'Little Nicky': How the Wheel of Fortune Announcer Spent Years in a Pedophile Network
How does Wheel of Fortune's announcer end up moderating a pedophile chatroom mid-flight? Meet "Little Nicky."
“I keep Pampers Goodnites XL's on hand for fun, which fit my 32 waist… I love wearing them, and I LOVE boys in diapers. Especially older ones.” - Jim Thornton AKA LittleNicky
The video to compliment this piece by good friend slyboy
A note on method: everything here comes from OSINT — Open Source Intelligence. That means public posts, public forums, and metadata people attached to their own accounts, not hacked data, not anything obtained by exploitation. If it's in this piece, it was sitting in the open for anyone to find.
I have been researching and uncovering a very large, decades long online pedophile network. Without giving away too many trade secrets I have already reported dozens of users from these sites after uncovering their identities using Open Source Intelligence (OSINT). I have around 3 million posts from many different sites locally that I use to work with law enforcement and other investigators to report and take down these predators. That being said, I was shocked to hear one of the websites I monitor, lifeline chat, was in the national news. So first lets give a little run down of what happened, how we got here and what these sites are.
What happened?
On an American Airlines flight from Charlotte to LAX, a passenger seated near Wheel of fortune announcer Jim Thornton saw his laptop open to a chatroom and photographed the screen. The visible messages were obviously of men sexualizing children; "a couple of cute boys and a hot little girl," "All-you-can-eat Boyfett," plus an Instagram link about a London man arrested for indecent images. The site was Lifeline.chat, described on its own page as a support chat "for people attracted to children," his in-room handle was NicholasB77. The passenger alerted a flight attendant → the captain → law enforcement met the plane at LAX, questioned him for about five minutes, and released him. He was never arrested or charged. Jim claimed he wondered into the chatroom by accident, I'm here to tell you he was a moderator on the site, while also posting on multiple other private pedophile boards for at least 4 years, but claims to have been around the space for decades longer.
The sites he posts on are all under one big umbrella network. In layman's terms, although each website is moderated/run and sometimes financed by different people, there's someone on top handling the ecosystem of many dozens of pedophile adjacent domains world wide. For a more detailed look at the ecosystem check my two previous pieces.
▸ For the technically inclined: the one machine name that runs the whole cluster — isp-cx-miami.net
al-ns#.isp-cx-miami.netDNS is the network's nervous system — and one operator owns it
Forget the hosting for a second. The most important name in this whole cluster is isp-cx-miami.net, because it doesn't just host sites — it runs their DNS. DNS is the internet's address book: it's what turns boymoment.com into a server you can actually reach. Whoever controls a domain's DNS controls where it points, its mail, its very reachability.
The cluster's authoritative nameservers are branded aldns.org — but look at what those nameservers are actually called:
| ns1.aldns.org | = al-ns1.isp-cx-miami.net | Amsterdam |
| ns2.aldns.org | = al-ns2.isp-cx-miami.net | Miami |
| ns3.aldns.org | = al-ns3.isp-cx-miami.net | Irvine, CA |
Spread across three countries for resilience, but all three carry the same fingerprint: isp-cx-miami. That's not a hosting company with many unrelated customers — it's one operator's DNS, dressed in a neutral name.
20 separate "independent" sites, one address book
Every one of these registered domains — presented publicly as its own project, with its own moderators and sometimes its own funding — resolves through that single isp-cx-miami nameserver set:
boymoment.net
boy-moment.com
yesmap.net
map-union.org
newgon.net
mapforum.org
nambla.org
fstube.net
annabelleigh.net
agetaboo.org
alentogroup.org
allykotetsu.com
nextpointfromnothing.com
brianribbon.com
robinsharpe.ca
robinsharpe.org
mhamic.org
cblf.org
glgarden.org
Pull the NS records for any of them yourself: dig NS boymoment.com +short → ns1/2/3.aldns.org. Same answer down the list.
And that's only half of it. The Free Spirits side of the cluster runs on a sibling nameserver set, fscodns.net, on the same backbone — another ~13 domains including boychat.org, boy.chat, lifeline.chat, freespirits.org/info, boywiki.org, boylinks.net/org, legarcon.net and jungsforum.net. Two namesets, one operator, ~33 domains between them.
And the servers underneath — same fleet
The boxes those domains actually live on sit inside one autonomous system, FranTech Solutions / AS53667 (a.k.a. BuyVM), and on reverse-lookup they answer to the same naming family: brian., anna., tom., robin., kubiak., baxter. … .isp-cx-miami.net. A single server routinely carries several boards at once — e.g. 198.251.88.251 hosts lifeline.chat + freespirits.org + freespirits.info together; 198.251.84.12 carries boychat.org + boy.chat. Different storefronts, one machine.
Why it matters
A cheap shared host could be coincidence. Shared DNS cannot: it means one person can move, hide, or resurrect any of these twenty-plus domains at will, and it's why deplatforming one board never touches the others — the operator just re-points the address book and the site reappears elsewhere. isp-cx-miami is the "someone on top." The individual forums are storefronts; this is the landlord who holds every key.
All of the above is live and re-checkable with public dig / whois / reverse-DNS lookups — no leaked data. Figures from continuous monitoring of ~178 domains and ~100 IPs.
Here's a quick overview of the websites I have found Jim posting on
- BoyChat — one of the oldest pro-contact “boy love” message boards on the open web (est. late 1990s), text-only, pseudonymous, still live but dying fast.
- BoyMoment — a newer, invite only forum in the same orbit; much more vulgar space since it's not public with a large photo gallery. This is where Thornton did the bulk of his posting.
- Lifeline (lifeline.chat) — a real-time chat room in the Free Spirits cluster, framed publicly as a “support” chat pedophiles, It is volunteer-moderated; and is ultimately a front for pro contact pedophiles to find struggling pedophiles to join their cause. This is the room Thornton was photographed in on the plane.
I'm not releasing these to embarrass him or his family which is why I'm leaving out a lot, if you're personally involved in this and want to hear more please reach out.
On lifeline he went by NicholasB77, but in the pedophile forums he's known as "little nicky". Jim describes a very rough childhood that seems to have had quite a toll on him psychologically, a mother who died early and an abusive father. Like many kids with severe childhood trauma, it unfortunately evolved into some troubling sexual obsessions, instead of speaking for him, here's some of his 500+ posts.
Jim was also very brazen in his attempt at anonymity, uploading 10 audio interviews with different pedophile users on these boards with his extremely noticeable voice. Sadly, 9 of them were scrubbed before I could get them, but I did get one 45 minute interview with Jim and a self described "[CSAM] addict". Here's some audio for you to listen and make the judgment for yourself.
Jim's lack of self awareness and out right cockiness is what got him caught. I have 0 evidence of any wrong doing. Jim is only guilty of being a creep based on his hundreds of messages, but these sexual obsessions don't deserve to stay in the dark. Let's hope Jim gets the intense therapy he needs and doesn't fall into a self fulfilling prophecy like many other pedophiles before him.
I track online pedophile advocacy networks using the same tools available to anyone — forum archives, image metadata, public data breach records, domain and DNS records, reused usernames and the predators own words. Nothing was exploited to get this information.