Namecheap Sold the Domains Behind Russia’s AI Bot Farm

Federal agents announced the seizure of two domain names on July 9, 2024, cutting the mail servers that had registered 968 fake X accounts for a Russian AI bot farm. The domains, mlrtr.com and otanmail.com, had been bought from Namecheap, Inc., the Phoenix registrar. Court papers did not accuse the company of knowing who was on the other end of the sale.

The farm was built for RT, Russia’s state television network, then handed to an officer of the Federal Security Service. It ran on software called Meliorator. The product on offer in Phoenix was ordinary: two cheap domains, a fake foreign address, and enough email accounts to mint a crowd of Americans who did not exist.

Two Namecheap Domains Fed 968 Fake Americans

Warrants from the U.S. District Court for the District of Arizona, dated June 27, 2024, told Namecheap to point both domains at FBI servers. A second warrant authorized a search of the 968 X accounts tied to those mailboxes. X separately suspended the remaining accounts for breaking its rules. The Justice Department said the platform had already taken down a large share of them before the court action landed.

THE SEIZURE IN FIGURES

• The accounts: Investigators listed 968 profiles on X, created from June 2022 through March 2024.
• The domains: Operators used mlrtr.com and otanmail.com as private mail servers that issued the addresses behind those profiles.
• The court date: Arizona warrants issued June 27, 2024; the public announcement came July 9, 2024.
• The alleged offenses: Use of the U.S. domains was charged as a violation of the International Emergency Economic Powers Act, and the payments for that gear as money laundering.

Attorney General Merrick B. Garland called the work a disruption of “a Russian-government backed, AI-enabled propaganda campaign.” Gary Restaino, then U.S. Attorney for the District of Arizona, put the local stake in plainer words: the ideas on those feeds “should be generated by Americans, for Americans.”

The Justice Department today announced the seizure of two domain names and the search of 968 social media accounts used by Russian actors to create an AI-enhanced social media bot farm that spread disinformation in the United States and abroad. Learn more: https://t.co/ibmqaruf5U pic.twitter.com/apWv6rGRYL

— FBI (@FBI) July 9, 2024

The Phoenix Registrar Was the Quiet Stakeholder

Namecheap is not a storefront on a side street. It is an ICANN-accredited registrar that has sold domains since 2001, and it lists a Phoenix office on East Washington Street, Suite 300. Court papers in the bot-farm case say the operators hid that they were in Russia while they bought the infrastructure, starting in April 2022, and used a fake Lithuanian address on the paperwork.

That is the part the local headline flattened. Russians did not occupy a Phoenix office. They bought two names from a company that sells millions of them, then stood up mail servers that could mint addresses on demand. Anyone who controls example.com can create mailboxes at that domain. Anyone who controlled mlrtr.com and otanmail.com could create the inboxes X required to open accounts.

Namecheap would not discuss the specific case. The company said it “actively combats all forms of abuse on our platform.” The Justice Department’s files, as unsealed, contain no claim that Namecheap staff knew they were selling to an FSB-backed shop. The company still became the American address on a foreign influence job, which is a form of skin in the game even when it is unwitting.

The mailboxes were the choke point the FBI wanted. Seizing the domains, an agent wrote, would block the one-time passcodes the farm scraped to beat X’s checks, stop new profiles that relied on those inboxes, and cut delivery to the servers. The software could be copied. The two names could not be reused once the banners went up.

What Meliorator Did Inside the Fake X Accounts

The technical picture sits in a joint cybersecurity advisory on Meliorator from the FBI, the Cyber National Mission Force, Dutch intelligence and police, and the Canadian Centre for Cyber Security. Affiliates of RT used the package to build fictitious personas of several nationalities and to post on X about the United States, Poland, Germany, the Netherlands, Spain, Ukraine, and Israel.

Meliorator was not a noisy spam cannon. It was a persona factory. Operators picked an archetype, or let the system fill the blanks, and the software assembled a “soul”: a name, a town, a politics, a biography, even profile pictures. A “thoughts” pane then assigned the bot a script of likes, follows, comments, and original posts that matched that soul. As of June 2024 the tool only ran on X, though the authors said the code pointed to other networks later.

THE MELIORATOR TOOLKIT

• Brigadir: An admin dashboard where operators logged in over a VNC link and steered groups of bots instead of one account at a time.
• Taras: The back-end engine, with configuration files that told each persona how to behave.
• Souls: Identity packs that could be full profiles with photos and bios, thin accounts used mainly to like and comment, or “authentic” copies built from crawled personal data.
• Evasion tricks: Proxy addresses matched to a fake hometown, scraped one-time codes from the private mail servers, and user-agent spoofing meant to slip past X’s checks.

Developers tracked the project in Redmine, hosted at a subdomain of mlrtr.com. The advisory said the bots could write original posts, mirror one another’s lines, and push older Kremlin stories so a reader would see what looked like agreement among strangers. One sample soul in the advisory was a Minneapolis “humanist” who liked Bitcoin and talked about a “New World Order.” That is the specimen, not a metaphor: a made-up Minnesotan, with hobbies, aimed at a real American feed.

An RT Editor and an FSB Officer Shared the Controls

The Justice Department left the main players unnamed. Individual A, it said, worked in early 2022 as deputy editor-in-chief at RT in Moscow. After RT lost its usual U.S. channels, the network’s leadership wanted another way to move copy. Individual A led the build of software that could open fictitious accounts “on a wide-scale basis.” Individual B and others then bought the first servers in April 2022 while hiding that they were in Russia.

In early 2023, with Kremlin approval and money, an officer listed as FSB Officer 1 set up a private intelligence organization. RT staff, including Individual A, sat inside it. The Justice Department said the group’s real job was to advance FSB and Russian government aims, including by spreading falsehoods through the accounts the farm had already grown. FSB Officer 1, Individual A, and other members all had access to the dashboard.

HOW THE FARM WAS BUILT

1. Early 2022: Individual A, then RT’s deputy editor-in-chief, leads work on a social-media bot farm after the network looks for ways to publish beyond television.
2. April 2022: Individual B and others start buying infrastructure while hiding their location in Russia.
3. June 2022: The first of the 968 X accounts appear, registered through mail on the two Namecheap domains.
4. Early 2023: FSB Officer 1 forms the private intelligence organization with Kremlin backing; RT employees, including Individual A, join it.
5. October and November 2023: The farm posts the sample videos later quoted in the affidavits, including clips of President Vladimir Putin on Ukraine and Poland.
6. March 2024: Account creation on the seized mail domains ends, per the court files.
7. June 27, 2024: Arizona warrants authorize the domain redirects and the search of the 968 accounts.
8. July 9, 2024: The Justice Department, FBI, and foreign partners announce the disruption and publish the advisory.

The lead developer of Meliorator, the warrants said, was tied to the email and phone numbers used to buy the domains. That person was described as another RT employee. The trail ran through Gmail addresses used to register the U.S. names. No defendant is named in the public papers.

The Bots Posted Putin Videos From Fake U.S. Hometowns

The affidavits do not ask readers to imagine the harm. They quote what the fake Americans actually pushed in the fall of 2023, after the farm had already been alive for more than a year. The posts were built to look like local talk, then to drop a Kremlin clip into a U.S. thread.

POSTS CITED IN THE AFFIDAVITS

Those lines are the farm’s voice. A reader in a candidate’s mentions, or a reader scrolling a Minneapolis feed, would have seen a neighbor, not a desk in Moscow. Deputy Attorney General Lisa Monaco said the department would “not tolerate Russian government actors and their agents deploying AI to sow disinformation and fuel division among Americans.” The division, in this file, was a video dropped under an American name.

Today’s actions represent a first in disrupting a Russian-sponsored Generative AI-enhanced social media bot farm. Russia intended to use this bot farm to disseminate AI-generated foreign disinformation, scaling their work with the assistance of AI to undermine our partners in Ukraine and influence geopolitical narratives favorable to the Russian government.

Christopher Wray, FBI Director, Justice Department announcement, July 9, 2024

Why Namecheap Kept Appearing in Russian Cases

Meliorator was one operation. The Phoenix registrar’s name did not leave the file when that farm’s banners went up. On October 24, 2024, Sen. Mark R. Warner, then chairman of the Senate Intelligence Committee, sent a letter to Namecheap’s then-CEO, Richard Kirkendall, at the East Washington Street address. Warner also wrote the heads of GoDaddy, Cloudflare, Newfold Digital, NameSilo, and Verisign.

That letter was about a different Russian project, the Doppelganger network, which cloned Western news brands and had already been tied to domain seizures that September. Warner said Justice Department papers showed the firms had provided registration services to that network. He listed tells that, in his view, should have raised a flag: cryptocurrency payments, anonymizing networks, cards issued to a U.S. company with staff in Russia, thin fake identities, and in at least one case a Russian address.

I write to express concerns about the extent to which your company has ostensibly facilitated sustained covert influence activity by the Russian Federation and influence networks operating on its behalf.

Mark R. Warner, U.S. Senator, letter dated October 24, 2024

Warner warned that Congress “may need to evaluate legislative remedies.” He asked the companies to act in the days around Election Day 2024. The letter is not a finding that Namecheap ran Meliorator. It is a finding, from the chairman of the intelligence committee, that the same registrar layer kept selling the names that Russian influence shops needed.

In October 2024, federal agents also seized another set of domains tied to an FSB spear-phishing unit known as Callisto Group. Almost all of those names had been bought through Namecheap. That case was about stolen inboxes, not fake Minnesotans. It still ran through the same Phoenix counter.

By June 26, 2026, Namecheap’s own help page listed Hillan Klein as chief executive officer. Kirkendall, the man Warner wrote, was no longer in that chair. The company still presents itself from 4600 East Washington Street, and it still prints “We love Ukraine” on that page. The bot-farm domains were a tiny sale. The pattern around them is why the registrar, not the RT editor, is the American stakeholder in this file.

No Public Charges Followed the Seizure Warrants

The Justice Department said on July 9, 2024, that the investigation was ongoing. It updated the same announcement on February 6, 2025, and left that sentence in place. No public indictment of Individual A, Individual B, or FSB Officer 1 has been announced. The affidavit for the domain seizures and the companion search warrant did the work that a charging document has not: they took the mailboxes, named the software, and described the chain from RT to the FSB.

That is a long gap. Account creation ran from June 2022 through March 2024. The public takedown came in July 2024. For most of that span the farm was a live product, posting as Americans, while the two Phoenix domains sat in a commercial registry like any other pair of names. A disruption that arrives after the personas are already in the feed is a cleanup. It is not a lock on the front door.

The seized sites were redirected to FBI notices. X took down the listed bots. Meliorator’s authors, the advisory said, already had an eye on other platforms. The unnamed editor, the FSB officer, and the private intelligence shop were in Russia, beyond an Arizona warrant’s easy reach. What the United States could touch was the registrar record and the accounts that record had spawned.

The two Namecheap domains are still the only American property the public file takes off the table. The software, the souls, and the people who built them were never in Phoenix. They only needed someone in Phoenix who would sell them a name.

Frequently Asked Questions

What Is Meliorator Software?

Meliorator is a custom bot-farm package that RT affiliates used from 2022, with an admin panel called Brigadir and a back-end called Taras, plus a crawler named Nemezida that could copy traits from real users. The joint advisory said unselected profile fields were auto-filled, and that developers tracked work in Redmine on a subdomain of mlrtr.com. It was not a public chatbot; a human still had to sit at the dashboard.

Did Namecheap Know It Sold Domains to Russian Intelligence?

Unsealed Justice Department papers do not say the company knew. Namecheap declined to discuss the specific investigation and said it fights abuse on its platform. It remains an ICANN-accredited U.S. registrar, accepts common cards and Bitcoin among other methods, and was not charged in the Meliorator warrants.

Which Platforms Did the Bot Farm Target?

The 968 accounts that were searched sat on X. As of June 2024, partners said Meliorator only worked there, but their review of the code indicated the builders meant to add other social networks. The influence targets named in the advisory were the United States, Poland, Germany, the Netherlands, Spain, Ukraine, and Israel.

Were Any Russians Charged in the Meliorator Case?

No public charging document has named Individual A, the RT deputy editor-in-chief, or FSB Officer 1. The Arizona warrants treated the U.S. domains as property used in IEEPA and money-laundering offenses and sent them to FBI servers. The National Security Division, the District of Arizona, and the Northern District of Illinois were listed as the offices on the case.

What Happened to mlrtr.com and otanmail.com?

Both names were redirected to FBI-controlled servers under the June 27, 2024 warrants and later showed federal seizure notices. The mailboxes those domains hosted could no longer issue the addresses or one-time codes the farm used to open and keep X accounts. The investigation page was last updated on February 6, 2025, still describing the inquiry as ongoing.