I was kind of hoping that I wouldn’t get anything new to report on regarding this topic as it almost seemed like it was done. Well, guess I was wrong. This weekend Joshua apparently switched to a new ISP, which he had initially planned to do at the end of last year. That ISP then handled traffic for less than 12 hours before suspending their service. The company in question being Zayo. Josh posted a detailed statement in the Telegram channel, here’s an exerpt:
Zayo is an Internet service provider. They are a big company with presence across the world. If Zayo is arbitrarily blocking entire networks because of individual sites, and they are doing so with no recourse, the Internet is doomed. We are watching in real time as the very foundations of our interconnected world buckle and fold.
I am reaching out to see if this decision can be reversed. I am going to ask that network engineers do the same. If you are in the industry and are concerned that this ISP you do business with behaves like this, contact your account manager immediately and say so.
As we are a US legal service, I believe we should enjoy a direct connection to the Internet. The complex routing I do is stupid and only needed due of a few complainers harassing the right people.
If I understand this correctly it seems that he disabled the mesh routing he was using before where requests would be distributed across different hosts via DNS round robin. It looks like removing that showed that he was using Zayo which then immediately got a hand full of people to send complains. Apparently the Kiwi Farms violated the acceptable use policy of Zayo, but there doesn’t really seem to be anything in there that the site violated, but there’s the usual generic catch-all clause that allows Zayo to terminate service for anyone at their own discretion. You can read their AUP as of now here or here. Josh then shared some emails regarding this incident:
On Sat, Oct 22, 2022 at 6:00 PM Blake Willis blake.willis@zayo.com wrote:
If I may suggest a course of action: ASAP, someone with official social media access should follow up on @lizthegrey’s post that we’re investigating the matter internally. in parallel, they should be informed of AUP violations & their services disconnected thereafter. This is the DIA in question BTW:
https://zayo.my.salesforce.com/a1X4z000006ZnKk
Thanks again for your attention.
-Blake
This already shows that they’re shitting themselves over twitter posts as he apparently is desperately trying to get hold of someone in charge of their Twitter account so they can do some damage control. Their social media accounts are just as dead as most other companies’ and there’s roughly ten replies to their last few tweets which hardly seems like something worth getting worked up over. Also once again their Instagram and Facebook accounts didn’t even receive a single comment which once again shows, that this is entirely isolated to retards on Twitter.
The email follows up with what appears to be a message that came in as a complaint:
On Sat, Oct 22, 2022 at 11:32 PM Blake Willis blake.willis@zayo.com wrote: Greetings folks,
Zayo seems to have sold IP Transit & DDoS protection to Kiwi Farms. This is who they are & what they do:
https://www.dropkiwifarms.net/
https://en.wikipedia.org/wiki/Kiwi_Farms#Terminations_of_service
Several of my industry colleagues have escalated this to me tonight, as I pack my suitcase to fly to Belgrade early tomorrow morning for next week’s RIPE meeting, where this issue will certainly come up…
Cloudflare finally terminated their services last month for AUP violations, so at the moment Zayo is their primary Internet service provider. The account in question is “1776 Solutions” run by Joshua Moon:
https://zayo.my.salesforce.com/0014z00001d9yWC?srPos=0&srKp=001
This is generating a large amount of negative attention for us in social media:
https://twitter.com/lizthegrey/status/1583896232497643520
https://twitter.com/search?q=zayo%20kiwifarms&src=typed_query
As well as copious abuse tickets e.g.
https://zayo.my.salesforce.com/5004z00001gix3E?srPos=3&srKp=500
https://zayo.my.salesforce.com/5004z00001j2jG2?srPos=1&srKp=500
For both AUP violations as well as increased risk to Zayo’s own infrastructure (both cybersecurity as well as potential volumetric DDoS attacks against Kiki Farms & our own infrastructure), this customer should be informed of AUP violations & terminated immediately.
Your immediate attention to this matter is appreciated. I’m happy to clarify further if needed.
–
Blake Willis Network Architecture & Interconnection Zayo Europe (AS6461 & AS8218)
There’s a bunch of things worth pointing out here. First the reference to the drop Kiwi Farms website, which still lists the same lies and was initiated by Keffals, who has been oddly quiet about the entire thing recently. Maybe because Destiny has shed some light onto Keffals’ character that paints a less than pretty picture. Then there’s the “Terminations of service” section of the Wikipedia article. That Wikipedia hasn’t been trustworthy for a while isn’t news to anyone anymore, but even if it was trustworthy referencing other services that bent the knee should not be a justification for Zayo to do the same. If it was then all one would need to do is get a site dropped by one company. After that you’d just have reference the previous companies to get the site removed. Whether or not the actions of the initial company were justified then becomes completely irrelevant.
Next up is the laughable statement, that this is generating “a large amount of negative attention” for them on social media. First of, as previously stated, it’s not “social media” - it’s just Twitter. Secondly it’s not large, it’s a total of 18 Tweets. Two of which are from August, four are not part of the campaign and nine are from a single account dedicated solely to the purpose of getting Kiwi Farms shutdown (archive.is, ghostarchive.org). Then there’s liz’s tweet which has a staggering 183 likes and 43 retweets.
Once again if that is all it takes to get an entire network blocked it’s a bit concerning to say the least. Apparently Blake Willis and Liz are buddies which would explain how this happened. Josh’s last message sums it up:
This guy spun 2 two abuse tickets and one tweet chain from his personal friend as an imminent threat. 20 year veteran of the company. That’s the true value of being a former Google employee: knowing people who can just press buttons to shut things off.
There’s allegations that Josh doxed the guy at Zayo by posting the emails, but figuring out that a guy named Blake Willis might have an email account called “blake.willis” with the domain Zayo.com isn’t exactly rocket science. Apparently the email also contained a phone number, but there’s none there so either it was removed afterwards or was never there to begin with. It’s also interesting how contacting Zayo in defense of Kiwi Farms is considered to be harassment by the people who want the site gone, but when they do it to achieve exactly that it’s okay. Really makes you think.
It seems that the forum was only safe while it was using a convoluted mesh of servers from different providers. These companies still received complains, but handled them professionally, i.e. see through their bullshit and empty claims. So it seems like these people can pressure and intimidate big corporations, but small individual hosts across the globe are out of their reach. This decision was once again taken very prematurely and the only thing that could be considered cooperation with Null are the emails regarding the incident.
Since this happened on a weekend there’s still a slight chance that this will be properly handled the coming week. We’ll have to see.