Less than 24 hours after neo-Nazi website The Daily Stormer returned to the web, its domain registrar, DreamHost, claimed Anonymous hit it with a DDoS attack that put its 400,000 websites offline. Then, after inciting an attack on DreamHost, Daily Stormer moved its domain registration back to GoDaddy the registrar that first booted the site off ten days ago.
DreamHost achieved a major win on Tuesday when the Department of Justice dropped a request for identifying information on visitors to an anti-Trump protest website, disruptj20.org. However, this morning, a District of Columbia court ruled that the company must still disclose some information about the site’s operators.
DreamHost got even more bad news moments after the court ruling, when they found out about the DDoS attack. The service’s co-founder, Dallas Kashuba, told Gizmodo that the attackers targeted DreamHost for hosting The Daily Stormer’s new domain name, PunishedStormer.com.
“[Punished Stormer] showed up on our service last night. This morning we are being attacked by Anonymous. Nobody gave us any chance to actually do something one way or another,” Kashuba told Gizmodo.
DownDetector reported that DreamHost has been having issues since 12:36 PM EST. Kashuba believes that an Anonymous-affiliated group is behind the DDoS because of tweets from a user called @BakedAnon.
Andrew Anglin, the owner of Daily Stormer, claimed earlier on Thursday that DreamHost had “manually approved” its new domain. “They actually manually approved my account, knowing what it was,” Anglin wrote on his site.
However, Kashuba suggested Anglin may have been confused about the kind of “approval” he had received from DreamHost.
“He’s probably talking about our anti-fraud process. That’s about credit card fraud prevention and nothing to do with content or specific domains,” Kashuba said. “I can’t confirm what we actually did or didn’t do though.”
Kashuba said he wasn’t certain whether DreamHost would eventually remove PunishedStormer.com from its services. “First priority is to get our other 400,000 customers back online.”
Kashuba couldn’t say if Anglin’s site breached its terms. “That I don’t know. We were starting to review the content as soon as we learned about it last night, and now we have a higher priority to deal with,” Kashuba said.
When asked if he knew why PunishedStormer.com appeared to remain online in spite of the attack, Kashuba said: “No, I don’t. My own sites are down. Yay for fairness, right?”
On Thursday around 3pm, PunishedStormer left DreamHost, according to Kashuba. A WHOIS query shows the Daily Stormer has now moved the registration of PunishedStormer.com to GoDaddy. GoDaddy has not responded to Gizmodo’s request for comment. We will update this post if we hear back.
Update 8/17/17 9:11pm ET: Daily Stormer has returned to the clearweb, again, under the top-level domain for Albania. Marcaria, an international domain registration and look-up tool, displays Google as proving the nameserver for this newest iteration of the site.
Google has previously revoked Daily Stormer’s registration, and we’ve reached out to the company to see why it appears to continue selling Stormer domain names. We’ll update if we hear back
Update 8/28/17 10:56am ET: A Google spokesperson claims Daily Stormer is currently using a Chinese company—dnspod.cn—but may have configured its nameserver to appear as Google. For now, Daily Stormer remains accessible.