Stochastic Terrorism As A Service

Kiwi Farms is a top tier player in STaaS.

The phrase Stochastic Terrorism is an internet-ism, used to describe the practice of inciting violence without being aware of who will actually make the attack. The bounds of provocative speech in this country are constrained by Brandenburg v. Ohio, a Supreme Court case decision rendered on June 8th, 1969. The first connection in what would become the internet we know today was made 143 days later, on October 29th of 1969.

The other law that fosters the ability to incite violence without consequence is Section 230 of the Communications Decency Act of 1996, which immunized carriers against litigation/investigation on content traversing their networks. If someone makes a threatening phone call, the caller is the one with criminal liability, not the phone company. That was a good analogy in 1996 when the vast majority of us access the internet using analog modems. It stopped making sense roughly ten years after it was passed, but Congress moves slowly in this area.

The poster child for the need for reform is Kiwi Farms, which is a specific website, but the name is used generally to cover the variety of digital cesspools created and operated by Joshua Connor Moon.

Moon was the original developer for 8chan, a digital cesspool created by Fred Brennan, who found 4chan to be too polite and confining. Fred sold 8chan to its current operator, Jim Watkins, who used it to incubate the Qanon cult. There are two fine Mother Jones articles on Watkins, QAnon Is Supposed To Be All About Protecting Kids, and QAnon’s Chief Enabler Ran a Website Where He Brushed Off Concerns About Pedophilic Content.

Those two articles were a team tackle involving me, 420chan founder Aubrey Cottle, and 8chan founder Fred Brennan, who had distanced from them after the Christchurch Massacre. Aubrey, Fred, and I are limited purpose public figures. There were others who made material contributions, if they contact me and INSIST that I include them, this paragraph will get edited. I think they prefer to remain anonymous.

Attention Conservation Notice:

The lede has all the background you need. The rest of this article is fairly technical infrastructure analysis that was done in an effort to get at Moon or Kiwi Farms before they trigger another mass shooting.

Origins:

The first time Moon’s mess qualified for an article here was Crack Babies Of Kiwi Farms, just a week ago, and then Kiwi Farms Crack Baby Butthurt quickly followed. The origins of this attention go back several years. There are some avowedly neo-Nazi corners of Moon’s sprawling shithole and one of them was bothering a retired U.S. military officer known to both Paul Cobaugh and I. The victim and I discussed this and at the time the best thing was to simply extract him.

But Kiwi Farms seldom bathes, it never sleeps, and it wasn’t long before they claimed another victim. Their murder of Super Nintendo game developer Near on June 27th of 2021 absolutely incensed me. I’ve never even owned a Nintendo product and didn’t know that kid at all. I will admit that I watched one of my favorite clips from Boardwalk Empire while pondering what to do.

What follows is an update of the material I made public back then.

Infrastructure Analysis:

Inspecting one of Moon’s know domains., we find a clue in the form of what appears to have been a configuration slip in late 2019, revealing Autonomous System 397702, which belongs to 1776 Solutions, LLC. See The Shape Of Cyberspace if you don’t know what an AS is. You can think of it as being akin to an area code for public IP addresses.

This is a historic thing, only visible to those who have things like RiskIQ. The average internet sleuth would not be able to find this using free tools.

Prior to being called 1776 Solutions, Moon’s company was named Final Solutions.

So there’s no question that this belongs to Moon - has his name on it, and some of his infrastructure was within the single IP prefix 103.114.191.0/24, which is associated with AS397702.

This autonomous system is a bit curious, as it only offers 103.114.191.0/24 via BGP and it has just a single peer. BGP is almost always implemented to provide multiple upstreams, as seen here for AS53340. The owner of that AS, VegasNAP, is not large. The owners absolutely knew what they were doing in platforming Moon.

What is Flow Chemical PTY, the company name that keeps coming up in searches?

Flow Chemical PTY is an Australian shell company that’s never done much, but it’s interesting that the principal is Vincent Zhen, from Hohhot, China. Kinda makes you wonder if Chinese intel is funding Moon and maybe the chemicals that are flowing are fentanyl precusors, eh?

Here are the particulars on the company from someone used to doing asset searches in Australia.

Counterintelligence:

What do we know thus far?

• We see the infrastructure for a site that’s providing Stochastic Terrorism as a Service, and given that the owner’s shell company was Final Solutions LLC, that tells us something about his world view.

• There is intentional deception on the ownership of the company but the end of the trail is a Chinese national, and again the Flow Chemicals PTY shell company name begs the question … which chemicals?

• A company called VegasNAP is platforming Moon and if you go digging you’ll find Tea Party connections to the owners.

I can not show the trail of how I know, but Josh Moon fled the U.S. to Kremlin friendly Serbia some years ago. He gets taunted about his only alternate career choice being as an eastern European farm hand. The other notable figure who left the U.S. and passed through Serbia is Andrew “Weev” Auernheimer, the CTO of Daily Stormer. When asked about his location, Auernheimer described it using a Serbian colloquialism that roughly translates to “Where the wolves fuck”, hinting at the remote nature of the place. I would very much like to know if they both passed through the same farm.

This all adds up to something that FBI counter intelligence should be all over.

Perhaps they already are …

Undercover:

What would an FBI investigation in that environment look like?

It could involve a known informant, like James “Pissboy” McGibney. He features heavily in my OIG complaint against the Dallas FBI field office.

Two people who worked with Pissboy got into trouble. Derek Lostutter got put away for some Steubenville stuff. Then Roy Arcadio Jimenez aka 5hm00p got in trouble for cracking Solujahboy’s Twitter account and using it to harass a career troll named Jennifer Emick. As you can see from the linked article, 5hm00p was plagued with guilt over being involved in the operation to locate his former friend Junaid Hussain, who had become a leader of online operations for ISIS. He died in a drone strike in Raqaa in August of 2015.

I will not show precisely how I know, but one of the people in Crack Babies of Kiwi Farms / Kiwi Farms Crack Baby Butthurt appears to be getting information from Pissboy. Given McGibney’s history, I hope these babes in the cesspool are not having extensive logged chats or conference calls about how to direct some stochastic terrorism my way. I mean it’s not like Tom Retzlaff avoided a Proud Boys assassination plot, then later got stabbed to death in his doorway … oh, wait …

Conclusion:

Kiwi Farms evolved in an environment of victimizing marginalized individuals, many of whom committed suicide. They’ve faced significant opposition since Near’s death. Clara “Keffals” Sorrenti has a bit of Al Capone in her - she did manage to knock them offline and keep them off for a long period of time. Liz Fong-Jones and Katherine Lorelei are pursuing a lawsuit, which is good, but such things can drag on for years.

When the story mentioned in MIOS: Doin’ A FISA breaks I have no doubt there will be counterintel attention on that. And since these things come in threes, once that is out I will explain why I am Rushing Into Semrush, which has at its roots ANOTHER problem that demands counterintelligence scrutiny.

This article is full of stuff that should have excited the attention of the FBI counterintelligence function years ago. I say “should” because the utter lack of visible activity makes me think that Kiwi Farms are the virtual equivalent of the Proud Boys - a group the FBI had treated as “friendlies”, prior to the January 6th Capitol Siege.

Multifaceted Overwatch isn’t an academic exercise, things are escalating pretty quickly. The Malign Information Operations Safari will continue, but it would be great if we could see some serious attention on Kiwi Farms and their ilk prior to November’s Civil War Referendum.

The last thing this country needs is a demand aggregator site radicalizing and matching locals to foreign agents, and that is precisely the roll Kiwi Farms is playing.