Montreal servers hosted TheDonald, far-right site blamed for stirring up violence at Capitol riot

One of the main pro-Trump websites used to organize the deadly riot on the U.S. Capitol earlier this month was hosted by computer servers located in Montreal.

The servers provided a temporary home to TheDonald, a forum for right-wing extremists, as other tech companies cracked down on hate-speech.

"TheDonald is known for its embrace and promotion of far-right content, but it has now become home to unmoderated calls for violence in Washington, D.C.,"Advance Democracy, a non-partisan research organization based in Washington, warned in a report released days beforethe Jan. 6 riot.

TheDonald was initially a community forum, known as asubreddit,on the social networking site Reddit.

With nearly 800,000 users, the subreddit was an influential source ofmisinformation and racist content that circulated widely on Twitter and Facebook, sometimes amplified by U.S. President Donald Trump himself.

Reddit shut down /The_Donald in June, saying the forum'sviolent and racist content violated itspolicies.

By then, however, operators of the forum had already set up TheDonald as a standalone website, using the Montreal servers belonging to OVH, a cloud computing company headquartered in France.

TheDonald website is designed to look and operate like the former subredditbut without Reddit's guidelines on acceptable content.

It exploded in popularity following the June ban by Reddit. Alexa, the Amazon web-ranking service, calculates TheDonald is currently the 405th-most visited website in the United States.

Ahead of the riot at the Capitol buildingearlier this month, the site featured dozens of calls for violence that were in turn supported by thousands of users.

"The posts with calls for violence had 40,484 engagements," said the report byAdvance Democracy, which monitors extremism in the U.S. and is headed by a former FBI agent.

"The calls for violence ranged from calls for the execution of those involved in 'stealing the election' to calls for the killing of DC police officers who may attempt to control the protesters."

OVH was investigating a complaint about TheDonald when the website abruptly changed servers on Jan. 9, a company spokesperson told CBC News.

Cat-and-mouse game

OVH also provided server access to a website claiming to be the "press platform" for the violent anti-government movement known as the Boogaloos.

That website, Tree of Liberty, was used to promote and help organize armed protests across the U.S. on Sunday. Though small, those protests attracted a heavy law enforcement presence.

OVH terminated its contract with Tree of Liberty last week, rendering the website inoperative.

"As a responsible cloud provider, we do not tolerate the hosting of abusive content that does not comply with our terms of use and local legislation," the company said in a statement to CBC News.

TheDonald might have faced a similar fate as Tree of Liberty if it hadn't opted to change servers pre-emptively, an illustration of the cat-and-mouse game extremists are playing with tech companies.

The identity of the company providing server access to TheDonald was initially masked by the site's use of CloudFlare, a paid service that can help websites deal with heavy traffic.

CloudFlare, in effect, handles information requests from individual computers seeking to access TheDonald.

With this service,CloudFlare'sIP address is made public, notthe IP address of the servers actually hosting the website.

A blogger using the name of Soatok devised a method that forced TheDonald to reveal its true IP address, which belonged to OVH, and published the findings on his blog on Jan. 9. (CBC News independently verified Soatok's process with cyber security experts.)

WATCH:Washington's streets fortified ahead of inauguration:

Washington's streets fortified ahead of Biden, Harris inauguration

4 years ago

Duration 2:45

With the inauguration of Joe Biden and Kamala Harris fast approaching, U.S. authorities have gone to great lengths to ensure a safe transfer of power and to prevent violent riots similar to what happened on Jan. 6. Tens of thousands of National Guard troops have fortified Washington, D.C., and imposed tough restrictions on movement that give the U.S. capital an air of occupation.

In response to an email sent to the blog,Soatok said he was motivated to identify the server behind TheDonald because CloudFlare was unresponsive to public criticism about its ties to the website.

"CloudFlare is notoriously friendly to hate speech, so getting them to act was at best an uphill battle, so I decided to employ one of the simple tricks I've picked up working with privacy technology," the blog's author told CBCNews.

The author added that it wasn't clear where the servers currently hosting TheDonald are located, noting the website appears to have patched the code that revealed its true IP address.

Neither CloudFlarenorTheDonald's moderatorsresponded to a request for comment.

Website moderators have backup plan

Even having secured another server to host the site, moderators of TheDonald remain concerned about losing their platform.

They recently informed users that several backup URLs had been created and also issued protocols for protecting the site from an ostensible takeoverattempt by the FBI.

Over the weekend, the Wall Street Journal reported that Epik, the company that hosts TheDonald a service distinct from servers had warned the moderators to eliminate extremist content or it would withdraw its services.

In a message posted Friday, a moderator said despite the uncertainty, the site would push ahead with plans to expand.

This will allow for "red pilling people who see that there's an entirely other viewpoint that they've been totally censored from seeing," the message said, using a slang termfor converting othersto far-right beliefs.

Affiliated forums have already been set up for followers of the QAnon conspiracy theory, fans of Proud Boys founder Gavin McInnes and Trump-supporting Canadian conservatives.