Chapter 1: The Connecting Thread

Throughout this investigation series, three infrastructure providers emerged as distinct entities: a German GmbH with a SHA1-hashed director (030A), a Belgian RIPE maintainer serving Turkish phishing (030B), and a Munich anime enthusiast selling anonymous ASNs (030C). They appeared unrelated — different jurisdictions, different business models, different aesthetic sensibilities.

The Satanist connects them all.

No other actor in our entire intelligence corpus spans all three of the providers documented in this series. The Satanist is not merely a customer — they are the proof of concept that the anonymity factory works as designed. Multiple bulletproof providers, each with plausible deniability, serving one pseudonymous operator who cannot be identified, contacted, or stopped through conventional channels.

Chapter 2: The Name — Psychedelics, Death, and the Soviet TLD

2C-B (4-Bromo-2,5-dimethoxyphenethylamine) is a Schedule I controlled substance in most jurisdictions. First synthesized by Alexander Shulgin in 1974 and published in PiHKAL (1991), it was widely sold in Dutch smart shops before EU scheduling. The choice of this name for Tor relay infrastructure is deliberate cultural coding:

• Subcultural membership — signals familiarity with psychedelic/darknet culture
• Transgressive identity — "I name my infrastructure after drugs because I don't care about your norms"
• Historical resonance — Shulgin's work was itself an act of scientific defiance

The relay naming scheme reinforces this: death, demise, dismal, dim, die, dreary, drear, depression, dark, dead, desolate. Not random words — a curated lexicon of darkness, each beginning with 'D'. This is an aesthetic choice revealing deliberate creative attention to branding.

The migration path is telling: When 2cb.network was blackholed (May 2026), the operator was already prepared with 2cb.su — a Soviet-era TLD managed by the Russian Foundation for Internet Development, where WHOIS/RDAP queries are opaque and registrar cooperation with Western law enforcement is... complex. The .su TLD is a dead country's domain that persists as a haven for actors seeking registrar-level opacity.

The site's hidden HTML metadata reveals additional personality: <meta name="2cb" content="look-for-the-bear-necessities"> — a Jungle Book reference functioning as a playful Easter egg. The favicon is a 💊 pill emoji rendered as SVG. These details reveal a personality: irreverent, technically competent, culturally literate, deliberately transgressive but with humor.

Chapter 3: The Complete Relay Roster

The Tor Project's Onionoo API (queried June 20, 2026) returns the complete active family, cryptographically verified via shared family certificate J5lwoyq+EYO6k9uq+HixF30nFFBBcKGPOsfasr+yLzo:

Bandwidth distribution: The top 5 relays account for ~200 MB/s; the bottom 10 account for ~90 MB/s. This is a deliberately distributed architecture — no single relay is critical, but collectively they form a substantial exit capacity.

Geographic strategy: Netherlands dominates (11 relays) due to hosting availability and legal environment. But presence in Romania, Bulgaria, Hungary, Finland, Sweden, and the US ensures that no single European legal action can eliminate the network.

Chapter 4: The Mynymbox Link — DNS as Identity

The single most revealing technical finding: 2cb.li's nameservers are dns.mynymdns.me and dns.mynymdns.st — Mynymbox's NymDNS service.

Mynymbox Hosting LLC is registered at Hamilton Development, Unit B, Charlestown, Nevis, KN0802. This is the same address structure used by the allium.top registrant. The company describes itself as "entirely self-funded and privately owned" — a privacy-focused hosting company that acts as a "privacy proxy" between customers and upstream domain registrars.

The Satanist is a confirmed Mynymbox customer. Mynymbox controls DNS resolution for all *.2cb.li subdomains — meaning every relay hostname (tor-exit.nl.2cb.li, tor-exit.bg.2cb.li, etc.) resolves through Mynymbox's infrastructure. This is not merely a service relationship; it's an operational dependency. If Mynymbox chose to blackhole 2cb.li's DNS, the entire relay network would lose its vanity hostnames instantly.

Chapter 5: Aokigahara SRL — The Suicide Forest Hosts Your Relays

Aokigahara SRL (AS215659), operating commercially as Kyun SRL under the brand kyun.sh, is a Romanian privacy cloud provider hosting 3 of the Satanist's relays:

The naming is diagnostic:

• Aokigahara = Japan's "Suicide Forest" at the base of Mount Fuji, notorious worldwide as a site of death
• Kyun = Japanese onomatopoeia for a heartbeat/pang (キュン) — common in anime
• MOEMOEKYUN = AS description referencing K-On! anime (萌え萌えキュン)

This company provides infrastructure for the Satanist's relays in three countries: Romania (93.113.25.109, near Bucharest), Netherlands (150.40.117.43, Amsterdam), and United States (45.38.20.213, Spokane Valley, Washington). A Romanian SRL routing IP space to the United States is highly unusual for a small provider and suggests a sophisticated understanding of BGP routing and remote IP justification at RIR level.

The aesthetic connection between Aokigahara SRL (death/suicide naming) and the Satanist (death-themed relay names) is too precise to be coincidental. Either:

1. The Satanist chose Aokigahara SRL specifically because the naming resonated (customer with shared aesthetic)
2. The Satanist is the operator of Aokigahara SRL (one person, multiple brands)

We cannot currently prove option 2. But the convergence of: death-themed naming, privacy cloud services, 2024 founding date, anime aesthetic overlap, and hosting of the Satanist's relays across three countries makes option 1 (pure coincidence of taste) insufficient as an explanation.

Chapter 6: The Saint Kitts Pattern

Three distinct entities in the 2cb.li ecosystem register in Saint Kitts and Nevis (KN), a Caribbean microstate with 47,000 inhabitants:

Saint Kitts and Nevis offers: no MLAT with Germany for cybercrime, LLC formation under $500, minimal beneficial ownership disclosure, and no established precedent for EU cyber-crime extradition. The jurisdiction was chosen specifically for these gaps.

Consider the investigator's path: A German prosecutor investigating abuse from 185.132.53.121 must trace through: Tor Project (US, content-neutral) → IP registered to AS211507 → ASN operated by Julian Achter (Germany, but mere conduit) → serving an operator identified only as "Satanist" → paying in Monero through NymBox (Saint Kitts) → domain in Liechtenstein with NymDNS (Saint Kitts). Every link is designed to break legal continuity.

Chapter 7: The allium.top Distinction

Prior analysis conflated allium.top with 2cb.li. The research definitively separates them:

The allium.top operator is technically transparent (publishes relay costs via CIISS format: LiteServer €3.75, rdp.sh €5, BuyVM $7) and uses a Njalla privacy DNS (founded by Peter Sunde of The Pirate Bay). They share hosting providers with the Satanist but are a distinct individual with a different wallet, different naming convention, and different cultural aesthetic.

Both operators converge on Saint Kitts and Nevis for registration. Both use bulletproof hosting. Both accept Monero. The difference: allium.top operates 3 relays transparently; the Satanist operates 27 relays behind layers of identity erasure. Scale and opacity distinguish ideology from operation.

Chapter 8: The Phishing Subnet

The 45.154.98.0/24 subnet — where allium.top previously operated (tor-exit-1.allium.top at 45.154.98.33, now relocated) — reveals the character of bulletproof hosting:

45.154.98.153 hosts caisse-epargne-se-connecter.net — an active phishing page impersonating Caisse d'Épargne, France's largest savings bank (26 million customers). This domain cohabits with Tor exit infrastructure on the same /24 — the bulletproof provider serves both with equal enthusiasm.

Chapter 9: The Zwiebelfreunde Contrast

To understand what the Satanist is, examine what they are not.

Zwiebelfreunde was raided in 2018 — later declared illegal by German courts. They accepted the legal risk of transparent operation and were vindicated. Cyberology operates the world's single largest Tor exit (133.9 Gbps) as a registered Dutch company. Both demonstrate that Tor exit operation does not require anonymity, bulletproof hosting, or offshore shells.

The Satanist chose: anonymous registration over transparency, bulletproof hosting over legitimate infrastructure, offshore shells over domestic accountability, a Soviet TLD over a mainstream registrar. The legitimate operator accepts risk. The bulletproof operator eliminates all possibility of accountability. This distinction is the finding.

Chapter 10: Operation Talent Survival and Domain Blackholing

Two enforcement events bracket the Satanist's operational timeline:

Operation Talent targeted content platforms (forums, payment processors). The Satanist's transport infrastructure was structurally immune — you cannot seize a Tor relay the way you seize a forum. The operation targeted specific servers; the Satanist has 27 across 16 providers.

The 2cb.network blackholing is more interesting. NameSilo suspended the domain via Identity Digital's Dendrite abuse system. This could be: registrar abuse response (most likely — NameSilo has suspended bulletproof domains under pressure before), law enforcement request (possible but no press release), or voluntary migration (the operator had already prepared 2cb.su). The 8-month lifespan (September 2025 → May 2026) matches the pattern of gTLDs being hostile to controversial content — reinforcing why the operator maintains 2cb.li (privacy TLD) and 2cb.su (opaque TLD) as fallbacks.

Chapter 11: The Financial Model

The Satanist solicits Monero donations on every page of 2cb.su:

At €300-800/month, this is within reach of a single individual with modest income — comparable to a car payment. The low cost makes several funding models viable: personal funds, XMR donations, Monero node service fees, or a combination. The infrastructure does not require external funding or commercial revenue to sustain.

The Monero node (accessible only via Tor v3 onion) could generate passive income from light wallet users who pay for remote node access. The operator explicitly describes running "privacy focused services" — plural — suggesting multiple revenue streams beyond relay operation alone.

Chapter 12: Cross-Corpus Intelligence

Searching our complete intelligence corpus (30+ investigations, 8,000+ IPs, 271,000+ entity links) reveals the Satanist connects to more prior investigations than any other single entity:

This density is not incidental. The Satanist operates at the nexus where multiple threat ecosystems converge. Their relays serve as generalist transport infrastructure that enables specialists in phishing, darknet markets, botnets, and C2 operations to route traffic through a single anonymization layer. They are not a specialist — they are a platform.

Chapter 13: What We Cannot Know

Intellectual honesty requires acknowledging opacity:

• Identity: One person or a group? The coordinated restart (all 27 relays, same day) and consistent aesthetic suggest a single mind. But we cannot prove this.
• Satanist = Kyun SRL? The death-themed naming overlap, 2024 founding timeline, and hosting relationship strongly suggest identity — but could be mere aesthetic affinity.
• Motivation: Privacy ideology, commercial operation, intelligence collection, or criminal enterprise? The architecture is motive-neutral. All are possible simultaneously.
• Traffic monitoring: A Tor exit operator can log unencrypted traffic. 27 exits represent substantial surveillance capability if deployed by a state actor. No evidence either way.
• The 2cb.network blackholing: Law enforcement, registrar abuse action, or voluntary migration? The timing and preparation (2cb.su already active) leaves all three plausible.
• Relationship to Mynymbox: Customer, affiliate, or operator? The Charlestown convergence is suggestive but not conclusive.

Conclusions

The Satanist represents the maximum expression of the anonymity factory documented in this series:

1. A single pseudonymous operator controls 27 Tor exit relays across 16 ASNs in 11 countries, generating ~4.5 Gbps of exit bandwidth
2. The multi-layer anonymity stack (NymDNS + Saint Kitts shells + Monero + .su TLD + Tor) creates effectively unbreakable identity protection
3. Bulletproof hosting (LAIN, Aokigahara/Kyun, MAXKO) specifically enables cohabitation with criminal infrastructure
4. The legal framework in each jurisdiction creates gaps that, combined, form a comprehensive shield
5. Legitimate operators (Zwiebelfreunde, Cyberology) demonstrate that the choice of bulletproof hosting signals intent beyond privacy advocacy
6. Domain blackholing (2cb.network) proved ineffective — the operator migrated to .su within weeks, all relays continued operating
7. The 11-year domain dormancy (2cb.li, registered 2015, activated 2026) reveals patient planning

The connecting thread is not the technology. Tor is neutral. Exit relays are legal. Monero is legal. Offshore LLCs are legal. Each component, individually, serves legitimate purposes. The combination — assembled to prevent any accountability for any activity — is what makes this architecture notable. And the patient, deliberate, aesthetically unified deployment across multiple providers demonstrates not impulse but craft.

The Satanist didn't build the factory. They are its most dedicated customer — and the proof that it delivers exactly what it promises.