Trolling is a multifunctional phenomenon, which varies considerably, not only in terms of the behaviours it displays and the perceptions of those behaviours, but also with respect to the platform and the community in which it resides. From a forensic perspective, trolling also varies in terms of that which is prosecutable to that which is not. Despite trolling being a linguistic act, little is known about how trolling varies linguistically. This article examines the functional linguistic variation within a corpus of Twitter trolling as a step towards distinguishing forensically significant trolling from the rest. The analysis reveals two major dimensions of linguistic variation, namely ‘interactive versus non-interactive' and ‘challenging versus non-challenging'. This second dimension reflects previous descriptions of trolling behaviours, specifically that they can be hostile and challenging, and that they post content that is not challenging but provocative. While no distinct types of trolling Tweets are found in this corpus, the findings provide a framework for quantifying the degree of a communicative function exhibited by a trolling tweet, which arguably could inform prosecuting decisions.