033B โ The Scale
49 relays. 17 autonomous systems. 12+ countries. ~4 Gbps. A single operator. A coordinated mass deployment on a single day. At this scale, the 2cb.li network is no longer a privacy project โ it is infrastructure.
Executive Summary
The 2cb.li Tor exit network is far larger than its visible footprint suggests. Two cryptographically linked relay families โ distinguished only by contact address โ total 49+ relays distributed across 17 autonomous systems in 12+ countries. Combined bandwidth is approximately ~4 Gbps, representing an estimated 1-3% of total global Tor exit capacity. That number is not trivial: the Tor Project itself flags single-entity control of more than 5% of exit bandwidth as a potential network security concern.
On April 6, 2026, 14+ relays appeared simultaneously in the Tor consensus across 6+ different hosting providers. Same-day deployment at this scale does not happen manually. It requires automation frameworks, pre-provisioned VPS accounts at multiple providers, and the financial resources to run them indefinitely. Estimated monthly cost: โฌ500โ1,000+. The operator is not a hobbyist. This is deliberately engineered infrastructure.
Two Families, One Operator
The 2cb.li relay network is organized into two cryptographically distinct but operationally linked families. Both are attested under a single AROI key (44FBABA6BC5EF8D1B69AB9C054994A18C5974B99), confirming single-operator control. The distinction between families is purely the relay contact address used โ and that distinction matters.
Family B carries the majority of bandwidth (~3.3 Gbps vs ~1 Gbps for Family A) despite its contact domain going offline. The relays themselves continue running unchanged โ Tor relay operation does not require a live contact domain. The operator migrated their public identity to 2cb.su while leaving Family B's infrastructure in place. This is deliberate: the offline domain reduces the attribution surface for the larger family while the AROI key still links both under a single identity for trust purposes.
Why Two Families?
Compartmentalization. If Family A draws investigative attention โ through the 2cb.su blog, the AROI attestation, or the relay contact โ Family B continues operating under a domain that no longer resolves. An investigator following the 2cb.su trail finds one family. The other is linked only through the AROI key, which requires knowing to look for it. Two families also provides operational redundancy: each can be independently decommissioned, migrated, or expanded without affecting the other.
April 6, 2026: The Deployment Event
Tor relay first-seen timestamps reveal something that would be unremarkable in isolation โ but across 14 simultaneous appearances on the same date, it becomes a forensic signature. On April 6, 2026, the following relays appeared in the Tor consensus for the first time:
Seven providers, two days, at minimum 8 confirmed relay deployments. The total count including relays without first-seen documentation is 14+. This is the forensic profile of an automated deployment pipeline โ not a human configuring servers one by one.
What does a same-day deployment across 7 providers actually require? Each provider needs: a pre-existing account (some require email verification, some Monero payment, some ID), a provisioned VPS instance, SSH access, a configured Tor relay with correct torrc settings, working exit policy, and the relay successfully bootstrapping to the Tor network. For 14 relays across 7 providers in 24 hours: that is either an automation framework (Ansible, Terraform, a custom Tor relay deployment script) or a team. Given everything else we know about this operator, it's automation.
The April 6 date is also notable: it falls in spring, the period when Tor network capacity historically sees increased demand as activism and censorship circumvention needs peak around elections in various countries. Whether the timing is coincidental or deliberate is unknown โ but the operator was watching the calendar.
The 17 ASN Infrastructure Map
The 2cb.li relay network is distributed across at minimum 17 autonomous systems. No single provider hosts more than ~15% of total relay capacity. This is architectural redundancy โ engineered against targeted depeering or seizure.
The LAIN Ecosystem: Julian Achter as Infrastructure Anchor
Julian Achter's LAIN LIR (de.lain) appears in two distinct roles: as the direct operator of AS211507 (6+ 2cb.li relays) and as the LIR sponsor for AS199428 (Alvaro Navas, Spain โ 1 additional relay). This means Achter's infrastructure decisions affect at least 7+ of the 17 ASNs in the network, either directly or as a sponsoring intermediary. His address (Am Hang 55, 85737 Ismaning, Bavaria) and phone number (+4915118462887) are public RIPE data. He sells ASN sponsoring at โฌ71/year, accepts Monero, and is listed on Monerica.com as a Monero-accepting business.
The Geographic Footprint
Confirmed relay exit points span 12+ countries, with the heaviest concentration in the EU/EEA:
| Country | IPs Documented | ASNs Present | Notes |
|---|---|---|---|
| Netherlands (NL) | 8+ | AS211507, AS210558, AS211619, AS199428, AS197170, AS57043 | Dominant exit geography |
| Luxembourg (LU) | 2 | AS53667 (FranTech) | FranTech EU nodes |
| Poland (PL) | 2 | AS210558 | 1337 Services EU east |
| Bulgaria (BG) | 2 | AS211507, AS211619 | LAIN + MAXKO |
| Romania (RO) | 1+ | AS215659 | Aokigahara SRL domestic |
| Switzerland (CH) | 1 | AS211507 | Strong data protection jurisdiction |
| Finland (FI) | 1 | AS211507 | April 6 deployment |
| Hungary (HU) | 1 | AS211619 | MAXKO Central Europe |
| Sweden (SE) | 1 | AS198189 | StealthVM/Throttle node |
| Moldova (MD) | 1 | AS43289 (TRABIA) | Cross-ASN from maxzrbn ecosystem |
| Hong Kong (HK) | 1 | AS211507 | LAIN Asia-Pacific node |
| United States (US) | 2+ | AS53667, AS215659 | FranTech Las Vegas + Aokigahara US |
The Netherlands dominates as an exit country (8+ IPs). This is not random: the Netherlands has one of the highest-quality internet exchange point ecosystems in the world (AMS-IX), excellent peering, and data protection laws that are strong in theory (GDPR) but notoriously slow to enforce against privacy infrastructure. Netherlands exits provide maximum bandwidth efficiency and minimum regulatory friction. The Swiss relay (ch3) is the outlier โ Switzerland is not an EU member, has its own Federal Act on Data Protection (FADP), and generally does not cooperate with EU-jurisdiction law enforcement on matters of "mere" anonymous internet routing.
The Moldova relay is the most geopolitically interesting. Moldova sits in a contested zone between EU aspiration and Russian economic pressure. TRABIA Network is a legitimate Moldovan ISP. A Tor exit in Moldova routes traffic through a jurisdiction with minimal international law enforcement cooperation and no MLAT relationship with most Western investigative bodies. Someone who chose Moldova deliberately understands jurisdictional geography.
The Scale in Context: What ~4 Gbps Actually Means
| Comparison | Approximate Exit Capacity | Context |
|---|---|---|
| 2cb.li (this network) | ~4 Gbps | Single pseudonymous operator |
| Typical university research relay | 100โ500 Mbps | 1โ5 relays, academic budget |
| Typical non-profit relay operator | 50โ200 Mbps | 1โ3 relays, donated or funded |
| Tor Project's concern threshold | >~8-20 Gbps (~5-10%) | Flags for traffic correlation risk |
| Total global Tor exit capacity | ~150-400 Gbps | Varies by time of day / year |
| 2cb.li as % of global total | ~1-3% | Factor-of-2 from concern threshold |
The Tor network's anonymity depends on diversity โ no single entity should control enough exit capacity to correlate entry/exit traffic. A Sybil attack on Tor exits works by deploying enough relays that a significant fraction of user circuits route through the adversary's nodes, enabling timing correlation without breaking cryptography. The threshold at which this becomes practically dangerous is debated; 5-10% is commonly cited as the warning zone.
At 1-3%, the 2cb.li network is approaching that zone but has not entered it. However, the April 6 deployment demonstrates the operator's capacity to double the relay count in a single day. If the same deployment was repeated โ or if the undocumented historical nodes (implied by ch1/ch2, nl1-3, us1 numbering) are still active โ the real fraction could be higher.
The AROI Argument Against Adversarial Intent
The operator voluntarily links all relays under AROI key 44FBABA6BC5EF8D1B69AB9C054994A18C5974B99. AROI (Autonomous Relay Operator Index) is a trust system for the Tor community โ long-running, well-attested relays gain credibility. Choosing AROI is the opposite of what an adversary running a Sybil attack would do: linking your relays under a public attestation key flags the exit concentration to Tor's diversity monitoring tools. An NSA-style adversary would run relays with randomized contacts, no AROI, and deliberately blurred family relationships. The AROI choice argues for legitimate privacy infrastructure operation โ or at minimum, an operator who wants to be seen as legitimate by the Tor community.
The Relay Numbering Convention: Evidence of Hidden History
The naming convention for 2cb.li relay hostnames follows a geographic-numeric pattern:
| Documented Hostname | Implies Missing | Country | Status |
|---|---|---|---|
| tor-exit.ch3.2cb.li | ch1, ch2 | Switzerland | ch1/ch2 undocumented |
| tor-exit.nl4.2cb.li | nl1, nl2, nl3 | Netherlands | nl1-3 undocumented |
| tor.exit.us2.2cb.li | us1 | United States | us1 undocumented |
| tor-exit.nl.2cb.li | โ | Netherlands | Base node (no number) |
| tor-exit.bg.2cb.li | bg2, bg3โฆ? | Bulgaria | Unnumbered โ may be the first |
If the numbered convention is sequential and complete, the undocumented slots (ch1, ch2, nl1, nl2, nl3, us1) represent 6 additional relays not yet captured in Tor metrics โ either historical nodes that ran and were retired, or active relays that our scan missed. The true relay count could be 55+, not 49.
The numbering convention also tells you something about how the operator thinks. Numbering relays ch1, ch2, ch3 โ rather than giving them unique names โ suggests planned expansion from the outset. You don't number something ch3 unless you already had ch1 and ch2. This is architectural thinking, not organic growth. The operator built the naming convention for a network they intended to scale before they started scaling it.
Investigative Questions
Is the April 6 deployment a threat to Tor users?
Not in isolation. 14 new relays from a known, AROI-attested operator increases capacity but does not change the operator's fraction of total exit traffic in a way that crosses the Sybil attack threshold. The concern would be if 14 relays became 140 โ then the fraction of global exit capacity under single-entity control would approach levels where traffic correlation becomes structurally possible. At current scale, the risk is theoretical, not active.
Where does the money come from?
Unknown. โฌ500โ1,000+/month is a significant personal expense for an individual operator. The operator runs a Monero node โ enabling anonymous payment receipt. Possible revenue sources: (a) donations from the Tor/privacy community in Monero, (b) the Mynymbox hosting service itself generates revenue from other customers paying for anonymous hosting, (c) personal wealth or employment income covers the cost without requiring infrastructure monetization, (d) the relays are partially subsidized by hosting providers in exchange for routing relationships. The financial picture is opaque by design.
Why does the Spamhaus AS-DROP listing matter for this network?
AS210558 (1337 Services) and AS211507 (LAIN) are both on Spamhaus AS-DROP, which is used by enterprise networks and many ISPs to block routing from those ASNs. This means Tor exits on these two ASNs are unreachable from enterprise networks and many corporate internet connections โ 2cb.li relays on these ASNs effectively don't exist for users accessing corporate targets. The effective exit pool available to real-world Tor users is therefore smaller than the raw relay count suggests: enterprise-destined traffic routes around these exits automatically.
Could this be a state intelligence operation masquerading as a cypherpunk privacy project?
The hypothesis cannot be ruled out, but the evidence does not support it. State intelligence operations running Tor exits (documented: NSA, GCHQ, and others) typically do NOT use AROI attestation, do NOT run visible public blogs, do NOT accept Monero payments, and do NOT choose domains named after Schedule I psychedelics. State actors optimize for invisibility; this operator optimizes for community credibility. The cultural profile (Satanist, 2C-B reference, anime ASN descriptions, death-vocabulary relay names) is internally consistent with a privacy-idealist cypherpunk subculture rather than a state actor using a cover persona. Confidence in the non-state hypothesis: MEDIUM-HIGH.
What would a takedown of this network look like, and would it succeed?
A targeted takedown against individual ASNs would fail by design. Even a simultaneous action against AS211507 (LAIN, Germany) and AS210558 (1337 Services, Germany) โ the two largest host ASNs โ would eliminate roughly 12 of 49+ relays, leaving 37+ active across 15+ other jurisdictions. Effective action would require coordinated multi-jurisdiction cooperation across Germany, the US, Romania, Croatia, the Seychelles, Moldova, Luxembourg, Finland, Sweden, Spain, the Netherlands, and the UK โ simultaneously. For infrastructure that is legal in all those jurisdictions. This is the point of 17 ASNs.
Documented Relay IPs โ April 6 Batch Highlighted
The following IPs are confirmed 2cb.li relay exit nodes. Orange-highlighted IPs were first seen on April 6, 2026 โ the coordinated deployment event.
โก = first seen April 6โ7, 2026 (coordinated deployment event). Full relay list includes 49+ total nodes; undocumented relays implied by numbering convention not shown.
What the Numbers Actually Mean
Investigative Assessment
The 2cb.li network at 49+ relays and ~4 Gbps is the largest single-pseudonymous-operator Tor exit network this investigation has documented. It is approaching but has not crossed the traffic correlation risk threshold. The April 6 deployment demonstrates infrastructure automation capability and financial resources that exceed those of typical privacy-idealist hobbyists by an order of magnitude.
The network is not currently a demonstrated threat. It is not a botnet, not a scanning platform, not a financial fraud operation. The threat is structural: the operator controls a significant fraction of global Tor exit bandwidth from behind an anonymity stack that makes attribution and enforcement effectively impossible across 17 jurisdictions. If the operator's motivations were to change โ or if the infrastructure were acquired, rented, or compromised by a third party โ the 49 relays and ~4 Gbps become a powerful traffic correlation and exit monitoring asset overnight.
The unanswered question is not what the operator is doing. It is what the operator could do, and who else knows this infrastructure exists.
One number is missing from this analysis: how many Tor users route through 2cb.li exits on any given day. Tor does not publish per-relay usage statistics that would allow this calculation without running the relay itself. But at 1-3% of global exit bandwidth, probability says roughly 1 in 50 to 1 in 30 Tor exit connections route through this network at any given moment โ including this one, if you're reading this via Tor.
The Satanist operator described their work simply: "I run privacy focused services." At 49 relays and ~4 Gbps, they are arguably running one of the larger privacy services that exists โ more than most VPN providers, more than many anonymization networks. The difference is that nobody signed up for it, nobody paid for it, and nobody knows whose infrastructure they're trusting when they use it.
Series Navigation
- 033A โ The Psychedelic Identity: 2cb.li domain, Satanist operator, triple anonymity stack, cultural coding
- 033C โ The Bulletproof Substrate: 1337 Services GmbH, LAIN, Aokigahara, MAXKO โ who provides the infrastructure rails
- 033D โ The Saint Kitts Pattern: Mynymbox, allium.top, and KN shell company formation
- 033E โ The Operators: Satanist, sy.st/maxzrbn, and independent co-tenants
- 033F โ The Payload: Caisse d'รpargne phishing, rdp.sh attribution, what shares this substrate
- TI-2026-030E โ Prior investigation: The Coordinated Deployment (Anonymity Factory series)