Anonymous VPS for Conflict Zone Reporters

The reporter operating from a conflict zone has to assume four things simultaneously: networks are monitored, devices may be seized at checkpoints, local fixers may be detained and interrogated, and combatant factions may target press infrastructure directly. Each of these is a distinct attack vector with its own mitigation.

Network monitoring is defeated by Tor or a trusted commercial VPN paid in crypto, not the corporate VPN of a Western newsroom which is itself often surveilled. Device seizure is defeated by full-disk encryption with a strong passphrase and zero plaintext credentials stored on disk. Fixer compromise is defeated by compartmentalization - fixers know only what they need to know for their immediate task. Targeted infrastructure attack is defeated by hosting the actual content in a jurisdiction the attacker cannot reach.

The provisioning workflow we recommend for conflict zone deployments:

1. Set up the account from outside the conflict zone, before deployment. Register a ProtonMail address over Tor, then sign up at Anubiz with that address. No name, no phone, no address is collected.
2. Pay in Monero from a wallet not linked to any KYC exchange. Many reporters use peer-to-peer Monero markets for this.
3. Provision the VPS in Iceland or Romania. Both are outside the legal reach of most active conflict zones in 2026.
4. Harden the VPS with SSH key authentication only, custom SSH port, fail2ban, and an automatic security update cycle.
5. Configure Tor hidden service for the admin interface so management does not require a clearnet connection from the field.

This workflow is documented in detail in the Tor hidden service hosting guide.

Once deployed, operational practices matter as much as the initial setup:

• Never connect from your hotel network. Use a SIM card bought anonymously plus Tor, or a satellite uplink for the most sensitive sessions.
• Encrypt before upload. The server should never see plaintext source material. Use age, GPG, or restic with a strong repository password.
• Compartmentalize accounts. The publishing identity, the source-comms identity, and the storage identity should be three separate accounts on three separate servers if budget allows.
• Have a dead-man switch. A cron job that wipes sensitive directories if you fail to authenticate within a defined window.
• Renew in crypto. Never let a renewal lapse to a card payment. We send renewal notices well in advance.

Conflict zone deployments typically fit on the Mini or Mini-V plans. Mini at $6 per month covers basic publication and source comms. Mini-V at $12 adds enough headroom for SecureDrop, Matrix, and a Nextcloud staging area. For multi-reporter teams covering long conflicts we recommend Romania VPS III at $99.99 per month, which handles encrypted document archives and full-text search.

Read the related war correspondent guide and the freelancer in hostile state brief for adjacent threat models. Browse plans to start.