Bunker Scheme. Image: German Police
— a pioneer of anonymous hosting, which began operations in 1998. The company placed its servers in one of the most unusual locations: inside a former NATO underground complex built in 1955 as a secure bunker in case of nuclear war.
Customers would line up: all servers were usually occupied despite high prices: VPS cost from €100 to €200 per month, excluding installation fees, and the VPS plans did not support Windows. However, the host successfully ignored any DMCA complaints from the USA, accepted bitcoins, and required no personal information from clients other than an email address.
But now the 'anonymous chaos' has come to an end. On the night of September 26, 2019, German special forces and police . The assault was made under the pretext of combating child pornography.
The storming was not easy, as the bunker is located in an inaccessible area of the forest, and the data center itself is situated several levels underground.
About 650 people participated in the operation, including law enforcement officers, rescue services, firefighters, medical personnel, drone operators, etc.
The entrance to the bunker can be seen next to three buildings in the upper left part of the photograph. In the center is a communication tower. To the right is the second building of the data center. The photo was taken from a police drone
Police at the entrance to the bunker after the operation began
The captured facility is located near the town of Traben-Trarbach in the southwestern part of Germany (Rhineland-Palatinate, capital Mainz). Four underground floors of the bunker go down to a depth of 25 meters.
Prosecutor Juergen Bauer told reporters that the investigation into the activities of the anonymous hosting service had been ongoing for several years. The operation was carefully prepared. At the same time as the assault, seven individuals were detained in a restaurant in Traben-Trarbach and in the town of Schwalbach, near Frankfurt. The main suspect is a 59-year-old Dutchman. He and three of his compatriots (49, 33, and 24 years old), one German (23 years old), a Bulgarian, and a lone woman (German, 52 years old) were arrested.
Searches were also conducted in Poland, the Netherlands, and Luxembourg. A total of about 200 servers, paper documents, numerous data carriers, mobile phones, and a large sum of cash (approximately $41 million equivalent) were confiscated. Investigators say that analyzing the evidence will take several years.
The operator's workplace in the bunker
During the raid, German authorities also seized at least two domains, including the domain of the Dutch company ZYZTM Research (zyztm[.]com) and cb3rob[.]org.
According to authorities, the aforementioned Dutchman purchased the former military bunker in 2013 — and transformed it into a large and well-protected data center, "to make it available to clients, according to our investigations, solely for illegal purposes," added Bauer.
In Germany, a host cannot be held liable for hosting illegal websites unless it is proven that they knew about and supported the illegal activity.
The former NATO facility was purchased from the geoinformation division of the Bundeswehr. Press releases at the time described it as a multi-story protective structure covering 5,500 m². It has two adjoining office buildings covering 4,300 m², and the total area of the buildings occupies 13 hectares of land.
Johannes Kunz, the head of the regional criminal police, added that the suspect "is linked to organized crime" and spent most of his time in the area, although he submitted documents for relocation to Singapore. Instead of emigrating, the data center owner presumably lived directly in the underground bunker.
Thirteen individuals aged between 20 and 59 are under investigation, including three German nationals and seven Dutch citizens, reported Bauer.
Seven were taken into custody because of the likelihood of their fleeing the country. They are suspected of participating in a criminal organization, tax offenses, as well as complicity in "hundreds of thousands of crimes" related to drugs, money laundering, and forged documents, as well as facilitating the distribution of child pornography. Authorities did not disclose any names.
Investigators described the data center as "bulletproof hosting," intended to conceal illegal activities from the authorities.
"I believe this is a tremendous success... that we were able to introduce police forces into a bunker complex that is protected at the highest military level," said Koontz. "We had to overcome not only physical or analog security but also breach the digital security of the data center."
Server in the data center
Among the illegal services allegedly hosted in the German data center were Cannabis Road, Flight Vamp 2.0, Orange Chemicals, and the second-largest drug-selling platform in the world, Wall Street Market.
For instance, the Cannabis Road platform registered 87 sellers of illegal drugs. Overall, the platform processed at least several thousand sales of cannabis products.
The Wall Street Market platform processed around 250,000 transactions related to illegal drug trafficking, with sales exceeding 41 million euros.
Flight Vamp is considered the largest illegal drug selling platform in Sweden. Swedish investigative authorities are searching for its operators. According to investigators, there were 600 sellers and about 10,000 buyers on the platform.
Synthetic drugs of various types were distributed across Europe through Orange Chemicals.
Presumably, all the listed shops will now have to move to another hosting in the dark web.
According to Bauer, a botnet attack on the German telecommunications company Deutsche Telekom at the end of 2016, which incapacitated about 1 million customer routers, was also conducted from servers in the Cyberbunker.
When the bunker was purchased in 2013, the buyer did not immediately identify themselves but said they were connected to CyberBunker, the operator of a similar Dutch data center located in another Cold War bunker. It is one of the oldest anonymous hosting services in the world, declaring independence of the so-called 'Republic of Cyberbunker' and willingness to host any site except for child pornography and anything related to terrorism. The website is currently unavailable. On is a proud statement from law enforcement: 'Server seized' (DIESE SERVER WURDE BESCHLAGNAHMT).
According to , Zyztm[.] com was originally registered in the name of Herman Johan Xennt from the Netherlands. The domain Cb3rob[.]org belonged to an organization that was hosted at CyberBunker and was registered under Sven Olaf Kamphuis, a self-proclaimed anarchist who was convicted a few years ago for his involvement in the aforementioned large-scale attack that briefly disrupted internet service in some areas.
The alleged owner and operator of the cyber bunkers is Herman Johan Xennt. Image: The Sunday World, July 26, 2015
59-year-old Xennt and Kamphuis worked together on a previous ‘bulletproof’ hosting project, CyberBunker, which was located inside a military bunker in the Netherlands, cybersecurity researcher Brian Krebs.
According to the company's director Guido Blaauw, he bought a 1,800 m² Dutch bunker from Xennt in 2011 for $700,000. It’s likely that after this, Xennt found a similar facility in Germany.
Guido Blaauw claims that after a fire in 2002, when a laboratory for ecstasy production was found among the servers in the Dutch bunker, no servers were actually hosted there: 'For 11 years they had told everyone about this ultra-secure bunker, but [their servers] were hosted in Amsterdam, and for 11 years they deceived all their clients.'
Batteries in the CyberBunker 2.0 data center
Nevertheless, the 'Republic of CyberBunker' was revived in 2013 on German territory, and entrepreneurs began offering many of the same services to the same clients as before: 'They are known for accepting criminals, pedophiles, phishers, everyone,' said Blaauw. 'That’s what they’ve been doing for years, and they’re known for it.'
CyberBunker was among . They have specific requirements, including a guarantee of client anonymity. Although CyberBunker is no longer in operation, other secure and anonymous hosts continue to function. They are typically physically located outside of U.S. jurisdiction, in offshore zones, and claim maximum privacy. Below are the services ranked according to positions in the anime enthusiasts' site:
- CyberBunker.com
Anonymous hosting in literature
Former profile picture from Facebook . Following his arrest in 2013, he spoke harshly to the authorities and
The story of the Cyberbunker Republic and other offshore hosting services somewhat resembles the fictional state of Kinakuta from the novel by Neal Stephenson. The novel is written in the genre of 'alternative history' and depicts how the development of humanity could have gone in a different direction with slight changes in initial parameters or as a result of chance.
The Sultanate of Kinakuta is a small island in the Sulu Sea, located in the strait between Borneo and the Philippine island of Palawan. During World War II, the Japanese used Kinakuta as a staging ground for attacks on the Dutch East Indies and the Philippines. There was a naval base and an airfield. After the war, Kinakuta regained independence, including financial autonomy, thanks to its oil reserves.
For some reason, the Sultan of Kinakuta decided to transform his state into an 'information paradise'. A law was passed concerning all telecommunications that pass through Kinakuta: 'I renounce all administrative authority over information flows within the country and across its borders,' the government declared. 'Under no circumstances will the government interfere with information flows or use its power to restrict these flows. This is the new law of Kinakuta.' After that, a virtual state called Crypta was created within Kinakuta:
Crypta. The 'real' capital of the Network. A paradise for hackers. A nightmare for corporations and banks. 'Enemy number one' of ALL world governments. In the network, there are no countries or nationalities. There are only FREE people ready to fight for their freedom!..
Neal Stephenson. 'Cryptonomicon'
In reflection on modern realities, offshore anonymous hosting services represent a semblance of Crypta — an independent platform that is not under the control of world governments. The novel even describes a data center in an artificial cave (the informational 'heart' of Crypta), which somewhat resembles the German Cyberbunker:
There is still a hole in the wall — apparently, several side passages branch off from this cave. Tom leads Randy there and almost immediately warns him by taking him by the elbow: ahead is a five-meter deep well, descending into a wooden ladder.
— What you just saw is the main switching room, — says Tom.
— When it's finished, it will be the largest router in the world. In the adjacent rooms, we will place computers and a storage system. Essentially — the largest RAID in the world with an enormous cache.
RAID stands for Redundant Array of Inexpensive Disks — a way to reliably and cheaply store large amounts of information. Exactly what is needed for an information paradise.
— We are still expanding the adjacent spaces, — continues Tom, — and we stumbled upon something there. I think you’ll find it interesting. — He turns and starts descending the ladder. — Did you know that the Japanese had a bomb shelter here during the war?
Randy has a photocopied map from a book in his pocket. He pulls it out and holds it up to the light bulb. Of course, high up in the mountains, it marks 'ENTRANCE TO BOMB SHELTER AND COMMAND CENTER.'
Neal Stephenson. 'Cryptonomicon'
Cryptocurrency occupies the same ecological niche as Switzerland does in the real financial world.
In reality, organizing such an 'information paradise' is not as simple as it is in literature. However, in some aspects, Stevenson’s alternate history is slowly coming true. For instance, today a significant portion of international communication infrastructure, including undersea cables, is owned not by governments, but by private corporations.
Only registered users can participate in the survey. , please.
Should anonymous hosting be banned?
Yes, it is a breeding ground for crime.
No, everyone has the right to anonymity.
A total of 1559 users voted. 316 users abstained.
Source: habr.com
