Bad Gateway: How Deplatforming Affects Extremist Websites

Author Bio

Megan Squire was a 2021-22 ADL Center for Technology and Society Belfer Fellow and is deputy director of data analytics and open-source intelligence at the Southern Poverty Law Center. She applies techniques from data science and cybersecurity to track and expose networks of hate and extremism online. Dr. Squire was previously a professor of computer science at Elon University. Recognized as a global authority on right-wing political extremism, she has been featured in Wired, NPR, The Washington Post, The Wall Street Journal, The Guardian, and many other outlets.

Executive Summary

Deplatforming websites—removing infrastructure services they need to operate, such as website hosting—can reduce the spread and reach of extremism and hate online, but when does deplatforming succeed? This report shows that deplatforming can decrease the popularity of extremist websites, especially when done without warning. We present four case studies of English-language, U.S.-based extremist websites that were deplatformed: the Daily Stormer, 8chan/8kun, TheDonald.win/Patriots.win, and Nicholas Fuentes/America First. In all of these cases, the infrastructure service providers considered deplatforming only after highly publicized or violent events, indicating that at the infrastructure level, the bar to deplatforming is high. All of the site administrators in these four cases also elected to take measures to remain online after they were deplatformed. To understand how deplatforming affected these sites, we collected and analyzed publicly available data that measures website-popularity rankings over time.

We learned four important lessons about how deplatforming affects extremist websites:

• It can cause popularity rankings to decrease immediately.
• It may take users a long time to return to the website. Sometimes, the website never regains its previous popularity.
• Unexpected deplatforming makes it take longer for the website to regain its previous popularity levels.
• Replicating deplatformed services such as discussion forums or live-streaming video products on a stand-alone website presents significant challenges, including higher costs and smaller audiences.

Our findings show that fighting extremism online requires not only better content moderation and more transparency from social media companies but also cooperation from infrastructure providers like Cloudflare, GoDaddy, and Google, which have avoided attention and critique.

Background

What is deplatforming? Internet-based services and social media sites often establish policies outlining expectations for user behavior. Typically, these agreements describe broad categories of activities that are disallowed, such as posting pornography, spam, hate speech, and illegal content. When a user violates one of these agreements, the service can react by removing the content, limiting site features, or suspending the account of the user who violated the policy. In this report, “deplatforming” refers to removing any individual or group from an internet service, whether a social media platform, web host, or infrastructure provider.

Social media companies such as Google, Meta, and Twitter regularly ban individuals, groups, and even entire networks of users from their services, citing violations of policies against inciting violence, harassing other users, or spreading misinformation. Some of these banned users retreat to their own self-hosted websites—or create new sites—so their behavior stays outside of the reach of content moderation teams.

Though unencumbered by the policies of social media companies, extremist websites face many new challenges, the most critical being that self-hosted websites must find and purchase their own hardware and software infrastructure to stay online.

There are three main categories of infrastructure that keep websites running: domain registrars, web-hosting companies, and security-protection companies.

1. The website must be able to register and keep a domain name. A domain name, such as google.com or adl.org, is how visitors find a site. If a website is removed from domain-name services, it becomes much more difficult, if not impossible, to find. 
2. Web-hosting companies and content distribution networks (CDNs) provide digital storage space for all the files, pictures, videos, and software that make up the content on a website. When a website loses its hosting provider, the site’s content disappears. Losing a CDN can cause slow service for high-traffic sites.
3. A third category of infrastructure provider includes companies that protect websites from external security risks such as distributed denial of service (DDoS) attacks. DDoS attacks flood a website with fake traffic to overwhelm it, rendering it unable to answer normal user requests. If an infrastructure company such as the network-security firm Cloudflare refuses to provide DDoS protection to a vulnerable website, it is vulnerable to being flooded with traffic, rendering it inaccessible.

Still, extremist websites may find self-hosting worthwhile because the infrastructure providers that keep them running may be more reluctant to engage in deplatforming than social media platforms are. For example, in September 2022, Cloudflare canceled its DDoS-protection and domain-registration agreements with KiwiFarms, an online forum known for hosting and enabling hateful content and harassment campaigns against LGBTQ+ people and others. Cloudflare made its decision reluctantly and only after facing a rash of bad publicity. The company’s CEO, Matthew Prince, said the “revolting” content on KiwiFarms—for which Cloudflare had provided service since at least 2016—had risen to the level of an “unprecedented emergency and immediate threat to human life.”

When a website is finally cut off from infrastructure services, there are only two possible paths forward: replacing the lost service with another provider or closing down. In this study, we examine what happened to four different extremist websites that were deplatformed but whose proprietors decided to continue operating.

• The Daily Stormer, a neo-Nazi website created in 2013, was first deplatformed in 2017 and has struggled to remain online after 16 different domain name changes. 
• 8chan, a website where users anonymously post hateful content, began in 2013 and was deplatformed in 2019. The site rebranded itself as 8kun and found new infrastructure providers. 
• TheDonald began as a Reddit discussion board in 2015 and was banned in 2020 for repeated violations of policies against harassing and targeting other users with hate speech. The community regrouped on a self-hosted, stand-alone website before once again switching infrastructure providers and rebranding as Patriots.win in 2021. 
• Nicholas Fuentes is a white nationalist and antisemitic internet personality who was deplatformed from numerous video-streaming services, including YouTube and DLive, before building his own website with streaming capabilities. 

Our goal was to use these four case studies to understand how and when infrastructure-level deplatforming takes place, what happens to websites deplatformed in this way—particularly in terms of popularity—and what makes these types of website removals effective.

Data Sources

One way to understand the effect of deplatforming is by measuring a website’s usage statistics before and after its critical infrastructure services are removed. But since we do not have access to the internal logs of each website, we sought an alternative source of data about site traffic and usage.

We decided to measure the effect of deplatforming extremist websites by using two free, publicly available domain-ranking lists: the Alexa Top 1 Million and the Cisco Umbrella Top Million. Researchers use such lists as indicators of site popularity because they are free and available for multiple years.

But Top Million lists also have a few limitations as indicators of site popularity. First, Top Million lists are incomplete substitutes for information about site traffic that could be gleaned more accurately from reading server logs, for example. Web server logs are only available to the administrator of a website, but they show the exact web pages and images requested by each site visitor, the precise date and time of each request, and the type of browser the visitor used. Top Million lists, no matter how they are constructed, are not as precise, since they use approximations of site traffic. Next, one of the main ways that users discover websites to visit is through search engines. Search engines like Google and Bing use proprietary algorithms to determine which content to suggest as the best result of a user’s search. These algorithms change frequently and may demote extremist content or domains at any given time, leading to fewer visitors and thus lower rankings in the Top Million lists.

Cisco Umbrella. Our first data set comes from Cisco’s Umbrella OpenDNS service. OpenDNS is used by millions of computers around the world to translate human-friendly domain names (e.g., adl.org) into the numeric addresses computers need to find each other on the internet. The Umbrella Top Million list, first released in January 2017, ranks websites by how many OpenDNS users have requested a domain name. The Umbrella data set is compiled by counting these passive DNS requests and ranking the top million websites each day. Because there is no requirement for participation by the web visitor, there is less risk of bias by the Hawthorne effect, when visitors to extremist websites change their behavior because they know they are being surveilled. Another advantage of DNS requests is that they also apply to types of digital content other than web content—for example, email and mobile apps. This ranking method has the potential to be a more accurate proxy for a broader range of user behavior than top-list methodologies relying solely on web-browser content are.

Alexa. Now discontinued, Alexa was a top-list service that ranked websites using a proprietary methodology based largely on the activities of its users, who installed its browser extension and had their web traffic compiled into the rankings. Unlike the Umbrella data, Alexa users were active participants in the data-collection effort, and only web traffic was included. The advantage of Alexa data is that it is long-running. Since the Alexa archive included files beginning in 2009, we knew it would include data from the early days of dailystormer.com and 8chan, predating Cisco Umbrella’s coverage.

We retrieved the entire history of Alexa Top Million lists from the archive server associated with the top lists comparison paper from Naab et al. We retrieved the Cisco Umbrella top million lists from Cisco’s archive server. We downloaded each of the daily files of the top 1 million sites, selected any domain matching our case studies, and loaded each day’s rank for that domain into a database. In total, there were 4,871 Alexa daily files and 2,113 Umbrella daily files.

Our primary method of analysis was a day-by-day ranking comparison over time for each domain. The domains tended to be used linearly, with one being deplatformed and the next taking its place, which lent to a longitudinal comparison. We then produced day-by-day ranking comparisons for each data source and each case study. However, given the limitations of top lists in general and Alexa and Umbrella top lists specifically, we focused on finding broad patterns that persist across multiple weeks or months rather than looking at single-day peaks or valleys.

Case Studies

The Daily Stormer is a neo-Nazi blog run by Andrew Anglin that publishes racist, antisemitic, and misogynistic content. Anglin uses his blog to incite his followers—whom he calls his “troll army”—to target and harass individuals. He has lost multiple lawsuits related to his role in spearheading harassment campaigns. As a result of the damage he and his website have wrought, Anglin has been found liable for millions of dollars in restitution to his victims, none of which he has paid. His current whereabouts are unknown.

Following public outrage over the Daily Stormer’s role in promoting the 2017 “Unite the Right” white-supremacist rally in Charlottesville, Virginia, and Anglin’s articles mocking the victims who were killed and injured at the event, GoDaddy canceled the blog’s dailystormer.com registration. Over the next two days, two other domain registrars, Google and Tucows, also refused to register the domain. Additionally, Cloudflare, a network-security company, banned the domain from its services, leaving it vulnerable to DDoS attacks. While the Daily Stormer was able to find a substitute service for DDoS protection, which was called BitMitigate, it has struggled with domain registration.

Faced with declining interest in the Daily Stormer, Andrew Anglin applied the tagline “The Most Censored Publication in History”' to his blog in a desperate bid to draw attention. On November 30, 2017, he took to the fringe social platform Gab to advertise his latest domain name, pleading with readers to return. He wrote, “Ok. We’re at dailystormer.red. No idea what this is or how long it will last. But we have to keep doing this. People are noticing. We are going to change how the internet works. The cavalry is coming.”

But the cavalry never came. In the four years since its initial deplatforming, the website domain has been canceled and moved 17 times. The Daily Stormer also now mirrors its content on a “dark web” site that is visible only to users who use the specially designed browsers required to navigate this hidden network. Both data sources, Alexa and Umbrella, show that consistent infrastructure-level deplatforming can be crippling, particularly if the domain name is canceled repeatedly before traffic begins to rebuild. 

Since most of the Daily Stormer domains were online for just a few days or weeks, we visualized rankings for five of the domain names that had enough data to show up in the lists consistently: dailystormer.com, dailystormer.red, dailystormer.name, dailystormer.su, and stormer-daily.rw.

https://www.datawrapper.de/_/wfAUm/

The Alexa data shows a sustained level of interest indailystormer.com from 2014 to 2017. Following the “Unite the Right” tragedy, the site lost its .com domain extension, or “top-level domain” (TLD), and cycled through seven others before finding temporary respite at the dailystormer.red domain. The website was able to keep the .red TLD for approximately two months.

After the dailystormer.red domain was deplatformed in February 2018, the site moved to dailystormer.top, which was quickly canceled, and then to dailystormer.name, where it stayed for two years. The site then switched to the dailystormer.su domain in February 2020. As of February 2022, online domain registration records indicate that the .su domain name was canceled for failure to pay registration costs. The site was subsequently changed back to the .name TLD for almost two months before it too was canceled.

The Alexa rankings data indicates that it was easy for dailystormer.red and dailystormer.name to achieve rankings that were nearly as high as dailystormer.com. However, the data shows that by the time the site rebranded for the 12th time, becoming dailystormer.su in early 2020, it struggled to maintain the same level of attention on a regular basis.

The 15th rebrand (to stormer-daily.rw) remained untouched for five months, until late October 2022, when it too was canceled by the registrar. A few days later, Anglin advised a supporter on how to create domains to mirror Daily Stormer content, saying, “I would say that you probably shouldn’t have used ‘dailystormer,’ as it makes it a lot more likely to get shut down....Also, using that domain means it’s auto-blocked from the first like, 5 pages of google [sic].”

https://www.datawrapper.de/_/2myaX/

The Umbrella data tells a more nuanced story. First, the large rankings spike of August 12, 2017, is clearly visible in the graph. This spike is followed by an immediate, sharp decline in rankings as the domain experienced its first disruption on August 13. Interest in the site waned considerably, as measured by Umbrella’s passive domain requests, and by the time the .red domain was established in late November 2017, rankings were only at a quarter or less of their former levels. The .name domain, which existed for two years, also never achieved rankings anywhere near as high as 2017 levels.

The .name deplatforming and subsequent move to the .su TLD had a more devastating impact on the Daily Stormer. Rankings for the dailystormer.su site were low to nonexistent for most of 2020 despite the global coronavirus pandemic and the Black Lives Matter protests in the United States, both of which increased interest in far-right and disinformation content online.

8chan/8kun: A Case of Rebranding

In 2013, software developer Fredrick Brennan created 8chan as an “imageboard” style of website, similar to 4chan, where users can anonymously post and discuss pictures and text. The site was relatively unknown until September 2014, when a targeted harassment campaign against female video game designers, known as Gamergate, erupted on 4chan. After 4chan administrators banned any discussion of the Gamergate controversy, participants chose 8chan as their new online home.

In January 2015, domain registrar Internet.bs canceled the 8chan.co domain for hosting child sexual abuse images. Brennan relaunched 8chan using a new domain, 8ch.net, which had been previously registered but used for different (largely anime and adult) content. Brennan left 8ch.net in mid-2016, and the new administrators were father and son Jim and Ron Watkins. News media began to cover 8chan in 2017, when one of its users, known only as “Q,” used the site to post the series of messages that eventually grew into the QAnon conspiracy theory. In 2019, the perpetrators of three different mass shootings posted their manifestos on 8chan. After the last of these incidents, which took place in El Paso, Texas, in August, Cloudflare canceled 8chan’s DDoS protection, and Tucows canceled its domain registration. Less than a day later, both of these services were reinstated by Epik and its DDoS protection subsidiary, BitMitigate. After two days, Epik reversed course and dropped 8chan from both services. The website went through several more rounds of deplatforming and name changes before relaunching with a new name, 8kun.top, in November 2019.

The 8chan data illuminates a few key findings about unplanned network disruptions. First, if a canceled domain name is allowed to be redirected to a new domain, as it was with 8chan in 2015, the disruptive effect of moving is lessened. There is a period of overlap as users get used to the new domain, but it is short. Second, as with the Daily Stormer case, the 8chan data shows that an unplanned domain-name cancellation with no redirects can reduce site rankings to half or less of their previous levels.

https://www.datawrapper.de/_/6ehSY/

Data from Alexa indicates that 8chan’s rankings were high beginning in September 2014 due to the influx of 4chan/Gamergate users. In January 2015, when 8chan.co was deplatformed by Internet.bs for hosting child sexual abuse content, the data shows the disruption was only moderate; 8chan quickly rebranded and switched domain name registrars, and site owner Fredrick Brennan successfully petitioned Internet.bs to allow him to redirect the 8chan.co domain to the new 8ch.net domain. Consequently, users could find the site easily, and 8chan was back to its prior rankings in less than a month.

The diagram shows several periods in the site’s history when there were overlapping domain names. One such overlapping period happened in early 2015; others are in early 2016, with shorter ones in 2020. Such “domain confusion” typically occurs around periods of disruption or deplatforming, such as when domain names suddenly change. It can also happen when a previously banned domain name becomes functional again or when media coverage elevates an old domain name. These periods of overlap are usually short-lived.

8ch.net reached its highest daily Alexa ranking of all time (886 out of 1 million sites) on March 17, 2019, following the revelation that the Christchurch shooter had posted his manifesto on the site. In August 2019, the rankings show a precipitous drop following the El Paso mass murder and subsequent deplatforming. The Alexa rankings also show a long dormant period between the site’s August deplatforming and its rebrand as 8kun. Since 2020, the Alexa data shows, the new 8kun.top domain rankings have never been as high as those of its predecessor. Rankings have been spotty, and there have been many days when the site failed to reach a top million ranking at all. The site’s performance in the year following the January 6 attack in the U.S. Capitol was even worse; the site failed to rank among the top million most days.

https://www.datawrapper.de/_/rrQj8/

The Umbrella data set begins in 2017 and thus cannot show the effects of 8chan’s deplatforming in January 2015. However, the Umbrella data confirms that on March 16-19, 2019, 8ch.net achieved an average daily ranking of 78,000, putting it in the top 10% of 1 million sites during the four-day span. On August 5-7, 2019, the site peaked with a three-day average rank of 77,000 out of 1 million sites. The impact of the August 2019 deplatforming is clearly visible as well. The Umbrella data differs from the Alexa data during this time, however, showing that some users still issued DNS requests for the 8ch.net domain for the remainder of 2019. In November 2019, however, the 8kun.top domain launched, and by early 2020 the traffic trying to find 8ch.net had dropped to almost none. As with the Alexa data, the Umbrella rankings for 8kun.top indicate that the site has struggled to regain its position before the deplatforming and rebrand.

TheDonald.win/Patriots.win: Two Planned Disruptions

TheDonald is a discussion forum for fans of Donald Trump. The forum began on Reddit in 2015, but starting in 2019, the platform began to take action against the group for targeting and harassing other users with hate speech. First, Reddit put the forum into quarantine status, which means that it added a screen asking users, “Are you sure you want to visit this community?” and requiring affirmative consent before redirecting them to the forum. In 2020, Reddit finally banned r/The_Donald permanently, and many of its users moved to a stand-alone website using the domain TheDonald.win. Eventually, the proprietor of TheDonald.win voluntarily shut down the site following the January 6 attack at the U.S. Capitol. Some of TheDonald users then migrated to a separate website on a new domain called Patriots.win, run by a different administrator. Of the four cases in this report, TheDonald represents the only one where part of the deplatforming was self-imposed.

The effect of the deplatforming on audience size before and after the Reddit ban was significant. The Internet Archive indicates that the r/The_Donald subreddit regularly attracted over 700,000 subscribers, with upward of 10,000 online at a given time. Since the move to TheDonald.win and Patriots.win sites, numbers have been considerably smaller, with the website attracting only 20% as many users as the Reddit forum. Data from social media monitoring service SMAT indicates that there are just over 157,000 unique usernames in use on TheDonald.win/Patriots.win forums. Although TheDonald community lost access to critical forum infrastructure twice, once on Reddit and once on its own domain, because the site administrators were given notice, they could create contingency plans and thus relaunch the site quickly. 

https://www.datawrapper.de/_/wTkVD/

https://www.datawrapper.de/_/GWqd5/

The effect of deplatforming on the domains was predictable: the Reddit ban drove traffic to the stand-alone website, and the subsequent shift from TheDonald.win to Patriots.win resulted in only minimal disruption. Both the Alexa and the Umbrella data sets show that after a slow start in November 2019, the rankings for TheDonald.win became consistent in spring of 2020, after Reddit placed restrictions on the channel. By the time Reddit banned the community in June 2020, the replacement website was going strong, regularly ranking among the top 10,000 sites according to the Alexa data. This shows that Reddit’s many warnings were sufficient to let the community slowly regroup elsewhere. Following the migration to Patriots.win in January 2021, both data sets show similar small disruptions. The small rankings decline shown in the Umbrella data disappeared within six months.

For both periods of disruption, during the Reddit bans and the post-January 6 migration, the Umbrella data is slightly more conservative, placing TheDonald.win only in the top 300,000 websites for most of 2020 and in the top 200,000 toward the end of that year.

Nicholas Fuentes/America First: Raising the Cost of Bad Business

Nicholas Fuentes is a white nationalist video streamer and former social media personality who promotes his racist, antisemitic ideas under the America First brand. On his nightly live-streamed video show, Fuentes promotes Holocaust denial conspiracies; denigrates women, LGBTQ+ people, and people of color; promotes vaccine misinformation; and targets individuals and groups for harassment. Initially, Fuentes did not place as much emphasis on using his website as the other case study subjects in this research did. Instead, he relied on social media platforms, particularly Twitter and YouTube, to spread his message. Fuentes live streamed on YouTube for more than three years before he was banned from the platform in February of 2020 for violating its terms of service. During this time, his domain, NicholasJFuentes.com, was mostly used to sell merchandise and served as a repository for old videos, which he charged a small fee, typically $5 per month, to access.

To our knowledge, none of the domains associated with Fuentes or America First has ever been banned or disrupted by a hosting provider, domain registrar, or other infrastructure company. This case study examines what happened when Fuentes was deplatformed from video streaming, a piece of critical infrastructure. The deplatforming forced Fuentes to carry the costs for building and maintaining his own video-streaming solution.

After his YouTube ban, Fuentes moved to a small video live-streaming platform called DLive, which had many of the same features as YouTube, including the ability to take donations. Fuentes was adept at coaxing his fans to donate money to him using DLive’s version of the YouTube “Superchat” function. Superchats on YouTube and similar pay-to-chat features elsewhere encourage users to attach a monetary donation to their comments to boost them to the top of the queue and catch Fuentes’ attention. Many hosts encourage donations by reading boosted comments aloud or answering boosted questions. Our prior work showed that Fuentes earned more than $114,000 from DLive viewer donations between April 2020 and January 2021.

DLive banned Fuentes following media coverage of his presence on the Capitol grounds during the January 6 attack and his use of DLive to solicit donations while promoting the “Stop the Steal” lie, contending the 2020 presidential election was fraudulent.

Running out of options for free video streaming services, Fuentes then came up with a new strategy to continue producing his nightly broadcast. Despite his ban from YouTube, Fuentes began using borrowed YouTube accounts to live stream videos that he classified as “unlisted” so they would not appear in searches. He then embedded the videos on his website to create the appearance that he hosted them using his AmericaFirst.live domain. Through this strategy, Fuentes avoided paying the high cost of hosting his large-bandwidth video streams while remaining under the radar of YouTube’s content moderation team.

We reported Fuentes and his scheme to YouTube dozens of times throughout February 2021, and YouTube sometimes took action retroactively by banning the hijacked streams. In a February 8, 2021, video streamed through one of his secret YouTube channels and embedded on the AmericaFirst.live domain, Fuentes reflected on his history of being deplatformed:

“And I think it's important to acknowledge, especially now in light of what’s been going on, you know we’re now facing total deplatforming. Something which I always knew would happen. I mean, I always knew from the day I started this show that total deplatforming would occur. Deplatforming, in other words, from everything in a total capacity. And not just from the platforms but from the services too. I always knew that day would come.”

There is no evidence that Fuentes ever lost domain registration or web hosting services, but when he made these comments, he was facing the choice of whether to abandon video streaming or rebuild his streaming capability on an infrastructure that he controlled but had to pay for. It appears that he decided to host his own content reluctantly. Later that month, a software developer worked with Fuentes to create a new, self-hosted video-streaming solution that did not use YouTube. However, to keep the bandwidth costs affordable and remain under the radar of Fuentes’ web hosting provider, this developer also purchased a domain called FoxtrotStream.xyz, which used a different hosting provider and a peer-to-peer video distribution mechanism that divided the bandwidth load among his viewers. In late 2021, Fuentes and his software developer expanded this streaming infrastructure into the Cozy.tv domain, which was intended to serve as an umbrella platform for multiple other streamers banned from YouTube and DLive. As of April 2022, Cozy.tv hosts over 60 streamers.

However hesitant he was to create his own infrastructure, Fuentes finally did commit to the Cozy.tv project. It therefore stands to reason that, unlike the other case studies in this report, Fuentes’ new, self-hosted domains saw increased traffic after he was deplatformed from social media. Still, the number of individuals tuning in for his broadcasts is much smaller than it was when he was streaming on YouTube and DLive. Nightly viewer counts for Fuentes’ videos on Cozy.tv are in the thousands, not the tens of thousands he was able to pull in on DLive during the run-up to the 2020 election and in its aftermath. This shows that even if extremists try to create their own self-hosted infrastructure following a social media ban, it will come at great cost both financially and in audience size.

https://www.datawrapper.de/_/u1pKG/

The Alexa data shows little interest in the NicholasJFuentes.com domain. Following the January 6 attack at the Capitol and Fuentes' subsequent removal from DLive, the AmericaFirst.live domain began to rise in the rankings. The data also shows that the Cozy.tv domain replaced the AmericaFirst.live domain in the rankings upon its debut in October 2021. One interesting artifact of the way Alexa data is collected is that the FoxtrotStream.xyz domain is not ranked in the top million on any day despite being the underlying host domain for nearly all of the streaming on AmericaFirst.live and Cozy.tv. This is because of the way Alexa collects data, which is based on what sites users types into their browsers, as opposed to monitoring the complete set of underlying domain name requests as the Cisco Umbrella product does. 

https://www.datawrapper.de/_/voyZw/

The Umbrella results, because they are collected based on passive monitoring of all requests to the domain name system, show that the NicholasJFuentes.com domain was not in the top million sites on any day, and the AmericaFirst.live and Cozy.tv domains were listed only a few times. Most of its top million rankings were for the FoxtrotStream.xyz domain because it received the most streaming traffic requests. This data reflects the fact that Fuentes is now responsible for the direct costs (such as bandwidth charges) and indirect costs (such as software development) that come with managing his video-streaming traffic rather than using a social media company to absorb these costs.

Conclusion

Our findings suggest that deplatforming is worthwhile and makes it harder for extremists to spread their ideologies, recruit adherents, and profit from hateful content.

With some sites, such as the Daily Stormer and 8chan, the negative impact of the deplatforming on domain rankings seems immediate and significant. The Daily Stormer rankings were devastated by persistent domain removals, and the site remains a shell of its former self after changing top-level domains 16 times.

8chan was similarly impacted for many months after its 2019 deplatforming. However, the response was less intense than it was with the Daily Stormer, possibly because 8chan rebranded to a new domain name, whereas Daily Stormer only ever changed its top-level domain or domain extension. Also, 8chan had the dubious honor of acting as the main source for new QAnon conspiracy content (“drops”) before, during, and after its 2019 deplatforming. These factors may have helped moderate the drop in 8chan’s domain rankings.

TheDonald/Patriots.win showed less long-term impact from its deplatformings. First removed from Reddit and later from its own stand-alone Reddit clone site, TheDonald was able to bounce back quickly in both cases, perhaps due to foreknowledge of the impending actions against it.

Rankings for Nick Fuentes' websites were extremely low to nonexistent until he chose to create his own stand-alone video-streaming domain in 2021. He did this reluctantly after being deplatformed from no-cost options such as YouTube and DLive. The data indicates that Fuentes’ rankings for the new, self-hosted video domain increased compared to his previous domains. Notably, however, he was then forced to shoulder the cost of providing streaming services on his own infrastructure rather than getting this service for free.

Together, these case studies illustrate that deplatforming is most effective when it is carried out consistently and persistently, when extremists have little forewarning, and when the cost to achieve a replacement solution is financially and reputationally prohibitive.

Recommendations

Perhaps the most important result of this study is that deplatforming at the infrastructure level can reduce the popularity of a site and thus its reach and, potentially, its influence. However, we also demonstrate that this effect is not necessarily permanent or guaranteed. The internet was built on protocols designed to minimize single points of failure, so that one node in the network going down would not disrupt the whole system. It stands to reason that, similarly, a single infrastructure disruption will be unlikely to keep a website permanently offline.

Instead, for deplatforming to be effective at the infrastructure level, it requires sustained, persistent action. Websites that were deplatformed on multiple infrastructure services at once were much less likely to rebound quickly. If a website has already diversified its vendors, a comprehensive approach to deplatforming would require coordination among multiple companies to be effective. Similarly, websites that were notified of a permanent action against them or were allowed ample time to move their content were far more likely to create backup plans and regroup. Companies should design a warning system that is reasonable but not deferential to the whims of bad actors.

We recommend that infrastructure companies take the following steps when deplatforming an extremist website:

• Anticipate defensive reactions. Techniques such as rebranding, claiming new ownership, vendor swapping, and bringing critical infrastructure in-house are common responses to deplatforming. Companies should anticipate and plan a response to these actions. 
• Create a multi-company task force or working group to combine efforts. Websites that were deplatformed by multiple infrastructure service providers at once were much less likely to bounce back quickly. However, if a website has diversified its vendors, such a blanket approach requires coordination among multiple companies to be effective. 
• Limit advance notice about impending permanent removal. Websites that were given warnings were much more likely to create backup plans and rebound quickly.

Advocacy organizations have a role as well: carrying out sustained pressure campaigns to persuade infrastructure companies to drop clients whose sole purpose is to be a platform for hate, especially if they take no steps to mitigate the hate or specific people are targeted. Cloudflare cut The Daily Stormer, 8chan, and, more recently, the harassment website KiwiFarms, after trans Twitch streamer Keffals was swatted by trolls and went into hiding. After intense public pressure, Cloudflare finally dropped KiwiFarms as a client.

For researchers, policymakers, advocates, and others who are assessing the effectiveness of deplatforming strategies, we recommend:

• Go deeper than social media. Many of the worst offenders in peddling hate and extremism online have already been booted from social media platforms and are hosting content on their own websites. While it may be more complicated to figure out the maze of companies involved in domain registration and website hosting, it is important to put pressure on infrastructure providers that host extremists.
• Track extremist websites as they seek new providers. Websites that lost critical infrastructure almost always tried to replace it with a similar service, and because there is little coordination among infrastructure providers, bad actors can easily replace lost services with competing products. It is crucial to continue to follow the trail as deplatformed websites move their businesses around.
• Focus on making users safe. In evaluating the effectiveness of deplatforming, consider the big picture. Is the website owner now so busy trying to keep their site online that they cannot organize more harassment campaigns? Is it costing them a fortune to keep switching providers? Are they losing credibility with their audiences? Remember that while it is not a perfect solution, deplatforming can increase the total cost of doing business for extremist websites. It slows down their activity and can make the internet safer for targets of hate and extremism.

Finally, we recommend that when companies decide how to respond to extremist content, they prioritize their commitments to the larger community of internet users, particularly marginalized groups and those targeted for abuse. Even if the task of deplatforming bad actors is tedious and imperfect, it is necessary to prevent the spread and normalization of hate. 

Glossary

4chan

4chan was founded by Christopher Poole in 2003 as one of many “imageboard” types of websites where users can anonymously post and discuss pictures and text. The first imageboards were developed in Japan for discussions of anime and popular culture.

8chan/8kun

8chan was developed by Fredrick Brennan in 2013 as an alternative to 4chan and other “imageboard” style discussion forums. In 2019, the perpetrators of massacres in Christchurch, New Zealand; Poway, California; and El Paso, Texas all posted their manifestos to 8chan. Later that year, after widespread deplatforming, 8chan rebranded to 8kun.

Alexa Top 1 Million List

The Alexa Top 1 Million List was a website ranking system developed by Alexa Internet, a company started by one of the founders of the Internet Archive. Amazon acquired Alexa Internet in 1999. The Alexa Top 1 Million List was launched in 2009 and was retired in May, 2022. The Alexa ranking methodology relies on a proprietary blend of factors, including counts of visits by a panel of users who have installed a special browser extension. See also Cisco Umbrella Top Million List.

BitMitigate

BitMitigate was founded in 2017 by Nick Lim as an alternative to Cloudflare. It provides network-security services such as protection against distributed denial of service (DDoS) attacks, which flood a website with traffic and render it unusable. Epik purchased BitMitigate in 2019.

Cisco Umbrella Top Million List

The Cisco Umbrella Top Million List is a website ranking system developed by network-security company Cisco and first released in 2017. The Umbrella methodology ranks websites based on the number of internet user domain requests issued for that website on a given day. See also Alexa Top 1 Million List.

Cloudflare

Cloudflare was founded in 2010 as a network-security company providing protection against certain types of malicious behavior such as distributed denial of service (DDoS) attacks, which flood a website with illegitimate traffic, rendering it unable to respond to legitimate user requests. 

Cozy.tv

Cozy.tv is a website created by Nicholas Fuentes in 2021 to serve as a clone of popular video-streaming sites such as YouTube. Cozy.tv currently features content from around 50 different internet performers, many of whom have been banned from mainstream video-streaming sites.

The Daily Stormer

The Daily Stormer is a neo-Nazi blog started in 2013 by Andrew Anglin. The site features hateful, antisemitic, and misogynist content produced by Anglin and a small roster of hired writers, much of it fashioned as commentary on news stories and occasional opinion pieces. The site has cycled through at least 15 domain names as it has been deplatformed by various domain registrars.

Dark Web

The term “dark web” refers to a special network that is overlaid on the regular internet and is only visible using special software and domain names.

Distributed Denial of Service (DDoS) Attack

A distributed denial of service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target with a flood of internet traffic to prevent users from accessing a site.

DLive

DLive is a video live-streaming platform started in 2017. It was designed for an audience of video gamers and fans who want to watch live streams of gameplay. The site allows viewers to send “tips” to streamers using an in-house currency called lemons. Many far-right extremists, such as Nicholas Fuentes, began using the site in 2020 after being removed from competing sites for violating their usage policies. BitTorrent purchased DLive in 2019.

Domain Name Service (DNS)

Domain Name Service (DNS) is the naming system used to map domain names to locations on the internet. The authority for distributing domain names is delegated to a list of domain registries, which in turn delegate to domain registrars the responsibility for managing relationships with customers who wish to purchase a domain name.

Epik

Epik was founded as a domain name trading company in 2009 by Rob Monster. Since then, Epik has expanded to also provide domain name registration and web hosting services. In 2019, Epik purchased BitMitigate.

Foxtrotstream.xyz

Foxtrotsteam.xyz is a domain name that is attached to the underlying infrastructure that powers the Cozy.tv service. To cut costs, the Cozy.tv site has been designed so that the high-bandwidth video-streaming feature distributes traffic among all the viewers watching the programs rather than being served from a centralized server.

Gab

Gab is a social-networking website founded in 2016 by Andrew Torba, a far-right Christian nationalist. Gab became a popular platform for hate and extremist groups following the 2017 Unite the Right event, when mainstream social media sites removed their accounts. In 2019, the perpetrator of the massacre at the Tree of Life synagogue in Pittsburgh posted his grievances to Gab before committing those murders.

GoDaddy

GoDaddy is a popular domain name registrar and web hosting provider founded in 1997. It is notable for canceling the domain registration of Daily Stormer following the deadly Unite the Right white supremacist rally in 2017.

Internet Archive

The Internet Archive is an internet-based digital library and archiving service begun in 1996. In addition to storing hundreds of millions of files in many formats, the Internet Archive also hosts copies of nearly a trillion web pages in a public-facing browsable archive called The Wayback Machine. 

Internet.bs

Internet.bs is a domain name registrar located in Bahamas responsible for distributing domain names with a .bs extension as well as others. The company is notable for canceling the domain of 8chan in 2015 after receiving complaints that the site was hosting child sexual abuse imagery.

KiwiFarms

KiwiFarms was begun in 2013 by Joshua Moon, a former 8chan site administrator. The site is known for hosting discussion forums that encourage users to harass and denigrate a wide variety of other internet users, particularly internet celebrities and LGBTQ+ people. The site was deplatformed from domain registration and DDoS protection by Cloudflare in 2022 and has since received some replacement services from Epik.

Nicholas Fuentes/America First

Nicholas Fuentes is a white nationalist internet performer who periodically livestreams a racist, antisemitic show he calls America First. After being deplatformed from YouTube and other video streaming platforms, Fuentes relocated to DLive in early spring 2020. He was deplatformed from DLive on January 9, 2021, following his speeches on the lawn outside the January 6 attack on the U.S. Capitol. Fuentes then engaged the services of a software developer who calls himself Zoomerdev to create a self-hosted replacement video-streaming platform known first as AmericaFirst.live and later rebranded as Cozy.tv.

TheDonald/Patriots.win

TheDonald was a discussion forum that began on Reddit in 2015 after Donald Trump announced his candidacy for President of the United States. The forum was eventually banned on Reddit and moved to a self-hosted website called TheDonald.win. That site was eventually also closed by its administrator and moved to Patriots.win with a different team of system administrators.

Top-Level Domain (TLD)

A top-level domain (TLD) is the trailing portion of the domain name, such as .com, .org, .us, .in, and so on. The Daily Stormer is notable for having been deplatformed by at least 15 different organizations that provide top-level domain registration.

Tucows

Tucows was started in 1993 as a file-downloads website and began to diversify its business into domain name registration in 2006. It is now one of the largest domain registrars in the world. Tucows canceled the Daily Stormer’s domain registration after the 2017 Unite the Right rally and canceled 8kun’s after both the El Paso shooting in August 2019 and its subsequent rebrand to 8kun in November 2019.

Web Hosting Service

A web hosting service provides customers with internet-connected computer server space to store files that run a website. Some web hosting companies, like Epik and GoDaddy, provide both domain name service (DNS) registration and web hosting, but it is also possible to purchase them separately. Some companies, like Cloudflare, offer DNS registration, web hosting, and network security services such as DDoS attack protection.

Donor Acknowledgments

The Robert Belfer Family
Craig Newmark Philanthropies
Crown Family Philanthropies
The Harry and Jeanette Weinberg Foundation
Electronic Arts
Righteous Persons Foundation
Walter and Elise Haas Fund
Modulate
The Tepper Foundation