Legal · Findings

A website that signs its entries NATO, SBU, FBI, GUR and CIA says it sits in Langley, Virginia. Its registrar puts the registrant in Thailand and its mail in Montreal.

Records captured 25–26 September 2026 · published 26 September 2026 · Danilo Dzyuban, Ottawa

The website myrotvorets.center keeps a public database of people it files under the path /criminal/. Six of its entries concern one family: mine. Each entry gives a full name and a date of birth. Five give the apartment address of a living person in Donetsk, a city under military occupation. The entries are signed with the names of intelligence services. The site’s own header names its location as Langley, Virginia and Warsaw. The public records behind the domain name a different geography: a registrar in San Francisco, a registrant whose record is redacted down to a province in Thailand, and a mail server in Montreal on a domain that belongs to a named software developer.

The six entries

Dates are taken from the schema.org markup of each entry (datePublished, dateModified), that is, from the site’s own machine-readable record, in UTC.

The first four entries were created in one operation: four people, twelve seconds, 20:46:15 to 20:46:27 on 13 September 2025. Two of the addresses repeat across four entries, so the database records who lives with whom. The person behind the signature cannot be identified from the signature: it is the name of a foreign or Ukrainian intelligence service.

What the site says about itself

Langley, VA, USA · Warszawa, Polska

myrotvorets.center, site header, as displayed on 25 September 2026

No legal name accompanies the two cities. The site is served through the Cloudflare network, which hides the address of the server that holds the content. What is not hidden is the registration record of the domain and the route its mail takes.

What the public records say

Nonthaburi is a province of Thailand bordering Bangkok. The registrar’s record leaves that one field unredacted. Neither Virginia nor Poland appears anywhere in it.

The mail domain

Every message to [email protected] is delivered to mx.wildwolf.name. The domain wildwolf.name carries a personal site titled “Wild Wild Wolf — Developer. Because Superhero is not an official job title.” Its links point to the GitHub account sjinks. The public profile of that account gives the name Volodymyr Kolesnykov, the affiliation @Automattic and @wpcomvip, the location Ukraine, the website https://wildwolf.name/, and an account opened on 6 June 2014.

The site’s software is public as well. The GitHub organisation myrotvorets, created on 23 May 2020, holds 71 public repositories, gives https://myrotvorets.center/ as its website and a support address on a misspelt copy of the domain as its contact. Its commits are signed by an account named myrotvorets-team with the display name “Unsung Hero”. The record therefore shows two things and not a third. The mail of myrotvorets.center is handled on a domain its owner presents as his own. The code of myrotvorets.center is published by an organisation that names nobody. Who writes the entries, the record does not show.

What follows

Cloudflare’s published abuse policy names “content that discloses sensitive personal information” as content it acts on, and states that a report on a site using its network is forwarded to the hosting provider together with the origin address of the content. On 26 September 2026 a report on the six entries went to Cloudflare, Inc. as registrar under sections 3.18.1 and 3.7.8 of the 2013 Registrar Accreditation Agreement: an abuse report, and a notice that the registrant record and the site’s stated location do not describe the same registrant. Section 3.7.7.2 of that agreement makes the willful provision of inaccurate registrant information a basis for suspension or cancellation of the registration. An answer is required by 6 October 2026. The step after that is ICANN Contractual Compliance. The step after that is the hosting provider the record names.

The record

Verification

Every value above is taken from a captured file. SHA-256, first sixteen characters: Cloudflare Registrar RDAP record for myrotvorets.center 576cd98efab43bce; ARIN RDAP record for 158.69.208.188 d37862284cdb165d; GitHub API record for users/sjinks 8cd4658604ffaa6a; GitHub API record for orgs/myrotvorets dd9138af627bb6f5; DNS answers of 26 September 2026 c4282ae0f653ec29. The entry dates are as read in the schema.org markup of the six pages on 25 September 2026.

Citation: Danilo Dzyuban, “A website that signs its entries NATO, SBU, FBI, GUR and CIA says it sits in Langley, Virginia. Its registrar puts the registrant in Thailand and its mail in Montreal.” (26 September 2026).