The IP coordinates of the two sites also point to the Kremlin, meaning that there are no precise coordinates for where this server is actually located.

The .ru domain

This clustering of fake and hate sites to servers in Russia, and to VK, fits into a broader pattern. In May 2016, the same month as Anonymous.Kollektiv was blocked from Facebook, The Atlantic magazine reported on a trend of Western white supremacist groups moving from Facebook to VK.

Separately, since 2015, the Russian government has been encouraging Russians to leave Facebook for Vkontakte after it blocked some anti-Ukrainian content, saying that Russians would have greater freedom of speech there.

That is not to say that Vkontakte does not have any hate speech guidelines. The Russian social networking site, however, has been known to enforce its rules by different standards to Facebook and other western social media networks. Both Vkontakte and Facebook focus their efforts to block ISIS supporters, but Vkontakte also focuses on anti-Kremlin groups, largely ignoring foreign white supremacists.

This reflects a broader pattern in Russia. As the Associated Press reported last year, at least 54 people were sent to prison for posting alleged ‘hate speech’ online. The AP’s investigation revealed that the ‘hate speech’ was often anti-government rhetoric. It suggests that the Russian government, as well as Vkontakte, have the capacity to crack down on what is presented as hate speech, but have a selective way of doing so.

Under Russian laws, the .ru and .rf domains fall under the jurisdiction of state media watchdog Roskomnadzor. Roskomnadzor has been long known for using Russia’s hate speech and extremist laws to target the opposition, while allowing far-right movements based outside Russia to post with impunity:

In 2015, Roskomnadzor blocked 133 domains, according to this thematic breakdown by independent anti-racism NGO the SOVA Center:

· xenophobic material of modern Russian nationalists — 19; · various inciting anti-government materials (including Anarchist materials) — 4; · non-violent opposition websites — 18; · materials of Muslim militants and other calls for violence by political Islamists — 22; · other Muslim materials –17; · non-violent Ukrainian websites — 32; · websites of banned Ukrainian organizations — 18; · parodies banned as serious statements — 2; · large body of various texts, blocked in its entirety — 1.

Note that none of these categories includes white supremacist/far-right groups based abroad. The authorities did ban some sites containing “xenophobic material of modern Russian nationalists” and have targeted ultranationalists, recently seen with Egor Prosvirnin of Sputnik &Pogrom, but this can be explained in the context of Russia’s domestic politics. The Kremlin sees the domestic far-right as a threat to the regime, due to their inclination and potential to seek power through violence.

The far-right groups abroad, however, are seen as tools to destabilize societies and infiltrate foreign governments. Considering Russia’s unequivocal support to many far-right groups in Western Europe, their ability to host fake news and hate speech on Russian servers is entirely consistent with the broader relationship. The .ru domain, therefore, provides outlets such as Anonymous.Kollektiv with a safe online haven, free from court orders and bans.

Maks Czuperski is the Director @DFRLab & Special Advisor to the President Atlantic Council. Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab). Donara Barojan is a Digital Forensic Research Associate in the @DFRLab’s Digital Research Unit Baltics.