
CyberBunker was an
Internet service provider
An Internet service provider (ISP) is an organization that provides services for accessing, using, or participating in the Internet. ISPs can be organized in various forms, such as commercial, community-owned, non-profit, or otherwise privatel ...
located in the
Netherlands
)
, anthem = ( en, "William of Nassau")
, image_map =
, map_caption =
, subdivision_type = Sovereign state
, subdivision_name = Kingdom of the Netherlands
, established_title = Before independence
, established_date = Spanish Netherl ...
and
Germany
Germany, officially the Federal Republic of Germany (FRG),, is a country in Central Europe. It is the most populous member state of the European Union. Germany lies between the Baltic and North Sea to the north and the Alps to the sou ...
that, according to its website, "hosted services to any website except child pornography and anything related to terrorism". The company first operated in a former
NATO
The North Atlantic Treaty Organization (NATO, ; french: Organisation du traité de l'Atlantique nord, ), also called the North Atlantic Alliance, is an intergovernmental military alliance between 30 member states – 28 European and two No ...
bunker
A bunker is a defensive military fortification designed to protect people and valued materials from falling bombs, artillery, or other attacks. Bunkers are almost always underground, in contrast to blockhouses which are mostly above ground. T ...
in
Zeeland
, nl, Ik worstel en kom boven("I struggle and emerge")
, anthem = "Zeeuws volkslied"("Zeelandic Anthem")
, image_map = Zeeland in the Netherlands.svg
, map_alt =
, m ...
, and later in another former NATO bunker in
Traben-Trarbach
Traben-Trarbach on the Middle Moselle is a town in the Bernkastel-Wittlich district in Rhineland-Palatinate, Germany. It is the seat of the like-named ''Verbandsgemeinde'' and a state-recognized climatic spa (''Luftkurort''). The city lies in the ...
, Germany.
CyberBunker served as a web host for
The Pirate Bay
The Pirate Bay (sometimes abbreviated as TPB) is an online index of digital content of entertainment media and software. Founded in 2003 by Swedish think tank Piratbyrån, The Pirate Bay allows visitors to search, download, and contribute m ...
and as one of the many
WikiLeaks
WikiLeaks () is an international non-profit organisation that published news leaks and classified media provided by anonymous sources. Julian Assange, an Australian Internet activist, is generally described as its founder and director and ...
mirrors.
CyberBunker has also been accused of being a host for
spammers
This is a list of individuals and organizations noteworthy for engaging in bulk electronic spamming, either on their own behalf or on behalf of others. It is not a list of all spammers, only those whose actions have attracted substantial independen ...
,
botnet
A botnet is a group of Internet-connected devices, each of which runs one or more bots. Botnets can be used to perform Distributed Denial-of-Service (DDoS) attacks, steal data, send spam, and allow the attacker to access the device and its co ...
command-and-control servers,
malware
Malware (a portmanteau for ''malicious software'') is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, de ...
and online scams. The company has also been involved in
Border Gateway Protocol
Border Gateway Protocol (BGP) is a standardized exterior gateway protocol designed to exchange routing and reachability information among autonomous systems (AS) on the Internet. BGP is classified as a path-vector routing protocol, and it mak ...
hijacks of IP addresses used by
Spamhaus and the
United States Department of Defense
The United States Department of Defense (DoD, USDOD or DOD) is an executive branch department of the federal government charged with coordinating and supervising all agencies and functions of the government directly related to national secur ...
. The Spamhaus hijack was part of an exceptionally large
distributed denial of service attack
In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connec ...
launched against them in March 2013. Because of the size of this attack it received considerable
mainstream media
In journalism, mainstream media (MSM) is a term and abbreviation used to refer collectively to the various large mass news media that influence many people and both reflect and shape prevailing currents of thought. Chomsky, Noam, ''"What makes ma ...
attention.
The company is named for its initial location in a former
Cold War bunker. As of 2013, CyberBunker listed its address as the bunker, but the location of CyberBunker's servers was unclear.
In September 2019, the
German police
Law enforcement in Germany is constitutionally vested solely with the states, which is one of the main features of the German political system.
Policing has always been a responsibility of the German states even after 1871 when the country was ...
stormed and shut down the company's operations in its bunker in
Traben-Trarbach
Traben-Trarbach on the Middle Moselle is a town in the Bernkastel-Wittlich district in Rhineland-Palatinate, Germany. It is the seat of the like-named ''Verbandsgemeinde'' and a state-recognized climatic spa (''Luftkurort''). The city lies in the ...
. Seven suspects were arrested.
History
Dutch bunker (CB-1)
In 1995, Herman-Johan Xennt bought a 20,000 square foot bunker just outside the small town of
Kloetinge
Kloetinge is a village in the Dutch province of Zeeland. It is located in the municipality of Goes, on the eastern side of the city.
History
The village was first mentioned in 1216 as Clotinge, and means "settlement with a height". Kloetinge ...
in the south of the
Netherlands
)
, anthem = ( en, "William of Nassau")
, image_map =
, map_caption =
, subdivision_type = Sovereign state
, subdivision_name = Kingdom of the Netherlands
, established_title = Before independence
, established_date = Spanish Netherl ...
, which had been formerly used by the NATO,
and was built in 1955. The bunker, originally used as a wartime Provincial Military Command Center ( nl, Provinciaal Militair Commando) of the
Dutch military
The Netherlands Armed Forces ( nl, Nederlandse krijgsmacht) are the military services of the Kingdom of the Netherlands. The core of the armed forces consists of the four service branches: the Royal Netherlands Navy (), the Royal Netherlands A ...
, was built to withstand a
nuclear attack
Nuclear warfare, also known as atomic warfare, is a theoretical military conflict or prepared political strategy that deploys nuclear weaponry. Nuclear weapons are weapons of mass destruction; in contrast to conventional warfare, nuclear wa ...
. The bunker was de-assessed by the Dutch military in 1994.
With collaborators, Xennt formed the CyberBunker company within the bunker, to offer "bulletproof hosting" of web sites.
The company's customers during the 1990s consisted largely of pornography web sites.
Its policy was to accept any web site except those related to child pornography and terrorism.
In 2002, a fire broke out in the Dutch bunker. After the fire was put out, it was discovered that besides Internet hosting services, an
MDMA
3,4-Methylenedioxymethamphetamine (MDMA), commonly seen in tablet form (ecstasy) and crystal form (molly or mandy), is a potent empathogen–entactogen with stimulant properties primarily used for recreational purposes. The desired ...
laboratory was in operation.
Three of the four men charged with the operation of the lab were convicted to three-year prison sentences; the fourth was acquitted due to a lack of evidence. Following the fire the local town denied the company a business license, resulting in the CyberBunker servers being moved to above-ground locations, including Amsterdam.
In its publicity, the company continued to claim that it operated from the bunker.
On 29 March 2013, the secure data storage company BunkerInfra issued a press release stating they had been the owners of the Kloetinge bunker since 2010, and that any claims made by CyberBunker regarding their continued usage of the complex were false, and that they have not been operating from the bunker since the fire in 2002. ''Businessweek'' reported them as stating that the bunker was "full of junk" when they acquired it, and quoted Guido Blaauw, their general manager, as stating that the CyberBunker publicity material was "all
''Photoshop''".
The Pirate Bay
In October 2009
BitTorrent tracker
A BitTorrent tracker is a special type of server that assists in the communication between peers using the BitTorrent protocol.
In peer-to-peer file sharing, a software client on an end-user PC requests a file, and portions of the requested f ...
The Pirate Bay
The Pirate Bay (sometimes abbreviated as TPB) is an online index of digital content of entertainment media and software. Founded in 2003 by Swedish think tank Piratbyrån, The Pirate Bay allows visitors to search, download, and contribute m ...
, which had been subjected to legal action by various anti-
piracy
Piracy is an act of robbery or criminal violence by ship or boat-borne attackers upon another ship or a coastal area, typically with the goal of stealing cargo and other valuable goods. Those who conduct acts of piracy are called pirates, v ...
groups including
Dutch
Dutch commonly refers to:
* Something of, from, or related to the Netherlands
* Dutch people ()
* Dutch language ()
Dutch may also refer to:
Places
* Dutch, West Virginia, a community in the United States
* Pennsylvania Dutch Country
People E ...
copyright organisation
BREIN
The stichting BREIN (Bescherming Rechten Entertainment Industrie Nederland) translates roughly as ''association for the Protection of the Rights of the Entertainment Industry of the Netherlands''. BREIN ( en, Brain or Brains) is an association i ...
, moved away from
Sweden to CyberBunker. In 2010 the Hamburg district court ruled that CyberBunker, operating in Germany as ''CB3Rob Ltd & Co KG'', was no longer allowed to host The Pirate Bay, being subject to a
€
The euro sign () is the currency sign used for the euro, the official currency of the eurozone and unilaterally adopted by Kosovo and Montenegro. The design was presented to the public by the European Commission on 12 December 1996. It consists o ...
250,000 fine or up to 2 years imprisonment for each infringement.
Spamhaus
In October 2011,
Spamhaus identified CyberBunker as providing hosting for spammers and contacted their
upstream provider, A2B, asking that service be cancelled. A2B initially refused, blocking only a single
IP address
An Internet Protocol address (IP address) is a numerical label such as that is connected to a computer network that uses the Internet Protocol for communication.. Updated by . An IP address serves two main functions: network interface ident ...
linked to spamming. Spamhaus responded by blacklisting all of A2B address space. A2B capitulated, dropping CyberBunker, but then filed complaints with the Dutch police against Spamhaus for extortion.
In March 2013, Spamhaus added CyberBunker to its blacklist. Shortly afterwards a
distributed denial of service
In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host conn ...
(DDoS) attack of previously unreported scale (peaking at 300
Gbit/s
In telecommunications, data-transfer rate is the average number of bits ( bitrate), characters or symbols ( baudrate), or data blocks per unit time passing through a communication link in a data-transmission system. Common data rate units are mul ...
; an average large-scale attack is often around 50 Gbit/s, while the largest known previously publicly reported attack was 100 Gbit/s) was launched against Spamhaus email and web servers using a
Domain Name System
The Domain Name System (DNS) is a hierarchical and distributed naming system for computers, services, and other resources in the Internet or other Internet Protocol (IP) networks. It associates various information with domain names assigned ...
(DNS) amplification attack;
the attack had lasted for over a week. Steve Linford, chief executive for Spamhaus, said that they had withstood the attack. Other companies, such as
Google
Google LLC () is an American Multinational corporation, multinational technology company focusing on Search Engine, search engine technology, online advertising, cloud computing, software, computer software, quantum computing, e-commerce, ar ...
, had made their resources available to help absorb the traffic.
[ The attack was being investigated by five different national cyber-police-forces around the world. Spamhaus alleged that Cyberbunker, in cooperation with "criminal gangs" from ]Eastern Europe
Eastern Europe is a subregion of the European continent. As a largely ambiguous term, it has a wide range of geopolitical, geographical, ethnic, cultural, and socio-economic connotations. The vast majority of the region is covered by Russia, wh ...
and Russia
Russia (, , ), or the Russian Federation, is a transcontinental country spanning Eastern Europe and Northern Asia. It is the largest country in the world, with its internationally recognised territory covering , and encompassing one-eigh ...
were behind the attack; Cyberbunker did not respond to the BBC #REDIRECT BBC
Here i going to introduce about the best teacher of my life b BALAJI sir. He is the precious gift that I got befor 2yrs . How has helped and thought all the concept and made my success in the 10th board exam. ...
's request for comment on the allegation.[
]Cloudflare
Cloudflare, Inc. is an American content delivery network and DDoS mitigation company, founded in 2009. It primarily acts as a reverse proxy between a website's visitor and the Cloudflare customer's hosting provider. Its headquarters are in San ...
, an Internet security firm located in San Francisco
San Francisco (; Spanish language, Spanish for "Francis of Assisi, Saint Francis"), officially the City and County of San Francisco, is the commercial, financial, and cultural center of Northern California. The city proper is the List of Ca ...
, California
California is a state in the Western United States, located along the Pacific Coast. With nearly 39.2million residents across a total area of approximately , it is the most populous U.S. state and the 3rd largest by area. It is also the ...
assisting Spamhaus in combating the DoS attack was also targeted. On 28 March 2013, CyberBunker's website went offline for a short period of time, possibly becoming a victim of a DDoS attack themselves.
On 25 April 2013 Sven Olaf Kamphuis, a vocal spokesman for CyberBunker, was arrested at the request of Dutch authorities near Barcelona
Barcelona ( , , ) is a city on the coast of northeastern Spain. It is the capital and largest city of the autonomous community of Catalonia, as well as the second most populous municipality of Spain. With a population of 1.6 million within ...
by Spanish Police
Spanish might refer to:
* Items from or related to Spain:
**Spaniards are a nation and ethnic group indigenous to Spain
**Spanish language, spoken in Spain and many Latin American countries
**Spanish cuisine
Other places
* Spanish, Ontario, Cana ...
after collaboration through Eurojust
Eurojust is an agency of the European Union (EU) dealing with judicial co-operation in criminal matters among agencies of the member states. It is seated in The Hague, Netherlands. Established in 2002, it was created to improve handling of ser ...
. An anonymous press release uploaded on Pastebin.com the following day demanding the release of Kamphuis threatened with more large-scale attacks should he remain in custody. The Spanish authorities reported that Kamphuis operated from a well-equipped bunker and used a van as a mobile computing office. No further information on this bunker was provided. In September 2013 it was revealed that a second arrest had been made in April in relation to the Spamhaus attack, the suspect being a 16-year-old from London
London is the capital and List of urban areas in the United Kingdom, largest city of England and the United Kingdom, with a population of just under 9 million. It stands on the River Thames in south-east England at the head of a estuary dow ...
. Kamphuis was held for 55 days awaiting extradition to the Netherlands and was later found guilty and sentenced to 240 days in prison. His sentence was suspended, with credit for the 55 days served.
Traben-Trarbach bunker (CB-3)
In 2013 the company purchased its second bunker, in Traben-Trarbach, Germany. As early as 2015, German cybercrime investigators received a warrant to investigate the company by tapping its Internet traffic in and out of the bunker. During this time, the company's clients are claimed to have included the dark web
The dark web is the World Wide Web content that exists on '' darknets'': overlay networks that use the Internet but require specific software, configurations, or authorization to access. Through the dark web, private computer networks can commu ...
marketplaces Wall Street Market
A darknet market is a commercial website on the dark web that operates via darknets such as Tor or I2P. They function primarily as black markets, selling or brokering transactions involving drugs, cyber-arms, weapons, counterfeit currency, st ...
, Cannabis Road and Flugsvamp, as well Fraudsters, a forum for exchanging illegal drugs, counterfeit money and fake identification. George Mitchell approached Xennt about running an encrypted phone business.
In September 2019, 600 German police raided the bunker. Seven people were arrested in the raid. Police later said that the bunker was the location from which a late 2016 denial of service attack on Deutsche Telekom
Deutsche Telekom AG (; short form often just Telekom, DTAG or DT; stylised as ·T·) is a German telecommunications company that is headquartered in Bonn and is the largest telecommunications provider in Europe by revenue. Deutsche Telekom w ...
was launched.
References
{{coord, 51.50216, 3.90718, display=title
Government buildings completed in 1955
Denial-of-service attacks
Bunkers in Europe
The Pirate Bay
Data centers