TI-2026-033D: The Saint Kitts Pattern
A Nevis LLC, a dark domain with forged heritage, and a Romanian SRL sharing CDN fingerprints with a Caribbean shell โ how the 2cb.li network uses offshore corporate structures to make legal accountability geometrically harder.
Executive Summary
Behind every bulletproof hosting provider is a corporate structure designed to fail gracefully under legal pressure. In the Psychedelic Connector network, that structure runs through Saint Kitts and Nevis โ one of the Caribbean's smallest nations and one of the world's most privacy-protective LLC jurisdictions. Two entities documented in this investigation are KN-registered: Mynymbox Hosting LLC (mynymbox.io, operating VPS and domain registration) and the operator of allium.top (Charlestown, Nevis, hiding behind Njalla DNS).
Mynymbox.io is a fully operational privacy hosting service: KVM VPS at โฌ4/month, shared hosting at โฌ3.50/month, 150+ cryptocurrency payment options, no identity required beyond an email alias, and VPN/Tor access explicitly permitted. Its backend server at 37.16.74.140 (PTR: hosted-by.royalehosting.net) sits behind BunnyCDN, exposing only port 22 to the internet. The legal entity holding all of this is a Nevis LLC โ a structure with zero public beneficial ownership disclosure and near-zero enforcement surface for EU or US jurisdictions.
allium.top takes anonymization further: KN-registered in Charlestown (Nevis's capital), using Njalla as proxy registrant (effectively erasing all WHOIS data), with no IP resolution, no website, and a self-reject-all SPF policy. The domain name itself is a deliberate capture: "allium" is the name of the open-source Tor relay statistics tool used by researchers worldwide. SSL certificates from MarchโAugust 2023 โ belonging to the prior operator who used the domain for exactly this purpose โ predate the current KN operator's October 2025 re-registration by over two years. The domain was targeted, not chosen randomly.
A structural cross-link surfaces in the infrastructure: kyun.sh, operated by Kyun SRL (Romania), shares identical BunnyCDN nameservers (kiki.bunny.net / coco.bunny.net) with mynymbox.io. Kyun SRL is the same Romanian entity cluster that includes Aokigahara SRL, documented in TI-2026-033C as the company behind AS215659. The CDN fingerprint connects the KN offshore shell to the Romanian substrate.
The KN Corporate Architecture
Saint Kitts and Nevis is a federation of two islands in the Caribbean Leeward Islands. The smaller island, Nevis, is home to one of the most privacy-protective LLC ordinances in the Western hemisphere. A Nevis LLC requires no public disclosure of members or managers, files no publicly accessible annual reports, and offers structural asset protection that ranks among the strongest globally. Paired with the country's Citizenship by Investment (CBI) programme โ the oldest such programme in the world, established 1984 โ beneficial owners can acquire KN citizenship and passports, making personal attribution yet harder.
Both domains are state: Nevis. Charlestown is Nevis's capital and the seat of its company registry. The geographic specificity โ not just "Saint Kitts and Nevis" but specifically Nevis and Charlestown โ is significant. The Nevis LLC Ordinance (1995, amended) is the relevant instrument, and it applies to entities registered specifically on Nevis, not on Saint Kitts proper. Both domains are thus definitively using the Nevis LLC framework.
Why Nevis and not Delaware, Cyprus, or the Seychelles? Delaware offers privacy but is subject to US court orders. Cyprus is EU-compliant and cooperative. The Seychelles has improved KYC enforcement under FATF pressure. Nevis in 2024โ2025 still represents the offshore trifecta: no public registry, no automatic information exchange, and physical remoteness from EU/US enforcement. A Nevis LLC hosting provider means that a French bank investigating a phishing attack on its customers (see TI-2026-033F) would need to initiate an MLAT with a Caribbean nation of 51,000 people with a single court โ before they even know whose company it is.
The selection of Nevis is not ignorance of alternatives. It is informed, deliberate jurisdictional choice.
Mynymbox.io: Privacy Hosting as a Service
Mynymbox.io is a functioning, professionally presented privacy hosting service. Its marketing is direct: "Built for journalists, activists, and anyone seeking online autonomy." The infrastructure behind that positioning is equally direct.
| Service | Detail | Signal |
|---|---|---|
| KVM VPS | โฌ4.00/month ยท AMD EPYC ยท dedicated IPv4+IPv6 ยท no overselling | Full root access |
| Shared hosting | โฌ3.50/month ยท DirectAdmin ยท unlimited domains + email | Free SSL (Let's Encrypt) |
| Domain registration | Custom pricing ยท .it.com โฌ9.90 ยท .st โฌ14.90 | Privacy-friendly TLDs |
| Payment | Bitcoin, Lightning, Monero, ZCash, ETH, LTC, MATIC, BCH, stablecoins, 150+ via TrocadorApp | No cards, no PayPal |
| Identity required | Email alias only โ no real name, no address, no phone | No KYC |
| VPN/Tor access | Explicitly allowed for client area, service management, support | Anonymity-first |
| Content policy | "Non-political and do not censor content" โ no removal for disagreement | No takedowns |
| Server locations | Netherlands (Amsterdam), Finland (Nordic) โ "coming soon" more regions | Privacy jurisdictions |
| Tor .onion | Dedicated .onion address for client area access | Dark web native |
The DNS record set on mynymbox.io is a complete operational profile. The A record points to 37.16.74.140, whose PTR resolves to hosted-by.royalehosting.net โ a Netherlands privacy hosting provider. Shodan reports only port 22 (SSH) on this IP, meaning the web-facing service runs entirely through BunnyCDN, which also handles DNS. Mail flows through MXRoute (a budget transactional email provider). The Keybase verification TXT is the only identity anchor that can be followed.
mynymbox.io PTR โ hosted-by.royalehosting.net [upstream confirmed]
mynymbox.io NS โ kiki.bunny.net / coco.bunny.net [BunnyCDN โ DNS + CDN layer]
mynymbox.io MX โ blizzard.mxrouting.net (45.43.208.19) [MXRoute transactional email]
mynymbox.io TXT โ keybase-site-verification=uYoh-JYdhbjre1SlaCKZf6ynZjCYmibddyJor8aPKLA [identity anchor]
The three-layer obfuscation stack between the Nevis LLC and the actual server hardware is visible in the infrastructure chain:
allium.top: The Tor Analytics Brand Capture
"Allium" is not a random word. In the Tor research community, it is the name of a widely-used open-source tool: the Allium Project (github.com/wfn/allium), a Python application for parsing, analyzing, and visualizing Tor relay consensus data. Security researchers, academics, and journalists tracking the Tor network use allium-derived tooling regularly. The domain allium.top was, until mid-2023, likely associated with exactly this use case.
Certificate Transparency logs tell the story with timestamps. Eight SSL certificates for allium.top and www.allium.top were issued by Let's Encrypt between March 10 and August 17, 2023. The prior operator maintained HTTPS on this domain for at least five months. Then the certificates expired, the domain lapsed, and โ over two years later โ it was re-registered in October 2025 by an entity in Charlestown, Nevis, using Njalla as proxy registrant.
The current allium.top is entirely dark. No A record exists in DNS โ Njalla resolves nothing, hiding any IP behind the registrar layer. The MX record points to mail.allium.top (self-hosted), implying operational email infrastructure exists somewhere, but is inaccessible publicly. The SPF record (v=spf1 -all) is a hard reject-all policy, meaning no legitimate email should ever originate from this domain. HTTP and HTTPS requests fail with no resolution.
| Record | Value | Implication |
|---|---|---|
| A | None | Njalla hides all IP resolution |
| NS | 1-you.njalla.no / 2-can.njalla.in / 3-get.njalla.fo | Njalla proxy registrant โ triple-jurisdiction NS |
| MX | mail.allium.top (self-hosted) | Private mail infrastructure exists behind Njalla |
| TXT (SPF) | v=spf1 -all | No legitimate mail, hard reject |
| DNSSEC | Unsigned | No cryptographic validation |
| crt.sh certs | 8 certs, 2023-03 to 2023-08 | Belong to prior (lapsed) operator |
The Njalla nameservers themselves are notable. The three nameservers are in three different country-code TLDs: .no (Norway), .in (India), .fo (Faroe Islands). This is by design โ Njalla distributes its DNS infrastructure across multiple jurisdictions to prevent any single-country court order from disabling DNS for all customers at once. Each nameserver requires a separate legal process in a separate country.
Why Target the Tor Analytics Brand?
Domains with established SSL certificate histories are harder to block โ they have reputational age in threat intelligence feeds that track certificate issuance patterns. A domain with no prior certificates is a red flag; allium.top had active HTTPS from 2023. The Tor analytics association is secondary but meaningful: in a world where Tor exit operators want their infrastructure to appear as research-adjacent rather than abuse-adjacent, a domain that previously hosted a legitimate Tor analysis tool has implicit legitimacy. The certificate record is evidence, not intention โ but the deliberate targeting of this specific name, over two years after its expiry, is not random.
The BunnyCDN Fingerprint: KN Shell Meets Romanian Cluster
Infrastructure fingerprints are often more durable than corporate names. A company can change its registered address, abandon a domain, or form a new legal entity in a different jurisdiction. But a CDN configuration โ the choice of nameserver provider, the specific accounts used โ tends to persist because migrating CDN infrastructure requires effort and carries operational risk.
The following WHOIS comparison reveals a connection that survives all legal obfuscation:
| Domain | Registrant | Country | Nameserver 1 | Nameserver 2 |
|---|---|---|---|---|
mynymbox.io | Mynymbox Hosting LLC | KN | kiki.bunny.net | coco.bunny.net |
kyun.sh | Kyun SRL | RO (Romania) | kiki.bunny.net | coco.bunny.net |
Identical nameservers. Different countries, different legal structures, different domain TLDs โ but both resolve through the same BunnyCDN nameserver pair. BunnyCDN is a legitimate commercial CDN, but accounts on it are specific. The simplest explanation for shared nameservers is a shared BunnyCDN account or a deliberate configuration replication by the same operator.
Kyun SRL is the Romanian company behind kyun.sh โ the same brand referenced in AS215659 (Aokigahara SRL) PeeringDB records documented in TI-2026-033C. Aokigahara SRL registered in Bucharest Sector 4, operating the MOEMOEKYUN ASN under the Kyun brand. kyun.sh is the commercial service frontend. Both Kyun SRL and Aokigahara SRL are Romanian entities in the same network cluster.
kyun.sh was created on December 18, 2025 โ seven months after mynymbox.io (May 22, 2024). If the same operator controls both, they built the KN hosting company first, then the Romanian ASN's commercial frontend second. This sequence is consistent with a strategy of building the legal anonymity shell (KN LLC) before the technical infrastructure (Romanian ASN, kyun.sh brand). The KN entity holds the legal liability exposure. The Romanian SRL handles the operational routing.
This structure โ offshore legal shell in the Caribbean, operational technical infrastructure in Eastern Europe โ is not unique to this network. It is a documented pattern in high-OPSEC hosting operations: separate the legal from the technical across jurisdictions that do not cooperate easily.
Investigative Q&A
Is Mynymbox.io illegal? Its public website looks professional.
Privacy hosting is legal. Accepting Monero is legal. Running a Tor-friendly VPS is legal. Even the "no censorship" stance has legal protection in many jurisdictions. Mynymbox.io likely operates within the law โ it sells anonymous infrastructure, not criminal services. What makes it forensically significant is its structural role in the 2cb.li supply chain: it provides the kind of hosting environment that Tor exit operators with 49 relays, sourced via Monero, with no identity disclosure, require. The legality of the service is exactly why bulletproof hosting exists โ it occupies legal gray zones deliberately.
Why does the allium.top operator need Njalla if they're already in Saint Kitts?
Because jurisdictional protection and registrar privacy are separate attack surfaces. KN protects the legal entity from law enforcement process. Njalla protects the domain registration from registrar-level subpoenas and WHOIS disclosure. Together they mean: to identify the human operator of allium.top, you must simultaneously compel both Tucows (Canadian registrar, GDPR-compliant) to identify their customer, who is Njalla (Swedish/KN entity, run by a privacy activist, explicitly anti-cooperation), who holds a KN entity, which has no public beneficial ownership registry. Three sequential legal barriers, each requiring a separate legal process in a different country.
Could the BunnyCDN nameserver match be coincidence โ both operators independently choosing the same CDN provider?
BunnyCDN is not the dominant CDN choice โ Cloudflare holds 80%+ market share in this segment. Two operators independently choosing BunnyCDN is possible but unlikely. The specificity increases the signal: the exact same kiki/coco nameserver pair, appearing on a KN-registered domain (mynymbox.io) and a Romania-registered domain (kyun.sh) that are already in the same investigative cluster via Aokigahara SRL. Coincidence is the null hypothesis, but the base rate doesn't support it here. Confidence in the link: MEDIUM โ infrastructure fingerprint, not identity proof.
What would happen if EU law enforcement served a request on mynymbox.io?
The legal process would need to reach a Nevis LLC through an MLAT between the requesting EU state and Saint Kitts and Nevis. Saint Kitts has signed some mutual legal assistance agreements, but their enforcement track record for hosting-related matters is limited. Even if the MLAT request succeeded, the KN registry would need to produce beneficial ownership records โ and Nevis LLC structures are specifically designed not to maintain publicly accessible versions of these. The actual server data (at RoyaleHosting in the Netherlands) would require a separate Dutch legal process โ which has better odds of success but requires first identifying that RoyaleHosting is the upstream, which requires piercing BunnyCDN's CDN layer. Total timeline in practice: 12โ24+ months, multiple failure points.
What is the significance of the Keybase key, and has it been linked to other accounts?
A Keybase key is a cryptographic identity โ it can be used to sign proofs across platforms (GitHub, Twitter, Reddit, Hacker News, etc.) and create an auditable chain of service associations. The Mynymbox key (uYoh-JYdhbjre1SlaCKZf6ynZjCYmibddyJor8aPKLA) has not, in current intelligence, been linked to additional identities. But it represents a persistent signal: if the operator of Mynymbox has ever used this same Keybase identity on a public forum โ a GitHub issue, a Reddit post, an HN comment โ that association becomes permanent in Certificate Transparency and web archives. Keybase keys are the identity equivalent of fingerprints left at the scene. This one is unmatched so far.
Jurisdictional Arbitrage Assessment
The Saint Kitts pattern is not novel โ it is a documented, deliberately-chosen architecture. Mynymbox Hosting LLC (KN/Nevis) and allium.top (KN/Charlestown) represent the legal anonymity tier of the Psychedelic Connector network: entities that are technically legitimate, jurisdictionally remote, and structurally designed to absorb law enforcement contact without revealing the humans behind them.
The BunnyCDN fingerprint connecting the KN shell to the Romanian SRL cluster is the most forensically significant finding in this article โ not because it proves identity, but because it demonstrates that the same operational hand configured both. One entity holds the legal anonymity. Another runs the technical infrastructure. The CDN account is where they intersect.
allium.top is unresolved โ currently dark, Njalla-hidden, no SSL since 2023 under prior ownership. It may be dormant, reserved for operational use not yet observed, or part of infrastructure being staged. The deliberate choice of a Tor-analytics domain name combined with the KN registration and Njalla proxy creates a signal worth monitoring. When this domain activates, it will be associated with existing infrastructure and operators already under investigation. Confidence: HIGH on all WHOIS/DNS findings โ direct registry evidence. MEDIUM on BunnyCDN link โ infrastructure fingerprint, structural not identity-level proof.
Cross-references in this series
- TI-2026-033A: The Psychedelic Identity โ 2cb.li domain, Satanist handle, AROI relay family, NymBox first reference
- TI-2026-033B: 49 Relays, 17 ASNs โ Network scale, April 6 deployment event, relay family structure
- TI-2026-033C: The Bulletproof Substrate โ Seven hosting providers, Spamhaus DROP listings, Aokigahara SRL / AS215659 documented
- TI-2026-033E: The Operators โ Satanist, sy.st, maxzrbn, allium.top operator chain, secretdrop.to
- TI-2026-033F: The Payload โ Caisse d'รpargne phishing, rdp.sh correction, Operation Talent context