By Phoebe Petrovic, Wisconsin Watch

Moments before 15-year-old Natalie Rupnow opened fire inside her Madison, Wisconsin, school, killing two people and herself on Dec. 16, 2024, a social media account believed to be hers posted a photograph on X showing someone sitting in a bathroom stall and flashing a hand gesture that has become a symbol for white supremacy.

As news about the shooting broke, another X user responded: “Livestream it.”

Extremism researchers now believe that second account belonged to 17-year-old Solomon Henderson, who police say walked into his high school cafeteria in Nashville, Tennessee, on Jan. 22, 2025, and fired 10 shots, killing one classmate and then himself. Archives of another X account linked to him show that he posted a similar photo to Rupnow’s in his final moments.

While there isn’t any evidence that Rupnow and Henderson plotted their attacks together, extremism researchers who have tracked their social media activity told Wisconsin Watch and ProPublica that the two teenagers were active in the same online networks that glorify mass shooters, even crossing paths. Across various social media platforms, the networks trade hateful memes alongside terrorist literature, exchange tips on how to effectively commit attacks and encourage one another to carry out their own.

The researchers had been tracking these networks for months as part of work looking into growing online extremist networks that have proliferated across gaming, chatting and social media platforms and that they believe are radicalizing young people to commit mass shootings and other violence.

The researchers’ analysis found only a few instances in which Rupnow and Henderson appeared to interact directly. But in the hours, days and weeks that followed the Madison shooting, Henderson appears to have become fixated on Rupnow. He boasted on X that Rupnow and him were “mutuals,” a common internet term for following each other, and shared another post that said, “i used to be mutuals with someone who is now a real school shooter ;-).”

The researchers, who have collaborated with counterterrorism organizations, academics and law enforcement to prevent violence by tracking how extremist networks radicalize youth online, agreed to share information as long as they weren’t named out of concerns for their physical safety. The news outlets vetted their credentials with several experts in the field.

It’s impossible to know with complete certainty that online accounts belong to particular people without specialized access to devices and accounts from law enforcement. The Metropolitan Nashville Police Department has acknowledged the existence of two documents they believe Henderson created, both of which contain details about his social media accounts. Other researchers and groups — including the Anti-Defamation League, Canadian extremism expert Marc-André Argentino and SITE Intelligence Group — have also determined these likely belong to Henderson.

The extremism researchers linked accounts to Rupnow, who went by Samantha, by tracing her activity across multiple social media profiles that revealed common biographical details, including personal acquaintances and that she lived in Wisconsin. On the bathroom post, one person the account regularly interacted with referred to Rupnow by her nickname, “Sam.” Wisconsin Watch and ProPublica were able to verify the social media posts and the connections between the accounts by retracing the researchers’ steps through archived social media accounts and screenshots.

In the hours after Natalie Rupnow opened fire in her school in Madison, Solomon Henderson posted numerous times on X, supporting her and boasting that they were “mutuals.” (Source: X, obtained by Wisconsin Watch and ProPublica, screenshots by ProPublica and blurred by ProPublica)

On Jan. 23, ABC News cited law enforcement sources in reporting that a social media account connected to Henderson may have been in contact with Rupnow’s social media account. The information reviewed by Wisconsin Watch and ProPublica details their suspected connections and interactions. Nearly all of the accounts that researchers have linked to Rupnow and Henderson have now been suspended.

A Madison Police Department spokesperson said the agency knows Rupnow “was very active on social media” and it is “just starting” to receive and review documents from tech companies. The Nashville police said they had nothing further to add beyond their previous statements. Rubi Patricia Vergara, 14, and Erin West, 42, were killed at Abundant Life Christian School in Madison. Josselin Corea Escalante, 16, died at Antioch High School in Nashville. Both attackers also killed themselves.

Rupnow and Henderson both had multiple X accounts, the extremism researchers told Wisconsin Watch and ProPublica. At the time of her attack, Rupnow followed just 13 other users. Two of those accounts have been linked to Henderson.

In November, Rupnow shared a post from Henderson, which appeared to wish a happy Veterans Day to the man who killed more than a dozen people at University of Texas at Austin in 1966.

After the Madison attack, someone wrote to Henderson and others on X, saying that one of their “buddies” may have “shot up a school.” Henderson told another user, “I barely know her,” and said he had never exchanged private messages with her. Later, in a 51-page screed that Nashville police are examining, he emulated and praised several past attackers including Rupnow and said, “I have connections with some of them only loosely via online messaging platforms.”

After Rupnow’s shooting, Henderson called her a “Saintress,” using a term common in the networks, and posted or reshared posts about her dozens of times, celebrating her racist, genocidal online persona and the fact that she had taken action. On one platform, he used a photograph of her as his profile picture. In his writings, he said he scrawled Rupnow’s name and those of other perpetrators on his weapon and gear.

A police officer sits near a door at Abundant Life Christian School in Madison on the evening of Dec. 16, 2024, just hours after a shooting inside the building. (Credit: Julius Shieh for Wisconsin Watch)

The online networks the two teenagers inhabited have an array of influences, ideologies and aesthetics. To varying degrees of commitment and sincerity, they ascribe to white supremacist, antisemitic, racist, neo-Nazi, occult or satanic beliefs.

In this online world, the currency that buys clout is violence. This violence often involves children and teenagers harming other children and teenagers, some through doxing or encouraging self-harm, others, like Rupnow and Henderson, by committing mass attacks in the nonvirtual world.

“This network is best described as an online subculture that celebrates violent attacks and radicalizes young people into committing violence,” said one of the violence prevention researchers. “Many of the individuals involved in this network are minors, and we’d like to see intervention to give them the help and support they need, for their own safety as well as those around them.”

Members of some of these communities, including Terrorgram, 764 and Com, have engaged in activities online and offline that have led to convictions for possessing child sexual abuse materials and sexually exploiting a child and indictments for soliciting hate crimes and soliciting the murder of federal officials. The cases are pending, and the defendants have not filed responses in court. On Jan. 13, the U.S. State Department designated the Terrorgram Collective as a terrorist organization, saying “the group promotes violent white supremacism, solicits attacks on perceived adversaries, and provides guidance and instructional materials on tactics, methods, and targets for attacks, including on critical infrastructure and government officials.”

When details of the Nashville shooting began to emerge, researchers realized they had seen some of Henderson’s accounts and posts within the network of about 100 users they are tracking. They had previously reported one username of an account belonging to Henderson, as well as others within the network to law enforcement and filed several reports with the National Center for Missing & Exploited Children.

They had not been aware of Rupnow’s accounts before her attack, but were able to locate her within the network after the fact, discovering she had regularly interacted with other accounts they had been following.

A memorial is seen outside Abundant Life Christian School in Madison, on the morning of Dec. 17, 2024, one day after a school shooting killed two people, plus the shooter. (Credit: Julius Shieh for Wisconsin Watch)

Alex Newhouse, an extremism researcher at the University of Colorado, Boulder, said these subcultures have a long history of lionizing and mimicking past attackers while goading each other to enact as much violence as possible — even by assigning “scores” to past attacks, something Henderson engaged with online. “The Antioch one is very obviously copycat,” Newhouse said.

Although Henderson’s diary indicates he had been contemplating an attack for months prior to Rupnow’s, her shooting drew his attention. Hours after, he retweeted another post that said: “There should be a betting market for which rw twitter figure will radicalize the next shooter.” (RW stands for right wing.)

However the two teens entered this online subculture, their writings reveal despair about their personal lives and the world around them and expressed violent, hateful views.

After the Madison shooting, a separate social media user noted their association and tweeted at the FBI, accusing Henderson and others of having prior warning. They “need to be locked up,” the poster said, “no questions asked.”

The FBI declined to comment. But after Henderson’s attack, social media users returned to the tweet: “hey so this guy literally just ended up calling a future school shooter a month ahead of time and the FBI did nothing about it.”

If you or someone you know needs help:

• Call the National Suicide Prevention Lifeline: 988
• Text the Crisis Text Line from anywhere in the U.S. to reach a crisis counselor: 741741

If you or someone you know has been harmed online, you can contact the National Center for Missing & Exploited Children at 1-800-THE-LOST or report.cybertip.org.

This article was produced for ProPublica’s Local Reporting Network in partnership with Wisconsin Watch. Sign up for Dispatches to get stories like this one as soon as they are published.