Chapter 1: The Man Behind the Mask

Unlike the corporate obfuscation of 1337 Services GmbH (TI-2026-030A), Julian Achter publishes his identity openly. His legal imprint page reads like a deliberate act of transparency:

Am Hang 55 is a residential house in Ismaning — an affluent Munich suburb 15km northeast of the city center. OpenStreetMap/Nominatim returns coordinates (48.2216°N, 11.6621°E) that precisely match PeeringDB's registered location for his organization. He runs bulletproof hosting infrastructure blacklisted across the entire internet from his home.

The choice of Einzelunternehmer (sole proprietor) is significant. Unlike a GmbH which limits liability to share capital, Achter personally carries unlimited liability for all business debts and legal judgments. This is either extremely reckless for someone hosting C2 infrastructure — or demonstrates absolute confidence that jurisdictional friction will prevent enforcement from ever reaching his doorstep.

Chapter 2: "We Love Lain" — The Cultural Signal

Every element of Achter's infrastructure carries the Serial Experiments Lain branding:

• RIPE NIC handle: LAIN
• RIPE AS description: "LAIN we love lain, cats and the world wide web, DE"
• PTR record pattern: lain.[IP].aluy.net
• Email prefix: lain@aluy.net
• PeeringDB notes: "we love lain, cats and the world wide web — privacy | free speech | anonymity — ^^ if you dont like those, go away ^^"

Serial Experiments Lain (1998) explores the dissolution of boundaries between physical and digital identity — its protagonist discovers she IS the Wired (the internet). In cypherpunk circles, referencing "Lain" signals:

1. Ideological alignment with anonymity, decentralization, identity-as-performance
2. Community membership in specific IRC/Matrix/imageboards where the anime is canonical
3. A post-cypherpunk aesthetic popular in 2010s/2020s privacy communities

The phrase "if you dont like those, go away" is not marketing copy — it's a boundary statement. This is ideological infrastructure. The anime reference functions as a cultural passport: those who recognize it understand the service's nature without it needing to be stated explicitly.

His PeeringDB organization was created 2021-10-21 — over three years before AS211507 was allocated (2025-03-17). This suggests Achter was active in the hobbyist BGP community well before obtaining his own ASN, likely operating under someone else's infrastructure first.

Chapter 3: The Anonymous ASN Marketplace

Achter's Aluy offers a complete stack for anonymous internet presence:

The KYC Gap

From the Terms of Service:

"Identity verification may be required when fraud prevention measures indicate it is necessary."

From the Privacy Policy:

"Verification may be requested when legally required or when fraud prevention measures indicate it is necessary."

The critical word is "may". Identity verification is discretionary, not mandatory. This creates a functional payment-to-ASN pipeline:

Customer → Monero payment (untraceable) → Aluy receives XMR
    → No KYC verification (discretionary, not triggered)
    → RIPE LIR sponsoring application filed
    → ASN assigned to customer-provided identity
    → Customer has legitimate RIPE-registered routing resources
    → Zero link between payment and RIPE registration

Under RIPE NCC policy, a sponsoring LIR is responsible for vouching for End User legitimacy and ensuring resources are used as specified. Achter's "may verify" policy effectively delegates this RIPE compliance obligation to a discretionary process that, by design, rarely triggers.

Pricing Economics

At €71/year — significantly below competitors — ASN sponsoring is either a loss leader for VPS hosting revenue, an ideological commitment to accessibility, or both. The price point makes anonymous internet routing resources available to anyone with a Monero wallet and €71.

Chapter 4: The Nuclear Option — Spamhaus ASN-DROP

Spamhaus ASN-DROP is the internet's most severe reputation sanction. Unlike individual IP listings, ASN-DROP blacklists an entire autonomous system — every IP announced by that ASN is null-routed by any network accepting Spamhaus feeds.

; Julian Achter
; AS211507

45.67.138.0/24      ; Amsterdam, NL
45.133.73.0/24      ; Hong Kong, HK
45.137.69.0/24      ; Turku, FI
45.137.201.0/24     ; Sofia, BG
45.141.117.0/24     ; Amsterdam, NL
45.141.119.0/24     ; Zug, CH
92.119.164.0/23     ; Amsterdam, NL (two /24s)
185.132.53.0/24     ; Amsterdam, NL — Sliver C2 + primary Tor exits

All 2,304 IPv4 addresses are blacklisted. This is the internet equivalent of excommunication — and yet the infrastructure remains fully operational. The customers who choose LAIN are specifically seeking hosting that ignores reputation sanctions. Being on Spamhaus DROP is not a bug; for the target demographic, it's a feature that confirms the infrastructure's bulletproof nature.

Chapter 5: Command and Control — The Sliver Evidence

The Shodan C2 Intelligence Feed documents two confirmed Sliver command-and-control servers on LAIN infrastructure in 2026:

Sliver is an open-source adversary simulation framework increasingly adopted by real threat actors (replacing Cobalt Strike). The "multiplayer" SSL common name is a Sliver default. Port 31337 ("elite" in hacker culture) is a deliberate cultural choice.

Both instances are in the 185.132.53.0/24 Amsterdam block — the same subnet that hosts primary Tor exits (tor-exit.nl.2cb.li at .121). This co-location of C2 infrastructure with Tor exits on the same /24 creates perfect cover: the high volume of Tor traffic masks C2 communications.

JARM fingerprint (both): 00000000000000000043d43d00043de2a97eabb398317329f027c66e4c1b01

Achter's own AUP explicitly prohibits: "Malware, ransomware, botnet C2, exploit kits." Two confirmed violations in two months demonstrates that stated policy and actual enforcement are entirely disconnected.

Chapter 6: The Transit Architecture — Friction by Design

AS211507's BGP transit chain reveals a deliberate choice of routing through small, hobbyist ASNs rather than major carriers:

The Netherlands path — carrying 4 of 9 prefixes including the high-abuse 185.132.53.0/24 — transits through three small/hobbyist ASNs before reaching LAIN. Each hop is a separate legal entity, often a sole proprietor in a different jurisdiction. An abuse complaint must traverse: reporter → ARISTO → de Zee → Trivox → LAIN — each with different response times and procedures.

AS216078 — The Trivox Node

Liam Kremer / Trivox is the critical upstream. This ASN appears in:

• AS211507's BGP path (multiple NL prefixes)
• AS199428's BGP path (Navas/Achter customer)
• Tor Project "Good Bad ISPs" database — listed immediately after Aluy in Germany section

The clustering of LAIN, Trivox, and 1337 Services in the same Tor Project endorsement list suggests a tight European privacy-infrastructure community sharing ideological alignment and, in some cases, direct transit relationships.

IXP Presence

7 Internet Exchange Points across 4 countries — all community/free exchanges:

Notably absent: AMS-IX, DE-CIX, NL-IX — the major European exchanges. LAIN exclusively uses free/community exchange points, consistent with a small operator minimizing costs while maximizing routing diversity.

Chapter 7: The Tenant Ecosystem

2cb.li / "Satanist" — The Tor Exit Operator

The most documented tenant on LAIN infrastructure operates under the handle "Satanist" with contact admin@2cb.network. Their Tor relays on AS211507:

Part of a 22-relay family. The naming convention ("dismal", "dim", "die", "dreary") follows a dark aesthetic. The relays are distributed across all four of LAIN's European countries — matching the geofeed segments exactly.

sy.st — Achter Himself as Tor Operator

Our passive reconnaissance revealed that tor-01.sy.st resolves to 185.102.217.65 — an IP that also hosts aluy.net services. The sy.st domain:

• Runs XMPP servers (groups.xmpp.sy.st)
• Uses ProtonMail for email
• Shares IP infrastructure with aluy.net

This means Achter doesn't merely host Tor exits — he operates them personally under the sy.st domain. He is simultaneously the infrastructure provider, LIR sponsor, AND a Tor exit operator on his own network.

AS199428 — Alvaro Navas (Granada, Spain)

The only confirmed sponsored ASN via RIPE STAT data:

• Maintained by lir-de-lain-1-MNT (Achter's LIR)
• Created: 2026-04-02
• IPv4: 87.121.79.0/24 (via Neterra, Bulgaria)
• IPv6: 2a14:c380:280::/44 — carved directly from Achter's own 2a14:c380::/29
• Transit: AS216078 (Trivox) — same upstream as LAIN itself
• Confirmed Tor exit at 87.121.79.14

Achter is simultaneously the RIPE LIR sponsor, IPv6 allocator, and connected-network peer for Navas — complete vertical integration of the LIR service stack.

The "Forest" Operator — 40 Unidentified Relays

An unidentified operator (contact: forest-relay-contact@cryptolab.net) runs approximately 40 Tor relays (15 middle + 16 exit) across LAIN's NL/BG/FI/CH infrastructure. This is the largest relay family on AS211507 by count. The operator's identity is not established. If "Forest" is a state actor or criminal group positioning for traffic correlation, LAIN's bulletproof nature provides perfect operational cover.

Chapter 8: Geographic and Jurisdictional Engineering

No infrastructure in Five Eyes countries. The AUP explicitly states: "rented dedicated servers in NL, BG, CH, and FI." Hong Kong is absent from this statement despite being present in the geofeed — suggesting a newer or different arrangement.

Geofeed Manipulation

The domain geo.aluy.net serves a geofeed file via BunnyCDN (aluy-geofeed.b-cdn.net). This self-reported geolocation data is consumed by MaxMind, IPinfo, and other geolocation databases. The technique allows Achter to declare where his IPs "are" — which may or may not match physical server location.

This is the exact same technique documented in TI-2026-030A for 1337 Services (rdp.sh geofeed). Two independent actors in the same ecosystem using identical geolocation manipulation methods suggests either shared knowledge, shared tooling, or the technique being well-known within this community.

The Cryptocurrency Layer

DNS records for aluy.net reveal:

• seed.aluy.net (92.119.164.86) — cryptocurrency seed node on AS211507
• seed2.aluy.net, seed3.aluy.net — additional seed nodes
• PawPayments integration (TXT records) — crypto payment processing
• Monero acceptance explicitly advertised

The cryptocurrency seed nodes on his own bulletproof infrastructure suggest Achter operates within the privacy-cryptocurrency ecosystem not merely as a payment acceptor but as infrastructure provider for cryptocurrency networks themselves.

Chapter 9: Legal Architecture — The Sole Proprietor's Gambit

German Law Obligations

Achter's privacy policy explicitly cites §100j TKG (Telecommunications Act) as legal basis for law enforcement data disclosure. As an LIR/ISP, he likely qualifies as a "Telekommunikationsdienst" under TKG 2021, triggering:

• Traffic data retention obligations (§174 TKG — legally disputed in Germany)
• Law enforcement cooperation requirements (§170 et seq. TKG)
• Abuse handling obligations

No evidence of BNetzA (Federal Network Agency) registration was found. The absence may be legal for non-telephone IP services, or may represent a compliance gap.

RIPE NCC Accountability

Per RIPE policy, a sponsoring LIR is responsible for resources it sponsors to End Users. If abuse is demonstrated, RIPE NCC can:

1. Issue warnings
2. Require remediation
3. Terminate LIR membership
4. Revoke all sponsored resources

This is the key enforcement lever. RIPE NCC could revoke LAIN's LIR status, stripping all sponsored ASNs (including AS199428/Navas) of their legitimacy. That this hasn't happened despite ASN-DROP status and documented C2 suggests either: RIPE hasn't received formal complaints through proper channels, or the process is slow.

The Unlimited Liability Calculation

As Einzelunternehmer, Achter has no corporate veil. Any judgment against Aluy can be enforced against his personal assets — including the residential property at Am Hang 55. Either:

1. He genuinely believes enforcement will never reach him (jurisdictional confidence)
2. He has structured personal assets to be judgment-proof (common in Germany via family trusts)
3. He is young enough that personal asset exposure is minimal

Given the PeeringDB account from 2021 and the cultural signaling, option 3 seems most probable — a young operator (likely early-to-mid 20s) with minimal assets to protect and strong ideological commitment to privacy infrastructure.

Chapter 10: The Ecosystem Position

LAIN vs. 1337 Services — Parallel, Not Subordinate

Our investigation definitively establishes that LAIN and 1337 Services are parallel actors, not collaborators:

The connection is cultural and demographic — both serve the same European privacy-infrastructure community, both are endorsed by the Tor Project, both explicitly allow Tor exits, both use geofeed manipulation. But their RIPE structures, transit chains, and corporate forms are entirely independent.

The European Privacy-Hosting Cluster

The Tor Project's "Good Bad ISPs" database reveals a tight cluster of German-based operators:

1. 1337 Services GmbH (Hamburg) — AS210558
2. Aluy / LAIN (Ismaning) — AS211507
3. Trivox / Liam Kremer — AS216078 (LAIN's upstream)
4. SnapServ Interaktiv — Germany

These operators share: Tor-friendly policies, privacy-cryptocurrency acceptance, hobbyist BGP community membership, and the "Serial Experiments Lain" / cypherpunk cultural aesthetic. They are nodes in a European privacy-infrastructure network that functions as a distributed anonymity factory — each independent, but collectively providing the ecosystem that makes anonymous internet presence possible.

Chapter 11: Honeypot Correlation

Our honeypot infrastructure tracked 20 IPs on AS211507 with the following profile:

The threat scores cluster below 60 — lower than typical bulletproof hosting (cf. 1337 Services IPs scoring 70-90+). This suggests LAIN's abuse profile is more "neglected enforcement" than "actively malicious operation." The C2 instances are customer-operated; the scanning may be Tor exit traffic rather than intentional attacks.

Entity link analysis reveals ORG-JA600-RIPE (Julian Achter's RIPE organization) connecting all 20 IPs through shared RDAP registration — confirming single-operator ownership of the entire IP footprint.

Conclusions

What Julian Achter Built

A functional anonymous ASN marketplace operating under German sole proprietorship law. For €71/year and a Monero payment, anyone can acquire legitimate RIPE-registered internet routing resources with no identity verification. The infrastructure is explicitly designed to be immune to reputation-based enforcement (Spamhaus, AbuseIPDB) — because the customers specifically seek that immunity.

The LIR Marketplace Model

This is the third position in our Anonymity Factory series: not the corporate shell (030A), not the complicit small ISP (030B), but the ideologically-committed sole proprietor who openly publishes his identity while enabling anonymous internet presence for others. The marketplace operator's transparency is the mechanism that enables customer opacity.

Key Intelligence Findings

1. AS211507 is fully Spamhaus ASN-DROP blacklisted — all 2,304 IPs, the nuclear option
2. Confirmed Sliver C2 on two IPs in 2026, violating Achter's own AUP
3. Achter operates Tor exits personally (sy.st domain shares IP with aluy.net)
4. No mandatory KYC + Monero = functional anonymous ASN procurement pipeline
5. 31+ Tor relays including 2cb.li ("Satanist"), sy.st (Achter), and "Forest" (40 unidentified)
6. Geofeed manipulation identical to 1337 Services technique (geo.aluy.net → BunnyCDN)
7. Residential address operation with unlimited personal liability — maximum exposure, maximum ideological commitment
8. Five-country distribution avoids Five Eyes, optimizes for privacy jurisdictions

Series Position

If 1337 Services (030A) is the factory and SERVPERSO (030B) is the negligent supplier, then LAIN is the marketplace — the storefront where anonymous actors can acquire the building blocks of internet identity. The €71 price point and Monero acceptance make this accessible to anyone. No corporate complexity required. No intermediaries. Just a young man in a Munich suburb, a residential internet connection, and an ideology that says anonymity is a right worth providing — regardless of what that anonymity enables.

Next in series: TI-2026-030D — The Satanist (the anonymous Tor exit operator 2cb.li who is LAIN's most documented tenant).