TI-2026-033C: The Bulletproof Substrate
Seven hosting providers, two Spamhaus blacklists, one defunct Belgian shell, and a Romanian SRL named after a suicide forest โ the infrastructure layer that makes 49 Tor relays possible.
Executive Summary
The 49 Tor relays attributed to the 2cb.li network (TI-2026-033B) don't float in the internet โ they are hosted. This article documents the seven autonomous systems that form the hosting substrate: who operates them, how they are legally structured, and what their presence on global threat intelligence feeds tells us about the ecosystem they serve.
Two of the seven providers โ 1337 Services GmbH (AS210558, Hamburg) and MAXKO d.o.o. (AS211619, Sisak Croatia) โ are formally listed on the Spamhaus ASN-DROP list. This is the most severe possible Spamhaus classification: it causes enterprise mail servers, security appliances, and major ISPs to automatically block all traffic from the entire autonomous system. MAXKO carries the highest individual risk score in the substrate at 75.4.
A defunct Belgian entity called SERVPERSO Systems holds a RIPE maintainer object (SERVPERSO-MNT) for five IPs inside AS210558, including 45.154.98.153 โ the IP hosting both a Tor exit node for allium.top and a Caisse d'รpargne phishing domain. The domain servperso.be is now available for registration, the company has been abandoned, and its Hamburg phone number creates a direct geographic link to 1337 Services GmbH.
The remaining four providers round out the stack: Julian Achter's one-man ASN (allocated March 2025, already hosting 13 Tor exits), FranTech Solutions (Nevada LLC since 2010, the oldest player), Aokigahara SRL from Bucharest (named after a Japanese suicide forest), and TRABIA Network from Moldova (300-500 Gbps, the largest by traffic). Every provider shows deliberate regulatory arbitrage โ registered in one jurisdiction, operating in another.
The Seven Providers at a Glance
The 2cb.li hosting substrate spans seven ASNs across six legal jurisdictions. Two are formally blacklisted at the ASN level, one is defunct, one is less than 18 months old.
Pattern Recognition
Every provider uses the same PeeringDB policy template: "Open" peering, "Not Required" contracts, "Not Required" locations. This is not coincidence โ it is the standard configuration for providers who want to maximize customer acquisition with minimum vetting friction. No contracts means no liability terms, no identity verification, no usage restrictions that could be enforced.
The Spamhaus Tier: What ASN-DROP Actually Means
Spamhaus maintains several blocklists of increasing severity. The ASN-DROP list sits at the top: it designates entire autonomous systems as so consistently abusive that security practitioners are advised to block all traffic from that ASN โ not individual IPs, not specific subnets, but everything. Two of the seven providers serving 2cb.li relays have earned this designation.
AS210558 โ 1337 Services GmbH was allocated in October 2021 and achieved ASN-DROP status before 2026. Its RDAP reveals a three-layer routing structure: PREFIXBROKER-MNT (23 IPs), SERVPERSO-MNT (5 IPs), and RIPE-NCC-HM-MNT (4 IPs), all sharing a single abuse contact at abuse@as210558.net. The PREFIXBROKER layer allows 72% of the address space to be reassigned to different downstream customers without modifying the AS registration โ a structure designed for flexibility, not transparency.
AS211619 โ MAXKO d.o.o. carries the highest individual risk score in the substrate: 75.4. Five of its ten tracked IPs have AbuseIPDB confidence score 100. Despite being listed as a Croatian company in Sisak, the top geolocation country for its IPs is Hungary โ the Sisak/Budapest corridor is a known hosting arbitrage zone where companies register in Croatia but physically locate servers in Hungary to access Budapest IXPs.
| ASN | Operator | Country | Spamhaus | Risk Score | Traffic |
|---|---|---|---|---|---|
AS211619 | MAXKO d.o.o. | HR | ASN-DROP | 75.4 | 100-200 Gbps |
AS210558 | 1337 Services GmbH | DE | ASN-DROP | 65.8 | 50-100 Gbps |
AS53667 | FranTech / PONYNET | US | Not listed | 58.2 | 50-100 Gbps |
AS215659 | Aokigahara SRL | RO | Not listed | 53.8 | N/D |
AS211507 | Julian Achter / LAIN | DE | Not listed | 48.1 | 10-20 Gbps |
AS43289 | TRABIA Network | MD | Not listed | 43.7 | 300-500 Gbps |
AS210558 | SERVPERSO Systems | BE | DEFUNCT | N/A | N/A |
The 2cb.li network uses both Spamhaus-blacklisted and non-blacklisted providers in combination. This is not accidental โ it creates a tiered resilience architecture. The DROP-listed ASNs (1337 Services, MAXKO) provide cheap, abuse-tolerant hosting that is already blocked by enterprise security. The non-listed providers (FranTech, TRABIA) maintain cleaner reputations that allow exit traffic to reach more destinations. Using both tiers simultaneously maximizes reach while distributing legal and reputational risk across different corporate structures in different countries.
SERVPERSO: The Phantom Belgian Entity
Within the IP blocks of AS210558 sits a ghost. The RIPE maintainer object SERVPERSO-MNT controls five IP addresses in the 45.154.98.0/24 range. The entity behind it โ SERVPERSO Systems โ is registered in Battice, a village in the Province of Liรจge, Belgium. Its registered phone number is +4941218302498. The Belgian country code is +32. This number begins with +49 โ Germany. Area code 4121 is Pinneberg, a district directly adjacent to Hamburg, where 1337 Services GmbH is registered.
The domain servperso.be is available for registration as of this investigation. The company has been abandoned.
One of the five SERVPERSO-MNT IPs is 45.154.98.153 โ the highest-abuse IP in the AS210558 block (AbuseIPDB confidence: 100). Passive DNS on this address includes:
caisse-epargne-se-connecter.net โ 45.154.98.153 [French bank phishing]
jolly-bouman.45-154-98-153.plesk.page โ 45.154.98.153 [Plesk control panel]
immich.oldos.duckdns.org โ 45.154.98.153 [user-hosted service]
45.154.98.153.powered.by.rdp.sh โ 45.154.98.153 [rdp.sh brand reverse DNS]
The Plesk control panel entry and rdp.sh reverse DNS confirm that 45.154.98.153 is a customer-hosted VPS managed through the rdp.sh infrastructure. The customer is hosting both a Caisse d'รpargne phishing site and services visible to Shodan โ all within a SERVPERSO-MNT block inside a Spamhaus DROP-listed ASN, controlled through a defunct Belgian entity with a Hamburg phone number.
The Paper Trail
The SERVPERSO-MNT RIPE object predates 1337 Services GmbH's RIPE allocation by approximately 6 months. This timing, combined with the shared Hamburg geography and unified abuse@as210558.net contact, suggests SERVPERSO was either: (a) a legal predecessor entity that acquired RIPE address space before the GmbH was formally registered, or (b) a shell vehicle used to obtain IP blocks under a different name before transferring operational control. Both interpretations are consistent with the evidence. The abandonment of the servperso.be domain and the German phone number on a Belgian company file are facts, not interpretation.
Julian Achter: The 2025 ASN and the Monero Market
RIPE NCC allocated AS211507 to Julian Achter on 2025-03-17. This is a remarkably recent allocation for a network that was already hosting 2cb.li relay nodes within months. Achter operates from Am Hang 55, 85737 Ismaning โ a residential address in a suburb of Munich, Bavaria. His PeeringDB profile is unusually candid:
PeeringDB Notes โ Julian Achter (AS211507)
"we love lain, cats and the world wide web
privacy | free speech | anonymity
^^ if you dont like those, go away ^^"
The reference to "lain" is to Serial Experiments Lain, a 1998 anime series whose protagonist dissolves her identity into a networked reality called "The Wired." In underground internet communities, Lain is an icon of radical internet freedom, anti-surveillance identity, and techno-nihilism. The adoption of this identity as an ASN operating brand signals deliberate alignment with these values โ not corporate hosting, but ideological infrastructure.
Through the aluy.net and de.lain LIR commercial services, Achter offers ASN sponsoring โ providing RIPE LIR sponsorship to individuals or entities that cannot hold direct RIPE membership. Price: โฌ71/year. Payment methods include Monero (XMR), enabling anonymous acquisition of official, RIPE-registered address space. This is the mechanism that allows 2cb.li relay operators who value pseudonymity to obtain legitimate IPs without creating a billing paper trail in standard currencies.
Despite holding the ASN for less than 18 months, AS211507 already peers at 7 Internet Exchange Points and hosts 13 confirmed Tor exit nodes across five countries: Germany, Netherlands, Bulgaria, Finland, and Switzerland. The speed of operationalization is consistent with prior planning before the formal RIPE allocation โ a characteristic also observed in the April 6, 2026 mass deployment documented in TI-2026-033B.
Achter's ASN is not just personal infrastructure โ it is a commercial service sold to others. When he says "ASN sponsoring at โฌ71/year," he means that anyone can pay Monero and receive official RIPE-registered address space under his LIR umbrella, without holding their own RIPE membership. The 2cb.li network may be one of his sponsored customers, or it may simply route through his ASN as an upstream. Either way, his network is the structural bridge between anonymous Monero-paying relay operators and legitimate internet routing tables.
Aokigahara SRL: Death Aesthetic as Business Model
Aokigahara (้ๆจใถๅ) is the Suicide Forest. A 35 kmยฒ forest at the base of Mount Fuji, Aokigahara has been the site of more than 100 deaths per year, documented since the 1950s. It is internationally synonymous with suicide, despair, and deliberate disappearance from the world. A Romanian company chose this name for an SRL registered in Bucharest Sector 4.
The company's PeeringDB brand is "Kyun" (ใใ ใ) โ a Japanese onomatopoeia describing a chest-tightening emotional pain, heavily used in anime fandom. The website is kyun.sh. The internal RIPE network name is MOEMOEKYUN โ a compound of "moe" (่ใ, the anime aesthetic of vulnerability and cuteness) and "kyun." Together they form a coherent sub-cultural identity: vulnerable, emotional, death-adjacent, networked.
In the underground hosting market, this aesthetic positioning serves a specific function: it signals to potential customers that the operator self-identifies with transgressive internet communities rather than mainstream corporate values. Customers seeking abuse-tolerant hosting understand these signals without them needing to be stated explicitly.
| Attribute | Value |
|---|---|
| Legal name | Aokigahara SRL |
| RIPE network name | MOEMOEKYUN |
| PeeringDB brand | Kyun |
| Website | kyun.sh |
| Registered | Bucharest Sector 4, Romania |
| RIPE allocated | 2024-01-23 |
| 2cb.li relay DNS | tor-exit.ro.2cb.li โ 93.113.25.109 |
| Abuse contact | abuse@kyun.sh + report@abuseradar.com |
| Secondary maintainer | SIMPLIQ-MNT (+40-364-782222) |
The SIMPLIQ Layer
Three of Aokigahara's eleven tracked IPs are maintained under SIMPLIQ-MNT (phone +40-364-782222, Romanian country code) rather than directly under Aokigahara SRL. This suggests a reseller relationship โ Aokigahara purchases or leases blocks from SIMPLIQ, a separate Romanian entity, for downstream allocation. Six more IPs are listed as "Private Customer" โ meaning the actual end-customer is deliberately hidden from public RDAP records. The structure: SIMPLIQ โ Aokigahara SRL โ Private Customer โ 2cb.li relay. Four layers of indirection.
TRABIA and the Operator Naming Convention
TRABIA Network (AS43289, Moldova) is the oldest and largest provider in the 2cb.li substrate. Trabia SRL was allocated its ASN in July 2007 โ predating all other providers by at least three years. Its PeeringDB traffic rating of 300-500 Gbps dwarfs every other provider in the stack. It operates looking glass at lg.as43289.net and peers at four IXPs. By any conventional measure, TRABIA is a legitimate Moldovan ISP/hosting provider.
What makes its appearance in this investigation significant is passive DNS evidence on IP 178.17.170.225:
poland.exit.maxzrbn.it โ 185.241.208.81 [1337 Services / AS210558]
The maxzrbn.it domain functions as an operational naming convention: each hosting country receives a dedicated subdomain on the operator's personal domain. This creates a persistent, public, operator-attributed map of infrastructure across jurisdictions. The same individual who controls poland.exit.maxzrbn.it controls moldova.exit.maxzrbn.it โ and by extension, the relays behind both.
It also gives investigators an unexpected gift: an ongoing discovery mechanism. As new relays are added by the maxzrbn operator, new DNS entries will be created under this domain. Monitoring maxzrbn.it is equivalent to monitoring the operator's expansion.
Why would a sophisticated Tor operator who values anonymity use their personal handle in public DNS records for every relay? The most likely explanation is operational convenience โ consistent naming makes management easier across 49+ nodes. The secondary explanation is identity expression: the maxzrbn handle is a public-facing brand in the Tor relay community, and maintaining consistent attribution is part of community reputation-building. The AROI key (documented in TI-2026-033A) already voluntarily linked all relays. The DNS naming convention adds a country-level layer to the same attribution structure. This is not an operator who is hiding โ it is an operator who is declaring.
Investigative Q&A
Why would a legitimate Tor relay operator choose ASN-DROP-listed providers?
Three reasons. First, price: ASN-DROP providers are often cheaper because mainstream customers avoid them, creating pricing pressure. Second, tolerance: operators who are listed on DROP already don't respond aggressively to abuse reports, making it easier to run exit nodes without constant service interruption. Third, performance: being DROP-listed doesn't affect Tor circuit-level connectivity โ the DROP list is used by enterprise mail and web security, not by residential ISPs or the Tor network itself. Exit traffic reaches destinations normally; only enterprise-grade security systems would block the source IP.
Is there coordination between these seven providers, or is this coincidence?
No direct coordination evidence exists. What exists instead is a market: operators seeking Tor-tolerant, abuse-lenient, Monero-accepting hosting providers will naturally converge on the same small set of providers. Achter's Monero-accepting ASN sponsoring service, 1337 Services' open policy, MAXKO's abuse tolerance โ these are not conspiracy, they are market segmentation. The 2cb.li operator picked from the available options, and those options are limited enough that unrelated investigators can enumerate them.
What is the legal exposure of a provider hosting Tor exit nodes alongside phishing infrastructure?
Significantly different across the two categories. Tor exit nodes have established legal protection in most EU jurisdictions โ the exit node operator is treated as a conduit, not a content provider, under the EU Electronic Commerce Directive and national equivalents. Hosting a Caisse d'รpargne phishing domain (caisse-epargne-se-connecter.net) on the same physical IP is different: phishing is criminalized under French law (Code pรฉnal Art. 226-4-1 and Art. 313-2) and EU cybercrime frameworks. The coincidence of both on 45.154.98.153 โ within a defunct Belgian entity's RIPE block โ creates real criminal exposure, but only if a jurisdiction can establish material nexus to a real person. The SERVPERSO structure makes that harder.
What does it mean that TRABIA is 300-500 Gbps while all others are under 200 Gbps?
TRABIA is primarily a Moldovan commercial ISP and CDN, not a boutique abuse-tolerant provider. Its appearance in the 2cb.li stack likely reflects normal commercial hosting sales โ TRABIA sold VPS or dedicated server capacity to a customer who then deployed Tor exit nodes. Unlike 1337 Services or MAXKO, TRABIA probably doesn't specialize in or even know about the Tor usage of their customer. The six IPs in our system are a tiny fraction of TRABIA's total infrastructure. The maxzrbn.it passive DNS on a TRABIA IP is significant for attribution but doesn't imply TRABIA-level complicity.
What is the geographic arbitrage pattern and does it work?
Every provider registers in a jurisdiction favorable to its formation (Nevada LLC, Hamburg GmbH, Romanian SRL, Croatian d.o.o.) while operating physical infrastructure elsewhere. This creates a gap between where abuse complaints are legally actionable (country of registration) and where servers actually are (country of operation). It works well against routine abuse complaints, adequately against civil litigation, and poorly against serious law enforcement cooperation under mutual legal assistance treaties (MLATs). A Hamburg GmbH investigated by German police would cooperate with a French MLAT request regarding phishing โ but identifying the GmbH in the first place requires the SERVPERSO โ PREFIXBROKER โ 1337 Services chain to be unraveled.
Substrate Assessment
The seven hosting providers documented here are not random โ they represent the available ecosystem of abuse-tolerant, contract-light, anonymity-friendly European hosting. Two are Spamhaus-blacklisted at the ASN level. One is a defunct shell with a Hamburg phone pretending to be Belgian. One was allocated less than 18 months ago by a Bavarian student selling ASN access for Monero. One is named after a suicide forest.
What they share is more telling than what distinguishes them: all operate with Open peering policy and no contract requirements. All show geographic arbitrage between registration and operation. All are listed in the same threat intelligence feeds. All accept exit node deployments without apparent concern. The 2cb.li operator chose this substrate deliberately โ not one provider, but seven, spread across six legal jurisdictions, ensuring that no single takedown or legal action can disable more than a fraction of the network at once.
The SERVPERSO thread remains open. A defunct Belgian entity with a Hamburg phone number, controlling five IPs inside a Hamburg-registered GmbH's ASN, including the phishing IP โ this is a structural connection that preexists the investigation and deserves direct law enforcement attention. Confidence: HIGH โ direct RIPE registry evidence.
Cross-references in this series
- TI-2026-033A: The Psychedelic Identity โ 2cb.li operator profile, Satanist handle, NymBox anonymity chain
- TI-2026-033B: 49 Relays, 17 ASNs โ Network scale, April 6 deployment event, relay family structure
- TI-2026-033D: The Saint Kitts Pattern โ Mynymbox LLC, KN shell companies, NymDNS vertical integration
- TI-2026-033E: The Operators โ Satanist, sy.st, maxzrbn, allium.top, secretdrop.to
- TI-2026-033F: The Payload โ Caisse d'รpargne phishing, rdp.sh correction, Operation Talent context