1337 Services GmbH (HRB 164175, Hamburg). Operating brand: rdp.sh. ASN: AS210558. RIPE org: ORG-SG394-RIPE.

But "ownership" is layered. The RIPE database shows three maintainers touching the same space: lir-de-1337services-1-MNT (the company), SERVPERSO-MNT (Belgian entity, created 6 months before 1337's RIPE registration), and PREFIXBROKER-MNT (Dutch IP brokerage, maintains 23 of 32 tracked IPs). Three entities, three countries, one network.

A German individual at Am Hang 55, 85737 Ismaning (Munich suburb). Operates the RIPE LIR "de.lain" (AS211507). Phone: +4915118462887. Sells ASN sponsoring at €71/year, accepts Monero. Listed on Monerica.com (Monero-accepting services directory).

His domain aluy.net shares the IP 185.102.217.65 with sy.st — a Tor relay operator domain. His fingerprint appears in Tor relay ContactInfo fields via relays.0x7c0.com: "Julian Achter. 1337 Services GmbH. Linux."

The question nobody asks: Is Achter the sole beneficial owner, or a front for others? A 25-year-old running a Hamburg GmbH that controls 50 IPv4 prefixes across 7 upstreams is not impossible — but it's unusual. Who provided the initial capital for IP space acquisition?

Place du marché 31, 2A, 4651 Battice, Wallonia, Belgium. A residential address in a small town (pop. ~5,000) in the French-speaking Liège province. RIPE handle SSN105-RIPE. Created 2021-04-16.

The name suggests "Services Personnels" or "Server Personnel." The address type (apartment 2A above a market square) suggests an individual, not a company. The operator remains unidentified by name in RIPE records.

The question: A Belgian entity predates the German company by six months, holds co-maintainer rights on IP space that becomes the most abused block on the network, and the phishing pages it hosts target French-speaking bank customers. Is SERVPERSO a customer of 1337, a partner of 1337, or the original entity that 1337 was built to commercialize?

De Hoefsmid 11, Heiloo, Netherlands. Operated by Wessel Sandkuijl. Dutch KvK-registered. PREFIXBROKER-MNT maintains 23 of 32 tracked high-risk IPs and controls the abuse handling RIPE object SGAH10-RIPE.

The question: If a "broker" handles your abuse contacts, who actually reads the abuse reports? The answer: nobody who has authority to act. This is the design. The broker handles RIPE compliance. The provider ignores abuse. The customer operates undisturbed.

The question: The legitimate operators (Bronk, allium.top) have public identities and transparent Tor relay information. The criminals are anonymous. The provider knows both, treats both identically, and separates them by nothing — often co-located on the same /24. Is this negligence, or is the legitimate traffic cover for the criminal traffic?

Not VPS hosting. Not RDP access. Not Tor relay capacity. The product is impunity.

rdp.sh sells the guarantee that abuse reports will be ignored. That Spamhaus listings won't trigger account termination. That law enforcement requests will traverse DE→BE→NL→FR jurisdiction chains before reaching the customer. That payment by Monero means no financial trail. That PTR records advertising "powered.by.rdp.sh" declare the provider's identity but nothing about the customer.

DROP = "Don't Route Or Peer." The most severe sanction in internet infrastructure. It means:

• Every major ISP, enterprise, and mail system implementing DROP refuses all packets from 45.154.98.0/24
• The prefix has been reviewed by Spamhaus analysts and determined to be irredeemably malicious
• No legitimate service can operate on this range and expect to reach most of the internet

The question nobody asks: If the /24 is DROP-listed, how does the phishing still work? Answer: phishing links are accessed directly by victims clicking SMS/email links. The connection goes victim→server (outbound from victim's ISP, which may not implement DROP on outbound). The phishing page doesn't need to reach mail servers — the lure is sent via separate clean infrastructure. DROP kills inbound reputation but not targeted credential harvesting.

Officially: none. Different customers, different purposes. But structurally:

• Both benefit from the same abuse-tolerant policy
• Tor traffic provides volume cover (high bandwidth looks normal to upstreams)
• The provider can point to "legitimate privacy services" when questioned
• Law enforcement investigating phishing encounters Tor exit contamination in their traffic analysis

The Tor traffic isn't enabling the phishing. It's obfuscating the investigation of the phishing.

The question: StarkRDP seized January 2025. CrazyRDP seized November 2025. Both are nearly identical to rdp.sh. Why is rdp.sh still operating? What differentiates it from the seized services?

Within 9 months of the /24 allocation (March 2022 → December 2022 first phishing). The Spamhaus DROP listing date is not publicly retrievable, but the SBL687510 reference number is in the high-600K range, suggesting listing sometime in 2023-2024. The network was designed to be abused from inception — or the provider simply didn't care once abuse began.

The question: A French victim reports to French police. French police identify the IP. The IP is Dutch-hosted, Belgian-maintained, German-owned, with a Caribbean corporate veil. Which country leads? In practice: none of them do. The jurisdictional spread is not a bug. It is the architecture.

Because it's profitable. Because RIPE NCC has no mandate to judge how IP space is used — only that paperwork is correct. Because BGP peers rarely decommission routes based on abuse. Because Spamhaus DROP is voluntary. Because inter-EU law enforcement cooperation for "mere" hosting is glacially slow.

And because there's genuine demand for abuse-tolerant hosting from legitimate users: Tor operators, whistleblowers, journalists in authoritarian countries, security researchers. The existence of a legitimate customer base provides moral and legal cover for serving criminals simultaneously.

Germany has strong privacy protections (Bundesdatenschutzgesetz). Hamburg's data protection authority (HmbBfDI) is known for being one of the strictest in the EU — paradoxically, this means hosting companies in Hamburg can use privacy law to resist disclosure requests about their customers. The regulatory framework designed to protect citizens is wielded to shield criminal infrastructure operators.

Additionally: Hamburg is a major DE-CIX interconnection point. Excellent connectivity. And the commercial register (Handelsregister) requires minimal verification — a GmbH can be established for €25,000 share capital with no proof of legitimate business purpose.

They have — but not against this entity. Operation Talent (Jan 2025) seized StarkRDP. Dutch police seized CrazyRDP (Nov 2025). Both were similar services. The pattern suggests:

1. Investigations take 2-3 years from identification to seizure
2. rdp.sh may be under investigation now but pre-seizure
3. Or: rdp.sh's legitimate Tor customer base creates legal complexity that pure-criminal services lacked
4. Or: the 4-country jurisdiction split genuinely prevents action

The uncomfortable alternative: rdp.sh is known, documented, and tolerated because its Tor exit capacity serves intelligence interests. A network that carries 3% of Tor exits is also a network where signals intelligence agencies can deploy collection infrastructure. Killing it would reduce collection surface.

rdp.sh accepts: Bitcoin, Ethereum, Litecoin, Monero, and 16+ other cryptocurrencies via CoinGate/BTCPay. Also PayPal, credit cards.

The cheapest VPS is €3.75/month. A /24 (256 IPs) fully populated would generate €960/month minimum. The network has 50 announced prefixes — potentially thousands of customer IPs.

The question: Where does the initial IP space acquisition money come from? IPv4 /24 blocks sell for $12,000-$25,000 each on the secondary market. 50 prefixes represents $600K-$1.25M in IP space value. Did this capital come from legitimate investment, prior criminal proceeds, or was the space acquired cheaply because it was already burned (Spamhaus-listed ranges trade at 50-70% discount)?

The reporting chain:

1. Victim reports to French police → identifies IP → discovers German company
2. French police → European Investigation Order to Germany → 6-12 month wait
3. Or: abuse report to abuse@as210558.net → SGAH10-RIPE (Prefix Broker) → no action
4. Or: report to RIPE NCC → "we don't police content, only registration data"
5. Or: report to Dutch hosting (Hybula) → "we provide colocation, not content services"
6. Or: report to Spamhaus → already DROP-listed → what more can they do?

Every entity in the chain has a technically correct reason to do nothing. The architecture ensures no single point of accountability.

2cb.su runs a Monero node and 49+ Tor relays. Their stated mission: "privacy-focused services." But they chose to operate on a network known to host phishing, spam, and malware. A privacy idealist would avoid contaminated infrastructure. A professional who doesn't care about contamination — or who benefits from it — would not.

The 2cb.su operator is the only documented actor operating simultaneously on 1337 Services (AS210558), LAIN (AS211507), AND SERVPERSO-maintained space. They are the literal connecting thread of the entire Anonymity Factory.

It means the word "privacy" has been weaponized. Legitimate privacy serves individuals against mass surveillance. What 45.154.98.0/24 provides is not privacy — it's operational immunity. The distinction matters: privacy protects the powerless from the powerful. Immunity protects the criminal from the victim.

The Tor Project cannot ban relays based on their hosting provider. Doing so would create a censorship mechanism. They warn operators ("These hosts already have many Tor nodes") but cannot enforce diversity requirements. The warning exists since at least 2024. No operator has left the network because of it.

The deeper question: ~3% of Tor exit traffic flowing through a single provider's infrastructure creates a concentration risk that the Tor Project knows about, documents, and cannot prevent. If that 3% were compromised by a state actor (via legal order to 1337 Services GmbH in Hamburg), what fraction of Tor's anonymity guarantee evaporates?

SERVPERSO-MNT was created April 16, 2021. 1337 Services GmbH registered with RIPE on October 27, 2021. Six months gap. During those six months, who was SERVPERSO working with? Did SERVPERSO create 1337 as a commercial front? Did 1337 acquire SERVPERSO's infrastructure? Or did a third party create both, sequentially, as layers?

The Belgian address (Battice, Liège) is in Wallonia — French-speaking Belgium. The phishing targets French banks. The domain names use French terms. SERVPERSO may be the operational brain, with 1337 Services providing only the German corporate legitimacy.

Officially: IPv4 brokerage. Helps companies acquire IP space. But maintaining 23 of 32 tracked malicious IPs and controlling the abuse contact object goes far beyond brokerage. Prefix Broker is the administrative shield — the entity that handles RIPE compliance paperwork so that neither 1337 nor SERVPERSO need to interact with the registration system directly.

Wessel Sandkuijl (Prefix Broker's operator) appears in multiple RIPE contexts. Is this a legitimate broker who got one bad client? Or a purpose-built intermediary for abuse-tolerant networks?