JUMP TO A SECTION:

What is an Imageboard and Why is it called a Chan? 

Key Players

The Language of the Chans

Topic Boards and Types of Content

How Imageboards are Evolving on the Darknet

An Introduction to Imageboards of the Darknet

The darknet is replete with an extensive array of content, including onion services and communities that intelligence and investigative analysts have noted are home to cyber criminals, scammers, and threat actors. Typically, the most common hubs for these users are darknet marketplaces and blogs/forums. However, recently, our analysts have observed the increasing presence of a legitimate and growing segment of the darknet, comprised of a community of free-speech enthusiasts who utilize imageboards known as “chans.”

The rise of QAnon and the coordinated siege of the U.S. Capitol in January shined a spotlight on one wildly popular imageboard known as 8chan, bringing about significant coverage in mainstream media. In the wake of such recent events, we have observed an increase in imageboard hosting on the darknet, including many direct copies of the 8chan codebase that are serving as new safe havens for emerging, controversial chan boards. In fact, DarkOwl has identified over two dozen alternative chans on the darknet – not related to 4chan or 8chan – across numerous languages (Russian, Korean, Japanese, German, and English) that are currently online and active.

An imageboard is considered a type of bulletin-board-like forum that revolves around the posting of images, often alongside text and discussion. Imageboards are characterized by a community of users with non-identifiable usernames, usually simply “Anonymous” – that rely on a system of tripcodes instead of registration with credentials. A tripcode is the hashed result of a unique password that allows one’s identity to be recognized without storing any data about the user and entering a particular password will let one “sign” one’s posts, often necessary for moderators and staff, with the tripcode generated from that password. 4chan and 8chan (or 8kun) implemented secure tripcodes that are not reproducible across different imageboards and are more resistant to the hashed password getting hacked or cracked. The originating IP address of the user is known to the administrator of the imageboard, but the pseudo-anonymity of the forum structure led to its users calling themselves “anons.”

The very first imageboard was 2channel, (2ちゃんねる, 2chan, or 2ch) first launched over two decades ago by Hiroyuki Nishimura, a Japanese Internet entrepreneur and student based in the United States at the time. By hosting the board outside of Japan, Nishimura managed to circumvent Japanese internet censorship and grew the predominantly Japanese online community millions of daily users with a level of influence in society many described as comparable to that of traditional mass media like television, radio, and magazines. Nishimura named the imageboard 2channel after the physical channel older televisions would need to be turned to, to use auxiliary devices like 1990s video game consoles.

In 2003, not long after the success of 2channel, Christopher “moot” Poole (at the time age 15 years old) launched an English language counterpart to 2channel known simply as 4chan. Poole already had a history as an active participant on the comedy surface web bulletin board known as “Something Awful” which funneled users to 4chan and quickly increased its popularity, forming a whole new genre of internet subculture including the “Cult of Kek” (Pepe the Frog), the conversational meme factory, and resources for rare adult fandom like My Little Pony.

The pseudo-anonymity provided by 4chan also enabled discussions from a rather darker segment of society where disturbing fetishes and hate speech are not just authorized but glorified. Illegal content such as child pornography and gore increased the need for fairly strict moderation on the site by its hundreds of volunteer moderators stationed around the world; Poole and a part-time developer were the only official staff of the board. In 2014, 4chan was central to the Gamergate controversy, an online harassment campaign dedicated to directly targeting and doxing females because of anger regarding feminist or progressive ideals found at the time in the video game industry.

By this time, alternative imageboards known as “alt-chans” had emerged including Wizardchan whose userbase consisted of virgin men or “incels” (slang derived from “involuntary celibate”) who define themselves as unable to find a romantic or sexual partner despite desiring one and ultimately often despised the sheer existence of the entire female gender. To this day there is crossover in the users between imagebaords – Wizardchan’s users also post in threads on 4chan and vice versa.

Due to the increased moderation of content on 4chan, a prominent user and admin of Wizardchan known as Fredrick Brennen, using the pseduonym “Hotwheels” founded “infinitychan” (using a sideways “8” for infinity, or simply 8chan or 8ch), redesigning the codebase to include user-created and moderated boards on the channel. In 2013, Brennen advertised the new imageboard as a “free speech friendly alternative to 4chan” and 4chan’s eventual blanket censorship of all Gamergate related discussions significantly increased 8chan’s rapid success and popularity in the first years of its operation. 8chan quickly outgrew Brennen’s ability to host the volume of posts by its thousands of daily users and illegal content became increasing difficult to moderate. In late 2014, he partnered with Jim Watkins in the Philippines to host and help scale the platform, using Watkins data center company N.T. Technology while Brennen served as admin and the public face for the board. (Source)

8chan’s content became increasingly obscene and its users linked to several violent international hate crimes including the mass shooting at a Christchurch mosque in 2019, the Poway Synagogue shooting, and El Paso shooting at a Walmart targeting Hispanics shortly thereafter – with all three shooters posting racist and xenophobic manifestos on the imageboard within hours of the attacks. Around the same time, Brennen resigned as the imageboard’s admin and launched a campaign to get the site shutdown permanently with direct attacks against both Jim and Ron Watkins across social media and the mainstream news media. In late 2019, Watkins rebranded 8chan to 8kun after widespread public criticism of the site with support from Russian hosting providers affiliated with cybercriminal activity.

The imageboards mentioned above are considered the grandparent-chans creating the ‘foundational’ platforms for fast-paced discussions, fueling mob-like mentalities and are still widely popular underground online communities. Nevertheless, there are hundreds of “alt-chans”, many of which have a growing presence of users on the darknet, including not only a mirror of 2channel, but 16chan, nanochan, 64chan, Korchan, Kohlchan, and others. The surge in new imageboards and their use of the darknet is indicated by conversations that express how its users are increasingly concerned over the concerted ‘attack on free-speech’ that occurred in the wake of the January 6th riots and as well as members of the US Congress’s call for a repeal of Section 230 of the Communications Decency Act, which has historically protected the hosts of controversial social platforms from legal consequence. (Source)

The following lists the founders and critical players of the most popular and widely discussed imageboards in public media. Due to the nature of the content and its users and creators inherent desire for digital privacy many of the owners and administrators of imageboards are completely anonymous or known only by their pseudonyms.

Imageboards pride themselves on providing a platform to advocate free-speech and the purest freedom of expression and many users utilize the forums as an outlet for venting internal frustration, speaking on the boards in ways that they would never, ever speak in real life. In 2010, 4chan administrator, “moot” was called to testify in the trial of David Kernell, a 4chan user who was eventually convicted of hacking of Sarah Palin’s email during the 2008 Presidential election and leaking screenshots from her account on the imageboard. The administrator’s role in the trial turned from ordinary to awkward when moot was asked to define and explain the community’s lingo and terms that were used in the posts and comments included in the prosecution’s discovery. Terms he testified about included such vernacular as “b tard”, “troll”, “peeps”, “lurker” and OP (original poster).

In the last decade, the culture and language of the chans has only become even more exclusive and insular to its chan-community, preventing many new users and investigative analysts from engaging its users or even further parsing what they are reading in any given thread from darknet data collection systems. The influx of right-wing extremism and domestic terrorism observed with the popularization of QAnon on 8chan (or 8kun), increased the use of phrases specific to Q’s posts such as “Patriots”, “Trust the Plan”, “Great Awakening”, “WWG1WGA” (where we go one we go all), “Panic in DC”, “deep state”, and the idea of “sheep” or those who follow main stream media blindly.

Imageboard users go to great lengths to directly insult each other on the thread and openly attack anyone of non-Caucasian race or non-evangelical Christian religious beliefs. Most of the lingo is too obscene and vulgar to be mentioned here, but there are some standard key phrases used across all the imageboards that provides general context to many an anon’s post. Several of these have made it into urbandictionary.com, whose definitions were included directly where available.

based: A word used when you agree with something; or when you want to recognize someone for being themselves, i.e. courageous and unique or not caring what others think. Especially common in online political slang.

redpilled: A word used to describe when a left leaning liberal have shifted their beliefs into alignment with the right. The phrase was adapted from the movie, The Matrix, where Morpheus is offering to enlighten Neo to the Matrix: “You take the red pill, you stay in Wonderland, and I show you how deep the rabbit hole goes.”

shill: This word describes a person who is pretending to agree with a conspiracy and intentionally circulates false information or acts totally insane in an effort to discredit said conspiracy. Someone who shills could also be someone directly lying in a post to deceive or cause controversy.

larp: An acronym meaning “live action role play” – when whatever post has been stated is not real or intended for comedic or dramatic effect, as if it occurred in a play.

/b/tard: A derogatory insult to address users who are found in the /b/ section of the board or to insinuate that their post is random or nonsensical.

lurker: A person who ‘lurks’ or browses the board and never posts anything.

newfag: A newcomer to the imageboard who is considered a nuisance to the discussion. Often this person is trying too hard to fit in.

neckbeard: A word derived from conjoining of the words “neck” and “beard,” to denigrate a male user on the board as characterized by an inflated sense of self-worth and a powerful sense of entitlement, particularly to affection, subservience and sexual acts from women.

neet: A person considered a failure in life who is unemployed and lounges all day playing video games or watching anime. 

waifu: A word used in the manga sub-genre to describe a fictional female character that they love and would marry if they were real.

glow: If the word glow is associated with an insult or someone says, “you glow” that would intimate that you’ve been perceived as law enforcement or a government agent.

troll/trolling: As it relates to imageboards, trolling describes the deliberate act, (by a troll – noun or adjective), of making random unsolicited and/or controversial comments on various internet forums with the intent to provoke an emotional knee jerk reaction from unsuspecting readers to engage in a fight or argument.

Persistent topic boards are a characteristic of chan forums. From its inception, 4chan required an administrator to create all topical boards to guide its users’ discussion, leading to a sort of standard that has persisted to newer chans. Alternatively, 8chan infamously provided creative freedom to its users to launch and moderate its own topical boards – a backend board style adapted by several imageboard developers.

Nevertheless, there are some board topics that are persistent across all of the imageboards, including the alt-chans across the surface web and darknet. Such well-known and highly popular sub-boards include:

• /b/ – random: The sub-board /b/ was the first board Poole created on 4chan and it was the catchall for any random thread about any sort of content including cartoon pornography and debased memes.  It is considered community etiquette across most all imageboards to limit discussions that are specialties or the focus of other boards on the channel. Many imageboards recognize the power of /b/ to such an extent it is the only board available on its entire platform.

• /pol/ – politically incorrect: The /pol/ sub-board covers wide range of subjects, including politics, culture, social issues, religion, law, finance, and current events. It has become most well-known for its divisive content and hate speech with posts including neo-Nazism, white supremacy, and xenophobia. Nearly all imageboards online today have an active /pol/ board and some even include additional country specific politics, like /polru/ for Russian political discussions. Some non-English speaking alt-chans have created an /intpol/ sub-board instead of /pol/, which stands for international politics as many of the English-speaking /pol/ boards are heavily influenced with U.S.-focused political partisanship. Last year, 8kun renamed its /pol/ board to /pnd/ for politics, news, and debate much to the protest of its userbase.

• /a/ – anime: Given the imageboard’s roots in Japanese anime subculture, and 2channel’s founder being Japanese, most imageboards have a sub-board called /a/ dedicated to sharing and discussing anime. Many posts on this sub-board also includes a very specific sub-genre of animated pornography known as “hentai” short for hentai seiyoku translated as a “perverse” or bizarre sexual inclinations.

• /g/ – technology: The /g/ sub-board got its start on 4chan, and other imageboards have quickly adapted this topical board for “discussing computer hardware and software, programming, and general technology.” This channel often includes a wide-range of posts that might asking recommendations for which Linux distribution to install or pictures of users’ home technology setups.

  Last week, DarkOwl analysts observed a post on /g/ on how to successfully hack Apple’s recently released AirTags product with detailed instructions from a security researcher’s blog on the surface web, demonstrating how /g/ could be used to uncover security vulnerabilities.  Within minutes of the post appearance, /g/ moderators removed the thread validating user complaints of how heavily moderated 4chan can be and what attracts many users to imageboards hosted exclusively on the darknet with more relaxed moderation policies.

Most imageboards have a surface web domain address and accessible directly from the public Internet. Imageboards are considered pseudo-anonymous, since a user’s IP address is known and likely logged by the imageboard administrator, especially for users accessing the site directly on the surface web.  While many users access imageboards using a Virtual Private Network (VPN) proxy, 8chan utilized Tor off and on over the last five years to mirror its content, to provide additional anonymity to its users accessing the imageboard and to mitigate DDoS attacks against its Internet domains.

Other imageboards, including 2channel, have a persistent presence on the darknet providing its users additional layers of operational security. Some imageboards like endchan have mirrors across other alternative darknets including Oxen and Yddrasil for additional data redundancy and wider client support to its userbase.

Many imageboards are strictly accessed through the surface web have strict rules about what can and cannot be uploaded and its administrators comply with all law enforcement requests for information and readily handover logs. Others give moderators the power to disallow users posting from a Tor exit node, in the case where users access the surface web domain using the Tor Browser Bundle for anonymity.

Other darknet exclusive imageboards have more lenient rules and allow its users to post illegal content including violence, pornography, and gore. Gurochan, an imageboard that originated over a decade ago, recently returned online and predominantly includes threads with gore and necrophilia.

An Increasingly Evolving Darknet Threat

The imageboard community on the surface web is rapidly evolving and many services are migrating directly to or mirroring their content across the darknet(s). Knowing that 4chan is now heavily moderated and often called a law enforcement honeypot, and that many users of 8kun have disappeared with the failure of a real-life political “reckoning” for the alleged deep state cult at the heart of the QAnon conspiracy, the imageboard underground digital community is thriving as a safe haven for people to direct their shills and troll campaigns.

As previously mentioned, during the course of this content research, DarkOwl identified over two dozen alternative chans on the darknet – not related to 4chan or 8kun – across numerous languages (Russian, Korean, Japanese, German, and English) that are currently online and active. To support its Vision users in conducting their most effective and efficient investigative analysis we have also created a “Groups” filter using these domains, so Vision UI users can easily target their searches directly into these communities without direct or a-priori knowledge of the onion service addresses. Hopefully this post, with its primer on historical context and guide to imageboard community lingo, will help end users develop intelligent targeted queries to find content of interest.