CyberBunker

CyberBunker was an internet service provider and web-hosting operation associated first with a former NATO bunker near Kloetinge in Zeeland, the Netherlands, and later with a former military bunker in Traben-Trarbach, Germany. The business was founded in 1995 after Herman-Johan Xennt acquired the Dutch facility, which had been built in 1955 as a Provincial Military Command Center and designed to withstand a nuclear attack. The bunker gave the company its name and became central to its marketing as a secure, autonomous, and difficult-to-interfere-with hosting location. CyberBunker promoted a permissive or “bulletproof” hosting model. According to the company’s stated policy, it would host almost any website except child pornography and material connected with terrorism. During its early years, its customers reportedly included many pornography websites. The model appealed to operators whose services faced complaints, takedown requests, or pressure from internet infrastructure providers. It also created recurring disputes over whether a hosting provider should remain neutral toward customer content or take responsibility for allegedly abusive activity carried through its network. The Dutch bunker’s role became controversial after a fire in 2002 exposed an MDMA laboratory operating on the premises in addition to the hosting business. Several people connected with the laboratory were convicted. After the incident, local authorities refused to issue the company a business licence, and its servers were moved to above-ground locations, including sites in Amsterdam. CyberBunker nevertheless continued to use the bunker in its publicity. In 2013, the company that had acquired the Kloetinge property stated that CyberBunker had not operated there since the 2002 fire and disputed the continuing bunker-based image. CyberBunker became internationally visible in 2009 when The Pirate Bay moved hosting operations to the company after facing legal pressure from copyright-enforcement organisations. A German court later prohibited CyberBunker’s German operating entity from hosting the file-sharing service and imposed substantial penalties for violations. The company was also associated with WikiLeaks mirrors and was accused of hosting spam operations, botnet command-and-control infrastructure, malware, and online scams. These associations made CyberBunker a prominent example in debates about intermediary liability and abuse-resistant hosting. The most publicised confrontation involved Spamhaus, an organisation that maintains anti-spam blocklists. After Spamhaus identified CyberBunker as a host for spammers, upstream provider A2B eventually disconnected CyberBunker. CyberBunker was later placed on Spamhaus’s blacklist. In March 2013, Spamhaus suffered a large distributed denial-of-service attack using DNS amplification. Spamhaus alleged that CyberBunker and criminal groups were involved, although the attribution was contested and CyberBunker did not publicly respond to the cited media request. The incident affected additional infrastructure providers, including Cloudflare, and attracted international law-enforcement attention. CyberBunker spokesman Sven Olaf Kamphuis was arrested in Spain in April 2013 at the request of Dutch authorities and was later convicted in the Netherlands; his custodial sentence was suspended after credit for time served. In 2013 CyberBunker acquired the Traben-Trarbach bunker in Germany. German investigators later examined traffic entering and leaving the facility and alleged that its customers included dark-web marketplaces, illicit forums, and the infrastructure of the encrypted communications service Exclu. In September 2019, approximately 600 German police officers raided the bunker and arrested seven suspects. Authorities subsequently connected the facility with a 2016 denial-of-service attack against Deutsche Telekom. In 2021, Xennt and six other defendants were convicted of forming a criminal organisation but acquitted of aiding and abetting crimes committed by customers through the servers. Their prison sentences ranged from 28 to 59 months. The operation was therefore effectively dismantled, and CyberBunker is treated as defunct. Its history was revisited in the 2023 Netflix documentary Cyberbunker: The Criminal Underworld.

CyberBunker began in 1995 when Herman-Johan Xennt acquired a former NATO bunker outside Kloetinge in Zeeland. The facility had been built in 1955 for the Dutch military as a Provincial Military Command Center and was designed to survive a nuclear attack. Xennt and collaborators converted it into a hosting site and promoted the resulting business as a secure environment for websites that might be unwelcome at ordinary providers. The company’s early customer base reportedly included many pornography websites. Its published policy was to host any website except child pornography and terrorism-related content. This approach became known as bulletproof hosting: the provider emphasised resistance to outside pressure and generally avoided judging customers’ activities unless they fell within its stated exclusions. A fire at the Dutch bunker in 2002 revealed that an MDMA laboratory was also operating there. Three of four men charged over the laboratory received three-year prison sentences, while one was acquitted. The incident damaged CyberBunker’s local standing, and the town subsequently refused the business a licence. Hosting equipment was moved to above-ground locations, including Amsterdam. CyberBunker continued to present the Dutch bunker as part of its identity, but the later property owner said the company had not operated there after the fire and that promotional images overstated its continuing presence. CyberBunker gained wider attention in 2009 when The Pirate Bay moved hosting to the company. A 2010 Hamburg court ruling barred the German operating entity from hosting The Pirate Bay, exposing the legal risks of providing infrastructure to a heavily litigated file-sharing service. CyberBunker also hosted or mirrored services associated with WikiLeaks. At the same time, it faced accusations that its network supported spammers, malware, botnet command-and-control systems, and online fraud. The conflict with Spamhaus was the company’s most consequential public controversy. In 2011 Spamhaus complained to CyberBunker’s upstream provider A2B about spam activity. A2B initially blocked one address, but later disconnected CyberBunker after Spamhaus blacklisted the provider’s broader address space. In 2013 Spamhaus added CyberBunker to its own blacklist. A major DDoS attack then struck Spamhaus and associated infrastructure. The attack used DNS amplification and reached a scale that drew international attention. Spamhaus accused CyberBunker of coordinating with criminal groups; the company did not answer the cited BBC request for comment. Cloudflare assisted Spamhaus and was itself affected. Kamphuis, a prominent CyberBunker representative, was arrested in Spain, extradited, and later convicted in the Netherlands. CyberBunker shifted its physical identity to Germany after acquiring a former bunker in Traben-Trarbach in 2013. Investigators monitored traffic and developed allegations that the facility hosted dark-web marketplaces, criminal forums, and the back end of the encrypted messaging service Exclu. German authorities also associated the bunker with a denial-of-service attack against Deutsche Telekom in late 2016. In September 2019, a large German police operation entered the bunker and shut down the company’s operations. Seven suspects were arrested. In 2021, Xennt and six others were convicted of membership in or formation of a criminal organisation, but the court did not convict them of aiding and abetting the crimes allegedly committed by customers using the servers. Sentences ranged from 28 to 59 months. With the infrastructure seized and the organisation dismantled, CyberBunker ceased operating as a functioning hosting brand. Its story was later documented in the 2023 Netflix production Cyberbunker: The Criminal Underworld.

• 2023

  Netflix documentary revisits CyberBunker

  [1]CyberBunkeren.wikipedia.org

  Cyberbunker: The Criminal Underworld presented interviews and investigation details about the company and its German bunker.

• 2021

  Criminal-organisation convictions

  [1]CyberBunkeren.wikipedia.org

  Xennt and six other defendants were convicted of forming a criminal organisation, though they were acquitted of aiding and abetting customer crimes.

• 2019

  German authorities shut down the bunker

  [1]CyberBunkeren.wikipedia.org

  A large police raid in Traben-Trarbach resulted in seven arrests and the seizure of the operation.

• 2013

  Spamhaus DDoS controversy and Kamphuis arrest

  [1]CyberBunkeren.wikipedia.org

  A major DDoS attack followed Spamhaus’s blacklisting of CyberBunker, and spokesman Sven Olaf Kamphuis was arrested in Spain.

• 2013

  Acquisition of the Traben-Trarbach bunker

  [1]CyberBunkeren.wikipedia.org

  CyberBunker acquired a second former bunker in Germany, which later became its best-known operating site.

• 2011

  Spamhaus challenges CyberBunker’s upstream connectivity

  [1]CyberBunkeren.wikipedia.org

  Spamhaus complained to A2B about alleged spam hosting, beginning a dispute that resulted in CyberBunker being disconnected.

• 2010

  German court orders hosting prohibition

  [1]CyberBunkeren.wikipedia.org

  A Hamburg court prohibited CyberBunker’s German entity from hosting The Pirate Bay.

• 2009

  The Pirate Bay relocates hosting

  [1]CyberBunkeren.wikipedia.org

  The Pirate Bay moved hosting to CyberBunker after legal pressure in Sweden and elsewhere.

• 2002

  Fire exposes an MDMA laboratory

  [1]CyberBunkeren.wikipedia.org

  A fire at the Dutch bunker led authorities to discover an MDMA laboratory operating alongside the hosting business.

• 1995

  CyberBunker founded in a former NATO bunker

  [1]CyberBunkeren.wikipedia.org

  Herman-Johan Xennt acquired a former Dutch military bunker near Kloetinge and established CyberBunker as a hosting operation.

CyberBunker positioned itself as a resilient, privacy-oriented, and censorship-resistant hosting provider willing to serve customers rejected or pressured by conventional providers, subject to its stated exclusions for child pornography and terrorism-related material.

• Internet hosting · 1995

  Web hosting

  CyberBunker provided hosting for websites and online services from bunker-associated infrastructure. Its distinctive proposition was a permissive hosting policy that sought to continue serving customers facing complaints or exclusion from conventional providers, subject to the company’s stated ban on child pornography and terrorism-related material.

• Resilient infrastructure hosting · 1995

  Bulletproof hosting

  The company’s public identity centred on “bulletproof” hosting: network and server services marketed as resistant to takedown pressure and external interference. This offering attracted controversial customers and became the focus of disputes involving spam, malware, online fraud, dark-web marketplaces, and other allegedly abusive activity.

• Data-centre services · 1995

  Server colocation and secure data hosting

  CyberBunker operated or promoted bunker-based facilities for servers, connectivity, and data storage. The hardened military sites were used as a security and resilience narrative, although the actual location of some servers was unclear and much of the Dutch operation later moved above ground.

• Platform infrastructure · 2009

  Infrastructure hosting for online platforms

  Customers and hosted services associated with CyberBunker included The Pirate Bay, WikiLeaks mirrors, and, according to German investigators, dark-web marketplaces and the back end of the Exclu encrypted messaging service. These relationships made the company an important infrastructure intermediary even when it did not operate the hosted services itself.

• 2021

  Criminal-organisation convictions

  Herman-Johan Xennt and six co-defendants were convicted of forming a criminal organisation. The court did not convict them of aiding and abetting crimes committed through customer-hosted services.

  Source

• 2019

  German bunker raid

  German police raided the Traben-Trarbach facility over allegations involving illicit online services and cyberattacks, arresting seven people and shutting down the operation.

  Source

• 2013

  Spamhaus DDoS attack controversy

  Spamhaus alleged that CyberBunker worked with criminal groups to launch a major DNS-amplification DDoS attack after CyberBunker was blacklisted. The allegation led to international investigation and the arrest of CyberBunker spokesman Sven Olaf Kamphuis.

  Source

• 2002

  MDMA laboratory discovered at Dutch bunker

  A fire led authorities to discover an MDMA laboratory operating in the Dutch bunker alongside CyberBunker’s hosting activities. Three people were convicted and later local authorities denied the business a licence.

  Source

Read more

• 2013Republic of CyberBunker branding

  International

  Sven Olaf Kamphuis described CyberBunker as the “Republic of CyberBunker,” while presenting himself as its Minister of Telecommunications and Foreign Affairs.

  Outcome. The quasi-state language reinforced the organisation’s anti-authoritarian and sovereignty-oriented public image during its dispute with Spamhaus.

  Source
• 1995Bunker-based hosting identity

  Netherlands · International

  CyberBunker promoted its location in a former NATO bunker as evidence of physical security, resilience, and independence from ordinary hosting providers.

  Outcome. The bunker identity became the central element of the brand, even after the Dutch operation moved away from the facility.

  Source

• 2019

  Operations shut down after German raidOther

  Background

  German investigators had examined the bunker’s network traffic and alleged that the facility hosted criminal services and infrastructure linked to cyberattacks.

  Action taken

  Police raided the bunker with a force of approximately 600 officers and arrested seven suspects.

  Aftermath

  The seizure dismantled CyberBunker as an operating hosting business and led to criminal proceedings that culminated in 2021 convictions for forming a criminal organisation.

  Source

• 2013

  Acquire and operate the Traben-Trarbach bunkerStrategy

  Background

  After the Dutch site ceased functioning as the company’s main base, CyberBunker sought another hardened facility to support its bunker-centred business identity.

  Action taken

  The company purchased a former bunker in Traben-Trarbach, Germany.

  Aftermath

  The German facility became the focus of surveillance, allegations concerning illicit customers, and the 2019 police raid.

  Source

• 2009

  Host The Pirate BayStrategy

  Background

  The Pirate Bay was under legal pressure from copyright-enforcement organisations and sought alternative infrastructure.

  Action taken

  CyberBunker accepted hosting for The Pirate Bay.

  Aftermath

  A German court later prohibited the company’s German entity from hosting The Pirate Bay and imposed penalties for infringement.

  Source

• 2002

  Move hosting operations away from the Dutch bunkerStrategy

  Background

  Following the bunker fire, the discovery of an MDMA laboratory, and the local authority’s refusal to grant a business licence, CyberBunker could no longer operate its hosting business normally from the Dutch site.

  Action taken

  The company moved servers to above-ground locations, including Amsterdam, while continuing to use the bunker in its promotional identity.

  Aftermath

  The gap between the company’s marketing and its actual Dutch infrastructure later became a subject of dispute with the bunker’s subsequent owner.

  Source

1. 1CyberBunkeren.wikipedia.org