1. The Provider

The Tor Project's Good/Bad ISPs page states: "1337 Services GmbH / RDP.sh (AS210558). These hosts already have many Tor nodes being hosted there." BGP.tools characterizes the network simply: "Server Hosting Tor services."

rdp.sh markets itself as privacy-focused, accepts cryptocurrency, offers "offshore hosting," and provides instant automated provisioning. Every customer's reverse DNS reads <IP>.powered.by.rdp.sh — the brand literally stamps itself on every packet.

2. The Subnet

45.154.98.0/24 — netname SERVPERSO-CLOUD — is maintained by SERVPERSO-MNT, the Belgian precursor entity documented in 030B. It exhibits a characteristic 4-country discrepancy:

The entire /24 is on Spamhaus DROP — the most severe blacklist in existence. DROP means "Don't Route Or Peer." Any network following Spamhaus recommendations refuses ALL traffic from this range unconditionally. The listing indicates abuse so persistent and systemic that the provider has been deemed unreformable.

3. The Phishing Operation

Caisse d'Épargne is France's second-largest retail bank. The phishing domain caisse-epargne-se-connecter.net translates to "savings-bank-to-connect" — a credential harvesting page designed to steal French banking logins. It sits on bulletproof infrastructure where abuse reports produce no action.

4. The Tor Exit

The allium.top operator is a high-OPSEC privacy-conscious individual: random-string ProtonMail, Njalla domain privacy, Monero-only, opaque relay names with no semantic meaning (SieNCoAd, ASqUADeo, NgePTimE), no MyFamily declaration, dedicated abuse contact. This is the gold standard of Tor operator anonymity.

Three relays across three different ASNs:

5. The Convergence

On 45.154.98.0/24, within 120 IP addresses of each other:

• .33 — allium.top Tor exit (privacy infrastructure, 845 Mbit/s)
• .153 — Caisse d'Épargne phishing + Russian scams + invoice fraud
• .176 — Unknown abuse (4,087 reports from 611 sources)
• .30 — rcrfgunleri.cfd (fraud domain)
• .42 — 96% AbuseIPDB confidence

All maintained by SERVPERSO-MNT. All announced by AS210558. All sold by rdp.sh. All under one company: 1337 Services GmbH, Hamburg.

6. The Supply Chain

Across the Anonymity Factory series (030A-030J), we've documented AS210558's position as the common infrastructure layer:

Julian Achter's 1337 Services GmbH doesn't run the Tor exits or the phishing pages. It provides the substrate — the BGP-announced IP space, the abuse-tolerant hosting, the jurisdictional complexity. The factory doesn't make the product. It makes the factory floor.

7. The Economic Model

The business model works because Spamhaus-DROP-listed IP space has negative value on the legitimate market — no respectable provider wants it. But for operators who don't need legitimate routing (phishing pages accessed once via SMS link, Tor relays that only need to reach directory authorities), the reputation doesn't matter. The provider buys burned ranges cheaply, sells them to customers who don't care about reputation.

8. The Question

This dossier is titled "The Phishing Question" because it poses the central dilemma of the entire Anonymity Factory investigation:

Does a provider that explicitly welcomes Tor relays — a legal activity that strengthens internet privacy — bear responsibility when the same infrastructure simultaneously enables bank phishing, credential theft, spam operations, and fraud?

The answer depends on who you ask:

• The provider would say: "We host legal services. Tor is legal. We process abuse reports." (But the Spamhaus DROP listing proves abuse reports produce no meaningful action.)
• The Tor operator would say: "We chose cheap hosting. We're independent of our neighbors." (But their exit capacity operates on infrastructure that responsible networks refuse to route.)
• The phishing victim would say: "My bank credentials were stolen via a page hosted on infrastructure that claims to serve privacy." (And no abuse report will take it down.)
• Spamhaus has already answered: DROP the entire range.

9. Series Assessment

"The Anonymity Factory" (030A through 030J) has documented a complete infrastructure ecosystem:

The factory operates because each layer provides plausible deniability for the others. The company is legal. Tor hosting is legal. The phishing operators are customers, not employees. The jurisdictional spread (DE/BE/NL/FR) means no single authority can act. And the Spamhaus DROP listing — intended as the ultimate sanction — paradoxically makes the space more attractive to criminals who don't need legitimate routing.