The scheme of the hopper. Figure: German police
CyberBunker.com is a pioneer of anonymous hosting, which began operations in 1998. The company placed the servers in one of the most unusual places: inside the former underground complex of NATO, built in 1955 as a protected bunker in case of a nuclear war.
Customers stood in line: all servers were usually busy, despite high prices: VPS cost from € 100 to € 200 per month, excluding installation fees, while VPS plans did not support Windows. But the hoster successfully ignored any DMCA complaints from the United States, accepted bitcoins and did not require any personal information from clients except an email address.
But now the "anonymous lawlessness" has come to an end. On the night of September 26, 2019, the soldiers of the German special forces and the police stormed the protected and guarded bunker . The seizure was carried out under the pretext of combating child pornography.
The assault was not easy, since the bunker is located in an inaccessible place in the forest, and the data center itself is located at several levels underground.
About 650 people took part in the operation, including law enforcement officers, rescue services, firefighters, medical personnel, drone operators, etc.
The entrance to the bunker can be seen next to the three buildings in the upper left of the photo. In the center is a communications tower. On the right is the second building of the data center. Photo taken from a police drone
Satellite map of the area
Police before entering the bunker after the start of the operation
The captured object is located near the town of Traben-Trarbach in the southwestern part of Germany (Rhineland-Palatinate, capital of Mainz). Four underground floors of the bunker go 25 meters deep.
Prosecutor Juergen Bauer told reporters that anonymous hosting has been investigated for several years. The operation was carefully prepared. Simultaneously with the storm, seven people were detained in the Traben-Trarbach restaurant and in the city of Schwalbach, near Frankfurt. The main suspect is the 59-year-old Dutchman. He was detained and three of his compatriots (49, 33 and 24 years old), one German (23 years old), a Bulgarian and the only woman (German, 52 years old).
Searches were also conducted in Poland, the Netherlands and Luxembourg. In total, about 200 servers, paper documents, numerous storage media, mobile phones and a large amount of cash (about $ 41 million in equivalent) were confiscated. Investigators say the analysis of the evidence will take several years.
Operator's workplace in the hopper
During the raid, German authorities also seized at least two domains, including the domain of the Dutch company ZYZTM Research (zyztm [.] Com) and cb3rob [.] Org.
According to authorities, the aforementioned Dutchman acquired a former military bunker in 2013 - and turned it into a large and well-protected data center “to make it accessible to customers, according to our investigations, exclusively for illegal purposes,” Bauer added.
In Germany, a hoster cannot be held accountable for hosting illegal websites unless it is proved that he knew and supported illegal activities.
The former NATO facility was purchased from the Bundeswehr geographic information unit. Press releases at the time described it as a multi-story defensive structure with an area of 5500 m². It has two adjacent office buildings with an area of 4300 m², the total area of buildings occupies 13 hectares of land.
Johannes Kunz, the head of the regional criminal police, added that the suspect was “involved in organized crime” and spent most of his time in the area, although he applied for relocation to Singapore. Instead of emigrating, the owner of the data center supposedly lived right in the underground bunker.
In total, thirteen people between the ages of 20 and 59 are under investigation, including three German citizens and seven Dutch citizens, Brower said.
Seven were taken into custody, because there is a possibility of their flight from the country. They are suspected of participating in a criminal organization, tax violations, as well as complicity in “hundreds of thousands of crimes” related to drugs, money laundering and fake documents, as well as aiding the dissemination of child pornography. The authorities did not give a single name.
Investigators described the data center as “bulletproof hosting,” designed to hide illegal activity from the eyes of authorities.
“I think this is a huge success ... that we were able to bring police forces into the bunker complex, which is protected at the highest military level,” said Kunz. “We had to overcome not only real or analog protection, but also break into the digital protection of the data center.”
Server in the data center
Among the illicit services allegedly hosted in a German data center were Cannabis Road, Flight Vamp 2.0, Orange Chemicals, and the second largest drug market in the world, Wall Street Market.
For example, at the Cannabis Road site, 87 illegal drug dealers were registered. Overall, the platform handled at least several thousand sales of cannabis products.
The Wall Street Market platform processed about 250,000 drug trafficking transactions with sales of more than 41 million euros.
Flight Vamp is considered Sweden’s largest drug trafficking platform. The search for its operators is conducted by the Swedish investigative authorities. According to the investigation, 600 sellers and about 10,000 buyers were noted there.
Through Orange Chemicals, various types of synthetic drugs were distributed throughout Europe.
Probably, now all of the listed stores will have to move to another hosting on the darknet.
According to Bauer, a botnet attack on the German telecommunications company Deutsche Telekom at the end of 2016, which disabled about 1 million customer routers, was also conducted from servers in the Cyberbunker.
When the bunker was bought in 2013, the buyer did not immediately identify himself, but said that he was associated with CyberBunker, the operator of a similar Dutch data center located in another bunker during the Cold War. This is one of the oldest anonymous hosting in the world. He declared the independence of the so-called “Republic of Cyberbunker” and his willingness to post any site except child pornography and everything related to terrorism. The site is currently unavailable. On the main page there is a proud inscription from law enforcement agencies: “The server is confiscated” (DIESE SERVER WURDE BESCHLAGNAHMT).
According to whois historical records , Zyztm [.] Com was originally registered in the name of Herman Johan Xennt from the Netherlands. The Cb3rob [.] Org domain was owned by an organization hosted by CyberBunker and registered with Sven Olaf Campheis, a self-proclaimed anarchist who was convicted several years ago for participating in the aforementioned large-scale attack that briefly disrupted the Internet in some places.
Estimated owner and operator of cyberbunkers Herman Johan Xennt. Image: The Sunday World, July 26, 2015
Xennt, Campeis, 59, worked together on a previous project of the “bulletproof” hosting CyberBunker, which was located inside a military bunker in the Netherlands, writes information security researcher Brian Krebs.
According to Guido Blaauw, director of Disaster-Proof Solutions , he bought a 1800 m² Dutch bunker from Xennt in 2011 for $ 700 thousand. Probably, after that Xennt found a similar property in Germany.
Guido Blaau claims that after the fire of 2002, when an ecstasy laboratory was found among the servers in the Dutch bunker, not a single server was located there: “For 11 years they told everyone about this ultra-safe bunker, but [their servers] were located in Amsterdam, and for 11 years they deceived all their customers. "
Batteries in the CyberBunker 2.0 data center
Nevertheless, the “Republic of Cyberbunker” was revived in 2013 in German territory, and entrepreneurs began to offer many of the same services to the same customers as before: “They are known for accepting scammers, pedophiles, phishers, everyone, - said Blaau. “This is what they have been doing for many years, and they are known for it.”
CyberBunker was one of the top hosters for anime . They are subject to specific requirements, including a guarantee of customer anonymity. Although the Cyberbunker is no longer there, other secure and anonymous hosters continue to work. They are usually physically located outside of US jurisdiction, in offshore zones, and declare maximum privacy. Below the services are located by position in the rating of the site of anime lovers:
- Anonymously.io
- Aruba.it
- ShinJiru.com
- CCIHosting.com
- HostingFlame.org
-
CyberBunker.com
- DarazHost.com
- SecureHost.com
Anonymous hosting in literature
Former Sven Olaf Campheis Facebook profile photo . After his arrest in 2013, he spoke roughly with the authorities and declared the independence of the Republic of Cyberbunker
The story of the Republic of Cyberbunker and other offshore hosting services is somewhat reminiscent of the fictional state of Kinakut from Neil Stevenson’s novel Cryptonomicon . The novel is written in the genre of “alternative history” and shows in what direction the development of mankind could go with a small change in input parameters or as a result of chance.
The Kinakuta Sultanate is a small island in the corner of the Sulu Sea, in the middle of the strait between Kalimantan and the Philippine island called Palawan. During World War II, the Japanese used Kinakuta as a bridgehead to attack the Dutch East Indies and Philippines. There was a naval base and an airfield. After the war, Kinakuta regained its independence, including financial, thanks to oil reserves.
For some reason, the Sultan of Kinakuti decided to make an “information paradise” out of his state. A law was passed that applies to all telecommunications that go through the territory of Kinakuta: “I give up all administrative authority over information flows within the country and across its borders,” the ruler announced. - Under no circumstances will the government poke its nose into information flows or use its power to limit these flows. This is the new law of Kinakuta. ” After that, the virtual state of Crypt was created on the territory of Kinakuta:
Crypt. The "real" capital of the Network. Hacker Paradise. The nightmare of corporations and banks. "Enemy number one" of ALL world governments. There are no countries or nationalities on the network. There are only FREE people who are ready to fight for their freedom! ..
Neal Stevenson. Cryptonomicon
Reflecting on modern realities, offshore anonymous hosting is a kind of Crypta - an independent platform that is not controlled by world governments. The novel even describes a data center in an artificial cave (the informational “heart” of Crypta), which is a bit like the German Cyberbunker:
There is still a hole in the wall - apparently, several lateral branches branch from this cave. Tom leads Randy there and almost immediately cautiously takes her elbow: in front of a five-meter well, a wooden staircase goes down.
“What you just saw is the main switch room,” says Tom.
- When it is finished, it will be the largest router in the world. In the next room we will place computers and a storage system. Essentially the world's largest RAID with a large, large cache.
RAID means a redundant array of low-cost disks - a way to reliably and cheaply store a large amount of information. Just what you need for an information paradise.
“We are still expanding the neighboring rooms,” continues Tom, “and stumbled upon something there.” I think you will be interested. - He turns and starts down the stairs. “Do you know that the Japanese had a bomb shelter here during the war?”
Randy has in his pocket an excerpted card from a book. He takes it out and brings it to the light bulb. Of course, high in the mountains marked "ENTRANCE IN THE BOMBUSHELD AND THE TEAM ITEM."
Neal Stevenson. Cryptonomicon
Crypta has occupied the same ecological niche as Switzerland occupies in the real financial world.
In reality, organizing such an “information paradise” is not as simple as in literature. However, in some aspects, Stevenson's alternative story is beginning to come true. For example, today a significant part of the international communications infrastructure, including submarine cables, is no longer owned by governments, but by private corporations.