Hackers affiliated with the “hacktivist” collective Anonymous have brought down Freedom Hosting II, the largest hosting provider on the dark web and host to a range of illegal activities, including child pornography.

The hack took down 10,613 sites, an estimated 20 percent of all sites on the dark web. It was seemingly at first motivated by money, with an initial message on the site demanding a small payment of 0.1 bitcoin ($101) for the return of 75GB of files and 2.6GB of databases the hackers had managed to download and then wipe from the service.

Those behind the attack, though, eventually had second thoughts despite receiving two ransom payments. They decided instead to keep the service offline as they found evidence that child pornography sites on the service went over the mandated free hosting limit, meaning that Freedom Hosting II was not only encouraging the sites but actually profiting from them as well.

“Initially I didn’t want to take down FH2, just look through it,” a person claiming to be part of the group that hacked the service told Vice. The person then explained that the group had found several large child pornography sites that were using more than Freedom Hosting II’s stated allowance that comprised of gigabytes of material, well above the usual 256-megabyte limit.

“This suggests they paid for hosting and the admin knew of those sites,” the hacker said. “That’s when I decided to take it down instead.”

Child pornography was not the only illegal service found in the hack. Security researcher Chris Monteiro said on Twitter that he had discovered .onion URL’s, the dark web equivalent of .com, in the hacked data that included botnets, fraud sites, sites peddling hacked data and weird fetish portals, including one WordPress installation that detailed “Asshole ballet.”

The hackers have since publicly dumped the data they grabbed from Freedom Hosting II on another dark web site. Leak detection site Have I Been Pwnd reported that the data includes the email addresses of 381,000 users.

Freedom Hosting II’s predecessor, Freedom Hosting, was shut down by the Federal Bureau of Investigation in 2013 because of its role in hosting child porn sites.

Image: Pixabay/Public Domain CC0