the home of online investigations

You can support the work of Bellingcat by donating through the following link:

Massive White Supremacist Message Board Leak: How to Access and Interpret the Data

November 6, 2019

By Bellingcat Investigation Team

Update: The Internet Archive has removed the SQL leak; however, the information is freely available via a torrent file (download here) or a Magnet link (click here, or copy/paste the link into a torrent client).

Today, the entire SQL database from Iron March, a now-defunct neo-Nazi / white supremacist message board, was posted onto the Internet Archive by the user “antifa-data“. You can access this data dump on the Internet Archive, and via a torrent file found here, or through this Magnet link.

This leak contained the entirety of the site’s information, including user names, registered emails, IP addresses of users, all of the forum’s public posts, and even the private messages between members. This message board was linked with the violent neo-Nazi group Atomwaffen Division, and has been widely studied by anti-extremist groups and researchers, such as the Southern Poverty Law Center (SPLC). The SPLC has also scraped all of the public posts from the site — well over 150,000 of them — and has been researching them over the last two years.

How to access the files

There are two ways to read and access the leak. The first is through the SQL database within the torrent, which can be accessed through an SQL database viewer (for example, MySQL Workbench or DB Browser for SQLite). However, this is quite arduous for the average user.

It is much easier to read through the exported spreadsheets that are included within the torrent file. The most important spreadsheets for analysis, and the most important columns within them, are:

core_members (All users)

  • Column A indicates the member ID, which is reflected across other spreadsheets as well.
  • Column B indicates the username within the site.
  • Column D indicates the registration email used by the user.
  • Column E indicates the time that the user signed up, converted into Unix time. You can convert the timestamp into normal time here; for example, the first user sign-up was at 1315842419, or 12 September 2011 at 3:46pm (UTC).
  • Column F indicates the IP address at registration; however, this could be spoofed if the user deployed a VPN or proxy connection.
  • Columns M-O indicate the date of birth provided by the user.

core_message_posts (All private messages)

  • Column A indicates the unique message ID — every single message sent on the forum has its own ID.
  • Column B indicates the message topic (thread) — each conversation between users has its own thread, and will not always be sequential to message ID, depending on how fast the users were writing back to one another.
  • Column C indicates the time of the message, converted into Unix time. You can convert the timestamp into normal time here.
  • Column D indicates the message content. Note that there is sometimes a blank space before the message begins, making it (falsely) appear blank in a preview on Excel.
  • Column F indicates the member ID, which can be cross-referenced with Column A in core_members.
  • Column G indicates the IP address used by the user who sent the message. This can be cross-referenced with Column F in core_members.

Cross-referencing private messages (core_message_posts) and the users sending them (core_members) is quite easy, in just cross-referencing usernames and member ID numbers. Click this image, created by Jake Godin, to see how to easily cross-reference these data sets.

core_message_topics (Titles of all private messages)

  • Column A indicates the topic (thread) ID number, which can be cross-referenced with Column B in core_message_posts.
  • Column B indicates the time that the message was sent, in Unix time. You can convert the timestamp into normal time here.
  • Column C indicates the title of the private message thread.
  • Column E indicates the member ID of the person who first sent the message, which can be cross-referenced with Column A in core_members.
  • Column I indicates the member ID of the recipient of the thread, which can be cross-referenced with Column A in core_members.

core_search_index (All forum posts)

  • Column F indicates the post content.
  • Column H indicates the member ID of the poster, which can be cross-referenced with Column A in core_members.
  • Column J indicates the post time, converted into Unix time. You can convert the timestamp into normal time here.

Potential research leads

In a cursory survey of the data, there are a number of investigative paths for identifying active users of this forum for violent white supremacists. In particular, there are a number of users who identified themselves as active serving members of the military in Western countries, especially the United States.

We have started to compile potential leads for these users, which can be accessed here. We encourage journalists and investigators to follow up on some of these, and other, leads that can be found in these data sets. Additionally, users can suggestion additions or revisions to the existing data set.

Bellingcat Investigation Team

The Bellingcat Investigation Team is an award winning group of volunteers and full time investigators who make up the core of the Bellingcat's investigative efforts.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

33 Comments

  1. Jules Rentaghost

    Here are the messages joined to member details and formatted as HTML for ease of reference:

    Topics 1-499 https://98dd3b42-de90-4268-bae9-ab3a3560c3f3.htmlpasta.com/
    Topics 500-999 https://b3d77586-fd8a-4ab3-bc38-c659201d202c.htmlpasta.com/
    Topics 1000-1499 https://76ed445d-d22f-4db3-99e3-793371597c6f.htmlpasta.com/
    Topics 1500-1999 https://fc26ded7-03d2-4bc7-b7c0-076f882f5df6.htmlpasta.com/
    Topics 2000-2499 https://d3bea88c-6e8c-44b6-8153-20408d7d8ef4.htmlpasta.com/
    Topics 2500-2999 https://1d737b3b-98ce-426f-ae9a-5b878ec2c9a8.htmlpasta.com/
    Topics 3000-3499 https://1eb9bde0-5622-4a4d-829c-0b753de7e26c.htmlpasta.com/
    Topics 3500-3999 https://f08b329f-6d99-424d-a165-beb2cb8d5883.htmlpasta.com/
    Topics 4000-4499 https://f9b19767-68cf-4279-8186-23eb1b375b30.htmlpasta.com/
    Topics 4500-4999 https://f850710f-f938-4ded-8d50-4a4eb45bfc26.htmlpasta.com/
    Topics 5000-5499 https://0da53b0d-edd7-4f0e-a6aa-f24150edceb2.htmlpasta.com/
    Topics 5500-5499 https://c2068758-2844-4dc6-b558-77932ac89c87.htmlpasta.com/

    Reply
      • G

        Oh great find! What a fucking tool. Interested to know if Hairy Tarantula will find out and what they will do if they did.

        Reply
      • Jules Rentaghost

        There is exactly one forum post by member with email amunra666@gmail.com in the database. I’ve copied the text below. It should caution against making assumptions about members of the forum without first investigating the nature of their involvement!

        ———————————-

        >> “I’ve had an abortion and I’m not a woman.”

        >> I feel that this video describes most modern folks well.

        I would like to address this very clearly. I am the father of fetus that was aborted. Perhaps you fascist fuckheads aren’t aware of the concept of gender dysphoria. or what it even remotely means for a person to give up something they wanted because of life circumstances.

        I use to be one of you, but then something happened in my life that made me realize that these ideologies and the indoctrinations are fucking disgusting, and pathetic. the Aryan movement will never ever fucking happen. get over it.

        Get over the fact that some people don’t identify as a certain sex/gender. you do not police the world, and you certainly do not police the decisions of AFAB who chooses not to identify as the gender.

        and How fucking dare you otrizies the choice of people who have fought for your freedoms to exist you pathetic fucking assholes.

        you want know what a real race traitor is? you are you disgust the race of humanity. you mother fuckers, fuck you and your childish behaviours. you should grow up and enter the real fucking world. but no would you rather be closeted fucking douchbags who feel you can police your hatred towards honest hard working people.

        even the Furher knew that. he allowed abortions, he allowed many different things. but i suppose if any of you even fucking read anything other than your own hate propaganda you would fucking know that. you fucking facist fuck losers

        fuck you!

        Reply
        • Jules Rentaghost

          I suggest that the bellingcat moderators delete the part of the thread concerning this member

          Reply
    • Fif

      Thanks. What I don’t understand yet: Are these topics the title of a single message? Why are there sometimes 3 messages for a topic, and then a few posts later the same topic comes again.

      Reply
      • Jules Rentaghost

        These are private message threads between members of the forum. Sometimes they have the same topic.

        The public forum posts are not given in the links above, and the database table containing them is actually not one of the csv files with the torrent. The table in the database with public forum posts is called forums_posts. It can be exported as csv from the database which is hosted here: https://colgate.ankin.info/dbstuffs/index.php (username: iron, password: march)

        Reply
  2. Geaux

    Would be helpful to, if possible, regionalize the IP addresses to approximate city/state for those wondering if their neighbor is a Nazi without having to scroll and search

    Reply
    • Antifash

      Did this last night. Check out gitlab link below. Has an additional locations.sql table that pulled this info for each core_members record with a geolocation IP lookup service.

      Reply
  3. Ethan

    Data management programmer here. I’ll be digging through this tomorrow and will update with whatever I find.

    Reply
    • Washcloth

      It looks like the location data was published from the “ip_address” field on the table “core_members”. However, there’s a table called “core_members_known_ip_addresses” that captures all ip addresses for each member.

      I did some preliminary analysis on these and found that many members had multiple ip addresses, as expected. Some could be explained by VPNs, Tor, etc. But some only had one IP, some only had 2, and some that had multiple IPs had a lot of IPs in the same place.

      I tried doing some geolocating, according to your github code, but had some issues implementing it. Any chance you could run the others past your geolocator and publishing the results for further analysis?

      Here’s the query I ran to list all the IPs on the larger IP table:

      SELECT distinct
      name
      ,member_id
      ,email
      ,timezone
      ,ip_address
      FROM(
      SELECT distinct
      mem.name
      ,mem.member_id
      ,mem.email
      ,mem.timezone
      ,mem.ip_address
      FROM ironmarch.core_members mem
      union
      SELECT distinct
      mem.name
      ,mem.member_id
      ,mem.email
      ,mem.timezone
      ,mip.ip_address
      FROM ironmarch.core_members mem
      join ironmarch.core_members_known_ip_addresses mip
      on mem.member_id = mip.member_id) AS ListOnazis
      ORDER BY name
      ,ip_address

      Reply
      • Antifash

        Thanks for this. Looks like github just pulled my page too so will probly revisit tonight. The geolocation will require a key from iostack and then you’ll need to modify / manually run the location.rb code from the gitlab link I posted.

        Tricky bit will be deciding which IP to use to show on map, but the json data can be readily updated to include the list of IPs (that would be easy).

        Any chance you or anyone else would have a place you’re willing to host it? It’s as simple as a single html file. Github just booted it and dunno if I wanna deal with hosting on my main server

        Reply
  4. J Rentaghost

    Here’s a python script (using the pandas library) which takes the CSV files of the iron march database and spits out a rough-and-ready static HTML representation of the whole forum, including public posts, private messages, and member info, organized by forum/topic and by member.

    https://pastebin.com/dUcN1ZTF

    There’s no search function (although you could easily use OS or text editor built-in search on the directory) but it makes it easy to look at any given member’s activity in context and get an idea of what the forum looked like as a whole.

    As explained in the comments at the top of the script, you will need to obtain some CSV files that weren’t exported in the torrent that is going round. These could be obtained from the SQL file in the torrent, but an easier way is to use the DB at https://colgate.ankin.info/dbstuffs/index.php as explained in the script.

    Reply

Leave a Reply

  • (will not be published)

You can support the work of Bellingcat by donating through the following link:

TRUST IN JOURNALISM - IMPRESS