Preface
Every infrastructure tells two stories. The first is what it does. The second is what it means. This letter reads between the lines of the Anonymity Factory โ not to prove conspiracy, but to identify the structural patterns that demand explanation and the silences that speak louder than data.
Confidence labels are applied throughout. [DOCUMENTED] means sourced evidence supports the claim. [INFERRED] means the logic follows from documented facts but the conclusion itself is unverified. [STRUCTURAL] means the observation describes a systemic pattern regardless of individual intent.
1. The Tolerance Problem
What's documented:
StarkRDP was seized in January 2025. CrazyRDP was seized in November 2025. Both offered bulletproof RDP/VPS hosting. Both operated from the Netherlands. Both served identical customer profiles to rdp.sh.
What's not explained:
rdp.sh (AS210558) has been operational since October 2021. It's on Spamhaus DROP. The Tor Project publicly warns about it. Trustpilot reviews describe it as "specialised in supporting illegal cracking activities." It has 30+ tracked high-threat IPs in our database alone. AbuseIPDB reports number in the thousands.
Why was StarkRDP worth seizing but rdp.sh is not?
Possible readings:
- [DOCUMENTED] Investigation timelines are 2-3 years; rdp.sh may be pre-seizure.
- [INFERRED] rdp.sh's Tor relay customer base creates legal complexity โ arguing to a German judge that hosting Tor (legal, ECtHR-protected) constitutes criminal facilitation is harder than arguing against a pure-criminal service.
- [STRUCTURAL] The 4-country jurisdiction split may genuinely prevent any single authority from building a complete case.
- [INFERRED] Intelligence value: ~3% of Tor exit traffic on known infrastructure provides a collection opportunity. A network you know about is more useful running than seized.
2. The Belgian Ghost
What's documented:
SERVPERSO-MNT (Battice, Belgium) was created 2021-04-16. 1337 Services GmbH registered with RIPE 2021-10-27. SERVPERSO has co-maintainer rights on the most-abused /24 in the network. The address is a residential apartment above a market square in a French-speaking town of 5,000 people.
What's not explained:
No corporate entity is publicly registered at that address. No individual name appears in public RIPE records beyond the handle SSN105-RIPE. The phishing operations on SERVPERSO-maintained space target French-language speakers exclusively. The SERVPERSO name itself is French-inflected.
Possible readings:
- [INFERRED] SERVPERSO is the original operator. 1337 was created six months later as the commercial and legal face โ the German GmbH provides institutional legitimacy that a Belgian residential address cannot.
- [INFERRED] The French-language affinity (phishing targets, naming convention, Belgian Wallonia location) suggests the operator is a native French speaker who built the criminal infrastructure before the German corporate wrapper existed.
- [STRUCTURAL] The creation sequence (Belgian technicalโGerman corporateโDutch brokerage) follows the standard layering pattern of organized cybercrime infrastructure: operational first, legitimacy second, obfuscation third.
3. The Saint Kitts Question
What's documented:
Three entities in this ecosystem use Saint Kitts and Nevis (KN) registration: 1337 Services LLC, Mynymbox Hosting LLC (2cb.li's DNS/hosting), and the allium.top domain registrant. Saint Kitts has no Mutual Legal Assistance Treaty (MLAT) with Germany. Its corporate registry is opaque. Entity formation costs ~$1,500.
What's not explained:
Three ostensibly independent entities โ a hosting company, a hosting provider's hosting provider, and a Tor relay operator โ all register in the same tiny Caribbean jurisdiction. The probability of this being coincidental depends on how common KN incorporation is in the broader hosting market. (Answer: it's extremely uncommon for European hosting companies.)
Possible readings:
- [INFERRED] A single incorporation agent or law firm in Saint Kitts services all three. This suggests a shared service provider, possibly a single advisor who recommended the jurisdiction to multiple connected parties.
- [INFERRED] The three KN entities are different legal wrappers for the same beneficial owner or ownership group. The no-MLAT feature isn't coincidence โ it's the reason for the choice.
- [STRUCTURAL] KN incorporation creates a jurisdictional dead end: German investigators cannot serve legal process in Saint Kitts. The entire beneficial ownership question terminates at a Caribbean mailbox.
4. The 3% Problem
What's documented:
AS210558 carries approximately 3% of Tor exit bandwidth. This includes 2cb.su (49+ relays), allium.top (3 exits, 845 Mbit/s), D.O. Bronk (28 relays), and numerous smaller operators. The Tor Project documents this concentration on their "Good/Bad ISPs" page.
What's not explained:
3% doesn't sound like much. But consider: if a signals intelligence agency (BfV, AIVD, DGSE, NSA) can monitor 3% of Tor exit traffic via a single legal order to a known German company, the math changes. A user making 33 requests has a statistical expectation of one request transiting the monitored exits.
Possible readings:
- [STRUCTURAL] Tor's security model assumes exit operators are diverse and independent. Concentration on a single provider breaks this assumption. Even without malicious cooperation, a single German court order could compel traffic logging on all rdp.sh customers simultaneously.
- [INFERRED] The fact that this concentration exists, is publicly documented, and is not being disrupted by any state actor suggests either: (a) no state actor cares about Tor (unlikely given NSA/GCHQ documents), or (b) the concentration is useful to state actors who can access it via legal process in Hamburg.
- [INFERRED] Julian Achter, as a German resident operating a German GmbH, can be compelled by BND/BfV under ยง2 G10-Gesetz (signals intelligence law) to provide traffic data. This is a non-public process. Neither the Tor operators nor the Tor Project would be informed.
5. The Naming Tells
What's documented:
The names in this ecosystem are not random:
| Name | Reading |
|---|---|
| 1337 | "Leet" โ hacker culture in-group signaling |
| rdp.sh | Remote Desktop Protocol + .sh (shell) โ technical competence signal |
| 2cb.su | 2C-B (psychedelic drug) + .su (Soviet TLD) โ subcultural positioning |
| SERVPERSO | Services Personnels (French) โ personal/private services |
| LAIN | Serial Experiments Lain (anime) โ digital identity themes |
| allium.top | Allium = Tor (Onion genus) โ taxonomic pun |
| Aokigahara SRL | Suicide forest โ nihilist/shock value (030H) |
What's not explained:
These names collectively signal a specific demographic: technically sophisticated, subcultural, psychonautic (2C-B), anime-influenced, nihilist-adjacent, and deeply embedded in hacker/privacy culture. This isn't a corporate cybercrime operation (which uses bland LLC names). This is scene infrastructure โ built by and for the technical underground.
Possible readings:
- [INFERRED] The operators know each other. Not through corporate relationships, but through shared subcultural spaces: IRC channels, darknet forums, Monero communities, anime/hacker crossover culture. The infrastructure is a materialization of a social network.
- [STRUCTURAL] Scene infrastructure is harder to disrupt than corporate infrastructure because it's bound by social trust, not contracts. There's no single point of failure (fire the CEO, seize the domain). The knowledge of how to rebuild is distributed across a trust network.
6. The Monero Thread
What's documented:
The Monero thread runs through everything:
- rdp.sh accepts Monero payment
- Julian Achter is listed on Monerica.com
- 2cb.su runs a Monero full node
- allium.top accepts Monero donations
xmr.rdp.shexists in Certificate Transparency (Monero mining)- ASN sponsoring via LAIN costs โฌ71/year in Monero
What's not explained:
Monero is not merely a payment method. It is a philosophical commitment. Bitcoin has a public ledger. Monero has ring signatures, stealth addresses, and confidential transactions. Choosing Monero is choosing to make financial flows permanently unauditable.
Possible readings:
- [STRUCTURAL] The ecosystem is financially opaque by design. Revenue, payments between entities, profit distribution โ all invisible. Not because they "accept crypto" (many businesses do), but because they specifically chose the one cryptocurrency designed to defeat chain analysis.
- [INFERRED]
xmr.rdp.shsuggests the provider mines Monero on its own infrastructure. This creates a self-reinforcing loop: host Tor relays (high CPU idle), mine Monero on spare capacity, accept Monero as payment, list on Monerica. The entire value chain stays within the privacy-coin ecosystem. - [INFERRED] If all inter-entity payments (SERVPERSOโ1337, 1337โPrefix Broker, customersโrdp.sh) flow via Monero, then the financial relationship between the three maintainer entities is permanently unknowable. Are they three independent businesses? Or one operation paying itself? The Monero ledger ensures this question can never be answered.
7. The Silence of Regulators
What's documented:
RIPE NCC's position: "We do not police how IP space is used." BaFin (German financial regulator): no public action regarding phishing hosted on German-owned infrastructure. BIPT (Belgian telecoms regulator): no public action regarding SERVPERSO. ACM/OPTA (Dutch telecom regulator): no public action regarding Prefix Broker or Hybula colocation. ANSSI (French cybersecurity agency): phishing reports go to individual ISPs, not hosting countries.
What's not explained:
Four EU countries. Four regulatory frameworks. Zero public enforcement actions. The NIS2 Directive (effective October 2024) explicitly requires "essential entities" including DNS service providers and hosting providers to implement cybersecurity risk management. rdp.sh is a hosting provider operating in the EU.
Possible readings:
- [DOCUMENTED] NIS2 implementation varies by member state; Germany's implementing law (NIS2UmsuCG) entered force March 2025. Enforcement is at early stages.
- [STRUCTURAL] The gap between regulation-on-paper and enforcement-in-practice is where bulletproof hosting lives. The architecture is designed to exploit exactly this gap โ always technically compliant (has abuse contact, responds to RIPE queries, registered properly) while being operationally non-compliant (ignores abuse, harbors criminals).
- [INFERRED] If NIS2 enforcement ever reaches rdp.sh, the response will be corporate dissolution and reconstitution under a new name, in a new jurisdiction, with the same IP space. This has happened before (see: FlokiNET โ โ โ). The infrastructure outlives its corporate shells.
8. The Useful Enemy
What's documented:
Intelligence agencies publicly state they want to deanonymize Tor users (FBI court filings, NSA ANT catalog, GCHQ Tempora documents). Tor's threat model assumes diverse, honest exit operators. 3% of exit capacity on a single provider in a Five Eyes-allied nation (Germany: 14 Eyes) is a known, exploitable concentration.
What's not explained:
Why no state actor has disrupted this concentration. Not by law enforcement (which could seize), nor by intelligence action (which could pressure BGP peers to decommission), nor by regulatory action (which could revoke the LIR membership).
Possible readings:
- [INFERRED] A Tor exit node you know about is more valuable running than seized. You can serve a Telecommunications Surveillance Order (ยง100a StPO) on a Hamburg-registered company and get traffic metadata. You cannot get this from a relay you've never identified.
- [INFERRED] The phishing/spam traffic provides additional intelligence value: victim data, credential flows, malware C2 traffic โ all passing through infrastructure where legal collection is possible. The criminals are unknowingly generating intelligence product.
- [STRUCTURAL] In intelligence economics, a known hostile node has positive value. An unknown hostile node has zero value. A seized node has negative value (you lose collection, adversary adapts). The incentive structure rewards leaving the Anonymity Factory running.
9. What the Data Cannot Say
After twelve letters, 8,000+ tracked IPs, 271,000+ entity links, and 36 intelligence sources, here is what the data definitively cannot answer:
- Whether SERVPERSO, 1337, and Prefix Broker share beneficial ownership
- Whether any intelligence agency has active collection on AS210558
- Whether the Tor concentration is deliberately cultivated or merely tolerated
- Whether Julian Achter is the ultimate principal or a technical operator for others
- Whether the Saint Kitts registrations are coordinated
- Whether the 2cb.su operator and the phishing operators know each other
These are not gaps in our methodology. They are features of the architecture. The Anonymity Factory is designed so that these questions cannot be answered from outside. The Monero payments, the Caribbean shells, the multi-jurisdiction split, the subcultural naming conventions that function as shibboleths โ all of these are information barriers engineered to make the system opaque to external analysis.
What we can say: the infrastructure exists, it's documented, it serves simultaneous legitimate and criminal purposes, it's architecturally resistant to disruption, and it's been operating for over four years without meaningful interference. Whether that's because nobody cares, nobody can act, or somebody benefits from its existence โ that's the reading between the lines.