Kirsten Ostrenga, aka Kiki Kannibal and Lilou Vos, was caught sockpuppeting on www.lolcow.farm - anonymously harassing and attacking girls across 2,500 posts she made. You can find the evidence at the bottom of this page.
Kirsten - a self-proclaimed activist against online harassment - is (in)famous for being the original "Myspace scene queen" and one of the first e-celebs. Rolling Stone's The Girl Who Played With Fire chronicles some of her Internet celebrity past as Kiki Kannibal.
She is the older sister of Dakota Ostrenga, aka Dakota Rose / Kotakoti, a model living in Japan.
Kiki spends most of her time today preaching peace & love on Twitter, Instagram, and Youtube.
On lolcow.farm, it's a very different story.
Her primary target was Youtube Jvlogger Taylor R, though she also posted about Sharla from "Sharla in Japan", Rachel from "Rachel & Jun", and Audrey Hayashi. The anti-Taylor posts began on June 16, 2016, the same day Taylor announced she had a new boyfriend.
This is aimed at a general audience, including people who may not know what lolcow.farm is or who Kiki Kannibal is.
tl;dr: Whether it was out of jealousy, paranoia, self-satisfaction, or all three, Kirsten secretly made hundreds of posts targeting Taylor R, a model and vlogger living in Japan. Out of any other poster on the site, she was by far the most aggressive and dedicated to cruelly insulting, harassing, and intimidating Taylor R and several other Jvloggers. Most of the rest of Kirsten's posts are dedicated to defending and complimenting herself or hypocritically accusing lolcow.farm posters of being jealous of herself and others.
Kirsten attempted to conceal her identity with an anonymizing VPN service from a company called Private Internet Access (PIA), but made numerous sloppy mistakes that eliminated the VPN's effectiveness. Check out the Evidence section at the bottom for details.
What is lolcow.farm?
lolcow.farm is an imageboard website for discussing drama related to humorous and crazy Internet personalities; especially people in the Japanese fashion, cosplay, and modeling communities.
Who is Kiki Kannibal?
Under the "scene handle" Kiki Kannibal, Kirsten became one of the first Internet celebrities at a young age. She singlehandedly helped shape scene fashion and regularly tussled with other online celebrities, like Jeffree Star, in dramatic blow-ups. Among Myspace and Stickam personalities, she was the OG. Her photos still remain the most frequently used of all time for catfishing and fake social media accounts.
Before Youtube existed, Kiki was one of the first video/streaming e-personalities, frequently using the old streaming platform Stickam and getting into trouble due to her racist, homophobic, and bullying behavior. Kiki's online antics indirectly resulted in the suicide of her ex-boyfriend, who jumped from a 2-story parking garage into a moving garbage truck in an attempt to escape from police officers who were coming to arrest him for the statutory rape of 14-year-old Kiki. You can read more details in the Rolling Stone article.
Kiki still attracts a following on social media, where she blogs and occasionally makes videos about fashion, vegan eating, and wholesome new age philosophy. Most of her social media content is directly contradicted by her insane and vicious posts on lolcow.farm.
Who is Sperg-chan?
On June 16, 2016, a /snow/ thread about Youtuber Taylor R began receiving an influx of extremely spiteful and nitpicky comments; much more than it had in the past. Many were obsessive and paranoid. (/snow/ is our board for "snowflakes": lesser, more boring versions of lolcows.)
This poster was affectionately dubbed "Sperg-chan" by users.
In part due to the deluge of apparent vendetta-driven posting in the thread - mostly from one person - the thread was locked for no longer being interesting. This upset Sperg-chan very much.
During July 2016, our website suffered a torrent of aggressive spam from Sperg-chan. Most of the spam included word salad all-caps rambling stretching hundreds of lines. Dozens of different graphic, gorey images of festering and mutilated genitalia were also featured. Sperg-chan accused the administration of being bought by Taylor R, or composed of Taylor herself.
Kirsten was also suspected to own an account named sarahsenpai on the Pretty Ugly Little Liar (PULL) forums. This account attacked Taylor in a similar style as lolcow.farm's own Sperg-chan.
We contacted the PULL owner and shared our information. She agreed it sounded like Kiki. We confirmed all of the IP addresses used by the PULL account also belonged to the PIA VPN ranges.
Interestingly, the email Kirsten used to register for PULL (sarahowen11985@gmail.com) had a Facebook account tied to it with the name Takuya Matsumoto. Takuya is her ex-boyfriend from Japan.
Unfortunately, the account no longer shows up when you search for it on Facebook, suggesting she changed the privacy settings or switched the email address.
We don't know why Kirsten created this Facebook with a throwaway email address. It's possible she used it to impersonate him or otherwise deceive people, but it's impossible to say for sure.
Please read all of the following evidence sections as a whole before making any judgments.
In the past, we have revealed several other rule-violating posters who attempt to anonymize themselves. You can see this in the /cream/ board. We have never once been incorrect in labelling someone's posts before.
We are certain that all of these posts were made by Kirsten (with a chance that some of them may have been made by her mother). We only labeled things we could definitively tie to her. It is possible that there are other posts she made that we have not found yet. If you identify any potential suspects, please report them on lolcow.farm and/or send an email to lolcow.farm@gmail.com with all of the information you have.
This analysis was conducted by lolcow.farm's first administrator.
Technical
Like most websites, our website naturally uses cookies to persist some user settings data, like board themes you pick. Cookies generally remain embedded in one's browser until they're manually cleared, unless you use some browser extension to automatically clear them. When you use the same browser multiple times, your posts will typically be linked together by this cookie regardless of what IP addresses you use.
Through "many-to-many" relationships between IP addresses, ISPs (Internet Service Providers), and these cookie values, we identified 5 distinct cookies (Cookies A, B, C, D, and E) and hundreds of IP addresses. This process begins with taking a post known to be made by Sperg-chan and constructing a full many-to-many network diagram ("graph") from its IP address and cookie relationships.
Cookie ID values are randomly and uniquely generated. It is impossible for two browsers to coincidentally share the same cookie ID. In short, two posts from two distinct IP addresses with different cookies are not necessarily from different browsers, but two posts from two distinct IP addresses with the same cookies are definitely from the same browser. Here, we are only looking at cases of identical cookie matches, so there is no room for speculation about random coincidences.
For our purposes, we can assume that a browser corresponds to an individual person. There are exceptions; if you share your computer with a family member or roommate, then one browser does not necessarily equate to one person. We know that Kirsten may currently live with her mother, and her mother occasionally engages in online activity. However, due to other factors we believe most, or all, of these posts were made by Kirsten and not her mother. Assuming Kirsten and her mother use separate computers, which seems likely, then we can also assume 100% of posts are from Kirsten.
By correlating what browsers (via cookies) an IP address was seen from (IP address -> browsers tied to that IP address -> IP addresses tied to those browsers -> ...) and what IP addresses a browser was seen from (browser -> IP addresses tied to that browser -> browsers tied to those IP addresses -> ...), we can start off with reasonable confidence through technical evidence alone that all posts made with any of these 5 cookies are from the same individual, whoever that individual may be.
There were so many IP addresses because PIA VPN regularly cycles through a large pool of them. We believe Kirsten was also manually ban evading by using the VPN software to switch to a new IP address on many occasions.
Behavioral
The first key piece of evidence was confidence that all 5 of these cookies correspond to a single human. In addition to this technical evidence through IP address/browser connections, we can analyze posts made from each of these 5 cookies to look for similarities in the cookies' owners' behavior through post content.
Common shared characteristics were identified:
Almost every post of every cookie set falls into one of those categories. Posts from these cookies are tied by both content and IP address correlation.
Stylometric
Stylometry is a method of attributing a piece of writing to a particular author by studying linguistic style. Through rudimentary stylometry, we can compare certain word, grammar, and symbol choices with text known to be written by Kirsten via her social networking profiles.
We did not perform a formal stylometric analysis by any means and these results should not be treated as scientifically rigorous. However, they add some additional supporting evidence.
Just a few instances:
"^ ^"
";3"
"pretty"
"fanatic"
There are many more examples. Additionally, we did not identify any text from her social media that conflicted with her lolcow.farm posts, or vice versa (e.g. consistently spelling some word a certain way on social media but consistently spelling it differently in lolcow.farm posts).
We consider this to provide a moderate degree of positive evidence, with no known instances of contradictory evidence. By itself this does not constitute confirmed writing attribution, but it's interesting when combined with the other evidence. If you like, you can compare the posts to her Twitter and Instagram and judge for yourself.
Human Error - IP Address Leakage
All of these posts were made from network ranges owned by the PIA VPN service - with one exception. Cookie A, which we already know through the above evidence to be used by the same person as Cookies B, C, D, and E, was briefly used to make 3 successive posts from IP address 104.188.188.116. Unlike every other IP address tied to these cookies, this IP address is residential, and does not belong to the PIA VPN service. And just like the other cookies, 100% of posts made from this cookie relentlessly attacked Taylor and others, defended Kiki, and insulted the site staff and posters.
IP address geolocation is generally not precise; it gives rough estimates of locations within a 10 - 50 mile radius. But here, the general location information is very revealing. 104.188.188.116 is an IP address belonging to a residential ISP (AT&T or a subsidiary company) which geolocates to roughly around the Orlando, Florida area. The geolocation is also in plausible range of Florida cities Winter Garden, Ocoee, Daytona Beach, or Clarcona.
Afterwards, posts with that cookie reverted back to solely being posted from the PIA VPN range.
This IP address likely belongs to Kirsten's or her mother's home residence in Florida. (Kirsten lists her primary location as Orlando.) The most plausible explanation is that she forgot to enable the VPN before making these 3 posts. She may also have accidentally turned it off at some point, or the software otherwise may have failed in some way.
Even without this final piece of evidence, we would still be completely confident that all of these posts are from Kirsten.
Evidence Validation
If anyone has any questions or speculation about the evidence, please feel free to post about it on lolcow.farm. You can email any private questions to lolcow.farm@gmail.com. We would also recommend looking through all of the posts as a whole and judging for yourself if they sound like they could be from Kirsten.
Kirsten may try to claim that all of this is a libelous fabrication. She has been a topic of discussion on our site for a while (primarily due to similarly insane and destructive behavior she's exhibited in the past), and may suggest that we are out to get her. A few notes:
