Neo-Nazi Digital Networks

Investigation Overview

This report documents two simultaneous OSINT investigations into distinct but thematically adjacent neo-Nazi digital operations: a successor neo-Nazi streaming network to GoyimTV, and a British National Socialist activist organization circumventing financial regulations through merchandise sales.

All targets were identified through passive enumeration of publicly accessible APIs, exposed WordPress REST endpoints, certificate transparency logs, image metadata (EXIF/XMP), domain registration records, and blockchain transaction history. No unauthorized access was required.

Background: GoyimTV Successor

In late October and early November 2025, GoyimTV (goyimtv.com) and its companion flyer distribution site (gtvflyers.com) went offline following a NewsChannel 5 investigation by journalist Phil Williams that exposed their targeting of children. Within three days of the takedown, four domains were registered through the same registrar — NiceNIC International Group (Zhuhai, China) — establishing a direct succession relationship.

The network operates 88streams.com (streaming platform), 88merch.com ("White Power Gear" WooCommerce store), 88flyers.com ("Propaganda Center" listing platform), and 88beats.com (music platform, not yet active). The streaming infrastructure is provided by StreamForge (streamforge.cloud, South Africa), a white-label SaaS that markets itself as "censorship-resistant." Content is served through BasedFlare CDN, specifically designed to avoid deplatforming.

Infrastructure

All four 88* domains registered Oct 31 – Nov 3, 2025 through NiceNIC ([email protected]) — same registrar as goyimtv.com.

All four domains resolve through BasedFlare IPs: 104.219.235.22, 172.93.215.129, 38.135.54.232, 104.219.234.42. The streaming platform's internal codename, revealed via the OpenID Connect configuration, is "StreamRed."

Health Endpoint — Live System Fingerprint

GET https://88streams.com/health
{
  "status": "healthy",
  "version": "1.0.3852+e3d0f9e47d838acb647b3d5aa8d5516b44b4f751",
  "buildNumber": "3852",
  "startedAt": "2026-02-17T17:58:14Z"
}

The health endpoint exposes the full git commit hash and build number of the production deployment. The JWKS endpoint exposes the authentication key ID and reveals the platform uses HS256 (symmetric, weak) for JWT signing.

Identity Attribution: FLOOD = shop2admin = flood-tribe

The most significant finding of this investigation is the positive identification of the 88Streams/88merch primary operator with "FLOOD", a member of Blood Tribe (Blutstamm), the neo-Nazi organization founded by former US Marine Christopher Pohlhaus ("Hammer").

Two 88merch WordPress user accounts — shop2admin (WP ID 1, site administrator) and flood-tribe (WP ID 98, vendor) — were confirmed to be the same person via Adobe XMP image metadata embedded in their uploaded avatar images.

The flood-tribe account is the 88merch store for FLOOD, a Blood Tribe member with 398 subscribers on FTJ Media who runs daily shows ("Napalm in the Morning," "The Doom Depot") and is active across 18 platforms. A continuous Adobe Creative Cloud subscription is confirmed from Photoshop version progressions: PS 25.5 (May 2024) → 25.9 (Sep–Oct 2024) → 26.0 (Apr–May 2025) → 26.9 (Dec 2025 – Feb 2026).

FLOOD — Cross-Platform Digital Footprint

FLOOD has not been publicly identified by any anti-fascist research group as of February 2026.

Physical Location: Summerville, South Carolina

A second geographic indicator comes from KangChirp (88streams channel Oj8K1aZC6b), who uploaded videos showing real-world flyer distribution at Old Town entertainment complex in Kissimmee, Florida, matching the Florida WHOIS registrant location of all four 88* domains.

Blood Tribe — Organization Profile

Blood Tribe (Blutstamm) is a US neo-Nazi organization founded in 2020 by Christopher Pohlhaus ("Hammer"), a former US Marine (honorably discharged 2009). Pohlhaus was photographed tattooing GDL founder Jon Minadeo II with Nazi symbols in July 2022, establishing a direct link between Blood Tribe and the Goyim Defense League — which operated goyimtv.com. The 88Streams network is therefore a direct operational successor to GDL's digital infrastructure.

Blood Tribe Members — Little Rock Rally, December 6, 2025 (22 of 23 identified)

Source: Arkansas Times, December 2025. Names published following their public rally at a Little Rock civil rights site.

88Merch — Exposed Product Catalog

The WooCommerce Store API at /wp-json/wc/store/v1/products requires no authentication and returns full product listings. The site's self-description via the WordPress REST API is "White Power Gear." Swastika patches were photographed eight days before the 88streams.com domain was even registered.

Cryptocurrency Wallets

FLOOD was mining Ethereum via Ethermine from September 2021 to August 2022 (pre-merge). The mining payout wallet directly funded FLOOD's ETH address (0x644e3de9c62de67fcd099ee0e8dc68fb85fc5588 → FLOOD's wallet, June 11, 2023).

Network Connection Map

OPSEC Failures (16 Identified)

• WordPress REST API exposes all user accounts on 88merch and 88flyers without authentication
• Gravatar SHA-256 hash reveals admin email — [email protected] cracked via hash reversal
• Health endpoint exposes full git commit hash and build number in production
• Search API returns all channels and videos without authentication
• WooCommerce Store API exposes full product catalog without authentication
• XMLRPC open on both 88merch.com and 88flyers.com (brute force / SSRF vector)
• Plausible analytics has CORS: * — queryable by any origin
• Android camera timestamps in product image filenames reveal photography timeline
• XMP OriginalDocumentID links shop2admin = flood-tribe — same source file on same computer
• OIDC JWKS uses HS256 symmetric key — if extracted, all JWT tokens are forgeable
• 88flyers media library fully accessible — propaganda PDFs with full metadata
• Certificate transparency logs reveal exact domain purchase ordering and timing
• 88beats and 88flyers registered in the same second — batch purchase confirmed
• volkmarket.shop residential IP exposes physical location (Summerville, SC, Dell computer)
• SPF records reveal email providers (ProtonMail for 88streams, Fastmail for 88merch)
• StreamForge source code references migration path from ViewShark with "no data loss, zero downtime"

Overview

Aryan Front, operating externally as "White Vanguard" and "Anglo-Celtic Brotherhood," is a British National Socialist activist organization self-described as "Britain's Leading National Socialist Activists." The group operates aryanfront.com (WordPress + WooCommerce + GiveWP donations) and whitevanguard.com (Wix e-commerce), maintains a Telegram channel with 2,861 subscribers, and conducted a documented street protest in Warwick, UK on February 7, 2026.

Critical OPSEC failures exposed the operator's identity, two live Stripe accounts, all donor records, and an explicit admission in product descriptions that the group is using merchandise sales to circumvent UK financial regulations prohibiting direct funding of far-right organizations.

Infrastructure

Operator Attribution: "M Day"

Both WordPress operators (admin ID:1 and admin-2 ID:4) use Apple iPhones, confirmed by iOS photo naming conventions (Photo-DD-MM-YYYY-HH-MM-SS, IMG_XXXX.mp4, UUID.jpg) and Photoshop 3.0 JFIF markers in all uploaded images.

Financial Exposure — Two Live Stripe Accounts

GiveWP Donor Records — Fully Exposed

The GiveWP REST API endpoint /wp-json/givewp/v3/donations and per-donor endpoint /wp-json/givewp/v3/donors/{id} return all donation records without authentication. 18 donors were enumerated with names and amounts. Two fundraising campaigns were active:

The exposure of donor records constitutes a potential GDPR violation — personal data of UK individuals is accessible without consent or authorization.

Admission of Financial Circumvention

This is a direct admission that merchandise sales are being used to route funds to a far-right organization in circumvention of UK financial regulations. A legal disclaimer on all products attempts to protect distributors from liability for public display, acknowledging that such display "may constitute criminal offences, including (but not limited to) the incitement..."

whitevanguard.com — Wix Merchandise

A second e-commerce store on Wix sells clothing branded with "88" pricing throughout (£28.88, £36.88). The "Embrace Struggle" gym top features a Welsh Dragon alongside the phrase "Embrace Struggle" — a reference to Mein Kampf ("My Struggle") — combined with the Newport, Wales WHOIS registration, establishing the operator as Welsh.

Network Connections

Aryan Front's Telegram channel (@WhiteVanguard1, 2,861 subscribers) is connected to:

• @PatrioticAlternativeOfficial — Mark Collett's Patriotic Alternative (UK far-right)
• @JackEltis — "Australian National Socialist, Sydney NSW" (international)
• @Nationalist13 — NS13, Southwest Ontario Canada ([email protected])
• @WhiteCanada1 — Canadian white nationalist channel

Real-World Activism — Warwick Protest, February 7, 2026

Five video files (IMG_4014.mp4 through IMG_4018.mp4) were uploaded to aryanfront.com documenting a masked protest in Warwick town center. UK police officers in high-visibility jackets are visible in the footage. A screenshot taken the evening after (Feb 8, 2026, 21:10:15 UTC) shows the protest materials. St Mary's Church, Warwick is identifiable in the background, along with a "Warwick News & Wine" shop sign. Participants carry a large "ARYAN FRONT" banner bearing the Kolovrat/Sonnenrad symbol.

The site has two confirmed regional chapter profile pages: Leicester (last modified Feb 7, 2026) and Warwick (last modified Feb 9, 2026).

Raw Data & File Drop

All collected data — API responses, HTML snapshots, image files with metadata, JSON exports, and compiled intelligence reports — is archived on ODINT's data server and available for journalists, researchers, law enforcement, and civil society organizations.

Target 1 — 88Streams Network

Target 2 — Aryan Front / White Vanguard