FlokiNET refused an ICE-linked takedown, but the registrar pulled the domain anyway

What happened

FlokiNET, an Icelandic hosting provider founded in 2012 as a safe harbour for free speech and whistleblower projects, has publicly documented a takedown demand it received for icepi.cx, a website that lists the work identities of US immigration officers. According to the company's blog, the notice arrived via ZeroFox, a firm FlokiNET says it has no relationship with, acting for a government agency in a country where the host does not operate. FlokiNET declined the request — and by mid-morning the domain had stopped resolving anyway, because its registrar, CentralNic, placed it on serverHold. The site has since reappeared at icepicx.is under a different registrar.

Why FlokiNET refused

The notice, as FlokiNET describes it, framed the site as a doxxing campaign. The company rejects that characterisation: doxxing publishes private details about private people, whereas this site lists which agency officers work for, what their roles are and how they can be reached in those roles. Officers carrying out an enforcement programme are not private individuals while doing that work, FlokiNET argues, and journalists cannot report on an agency whose personnel are structurally unknowable.

FlokiNET is candid that the underlying data originated in a breach and that nobody in the dataset chose to be included. But it says the question it had to answer was narrower: whether publishing serves a purpose a hosting provider should protect. It concluded that the site functions as a reference tool for accountability reporting by journalists and citizens, and refused on that basis.

An automated notice with an invisible client

Two features of the request trouble FlokiNET. First, it says ZeroFox identifies candidate material through AI-driven detection, and distinguishing accountability journalism from a harassment campaign is precisely the judgement such detection cannot make — the work of reading the site and weighing public interest against personal risk shifts to whoever receives the notice. Second, the accusing party and the contacting party are no longer the same: FlokiNET cannot see who inside ICE decided the site should go, whether anyone did, or what they were shown before deciding.

FlokiNET compares this to copyright enforcement, where monitoring firms send automated demand letters at volume and verification is a cost against the business model. What has changed, it argues, is the client. The blog notes that DHS signed a $15 million contract with ZeroFox in July 2026 covering ICE and Homeland Security Investigations, allowing the company to file on the department's behalf until 2028. FlokiNET also points to reporting by The Intercept on a leaked memo describing the programme internally as a "Doxing Mitigation Initiative," including an ICE official's worry that it could be turned on whistleblowers and critics inside the agency rather than outside threats. It adds that ZeroFox classified peaceful Black Lives Matter organisers in Baltimore as "threat actors" in 2015, and that the FBI hired the company in 2021.

The registrar decided otherwise

FlokiNET's refusal, it writes, kept nothing online. The request that decided the outcome was not the one sent to FlokiNET: CentralNic reached the opposite conclusion the same morning, published nothing about it, and a global audience briefly lost access to the site. FlokiNET links to additional coverage of the case at Politico Pro.

What FlokiNET wants changed

The company argues that legislation such as the EU's Digital Services Act loads obligations onto hosting providers while asking nothing of the people who file notices. Anyone filing a takedown notice on another party's behalf, it says, should have to state who they act for, on what legal basis, and who is accountable if the claim is wrong; notices produced by automated detection should declare that on their face, because a provider cannot weigh a claim without knowing whether a human ever looked at it. FlokiNET also wants removals at the registry and registrar level subject to the same scrutiny, warning that when an agency can buy removals through a contractor, possibly paid by volume, and the quickest route runs through infrastructure nobody is watching, the result is not a system for stopping harassment but one for making inconvenient information disappear.

Why it matters

The episode shows how removal decisions on the web are now spread across a chain of intermediaries — monitoring contractor, host, registrar — any one of which can act, or decline to act, without transparency. A host can weigh a claim carefully and refuse it, and the site can still vanish hours later through a registrar that explains nothing. When detection is automated, the filer is a contractor and the client is a government institution, the burden of verifying accusations falls on whichever company receives the notice, or on no one at all. For platforms, registrars and publishers, FlokiNET's account is a case study in why notice-and-takedown processes — and the quiet infrastructure layer beneath them — may need obligations flowing in the other direction too.