False reports of active shooters that put Villanova University in Philadelphia and the University of Tennessee at Chattanooga on lockdown and saw law enforcement swarming over campuses last week were likely perpetrated by an online swatting group called “Purgatory,” extremism researchers say.

Five Purgatory members hosted a voice call on Discord, a platform popular with gamers, on Aug. 21 to an audience of 41 people, livestreaming the bogus calls to authorities at Villanova and Tennessee, according to a report by Marc-André Argentino, a Canadian researcher.

Using a VoIP (Voice over Internet Protocol) service that masks caller identity and location, a Purgatory leader with the screenname “Gores” made calls reporting active shooters, per a report by the Global Project Against Hate and Extremism, or GPAHE, which also monitored the chat.

In a call archived by GPAHE, Gores attempted to duplicate the successful swatting attacks at Villanova and Tennessee by calling the security office at Bucknell University in Pennsylvania later the same day, as other Discord users laughed.

“Can you hear me?” Gores asked the woman who answered the call. “I’m currently at Bucknell University. I’m in the library right now. I just saw a guy walking around, six foot tall and it looks like he’s holding an AR-15. I think he’s heading towards me.”

Like the other active-shooter reports that day, it was a fabrication.

GPAHE reports that Gores attempted to provoke an armed police response at locations in Michigan on Aug. 21, but police departments recognized the hoax.

According to GPAHE, Gores sometimes used “the sound of a shotgun blast in the background.” That’s consistent with an official update by the University of Tennessee at Chattanooga stating that the 911 telecommunicator who fielded the call for service reported hearing gunshots.

Purgatory is a subset of a larger decentralized online network known as Com, whose members engage in hacking, fraud, extortion, child sexual abuse material, and at the most extreme, murder and terrorism. The participants, many of whom are teenagers, commit crimes that they document for social standing. Some groups also advertise crimes-for-hire.

A post on Purgatory’s Telegram channel documented by Argentino and GPAHE advertises a price list. A swatting attack on a school, described as “institutional purge,” costs $20, while vandalism, using a brick to break out a window, costs $15.

Last month, Evan Strauss, the 27-year-old founder of Purgatory, pleaded guilty to conspiracy, cyberstalking, interstate threatening communications and threats to damage or destroy by means of fire and explosives.

Over two months in late 2023 and early 2024, Strauss and two co-defendants, who also pleaded guilty, placed calls to a Delaware high school threatening to shoot students and teachers, called in a bomb threat to the Albany, N.Y. airport, and called a sheriff’s office in Alabama threatening to burn down a trailer park, according to the government.

It is unclear whether there is a direct connection between the original Purgatory and the new group. The first posts of the Telegram channel for the iteration responsible for the Villanova and University of Tennessee swattings includes a link to the press release about Strauss’ guilty plea, according to GPAHE.

Since Aug. 21, swatting attacks have affected University of Colorado-Boulder, Kansas State University, University of South Carolina, University of Arkansas, Iowa State University, University of New Hampshire and Northern Arizona State University.

Argentino said the swatting attacks were likely carried out by Purgatory and a rival Com group called “Diddy Swats,” named for hip hop producer Sean Combs, recently convicted of prostitution-related offenses. Competition often drives criminal activity among the online groups.

Reflecting on how the false active-shooter calls resulted in mass panic, with students barricading themselves in classrooms, Argentino wrote that “the prevalence of school shootings in the United States makes these swatting calls especially traumatic for those on site” while draining public resources by prompting “large-scale tactical responses.”

But the attacks cause even deeper harm by eroding social trust, Argentino said.

“These dynamics also impose psychosocial costs on the wider campus community by heightening fear, normalizing rumor as evidence, and displacing official risk communication,” he wrote.

“Tertiary harms emerge as the content economy rewards rapid, sensational posts with reach and monetization, incentivizing copycat coverage and degrading the information environment for future incidents.

“Institutions face eroded trust, rising call volumes driven by misinformation, and response fatigue that slows decision making in genuine crises … In this way, swatting functions as an attack on social infrastructure, converting an unfounded report into cascading harms mediated by networked attention, algorithmic amplification, and weakened verification norms.”