MIR ISLAM▊
A Brooklyn teenager who published the Social Security numbers and credit files of the First Lady, the Vice President, and the FBI director on a website called exposed.su — then phoned armed police to the homes of at least nineteen people, including the reporter covering him. Federal guidelines said 37 to 46 months. He served about a year. The story could have ended there, as another tale of a clown who got a slap on the wrist. Instead it ended in Manila, with a body in a river.
I didn't expect to go as far as I did, but because of these disorders I felt I was invincible.
Mir Islam, addressing the court at his sentencing, July 11, 2016 — via KrebsOnSecurity
- WHO
- Mir Islam — "JoshTheGod," Brooklyn, New York; 22 at his 2016 sentencing FACT
- SCENE
- UGNazi (2012), then exposed.su (2013) — the celebrity-dox site run as a public performance. Related figure: Eric Taylor, "Cosmo the God"
- THE DRAMA
- Doxed Michelle Obama, Joe Biden, Robert Mueller, John Brennan, Jay-Z, Beyoncé, Kim Kardashian and dozens more; swatted at least 19 people, including journalist Brian Krebs — while on release from a prior federal carding arrest
- RECORD
- Pleaded guilty July 6, 2015 to conspiracy, conveying false information about explosives, and cyberstalking; sentenced July 11, 2016 to 24 months — roughly a year of it already served. The 2012 carding case closed with one day in jail FACT
- STATUS
- INCARCERATED ABROAD — per KrebsOnSecurity (Sept 2024), held in the Philippines for murder in the December 2018 death of Tomi Masters ATTRIBUTED
This file documents the purest specimen in the archive of doxing as attention-seeking performance: not espionage, not profit, just a teenager publishing the First Lady's credit file to be looked at, and sending SWAT teams to strangers' homes to feel large. It also documents the other recurring pattern — the reporter who covers the scene becoming its target. Brian Krebs's home would be hit again over the years by other men in this archive: a Ukrainian forum admin who mailed him heroin and tried to frame him, booter-service operators, the college kids behind Mirai. Islam got there first, and then reported his own handiwork on Twitter. And it documents the light comeuppance: guidelines said 37–46 months, the judge gave 24, and about half was already served.
the drama timeline
ACT I — UGNAZI (2012)
A crew of teenagers spends a year knocking over high-profile websites for the spectacle, and the FBI's carding sting scoops two of them up.
-
2012
The spectacle crew
UGNazi surfaces and claims credit for attacking a string of high-profile targets — DDoS against NASDAQ, ca.gov and CIA.gov, a hijack of 4chan's DNS through Cloudflare, and the dump of roughly 500,000 credit card numbers from a billing provider. Islam is a core member as "JoshTheGod." The crew's social engineer is Eric Taylor, "Cosmo the God" — fifteen years old.
-
JUN 25, 2012
Operation Card Shop
The FBI's carding sting sweeps up Islam — caught trying to buy stolen credit cards from an undercover agent. He pleads guilty to aggravated identity theft and conspiracy to commit computer hacking. The case will sit open for years while he stays free — and everything in Act II happens on that release.
-
NOV 2012
Cosmo, adjudicated
Taylor, arrested in the same sweep, is adjudicated in a California juvenile court: probation, account logins handed over, no contact with UGNazi or Anonymous members, no internet beyond schoolwork. He was fifteen when the FBI came through the door.
ACT II — EXPOSED.SU (2013)
Out on release from a federal arrest, Islam launches the most famous celebrity-dox site ever built — and a swatting spree to go with it.
-
MAR 2013
The First Lady's credit file, as content
exposed.su goes live, publishing names, addresses, phone numbers, Social Security numbers and credit reports for roughly fifty public figures: First Lady Michelle Obama, Vice President Joe Biden, FBI director Robert Mueller, CIA director John Brennan — plus Jay-Z, Beyoncé, Kim Kardashian, Arnold Schwarzenegger, Ashton Kutcher. It is doxing as pure performance: nothing sold, nothing ransomed, just an audience. Per KrebsOnSecurity's later reporting, Taylor helped establish the site.
-
MAR 14, 2013
Swatting the reporter
The day Krebs digs into how the site works, exposed.su doxes him — and armed police are relayed a fake hostage report and dispatched to his home in Annandale, Virginia. Krebs walks out his front door into drawn guns. The reporter-as-target move would be imitated for a decade; this was the marquee case.
-
FEB–SEP 2013
The spree
Prosecutors allege at least nineteen swatting victims in all, among them NRA chief Wayne LaPierre, Boston federal prosecutor Stephen Heymann, and then-legislator Ted Lieu. Separately, Islam admits to cyberstalking a University of Arizona student for months — and when she stops responding, phoning a fake active-shooter threat to her campus. Real officers, real guns, real doors — deployed as a harassment tool.
ACT III — THE LIGHT COMEUPPANCE (2015–2017)
Two federal cases land. The math comes out to about a year — and one day.
-
JUL 6, 2015
The plea
Islam pleads guilty in federal court in Washington, D.C. to three counts: a conspiracy spanning identity theft, computer fraud, wire fraud and threats; conveying false information about explosives (the University of Arizona threat); and cyberstalking. He goes into custody.
-
MAR 2016
One day for the carding case
The 2012 Card Shop case finally closes in the Southern District of New York: one day in jail, a $500 fine, three years of probation — for aggravated identity theft and hacking conspiracy, resolved after years in which the exposed.su spree happened on his watchlisted release.
-
JUL 11, 2016
"Just 1 year in jail"
Federal guidelines call for 37–46 months. Judge Randolph Moss gives 24 months — and with credit for the year already served, Islam faces roughly a year more. Islam tells the court his disorders made him feel invincible. Krebs's headline files the verdict for history: "Serial Swatter, Stalker and Doxer Mir Islam Gets Just 1 Year in Jail."
-
FEB 2017
Cosmo's turn: probation
Taylor — by now an adult, prosecuted for the crimes of his teens — is sentenced to three years of probation for his role in the swatting attacks, including the one on Krebs's home. No prison time.
ACT IV — TWO ROADS OUT (2018–2024)
One UGNazi alum reinvents himself as a security researcher. The other ends up in a Manila jail, and the crew's ghost keeps turning up in federal complaints.
-
2018
Cosmo goes legit
Taylor builds an actual career on the right side of the line: security research, penetration testing, advisory work for the data-center startup Path, press interviews on how the tricks of his teens still work on corporate America. Of everyone in this file, he is the one who took the second chance and used it.
-
DEC 2018
Manila
Per KrebsOnSecurity: 21-year-old Troy Woody Jr. is arrested in Manila after being spotted dumping the body of his girlfriend, Tomi Masters, into a river. Islam is taken in the same case. As of Krebs's September 2024 reporting, the two are "currently incarcerated in the Philippines for murder." The attention-seeker's story stops being funny here, permanently.
-
SEP 2024
The ghost of UGNazi
A federal complaint against Los Angeles crypto figure Adam Iza — accused of paying sheriff's deputies to shake down rivals — pulls the whole UGNazi lineage back into the record: the Manila case, the exposed.su years, the swattings. Twelve years on, the crew's name is still surfacing in FBI paperwork.
both sides, on the record
The case: this was not victimless clowning. At least nineteen people had armed police sent to their doors on fabricated emergencies — a tactic that has since killed. A college student was stalked for months and her campus threatened with a fake shooter. Dozens of people, from the First Lady to civilians, had their most sensitive identifiers published for an audience. And the spree ran while Islam was on release from a prior federal arrest — the leniency itself became the runway.
The sentence didn't fit: prosecutors asked for guidelines — 37 to 46 months. The court gave 24, roughly half already served. The victim who wrote the definitive account put the discount in his headline.
He pleaded guilty and said why: Islam took the plea, went into custody a year before sentencing, and told the court his disorders made him feel invincible. Judge Moss weighed that and was openly reluctant to impose the maximum. The short sentence was a court's considered judgment, not an accident.
These were teenagers: the whole UGNazi arc — the DDoS spectacle, the doxes, the swattings — was committed by people in their teens chasing an audience, not professionals chasing money. The system treated it that way.
Cosmo is the counter-example: Taylor was fifteen at his arrest, was handled as a juvenile ought to be, kept the terms of his probation, and converted the second chance into a legitimate security career — research, consulting, the conference-and-press circuit. The rehabilitation the sentence bet on actually happened, in his case [7].
YOU DECIDE
The record is unusually clean: the convictions are federal, the victims are named, and the perpetrator explained himself in open court. What the reader must weigh is the arithmetic — nineteen swattings, fifty doxes, one year — and the fork in the road afterward: one alumnus advising companies on security, the other in a Manila jail in a murder case. Attention-seeking was the engine the whole way. It just kept finding bigger things to crash.
The archive does not sentence anyone. The archive keeps the docket — and the headline.
evidence locker
PRIMARY / COURT RECORD
REPORTING, CONTEXT & CROSS-LINKS
The standard. Mir Islam's convictions, pleas and sentences are court record, cited to the Department of Justice and to KrebsOnSecurity's hearing coverage; the Philippines murder case is stated exactly as Krebs reported it in 2024 and no further. Eric Taylor was fifteen at his 2012 arrest — that is stated as the fact it is, his juvenile and 2017 dispositions come from contemporaneous reporting, and his later legitimate career is given at full strength. No victim's personal information is reproduced here; publishing it was the crime. If a line here couldn't survive scrutiny, it wouldn't be on the page.