Tsutaja

Record ID: ACT-0005
Handle(s): Tsutaja, Phin
Status: Inactive
First Observed: 2024-01-29 (Earliest in provided logs; operations date back to mid-2023)

Tsutaja (also operating under the handle “Phin”) is an independent systems administrator, developer, and the founder of Tsutaja Networks. They are best known as the operator of Filehaus, a “bulletproof” file-hosting service, alongside affiliated projects such as Tsumail and Tortaja (a Tor-based hidden service).

The logs reveal Tsutaja to be a highly dedicated and technically capable infrastructure operator who builds custom backends (frequently in Rust), manages BGP sessions, sets up Autonomous System Numbers (ASNs), and procures physical hardware for colocation in datacenters across Europe and the United States. Operating on a shoestring budget funded primarily through cryptocurrency donations and part-time work, Tsutaja demonstrates significant persistence in keeping their network online.

Ideologically, Tsutaja identifies as a free-speech absolutist and an “ultra-libertarian.” They willingly host controversial, highly targeted platforms—including KiwiFarms and various cybercrime or neo-Nazi properties—refusing to bow to DMCA requests or public pressure. The strict exception to this rule is real-world Child Sexual Abuse Material (CSAM), which Tsutaja actively polices and removes, citing their own history as a victim of childhood abuse.

Tsutaja is a complicated and polarizing figure. As a self-described trans woman who frequently employs 4chan-style shock humor and slurs, they frequently clash with both progressive tech spaces and the right-wing communities they host. They are prone to volatile feuds, impulsive doxxing of adversaries, and intense operational paranoia.

• Tsutaja — Primary handle across Telegram and development platforms.
• Phin — Secondary identity, associated with PGP keys and the email [email protected].
• Tsutaja Networks — The organizational entity for their hosting projects.

• Tsutaja Networks (Founder and Operator)
• Filehaus / Tsumail / Tortaja (Primary Developer)
• iHostART / MAN Hosting S.R.L. (Infrastructure partner; frequently collaborates with an individual named “Calin”)

• 2023-06-10 — Filehaus is established (based on first-anniversary logs).
• 2024-04-27 — Publishes primary PGP public key for “Phin, Tsutaja Networks”.
• 2024-07-09 — Filehaus suffers massive (200Gbps+) DDoS attacks and BGP session drops due to hosting KiwiFarms.
• 2024-07-17 — Tsutaja claims to have identified the individual behind the “NullBulge” threat actor group.
• 2024-08-13 — Tsutaja Networks is officially registered as a corporate entity in South Africa.
• 2026-03-01 — Last known activity in the provided dataset.

• Filehaus Summer 2024 DDoS & Routing Outages
• NullBulge Doxxing Claim
• FMHY (Freemediaheckyeah) Community Feud

Technical Proficiency and Resourcefulness The logs strongly indicate that Tsutaja possesses genuine technical skill. Unlike many entry-level operators who rely on managed VPS providers, Tsutaja writes custom server backends in Rust, manages load-balancing across multiple Content Delivery Networks (CDNs), procures secondhand enterprise hardware (such as ex-Chia mining drives and Xeon processors), and negotiates directly with datacenter providers for colocation and transit. They exhibit a strong preference for bare-metal Linux (Debian, Gentoo) and hold a deep disdain for modern web bloat, notably refusing to rely on JavaScript for their core services.

Ideological Contradictions Tsutaja occupies a highly specific intersection of internet subcultures. They identify as a transgender woman and libertarian, yet frequently utilize a vocabulary heavily saturated with racial, homophobic, and transphobic slurs. They actively platform communities that are explicitly hostile to their own demographics (e.g., the Daily Stormer, KiwiFarms) purely on the principle of free speech. As demonstrations of ideological consistency go, Tsutaja's simultaneous identification as “transfem” and enthusiastic deployment of the handle “autisticgroyper1488” certainly marks out a unique operational lane.

Anti-CSAM Stance Despite their willingness to host almost any other form of controversial or illegal content (including pirated media, malware, and extremist forums), Tsutaja draws a hard line at real-world CSAM. They actively cooperate with law enforcement reporting agencies to remove it. Tsutaja frequently attributes this strict boundary to their own trauma as a childhood abuse survivor. Notably, however, they fiercely defend the hosting of fictional/drawn underage material (loli/shotacon) as a free-speech issue, frequently mocking organizations like the Internet Watch Foundation (IWF) for attempting to censor it.

Hostility and Paranoia Tsutaja operates in a perpetual state of conflict. The logs document relentless DDoS attacks against their infrastructure, upstream providers terminating their BGP sessions, and domain registrars (like Namecheap and Identity Digital) suspending their URLs. In response to adversaries—ranging from rival hackers like “Emo” to “moralfags” from the FMHY subreddit—Tsutaja is highly combative. They frequently engage in counter-doxxing, claiming to expose the real names and addresses of those who cross them. While their operational security regarding their own infrastructure appears robust, their interpersonal conduct is volatile, impulsive, and deeply entrenched in internet drama.

Record created: 2026-05-11.