# The mailboxes died at 1:57 in the morning

**Deck:** At 1:57 a.m. UTC on Friday, the .org registry removed autistici.org from the internet's address book — and thousands of activist mailboxes with it — 28 days before the deadline the US government's own wind-down license had set. No outlet has reported it. Nobody involved has said a word.

**By:** URnetwork editorial
**Dateline:** San Francisco — August 28, 2026
**Published:** 2026-08-28T06:55:30-05:00
**Category:** News / Analysis

---

At 1:57 a.m. UTC this morning, by the registry's own record, autistici.org stopped existing.

Not the servers — those are still running, and will answer if you know their numeric addresses. What
died was the name. Public Interest Registry — PIR, the US nonprofit that operates the .org registry
from Reston, Virginia — placed the domain on serverHold, a status that removes it from the .org zone. Every website under autistici.org vanished from the internet's address book. So did every
@autistici.org email address — nearly 12,000 mailboxes by the count of the collective that
runs it, roughly 16,000 by the US government's. Mail sent to any of them now fails, because the machine trying to
deliver it can no longer find where they live.

No news outlet has reported this. As of this writing it exists only in the registry's records,
where this desk found it.

Autistici/Inventati — A/I to its users — is an Italian collective, run by volunteers since 2001,
that provides activist email, web hosting, blogs, and chat to people who ask for them, without
logging who they are. On Wednesday the US Treasury's Office of Foreign Assets Control, OFAC, the
agency that administers economic sanctions, designated it a Specially Designated Global Terrorist —
alleging that its "encrypted email accounts, chat and video conferencing" and hosting materially
support "Antifa cells and other violent left-wing extremists," including the Kurdistan Workers'
Party. The same batch designated Palestine Action, the UK protest group already proscribed at home,
and the Palestinian-solidarity network Masar Badil.

Alongside the designation, OFAC issued General License 36, authorizing "the wind down of any
transaction involving Autistici Inventati" through 12:01 a.m. on September 25. A month, on paper.
The collective read it that way: on Thursday afternoon it reposted an appeal titled "Defend
Autistici/Inventati Before September 25."

About fifteen hours after that repost, the registry pulled the name. From the signature on the general license to the
serverHold: about 37 hours. The wind-down period had 28 days left to run.

![The license allowed wind-down until September 25; the hold came about 37 hours in — 28 days early.](https://ur.io/blog/2026-08-28-01/figure-runway.png)

## Read the status codes

The domain's public record says who did this. Domain statuses come in two families:
codes beginning with "client" are set by the registrar — here Gandi, the French company A/I bought
the name through in 2000 and keeps registered through 2029 — and codes beginning with "server"
are set by the registry itself. At 1:57 this morning, autistici.org acquired three: serverHold,
serverTransferProhibited, serverUpdateProhibited. All three are registry-side. Gandi's only mark on
the record is a routine transfer lock that predates all of this. This was PIR's hand, in Virginia —
whether on OFAC's instruction or its own compliance judgment, PIR has not said, and either answer
is uncomfortable.

The action was surgical. The sanctions entry lists exactly one domain, autistici.org, and exactly
one domain went dark. The collective's sibling names — noblogs.org, inventati.org, investici.org —
resolve normally. The state did not touch a single server. It reached into the address book and
removed one line, and that was enough.

## What the license actually licenses

Nothing in this appears to be illegal. General License 36 authorizes "all transactions… that are
ordinarily incident and necessary to the wind down of any transaction involving Autistici
Inventati… through 12:01 a.m. eastern daylight time, September 25, 2026." Authorizes. The word
never obliges anyone to do anything, and OFAC penalties run on strict liability — no intent
required — so the safe reading of any sanctions question is always the fast one.

Look again at the three status codes and you can watch that logic execute. Two of them —
serverTransferProhibited and serverUpdateProhibited — are what an asset freeze mechanically
requires: the domain is now the blocked property of a designated entity, and blocked property must
be held in place, unable to be moved or altered. The third, serverHold, is not a freeze. It is a
switch. It does not preserve the asset; it turns it off, and with it every mailbox and page that
answered to the name. A registry protecting itself needed the first two. The mailboxes died with
the third.

So the month of grace existed in a government document, and the actual clock was set by the
compliance reflexes of a single US chokepoint that every .org name on earth runs through.

## The allegation is the service catalogue

Treasury's theory deserves to be read whole. Its press release says A/I "exclusively provides its
services to vetted individuals, collectives, and groups it perceives to be aligned with its
ideology, including to sanctioned terrorist organizations such as the Kurdistan Workers' Party
(PKK)." If A/I knowingly ran infrastructure for the PKK, the legal theory is not exotic: the US
Supreme Court held in *Holder v. Humanitarian Law Project* in 2010 that even speech-like support,
when coordinated with a designated group, can be punished as material support.

Whether A/I in fact knowingly served the PKK, nobody outside the government can currently say; no
evidence has been released. What the record does support is narrower and stranger: no released
document names a single specific act of terrorism the collective assisted. The conduct Treasury
itemizes — "website hosting on foreign servers, encrypted email accounts, chat and video
conferencing" — is the service catalogue of every privacy-respecting provider on earth, plus a
vetting step. The designation reads, in the government's own words, as an indictment of
infrastructure.

## "An atomic bomb to take out a rabbit"

The collective denies everything, in its own English: "We deny all allegations… Antifascism and
anticapitalism are not terrorism. Protesting is not terrorism." And in an interview the Italian
outlet Fanpage published this morning — hours after the hold — a member of the collective answered
the vetting allegation in detail. The blogs, the member said, are the most open thing A/I runs:
anyone with an account on their servers, or on servers with a compatible policy, can open one. "We
receive no notification and we don't have to pre-authorize anyone. The blog simply gets opened."
Legal requests that arrived through legal channels, the member said, were followed and complied
with. What the US built instead, in the member's words, is "like using an atomic bomb to take out
a little rabbit."

The member's own theory of why it happened now: American movements organizing against ICE use
A/I's platforms to communicate, and Washington-aligned think tanks had spent a year taking aim at
the blogs.

## They engineered for seizure. This wasn't one.

A/I has been raided before, and its whole architecture is an answer to raids. In 2004, Italian
police copied every disk in the collective's server with the cooperation of its hosting company,
Aruba — and A/I found out by chance a year later. The collective responded by
rebuilding as the "R* Plan": services scattered across servers in multiple countries, encrypted, so
that no one seizure could take the community's mail. For a quarter century the design assumption
was that someone would eventually come for the machines.

Nobody came for the machines. The registry hold defeats the entire design from a layer above it:
scatter your servers across every jurisdiction you like — your name still lives in one database, in
Virginia. The same lever has been pulled before at country-code level — India's registry has held
protest-movement domains this summer on no published authority — but this is .org, the namespace
where the world's nonprofits live, executing a terrorism designation against a civil-society host
in an allied democracy, silently, in one registry command.

## The law protects the letters. Nothing protected the address.

The people this lands on are mostly not the people in Treasury's press release. They are the
activists, journalists, and ordinary Italians whose correspondence lived at an address that no
longer resolves. The sanctions statute
exempts "any postal, telegraphic, telephonic, or other personal communication, which does not
involve a transfer of anything of value"; OFAC's own FAQ adds that Americans do not violate
sanctions "for engaging in such constitutionally protected activity." The exemption is intact. It
now protects mail that cannot be delivered.

PIR knows exactly what deleting an address does, because its own anti-abuse policy says so: as a
registry it "can't remove individual pieces of content"; it "can only suspend the entire domain
name, which renders any and all postings, threads, third-level domains, email, and all other
content… inaccessible," which is why the policy calls DNS action "typically a disproportionate
remedy that could cause significant collateral damage." Those words were written about abuse cases,
not sanctions. They are nonetheless the most precise description anyone has published of what
happened to autistici.org at 1:57 this morning — published in advance, by the party that did it.

At mid-morning UTC the hold still stood, re-confirmed in the registry's record, and the
collective's own blog — safe on a sibling domain the sanctions entry didn't name — had not yet
told its users the name was gone.

The designation will be argued about for months, in Italy and probably in court. The mailboxes
did not get months. They got 37 hours, at 1:57 in the morning, from a registry that has not said
a word.

## References

- RDAP (the registry's machine-readable successor to whois) record for autistici.org — https://rdap.publicinterestregistry.org/rdap/domain/autistici.org — Public Interest Registry — pulled 28 Aug 2026 10:13:58 UTC (curl, JSON archived), independently reproduced by the desk lead, and re-pulled at press time 28 Aug 11:20:46 UTC (curl). All pulls: status set "server hold", "client transfer prohibited", "server transfer prohibited", "server update prohibited"; "last changed" event 2026-08-28T01:57:20.598Z, reproduced to the millisecond; registrar Gandi SAS; registration 2000-08-10; expiry 2029-08-10.
- Port-43 whois for autistici.org — .org registry whois — pulled 28 Aug 2026 (whois client, archived): Updated Date 2026-08-28T01:57:20Z, same four statuses, each linking icann.org/epp definitions. The top-line record-state field reads "ACTIVE" and is contradicted by the Domain Status lines; it is not quoted.
- ICANN EPP status code definitions — https://icann.org/epp — ICANN — linked from the whois record itself; basis for the server-set vs client-set attribution.
- DNS effect probes — dig autistici.org SOA against a0.org.afilias-nst.info → NXDOMAIN from the .org authoritative server; dig A and MX via resolver → NXDOMAIN; noblogs.org resolves normally — 28 Aug 2026, session logs archived.
- Sibling RDAP pulls — noblogs.org, inventati.org, investici.org, ai-odv.org — same PIR RDAP base URL — 28 Aug 2026: no server-side status on any; only routine client-side registrar locks predating this week.
- Origin liveness — curl --resolve www.autistici.org:443:93.190.126.19 → HTTP 200, site title intact; SMTP banner from mx1.investici.org:25 answers — 28 Aug 2026.
- OFAC, Recent Actions, 26 Aug 2026 (SDN entry verbatim, including the single Website field autistici.org) — https://ofac.treasury.gov/recent-actions/20260826 — US Treasury OFAC — 26 Aug 2026, retrieved 28 Aug 2026.
- "Treasury Takes Action Against Violent Far-Left Terrorist Networks" — https://home.treasury.gov/news/press-releases/sb0616 — US Treasury — 26 Aug 2026, retrieved 28 Aug 2026.
- General License No. 36 (PDF) — https://ofac.treasury.gov/media/936791/download?inline — US Treasury OFAC — 26 Aug 2026, retrieved 28 Aug 2026; the PDF's digital-signature timestamp, read from the desk's archived copy, is 26 Aug 2026 08:31:37 EDT — one endpoint of the 37-hour interval.
- "Designation of Autistici Inventati as a Specially Designated Global Terrorist" — https://www.state.gov/releases/office-of-the-spokesperson/2026/08/designation-of-autistici-inventati-as-a-specially-designated-global-terrorist/ — US Department of State — 26 Aug 2026, retrieved 28 Aug 2026 (source of the 16,000-mailbox figure).
- OFAC FAQ 1190 — https://ofac.treasury.gov/faqs/1190 — US Treasury OFAC — retrieved 28 Aug 2026 (personal-communication exemption and protected-activity language).
- A/I collective statement, Italian and their own English — https://cavallette.noblogs.org/2026/08/10076 — cavallette (A/I's blog, on noblogs.org) — 26 Aug 2026 22:20, retrieved 28 Aug 2026; re-probed at press time 11:21 UTC: still the collective's latest statement.
- "[REPOST] The Server Called Paranoia: Defend Autistici/Inventati Before September 25" — https://cavallette.noblogs.org/2026/08/10083 — cavallette — 27 Aug 2026 13:17 CEST (11:17 UTC), retrieved 28 Aug 2026; still the blog's newest post at press time.
- "A short history of the A/I Collective" — https://www.autistici.org/who/collective — Autistici/Inventati — undated, fetched 28 Aug 2026 via pinned IP because the domain no longer resolves (source of the nearly-12,000-mailbox count, the 2004 Aruba account, and the R* Plan).
- Fanpage interview with an A/I member — https://www.fanpage.it/attualita/per-gli-usa-terroristi-diamo-voce-al-dissenso-online-parla-il-collettivo-italiano-nel-mirino-di-trump/ — Fanpage.it — 28 Aug 2026 10:27 CEST; direct fetch 403 (Akamai), text retrieved via r.jina.ai; quotations appear in the desk's own English rendering.
- PIR anti-abuse policy — https://pir.org/our-impact/anti-abuse-policy/ — Public Interest Registry — undated, fetched 28 Aug 2026 via r.jina.ai (direct fetch 403). Quoted as PIR's own description of what suspending a domain does; the policy governs abuse cases, and the piece does not claim PIR invoked it here.
- "Rubio Uses Terrorism Law To Ban Secure Email Service" — https://reason.com/2026/08/27/rubio-uses-terrorism-law-to-ban-secure-email-service/ — Reason — 27 Aug 2026 (pre-hold), retrieved 28 Aug 2026.
- *Holder v. Humanitarian Law Project*, 561 U.S. 1 (2010) — cited for its holding as background; not re-retrieved for this piece.
- Coverage bound: Google News RSS sweeps (curl) — EN query on autistici/autistici.org (55 items through 03:49 GMT 28 Aug) and IT query (43 items through 08:27 UTC), 28 Aug ~10:30 UTC; press-time re-sweep 11:22–11:28 UTC: EN targeted domain/DNS/registry query returned 1 item (Reason, pre-hold), IT 24-hour query returned 18 designation items, IT targeted dominio/serverhold/oscurato query returned 0 items; Formiche's infrastructure analysis checked in full text (no mention of the hold); PIR newsroom, OFAC recent-actions index (latest entry 27 Aug, unrelated), and Gandi's news page swept — no statement or report of the serverHold found anywhere.

## Publication notes

- **Selection basis:** board ruling of 28 Aug 2026 — c01 won the five-axis weighted score at 9.38 over runner-up c08 (9.28), the tie broken by perishability: the serverHold is the desk's own unpublished discovery and is exclusive only today.
- **Body length** 1,499 words (measured with blog-temp/2026-08-28-01/wordcount.py; the figure caption is counted, per house convention).
- **Risk-register accounting (board §6):** ADD items executed at press time — item 2: fresh RDAP pull 11:20:46 UTC, hold unchanged, timestamp identical to the millisecond, so all tenses stand; item 3: the exclusivity null re-bounded in the same three registers plus PIR newsroom, OFAC recent-actions index, and Gandi's news page — nothing found, "no news outlet has reported this" stands as written; item 4: A/I's blog re-probed at 11:21 UTC — newest post still the 27 Aug repost, so the "had not yet told its users" clause stands; item 8: Gandi's client-side codes re-read (routine transfer lock only) and Gandi has published nothing, so the budgeted extra sentence was not needed; item 10: interval arithmetic re-verified from the archived endpoints (GL 36 signature 26 Aug 08:31:37 EDT → hold 28 Aug 01:57:20 UTC = 37.4 hours; hold → 25 Sept 12:01 a.m. EDT = 28.1 days); item 1's stop-the-presses sweep found no PIR, OFAC, or Gandi statement attributing the hold, so the attribution stays as drafted. HOLD items honored: the deliberate "whether on OFAC's instruction or its own compliance judgment" ambiguity is untightened; "by the registry's own record" wording kept; both mailbox counts attributed, never merged; the *Holder* clause stays scoped to "the legal theory is not exotic"; the freeze-vs-switch read remains presented as an argument from the codes' plain function, not laundered into "experts say."
- **Paid for by (board §10 cut list, whole units):** the "that is a different story" tail on the Palestine Action/Masar Badil sentence; "though neither party seems to have known it yet" from the Fanpage framing; "and it pays to see exactly why."
- **Desk-lead verification folded:** the hold independently reproduced (status set and 01:57:20.598Z stamp to the millisecond); the four-code record stated precisely — three registry-side codes set this morning, the French registrar's single routine client-side lock predating them; one clause added noting the registration is kept through 2029 (not a lapsed domain).
- **Readability gate (passed; six fixes applied) and its pays:** the first mailbox attribution expanded to "the count of the collective that runs it" (the entity is introduced two paragraphs later); strict liability glossed in three words ("no intent required"); the first interval anchored to the repost so the two clocks sort on first read; RDAP glossed in References only (uncounted; body stays clean). Paid with whole units: "— and, increasingly, Americans organizing against ICE —" cut from the close (the fact survives, attributed to the member, in the theory paragraph — the cut also restores its scope) and "reading case files" cut from the 2004 account. Net zero; re-measured at 1,499. In HOT-TAKES.md, the delegation clause was unpacked into plain language and Take 2 now ends on its own concession, the flip carried by the shared section with both mailbox counts attributed; voiceover beat eight re-cut to match.
- **Round 1 correction (post-freeze, German desk finding, desk-lead verified):** the repost-to-hold interval corrected from "Thirteen hours" to "About fifteen hours" — the repost's own metadata stamps it 2026-08-27T13:17:15+02:00 (11:17 UTC), ~14h40m before the 01:57:20 UTC hold; the earlier figure had read 13:17 as UTC. The ~37-hour interval anchors to the license signature and is unaffected; no other sentence derives from the thirteen (grepped across article, hot takes, voiceover, figure brief). Paid the +1 word by cutting "precisely" from "says who did this"; count re-measured at 1,499. References updated: the repost's timestamp now carries its zone, and the Fanpage line corrected to say its quotations appear in the desk's own English rendering. Exact before/after ledger for translators: blog-research/2026-08-28-01/ENGLISH-CHANGES-ROUND-1.md.
- **Deviations:** none from the board's synthesis instruction. Palestine Action remains capped at one sentence; the NIXI comparison remains one unnamed clause; no other sibling material absorbed.