How the Netherlands facilitate the most hated websites in the world

Orange site: https://news.ycombinator.com/item?id=32875404

On June 6 this year, Jim Watkins, a 58-year-old American entrepreneur and website administrator, is summoned to testify before US Congress. He has to answer questions about his website ‘8kun’, an internet forum on which visitors can post messages anonymously. What role did this site play in the storming of the Capitol, in the beginning of 2021? The hearing wasn’t easy, Watkins complains afterwards in a livestream to his followers. „I was interrogated by prosecutors for six hours,” he says.

Watkins’ website 8kun is the birthplace of QAnon, the anonymous figure at the center of an extreme conspiracy theory surrounding former US president Donald Trump. Trump, Q explains, has made many secret attempts to purge the US ‘deep state’ of covert agents employed by a mysterious group of powerful people like Soros, the Obamas and the Clintons. Only on 8kun did the real Q share his messages. Thousands of believers pondered his apocalyptic predictions daily - self-proclaimed ‘bakers’ who tried to distill meaning from Q’s ‘crumbs’.

When thousands of Americans stormed the Capitol on January 6th 2021, it became clear how much of the internet craze had spilled over into the real world. This was symbolized by the infamous ‘Q-shaman’ standing in the Capitol in a fur hat with bison horns and bared torso. ‘Q sent me’, a sign he carried read.

Even before QAnon rose to prominence, 8kun was already widely regarded as the cesspool of the internet. The site, previously called 8chan, is filled with hate speech, racism, right-wing extremist ideology and, occasionally, child pornography. In 2019, in the span of a few months, three gunmen posted their ‘manifesto’ on the site in advance of their terrorist attacks. The attacks on two mosques in Christchurch, New Zealand, on a synagogue in Poway, California, and in a Latinx-area mall in El Paso near the Mexican border took the lives of 75 people.

Only then was the limit of major internet parties met. They decided publicly to no longer host or provide other services to the site, a rarity in Internet business. 8kun soon experienced how difficult it was to remain online without their help.

Small Dutch city

Three years later, 8kun is still online - although there are only a few routes left through which internet traffic can reach the site. And one of them runs through a small village in the Dutch province Flevoland.

Across a car and dog wash named Pitstop, on an industrial zone located on the outskirts of the small city of Dronten, 70 kilometers northeast of Amsterdam, sits a facility of the Dutch internet company Serverius IT Infrastructure. Behind the modern, wood-finished office building, Serverius runs a data center. The company also runs two others in Meppel and Apeldoorn in the east of the Netherlands. Just as a landlord sublets rooms, the company provides its internet tenants with electricity, cooling and internet for their digital rooms. From those servers, stacked horizontally in racks upon racks of computers, Serverius’ clients run their own internet services.

The tenants come from all over the world. The liberal and stable Netherlands, with its reliable power grid and excellent internet infrastructure, is a desirable place for data centers and the hosting industry alike.

But insight into who is renting the rooms is limited. The standing practice in the hosting industry is to show very little interest in what customers do or who they are, a limited sense of responsibility combined with complex and border crossing subletting arrangements. Oversight is not the highest priority. Why risk turning away one bad customer - who potentially brings in tens of thousands of dollars a month - among the many tens of thousands good clients a datacenter can service?

For whatever the reason, internet traffic bound to the infamous 8kun image board go through Serverius’ data center in Dronten, research by Ron Guilmette, an American independent internet researcher, has shown. Guilmette has worked tirelessly to scrub 8kun of the internet entirely. One by one, he demands internet companies that pass traffic to 8kun to stop doing that: his ultimate goal is to make the site inaccessible from anywhere on the web. „This work however is made much more difficult because these sites hide all the time”, he says.

Analysis of the data packets bound for 8kun reveals that a company called VDSina is passing them along. VDSina is a Moscow-based Russian hosting company, and, according to their website, has „super epic servers” at Serverius in the Netherlands.

Besides facilitating connectivity to 8kun, VDSina is well-known for hosting clients that perform ddos-attacks that take down websites, for spreading computer viruses and hosting websites involved with credit card and identity theft. In the first quarter of this year, the influential internet organization Spamhaus ranked VDSina number 7 on its global ranking of bad hosters who run botnets: networks of infected computers used for nefarious purposes. „In our internal database of Internet service providers, VDSina scores a two out of ten, where a score of one is the worst imaginable”, says Carel Bitter, a Dutch analyst at Spamhaus.

Internet fundamentalist Nick Lim

VDSina not only aids in keeping 8kun accessible through its footprint in the Dutch data center, but the Daily Stormer as well. The Daily Stormer is an infamous neo-Nazi news website.

This is no coincidence. They belong to the same customer of VDSina: Nick Lim, a young American Internet fundamentalist with absolutist views on freedom of speech, who is either 24 or 25 – his real age is unknown to the public. When 8kun was largely pushed off the Internet after the terror attacks of 2019, administrator Watkins turned to Lim’s hosting company.

Lim had also welcomed Daily Stormer after it too was spat out by major services in 2017. The site is openly racist and antisemitic and it regularly advocates a second genocide of Jews. More recently Kiwi Farms, a bullying site that organizes stalking of transgenders, lhbtqi people and people with autism, also washed up at Lim’s internet company. At least three suicides have been linked to the brigading on this site.

Lim confirms in terse emails that his company indeed has a presence in Dutch data centers and that he has a „strict commitment to freedom of expression and neutrality”. Beyond that, he reveals very little.

One of the few other internet routes to these websites that remain, go through the Finnish company Oy Crea Nova, where Nick Lim personally bought a server. The Finnish Helsingin Sanomat (HS), a newspaper with which NRC has cooperated for this article, is investigating the company. According to an article published by HS this Saturday, the owner of Oy Crea Nova is under criminal investigation for tax evasion. The owner was recently fined when Finnish authorities discovered child sexual abusive material on one of its devices.

Tax purposes

Who is responsible for these bad sites? Who can take them down? When NRC starts making telephone calls, all parties point at each other and at their customers. They state that they were unaware of hosting 8kun and the other sites.

Gijs van Gemert, CEO of Serverius, says on the phone he does not know a client by the name of VDSina. Van Gemert however does know a customer identified by the exact same technical specifications, but under a different name: ‘Hosting Technology Limited’. The company used to be a direct customer of Serverius, but is now a customer of a customer, says Van Gemert – he does not want to explain why. He stresses that NRC should not be addressing questions to him, the data center, but at the hosting company, his customer. He refers to MIRholding: VDSina is their customer, he says.

MIRholding, as it turns out, belongs to a young Dutch-Russian pianist and internet entrepreneur Andrej Nesterenko. He has a P.O. Box in a large office building in Amsterdam. Since last December, he has taken over VDSina as a customer of Serverius, Nesterenko admits on the phone. His guess is that Hosting Technology Limited is a foreign entity of VDSina, set up for tax purposes. The servers are still in Dronten, but his company offers additional services that Serverius could not provide. When NRC points out his client’s reputation, Nesterenko says that VDSina is a large and respected party. „They have a 24-hour complaints desk”, he says. VDSina did not respond to questions from this newspaper.

An hour after NRC reached out to Serverius and MIR, 8kun and Daily Stormer go down worldwide. When asked about the outage during a livestream, Jim Watkins starts talking about a plot by an American journ*list and a former employee for whose „capture and return” he claims to have offered a $20,000 bounty. News website Vice speculates that the sites are down because of ddos-attacks, caused by the recent addition of Kiwi Farms to Nick Lim’s clients.

Five hours after the initial calls, 8kun and the Daily Stormer are back online, but the connection through Dronten has been severed. The Finnish route is also down. When confronted by the HS newspaper, the owner of Oy Crea Nova quickly pulled the plug on the server. Nick Lim angrily called and demanded his money back – just over a thousand dollars. Afterwards, VDSina removed Serverius’ name and photo from their website.

New shelter

The cat and mouse game goes on for days, as Lim tries to find a new foothold for his sites. Repeatedly he is thrown out by parties after inquiries by NRC. „Right now, Nick Lim is like a wounded elk”, says internet researcher Guilmette, who monitors the websites’ every move. „It is time to move in quickly for the kill, before he gets away again.”

8kun and Daily Stormer do manage to restore their connections to the world wide web. Internet traffic to Nick Lim’s servers currently goes through an old acquaintance, a Dutch hosting company where until recently the largest amount of child pornography in the Netherlands was located – the company has however dismissed several problematic customers in recent months.

Of all the places on earth that Nick Lim could have picked to host these hated websites, he ends up back where it all started: in the Netherlands. The company that chooses to transmit his data – one of three currently remaining in the entire world --- is called NForce Entertainment, a company in Roosendaal, Brabant.