| |
|
Update May 20: We've removed cPanel / WHM from our server environment entirely due to CVE-2026-41940
|
|
Attempted server attacks:
total blocked:
|
|
Multiple attempts to disrupt stopice.net servers, disrupt alerts or compromise server security occur daily.
Our automated threat mitigation systems quickly identify and block these attempts using various custom-built multi-layered traffic containment strategies.
While stopice.net does not store personal user data such as names, addresses or GPS data, "certain individuals" have repeatedly attempted to attack or breach
our servers since last year Feb 2025 in attempt to disrupt the platform.
We are now publishing real-time stats monitoring and tracking these attempts, along with the IP addresses and networks they originate from.
Below is a log of specific IP addresses directly associated with these attacks. This list is populated automatically.
Feel free to use it for your own attack mitigation and traffic containment strategies. Additional details in security notes below.
Network / IPs
roshan.wtf
104.21.92.176
172.64.80.1
An SSL/TLS Exhaustion Attack originating from this network targeted stopice.net minutes before a CBP convoy dispatched from Terminal Island, CA
raided a nearby Home Depot in Signal Hill Dec 19, 2025 at 7:45 AM.
The attack appeared to be timed in attempt to disrupt server operations to prevent alerts from reaching the community.
The server attack failed and StopICE continued to operate without disruption.
A StopICE alert had also gone out the previous day when the same CBP convoy was spotted driving through the same Home Depot parking lot.
Upon investigating the source of the attack we found the IP addresses associated to be connected to a VPS running a web page on an apache web server accessible under its root IP address.
The web page was put together from a generic template which was edited to display Greek and Roman mythology from Metamorphoses, a narrative poem completed around 8 CE.
At the bottom of the page was a contact. An individual who referred to themselves as “Roshan” next to a photo. A photo of an individual who we found to look very familiar.
We continued to monitor various attack attempts originating from this server along with associated VPNs who followed the same attack signatures.
We contacted one individual associated with the server who attempted to deny responsibility for the attacks.
On Jan 29-30 2026 we noticed another attempted attack originating from the same server. The individual who previously denied any
involvement contacted us again claiming responsibility for the attacks - which again failed to compromise StopICE servers.
Upon further investigation we tracked down several other individuals associated with the attackers server and attack signature, some of whom are are associated with far-right neo-nazi movements along with AZOV Brigade/Battalion in Ukraine. Upon quickly identifying these individuals and publishing their details publicly, they responded with a DDOS attack over 300K individual ip addresses attempting to knock Stopice.net offline in addition to several other desperate attempts - all of which failed. The web site content associated with the root IP on the originating server and it’s IP addresses (roshan.wtf) was quickly changed to a fake donation page for Ukraine, contact information was removed and the server was put behind cloud flare. In desperate response attackers attempted to spread false rumors via social media claiming “personal names and addresses” of subscribers were leaked from StopICE.net and sent to law enforcement when StopICE does not collect nor store this information.
We also received numerous threats via social media from others associated with Eastern European neo-nazi movements (including AZOV Brigade) via social media. One individual, Tobin Heincy currently from Temecula, CA (originally from Prague, CZ) who is mentioned below. According to Hiency’s Facebook profile he was a CBP official working for DHS as of early 2025.
Upon realizing the interesting coincidence that Tobin Heincy was currently residing in the same area as the CBP officials who raided the Home Depot on Dec 19, minutes after the first attempted server attack, we began investigating further and tracked down more details identifying individuals associated with these particular attacks, their associates, and connections with far-right Neo nazi movements.
Stay tuned to this page for updated information along with automated security stats published above.
Read an overview of the attempted attacks on our server Jan 30th
|
Instagram message received
from
Tobin Heincy - US CBP Agent
Spirit Lake, ID
Temecula / San Diego , CA
message
"We're coming for you. Tracking your every move"
| |
description
|
Tobin Heincy thought it was a good idea to leave threatening messages on Stopice.net’s founders' personal page.
Tobin Heincy is a US CBP AGENT from Spirit Lake, ID who currently resides in Temecula.
He joined CBP at the beginning of the Trump administration in 2025 as a TUAS operator
and was previously enlisted in the US Army according to his Facebook profile.
Tobin Heincy also has “1488 ϟ ϟ” written on his Instagram profile bio.
This is a well known white supremacist numerical code and hate symbol. Tobin Heincy is a neo-nazi who was allowed to join CBP through DHS
at the beginning of the Trump Administration in 2025. (no surprise)
Tobin Heincy is also believed to be one of the individuals connected with the attempted server attack against stopice.net on Jan 30.
attachments
|
enlarge screen shot
enlarge screen shot
enlarge screen shot
enlarge screen shot
enlarge screen shot
enlarge screen shot
Tobin Heincy's instagram account was reported for neo-nazi hate speech. Meta confirmed
that the page did in fact contain this content which was a violation of terms and removed the account.
enlarge screen shot
| | | |
email received
from
Miranda, Jordan [email protected]
|
subject
"You're last days are coming close"
| |
message received
| |
"Since you have ignored our message enjoy you're last few days."
|
attachment
|
enlarge screen shot
| |
text message received
from
610-604-8350
|
registered to
WENG , HSIAOFEN
|
message received
| |
"n*gger" , "deport illegal immigrants"
| |
facebook msg received
from
Marco Giovetti
| |
message received
| |
"Sherman Austin You're just lucky that i am out of the US at the moment and it woud take me 10+ hours to get there, or i
would have already slit your throat in front of your loved ones.
You think you're dealing with fascism? You have NO IDEA of the accuracy of TRUE fascists."
|
attachment
|
enlarge screen shot
| |
instagram messages
from
Marc Szakaly, Estero, FL
|
work place
Solar Energy Consultant
stilwellsolar.com
239-495-5988
| |
incident description
|
Marc Szakaly decided to leave multiple pro-trump maga threatening messages across stopice.net's founder
personal instagram page. In most cases this would've been simply ignored.
However, Marc also decided to leave these messages on post of his son, who is also a MINOR.
*update: After Marc's place of employment was contacted notifying them how he is respresenting their company, he immediately went back to each post and deleted his messages.
|
attachment
|
enlarge screen shot
enlarge screen shot
enlarge screen shot
| |
| |
*This information is publicly sourced and provided in the interest of public safety and legal transparency, and is not intended to
engage in, nor encourage illegal activity of any kind.
Questions?
Contact
|
Stop ICE Alerts
UNCONFIRMED reports are intended to gather more information before being labeled CONFIRMED- which is why these comments exist as a crowd sourcing tool for
additional feedback.
