TI-2026-033E: The Operators
Four pseudonymous identities, four distinct OPSEC philosophies, one shared conviction โ the human layer of the Psychedelic Connector network, profiled from their own public declarations.
Executive Summary
Behind every Tor exit relay is a human decision to run one. This article profiles four operators whose infrastructure intersects with the 2cb.li Psychedelic Connector network, moving from the most publicly declared to the most operationally silent.
Satanist is the primary operator of 2cb.li โ 49+ relays, 17+ ASNs, ~4 Gbps exit capacity. On 2cb.su (Bear Blog), the handle declares directly: "I run Tor relays and a Monero node." The domain 2cb.su uses NymDNS nameservers (dns.mynymdns.me / dns.mynymdns.st) โ the anonymous DNS provided by Mynymbox Hosting LLC (TI-2026-033D), confirming Satanist as either the operator or a direct integrated customer of that KN infrastructure.
em / j3 operates sy.st ("Syst(em)") โ a French-language privacy blog styled as a newspaper, running since 2022. WHOIS for sy.st (Sao Tome .st TLD) confirms registrant-country: FR (France), registered via Gandi, expiring 2035. The about page self-redacts name, age, and employer but confirms French as primary language, and discloses interests in cybersecurity, privacy, and firearms. PGP fingerprint 998D 9E4A E0B6 B7AE 1AE7 4B1E 8366 D12B FDBC F74C is published on every page โ the most durable identity anchor in this investigation. tor-01.sy.st runs on AS211507 (Julian Achter/LAIN).
maxzrbn operates through maxzrbn.it โ a domain with no visible website, created May 12, 2024 (10 days before mynymbox.io), hosted on IONOS with all registrant data hidden. The domain exists solely as an operational naming convention: poland.exit.maxzrbn.it (AS210558), moldova.exit.maxzrbn.it (AS43289/TRABIA). Maximum operational silence, zero ideological declaration.
secretdrop.to is a zero-knowledge one-time encrypted file drop, running a Tor relay on AS210558 (1337 Services GmbH) and maintaining an active PGP-signed warrant canary last updated June 22, 2026 โ four days before this article. The canary attests to no warrants, court orders, or backdoors, anchored to a Bitcoin block hash.
Operator Profiles at a Glance
Satanist: Declaration as OPSEC
The 2cb.li operator chose a handle that announces itself. "Satanist" does not describe a religious practice โ in the context of underground internet communities, it is a performance of transgression, a signal that the operator does not intend to be policed by mainstream norms. The same logic applies to the domain name 2C-B (a Schedule I psychedelic) and the .su TLD (Soviet Union ccTLD, actively maintained as an anti-censorship zone).
The 2cb.su Bear Blog is the only public-facing declaration of identity. Its content is deliberately minimal โ three sentences on the homepage โ yet those three sentences are forensically complete: handle, activity, and infrastructure (Tor relays + Monero node). There is no archive of posts, no personal biography, no attempt to build a public persona beyond the operational statement.
2cb.su NS โ dns.mynymdns.me / dns.mynymdns.st [NymDNS โ Mynymbox Hosting LLC, KN]
2cb.su MX โ mail.2cb.su [self-hosted email]
2cb.li A โ 94.156.119.148 [PTR: srv-6a4a58.mynymbox.io]
2cb.li NS โ dns.mynymdns.me / dns.mynymdns.st [same NymDNS โ vertical integration]
The NymDNS nameservers on 2cb.su are the structural link that matters. Both 2cb.li (the exit relay domain) and 2cb.su (the personal blog) use the same anonymous DNS infrastructure operated by Mynymbox Hosting LLC. This is either self-hosting โ Satanist is the Mynymbox operator โ or such close integration with Mynymbox that the distinction is operationally irrelevant. Either interpretation places Satanist at the center of both the exit network and the KN offshore infrastructure documented in TI-2026-033D.
The choice to self-declare on a Bear Blog โ minimalist, static, no comments, no tracking โ is itself an OPSEC decision. There is nothing to subpoena from Bear Blog beyond the content itself: no user database, no email addresses, no login records, no IP logs in the meaningful sense. The handle "Satanist" is untraceable to a real name without additional attribution. The declaration is simultaneously maximal (fully public, no hiding) and minimal (no personal detail that assists identification). This is not naรฏvetรฉ โ it is the calculated visibility of an operator who understands that hiding the existence of their operation would be harder than hiding their identity within it.
em / j3: The French Privacy Activist
sy.st has been running since 2017. The domain was registered November 24, 2017 โ before 1337 Services GmbH existed, before AS211507 was allocated, before mynymbox.io was registered. Whatever em/j3 was doing in 2017, it predates this investigation's other actors by years. The domain is registered until 2035. This is infrastructure intended to outlast the current political moment.
The about page is a masterpiece of deliberate self-redaction. Every identifying detail โ name, age, employer โ is redacted with dashes: "I'm โโโโโโโโโ โโโโโ, a โโ years old working on โโโโโโโโ at โโโโโโโโโโโ." What remains is a profile: French speaker, computer scientist, privacy advocate, legally armed ("firearms"), interested in analogue security history (Enigma-E kit). The PGP fingerprint appears on every page, inviting verification while providing no name to verify.
| Attribute | Value | Source |
|---|---|---|
| Nationality | France (FR) | WHOIS registrant-country |
| Registrar | Gandi (French registrar) | WHOIS |
| Domain created | 2017-11-24 | WHOIS (.st NIC) |
| Domain expires | 2035-11-24 (18 years) | WHOIS (.st NIC) |
| Language | French (primary), English | About page |
em@sy.st | Contact page | |
| Email provider | ProtonMail (MX: protonmail.ch) | DNS |
| PGP key type | Ed25519 (modern) | sy.st/pgp.txt |
| Secondary contacts | Signal, Threema, SimpleX | Contact page |
| CDN | BunnyNet (185.102.217.65) | DNS A record / PTR |
| Nameservers | le.sy.st / et.sy.st (self-hosted) | DNS NS |
| Tor relay | tor-01.sy.st on AS211507 (LAIN) | 033A investigation |
| Also runs | DOH DNS, XMR Tor node, xmpp.sy.st (Prosody) | sy.st homepage |
The blog post "Live by your principles, not threat models" (March 21, 2026) is the clearest ideological statement in this entire investigation. The argument: privacy is not a pragmatic response to a specific threat โ it is a political commitment that should be maintained regardless of whether a specific adversary is watching. This is the framework of a person who runs Tor exits not to hide from something, but because anonymity infrastructure is a value in itself.
The Enigma-E Kit Post
The most recent blog post (March 22, 2026) is a review of the Enigma-E โ a kit for building a functional electronic replica of the World War II Enigma cipher machine. This is not trivia. An operator who builds cryptographic hardware for recreation and runs an XMPP server, DOH DNS, and Monero Tor node as personal infrastructure is demonstrating a relationship to operational security that is habitual, not reactive. The Enigma post is also a precise timestamp: as of March 2026, em/j3 was still actively engaged with this infrastructure.
maxzrbn: The Naming Convention
maxzrbn.it exists in public DNS records as a fact without an explanation. The domain resolves to an IONOS elastic IP, the website returns nothing, and the registrant is completely hidden. The domain's only observable purpose is as an operational namespace: every Tor relay operated by maxzrbn gets a subdomain that encodes its host country.
moldova.exit.maxzrbn.it โ 178.17.170.225 [AS43289 ยท TRABIA Network ยท MD]
maxzrbn.it A โ 217.160.0.99 [IONOS elastic IP ยท website: empty]
maxzrbn.it NS โ ns1076.ui-dns.de / ns1119.ui-dns.com / ns1025.ui-dns.org / ns1052.ui-dns.biz [IONOS multi-TLD NS โ 4 jurisdictions]
The naming convention is also a discovery mechanism. Any security researcher monitoring new DNS entries under maxzrbn.it will see new relays as they are deployed. This is a consequence of the convention, not an intent โ but it means the maxzrbn relay fleet is inherently auditable through DNS monitoring, regardless of how well the registrant is hidden.
The IONOS four-nameserver pattern (ui-dns.de / ui-dns.com / ui-dns.org / ui-dns.biz โ four TLDs for four nameservers) mirrors the Njalla approach documented in TI-2026-033D: distributing DNS infrastructure across multiple jurisdictions to prevent any single court order from seizing all nameservers simultaneously. maxzrbn uses a commercial CDN's native multi-jurisdictional NS structure; Njalla distributes custom nameservers across NO/IN/FO. Different tools, same threat model.
maxzrbn.it was created May 12, 2024 โ 10 days before mynymbox.io (May 22, 2024). Both domains were registered in the same infrastructure build-out window. Both use privacy-oriented registrars with complete registrant concealment. The maxzrbn handle predates the domain in passive DNS records (from TRABIA and 1337 Services relay entries), suggesting the naming convention was in use before the .it domain was formalized. The domain registration may have been a late administrative act โ formalizing a convention that was already operational. This is consistent with an operator who builds first and documents infrastructure second.
secretdrop.to: The Warrant Canary Architecture
secretdrop.to is a professional-grade anonymous file sharing service: AES-256-GCM client-side encryption, Argon2id key derivation, zero-knowledge architecture (server stores only an opaque encrypted blob it cannot read), one-time access (secret destroyed on first read), no accounts, no tracking. Its multilingual interface (English, German, Spanish, French, Portuguese, Russian, Chinese) targets a European-plus audience with international reach.
The service runs a Tor relay at 45.94.31.57 โ on AS210558 (1337 Services GmbH, Hamburg), the same Spamhaus ASN-DROP-listed provider used by 2cb.li relays. The website itself is Cloudflare-fronted; the relay IP is not published in public DNS but was identified from Tor relay consensus data in TI-2026-033A.
The canary is PGP-signed and anchored to a Bitcoin block hash โ a standard proof-of-freshness technique that timestamps the statement to a specific moment in the Bitcoin blockchain, preventing backdating. The update policy is monthly. The fact that this canary was updated four days before this article's publication date means it is currently valid. If it is not renewed within 31 days of June 22, the operator has declared, "assume the service is compromised."
The Warrant Canary as Legal Architecture
A warrant canary has a specific legal function: in jurisdictions that allow gag orders on disclosure, the canary allows operators to signal compromise without actively lying (which would be perjury or contempt) or actively disclosing (which the gag order forbids). By making a positive statement that can be retracted by omission โ "we attest X, and if we stop attesting, assume the opposite" โ the canary transfers the communicative act from speech (prohibited) to silence (not prohibited). The Bitcoin anchoring is not just for show: it makes each canary update an independently verifiable timestamped statement in a public ledger, meaning historical canaries are auditable. secretdrop.to has built a legal compliance architecture that functions in adversarial environments.
Investigative Q&A
Is Satanist and the Mynymbox operator the same person?
The NymDNS nameservers on 2cb.su are the strongest evidence for identity overlap. Using Mynymbox's own DNS infrastructure for your personal blog, while also being the primary customer of Mynymbox for 2cb.li hosting, suggests either the same person or an operator with enough access to configure DNS at the infrastructure level โ which is not a typical customer relationship. The alternative hypothesis is that Satanist is a close collaborator or founding customer who was given nameserver access as a privilege. Both interpretations require Satanist to have more than typical hosting customer access to Mynymbox infrastructure. Confidence in overlap: HIGH.
What does em/j3's 18-year domain registration tell us?
Domain registrations of 10+ years are unusual and expensive. An 18-year registration to 2035 signals commitment beyond typical infrastructure cost-optimisation. It also means the domain cannot be seized or expired without involving Gandi (French registrar) under French/EU law โ a more protective jurisdiction than a .com at a US registrar. The registration in 2017 predates all other actors in this investigation, suggesting em/j3 has been building privacy infrastructure for significantly longer than the 2cb.li operation has existed. This is not a person who discovered privacy activism in 2024.
Could the PGP fingerprint on sy.st be used to identify em/j3?
Directly, no. The Ed25519 key is issued to the UID "em@sy.st" โ a circular reference. There is no Web of Trust linking this key to a named identity or any government-issued credential. However, PGP keys can accumulate signatures from other keyholders over time, and if em/j3 has ever signed or been signed by a key linked to a real name, that creates a traceable path. Additionally, if em/j3 has used the same PGP key to sign commits on a public code repository, those commits are permanently archived. The key itself is not identifying. Its history of use across platforms is the attack surface.
Why does secretdrop.to run a Tor relay at all?
Contributing to the Tor network by running a relay is a form of community reciprocity โ if you build services that depend on Tor anonymity, you contribute infrastructure back. It also demonstrates to users that the operator is genuinely invested in the Tor ecosystem, not merely using it as a marketing claim. The choice of AS210558 (1337 Services GmbH) for the relay is notable: the operator specifically chose a Tor-tolerant, abuse-lenient provider for the relay while using Cloudflare (a mainstream CDN) for the website. This bifurcation separates the relay's abuse exposure from the service's availability โ exactly the risk management you would expect from someone who has thought about infrastructure design carefully.
Are these four operators coordinated, or are they independently choosing the same infrastructure?
The evidence supports independent convergence on shared infrastructure more than coordinated deployment. The same bulletin-board operators who find 1337 Services GmbH, FranTech, and LAIN through privacy hosting directories will converge on the same set. The NymDNS/Mynymbox connection between Satanist and the KN infrastructure is the strongest coordination signal โ but even this could be a hosting relationship rather than operational coordination. The OPSEC philosophies are too different to suggest a single trained group: Satanist openly declares; em/j3 carefully curates; maxzrbn is silent; secretdrop.to maintains legal architecture. If these were coordinated by a single actor, the OPSEC would be consistent. It is not.
Operator Assessment
The four operators documented here represent a spectrum of privacy ideology and operational security that is itself forensically informative. Satanist is publicly visible and structurally integrated with Mynymbox infrastructure โ the most exposed operator in the network. em/j3 is a French national with a seven-year privacy infrastructure history, a permanent PGP identity, and the ideological framing of a committed activist rather than a commercial operator. maxzrbn is operationally disciplined to the point of invisibility โ the naming convention is all that remains above water. secretdrop.to demonstrates legal awareness through its warrant canary architecture that none of the other operators exhibit.
What they share is not coordination but convergence: all four have independently arrived at the same infrastructure ecosystem (1337 Services, BunnyNet, Mynymbox, Tor exit operation) through the same set of values. The Psychedelic Connector is not a single organization. It is a community of practice, and these are its practitioners.
The most actionable intelligence in this article is the em/j3 PGP key. 998D 9E4A E0B6 B7AE 1AE7 4B1E 8366 D12B FDBC F74C โ a confirmed French national, active since 2017, running infrastructure until 2035. Any future signed document, code commit, or forum post using this key narrows the attribution from "French national with privacy interests" to a specific individual. Confidence: HIGH on all operator identifications; MEDIUM on Satanist/Mynymbox overlap (structural evidence, not identity proof).
Cross-references in this series
- TI-2026-033A: The Psychedelic Identity โ 2cb.li domain forensics, AROI family key, initial operator identification
- TI-2026-033B: 49 Relays, 17 ASNs โ Full relay inventory, April 6 deployment event, relay family cryptography
- TI-2026-033C: The Bulletproof Substrate โ Seven hosting providers, Julian Achter/LAIN, AS211507 where tor-01.sy.st runs
- TI-2026-033D: The Saint Kitts Pattern โ Mynymbox Hosting LLC (KN), NymDNS used by Satanist's 2cb.su, KN offshore structure
- TI-2026-033F: The Payload โ Caisse d'รpargne phishing, rdp.sh correction, Operation Talent context