French President Emmanuel Macron | Axel Schmidt/Getty Images Neo-Nazi activist may be behind fake Macron documents An anonymous user on 4chan posted files allegedly showing that Macron maintained an offshore bank account in the Bahamas.

WASHINGTON — A white nationalist affiliated with a neo-Nazi website may have created fake documents about new French President Emmanuel Macron that circulated a week before Macron’s election victory.

On May 3, an anonymous user on the message board 4chan posted a large cache of files allegedly showing that Macron, the center-right candidate running against far-right firebrand Marine Le Pen, maintained an offshore bank account in the Bahamas. Researchers quickly determined that the files were fake, but they spread widely online ahead of France’s May 7 president election.

The 4chan user who posted the fake files also linked to a website, nouveaumartel.com. By forensically examining that web address, cyber analysts at VirtualRoad.org discovered links to the Daily Stormer, a neo-Nazi website, and to the site's system administrator, the far-right internet troll Andrew Auernheimer, aka “Weev.”

The Daily Stormer’s website shares IP addresses and a content delivery network with nouveaumartel.com, according to VirtualRoad’s analysis. And while the owner of nouveaumartel.com tried to mask its IP address by passing it through a “Tunnel broker” service, that service used the account name “weevlos.”

“We have strong confidence that the ‘fake offshore documents’ known as #MacronGate are connected with” the Daily Stormer, VirtualRoad Chief Technology Officer Tord Lundström told POLITICO in an email. “There are several forensic pieces of evidence that point to the same.”

While it is possible to fake some of the connections, Lundström argued that the extent of overlap between the Daily Stormer’s site and nouveaumartel.com suggests that it is not a coincidence or hoax.

“We have also considered the possibility that the IPv6 overlap” — the sites’ shared use of an IPv6 address — “could be coincidental, but as the IPv6 address can only be used by the person that runs that Tunnel broker service ‘weev,’ we think that in this case that is not the case.”