|Criminal activities||Telephone harassment and hoaxing, via social engineering; DDoS attacks|
Pranknet, also known as Prank University or Prank U, is a Canadian-based anonymous prank calling virtual community responsible for damage to hotels and fast food restaurants of more than $60,000 as well as multiple instances of telephone harassment. It was founded by a man who later referred to himself as "Dex" (alleged to be a Canadian man named Tariq Malik). The group has been linked to nearly 60 separate incidents.
Posing as authority figures, such as fire alarm company representatives and hotel front-desk/corporate managers, Pranknet participants called unsuspecting employees and customers in the United States and tricked them into damaging property, setting off fire sprinklers, breaking out windows, and other humiliating acts such as disrobing and consumption of human urine. Pranknet members can listen in real-time and discuss the progress together in a private chat room.
In 2009, a wave of the pranks across the United States prompted internal alerts by Choice Hotels, as well as advisories by the Orange County, Florida Sheriff's office, and others. At that time, law enforcement officials from a number of jurisdictions and the Federal Bureau of Investigation began investigating the various incidents as well as the identity of "Dex".
Pranknet participants initially used Skype to make their calls. As of 2009[update], Skype provided an uncontrolled registration system for users without proof of identity, making it difficult to trace and identify users. After Skype began an internal investigation, Pranknet left Skype and briefly used Paltalk for its chats. However, Paltalk banned Pranknet after a February 2009 KFC incident. After Pranknet users were banned from Paltalk, the company was subjected to multiple DDoS attacks. Beginning in 2009, members chatted before, during, and after each prank via Beyluxe Messenger, which is owned and operated outside North America. Audiences range from 40 to 200 people at any given time.
Notable Pranknet incidents
In February 2009, "Dex" called a KFC restaurant in Manchester, New Hampshire. Posing as a manager from the corporate office, he persuaded employees to douse the building with fire suppression chemicals and to then proceed outside, remove all of their clothing and urinate on each other. He claimed the chemicals were caustic and this would render them inert. When "Dex" posted the audio to YouTube he described it as "Epic KFC Prank Call (greatest ever)...dex successfully convinces the 3 female employees to undress fully nude outside and urinate on each other." Many months later "Dex", posing this time as an insurance adjuster called the same KFC and had the victims describe their experiences while Pranknet members listened.
On February 10, "Dex" and a member called "DTA_Mike", posing as hotel front desk employees, called two separate guests at the Best Western in Shillington, Pennsylvania. Using the pretense of a ruptured gas line, the caller persuaded each guest to break a window and then throw the television out. "Dex" and his friend repeated the same stunt on February 19 with a Best Western in Santee, California.
On April 30, a Pranknet member named "Rollin in the A" called Prejean's Restaurant in Lafayette, Louisiana posing as an official from the health department. This target was selected because the restaurant provided live video streaming of its dining area on their own website. The victim at this restaurant was told that Prejean’s pork was tainted with the swine flu. "Rollin in the A" also told the manager to close the restaurant immediately and tell the customers (75 of them) that they may have eaten tainted food.
On May 27, "Dex" called a Hampton Inn in York, Nebraska and tricked an employee into setting off the fire alarm. As guests made their way to the lobby, a second call was placed to the front desk. "Dex" claimed that, to avoid alleged fines, the fire department should not be called. Instead, the caller gave various bogus instructions to turn the alarm off, including going to a website that only displayed pornography. The next suggestion from the caller was to break the front windows of the hotel. A truck driver staying at the hotel volunteered, and under direction from "Dex", the man drove his semi-trailer truck into the front door. Later that night, "Dex" tweeted: "I just pulled off the most epic prank. I had a hotel guest back his truck into the hotel front window (in the lobby), and break the window." The post was deleted in late July.
In June, a prank was made on a Holiday Inn Express in Conway, Arkansas. The caller posed as a representative from the company that installed the hotel’s fire sprinkler and claimed the system needed to be reset by pulling the fire alarm. Once the alarm was turned on, the clerk was told that the sprinklers would activate unless windows were broken.
In July, a Pranknet member called a Hilton in Orlando, Florida and, purporting there to be a gas leak, convinced a family staying there to break windows with the lid for the toilet tank and throw their mattress out the window. The incident cost $5,000 in damages.
Also in July, a Pranknet caller informed two hotel guests that deadly spiders were about to infest their room. The caller was able to manipulate the couple into breaking their window with the tank lid from their toilet.
On July 5, Pranknet members Powell and Markle called an Arby’s in Baytown (where Powell lives) and talked a worker there into triggering the fire suppression system, causing an estimated $4,600 in damages. Powell failed in his attempts to get any windows broken. Powell was later arrested and charged with criminal mischief for the incident.
On July 20, Markle tricked a desk clerk at the Homewood Suites in Lexington, Kentucky into drinking another person’s urine. The prank started with a call to a guest. The guest was told it was the front desk calling and that a prior guest had tested positive for Hepatitis C. The guest was then told there was a doctor on site and a simple urine test could determine if the guest was infected. The urine was to be brought to the front desk in a simple drinking glass. Markle then called the front desk alleging to be an employee of Martinelli's Cider. He told the clerk that a representative from the company would like to come downstairs with a sample of their new drink. The guest from the previous call then arrived and handed the clerk his urine. Markle then coaxed the woman to try it. He asked how it tasted. "Horrible," she said. "That does not taste like cider. I'm not going to take another sip, that's horrible." Markle replied: "Well, I need to inform you of something, ma'am. I want you to understand that you just drank that man's urine." In its investigation, the Lufkin Police Department's cyber crimes division has requested a subpoena for Markle's Skype activities. The police report classifies the Lexington incident as first-degree wanton endangerment, a Class D felony in Kentucky.
Additionally, an employee at a Holiday Inn Express was persuaded by a Pranknet caller to set off a fire alarm, break windows, and set off sprinklers which flooded the building. Damages were estimated at $50,000.
In November 2010, an elderly man staying at a Motel 6 in Spartanburg, South Carolina was tricked by Pranknet members into destroying his television set and smashing mirrors in his room with a wrench. The man, told that there was a "midget" trapped in an adjoining room, was then tricked into destroying a sheetrock wall behind his room door, almost making his way through to the next room. According to TSG, "Motel 6 is a preferred target because Pranknet members can call directly into rooms without having to know a guest's name" As of November 1, 2011, this is no longer possible. After police arrived to answer a 911 call placed by the motel manager, they declined to press charges against the victim but noted that other similar phone calls had been received at the motel.
Phone and computer hijacking
Beginning in July 2009, "Dex" began hijacking phone numbers of U.S. businesses and had them forwarded to his Skype account. Claiming to be an authority from a particular business, he calls a phone company and claims they have no dial tone. He then requests that all calls be forwarded to the number he provides.
On July 7, "Dex" took over incoming calls of the Olympic Game Farm in Port Angeles, Washington making obscene sexual comments to customers who called. On July 11, he repeated the stunt with the Fun 4 All amusement park in Chula Vista, California. On July 13 he took over incoming calls to a Best Western in Jacksonville, Florida for over 12 hours. In one interaction, a woman called to find out if her husband had arrived and was told first that he had been in an accident, and then that he was having sex with a man in his room and did not wish to be disturbed. On July 15, "Dex" controlled incoming calls to a Hilton Garden Inn in Tulsa, Oklahoma. He told people inquiring about a shuttle to take a cab and they’d be reimbursed. He told some callers the hotel had a swine flu outbreak and told other callers the hotel was in the midst of a hostage situation.
Pranknet members frequently place Craigslist ads offering free tickets or items. Inquirers are bombarded with obscene sexual rants and racial epithets. A 12-year old girl called about a free trampoline, and "Dex" told her not to get pregnant by a black man because "they have AIDS". Markle frequently calls women who are selling household items on the site. After getting the victim’s home address, he then tells her he is on his way over to rape her and kill her children.
Elizabeth Moreau incident
On October 25, 2010, TSG reported that Pranknet leader "Dex" was responsible for an October 21 hoax in which he phoned ESPN reporter Elizabeth Moreau, tricking her into breaking windows in her room at the Hilton Garden Inn in Gainesville, Florida. He then initiated a conference call with a front desk employee at the hotel, where he then claimed he was Moreau's boyfriend and that the damage was a result of them fighting, as well as making a number of vulgar statements. As a result of the hoax, a Gainesville Police detective was assigned to the case.
Smoking Gun investigation
"Dex" and other Pranknet members had regularly taunted victims and others, saying they were untraceable. In an interview with The Smoking Gun on June 17, 2009, "Dex" exhibited no worries about being tracked down or caught. In a July co-interview with Markle, he boasted: "It's too difficult to find me. I'm a ghost on the Internet. I do pretty much everything I can to keep anything out of my computer that would lead it back to my actual computer. I'm not a stupid individual, like I said."
In June 2009, The Smoking Gun launched an investigation that lasted nearly two months and included travel to Windsor, Ontario and a stakeout outside Malik’s mother’s home. Smoking Gun editor William Bastone emailed "Dex", and during a Skype interview provided URLs on the Smoking Gun website. The URLs were unique; when Malik viewed them, it revealed his IP address and location. The names, biographies and locations of Pranknet’s founder "Dex" and a number of prolific members, and their other findings, were published on their website and provided to the FBI in August 2009.
According to crime reporting website The Smoking Gun, key members included:
- Tariq Malik, also known as PrankNet leader "Dex" (a tribute to the character Dexter Morgan, a fictional serial killer). In an interview with The Globe and Mail, "Dex" denied he was Malik (but confirmed he is Canadian).
- William Marquis, Pranknet’s "second in command". Known as Hempster, Marquis was previously convicted in 2004 for drunk driving and in 2005 for marijuana production. CBC News attempted to interview Marquis regarding the Pranknet allegations. However, he did not answer his door.
- James Markle, one of the group's most prolific callers. Markle was already a person of interest in a Lufkin Police investigation involving a phone call to a local McDonald's, and was arrested for this subsequently. The Smoking Gun had based the claim upon information from old MySpace and Facebook pages, and people from the area who identified Markle in photos. The Smoking Gun also published official documents showing that Markle pled guilty to aggravated sexual assault of a child in 2005, serving two years in a juvenile detention facility for raping a 5-year-old girl and then threatening to kill her if she told anyone about the incident. In an interview with The Lufkin Daily News, Markle denied that the person described on TSG was him, claiming instead it was another person called the Samoan Prankster. He was charged with felonies in two separate states: for making a felony terroristic threat in the Lufkin McDonald's case and for terrorizing and criminal damage (both felonies) in a separate incident involving a Wendy's restaurant in Gretna, Louisiana. He was later extradited to Louisiana as a result of the charges filed in the Gretna incident. In December 2010, Markle was sentenced to 5 years imprisonment in Texas for the prank call to the Lufkin McDonald's.
- Shawn Powell, previously imprisoned for indecency with a minor (for taking nude photos of an 8-year-old female relative), a felony that put him in custody for 13 months. He specialized in racist and threatening calls. He was charged with criminal mischief for his part in a hoax call to the Baytown Arby's restaurant, resulting in the fire suppression system being activated and resulting in $1,350 worth of damage.
- LeeAnn Jordan, who had used her PayPal account to receive international money transfers and to pay for Paltalk.
A former member, Jericho Batsford, left the group in 2009 after the Conway, Arkansas incident, and contacted local FBI agents. She told them she knew Dex’s identity to be that of Malik and that he was responsible for many incidents. In response to her defection, Pranknet members have constantly harassed her home and her workplace via Skype and Beyluxe. Malik told members to be patient, that she would not answer the phone and let them get to her, and to instead "get her later on down the road, when she least expects it." Batsford had participated in some phone pranks, but left when she witnessed members encouraging children under the age of 18 to make bomb threats.
- "Elderly Man Falls Victim To Motel 6 Prank". The Smoking Gun. 23 November 2010. Retrieved 23 November 2010.
- "Telephone Terrorist". The Smoking Gun. August 4, 2010. Retrieved 25 March 2013.
- Lamb, Joe (June 12, 2009), "CPD investigating prank call", The Log Cabin Democrat
- Hoyland, Christa (July 14, 2009), "FBI investigating incidents of QSR phone-in vandalism", QSRweb
- "Ontario man accused of mass online pranks", CBC News, August 6, 2009
- "Outing An Online Outlaw", The Smoking Gun, August 4, 2009
- Leyden, John (August 10, 2009), "Hotel prank call badboy tracked down to mum's flat", The Register
- Philippe BIONDI and Fabrice DESCLAUX, Silver Needle in the Skype (PDF), blackhat, retrieved 2009-08-09
- Leonard, Tom (July 15, 2009), "FBI probes PrankNET over thousands of dollars in damage caused to hotels and restaurants", The Telegraph
- Abrams, Joseph (July 14, 2009), "Online Pranksters Wreak Havoc at Hotels, Restaurants Nationwide", Fox News
- Wilkinson, Melanie (August 5, 2009), "Hotel prank unraveling, according to Court TV website", York News-Times
- Dickerson, Rachel Parker (August 7, 2009), "Web Site Unmasks Motel Prankster", KATV
- Beitsch, Rebecca; Edwards, Amy L. (July 9, 2009), "Pranksters strike: Indian River County deputy fooled into breaking hotel window with toilet tank", Orlando Sentinel
- "First Pranknet Arrest", The Smoking Gun, August 26, 2009
- Cook, Ashley (August 7, 2009), "Police expand investigation into Diboll man's activities", Lufkin Daily News[dead link]
- Ulber, Emily (August 7, 2009), "Phone prank at south Lexington hotel might be linked to international ring", Lexington Herald-Leader
- staff (25 October 2010). "Pranknet Boss Hoaxed ESPN Reporter | The Smoking Gun". The Smoking Gun. Retrieved 28 October 2010.
- Chen, Dalson (August 4, 2009), "Ontario man leader of notorious U.S. pranksters, website claims", The Vancouver Sun
- "Telephone Terrorist". The Smoking Gun. Retrieved 14 February 2011.
- Verma, Sonya (August 8, 2009), "Out-of-line pranksters take cover online", The Globe and Mail
- Cook, Ashley (August 6, 2009), "Diboll man alleged to be prankster says it's not him", Lufkin Daily News[dead link]
- "Prank phone call caused $5,000 to McDonald's", KTRE (Lufkin), September 9, 2009
- Phillips, Christel (August 7, 2009), "National Web site fingers Diboll teen as prankster", KTRE
- "Another Pranknet Child Molester", The Smoking Gun, August 6, 2009
- "Second Pranknet Member Arrested", The Smoking Gun, September 9, 2009
- Phillips, Christel (September 24, 2009), ""Prankster" Extradited", KTRE (Lufkin)
- "Degenerate Phone Prankster Receives Severe Dose Of Texas Justice", The Smoking Gun, December 2, 2010