Access logsAll visits to the tracking page and visits from Ephialtes' IP, in order. I won't take too much time to explain how I know the IP, but it's from Blockland connection logs, and an
earlier incident in February 2011. You can do a search on the IP.
(image is loading upon opening inbox)
kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:14:02:38 +0000] (me testing)
kalphiter.com:80 107.22.98.172 - - [03/Jun/2012:14:02:55 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 139 "-" "bitlybot" (bit.ly testing)
kalphiter.com:80 50.16.6.49 - - [03/Jun/2012:14:05:27 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 184 "-" "bitlybot" (bit.ly testing)
kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:14:05:46 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 196 "http://forum.blockland.us/index.php?action=pm;sa=send2" (me testing before sending message)
kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:14:05:46 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 195 "http://forum.blockland.us/index.php?action=pm;sa=send2" (me testing before sending message)
kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:14:06:00 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 195 "http://forum.blockland.us/index.php?action=pm;sa=send2" (me testing before sending message)
kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:14:06:00 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 195 "http://forum.blockland.us/index.php?action=pm;sa=send2" (me testing before sending message)
kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:14:13:35 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 196 "http://forum.blockland.us/index.php?action=pm;f=outbox" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0" (me testing before sending message)
kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:15:25:05 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 196 "http://forum.blockland.us/index.php?action=pm;f=outbox" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0" (me testing before sending message)
kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:15:42:41 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 195 "http://forum.blockland.us/index.php?action=pm;f=outbox" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0" (me testing before sending message)
kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:16:20:51 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 196 "http://bitly.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0" (me testing before sending message)
kalphiter.com:80 188.222.122.214 - - [03/Jun/2012:16:23:19 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 241 "http://forum.blockland.us/index.php?action=pm" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.168 Safari/535.19" (Ephialtes' IP, loading an inbox)
kalphiter.com:80 188.222.122.214 - - [03/Jun/2012:16:23:19 +0000] "GET /images/75024MaQpsfFq.gif HTTP/1.1" 200 1823921 "http://forum.blockland.us/index.php?action=pm" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.168 Safari/535.19" (Ephialtes' IP, loading an image in MY SIGNATURE)
kalphiter.com:80 188.222.122.214 - - [03/Jun/2012:16:25:22 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 241 "http://forum.blockland.us/index.php?action=pm" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.168 Safari/535.19" (Ephialtes' IP, loading an inbox)
kalphiter.com:80 188.222.122.214 - - [03/Jun/2012:16:25:26 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 240 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.168 Safari/535.19" (Ephialtes' IP, most likely visiting the link directly, then realizing what had just happened)
According to Ephialtes,
the image was sent to my inbox, hence my IP being the one viewing it.
Explanation of logsHm, I wonder why an
image in my signature is loaded at the same exact second (16:23:19) as the
tracking image. You claim Goldeen forwarded it to you (this is most likely true, but screenshotted it in order to fool people), yet somehow my signature was attached to the message. I know, you must have had
access to Goldeen's inbox! I should tell Goldeen to change his password!
This is the image in my signature
It redirects from
http://alturl.com/nis7d to
http://kalphiter.com/images/75024MaQpsfFq.gif, and you can view it in my signature. It's the only image in my signature that I host myself. It's also a complete coincidence that the signature image supported my cause.
Timeline (all in EST)(FT) marks forum time, which is 6 minutes behind the actual time
09:00:29 (FT) I send the PM to Goldeen
11:23:19 Ephialtes' IP visits the inbox
11:19:29 (FT) I post the discovery that Goldeen is Ephialtes
11:23:04 (FT) Goldeen quotes image from message and sends it to Ephialtes (in normal circumstances, who the hell does this?)
11:24:47 (FT) Goldeen responds
11:55:58 (FT) Ephialtes posts screenshot of message from Goldeen (the time message was sent is based on image the Ephialtes posted)
If you take out the event where Ephialtes' IP visits the inbox (my logs), I still have a very strong case considering how fishy the whole situation is.
Ephialtes, your tricks are mediocre.
Poll