033A โ The Psychedelic Identity
A domain named after a Schedule I drug. Registered in Liechtenstein. DNS through a Saint Kitts LLC. Hosting through a Saint Kitts LLC. Held for 11 years before activation. This is not operational security by accident โ it is operational security by architecture.
Executive Summary
2cb.li is a Tor exit network operating across at least 4 autonomous systems in 12+ countries. The domain name references 2C-B (4-Bromo-2,5-dimethoxyphenethylamine), a Schedule I psychedelic synthesized by Alexander Shulgin and documented in PiHKAL. The operator self-identifies as Satanist on a Soviet-TLD (.su) blog, runs 49+ Tor relays with names drawn from a death vocabulary, and operates through a triple-layer anonymity chain: Liechtenstein TLD โ Saint Kitts DNS โ Saint Kitts hosting.
This is identity as infrastructure. The naming conventions are not decoration. They are deliberate signals within an international cypherpunk-psychonaut subculture โ and they leave an attribution trail that this investigation follows backward from relay exit points to a single Keybase cryptographic identity. The operator is anonymous by design and visible by choice.
The Domain Name: A Schedule I Reference
2C-B (4-Bromo-2,5-dimethoxyphenethylamine) is a phenethylamine psychedelic first synthesized by Alexander Shulgin in 1974. It appears in PiHKAL: A Chemical Love Story (1991) โ the primary reference for Shulgin-class compounds. 2C-B was synthesized before it was illegal; US scheduling came in 1994, three years after the book was published. The domain name encodes this history: not just "psychedelic drug" but a specific compound tied to a specific scientific-countercultural moment. To know 2C-B by name is to have read Shulgin. To choose it as a domain is to signal that you did.
The domain 2cb.li was registered on April 9, 2015 โ held for 11 years before its current Tor exit use. The .li TLD belongs to Liechtenstein, a microstate with strong privacy laws and no public WHOIS for .li domains. Registration costs โฌ15โ30/year with no identity verification requirement via many registrars.
The Registration Timeline
April 9, 2015: Domain registered. 2015โ2024: Domain held with minimal public use. 2024โpresent: Tor exits deployed at scale across 17 ASNs. 2025: Deep OSINT confirms Satanist operator with 49+ relays and ~4 Gbps bandwidth. The 11-year gap between registration and full deployment is characteristic of a pre-planned operational identity โ not opportunistic acquisition. An 11-year-old domain carries more credibility in trust-based communities than a domain registered last month.
Whoever registered 2cb.li in 2015 was planning a privacy infrastructure operation a decade before building it. The timing aligns with the broader expansion of privacy-focused hosting in the early 2020s โ when VPS providers started accepting Monero, when anonymous company formation became streamlined in Saint Kitts. They were early and they were patient.
The domain choice is also an intellectual signal. Knowing 2C-B specifically (not "2C-something" generically) requires having read Shulgin. Choosing that reference for a Tor exit network tells you something precise about who this person is: technically capable, chemically literate, philosophically aligned with counterculture privacy values. This is not a random name. Random names don't age for 11 years before deployment.
The Anonymity Stack: Triple-Layer Erasure
The 2cb.li domain is engineered so that each layer of identity inquiry terminates at a privacy jurisdiction. Attempting to trace ownership from the outside reveals nothing actionable at each stop:
| Layer | Provider | Entity | Jurisdiction | What inquiry reveals |
|---|---|---|---|---|
| TLD | .li (Liechtenstein) | SWITCH (registry) | LI โ no public WHOIS | Nothing. Registry is private by default. |
| DNS | NymDNS (mynymdns.me) | Mynymbox Hosting LLC | KN โ Saint Kitts and Nevis | A Saint Kitts LLC. No registrant data. |
| Hosting | NymBox (mynymbox.io) | Mynymbox Hosting LLC | KN โ Saint Kitts and Nevis | The same KN LLC. No server ownership trail. |
| Server | 94.156.119.148 |
srv-6a4a58.mynymbox.io | Anonymous VPS | VPS assigned by the same operator. |
inquiry starts here
Liechtenstein โ no WHOIS
Saint Kitts LLC
Same Saint Kitts LLC
Assigned by same operator
Both NymDNS and NymBox are operated by Mynymbox Hosting LLC, registered in Saint Kitts and Nevis (KN). Saint Kitts offers Citizenship by Investment at $250,000 โ a jurisdiction designed for maximum financial and corporate privacy. Mynymbox.io was registered May 22, 2024, via a Keybase-verified identity. The Keybase key (uYoh-JYdhbjre1SlaCKZf6ynZjCYmibddyJor8aPKLA) is the single potential attribution anchor for the operator's cryptographic identity.
Vertical Integration: The DNS Anonymizer and the Host Are the Same Entity
The operator does not merely use anonymous hosting โ they appear to operate the anonymous hosting provider. The DNS anonymizer and the VPS host are both Mynymbox Hosting LLC. This means there is no third-party service provider to subpoena: the Tor exit operator, the DNS resolver, and the hosting infrastructure are under single operational control. Standard law enforcement approaches (contact the host, demand records) fail here because the host is the subject of inquiry.
Saint Kitts and Nevis is notable in the anti-money-laundering world for its Citizenship by Investment (CBI) programme โ $250,000 buys full citizenship, and with it, a second passport and a second corporate domicile. Companies registered there face minimal disclosure requirements compared to EU or US jurisdictions.
Mynymbox is not the first privacy hosting provider to incorporate in Saint Kitts. It fits a pattern: incorporate in a CBI jurisdiction, accept Monero, use a pseudonymous Keybase identity for trust signaling. The question this raises is whether Mynymbox was built by the Satanist operator or for them by a third party. The Keybase verification suggests the former โ someone anchored a cryptographic identity to Mynymbox's domain because they wanted their service to be trusted within the privacy community, not merely anonymous. Trust and anonymity are in tension here, and the operator is navigating both.
The Operator: "Satanist"
The 2cb.li operator self-identifies on 2cb.su (Bear Blog platform, Soviet-era TLD):
"I'm Satanist, the current admin of this website. I run privacy focused services. Currently I run Tor relays and a Monero node."
| Identifier | Value | Platform |
|---|---|---|
| Handle | Satanist | 2cb.su (Bear Blog) |
| Contact (current) | admin@2cb.su | Relay contact field, 2cb.su |
| Contact (previous) | admin@2cb.network | Offline โ second relay family |
| AROI Key | 44FBABA6BC5EF8D1B69AB9C054994A18C5974B99 | Tor relay attestation index |
| Monero Node | Active | Privacy-coin financial infrastructure |
| Blog TLD | .su (Soviet Union) | Russian RELCOM registry, no WHOIS |
The .su TLD is a Soviet Union legacy domain managed by the Russian RELCOM registry. It provides essentially no public WHOIS information and is historically associated with Russian-language privacy-conscious communities โ but is used globally. Using .su for the personal blog while operating .li for the Tor infrastructure represents a consistent multi-jurisdiction privacy philosophy: no single point of inquiry should yield useful information.
What does "Satanist" mean in this context? Almost certainly not a religious designation. The handle maps to a tradition of aesthetic-philosophical Satanism โ LaVeyan or broadly anti-authoritarian โ common in hacker and cypherpunk communities since the 1990s. The Church of Satan's founding principle (rational self-interest, rejection of external authority) maps cleanly onto operating anonymous privacy infrastructure: the core belief is that individuals should control their own communications, outside the reach of governments or corporations. This is the ideology expressed through infrastructure.
This is not an indicator of malicious intent. It is an indicator of community. The Satanist handle places this operator within a specific ideological cluster โ the intersection of darknet culture, privacy advocacy, and techno-nihilism โ that also produced the naming conventions for the relay families, the ASN descriptions, and the hosting choices. The name is a commitment, not a threat.
The Relay Naming Convention: Death Vocabulary
Every 2cb.li Tor relay carries a nickname from the same semantic field โ D-words, all dark, drawn from a consistent gothic-nihilist vocabulary that mirrors the operator's stated identity:
dismal dim die dreary
depression drear dead dark
death demise desolate delusional
Death, darkness, psychological dissolution โ names beginning with "d". This matches the operator's stated Satanist identity and the hosting choices (Aokigahara โ Japan's suicide forest, AS215659; see 033C).
The naming is simultaneously operational (each relay is uniquely identifiable within the family) and aesthetic (the name set constitutes an artistic statement). For a network routing Tor traffic, the names serve no functional purpose โ they serve identity and community membership. A relay called death works identically to one called relay-7a4f. The choice is expressive, not technical.
Attribution Value of Relay Naming Conventions
Relay nicknames are self-declared in the Tor relay descriptor and are visible in the Tor consensus document โ a public, append-only record. An operator who names all relays with a consistent vocabulary across years is voluntarily maintaining a persistent, searchable signature that transcends hosting infrastructure. The 2cb.li "d-words" cluster is attributable to a single operator with high confidence regardless of which ASN the relay is hosted in โ the naming convention survives IP rotations, ASN migrations, and provider changes. You can rename your server. You cannot rename your aesthetic without losing the community identity you built.
Investigative Questions
The evidence above raises questions a thorough investigation must address โ including the uncomfortable ones that cut against simple threat narratives.
Is operating this infrastructure illegal?
In most jurisdictions: no. Running Tor exit relays is legal in the EU, UK, US, and most of Europe. The operator is structurally analogous to an ISP โ they route packets; they do not direct what goes through them. Legal risk in Tor exit operation sits with users who abuse the exits for illegal activity, not with the exit operator. Some jurisdictions (Russia, China, Iran, Tรผrkiye) restrict or ban Tor entirely, but the operator's TLD choices and hosting geography suggest they are not operating from those jurisdictions.
Can this operator see the traffic exiting through their relays?
Yes โ exit relay operators can observe unencrypted traffic (HTTP, non-TLS protocols). HTTPS traffic is encrypted end-to-end and the exit operator cannot read content, only metadata (destination IP, timing). With 49+ relays providing ~4 Gbps of bandwidth, the operator occupies a significant fraction of the Tor network's exit capacity. A sufficiently large fraction of global exit bandwidth could enable traffic correlation attacks โ matching entry and exit timing to de-anonymize specific users without breaking Tor's encryption. Whether this operator actively collects exit traffic is unknown; it is structurally possible and not detectable from outside.
Why build your own hosting provider instead of buying from an existing privacy host?
Trust minimization. Every third-party provider is a potential compromise point โ they can be subpoenaed, hacked, extorted, or pressured by regulators. Running your own hosting (Mynymbox) means there is no counterparty who holds your identity and can be compelled to disclose it. The operational cost (managing Saint Kitts company registrations, DNS servers, VPS infrastructure, Keybase identity) is offset by the complete elimination of the third-party risk surface. The operator chose maximum resilience over operational convenience. This is the same reasoning behind running your own Monero node rather than using an exchange.
What does operating a Monero node specifically indicate?
Monero (XMR) is a privacy-preserving cryptocurrency with ring signatures, stealth addresses, and RingCT โ designed to make transactions untraceable. Running a Monero node (infrastructure), not just using the currency, mirrors the Tor pattern: the operator contributes to the anonymity networks they depend on. A Monero node also enables receiving payments for services (hosting, relay exits) without passing through an exchange or KYC process. Combined with anonymous hosting and Tor exits, this completes a three-layer anonymity stack: network privacy โ payment privacy โ infrastructure privacy. Each layer is independent; all three together are very hard to penetrate simultaneously.
Is the operator Russian?
Unknown. The .su TLD is the strongest geographic indicator, but .su is used globally by privacy enthusiasts โ it is not restricted to Russian citizens or organizations. The Tor relay data shows relays hosted in European jurisdictions (Poland, Moldova, Netherlands, Germany). The cultural references (Serial Experiments Lain, magical girl anime, Alexander Shulgin) span English, Japanese, and Russian internet culture. No WHOIS, no physical address, no payment trail is visible. Attribution to a specific nationality is not supportable from available evidence. Confidence: LOW on geographic origin.
What is this operator's connection to the phishing activity observed on rdp.sh?
The Satanist operator co-tenants infrastructure with 1337 Services GmbH (Julian Achter / LAIN), whose AS211507 hosts both 2cb.li relays and the rdp.sh platform linked to Caisse d'รpargne phishing. Attribution of the phishing goes to the LAIN/1337 Services infrastructure, not to the Satanist. Their relationship is hosting proximity: they share the same bulletproof substrate without necessarily sharing operational goals. The Satanist builds privacy infrastructure; LAIN builds commercial bulletproof hosting. One pays rent to the other. See 033F for the phishing attribution chain.
The Cultural Coding System
The domain ecosystem built around 2cb.li uses naming conventions that function as tribal membership signals โ legible to insiders, opaque to outsiders, and consistent across operators who have never explicitly identified each other:
| Domain / Entity | Reference | Cultural Layer | What it signals |
|---|---|---|---|
| 2cb.li | 2C-B (Shulgin psychedelic, PiHKAL 1991) | Psychonaut / counterculture | Read Shulgin. Know the schedules. Anti-prohibition. |
| allium.top | Allium = onion genus (Tor = The Onion Router) | Cypherpunk wordplay | Technically literate. Knows Tor's metaphor. |
| lain (AS211507) | Serial Experiments Lain (1998 anime: identity dissolution) | Anime / tech nihilism | The boundary between self and network is an illusion. |
| Aokigahara (AS215659) | Japan's "suicide forest" near Mount Fuji | Death aesthetic | Indifference to consequences. Anti-life aesthetics. |
| MOEMOEKYUN (AS215659) | Magical girl anime incantation (K-On!) | Ironic anime camp | Irony as distance from seriousness. Aesthetic play. |
| 2cb.su | .su = Soviet Union (RELCOM, dissolved 1991) | Ghost-state nostalgia | Allegiance to entities that no longer exist. Outside current authority structures. |
| secretdrop.to | SecureDrop-adjacent anonymous drop concept | Whistleblower / press freedom | Privacy as journalism protection, not purely personal. |
AS211507 โ RIPE Description: "we love lain, cats and the world wide web"
AS211507's RIPE database description is a direct reference to Serial Experiments Lain (1998), a philosophical anime about the dissolution of the boundary between self and network. The series is canonical in the online privacy and anonymity community โ often cited alongside early cypherpunk texts. Its presence in an ASN description is a community password: it signals in-group membership to anyone who recognizes it, and is meaningless noise to anyone who doesn't. "Cats" places it in internet culture broadly; "world wide web" โ not "the internet" โ signals a specific era of web philosophy, pre-platform, pre-surveillance capitalism.
This cultural coding system has a practical security implication: it self-selects the user base. Users who recognize 2C-B references, who know PiHKAL, who parse the Lain reference in an ASN description โ they are not casual users. They are a specific community: technically literate, privacy-committed, ideologically aligned with anti-surveillance values. For a network operator, this is implicit market segmentation. The naming conventions filter for the intended users and filter out actors who don't understand the subculture.
The psychonaut-cypherpunk intersection is historically not the primary source of large-scale cybercrime โ ransomware operators don't name their C2 infrastructure after Shulgin. This matters for threat modeling: the infrastructure exists and routes real traffic, but its design targets a specific privacy-conscious community, not mass-market criminal tooling. The threat, if any, is structural โ the exits exist and could be misused โ not ideological.
Connected Domain Ecosystem
| Domain | Purpose | Registration | Active | Est. operator |
|---|---|---|---|---|
| 2cb.li | Tor exits โ main network (49+ relays) | NymBox/NymDNS (KN) | Yes | Satanist |
| allium.top | Tor exits (3 relays, since 2022) | Njalla (KN registrant) | Yes | Satanist (co-attributed) |
| secretdrop.to | Anonymous communication drops | Cloudflare | Yes | Unknown co-tenant |
| sy.st | Tor exits, XMPP, blog (since 2017) | Gandi / ProtonMail | Yes | maxzrbn (Massimo Zerbini) |
| maxzrbn.it | Cross-ASN Tor exits (PL + MD) | IONOS | Yes | maxzrbn |
| rdp.sh | 1337 Services GmbH RDP platform | Active | Yes | Julian Achter / LAIN |
| 2cb.network | Previous operator contact domain | Unknown | Offline | Satanist (previous) |
sy.st predates all other entities (active since 2017 โ seven years before Mynymbox was registered). It appears to be the original privacy infrastructure operation from which the broader ecosystem evolved. The relationship between Satanist (2cb.li) and maxzrbn (sy.st) is co-tenancy on shared bulletproof hosting, not shared identity โ they are independent operators with compatible philosophies and overlapping infrastructure. See 033E for full operator profile analysis.
What This Infrastructure Actually Is
Investigative Conclusion
2cb.li is not a botnet, not a malware distribution network, not a scanning operation. It is a privacy infrastructure project: Tor exit relays, anonymous DNS, anonymous VPS hosting, and Monero financial infrastructure โ operated under a consistent pseudonymous identity by an operator embedded in the cypherpunk-psychonaut subculture since at least 2015.
The operator is anonymous by design and visible by choice. The blog, the Keybase key, the AROI relay attestation, and the naming conventions are all voluntary disclosures. They exist not to hide โ which would require no blog at all โ but to establish credibility within the privacy community: I am real, I am consistent, I am not an exit scam. Reputation in the privacy space requires persistent identity. This operator has built one without ever using a real name.
The open threat question is not the operator's intent. It is the structural question of who uses 49+ high-bandwidth exit relays representing ~4 Gbps of Tor capacity โ and whether the exit traffic is monitored or logged. That question remains open. The architecture makes it unanswerable from outside.
There is a final irony in this investigation. The Satanist operator publishes their identity voluntarily. They link relays under an AROI attestation key. They run a public blog on a .su domain. They use Keybase. They do everything but use a real name โ and they do this because credibility in the privacy community requires some persistent identity, just not a legal one.
This is the paradox of privacy infrastructure operators: to be trusted, you must be visible. To be safe, you must be anonymous. 2cb.li solves this by creating a pseudonymous identity that is deeply consistent, culturally embedded, cryptographically anchored, and operationally persistent โ but untethered from any legal name or address. The Keybase key is the single thread that could unravel it. Everything else โ the .li domain, the .su blog, the Saint Kitts LLC, the Liechtenstein TLD โ was designed to make that thread impossible to find.
We found the thread. We cannot pull it.
Series Navigation
- 033B โ The Scale: 49 Relays, 17 ASNs, ~4 Gbps โ infrastructure footprint and the April 6 coordinated deployment
- 033C โ The Bulletproof Substrate: 1337 Services GmbH, LAIN, Aokigahara, MAXKO โ who provides the infrastructure rails
- 033D โ The Saint Kitts Pattern: Mynymbox, allium.top, and KN shell company formation agent hypothesis
- 033E โ The Operators: Satanist, sy.st/maxzrbn, and independent co-tenants sharing common substrate
- 033F โ The Payload: Caisse d'รpargne phishing, rdp.sh attribution, and what shares this anonymity substrate
- TI-2026-030D โ Prior investigation: The Satanist (Anonymity Factory series, earlier entry point)