1. The Conventional Narrative

When you query the Tor Onionoo API for the Satanist relay family, 16 relays share the same first_seen timestamp: 2026-04-06 23:00:00 UTC. Across Julian Achter's LAIN network, FranTech's BuyVM, Aokigahara SRL, Throttle Limited, TechTies, HOSTKEY, RoyaleHosting — 8 autonomous systems, 9 countries, one hour.

The natural conclusion: a coordinated mass deployment. Someone ordered 16 virtual servers across the globe and brought them online simultaneously. It suggests deep pockets, pre-established provider accounts, and operational confidence.

But Onionoo's first_seen field is hour-granular. And more importantly, it doesn't necessarily reflect when a relay was first provisioned. It reflects when the relay was first seen in this family configuration.

The distinction matters enormously.

2. The Archive Tells a Different Story

Tor's CollecTor service archives every server descriptor ever published by every relay. Unlike Onionoo's summary view, CollecTor preserves the raw historical record.

We searched archived descriptors from September 2025 through March 2026, looking for the Satanist contact string. What we found rewrites the timeline:

The fingerprints AB3CBBB2, C4FEABB1, 872BE4C1, 88034231, 90D76DEA, 518F58F7, C6C6D95F, 24E9CA38, F8F2B6BF — nine relays now showing first_seen = 2026-04-06 in Onionoo — were already publishing descriptors months earlier.

3. The Wayback Confirmation

A Wayback Machine snapshot from December 19, 2025 captures 2cb.network already presenting relay AB3CBBB2 as live infrastructure with a direct link to Tor Metrics. The operation was public and established months before April 6.

Meanwhile, 2cb.li on January 14, 2026 still showed only a default nginx page — confirming the domain migration happened later, between January and April.

The contact string evolution tells the story: admin AT 2cb dot network → admin AT 2cb dot su. The old domain (2cb.network) was later blackholed by NameSilo around May 14, 2026. The operator had already migrated to the .su Soviet TLD by then.

4. What Actually Happened on April 6

If April 6 wasn't a first deployment, what was it?

The most evidence-supported explanation is Tor's Happy Families migration. This mechanism, introduced to replace the old MyFamily directive, requires operators to:

1. Generate a single family key: tor --keygen-family
2. Copy .secret_family_key to every relay
3. Add FamilyId to every relay's torrc
4. Restart all relays simultaneously

This is exactly what April 6 looks like: a fleet-wide reconfiguration that caused Onionoo to assign new first_seen timestamps. The operator took the opportunity to:

• Consolidate branding — purging names like mine, freedom, ExitForPrivacy in favor of the death lexicon
• Migrate contact — from 2cb.network to 2cb.su
• Restructure hosting — some IPs changed between pre-April and post-April configurations

5. The Full Deployment Timeline

With both Onionoo and CollecTor data, we can reconstruct the actual expansion history:

The pattern is clear: 16 on day one (the regrouping), then a steady trickle of new additions — one to two per week through June 2026. The network is still growing.

6. The Automation Evidence

Three independent signals confirm the fleet is managed by configuration automation, not manual administration:

6.1 Template-Driven Configuration

Analysis of Onionoo exit policies and bandwidth settings reveals 3-4 distinct configuration templates applied across the 27 relays:

• Profile A: 7 relays — reject ports 25/465/587, 1 GiB/s rate/burst
• Profile B: 4 relays — reject ports 25/465/587, 100 MiB/s rate/burst
• Profile C: 4 relays — guard-only (reject *:*), 1 GiB/s rate/burst
• Profile D: 3 MAXKO relays — extended allowlist, 524288000 rate/burst

6.2 The 38-Minute Restart Window

On June 19, 2026, all 27 relays restarted between 20:46:47 UTC and 21:25:03 UTC. The order suggests an automation inventory iterating through hosts — not a human clicking provider consoles one by one. Each restart is spaced roughly 1-2 minutes apart, consistent with sequential SSH connections.

6.3 ansible-relayor: The Best-Fit Tool

The open-source nusenu/ansible-relayor Ansible role performs exactly the operations observed:

• Generate a family key with tor --keygen-family
• Distribute .secret_family_key to all hosts
• Template each relay's torrc from variables
• Set FamilyId from the shared public family ID
• Restart all relays in sequence

7. The Naming Evolution

The CollecTor archives reveal a personality shift in the operator's relay naming:

The shift is deliberate. ExitForPrivacy is an advocacy statement — it says "I run exits because privacy matters." death is a persona — it says "I am this aesthetic." The April 6 reorganization wasn't just technical. It was the moment the operator consolidated an identity.

Notable gaps: doom, dread, dire, decay, despair, deathly — all absent. This is not a mechanically generated thesaurus dump. It's a hand-curated selection, which means each name was chosen. The operator cares about words.

8. The Provider Supply Chain

To deploy 16 relays in one day across 8 ASNs, you need either pre-existing accounts at all providers or the ability to open accounts and provision servers within hours. We investigated each provider's onboarding requirements:

The dual-tier strategy is elegant: zero-KYC providers for rapid anonymous expansion, Tor-aware providers with pre-existing relationships for infrastructure stability. BuyVM's requirement for "legitimate name, residential address, and residential ISP" means those accounts were established well before April 6.

9. June 19: The Security Patch

The June 19 synchronized restart was one of the first signals that led us to investigate the Satanist network. All 27 relays restarting within 38 minutes demands an explanation.

The answer is mundane but revealing:

• June 3, 2026: Tor Browser 15.0.15 released, noting "important security updates to the tor daemon" (Tor 0.4.9.9)
• June 4, 2026: Tails 7.8.1 released as an emergency release, updating Tor client to 0.4.9.9 for "several security vulnerabilities"
• June 19, 2026: All 27 Satanist relays restart, 26 of 27 now running 0.4.9.9

The operator applied the security patch ~2 weeks after release, across the entire fleet, in under 40 minutes. One relay (FC088734 in the US) remained on 0.4.9.5 — either a failed update or deliberately held back as a control.

10. The Operation Talent Timeline

FBI's Operation Talent (January 29, 2025) seized Cracked.io, Nulled.to, StarkRDP, and related services. Prior dossiers (030A, 030B) documented that rdp.sh — 1337 Services GmbH's retail brand — survived the seizure. The 2cb.li relays run on 1337/SERVPERSO infrastructure.

The timeline:

• Jan 29, 2025: Operation Talent executed
• Sep 21, 2025: Earliest confirmed Satanist relay descriptor (8 months post-Talent)
• Dec 19, 2025: 2cb.network publicly advertising relays
• Apr 6, 2026: Family reconstitution (15 months post-Talent)

The 8-month gap between Operation Talent and the first Satanist descriptor makes a direct post-Talent reconstitution unlikely. But the broader pattern — the darknet ecosystem's migration toward compartmented, privacy-first infrastructure after major seizures — is the environment in which the Satanist network emerged.

11. Cross-Corpus Intelligence

Searching across our complete intelligence corpus (30+ investigations, 8,000+ IPs), the April 6 event connects to a broader pattern of coordinated deployments we've documented:

• TI-2026-026N (Heficed): 1,313 campaign IPs activated within a single second (11:32:47 UTC, May 21, 2026) — centralized C2 orchestration at industrial scale
• TI-2026-025A (Outlaw): Multi-campaign coordinated deployment across MEVSPACE, FranTech, and cloud providers — same simultaneous-launch pattern
• TI-2026-023A (VPN): Zwiebelfreunde's 100 Tor exits with zero abuse vs. the Satanist's 27 with 100% abuse tolerance — the ethical axis of relay operation

The April 6 event sits between these extremes. Not 1,313 IPs in one second (botnet). Not a slow organic growth (legitimate operator). 16 relays in one hour across 8 ASNs — the tempo of a privacy professional, not a criminal enterprise nor a hobbyist.

12. The Unanswered Questions

1. What triggered April 6? No public law enforcement operation, no provider deplatforming, no Tor Project advisory explains the regrouping. Was there a private abuse complaint? An undisclosed provider action? Or simply an operator-initiated restructuring?
2. Did relays disappear between March and April? If relays went offline in late March, forcing the April 6 re-roll, that would point toward external pressure. A full CollecTor census could answer this.
3. Is April 6 family-local or network-wide? Did other Tor relay families also restructure around this date? If yes, it might correlate with a Tor protocol change or community event rather than an operator-specific trigger.
4. When did the family/contact transition complete? The exact date when 44FB... + admin@2cb.network became admin@2cb.su would pinpoint the operational switchover.
5. What does the 44FB prefix mean? Pre-April contact strings include this prefix alongside the email — possibly a CIISS (Contact Info in Server Strings) identifier or proof-of-ownership token.

13. Conclusions

The Coordinated Deployment wasn't what it appeared. The forensic record tells a more nuanced story:

• The Satanist relay operation is at least 9 months old, not 2.5 months
• April 6 was a reorganization — new family structure, new contact domain, new naming convention — not a first deployment
• The fleet is managed by configuration automation capable of reaching all 27 relays in under 40 minutes
• The operator selects providers along a privacy spectrum — zero-KYC for expansion, identity-aware for stability
• Security patches are applied promptly and uniformly — 2 weeks from release, 100% fleet coverage
• The naming evolution from freedom to death reflects a deliberate identity consolidation

This is not a hobbyist who stumbled into running Tor relays. This is an operator who has refined their infrastructure, their identity, and their operational security over months — and who restructured everything in one evening when the time came.