trust, rising call volumes driven by misinformation, and response fatigue that slows decision making in genuine crises. Individuals who are wrongly accused may suffer lasting reputational damage through persistent search results, employment or admissions bias, and long-term mental health effects. Platforms and newsrooms inherit legal and ethical exposure as speculation spreads faster than corrections. In this way, swatting functions as an attack on social infrastructure, converting an unfounded report into cascading harms mediated by networked attention, algorithmic amplification, and weakened verification norms.

Service for Hire

As new school semesters begin, I would not be surprised by an increase in swatting attempts at universities and high schools. Purgatory acts as a service-for-hire in the Com Network, where you can pay $20 to have them swat an academic institution, as they did on August 21.

Yet it doesn't stop there. They also offer offline criminal services such as bricking and slashing. It is very possible that these offline services are carried out through Murderous Vile Kult, which is run by Gores (the user behind the August 21, 2025 swattings). MVK is a Com group that focuses on extortion and real-world criminality.

Services-for-hire and criminal shops are not unique in the Com Network. When I examined the hierarchy of 764, I found that the group used prospective recruits and members to fulfill IRL service requests. Based on MVK Inferno chats, it is likely that MVK is using a similar strategy to carry out Purgatory’s IRL requests, given the overlap between MVK and Purgatory leadership.

2) Fake Prevention Website Created by Com Group Targeting at Risk Youths Seeking Help

This next observation is not what I would call “successful”; however, the attempt itself is concerning, particularly for those working in countering radicalization to violence. On July 27, a Com Network Telegram channel called Intrusion was created. The channel shared a link to a website that, at first glance, appeared to be a landing page for an organization offering psychosocial resources to those struggling with mental health issues, bullying, extortion, or self-harm. In reality, the website was a scam designed to target vulnerable individuals from the Com Network who had worked up the courage to finally seek help.

Embedded in the website’s source code is the API token for a Telegram bot linked to the form prospective “clients” are asked to complete. If someone were to fill out the form, the Telegram bot would post the submission to the channel, providing all the information needed to begin a harassment campaign.

I do not characterize the operation as successful because there is no evidence of user uptake or direct victimization attributable to the spoofed site. The attempt, however, is significant as an attack on trust in prevention infrastructure. Frontline clinical services for individuals in crisis or at risk of mobilizing to violence rely on institutional legitimacy, credible signaling, and a stable therapeutic alliance. Adversarial mimicry of care pathways seeks to “poison the well” by inserting doubt about the authenticity of hotlines, referral portals, and outreach staff. Even without demonstrated use, such efforts can raise help-seeking thresholds, suppress bystander referrals, shift disclosure from formal to informal channels, and erode the confidence of high-risk clients who already face stigma, fear of surveillance, and low treatment motivation.

3) New Grooming and Extortion guide from 1414

On August 18, 2025, a Com Network group published a seven-page extortion and grooming guide on Telegram. The text describes “1414” as a small Com-adjacent group founded in mid-to-late 2024 by Chax, Saw, and Grume, later joined by a fourth member, Stalk. Its ideology is openly predatory and misogynistic, framing girls as targets to be controlled, coerced, and humiliated, while treating fear, self-harm, and public disorder as tools to gain clout. The group’s TTPs focus on grooming to gain leverage, followed by extortion through doxxing, threats to leak sexual material, and threats of swatting, combined with demands for self-harm and other acts. The document functions as a rudimentary instructional manual that codifies recruitment, control, and coercion practices, while also presenting a rank system to organize activity and signal authority.

Compared to other Com guides on sextortion and extortion, the 1414 document is less about the novelty or practicality of its instructions and more about propaganda and status, as the group attempts to establish its place in the Com Network.

4) Attempted Stabbing by Minor in Morocco Failed on Livestream.

On August 20, 2025, a 15-year-old boy posted on his X account, Watch People Die, and 8Kun.top a link to his manifesto (hosted on Mega) along with a Discord invite to a server where he livestreamed what appears to have been a failed stabbing attempt in Morocco. Most of the 14-minute stream consists of grainy footage showing his black Crocs and brown camo pants as he walks. At one point, he stops to greet and shake hands with someone he seems to know. The stream ends abruptly, and it is unclear what occurred. There have been no reports of an attempted stabbing, injuries, or deaths around that date, but the minor has not posted online since.

In his manifesto, the minor claims his beliefs are “satanistic esoteric Spawnism.” My colleagues and I have recently covered the origins, impact, and threat posed by Spawnism; however, it is unclear whether this individual was part of that network or simply trolling. He also professes allegiance to several fringe and violent extremist groups, including 764, No Lives Matter, Maniacs Murder Cult, ISIS, and the Order of Nine Angles’ Temple of Blood. The minor even claims association with “Ranjit Singh and his murder cult Sikh Nationalist Front,” stating, “I plead allegiance to the Khalistani State.” Later in the manifesto, he issues a call to action directed at Sikhs: “Sikhs, murder your local anti-Sikh; reclaim Khalistan from Canada.” These are likely a SAVF in-group reference to a mosque threat incident which occurred in Mumbai in September, 2024. He further recommends reading Liber 333, NAOS, and the Rape Anthology—texts linked to the Order of Nine Angles. The document reflects the type of shitposting and trolling that can only be understood within the context of the terminally online edge-sphere.

The minor does appears to be part of the wider Soyjak Attacker Fandom Network, which includes  Arda Küçükyetim, Natalie Rupnow, Solomon Henderson, Jordan Patten, Damien Blade Allen and others. The minors X account was regularly interacting with and connecting with the SAVF network. In his manifesto, the minor also makes several nods to Rupnow and Henderson, highlighting a possible contagion effect.

In his manifesto, he shows a picture of his attempt at making a slam-bang shotgun, along with the gear he planned to wear: a camo jacket, skull mask, body armor, gloves, and eye protection. Unlike other shooters he sought to emulate, he provides no explanation for these choices; instead, they are presented almost by rote. This reflects the fandom he and others participate in, where the contagion effect is both culturally embedded and ritualistic.

The minor was also active on the shock site WatchPeopleDie (WPD), where he maintained three profiles. WPD began as the Reddit community r/WatchPeopleDie, which was banned in 2019 after users shared links to the Christchurch mosque attack livestream. The current website operates as a centralized repository for videos of real deaths and severe injuries. Its homepage sums up the pitch: “People die and this is the place to see it. You only have one life, don’t make the mistakes seen here.”

On his WPD profile, the minor identified with both the Order of Nine Angles and inceldom. His Discord profile picture during the livestream was of “Saint” Elliot Rodger, who carried out the 2014 Isla Vista attack that killed six people.

5) The Banality of Nihilistic Violent Extremism

One of the ways that victimization, acts of criminality, and even murder are determined in Com are Polls. Polls are used in Com as a ritualized decision tool for violence. Participants use quick, anonymous votes to authorize targets, timing, or notoriety, then treat the poll result as a social mandate to proceed. Polls convert planning into an interactive event, create pre-incident hype, and archive a screenshotable “license” for later boasting. The mechanism gamifies cruelty, diffuses responsibility across many voters, and supplies engagement metrics that reward escalation. Even when manipulated, the performance of collective choice shapes perception, normalizes aggression, and lowers inhibition for follow-on acts.

The polls make violence into communal performance, where personal intention is transformed into a public script. The audience is recruited as co-conspirators, and manufacture a veneer of collective authorization for the violence. The vote totals supply social proof. Polls also work as commitment devices that escalate users toward action, shift blame across many hands, and generate metrics that reward the most transgressive outcome. Polls convert an individual decision into a communal one. The vote total functions as “community will,” which diffuses agency across many hands and gives organizers deniability. Participants can claim they only followed what “we” chose, while spectators become complicit through a low-cost click that lowers inhibition for action.