TI-2026-019L โ "The Cathedral" โ Church of Cyberology: The World's #1 Tor Exit Operator and Why Threat Feeds Get It Wrong
๐ Executive Summary
68 IPs from our threat intelligence database are attributed to the "Church of Cyberology" (AS215125, Netherlands). Automated scoring flagged them as suspicious โ high abuse scores, threat feed presence. Deeper investigation reveals: the world's #1 Tor exit node operator by bandwidth, a legitimate Dutch religious organization running 22.5% of all Tor exit capacity globally.
This dossier is a methodological correction โ proving that automated threat scores require human validation, and demonstrating intellectual honesty in our investigation process. Not every flagged IP is an enemy.
โช Identity: A Real Dutch Organization
| Field | Value |
|---|---|
| Full Name | Church of Cyberology (Cyberologykerk) |
| KvK (Chamber of Commerce) | 93306199 |
| RSIN (Dutch Tax ID) | 866348207 |
| Address | J.A. Rรคdeckerweg 25, 1871 CJ Schoorl, North Holland, NL |
| Founded | January 1, 2024 (preceded by "Nothing to Hide" since 2022) |
| ASN | AS215125 (registered April 10, 2024) |
| IPv4 | 192.42.116.0/24 (RIPE netname: "TOR-EXIT-AND-MORE") |
| Upstream | AS1101 (SURF/SURFnet โ Dutch national research network) |
| ANBI Status | Pending (Dutch tax-exempt charity application) |
The name combines "Cyber" + "-ology" and structurally parodies the Church of Scientology โ joining Kopimism and FSM in the tradition of tech-religion hybrids using religious freedom protections for ideological purposes. Their "church services" = Tor relay processes.
๐ Scale: Global Dominance
| Metric | Value | Global Rank |
|---|---|---|
| Total Bandwidth | 133.9 Gbit/s | ๐ฅ #1 |
| Tor Consensus Weight | 10.51% | ๐ฅ #1 |
| Exit Authority | 22.5% of ALL Tor exit traffic | ๐ฅ #1 |
| Active Exit Relays | 476 | ๐ฅ #1 |
| Total Relays | 634 | โ |
| Yearly Traffic | 246 petabytes | โ |
| Yearly DNS Queries | 143 billion | โ |
Each IP hosts 7-8 simultaneous relay processes (naming: NTH98R1โNTH98R8). Hardware: AMD EPYC 7742 (64C/128T, 256GB), multiple Ryzen 9 5950X servers, Juniper MX80 BGP router. All located in Netherlands. All open-source stack (FreeBSD/OpenBSD).
๐จ What Tor Actually Is โ The Full Picture
Before we proceed, every reader must understand what 246 petabytes of annual Tor exit traffic actually contains. This is not theoretical โ these are documented, prosecuted, and ongoing realities:
The Dark Side (documented by law enforcement worldwide):
- Child Sexual Abuse Material (CSAM): Tor hosts the largest distribution networks for child exploitation. Operations like "Playpen" (FBI, 2015 โ 215,000 users), "Welcome to Video" (DOJ, 2019 โ 337 arrests across 38 countries), "Dark Scandal" (Europol, 2022) were ALL Tor-hosted. Every exit relay processes some of this traffic. There is no opt-out.
- Darknet Drug Markets: Silk Road, AlphaBay, Hansa, Hydra ($5.2B revenue at seizure), and currently active markets like Kraken (ะัะฐะบะตะฝ) and Mega (ะะตะณะฐ) โ which, as documented in DOSSIER-019K, are hosted on w1n ltd infrastructure AND accessed primarily through Tor exits like these.
- Ransomware Operations: Nearly all ransomware negotiation portals (LockBit, BlackCat/ALPHV, Cl0p, Royal) use Tor .onion addresses. Victim payment pages, data leak sites, and C2 infrastructure all route through exit relays.
- Weapons & Explosives Trading: Documented marketplaces for firearms, ammunition, and explosive precursors. Multiple ATF/Europol operations have taken these down โ only for replacements to appear.
- Credential & Identity Fraud: Stolen database marketplaces (Genesis Market โ 80M+ credentials), fullz shops (complete identity packages for fraud), and the very credential brute-force attacks documented throughout our dossier series.
- Contract Violence: While most "hitman" services are scams, the infrastructure exists and is occasionally real โ documented cases include the "Besa Mafia" investigation where actual murder plots were facilitated.
- Financial Crime: Cryptocurrency mixing/tumbling services, money laundering infrastructure, sanctions evasion (North Korea, Iran), and pig-butchering scam operations.
- Terrorism: ISIS/ISIL propaganda distribution, recruitment, and operational communications have used Tor. Al-Qaeda's "Inspire" magazine was distributed via Tor.
The Light Side (equally real):
- Journalists: Reuters, AP, NYT, The Guardian all use Tor for source protection. SecureDrop (used by 70+ news organizations) requires Tor.
- Whistleblowers: Edward Snowden's communications, Panama Papers source, and countless corporate/government whistleblowers depend on Tor for survival โ literally.
- Dissidents & Activists: During the Arab Spring, Iranian protests (2022), Myanmar coup โ Tor was the only way to communicate without state surveillance leading to arrest, torture, or death.
- Domestic Abuse Survivors: People escaping abusive partners who monitor their internet activity use Tor to access help resources without detection.
- Researchers: Security researchers, academics studying censorship, and human rights organizations use Tor for safe research in hostile environments.
- Ordinary Privacy: People in surveillance states who simply want to read uncensored news, access blocked Wikipedia articles, or communicate freely.
The mathematical reality for this specific operator: With 22.5% of all Tor exit capacity, approximately one in every four Tor connections to the clearnet exits through Church of Cyberology infrastructure. This means statistically: one quarter of all Tor-facilitated CSAM distribution, one quarter of all darknet market transactions, one quarter of all ransomware negotiations โ AND one quarter of all journalist source protection, one quarter of all dissident communications, one quarter of all whistleblower safety.
There is no technical mechanism to accept one and reject the other. The accept *:* exit policy means exactly what it says: accept everything from everyone, no questions asked, no logs kept. This is a conscious architectural choice. The question is not whether Tor enables both good and evil โ it demonstrably does. The question is whether wrapping this choice in religious language adds moral clarity or deliberately obscures accountability.
๐ฐ Financial Reality: Volunteer Operation
2025 income: โฌ1,294. 2025 expenses: โฌ101. Running 133.9 Gbit/s of Tor bandwidth on โฌ1,294/year.
The infrastructure runs on donated hardware (~โฌ25,000 in-kind from "Nozel C.V." โ a Dutch partnership also behind server management tools). This is genuinely a small volunteer group operating privacy infrastructure at extraordinary scale.
๐งช Why They Appear in Our Database
| Our Observation | Explanation |
|---|---|
| 68 IPs flagged | Active exit/guard nodes automatically blocklisted by commercial feeds |
| Only 12 honeypot hits total | Almost NO direct attacks โ Tor traffic routing |
| 7 IPs with abuse score 100 | Highest-bandwidth exits with accept *:* policy |
| ALL 68 confirmed Tor exits | That's their stated purpose |
| 0 commands executed | No exploitation โ just routing |
| 0 successful logins | No credential attacks |
The fundamental truth: Tor exit nodes by definition appear as attack sources because they're the last hop. Threat feeds cannot distinguish "attacked through" from "attacked from." This creates permanent false positives for all exit operators.
๐ The OTX Pulse That Isn't What It Seems
OTX Pulse 69e96101 lists both w1n (185.246.128.133) and Cyberology (192.42.116.100) together โ appearing to link them. The reality: w1n attacks targets, Cyberology routes traffic through to those same targets. The pulse aggregates "IPs seen touching target X" without distinguishing intent.
w1n: 4,723 sessions, 55 rotating banners, specific IoT credentials.
Cyberology: 12 connections, standard behavior, zero exploitation.
Same threat feed. Fundamentally different actors.
โ ๏ธ Data Correction
Our database contains an ASN error: claims 192.42.116.0/24 belongs to AS208567. The correct ASN is AS215125. AS208567 is actually "GIZMO" โ registered to Boris Tassou in Brittany, France (completely unrelated). RIPE IRR confirms AS215125 unambiguously. This error likely stems from BGP database lag during the April 2024 AS registration.
๐ The Methodological Lesson
Not everything that appears malicious IS malicious. Church of Cyberology is: registered with Dutch authorities (KvK 93306199), financially transparent, technically transparent (public metrics), operating within Dutch law, and contributing 22.5% of global Tor exit capacity.
Compare with w1n ltd (DOSSIER-019K): "Dormant" filing, blank websites, Seychelles admin, darknet market hosting, 55 rotating SSH banners, 4,723 brute force sessions. Same database, same sources โ completely different conclusions when investigated properly.
The role of investigation is to distinguish signal from noise โ and to publicly correct the record when noise has been mistaken for signal. Intellectual honesty requires acknowledging when our automated systems flag legitimate privacy infrastructure alongside actual threats.
โ๏ธ The "Church" Question โ Philosophy vs. Legal Shield
We must be intellectually precise about what we're looking at. The word "Church" carries philosophical weight โ it implies moral authority, spiritual guidance, a community of shared values, and accountability to those values. It is not a neutral technical descriptor.
Running 476 Tor exit relays with accept *:* policies processing 246 petabytes of unmonitored traffic per year is an engineering decision, not a theological one. The "Church" wrapper was chosen specifically because Dutch law grants religious organizations enhanced protections against compelled disclosure, seizure, and regulatory scrutiny. This is a legal strategy disguised as philosophy.
The uncomfortable truth: that same 22.5% of Tor exit capacity that enables a journalist in Tehran to reach the free internet also routes child exploitation material, darknet market transactions, ransomware negotiations, and the very credential brute-force attacks documented in our other dossiers. These are not hypotheticals โ our SSH key analysis proves attackers actively route through these exits (key d4:98:c4:f3:... appears on 16 Cyberology exits AND on direct-attack IPs simultaneously).
The honest framing would be: "We believe privacy is a fundamental right. We accept that our infrastructure will be abused. We operate it anyway because we believe the benefit outweighs the harm." โ That is a defensible philosophical position.
What they actually chose: "We are a church. Our relay processes are church services. Religious freedom protects us." โ That is not philosophy. That is regulatory arbitrage wearing a cassock.
This distinction matters. The Tor network itself is morally neutral technology. Operating exits is a legitimate choice. But calling yourself a "church" to shield that choice from accountability transforms a brave act of civil disobedience into a bureaucratic loophole. It should be recognized for what it is: a privacy infrastructure project with a religious-legal wrapper โ not an actual church with actual moral philosophy guiding its decisions about what 246 petabytes of annual traffic carries through its doors.
๐ Sources
cyberology.nl (KvK, financials, infrastructure) ยท cyberology.church (mission) ยท nothingtohide.nl (operational arm) ยท metrics.nothingtohide.nl (Tor rankings) ยท RIPE RDAP AS215125/ORG-COC3-RIPE ยท stat.ripe.net IRR ยท Tor Onionoo API ยท ips.is_tor_exit (68/68 = 100%)