A look at Finland-based Crea Nova, an internet service company that hosted hate and conspiracy-filled websites, and its connections to Russia
Elina Lappalainen / Helsingin Sanomat : Tweets: @elinalappalaine and @gossithedog Tweets: Elina Lappalainen / @elinalappalaine : Now in English: This is how 8kun and Daily Stormer, known for their neo-Nazi and Qanon content, went down. The infamous VanwaTech maintained the site's traffic with the help of a small Finnish server company Crea Nova. https://www.hs.fi/... Kevin Beaumont / @gossithedog : Investigative journalism at its best here. 8kun (8chan), Daily Stormer and Kiwi Farms are all still offline - as are various cybercrime forums and such. Find out the different Russian owned companies and infrastructure behind things for 8kun and DS in the article below. https://twitter.com/...
Context & Ripple Effects
The deplatforming chain behind 8kun has been documented link by link: after Cloudflare quit servicing 8chan in 2019, the site cycled through registrars like Epik before rebranding as 8kun. A 2021 profile traced the next hop to Vancouver-based VanwaTech, Nick Lim's hosting provider for Daily Stormer and 8kun, while DDoS-Guard, a Russian firm also serving 8kun, showed how Russian-owned infrastructure absorbed traffic mainstream providers refused.
Helsingin Sanomat's reporting adds what looks like the next link: Crea Nova, a small Finnish server company that worked with VanwaTech to maintain traffic for 8kun, Daily Stormer and Kiwi Farms, with reporting tying it to Russian-owned companies. The finding matters because it shows the fallback layer beneath the fallback layer — and because security researcher Kevin Beaumont notes these sites and several cybercrime forums remain offline as a result of this exposure.
First-order effects
- Crea Nova is now publicly identified as the Finnish node keeping VanwaTech's client sites reachable, putting a small national operator under scrutiny its size offers little insulation against.
- With the Finnish connection mapped, 8kun, Daily Stormer and Kiwi Farms lose another viable infrastructure provider — Beaumont reports them still offline alongside multiple cybercrime forums.
Second-order effects
- VanwaTech must find yet another upstream host willing to carry traffic for its white-supremacist clientele, continuing the migration pattern already visible in the moves to Epik and DDoS-Guard.
- Each exposure narrows the pool of willing providers to smaller firms in permissive or geopolitically distant jurisdictions, which raises costs and fragility for the sites but concentrates their dependence on Russian-linked infrastructure.
Third-order effects
- If the pattern holds, deplatforming by major providers does not eliminate extremist sites but progressively relocates them onto a shrinking chain of fringe and foreign-state-adjacent hosts, entangling content-moderation decisions with national-security questions for governments like Finland's.
- The recurring investigations — from the 151-company survey to the DDoS-Guard and Crea Nova reporting — point toward regulators treating hosting and transit intermediaries as accountability points rather than neutral pipes.
The trend: Extremist web infrastructure keeps migrating down a chain from mainstream providers to ever-smaller and increasingly Russia-linked hosts, with investigative exposure now functioning as the primary enforcement mechanism knocking each link offline.