Last week persons unknown claiming to be female hackers posted on 8chan stating that they have begun a DDoS attack against infamous hate group Kiwi Farms. The posts linked to a rival trolling group. At roughly the same time there were a series of outages of several websites linked to 1776 Hosting, a controversial hosting company being set up by Kiwi Farms owner Joshua Conner Moon (also known as Null). Kiwi Farms and 1776 are controversial because of their owner’s calls for genocide, distribution of paedophilia content such as child rape stories and the actual murders of minors by a member of his board. Moon also runs a ‘novelty’ email service lolcow.email, which brought ‘novel’ situations to schools in his former home state of Florida such as mass murder threats.

The persons allegedly attacking Kiwi Farms would like us to think they look like this. Stock photo by Dreamstime.

On the rival group’s site itself however, members fiercely denied being responsible for the outages. Instead group members claimed Kiwi Farms members were trying to frame them. I have no direct knowledge of whether Moon’s sites are under attack or who (if anyone) is responsible. However, I am clear on the source of one hacking attack –
What is certain is that Kiwi Farms has launched a retaliatory and openly criminal attack on their rivals, which has also caused some apparent downtime. I can tell this because they are openly boasting about it with animated video gifs of their screens (archive – animated .gif towards the bottom of the page). User ‘FancyBear’ posted a video of himself launching a crude DDoS attach against the rival site. FancyBear has previously posted stolen data from one of Kiwi Farms’ vulnerable victims. This is unlikely to impress the FBI should Moon complain of the alleged attacks on him.

The openly organised hacking, even if provoked, is likely to further fuel law enforcement interest in Kiwi Farms. Moon himself has admitted that ‘organised harassment’ could get his site shut down and yet he has taken no action against a user openly committing felonies and documenting them.

Kiwi Farms user ‘FancyBear’ openly posts his execution of a retaliatory DDoS attack. I have blocked out the name of the victim site to avoid giving them publicity. Click for full size.

The DDoS fight has yielded some interesting information. 8chan users pointed out that whilst Joshua Moon has been marketing 1776 Hosting as a ‘free speech’ hosting service directly connected to the North American Internet Backbone (if such a thing exists) all of the company’s facilities appear to be provided by a colocation firm called Colocrossing. Public registry information shows that 1776 Hosting has the IP address range 103.114.191.1-255.

Colocrossing’s legal terms of use and Acceptable Use Policy prohibit the sending of offensive communications –

“3. Customer shall not transmit any communication where the meaning of the message, or its transmission or distribution, would violate any applicable law or regulation or would likely be offensive to the recipient thereof.”

This is likely to be a catastrophic flaw in Moon’s business model, given that he specifically targets those too offensive for other services. The abuse address for Colocrossing is – abuse@colocrossing.com.

I am not naming the rival site here because of its indiscriminate defaming of anyone associated with the Kiwis, which is one reason I also have not joined them. Nonetheless whilst I have literally no horses in this particular race, I suspect a great deal of popcorn will be consumed by Moon’s many enemies.