The Digital Infrastructure of Hate: Facilitators, Consequences, and a Framework for Action

by Gemini 2.5 Pro, Deep Research. Warning! LLMs may hallucinate!

Foreword: The Resilient Architecture of Online Extremism

The proliferation of online extremism, encompassing ideologies from neo-Nazism and white supremacy to violent Christian nationalism, is frequently misconstrued as a phenomenon confined to the visible layers of the internet—social media platforms and fringe forums. While the deplatforming of extremist actors from mainstream services like Facebook, Twitter, and YouTube represents a necessary and often effective countermeasure, it addresses only the most conspicuous facet of a much deeper and more resilient problem.¹ This report posits that online extremism is not merely a collection of isolated websites but a robust, multi-layered ecosystem sustained by a dedicated digital infrastructure.

This architecture provides extremist groups with a persistent, and in many cases, "cancel-proof" online presence, allowing them to continue their operations of recruitment, radicalization, and incitement even after being removed from public view. Understanding this foundational infrastructure—from the domain registrars that grant online identity to the payment processors that fuel their operations—is critical to developing comprehensive and effective strategies to combat the global spread of hate. This report deconstructs this facilitation stack, analyzes the key corporate actors enabling it, examines the real-world consequences of the content it hosts, compares the divergent global regulatory responses, and concludes with a framework of actionable recommendations for policymakers, regulators, and the technology industry. The analysis reveals that the persistence of online hate is not an accident of an open internet but the result of a series of deliberate business and policy choices that have allowed a parallel digital economy for extremism to flourish.

Chapter 1: The Facilitation Stack: Anatomy of the Extremist Internet

The ability of any group to establish and maintain a presence on the internet depends on a hierarchical stack of technical services. Each layer provides a critical function, and together, they form the backbone of a website's existence. For extremist groups, navigating this stack has become a core operational imperative. While mainstream providers have become more stringent, a parallel ecosystem of ideologically aligned or willfully negligent providers has emerged to fill the void. This chapter deconstructs the key layers of this "facilitation stack," explaining the function of each and identifying the types of actors that enable extremist groups to operate with impunity.

1.1 Domain Registrars: The Gateway to an Online Identity

The first and most fundamental step in establishing an online presence is securing a domain name—the human-readable address like example.com. This is done through a domain registrar, a company accredited by the Internet Corporation for Assigned Names and Numbers (ICANN) to manage the reservation of internet domains.² The registrar acts as the gatekeeper to the internet's address book, the Domain Name System (DNS), which translates domain names into the IP addresses that computers use to locate each other.³ Control over a domain name is the foundational asset for any online entity.

Historically, major registrars like GoDaddy and Google faced significant public pressure to act against high-profile extremist clients. A notable case is that of The Daily Stormer, an American neo-Nazi website. Following the violent "Unite the Right" rally in Charlottesville in 2017, GoDaddy terminated the site's domain registration, citing violations of its terms of service.⁴ When the site attempted to move its registration to Google, it was promptly canceled there as well.⁴ These actions demonstrated that major registrars could, when sufficiently motivated, effectively sever an extremist group's primary online identity.

However, these deplatforming actions did not eliminate the problem. Instead, they catalyzed the growth of a niche market for registrars that either align ideologically with extremist clients or adopt a staunch "free speech" absolutism that makes them unwilling to enforce terms of service against hateful content. This created an opening for companies like Epik, which became notorious as a "safe haven for the extreme right".⁶ Epik actively courted clients who had been deplatformed elsewhere, providing domain registration services to a roster of extremist platforms including Gab, Parler, 8chan, and groups like the Proud Boys.⁶ Epik's business model was explicitly built on servicing this "canceled" market, illustrating the emergence of a parallel infrastructure layer driven by ideology. The company's significance was starkly revealed in a 2021 data breach, an event described by researchers as a "Rosetta Stone to the far-right" for exposing the intricate network of individuals and groups who relied on its services to maintain their online presence.⁷

1.2 Hosting and Cloud Services: The Digital Landlords

Once a domain name is secured, a website needs a physical location to store its files, databases, images, and other content. This is the function of web hosting and cloud service providers. They are the digital landlords who rent out server space and provide the connectivity that makes a website accessible to visitors. This can range from small, shared hosting plans to massive, scalable cloud infrastructure provided by giants like Amazon Web Services (AWS), Google Cloud, and Microsoft Azure.

Similar to the domain registrar space, mainstream hosting providers have faced pressure to deplatform extremist content. In 2019, the web host Bluehost shut down a website for the Atomwaffen Division, a violent neo-Nazi group linked to multiple murders, for violating its terms of service.¹⁰ The most high-profile instance of hosting deplatforming occurred after the January 6, 2021, attack on the U.S. Capitol. Amazon Web Services terminated its hosting for Parler, an "alt-tech" social media platform that had become a primary hub for organizing the insurrection.¹¹ AWS cited Parler's failure to effectively moderate content that incited violence, making it clear that even the largest infrastructure providers would act when faced with sufficient legal and public relations risk.

This trend has, once again, spurred the creation of specialized, politically motivated hosting companies. The most prominent example is RightForge, a company that explicitly markets itself as a "cancel-proof" hosting service committed to "American principles online".¹³ Its business model is predicated on providing a safe harbor for conservative and far-right clients who fear deplatforming by mainstream tech companies. RightForge's flagship client is Donald Trump's social media platform, Truth Social, for which it provided the initial hosting infrastructure.¹³ This relationship highlights the maturation of the parallel ecosystem, where high-profile political figures can now turn to dedicated infrastructure companies to launch their platforms. The relationship has not been without turmoil; in 2022, Fox Business reported that RightForge alleged it was owed $1.6 million by Truth Social and was considering legal action, revealing the potential financial instability of this niche market but also confirming its clear business purpose.¹⁵

1.3 Content Delivery and Protection Networks: Amplification and Armor

Hosting a website is not enough to ensure it is fast, reliable, and resilient, especially if it is controversial. This is where Content Delivery Networks (CDNs) and DDoS (Distributed Denial of Service) protection services become critical. A CDN, such as Cloudflare or Google Cloud CDN, does not host the original content. Instead, it operates a global network of servers that cache copies of a website's content (images, videos, etc.) in locations physically closer to end-users.¹⁶ This dramatically speeds up website loading times and reduces bandwidth costs for the owner.¹⁸

Crucially, many CDNs also provide DDoS protection. A DDoS attack is a malicious attempt to overwhelm a website's server with a flood of internet traffic, rendering it inaccessible. For extremist sites, which are frequent targets of such attacks from activists and rival groups, DDoS protection is not a luxury but a necessity for survival.¹⁹ Services like Cloudflare and DDoS-Guard act as a shield, absorbing and filtering malicious traffic before it can reach the website's hosting server, thus keeping the site online.¹⁶

This infrastructure layer is arguably the most critical for the resilience of online extremism. It grants hate sites the performance and stability of a mainstream commercial website and, more importantly, armors them against the most common form of technical disruption. This makes them highly available and difficult to silence through direct action.

Two companies dominate this space as facilitators. Cloudflare, a mainstream U.S. tech giant, provides services to a vast number of extremist websites, including Holocaust denial platforms and neo-Nazi forums, under a long-held public policy of content neutrality.²⁰ At the other end of the spectrum is DDoS-Guard, a Russian company that operates as a "bulletproof" provider. It has a documented history of servicing the most toxic clients, including Parler (after its AWS deplatforming), the QAnon-home 8kun, the Palestinian militant group Hamas, and the neo-Nazi site

The Daily Stormer.²³ The willingness of these providers to shield extremist content is a key reason for its persistence.

1.4 Payment Processors and Monetization: Fueling the Ideology

Ideology alone does not keep a website online; it requires funding. Extremist groups rely on a variety of methods to raise money, including soliciting donations, selling merchandise, and running subscription services. All of these require payment processors—companies like PayPal, Stripe, and Square—or crowdfunding platforms like Patreon and GoFundMe to handle transactions. This financial layer is the lifeblood of organized extremism, turning online engagement into tangible resources.

Because of their direct role in enabling financial transactions, payment processors have become a key choke point for disrupting extremist operations. Deplatforming from these mainstream financial services has proven to be one of the most effective tactics available. Following the 2018 Pittsburgh synagogue shooting, which was perpetrated by a user of the "alt-tech" platform Gab, both PayPal and Stripe terminated Gab's accounts.²⁴ The impact was immediate and severe; Gab reported in a Securities and Exchange Commission (SEC) filing that the loss of these processors resulted in a 90% decline in payments for its subscription services.²⁴ Similarly, after the 2017 Charlottesville rally, platforms like Patreon and GoFundMe, along with PayPal, began aggressively banning white supremacist groups and individuals, cutting off significant revenue streams.²⁵

This financial deplatforming has forced a now-familiar adaptation: the emergence of a parallel "alt-finance" ecosystem. Gab, for instance, found a crucial lifeline in a company called 2nd Amendment Processing.²⁴ As its name suggests, this processor was originally established to serve the firearms industry, another sector often deemed "high-risk" by mainstream financial institutions.²⁷ Its willingness to work with Gab demonstrated a clear ideological and business alignment. Further cementing this connection, 2nd Amendment Processing used its own Gab account to promote web stores associated with the Proud Boys, another far-right group, showing how these parallel infrastructure providers actively support and cross-promote each other within their ecosystem.²⁴

Another adaptation has been the shift to cryptocurrencies, particularly Bitcoin. After being deplatformed from traditional financial services, sites like The Daily Stormerbegan prominently soliciting donations in Bitcoin, hoping to leverage its decentralized nature to evade censorship.²⁵ However, the effectiveness of this strategy has been mixed. The technical complexity of using cryptocurrencies presents a significant barrier for many potential donors. Furthermore, while decentralized, Bitcoin is not anonymous; all transactions are recorded on a public ledger (the blockchain), which allows for the tracking of funds to and from known extremist wallets. Finally, the volatility of cryptocurrencies makes them an unstable source of funding.²⁵

The deplatforming actions of mainstream tech companies, while well-intentioned, have inadvertently cultivated a specialized market for "alt-tech" infrastructure. This has led to the creation of a parallel digital economy that is not only tolerant of extremism but is ideologically and financially invested in its propagation. The process begins when a mainstream provider, such as GoDaddy or AWS, removes an extremist client for violating its terms of service.⁵ This action, while removing the immediate problem from that platform, creates a business opportunity. Entrepreneurs and companies who are either ideologically sympathetic to the far-right or see a profitable, underserved market niche, step in to fill the void. Companies like Epik, RightForge, and 2nd Amendment Processing were founded or gained prominence by explicitly marketing themselves as "free speech" or "cancel-proof" alternatives to this deplatformed demographic.⁶ This establishes a resilient, self-sustaining ecosystem where standard content moderation policies are ineffective, as the providers and their clients share an ideological opposition to such enforcement.

This development has lowered the barrier to entry for creating a durable and scalable platform for hate. Extremist groups no longer need to build their own technical infrastructure from the ground up. Instead, they can assemble a complete, resilient online presence using a modular "stack" of commercially available services that are willing to work with them. A group can register its domain with Epik, host its site with RightForge, protect it from attacks with DDoS-Guard, and fund it through 2nd Amendment Processing. This "Infrastructure-as-a-Service" model for hate makes the extremist internet far more robust and challenging to dismantle than a simple collection of individual websites.

Chapter 2: Case Studies in Complicity and Controversy

While the previous chapter outlined the technical layers of the facilitation stack, this chapter provides a deeper analysis of the specific corporate actors who play a pivotal role in enabling online extremism. By examining their business models, client histories, and public justifications, a clear picture emerges of a spectrum of complicity, ranging from willful negligence and content neutrality arguments to ideologically driven support and state-adjacent operations.

2.1 DDoS-Guard: Bulletproof Hosting and State-Adjacent Operations

DDoS-Guard is a Russian-based internet infrastructure company that exemplifies the model of "bulletproof hosting".²³ Such providers specialize in offering resilient services to clients engaged in illicit or controversial activities by deliberately ignoring abuse complaints and resisting takedown requests from law enforcement and civil society.³¹ The company's corporate structure is intentionally opaque, with entities incorporated in Scotland (Cognitive Cloud LP) and Belize (DDoS-Guard Corp), a practice likely used to gain access to regional IP address blocks and obscure ultimate ownership and control.²³

The company's client history reads as a catalog of the internet's most toxic and criminal elements. After Amazon Web Services deplatformed the social network Parler following the January 6th Capitol attack, Parler was able to partially restore its online presence using DDoS-Guard's protection services.²³ DDoS-Guard has also provided services to 8kun (formerly 8chan), the online home of the QAnon conspiracy theory; the American neo-Nazi website

The Daily Stormer; the cyberstalking and harassment forum Kiwi Farms; and even the Palestinian Islamic militant group Hamas.²³ According to a former employee, the company's business model involves charging higher rates to these odious clients, who have few alternative providers willing to work with them.²³ While the company has occasionally dropped clients like 8chan and Hamas after news reports brought their content to light, investigative reporter Brian Krebs noted in 2021 that a vast number of its clients were phishing sites and domains tied to cybercrime.²³

Most alarmingly, DDoS-Guard has demonstrable ties to the Russian state. Since 2016, the company has provided denial-of-service protection to the Russian Ministry of Defence and has worked closely with the Russian Central Bank.²³ This relationship raises critical questions about the strategic dimensions of its operations. By providing a safe haven for Western extremist groups that promote social and political discord, DDoS-Guard's commercial activities may align with Russian geopolitical interests aimed at destabilizing rival nations. This potential weaponization of infrastructure transforms the company from a mere commercial enterprise into a potential instrument of state-sponsored information warfare.

2.2 Epik: The Rise and Fall of a Safe Haven for the Far-Right

Epik, an American domain registrar founded in 2009, carved out a unique and controversial niche in the market by branding itself as a bastion of free speech and a protector against "cancel culture".⁶ Under its former CEO, Rob Monster, the company actively courted clients who had been deplatformed by mainstream competitors for hosting extremist content.⁶ This strategy made Epik the registrar of choice for a significant portion of the far-right internet.

Its client list included the social network Gab, the imageboard 8chan, the social network Parler (which moved its domain to Epik after the January 6th attack), the pro-Trump forum Patriots.win, conspiracy theory site InfoWars, and extremist groups such as the Proud Boys and the Oath Keepers.⁶ Monster defended these business decisions by positioning the company as a neutral service provider committed to free expression, stating that Epik welcomed "all views, without bias or preference".⁶ Critics, however, described the company as a "safehaven for the extreme right" and a lifeline for sites flooded with hate speech and dangerous disinformation.⁶

The company's role as a sanctuary for the far-right was irrevocably exposed in September 2021 when the hacktivist collective Anonymous breached its servers and released a massive trove of data.⁷ The leak, dubbed "EpikFail," contained over 150 gigabytes of internal records, including customer lists, domain purchase histories, payment information, and internal emails.⁷ Crucially, the breach also exposed the data from Epik's WHOIS privacy service, Anonymize, which was supposed to conceal the identities of domain owners.³² The hack was described as a "Rosetta Stone to the far-right," providing researchers and journalists with an unprecedented, unvarnished view into the architecture, funding, and individuals behind this ecosystem.⁷ The breach ultimately contributed to a leadership change and the sale of the company in 2023, marking the end of an era for one of the most prominent facilitators of online hate.⁶

2.3 Cloudflare: The Infrastructure Giant's Tightrope Walk

Cloudflare is a dominant, mainstream technology company based in San Francisco. It is not a niche player; an estimated 10% of all internet requests flow through its massive global network.²⁰ The company provides essential CDN and DDoS protection services to millions of clients, ranging from government agencies like the FBI to major commercial websites.²⁰ Its critical role in the internet's infrastructure makes its policy on extremist content particularly consequential.

For years, Cloudflare has publicly adhered to a doctrine of "content neutrality." CEO Matthew Prince has argued that as an infrastructure provider, Cloudflare is not a publisher and should not be in the business of terminating services based on the content of a website, no matter how "disgusting and immoral".³³ He has famously analogized Cloudflare's role to that of a fire department, which should not refuse to put out a fire based on the moral character of the homeowner.³³ This policy has meant that Cloudflare has provided its security and performance-enhancing services to a wide array of extremist sites, including Holocaust denial websites, neo-Nazi forums like Stormfront, and Richard Spencer's alt-right.com.²¹

However, this stance of principled neutrality has been undermined by the company's own actions. On a few rare occasions, Cloudflare has deplatformed high-profile extremist clients, but only after they generated intense public outrage and were linked to catastrophic real-world violence. In 2017, it terminated services for The Daily Stormer, with Prince stating the decision was made because the site's operators claimed Cloudflare was secretly supportive of their ideology, making them "jerks".³⁴ In 2019, after a mass shooter posted his manifesto on 8chan before killing 23 people in El Paso, Cloudflare dropped the site as a client.³⁵

These exceptions have led critics to argue that Cloudflare's neutrality is not an unbreakable philosophical principle but a convenient business and public relations position.³⁷ The company appears willing to tolerate extremist content until the negative press and association with violence become too damaging to its brand. This inconsistency reveals that the decision to provide services is ultimately a calculation, not a matter of principle. The case of Cloudflare demonstrates that for an infrastructure provider of its scale and importance, a claim of "neutrality" is not a passive stance but an active choice to enable harm. By providing security and performance enhancements to hate sites, it makes them more resilient, accessible, and ultimately, more dangerous.

2.4 The Alt-Tech Payment Pipeline

The financial deplatforming of far-right groups from mainstream payment processors like PayPal and Stripe and crowdfunding platforms like Patreon has been a significant disruptive force.²⁵ After events like the 2017 Charlottesville rally and the 2018 Pittsburgh synagogue shooting, these companies took aggressive action to sever ties with white nationalist and other extremist organizations, drastically curtailing their ability to raise funds and sustain their operations.²⁴

This pressure, however, created a market for alternative financial services. Niche payment processors that cater to "high-risk" or politically controversial clients emerged to fill the gap. A key example is 2nd Amendment Processing, a company initially created to serve the firearms industry, which is often shunned by mainstream processors due to its political nature.²⁷ After being banned by PayPal and Stripe, the social media platform Gab secured a partnership with 2nd Amendment Processing, a move that was crucial for its financial survival.²⁴ This relationship illustrates the development of a parallel "alt-finance" infrastructure, where ideologically aligned companies provide essential services to deplatformed entities. The connection was further solidified when 2nd Amendment Processing used its Gab account to promote online stores for the Proud Boys, demonstrating a symbiotic relationship within the far-right economic ecosystem.²⁴

In addition to these niche processors, many extremist groups have turned to cryptocurrencies like Bitcoin as a means to bypass the traditional financial system entirely.²⁵ Andrew Anglin, founder of

The Daily Stormer, has actively solicited Bitcoin donations as the "best option" after being cut off from other services. However, the reliance on cryptocurrency has limitations. The technical knowledge required to use it, its price volatility, and the public, traceable nature of the blockchain have prevented it from becoming a fully effective replacement for traditional fundraising methods for most groups.²⁵

Table 2.1: Comparative Analysis of Infrastructure Provider Policies

Chapter 3: From Pixels to Attacks: Content and Real-World Consequences

The digital infrastructure detailed in the preceding chapters is not an abstract concept; it is the delivery mechanism for content that has tangible, destructive, and often violent real-world consequences. This chapter connects the technical facilitation stack to its ideological output, providing specific examples of the extremist material being hosted and demonstrating its direct link to radicalization, political violence, and the erosion of societal norms.

Continue reading here (due to post length constraints): https://p4sc4l.substack.com/p/online-extremism-is-not-merely-a