๐ TI-2026-042T โ The European Axis: Contabo, Hetzner, and the Privacy Shield
I. The European Backbone
| Provider | Country | Example in Data | Threat |
|---|---|---|---|
| Contabo GmbH | DE | play.eutoligado.net | 95 |
| Hetzner Online GmbH | DE | darkcurry.com, xavicopadolliure.es | 71 |
| OVH SAS | FR | xplaydashboard.com, au.nodomain.vip | 86/64 |
| IONOS SE | DE | funny-hellman plesk page | 61 |
| Surfplanet GmbH | DE | oldschool-bots.duckdns.org, starcamp.store | 79/78 |
II. The German Data Center Paradox
Germany has some of the strongest data protection laws in the world. The Bundesdatenschutzgesetz (BDSG) and GDPR implementation create strict requirements for data handling. These same laws make it difficult for foreign law enforcement to obtain data from German hosting providers.
The result: German data centers become attractive to operators who want legal protection from investigation. Contabo, Hetzner, and IONOS host massive amounts of infrastructure โ some of it legitimate, some of it attack operations. The privacy laws designed to protect German citizens also protect the operators of play.eutoligado.net (threat 95) and darkcurry.com (threat 71).
III. The Contabo Pattern
IP 185.135.137.194 โ Contabo GmbH โ threat 95. Hostnames: play.eutoligado.net, www.play.eutoligado.net. "eutoligado" โ Portuguese for "I connected" or "I'm connected." A play/gaming domain with Portuguese language, hosted in Germany on Contabo, with threat score 95. The infrastructure is in Europe. The language is South American. The operation is global.
IV. OVH: The French Giant
OVH โ one of the world's largest hosting providers โ appears throughout our data. xplaydashboard.com (threat 86), au.nodomain.vip (threat 64). OVH's scale provides cover: millions of legitimate customers make it easy for attack operations to blend in. OVH also experienced a major data center fire in Strasbourg in 2021, destroying customer data โ a reminder that physical infrastructure has physical vulnerabilities.
European hosting provides: legal protection (GDPR), infrastructure quality (German engineering), network connectivity (European internet exchanges), and plausible legitimacy (hosting alongside millions of legitimate sites). This is why attack operations don't host in Somalia. They host in Frankfurt and Paris.
V. Boystown: 400,000 Users, German Administrators, EU Privacy Shield
The case that proves the thesis:
Boystown was a child sexual abuse material (CSAM) platform on the Tor network. Launched June 2019. Shut down April 2021. 400,000 registered users.
| Detail | Fact |
|---|---|
| Platform | Tor onion service (.onion) |
| Server | Registered in Moldova |
| Administrators | 4 German nationals (Paderborn, Munich, Hamburg, one in Paraguay) |
| Categories | Kindergarten, Toddler, Adolescents, Hardcore |
| Users | 400,000 registered |
| Sentences | 7–12 years (December 2022) |
| Detection method | BKA Tor correlation attack on Ricochet protocol |
Four hundred thousand people consuming sexual abuse material of infants and toddlers. Administered from Germany. Server in Moldova. Using EU privacy infrastructure (Tor, cryptocurrency, cross-border jurisdictional gaps) to operate for two years before detection.
The same GDPR that protects legitimate privacy delayed identification of operators. BKA needed months of sophisticated Tor traffic correlation to identify administrators who were communicating via privacy-preserving protocols — the same protocols EU law was designed to protect.
VI. Johannes Selg: 63 IPs, One Name
RDAP registration analysis reveals Johannes Selg (MH7476-RIPE) as technical contact for 63 IP addresses in our honeypot database. All on Contabo GmbH infrastructure.
IPs confirmed in our top-threat database with this registrant:
- 185.135.137.194 — threat 95, 36 hits (France-deployed, German-registered)
- 173.249.52.138 — threat 91, 54 hits (France-deployed, German-registered)
- 173.249.39.48 — cetracker.com.br host (042S surveillance investigation)
63 IPs under one registrant. Either:
- A single large customer running attack operations across 63 servers
- Contabo’s own technical staff NIC handle appearing on customer allocations
- A reseller managing infrastructure for multiple attack operators
In all cases, a single RDAP identity spans 63 attack-capable IP addresses on German-registered, French-deployed infrastructure. This is infrastructure-as-a-service for exploitation.
VII. The 44-IP Geo Discrepancy Cluster: Systematic Jurisdictional Engineering
44 IP addresses share an identical geographic discrepancy pattern:
| Source | Country |
|---|---|
| RDAP (registrant) | DE (Germany) |
| Team Cymru (BGP) | DE (Germany) |
| ipinfo (geolocation) | FR (France) |
| AbuseIPDB | FR (France) |
| Derived | FR (France) |
This is not noise. 44 IPs with the exact same pattern is deliberate architectural choice:
- German law governs registrant data → GDPR Art. 17 right to erasure, strict data processing, DPA oversight
- French law governs physical infrastructure → seizure requires French court order + German cooperation
- Abuse complaints → go to German company (slow GDPR-compliant process)
- Criminal investigation → requires bilateral EU cooperation (months, not days)
The Boystown administrators used exactly this strategy: German operators, Moldovan server. Our honeypot attackers use the same: German registration, French deployment. The privacy shield is not a bug. It is the product.
VIII. Temporal Correlation: The Coordinated Strike
On 2026-06-03 at 01:10 UTC, five IP addresses attacked within the same 10-minute window:
| IP | Provider | Country | Threat |
|---|---|---|---|
| 185.135.137.194 | Contabo | FR (DE-registered) | 95 |
| 46.62.239.90 | Hetzner | FI | 86 |
| 87.251.64.176 | Unknown | PL/RU/KZ (triple discrepancy!) | ~70 |
| 185.246.128.133 | Unknown | TBD | TBD |
| 185.255.100.203 | Unknown | TBD | TBD |
One operator. Distributed across: Contabo (German company, French DC), Hetzner (German company, Finnish DC), and a PL/RU/KZ triple-jurisdiction node. Attacking simultaneously to maximize coverage before any single provider responds to abuse reports.
The triple-discrepancy partner (87.251.64.176: Poland geolocation, Russian prefix, Kazakhstan ASN registration) adds another jurisdiction — making this a five-country investigation for a single attack wave.
IX. DFN: The German Research Network as Attack Platform
IP 139.19.117.129 on the Deutsches Forschungsnetz (DFN, AS680 — one of the world’s oldest ASNs):
- Threat score: 93
- Honeypot hits: 49
- Entity relations: 64 (highest of any academic IP)
- Shared SSH key: d4:98:c4:f3:12:ef... across 17 IPs in 192.42.116.x range
This is the 042Q pattern (universities that attack) repeated in Germany. DFN provides network infrastructure to German universities and research institutions. A compromised research server produces attack traffic from an ASN that most firewalls whitelist as “educational.”
The 17-IP SSH key cluster suggests a large research scanner or a compromised cluster. Either way: German academic credentials provide cover for traffic that would be blocked from any commercial VPS.
X. Surfplanet: The Persistent Pair
Two Surfplanet GmbH IPs occupy positions 4–5 in Germany’s top threats:
- 78.111.67.246 — threat 92, 60 honeypot hits
- 78.111.67.242 — threat 91, 60 honeypot hits
Same /24 subnet. Identical hit count. Almost identical threat scores. This is a persistent dual-node operation — two IPs maintained in parallel for redundancy. If one gets blocked, the other continues. Surfplanet GmbH is a mid-tier German hosting provider, not a known bulletproof hoster. Yet it hosts the most persistent attack pair in our German dataset.
XI. The Exploitation Thesis: Privacy as Predator Shield
The European privacy framework was designed to protect citizens from corporate surveillance. It now protects:
- 400,000 Boystown users consuming toddler abuse material (2 years undetected)
- 63 attack IPs under one registrant (Johannes Selg) on Contabo
- 44 IPs using DE-registration/FR-deployment jurisdictional split
- Coordinated botnets spanning 5 countries in a single attack wave
- Academic network attackers hidden behind DFN research credentials
GDPR Article 6(1)(f) requires “legitimate interest” to process personal data. Abuse report processing IS a legitimate interest. But the bureaucratic overhead of GDPR-compliant abuse handling gives operators weeks of operational time before infrastructure is pulled. Boystown ran for two years. Our Contabo attackers have been active since at least June 2026.
The privacy framework does not distinguish between:
- A journalist protecting sources
- A dissident evading state surveillance
- A child exploitation network evading law enforcement
The same legal mechanism protects all three. This is not a flaw in the framework. It is the framework.
XII. The German Concentration: Numbers
German-associated infrastructure in our honeypot:
| Provider | ASN | IPs | Max Threat | Max Hits |
|---|---|---|---|---|
| Contabo GmbH | AS51167 | 30 | 95 | 54 |
| Hetzner Online | AS24940 | 30 | 89 | 18 |
| netcup GmbH | AS197540 | 27 | 82 | 12 |
| ColoCrossing (042S) | AS36352 | 30 | 99 | 72 |
| DFN Research | AS680 | 1+ | 93 | 49 |
| Surfplanet | — | 2 | 92 | 60 |
| Vodafone DE | — | 1 | 93 | 50 |
120+ IPs across German-controlled infrastructure. This is not Germany as a victim of cybercrime. This is Germany as the operating base for cybercrime, protected by its own privacy framework.
XIII. Cross-Investigation Convergence
| Investigation | German/EU Connection |
|---|---|
| 042L | MEVSPACE Poland → EU transit corridor to German hosting |
| 042N | Digit One Russia → ansible credential shared with 042P Pakistan, both route through EU |
| 042O | Omegatech NL/CH → Seychelles shell company, operated from EU infrastructure |
| 042Q | CIPMA Pakistan on same Cybernet as Digit One → academic attack mirrors DFN pattern |
| 042R | cetracker.com.br on Contabo DE → same Johannes Selg registrant, same 63-IP cluster |
| 042S | edgetrack.org on netcup DE → surveillance-as-service on German privacy infrastructure |
Every exploitation corridor documented in this series routes through European infrastructure. Not because Europe produces exploitation — but because European privacy law provides the operational shield that exploitation requires to scale.
XIV. Series Context: The Shield Becomes the Weapon
042D–K: Exploitation in weak states (no enforcement)
042L–R: Infrastructure follows exploitation routes (transit corridors)
042S: Surveillance IS exploitation (tool = crime)
042T: Privacy IS the exploitation shield (law = weapon)
042T inverts the expected narrative. Germany is not failing to protect children. Germany’s privacy infrastructure — GDPR, jurisdictional complexity, data protection authorities, erasure rights — is actively shielding the infrastructure that exploits children. Boystown ran for two years under this shield. Our 63-IP Contabo cluster operates now. The 44-IP jurisdictional split is current. The DFN academic attack platform is live.
The privacy shield works exactly as designed. It protects everyone equally. That is both its virtue and its catastrophe.