I. The Website

bronk-ict.nl is a Laravel application running on nginx 1.29.4 and PHP 8.4.18, hosted at 149.210.164.144 (Signet B.V., AS20857, Netherlands). The site identifies a sole proprietor — initials D.O. Bronk — offering software development services in C, C++, C#, Python, Delphi, and SQL alongside web development with Vue and Laravel.

This is extraordinary for the Tor ecosystem. Most relay operators maintain strict pseudonymity. Bronk-ICT publicly declares its operation with a real domain, a real abuse contact, and a real business identity. Furthermore, the relays are verified through CIISS v2 (proof:dns-rsa) — a cryptographic protocol that proves the operator controls the DNS records of bronk-ict.nl. This is the gold standard of Tor operator identity verification.

The website's server (149.210.164.144) also hosts the mx1.bronk-ict.nl mail exchange record, meaning the company's actual email infrastructure runs on the same hardware that serves the website and at least one Tor relay. This is characteristic of a real, resource-constrained business — not a well-funded front operation that would provision separate infrastructure.

II. The Network: 28 Relays, 8 ASNs, 9 Countries

OrNetStats — the authoritative Tor relay verification service — lists 28 proven relays for bronk-ict.nl. The distribution across providers is unusual in both its diversity and its scale:

The eight-ASN diversity is significant. A coordinated malicious operation (traffic correlation, MitM) would typically minimize complexity by using one or two providers. Bronk has deliberately spread across providers with different jurisdictions, BGP policies, and ownership structures. This is textbook Tor operational diversity — protecting against a single point of censorship or seizure.

Technical Sophistication Markers

• FreeBSD: 4 relays run FreeBSD (BronkOnFreeBSD, USABSDBronk, two others). Only ~9.3% of Tor relays use BSD — this indicates genuine systems expertise.
• obfs4 Bridge: BronkOBridge (first seen May 31, 2026) is a pluggable transport bridge for censorship circumvention. Adversarial actors have zero use for bridges.
• IPv6 Support: Multiple relays serve IPv6 ORPorts — considered best practice, indicating infrastructure care.
• Variable Exit Policies: Exit policies vary by relay (conservative SMTP-blocking to permissive web-only). This suggests individual per-relay configuration, not mass-deployed templates.
• No BadExit Flags: Zero instances of Tor directory authorities flagging Bronk relays for malicious traffic manipulation.

III. The Timeline: December 2025 Through June 2026

Previous analysis assumed Bronk launched April 6, 2026 — the same day as the coordinated 2cb.su deployment. OrNetStats corrects this:

IV. The MAXKO Thread

MAXKO d.o.o. is a Croatian technology group founded in 2014 in Sisak. Through its holding structure, it operates:

• AS211619 (Europe) — ISP covering Croatia, Hungary, Bulgaria
• AS329325 (Africa) — via subsidiary "Maxko for Gaming Development LLC" registered with AFRINIC
• Aokigahara SRL sponsorship — MAXKO's Croatian LIR (mnt-hr-maxko-1) sponsors Aokigahara's RIPE membership

MAXKO is not a simple hosting provider. Its portfolio includes:

• Software development (custom apps, business automation)
• Game development (Asteidus MMORPG)
• Blockchain integration (eMAX token on Polygon/MATIC chain)
• Global hosting infrastructure (6 data center locations)

The critical finding: MAXKO is the common supply chain. Both D.O. Bronk and the 2cb.su/Satanist operator purchase infrastructure from the same Croatian technology group. This is the ONLY overlapping set of ASNs between Bronk's eight providers and 2cb.su's known infrastructure:

Whether MAXKO knowingly provisions both operations or is simply Tor-friendly commodity hosting remains an open question. The blockchain and gaming diversification suggests a company comfortable with privacy-adjacent technology. The sponsorship of Aokigahara SRL — a company named after Japan's "Suicide Forest" — suggests at minimum a tolerance for unconventional branding.

V. The Romanian Layer: Five Cyber Host and Internet Magnate

Bronk operates four relays on IP addresses in the 93.113.25.x range, assigned to AS214209 — registered to Internet Magnate (Pty) Ltd, ostensibly a South African company. The truth is more interesting.

Five Cyber Host Security SRL

Internet Magnate (Pty) Ltd — The Shell

The LowEndSpirit hosting forum thread from October 2024 is revelatory. In a discussion about his new 100Gbps test servers, Calin provides magnates.co.za as the abuse contact. Community members immediately identify the game:

Calin's known operational profile includes:

• Hosting illegal IPTV streaming services
• Publicly bragging about ignoring DMCA takedown requests
• Creating Internet Magnate specifically to move IP space to a jurisdiction with lax enforcement
• Operating infrastructure where abuse reports disappear (no functional MX records)

VI. The MyFamily Configuration: The Smoking Gun

This is the central finding of this investigation. In the Tor relay ecosystem, the MyFamily configuration in torrc tells directory authorities that certain relays are operated by the same entity. When Relay A lists Relay B in its MyFamily, the Tor client will avoid selecting both in the same circuit — preventing traffic correlation by a single operator.

Bronk's Wave 1 relays (launched April 6, 2026) contain the following in their alleged_family field — Tor's public record of what a relay has declared:

Three Interpretations

VII. The Legitimacy Paradox

The evidence presents a paradox. Every individual indicator points to legitimacy:

• Real Dutch business identity (KvK-registered, presumably)
• Cryptographic domain proof (DNS-RSA)
• Public website with Tor disclosure
• Functional abuse contact
• 8-ASN diversity (expensive, complex)
• obfs4 bridge (anti-censorship purpose only)
• FreeBSD expertise
• No BadExit flags
• Variable exit policies (individual relay care)
• Mail server co-location (real business infrastructure)

But this legitimacy operates on infrastructure layers specifically designed for unaccountability:

• Aokigahara SRL — named after the "Suicide Forest," sponsored by a Croatian gaming conglomerate
• Internet Magnate — South African shell with non-functional abuse email
• MAXKO — common supply chain with a Satanist-themed criminal network
• Snel.com — accepts Monero payments (financial untraceability)
• RoyaleHosting — known bulletproof hosting forum darling

The paradox is not that these are contradictory — they are not. A legitimate privacy advocate would deliberately choose providers that resist third-party pressure. The same hosting that enables criminal infrastructure also enables the infrastructure that protects dissidents, journalists, and abuse survivors. This is the fundamental design of Tor, expressed at the hosting layer.

The Scale Question

Running €12,000-24,000 per year in Tor infrastructure without visible external funding raises questions. For comparison:

• Cyberology (world #1 exit): operates its own AS, commercial model
• Torservers.net: nonprofit foundation with public fundraising
• Neel Chauhan: individual relay operator funded through donations
• Bronk-ICT: sole proprietor, no visible funding, no public fundraising

The mx1/mx2 hostnames on Bronk's Netherlands relays suggest the simplest answer: the same servers run real business services (email, hosting for clients) alongside Tor relays. The marginal cost of adding Tor to existing infrastructure is much lower than dedicated hosting — perhaps €5-8K/year incremental rather than the full €12-24K estimate.

VIII. The Entity Map

MAXKO d.o.o. (Sisak, Croatia, 2014)
├── AS211619 (Europe) ─────────────── Both Bronk AND 2cb.su use this
│   ├── Croatia: 45.95.169.119 (Bronk exit)
│   ├── Hungary: 45.9.168.106 (Bronk guard)
│   └── Bulgaria: [2 relays, offline Jun 19]
├── AS329325 (Africa / Gaming)
│   └── South Africa: SABronk, BronkJohannesbrg
└── Sponsors → Aokigahara SRL (Romania, AS215659)
                ├── Bronk relays: 7 (RO+US)
                ├── 2cb.su relays: [offline]
                └── obzgs5tbmn4q: 16 relays (anonymous)

Five Cyber Host SRL (Scrioaștea, Romania, 2019)
└── Internet Magnate (Pty) Ltd (SA shell, AS214209)
    └── Bronk relays: 4 (93.113.25.x range)
        └── Abuse: reports@magnates.co.za → NO MX → void

ATW Internet Kft. (Budapest, Hungary)
└── AS41075: Bronk guard relays × 5 (highest CW ~274K)

Signet B.V. (Netherlands)
└── AS20857: drskaffa, intospace, dobronk
    └── mx1/mx2.bronk-ict.nl (real mail server)

IX. Assessment

X. Gaps and Open Questions

• KvK registration: Dutch business register lookup would confirm legal entity form, owner full name, and registration date. Requires paid API access.
• Full name: "D.O. Bronk" — initials only. No LinkedIn profile found. The surname is uncommon in the Netherlands.
• Funding model: No evidence of Tor Project grants, foundation support, or commercial relay revenue. Self-funded from IT consulting income?
• 2cb.su fingerprint timing: Did Bronk list the fingerprints before or after 2cb.su appeared on AS215659? The chronological sequence determines whether this is coordination or reaction.
• Bulgaria relay deaths: Why did MoreBulgaria and BulgarianBronkA1 go offline June 19? Provider issue, payment failure, or deliberate?
• tor-relays mailing list: Whether Bronk has posted to the community mailing list remains unchecked due to rate limits.
• MAXKO relationship: Is MAXKO Tor-friendly by commercial policy, or is there a deeper relationship?