In the hours before police discovered a nightmarish murder scene inside a brick Markham home, a “panicked” international community was coming together online, desperately trying to track down the man they believed may have killed his family.
In Israel, Tunisia and the United States, players of a niche multiplayer game who hung out in an online forum called “Perfect World Void” were growing increasingly alarmed that a Canadian they knew only as “Menhaz” was not joking around this time.
The graphic images some of the gamers received in the early hours of Sunday needed to be taken seriously. They needed to contact police.
So began an effort across at least seven time zones to determine the precise location of “Menhaz” and alert the appropriate authorities. It ended at approximately 3:17 p.m., when investigators from York Regional Police knocked on the door of a home on Castlemore Ave., discovering four bodies inside and a young man waiting at the door.
Menhaz Zaman, 23, has been charged with four counts of first-degree murder in the deaths of Firoza Begum, 70, Momotaz Begum, 50, Moniruz Zaman, 59, and Malesa Zaman, 21. Friends have said the victims are the suspect’s grandmother, mother, father and sister.
More than 12 hours before the arrest, players communicating through a popular video game chat app called Discord said they realized they needed to act on disturbing comments and pictures they’d received.
Maroon Ayoub, a Perfect World Void administrator, said he got the first chilling message at about 11 p.m. Toronto time — shortly after he woke up around 6 a.m. at his home in Israel.
The messages were disturbing: Ayoub had received graphic images, and there was no reason to think it was “trolling,” he said, speaking to the Star through private Discord messages.
“Unlike in almost all his messages, he seemed very serious, wrote with proper English and denied my ‘are you joking’ question,” said Ayoub, who said he was a longtime friend of Zaman’s.
The case underscores the particular challenges of an emerging form of crime — one committed offline but where the evidence first appears online, through photos, videos or self-incriminating comments.
For those receiving evidence of a crime, it can be difficult to gauge its legitimacy, let alone know who to contact. As in this case, the recipients may not know the real or full name of the person they’re talking to, or their address. They might only have the vaguest details of where they live.
For police, an online tip sets off an urgent quest to verify whether a threat is real, and if so, where and how to stop it.
Determining the location of a possible crime scene or dangerous person requires making swift contact with websites or hosting platforms to obtain identifying information, such as internet protocol (IP) address. Even in cases where a search warrant isn’t required to get this information — such as when a life is at risk — police can face daunting obstacles, delaying key steps in an investigation.
“Unfortunately, there’s no template, not every investigation is going to go one way,” said Warren Bulmer, an expert in cybercrime and online investigations who recently retired from the Toronto Police Service, and who is not connected to the Markham case.
York Regional Police said they received a call to attend the home just before 3 p.m. on Sunday — minutes before the arrest — but the force has not released any information about who alerted them, or any details about how or when the residence was identified as a potential crime scene.
According to screen shots of a Discord conversation seen by the Star, a GTA-based gamer told Ayoub she contacted Toronto-area police about the possible murders before 5 a.m. Sunday.
The Star could not independently confirm the Canadian gamer’s claim. Toronto police spokesperson Allison Sparkes said she couldn’t comment on a York police investigation.
The RCMP also referred the Star to York police.
The causes and times of deaths of the victims will not be released as the case is before the courts, York police said this week.
For the Perfect World Void gamers, Menhaz’s messages first came in around 10 p.m. Toronto time on Saturday. They were used to seeing him joking around, using poor English on purpose and “trolling.”
But this, they soon realized, was something different.
For Ayoub, Menhaz was a longtime friend with whom he regularly chatted online, although he did not know his real identity.
(A former tenant of the Castlemore home confirmed to the Star this week that Menhaz’s profile picture matched Menhaz Zaman.)
“Is it another troll?” Ayoub asked “Menhaz,” not sure what to think of the shocking claim.
“I know ima pathetic coward subhuman,” he heard back.
The Star is choosing not to publish the messages in full. They describe how Menhaz lied to his parents about going to university; how he said he dropped out of a mechanical engineering program after failing classes in his first year; that be became depressed and became an atheist.
“For three years Ive (sic) been telling my parents I go to uni, when actually I was just hanging out at the mall four days a week,” they said.
“I don’t want my parents to feel the shame of having a son like me.”
After a short conversation, Ayoub said he was convinced it wasn’t a joke.
“I believed him because I think of him as an honest person. Her never lied to me and he gave me that impression generally,” Ayoub told the Star.
Ayoub contacted another forum administrator who goes by the name Jigsaw and has an account based in the U.S. In Discord messages, Jigsaw, who did not give the Star his real name, said he was also sent images and videos.
The images were so disturbing that he vomited, Jigsaw said.
Jigsaw said he had known Menhaz for seven years. He found him “innocent” in his personality, but in recent weeks he’d become aggressive toward Islam and had left insulting posts in the forum. He was banned for a week in mid-July, Jigsaw said.
Get more of today’s top stories in your inbox
Sign up for the Star’s Morning Headlines newsletter for a briefing of the day’s big news.
Realizing the pictures required the urgent attention of police, he called 911 around midnight. He said he also sent his local police the graphic images as well, but did not say which service he called.
After he alerted Jigsaw, Ayoub said another gamer contacted him, saying “Menhaz committed a murder.” That friend then added Ayoub to an online group of others trying to decide what to do next.
The group was “panicking and trying to collect info about this location so they (could) contact the cops,” Ayoub said.
One Discord user in Tunisia told the Canadian Press he also reached out to police in Canada to alert them to the disturbing postings and photos, which he shared with the news agency.
“I didn’t sleep or drink for two days, not because of graphic content, but just kept asking the question why’ over and over,” he said in a Facebook message.
“I’ve already called York Regional Police and Crime Stoppers … and sent them everything I have.”
It’s unclear how police were able to narrow the reports down to the Castlemore home. Ayoub told the Star one forum administrator who had attempted to contact police took an IP address from their database “but apparently it wasn’t the one needed.”
In a circumstance where a crime may be linked to someone online, police would typically reach out to the service provider — in this case, Discord — to obtain an IP address possibly containing location-identifying information.
Asked when and if they were contacted by police about tracing an IP address in the case, a Discord spokesperson did not address the question and sent an emailed statement.
“We are shocked and appalled by this tragic event, and we are working closely with law enforcement to provide any assistance we can. In the meantime, our hearts go out to the family and friends of the victims.” it said.
The statement added that Discord’s Terms of Service and Community Guidelines prohibit harassment, threatening messages or any illegal activity.
Ayoub has since said he and others on Discord have attempted to share as much information as possible about “Menhaz’s” online life and actions, in an effort to provide greater understanding about the case.
Bulmer, the online investigations expert, said one of the many hurdles police encounter in the early hours of trying to track someone online is overcoming the various policies websites or social media platforms have on what information they provide, and when.
In the majority of cases, police require a warrant from the courts to access personal information such as an IP address. In cases where a life may be on the line — referred to as “exigent circumstances” by police — investigators have the ability to fast-track that process, though there are still complicating factors.
Each company or platform will have its definition of what constitutes a crisis when someone’s personal data should be released — “their own definition of exigent circumstances,” Bulmer said.
Even once they receive an IP address, it may only provide the name of the internet service provider, such as Rogers or Bell, or the name of the person paying for the internet service who has no connection to the incident.
“Those are all factors and the police really don’t know where they are going until actually they get right down to that name and address and then they have to physically go there,” Bulmer said.
He added that there are also now a lot of ways for people to access the internet anonymously, such as through a virtual private network (VPN).
Last month, a New York man allegedly killed a 17-year-old Utica girl then posted the graphic images of her body on both Instagram and Discord, multiple media outlets reported.
One Discord user who saw the images told Rolling Stone she didn’t believe the images at first — “I thought it was fake or a look-alike.” Another person on the server who followed the alleged killer on Snapchat found his location through that photo app and called the police, Rolling Stone reported.
In March, a massacre of 51 people in Christchurch New Zealand, which the killer streamed part of on Facebook Live, led to a debate about the role of tech companies in hosting, and reproducing violent and hateful content.
Zaman is scheduled to make a court appearance Friday.
With files from Jeremy Grimaldi and Canadian Press
Wendy Gillis is a Toronto-based reporter covering crime and policing. Reach her by email at email@example.com or follow her on Twitter: @wendygillis
May Warren is a breaking news reporter based in Toronto. Follow her on Twitter: @maywarren11