Skip to main content

The rise and fall of a Twitch bot army

The rise and fall of a Twitch bot army

/

‘I’ve made countless streamers just turn off their stream’

Share this story

Photo by Amelia Krales / The Verge

On the morning of Friday, February 24th, a post on HackForum appeared, offering a new way to make life difficult for Twitch streamers. “ChatSurge is an extremely simple service to flood, destroy just simply demolish any TwitchTV chatroom [sic],” the post read. “I've made countless streamers just turn off their stream because of it.”

It was a spam service, offering to flood a given Twitch feed with the same (usually offensive) message over and over. On a platform where game-streamers succeed or fail by engaging with live comments on-screen, that can cause some serious chaos. Plenty of folks on HackForum, best known as a gathering place for low-level digital troublemakers, were willing to pay for access to that chaos, which the poster described as “an extremely effective, unique and hilarious service for as cheap as 30$/month.”

The spambots started attacking that same day, posting as many as 699 messages per minute in some channels, according to a motion filed last week in the Supreme Court of British Columbia. As soon as that flood began, Twitch started thinking about how to take down their new spammer. After a second wave of attacks, the company moved for court orders against ChatSurge’s web host, registrar, payment processor, and other services in an effort to track down the proprietor of the service. All told, the motion blames ChatSurge for 150,000 spam messages across more than 1,000 channels.

“ChatSurge is an extremely simple service to flood, destroy just simply demolish any TwitchTV chatroom.”

ChatSurge’s founder said he was surprised by the action, because Twitch had never contacted him about shutting down the service outside of court. The service’s founder, who goes by “Ob Noxious,” said he never received a cease and desist notice before the case was filed, despite having a publicly listed email and screen names under Skype, XMPP, and Discord. The site itself remained live until Tuesday night, shortly after its founder spoke with The Verge.

“If they wanted me to shut down, they would have at least sent me a cease and desist,” he said. “I still don’t know what their end goal is.” The Verge agreed to grant Ob Noxious anonymity given the pending legal action against him. Twitch did not respond to a request for comment.

The founder said he first got the idea for ChatSurge from a friend’s description of early Twitch trolling campaigns, when there were few protections against automated bots. But when he tried the same techniques, he found a much harder landscape. Twitch now uses Captcha, blocks any sign-ups that look suspicious, and actively bans any existing accounts showing bot-like behavior, all of which make it very difficult to keep a bot account running.

After a second wave of attacks, the company moved for court orders

But that wasn’t enough to keep him out. He ran login Captchas through a service called 2Captcha, which uses paid workers to decode the images, sending the results back to ChatSurge through an API. Three dollars got him 1,000 Captchas, which was enough to start about 600 accounts after losing some to doubled usernames and automated blocks. Twitch engineers would still wipe out Noxious’ accounts roughly four or five times a day. Typically, the service would wipe out whole domains at a time — every email registered to @obnoxio.us, for example — which meant Noxious also had to cycle IP addresses and domain registrations. All of it cost more money, but with enough paying subscribers, he was able to come out ahead.

Similar schemes have taken root on Twitter and other platforms, but Twitch is one of the few places with enough angry users to make rage-spam a viable business. For Ob, it’s a natural result of being able to watch streamers read on-screen comments in real time, one of Twitch’s central innovations. “You’re not going to see someone’s immediate reaction to email spam,” he said, “but you will with Twitch.”

“You’re not going to see someone’s immediate reaction to email spam, but you will with Twitch.”

Noxious wasn’t sending any of the messages himself, and said he disagrees with many of the spam messages named in the motion, which include numerous racial slurs. Still, he’s never moderated what ChatSurge users can send out; he just doesn’t see the point. “In my opinion, if you’re streaming on Twitch.tv, you’ve got a thick skin,” Noxious told us. “That’s just the community. There’s no way around that.”

Noxious said ChatSurge was barely breaking even by the time it was taken down, the result of a drop in users after the February rush. For him, the biggest surprise is how aggressively Twitch has pursued what he sees as a relatively small service. “It makes them look kind of ridiculous, in my opinion,” he said.

Last night, after speaking with The Verge, ChatSurge’s founder took the site down and posted a short message in its place, saying he’d been served “legal documents” and didn’t have the money or motivation to fight in court. “It was a good run and I love every single one of you. You stayed with me and loved every last bit of it. Unforunately [sic] this marks the end of my TwitchTV adventures.”