CyberBunker


CyberBunker was an Internet service provider located in Holland and Germany that, according to its website, hosted "services to any Web site "except child pornography and anything related to terrorism". The company operated first in a former NATO Bunker in southern Holland, and later in another former NATO bunker in Traben-Trarbach, Germany.
Cyberbunker served as a web host for The Pirate Bay and as one of the many WikiLeaks mirrors. CyberBunker has also been accused of being a host for spammers, botnet command-and-control servers, malware and online scams. The company has also been involved in Border Gateway Protocol hijacks of IP addresses used by Spamhaus and the United States Department of Defense. The Spamhaus hijack was part of an exceptionally large distributed denial of service attack launched against them in March 2013. Because of the size of this attack it received considerable mainstream media attention.
The company is named for the its initial location in a former Cold War bunker. CyberBunker lists its address as the bunker, but the location of CyberBunker's servers is unclear.
In September 2019, the German police stormed and shut down the company's operations in its Traben-Trarbach bunker. Seven suspects were arrested.

History

Holland bunker

In 1995, Herman-Johan Verwoert-Derksen bought a 20,000 square foot bunker just outside the small town of Kloetinge in the south of the Netherlands, which had been formerly used by NATO. built in 1955. The bunker, originally used as a wartime Provincial Military Command Center of the Dutch military, was built to withstand a nuclear attack. The bunker was de-assesed by the Dutch military in 1994.
With collaborators, Verwoert-Derksen formed the Cyberbunker company within the bunker, to offer "bulletproof hosting" of web sites. The company's customers during the 1990s consisted largely of pornography web sites. Its policy was to accept any web site except those related to child pornography and terrorism.
In 2002, a fire broke out in the Dutch Bunker. After the fire was put out, it was discovered that besides Internet hosting services, an MDMA laboratory was in operation. Three of the four men charged with the operation of the lab were convicted to three-year prison sentences; the fourth was acquitted due to a lack of evidence. Following the fire the local town denied the company a business license, resulting in the Cyberbunker servers being servers to above-ground locations, including Amsterdam.
In its publicity, the company continued to claim that it operated from the bunker. On 29 March 2013, the secure data storage company BunkerInfra issued a press release stating they had been the owners of the Kloetinge bunker since 2010, and that any claims made by CyberBunker regarding their continued usage of the complex were false, and that they have not been operating from the bunker since the fire in 2002. Businessweek reported them as stating that the bunker was "full of junk" when they acquired it, and quoted Guido Blaauw, their general manager, as stating that the CyberBunker publicity material was "all Photoshop".

The Pirate Bay

In October 2009 BitTorrent tracker The Pirate Bay, which had been subjected to legal action by various anti-piracy groups including Dutch copyright organisation BREIN, moved away from Sweden to CyberBunker. In 2010 the Hamburg district court ruled that CyberBunker, operating in Germany as CB3Rob Ltd & Co KG, was no longer allowed to host The Pirate Bay, being subject to a €250,000 fine or up to 2 years imprisonment for each infringement.

Spamhaus

In October 2011, Spamhaus identified CyberBunker as providing hosting for spammers and contacted their upstream provider, A2B, asking that service be cancelled. A2B initially refused, blocking only a single IP address linked to spamming. Spamhaus responded by blacklisting all of A2B address space. A2B capitulated, dropping CyberBunker, but then filed complaints with the Dutch police against Spamhaus for extortion.
In March 2013, Spamhaus added CyberBunker to its blacklist. Shortly afterwards a distributed denial of service attack of previously unreported scale was launched against Spamhaus email and web servers using a Domain Name System amplification attack; the attack had lasted for over a week. Steve Linford, chief executive for Spamhaus, said that they had withstood the attack. Other companies, such as Google, had made their resources available to help absorb the traffic. The attack was being investigated by five different national cyber-police-forces around the world. Spamhaus alleged that Cyberbunker, in cooperation with "criminal gangs" from Eastern Europe and Russia, was behind the attack; Cyberbunker did not respond to the BBC's request for comment on the allegation.
Cloudflare, an Internet security firm located in San Francisco, California assisting Spamhaus in combating the DoS attack was also targeted. On 28 March 2013, CyberBunker's website went offline for a short period of time, possibly becoming a victim of a DDoS attack themselves.
On 25 April 2013 Sven Olaf Kamphuis, a vocal spokesman for CyberBunker, was arrested at the request of Dutch authorities near Barcelona by Spanish Police after collaboration through Eurojust. An anonymous press release uploaded on Pastebin the following day demanding the release of Kamphuis threatened with more large-scale attacks should he remain in custody. The Spanish authorities reported that Kamphuis operated from a well-equipped bunker and used a van as a mobile computing office. No further information on this bunker was provided. In September 2013 it was revealed that a second arrest had been made in April in relation to the Spamhaus attack, the suspect being a 16-year-old from London.

Traben-Trarbach bunker

In 2013 the company purchased its second bunker, in Traben-Trarbach, Germany. As early as 2015, German cybercrime investigators received a warrant to investigate the company by tapping its Internet traffic in and out of the bunker. During this time, the company's clients are claimed to have included the dark web marketplaces Wall Street Market, Cannabis Road and Flugsvamp, as well Fraudsters, a forum for exchanging illegal drugs, counterfeit money and fake identification.
In September 2019, 600 German police raided the bunker. Seven people were arrested in the raid. Police later said that the bunker was the location from which a late 2016 denial of service attack on Deutsche Telekom was launched.