The Guardian
The far-right 8kun site again loses its Internet service protection after the Capitol attack
The Shell company, owned by two Russians, has cut ties with the 8kun Internet host, which has been linked to other acts of violence. Photo: Murdo MacLeod / The Guardian Sign up for the US Guardian Today newsletter A far-right website that was among the platforms used to organize deadly violence on the US Capitol was again forced to find new Internet service protection after a company fronted by two Russians and registered in Scotland, severed relations with the platform’s host on the Internet. The 8kun site, formerly known as 8chan, has long been a favorite platform for the far right and a follower of the groundless conspiracy theory QAnon. It was used by protesters before the January 6 attack to mobilize other “patriots” to “help invade the Capitol”, with some on the message board debating which politicians to kill after entering. After the turmoil, users continued to post content fueling violence, including maps of government buildings to target and combat techniques for a proposed civil war. It was not the first time that the platform was linked to acts of violence. The predecessor site 8chan was linked to a series of white nationalist terrorist attacks, including the massacres in Christchurch, New Zealand and El Paso, Texas. 8kun has faced significant obstacles to staying online since at least 2019, when the El Paso attack took place. All sites on the Internet are maintained online by a network of services, including web hosts and domain name registrars. 8kun had a loyal Internet provider at VanwaTech, based in Washington State, whose CEO has repeatedly defended its connections to the hate site in the name of free speech. 8kun was used by protesters before the January 6 attack to mobilize other ‘patriots’ to ‘help invade the Capitol’, Photo: Ahmed Gaber / Reuters But the site also cannot function without platform protection services that prevent DDoS attacks service attacks, and few providers are willing to work with it. After his removal from Cloudflare, 8kun, through VanwaTech, worked with Oregon-based CNServers LLC to protect against DDoS. That company also severed ties with 8kun when it was alerted to the site’s violent history. Since October 2020, 8kun has received DDoS protection from DDoS-Guard, a company that provides protection for several controversial sites, including the neo-Nazi website Daily Stormer. 8kun’s links to DDoS-Guard were first reported by security researcher and journalist Brian Krebs. This week, DDoS became the last company to sever ties with 8kun’s hosting company VanwaTech, after investigations by the Guardian. 8kun is now being hosted by American company FiberHub, which is based in Las Vegas, Nevada, according to the analysis by independent web researcher Ron Guilmette seen by the Guardian. FiberHub does not provide infrastructure directly for 8chan, but supports VanwaTech as a customer, co-founder and chief technology officer Rob Tyree confirmed to the Guardian by email. “We have not received reports that content hosted by VanwaTech with support from our infrastructure violates our terms of service or acceptable use policy, which includes the requirement to comply with all US federal and state laws and regulations,” said Tyree. “If we receive any of these reports, we will follow our internal policies and observe all legal requirements to resolve these issues as quickly as possible.” DDoS-Guard, a company that provided services to VanwaTech until the beginning of this week, was registered under a limited partnership, a financial structure in Scotland that allows non-residents to create companies with little scrutiny, on November 24, 2017 by Aleksei Likhachev and Evgeniy Marchenko – two Russian businessmen who remain owners of the company to this day. The partnership under which DDoS-Guard is registered is called the Cognitive Cloud and is listed at an address on Edinburgh’s Forth Street. Speaking from the city of Rostov-on-Don in southern Russia earlier this week, Marchenko told the Guardian that 8kun was not a direct customer of DDoS-Guard, but that his company was providing services to VanwaTech. He described DDoS-Guard as a global information security service. It hosted “thousands of websites,” he said, adding that it simply provided VanwaTech with “traffic protection services” to prevent it from falling victim to DDoS or other “brute force” attacks. “It looks like they host some dubious sites like Qanon / 8chan / 8kun. I still don’t understand what it is about and I don’t have information about its content or activity ”, he added. The partnership under which DDoS-Guard is registered is called the Cognitive Cloud and is listed at an address on Edinburgh’s Forth Street. Photo: Murdo MacLeod / The Guardian “We are not related to any political issue and we do not want to be associated in any way with customers hosting toxic sites like QAnon / 8chan,” said Machenko after the company broke ties with VanwaTech. Asked why he hired a company based in Scotland, Marchenko said: “Why not? The UK is very comfortable for business. I visited London once, 14 years ago. ”He said:“ We do not support any illegal activity. We don’t know anything about what happened in Washington or we support one side or the other. This company [VanwaTech] is just one of our many customers. ”Other DDoS-Guard customers include the Russian Ministry of Defense, as well as media organizations in Moscow. The company’s Web page leads to an official ministry story that describes recent measures taken by the Kremlin to ban Russian soldiers from using smartphones after a series of leaks. “It is okay to make money from the Russian government or any other government. It’s just business, ”said Marchenko. DDoS-Guard’s Edinburgh office is located at 18 Forth Street, a terrace of small Georgian houses in the eastern part of the new city of Edinburgh. There was no evidence of any Cognitive Cloud offices at that address or in any of the other five neighboring houses. An employee of a neighboring company said in his 7 years of work there that he had never met anyone from Cognitive Cloud, but he often received requests to send correspondence and orders to the company. An Edinburgh office manager said that Cognitive Cloud was not a tenant at the address, but instead referred the Guardian to another London-based company of a different name, to which she said that mail addressed to Cognitive Cloud should be forwarded. The Scottish number listed on the website for protection against DDoS is disconnected. A technical support representative contacted via the Russian phone number on the website said that the majority of its customers are based in Russia and declined to answer any further questions. Marchenko said his Edinburgh office was an “EU subdivision” with a “representative”. VanwaTech did not respond to the request for comment.