Cesspit of the internet runs to South Africa for cover – quickly gets the loot

South African hosting provider Xneelo has ditched one of the internet’s most hated websites from its cloud hosting platform.

8kun, formerly known as 8chan, is a haven for QAnon conspiracy theorists and anonymous extremists who goad each other with inflammatory, violent, and racist messages.

Racist diatribes related to the 2019 Christchurch Mosque shootings in New Zealand were released 8 Kun hours before the gunman’s rampage began.

Later that same year, another floor screed was put in place before a shooting at a Walmart in El Paso, Texas.

It has also been linked to the attack on the US Capitol in Washington DC on January 6, 2021.

Members of the 8kun community allegedly openly discussed plans to storm the building, including debating how much force they should use.

The racism on 8kun is not limited to anti-Semitism, Islamophobia or xenophobia – it also contains racism with a distinctly South African twist.

In mid-September, internet investigator Ron Guilmette contacted MyBroadband after tracing one of 8kun’s IP addresses to South Africa.

MyBroadband has previously worked with Guilmette to uncover nefarious activity stretching across South Africa and the rest of the continent, particularly the Major African IP address heist.

Internet Protocol (IP) addresses are unique numbers that allow networked computers to communicate with each other.

Public addresses that enable communication over the Internet are assigned through five regional registers.

Each registrar maintains a public database of who has been assigned IP address blocks, along with their contact information and business address.

It was thus possible to see that one of the addresses used by 8kun.top, 169.239.129.107, was probably from South Africa and was assigned to a New Zealand hosting company called Zappie Host.

Zappie Host’s website confirmed that it resells cloud hosting servers in New Zealand, South Africa and Chile.

People show Qanon messages on cardboard boxes during a political rally in Bucharest, Romania, August 10, 2020. By: Mircea Moira / Shutterstock.com

However, Guilmette’s interactions with Zappie Host stretched back over a month before it began hosting 8kun.

He had alerted the company that it was forwarding traffic to 8kun through a peering relationship with a Vancouver, Washington company unimaginatively named Vanwatech (aka Orcatech).

Vanwatech offers 8kun and extremist website The Daily Stormer provide security and content delivery services. It also recently started offering services to the infamous Kiwi Farms stalker website, which allows users to coordinate harassment campaigns.

As part of his campaign to de-peer Vanwatech, Guilmette contacted Zappie Host on August 3, 2022.

Peering refers to the logical and physical connection between two networks that allows them to exchange traffic freely.

Guilmette pointed out to Zappie Host that their peering with Vanwatech enabled traffic to 8kun and Daily Stormer.

He believed that a New Zealand company could be affected by an attack near his homeland, specifically noting that 8kun was distributing the Christchurch assassin’s manifesto.

Zappie Host’s head of technical support, Adam Berger, responded a little over four hours later.

“Thanks for the report, we will investigate this internally,” he said.

However, nothing happened.

Guilmette followed on August 15, and Berger replied that Zappie Host needs a legal takedown notice before taking any action.

Paraphrasing Berger said they could not be judges or juries on illegal content. His response also indicated that they would only take action against websites hosted on their own network, not peers.

Rather than wasting more time with Berger, Guilmette went over his head to Zappie Host’s upstream provider, Global Secure Layer (GSL Networks) in Australia.

Within a few hours, GSL had blocked the IP addresses in question.

While it didn’t shut down the sites, it did remove a layer of obfuscation and revealed several possible locations where 8kun is hosted.

After weeks of messing around with the sites, 8kun reappeared at Zappie Host — only this time, the New Zealand company hosted them directly from a South African IP address.

At the same time, 8kun.top pointed to two more IP addresses – one in Ukraine and the other in Russia.

Guilmette ultimately drove the hosts back behind them the Netherlands and Finland.

In cooperation with journalists in these countries, they closed the pages.

Meanwhile, in South Africa, MyBroadband had traced the Zappie host’s IP address and found that traffic to 8kun was routed through Xneelo’s network.

Xneelo investigated and confirmed that Zappie Host was in fact a downstream customer and that 8kun violated their Terms of Service.

“We have contacted the reseller and will block the website [immediately] as it violates our Acceptable Use Policy (AUP),” a Xneelo spokesperson told MyBroadband.

“In the future, every citizen can contact ISPA directly afterwards opt-out procedure. This allows a hosting provider to act in the best interests of the public,” it said.

“However, in this case, the site is in clear violation of our AUP, allowing the suspension to proceed without a takedown notice.”

Zappie Host’s cheap Linux container services

MyBroadband contacted Zappie Host for comment, and Berger said they acted and removed the client as soon as the issue was brought to their attention.

“Without delay or hesitation,” he added.

When MyBroadband challenged Berger to that claim, pointing to Guilmette’s emails from early August, he offered one my mistake.

“At the time, I completely misunderstood the recent laws that were being enacted here in New Zealand,” Berger said.

However, he still claimed that they removed Vanwatech from their network “after better learning that New Zealand sanctioned these websites due to the Christchurch shootings”.

This is odd, as MyBroadband saw GSL Networks’ email to Guilmette stating that they blocked Vanwatech’s IP address ranges – not that they asked Zappie Host to de-peer them.

“I hope you can understand that we’re trying to do ‘the right thing within the law,’ and that’s what we’re trying to do with every client,” Berger said.

“Guilmette made some really good points, actually [is] better educated [than] us in this (very) complex case.”

The coordinated cross-border strike on 8kun and Daily Stormer brought the sites offline. However, it only took Vanwatech to find new hosts willing to take them as clients.

Asked about 8kun’s brief downtime, Guilmette said most companies want nothing to do with such sites.

“Over time, I and others have managed to separate this racist, sexist, misogynistic, anti-Semitic, and homophobic website from numerous different internet companies,” Guilmette told MyBroadband.

“Most companies want nothing more to do with this stuff once they realize they’re helping move packages in and out, but there will always be exceptions,” he said.

“Either greed or an extremist ideology of free speech always motivates some unscrupulous internet companies to take it over once separated from their previous service providers. So the hunt goes on.”

MyBroadband contacted 8kun owner Jim Watkins for comment, but he did not respond at the time of publication.


Now reading: South African tech journalist allegedly behind QAnon speaks to MyBroadband