🇸🇪 TI-2026-044E — The Relay Network: Swedish Tor Exits and the Anonymity Factory

The Relay Network: Swedish Tor Exits and the Anonymity Factory

Series: The Nordic Paradox

Confidence: High on infrastructure and identity mapping; medium on unseen operator coordination

Core judgment: Some Tor exits are acts of civil-liberties advocacy. Others are industrial anonymity services built on the same supply chains as cybercrime forums and phishing infrastructure.

Executive Summary

Part A of The Nordic Paradox examined Sweden's privacy-hosting tradition — the idealist layer. Part B showed that parts of the Swedish hosting cluster also generate measurable attack traffic. Part C traced how the Baltic address market launders geography. Part E now follows the relay network itself: the Tor exit layer that turns abstract privacy principles into operational internet infrastructure.

The investigation data shows that this layer is not one thing. It contains nonprofits, ideological actors, and technically serious privacy operators. But it also contains a more industrial structure: a supply chain of German corporate shells, Belgian maintainer layers, Swedish no-KYC VPS providers, Njalla-registered domains, Monero payment rails, and cross-ASN Tor exit fleets. At the center of the current dossier is 1337 Services GmbH (AS210558), registered in Hamburg under HRB 164175, with directors Florian Marzahl and Finn Alexander Grimpe — two names the investigation ties to the criminal forums Cracked.io and Nulled.to. [E9]

That linkage matters because Operation Talent on 29 January 2025 did not simply take down random forum brands. According to the investigation data, DOJ publicly seized Cracked.io, Nulled.to, and StarkRDP, but did not list rdp.sh, the public-facing commercial brand of 1337 Services. The visible storefronts fell. The backend survived. Related investigation data went further: rdp.sh branding remained visible on SERVPERSO-maintained infrastructure after the seizure window, suggesting either incomplete enforcement or rapid continuity of service. [E1][X1]

The investigation also identifies a deliberate or at least highly consequential obfuscation move at the routing layer. Querying AS210558 via Team Cymru returns not a company name but a 40-character SHA1 hash: 028f45e8dd4f225cb46a7d8003745a3a7f55d3a0. That does not make attribution impossible. It makes automated attribution slower, noisier, and more error-prone. The anonymity factory is not just a set of servers. It is a set of friction points inserted into whois, BGP, corporate registration, domain registration, and payment infrastructure. [E2]

Sweden enters this picture through the provider layer. The investigation identifies StealthVM / Throttle Limited (AS198189) as a Swedish no-KYC VPS operator that accepted Monero, provisioned quickly, and continued to host privacy-oriented relays even after the StealthVM brand decayed from view. That makes Sweden not merely a philosophical homeland of privacy hosting, but a live component inside the relay supply chain. [E7]

And then there is the operator layer. The dossier ties 49+ relays to the 2cb.li / Satanist ecosystem across at least 17 ASNs, with visible placement on AS210558 (1337 Services), AS211507 (LAIN / Julian Achter), AS53667 (FranTech), and AS43289 (TRABIA). Another operator, allium.top, uses a random-string ProtonMail identity, Njalla registration shielding, XMR-only donations, and opaque relay naming while operating since August 2022. Meanwhile relay.secretdrop.to resolves to 45.94.31.57 on AS210558, sits behind Cloudflare, and shows repeated certificate-transparency activity consistent with an actively maintained anonymous drop service. [E4][E5][E6][X3]

The result is not "Tor is criminal." The evidence does not support that. The result is narrower and more important: a subset of the Tor exit ecosystem is run like infrastructure-as-a-service for anonymity itself — distributed, payment-hardened, attribution-resistant, and closely adjacent to commercial abuse infrastructure. In that system, Sweden is not the whole machine. It is one of the places where the machine still finds clean power. [E4][E7][E8]

---

FINDINGS

1. 1337 Services GmbH links formal corporate registration to known cybercrime operators. Hamburg records identify Florian Marzahl and Finn Alexander Grimpe as directors, while the investigation ties them to Cracked.io and Nulled.to. [E9]

2. Operation Talent disrupted brands, not the enabling substrate. DOJ seized Cracked.io, Nulled.to, and StarkRDP, but not rdp.sh; related post-seizure data still found rdp.sh branding in the same ecosystem. [E1][X1]

3. The SHA1 identity mask on AS210558 is operationally significant. Returning a hash instead of a human-readable org name degrades automated attribution and abuse correlation. [E2]

4. SERVPERSO was there first. The Belgian maintainer layer predates 1337 Services' RIPE and corporate registration, implying pre-positioned supply chain infrastructure. [E3]

5. 2cb.li / Satanist is not a volunteer oddity. The relay family spans many ASNs and countries, which is consistent with centrally managed infrastructure rather than isolated exits. [E4]

6. Njalla and Monero are not incidental details. They are parts of an attribution-resistance stack visible in allium.top and adjacent services. [E5][X3]

7. Sweden remains an enabling layer. StealthVM / Throttle Limited gives the wider relay ecosystem Swedish no-KYC infrastructure with fast provisioning and Monero payment acceptance. [E7]

8. Spamhaus considers AS210558 severe enough for ASN-DROP. That places 1337 Services in a network category associated with sustained abuse significance, not background contamination. [E8]

---

Evidence Table: Relay Infrastructure and Operator Layers

---

Chapter 1: The Frontend Fell. The Backend Stayed Up.

The cleanest fact in the dossier is also the most consequential. Operation Talent publicly listed seized domains including Cracked.io, Nulled.to, and StarkRDP, but it did not include rdp.sh. That matters because the investigation identifies rdp.sh as the commercial face of 1337 Services GmbH, the infrastructure company underneath the forum ecosystem. If law enforcement removed the storefronts but not the provider layer, then the operational core remained available to the same market segment. [E1]

This distinction between frontend and backend is the central theme of the article. Cybercrime investigations often create a public impression of decisive disruption because brand names disappear and splash pages go up. But the enabling substrate is harder to remove. ASNs persist. IP space persists. maintainer objects persist. reseller relationships persist. Tor exits route somewhere else. Domains are swapped. When the investigation says "the visible brands fell; the enabling infrastructure survived," it is not rhetorical flourish. It is an infrastructure statement. [E1]

Related investigation data strengthens that conclusion. A SERVPERSO-maintained IP, 45.154.98.153, reportedly still carried powered.by.rdp.sh reverse-DNS branding and exposed operational services after the seizure timeframe. That does not prove unchanged ownership of every component, but it does show continuity of the infrastructure family. Either the seizure did not reach this segment, or the segment was restored fast enough that the market effect was limited. In both cases, the lesson is the same: taking down customer-facing brands is not the same as dismantling the anonymity factory. [X1]

That continuity explains why the Tor layer matters here. Tor exits are often discussed as ideological infrastructure, and sometimes they are. But in this ecosystem they also behave as continuity nodes: resilient, cross-provider, hard to map cleanly, and operationally adjacent to hosting brands already linked to criminal services. When the forum goes dark, the relay network does not automatically disappear with it. [E1][E4]

Chapter 2: A Company Name Replaced by a Hash

There are more subtle ways to resist attribution than using fake names or offshore shells. One of them is simply to degrade the metadata most analysts rely on. The investigation documents that querying AS210558 in Team Cymru returns a SHA1-like string rather than a recognizable organization name. The literal value — 028f45e8dd4f225cb46a7d8003745a3a7f55d3a0 — is not a typo. It is a 40-character hexadecimal token where a human-readable entity should be. [E2]

This matters because automated threat-intelligence workflows are built on string matching and entity normalization. A provider called "OVH SAS" groups cleanly. A provider called "DigitalOcean, LLC" groups cleanly. A provider represented by a cryptographic-looking token does not. Abuse analysts have to know that the token maps back to 1337 Services GmbH, or else build bespoke logic to recover the identity from other sources. The effect is not invisibility. The effect is cost. Cost slows reporting, slows triage, and increases the chance that one part of the ecosystem never gets linked to another. [E2]

Whether the mask is deliberate or a tolerated artifact matters less than its operational consequence. The investigation does not claim direct proof of intent behind the SHA1 field. It does show that the result benefits the operator. In a market built around anonymity, friction is a product. Adding friction to the attribution layer is consistent with everything else the dossier observes: the use of Njalla, Monero, multi-jurisdiction maintainer chains, and corporate wrappers that appear only after the infrastructure is already in motion. [E2][E3][E5]

Seen this way, the SHA1 mask is not a curiosity. It is a design pattern. The anonymity factory does not depend on one dramatic obfuscation trick. It depends on many small ones, each of which is survivable alone and powerful in combination. [E2]

Chapter 3: SERVPERSO — The Belgian Layer That Was There Before the Company

The investigation's timeline evidence is unusually revealing. SERVPERSO-MNT appears in RIPE on 2021-04-16. 1337 Services was registered later in 2021, and AS210558 was allocated on 2021-10-28. That means the maintainer layer predates the public-facing German company by roughly six months. [E3]

That sequencing tells us something important about how this ecosystem is built. The company wrapper did not create the infrastructure chain. The infrastructure chain existed first and later acquired the wrapper. This is the opposite of how an ordinary small hosting business normally grows. A conventional provider begins with a brand, some servers, and then expands into more address space. Here the evidence suggests a pre-positioned supply chain: maintainer object, address-space handling, relay placement, reverse-DNS branding, and only then a polished German GmbH. [E3][X1]

Related dossier data on SERVPERSO makes the picture uglier. The 45.154.98.0/24 block reportedly exposed 211 PTR records showing ns1.rdp.sh, dozens of powered.by.rdp.sh hostnames, tor-exit-1.allium.top, and a mix of phishing, scam, and abusive domains. Even without importing every associated allegation into the current piece, the direction is clear: the maintainer layer is not clean plumbing accidentally rented by one or two bad customers. It is a shared operating surface where anonymity services and outright abusive infrastructure sit close together. [X1]

That is why the Belgian layer matters inside a dossier about Swedish Tor exits. It demonstrates that the relay network is not a national story. It is a transnational supply chain in which Sweden provides one kind of cover, Belgium another, Germany another, and domain/payment intermediaries yet another. The relay network is multinational because resilience requires legal and operational fragmentation. [E3][E4][E7]

Chapter 4: 2cb.li and the Managed Exit Fleet

The dossier's strongest evidence against the "these are just isolated volunteers" narrative comes from the 2cb.li / Satanist relay family. According to the investigation, Onionoo and related telemetry tie 49+ relays to 2cb.li contact patterns across at least 17 ASNs. The visible examples include AS210558, AS211507 (LAIN / Julian Achter), AS53667 (FranTech), and AS43289 (TRABIA). [E4]

That spread matters because decentralization here is not ideological purity. It is resilience engineering. A volunteer relay operator might use one provider, or maybe a small handful, and accept churn. A fleet that deliberately spans many ASNs and countries behaves differently. It is built to absorb abuse complaints, provider terminations, and partial seizures without losing total capacity. Related investigation data explicitly interprets this as a resilience strategy: when Operation Talent struck overlapping infrastructure, the 2cb.li ecosystem survived because it was already distributed. [X2]

The named association with Julian Achter / LAIN (AS211507) sharpens the point. The current investigation identifies Achter as a German LIR operator directly linked to Tor exit hosting and LIR marketplace participation. Cross-referenced investigation data further places 2cb.li exits directly on LAIN infrastructure. That means the network is not merely using random VPSes. It reaches into the sponsorship and resource-allocation layer of internet numbering itself. [E4][X2]

This is where the phrase anonymity factory becomes analytically useful. A factory is not defined by one part. It is defined by repeatable output from coordinated components. The visible components here are exactly that: routable space, sponsoring layers, maintainer chains, domain shields, crypto payments, and exit-node families that can move across providers while preserving operational identity. [E4][E5][E7]

Chapter 5: allium.top, Njalla, and High-OPSEC Privacy Theater

If the 2cb.li ecosystem shows scale, allium.top shows style. The investigation describes an operator using a random-string ProtonMail address, Njalla nameservers and shielding, XMR-only donations, and deliberately opaque relay names. Related investigation data adds a concrete operating date: 2022-08-21. That means this is not a momentary experiment. It is a sustained operational pattern. [E5][X3]

None of these details alone prove criminality. That is not the claim. The point is that they make attribution materially harder while remaining fully legible to a specific subculture that knows what these signals mean. Njalla offers a ready-made legal and administrative shield. ProtonMail lowers friction for pseudonymous communications. Monero removes ordinary payment trails. Opaque relay names reduce casual correlation. The stack is not accidental. It is coherent. [E5][X3]

In a healthier privacy ecosystem, such OPSEC might be interpreted primarily as protective behavior for high-risk operators. In the infrastructure context documented here, the meaning changes because the same actors sit on or near networks already associated with criminal-service hosting. When allium.top resolves into 1337 Services space, or when the same supply chain overlaps with phishing and forum infrastructure, the boundary between privacy maximalism and criminal-adjacent tradecraft becomes difficult to defend cleanly. [E5][X1]

This is why the Nordic question remains live. Sweden's privacy tradition made it culturally normal to defend anonymity infrastructure. Njalla emerged from that milieu. But once those tools become standardized shields inside an industrial relay network, the moral meaning of anonymity changes. It is no longer just a principle. It is also a service layer. [E5][E7]

Chapter 6: secretdrop.to and the Anonymous Service Stack

The investigation's secretdrop.to evidence is important because it shows the relay ecosystem doing more than routing traffic. relay.secretdrop.to resolves to 45.94.31.57 on AS210558, sits behind Cloudflare, and shows repeated certificate-transparency activity plus Google site-verification signals. That combination points to an actively maintained anonymous file or message-drop service, not a dead artifact. [E6]

This is how anonymity factories mature. They stop being just server rental businesses and become layered ecosystems: hosting, relay placement, domain management, TLS management, traffic shielding, operational tooling. The investigation data on rdp.sh in related dossiers reinforces the pattern, documenting dozens of subdomains and operational infrastructure references across the same broader environment. Even if secretdrop.to serves legitimate whistleblowing or leak use-cases for some users, the core point remains: the same infrastructure family is capable of offering anonymous services, Tor relay capacity, and cybercrime-adjacent hosting from one interconnected supply base. [E6][X4]

That matters for attribution, but it also matters for culture. Anonymous-drop branding evokes journalism, leak platforms, and public-interest exposure. Yet the technical substrate is not automatically public-interest infrastructure just because it looks the part. Infrastructure inherits context from its neighbors. In this case, the neighbors include rdp.sh, AS210558, SERVPERSO, Spamhaus ASN-DROP, and a legal/directorial chain tied to two major crime forums. [E6][E8][E9]

Chapter 7: Sweden's Role — Not the Whole Machine, But a Clean Room Inside It

The article is called Swedish Tor Exits and the Anonymity Factory because Sweden remains a live enabling layer even when the most overtly criminal-adjacent components sit elsewhere. The investigation identifies StealthVM / Throttle Limited (AS198189) as a Swedish no-KYC VPS provider that accepted Monero, offered rapid deployment, and continued to host privacy-oriented relays after the visible brand degraded. [E7]

This is not an accident of geography. Sweden has long served as a legitimacy anchor inside European privacy culture. A Swedish address, Swedish company, or Swedish ideology layer still signals civil-liberties seriousness to many technically literate users. That reputation has value. The investigation suggests it is also rentable. A relay family that can mix German hosting shells, Belgian maintainer layers, and Swedish no-KYC VPS capacity gets both redundancy and reputational cover. [E3][E7]

The point is not that Sweden caused 1337 Services. It is that the Swedish privacy ecosystem still provides clean inputs — hosting, culture, payment tolerance, and normalized anonymity rhetoric — into a wider relay economy that includes far dirtier actors. That is what makes the Nordic paradox durable. The idealist infrastructure does not disappear. It gets operationally entangled. [E5][E7]

Chapter 8: Spamhaus Already Made a Judgment

One of the most useful facts in the dossier is also the simplest: AS210558 appears on Spamhaus ASN-DROP. Spamhaus does not reserve ASN-DROP for accidental contamination or a few nuisance customers. It is a severe classification reflecting sustained abuse significance at the autonomous-system level. [E8]

That matters because it cuts through rhetorical ambiguity. We do not need to prove that every relay on AS210558 is malicious, or that every service on the network exists for criminal use, to understand that the overall environment has crossed a threshold. Spamhaus already reached an institutional judgment that the abuse pattern is systemic enough to treat the ASN itself as toxic. [E8]

Placed next to the directorial evidence, the Operation Talent exclusion, the SHA1 mask, the SERVPERSO precursor layer, the allium.top OPSEC stack, and the Swedish Throttle component, the meaning becomes difficult to escape. This is not just privacy infrastructure. It is privacy infrastructure industrialized for resilience against attribution and enforcement. [E1][E2][E3][E5][E7][E8][E9]

---

EVIDENCE

• [E1] Operation Talent seizure list excluded rdp.sh — DOJ press release + prior dossier evidence; reliability: high. Shows that Cracked.io, Nulled.to, and StarkRDP were listed, but rdp.sh was not.
• [E2] AS210558 SHA1 identifier in Team Cymru — Team Cymru BGP database + prior dossier evidence; reliability: high. Documents the 028f45e8dd4f225cb46a7d8003745a3a7f55d3a0 org-field anomaly.
• [E3] SERVPERSO timeline predates 1337 Services — RIPE NCC database + prior dossier evidence; reliability: high. Shows SERVPERSO-MNT creation on 2021-04-16 and later AS210558 allocation.
• [E4] 2cb.li relay family spans many ASNs — Onionoo + prior dossier evidence; reliability: high. Ties 49+ relays to 2cb.li contact patterns across 17+ ASNs.
• [E5] allium.top OPSEC pattern — Onionoo + WHOIS + prior dossier evidence; reliability: high. Documents ProtonMail randomness, Njalla shielding, XMR-only donations, and opaque naming.
• [E6] secretdrop.to on 1337 infrastructure — CT logs + DNS + prior dossier evidence; reliability: high. Places relay.secretdrop.to on 45.94.31.57 / AS210558 behind Cloudflare.
• [E7] StealthVM / Throttle continued after brand decay — archived StealthVM material + prior dossier evidence; reliability: high. Shows Swedish no-KYC, Monero-accepting VPS infrastructure remained available to relay operators.
• [E8] Spamhaus ASN-DROP for AS210558 — Spamhaus ASN-DROP + Qdrant honeypot_asns; reliability: high. Confirms severe abuse classification at ASN level.
• [E9] Hamburg register confirms 1337 directors — Hamburg Handelsregister + prior dossier evidence; reliability: high. Anchors Florian Marzahl and Finn Alexander Grimpe to HRB 164175.
• [X1] Post-seizure rdp.sh persistence on SERVPERSO space — cross-referenced investigation TI-2026-030B; reliability: high in the investigation corpus. Documents powered.by.rdp.sh branding and continued exposure on 45.154.98.153 after Operation Talent.
• [X2] 2cb.li resilience across overlapping providers — cross-referenced investigation TI-2026-030D; reliability: high in the investigation corpus. Shows the relay family surviving enforcement pressure through cross-ASN distribution, including LAIN/AS211507.
• [X3] allium.top operating since 2022-08-21 — cross-referenced investigation TI-2026-030J; reliability: high in the investigation corpus. Adds the operating timeline and relay-metrics detail.
• [X4] rdp.sh CT footprint — cross-referenced investigation TI-2026-030J; reliability: high in the investigation corpus. Documents a broader operational subdomain footprint around the same infrastructure family.

---

Questions That Remain

1. Who actually owns operational control of the overlapping relay, hosting, and domain layers on a day-to-day basis? The legal entities and visible operators are mapped with high confidence, but the internal division of labor remains opaque. [E9][X1]

2. Was the SHA1 mask deliberate, inherited, or tolerated? The consequence is clear; the decision path behind it is not. [E2]

3. How much of the Swedish relay layer depends on providers like Throttle versus NGO or volunteer infrastructure? The dossier proves Swedish participation, but not the full market share of each model. [E7]

4. Where is the real enforcement bottleneck? Operation Talent showed public capability against forum brands, but the persistence of the substrate suggests legal, technical, or jurisdictional limits lower in the stack. [E1][X1]

5. How many anonymous services like secretdrop.to share the same backbone without obvious public branding? CT activity shows one example, not the entire inventory. [E6][X4]

Conclusion

Part E closes the distance between privacy rhetoric and operator reality.

The same Nordic ecosystem that once looked like a principled defense of anonymity now contains an industrial relay market where German corporate shells, Belgian maintainer objects, Swedish no-KYC infrastructure, Njalla shielding, Monero payments, and cross-ASN Tor fleets work together as a resilient service layer. 1337 Services GmbH ties formal business registration to operators linked with Cracked.io and Nulled.to. Operation Talent removed the fronts but not the factory. The SHA1 mask degrades machine attribution. SERVPERSO proves the supply chain existed before the wrapper. allium.top and secretdrop.to show how anonymity becomes an operational product. [E1][E2][E3][E5][E6][E9]

This does not invalidate Tor as a technology. It does something more precise. It shows that a meaningful part of the exit ecosystem is no longer best understood as volunteer infrastructure with incidental abuse around the edges. It is better understood as managed anonymity capacity, sold and maintained by actors who know exactly how to make themselves difficult to seize, difficult to name, and difficult to collapse all at once. [E4][E8]

Which brings the series back to Sweden. The Swedish privacy tradition was real. The ideals were real. But ideals alone do not control what gets built on the supply chains they normalize. In this relay network, Sweden is not merely the conscience of privacy. It is also one of the clean rooms where the factory still assembles its parts.