I. The Apartment

Every company needs an address. Aokigahara SRL chose an apartment.

Current registered address (from Romania's Trade Register via listafirme.ro): Intrarea Gheorghe Simionescu 19, Ap. B26, Cod 014155, Sectorul 1, Bucharest. This is a residential apartment in a northern Bucharest neighborhood — postal code 014155 places it precisely in the residential blocks near Parcul Băneasa.

The address has changed at least once. Prior RIPE records show "Str. Drumul Cretestilor nr.19, Sc.B, Et.1, Apt.15, Sector 4" — a different residential apartment in southern Bucharest. The move from Sector 4 to Sector 1 suggests a change of personal residence, not a business expansion. Both addresses are apartments in residential blocks.

The ARIN RDAP record for the US IP allocation (45.38.20.0/24) provides independent confirmation: "Private Customer, Private Residence, Bucharest, Romania, 010452." Postal code 010452 is Sector 1 — matching the current listafirme.ro address exactly. The operator's private home address is independently corroborated across two registration systems.

II. The Name — Three Layers of Meaning

The naming structure isn't random. It's a three-layer communication system, each layer addressing a different audience:

Layer 1: Aokigahara (The Legal Name) — Death

Aokigahara (青木ヶ原) is a dense forest at the northwest base of Mount Fuji, Japan. Known as the "Sea of Trees" (Jukai), it is the world's second most common suicide location. Between 50 and 100 people die there annually. The forest entered Western mainstream consciousness through the Logan Paul incident of January 2018, when the YouTube celebrity filmed a suicide victim's body and posted it for views.

Naming a Romanian IT company after this forest is deliberate provocation. It signals to those who recognize it: the operator embraces forbidden territories, rejects mainstream norms, and deliberately courts controversy. It is identity signaling for the transgressive internet subculture.

Layer 2: MOEMOEKYUN (The AS-Name) — Anime

"Moe moe kyun" (萌え萌えきゅん) originates from K-On! (けいおん!), a 2009 Kyoto Animation series. In Episode 4, character Mio Akiyama is forced to perform a maid café pose and say the phrase while making a heart shape with her hands — becoming visibly embarrassed. The phrase became a foundational meme in otaku culture.

"Kyun" (きゅん) is Japanese onomatopoeia for the fluttering sensation in your chest when something is overwhelmingly cute. Using this as an Autonomous System name on RIPE NCC is a statement: the operator of this serious internet infrastructure is deeply embedded in anime/otaku culture. This is not uncommon among Tor operators — the intersection of anime fandom and privacy-tech communities is well-documented.

Layer 3: Kyun.sh (The Brand) — Approachable

The commercial brand strips away the death and the anime, leaving only the cute sound: "kyun." The .sh TLD (Saint Helena, but commonly used for shell/developer tools) gives it a technical aesthetic. The website features a custom character "Kyoko" (an anime-style AI assistant), retro animated GIFs, and a design language from 2000s-era otaku web aesthetics.

Each audience sees what's meant for them: potential customers see a quirky hosting brand, otaku see community membership, and those who look up "Aokigahara" see the death signal. The cognitive dissonance is the point.

Layer 0: Chef Naphtha (The Persona) — Chemistry

The operator pseudonym references naphtha — a volatile petroleum distillate (C5-C9 hydrocarbons) used as a solvent, lighter fluid, and chemical extraction agent. It is invisible, flammable, and evaporates without trace. The "Chef" prefix implies mastery — cooking with something dangerous. The metaphor is apt for someone who operates infrastructure that carries others' traffic without retaining it.

III. The Operator

Chef Naphtha exists across multiple systems, each revealing a fragment:

The LowEndTalk presence is confirmed through community posts: "Hosts using Crunchbits Spokane network: kyun.sh @naphtha" and "I think Kyun is on the forum" (referencing @naphtha). The operator engages with the hosting community, uses a custom control panel (not off-the-shelf VirtFusion or SolusVM), and offers unmetered bandwidth.

The deanonymization vector is clear: Romanian Trade Register (ONRC) query with CUI 48489042 returns the full legal name of the sole administrator. The pseudonym "Chef Naphtha" has a recoverable legal identity — the mandatory public company register is the weakest link in the anonymity chain.

IV. The Sponsor — Who Holds the Keys

Aokigahara SRL is not a RIPE NCC member. It holds internet resources as a sponsored end-user — meaning another organization (the Sponsoring LIR) vouches for it and maintains the RIPE relationship on its behalf.

The sponsor is ORG-ICL64-RIPE, which uses the maintainer object mnt-hr-maxko-1. The "hr" prefix means Croatia. The "maxko" component is an identifier — likely a surname or company abbreviation — that could not be resolved to a named entity during this investigation.

150.40.117.0/24 (Netherlands):
  mnt-by: mnt-hr-maxko-1    ← Croatian LIR (sponsor)
  mnt-by: KYUN-MNT          ← Aokigahara SRL (self-managed)
  org:    ORG-KA1059-RIPE   ← Aokigahara SRL
  created: 2024-07-02

150.40.120.0/24 (US/Texas):
  mnt-by: mnt-hr-maxko-1    ← Same Croatian LIR
  mnt-by: KYUN-MNT          ← Same self-managed
  org:    ORG-KA1059-RIPE   ← Same org
  created: 2024-07-02
  

Under RIPE Policy Document ripe-753, the Sponsoring LIR bears responsibility for:

• Verifying the End User's identity
• Ensuring accuracy of registration data
• Maintaining the End User Agreement
• Reporting material changes to RIPE NCC

This Croatian entity is the institutional anchor. Without its sponsorship, Aokigahara SRL could not hold AS215659 or any RIPE-allocated IP space. The LIR's identity — and its portfolio of other sponsored clients — remains an open question.

V. The Infrastructure Map

AS215659 announced 7+ IPv4 prefixes as of June 2026, sourced through three distinct channels:

Channel 1: Direct RIPE Allocation (via Croatian LIR)

Channel 2: ARIN Sub-Allocation (via Internet Utilities NA LLC)

Channel 3: IPXO Marketplace Lease (via Internet Utilities LATAM)

The "ZA" (South Africa) country code on IPXO blocks is an artifact: these are legacy South African RIPE registrations resold through the marketplace. The IPs physically live in Romania. This explains the geographic confusion in DOSSIER-PRIVATE-CUSTOMER-001.

Physical Locations

Romania: All Romanian IPs geolocate to Popeşti-Leordeni — a commune immediately south of Bucharest (~10km from the city center), likely a single colocation facility. The specific datacenter has not been identified.

United States: Confirmed at Crunchbits/Synteq Digital, Spokane Valley, Washington (ZIP 99216). Crunchbits also hosts IncogNET and other privacy-focused operators.

Netherlands: Single /24 in Amsterdam. Upstream facility not confirmed.

VI. The IP Brokerage Chain

The US IP blocks flow through a multi-jurisdiction corporate chain:

Aokigahara SRL (Romania, CUI 48489042)
    ↑ sub-allocated from
Internet Utilities NA LLC (Delaware, DCL-577)
  Address: 2711 Centerville Road, Wilmington, DE
  (Standard registered-agent address)
    ↑ administered by
Vincentas Grinius (Lithuanian national)
  ARIN: GRINI3-ARIN, registered 2024-08-23
  Address: 6th Floor, 9 Appold Street, London EC2A 2AP
  Contact: accounts@netutils.io
    ↑ operates
Internet Utilities LATAM LTD (Belize)
  Address: Blake Building, Corner Eyre & Hutson Street, Belize City
  Website: netutils.io
  (IPXO marketplace for RIPE blocks)
  

This is a professional IP brokerage. Vincentas Grinius (Lithuanian) operates through a Belize offshore entity (LATAM) and a Delaware LLC (NA) to provide IP address leasing globally. The London address (9 Appold Street, EC2A) is a Broadgate business center — premium but anonymous office space. The Belize entity handles IPXO marketplace operations for RIPE-region blocks.

This is not unique to Kyun — Internet Utilities serves many customers. But the structure demonstrates how IP address allocation has become a commodity market: blocks originally assigned in South Africa can be leased through Belize, administered from London, registered in Delaware, and physically announced from Romania. Geography has become decorative.

VII. The Multi-Tenant Tor Hub

AS215659 is not just hosting 2cb.su relays. It's a full-scale Tor exit hub with four independent operators:

The surprise: Bronk-ICT — a legitimate Dutch IT firm (bronk-ict.nl, operated by D.O. Bronk) — is the dominant bandwidth contributor. Their relays carry consensus weights of 15,000-17,000, compared to 2cb.su's 3,500-9,400. A Dutch professional software developer is the biggest customer on the Satanist's network.

This reveals Kyun.sh's actual business model: sell anonymous VPS hosting to Tor relay operators who pay in Monero. The 2cb.su relays are the operator's own contribution, but paying customers like Bronk-ICT and obzgs5tbmn4q generate the revenue.

The Family Question

A critical detail: Onionoo shows 2cb.su and obzgs5tbmn4q relays sharing the same effective_family identifier. In Tor's protocol, this means both operators have mutually listed each other in their MyFamily torrc directive — an explicit declaration of trust or shared operation.

Two interpretations exist:

1. Same operator, different personas: Chef Naphtha runs both 2cb.su and obzgs5tbmn4q under different identities. Combined: 19 relays, not 3.
2. Cross-certification agreement: Two independent operators who share infrastructure (same physical network) and formally declare this to the Tor directory.

The evidence leans toward interpretation 2: obzgs5tbmn4q has a separate website (obzgs5tbmn4q.org), separate ProtonMail contact, and self-describes as a "small group of people" — plural. But the possibility of identity overlap cannot be excluded.

VIII. The May 2026 Expansion

On a single day — May 21, 2026 — Aokigahara SRL's IP capacity quadrupled.

Three blocks (82.153.138.0/24, 31.57.129.0/24, 45.137.99.0/24) were provisioned through IPXO/netutils under "Private Customer" (ORG-PC1669-RIPE), all with country code ZA. A fourth block (93.113.25.0/24) came through SIMPLIQ. All four IRR-registered for AS215659 on the same date.

The timing correlates with a customer growth event: obzgs5tbmn4q's 16 relays first appeared in April 2026. Bronk-ICT's Romanian relays appeared in May 2026. The expansion was demand-driven — new Tor relay customers needed IP addresses.

IX. The Reliability Problem

Monerica.com (a directory of Monero-accepting services) carried a warning about Kyun.sh: "Use caution — Historically poor reliability. Romania location has previously had high downtime and USA location has had at least one data loss incident. Doesn't fully own all hardware."

The evidence partially corroborates this:

The reliability profile is consistent with a solo operator running a lean infrastructure: when things break, there's one person to fix them. The migration from Colocation America to Crunchbits suggests the operator learned from the data loss incident and upgraded to a more reliable upstream.

X. What the Suicide Forest Reveals

Aokigahara SRL is a case study in minimum-viable-entity formation for internet resource acquisition. The pattern:

1. Form a Romanian SRL (€40, 3 days, residential address, no employees)
2. Obtain ASN through a Sponsoring LIR (Croatian entity, identity obscured)
3. Acquire IP space through marketplace (IPXO — legacy ZA blocks, geographic confusion)
4. Sub-allocate US IPs through offshore brokerage (Belize/Delaware/London chain)
5. Colocate physical servers at privacy-friendly DCs (Crunchbits, Spokane)
6. Accept only Monero. Require only a password. Keep no logs.
7. Attract Tor operators as customers. The revenue pays for the infrastructure.

The result: a pseudonymous individual operating from a Bucharest apartment controls a multi-country Tor exit hub carrying significant bandwidth. The legal structure provides just enough legitimacy to hold RIPE resources while maximizing anonymity everywhere else.

But the anonymity has cracks. The Romanian company register exposes the surname prefix "Ke-." The ARIN record ties the same person to postal code 010452. The LowEndTalk presence connects the pseudonym to the company. And the mandatory Sponsoring LIR relationship means at least one entity — the Croatian LIR — has verified the operator's legal identity.