CyberBunker: the hosting company that lived in two bunkers

01 / NL-ZEELAND · BUNKER 1Bunker one: Kloetinge, the Netherlands

The first bunker stands near Kloetinge, just outside Goes. It was built in 1955 as a provincial military command centre, designed to keep working through a nuclear attack. The Dutch military gave it up in 1994, and the next year Herman Johan Xennt bought it. [1]

Inside, Xennt set up CyberBunker: "bulletproof" hosting that would not take sites down because someone complained. The house rule, repeated for years, was that anything was allowed except child abuse material and terrorism. The early customers were mostly porn sites. [1]

1. 2002CRIT

   Fire in the bunker, drug lab found

   Firefighters responding to a blaze found an MDMA lab inside. Three of the four men charged were convicted and got three years; the fourth was acquitted. The municipality refused a business licence afterwards, and servers moved to above-ground data centres, including in Amsterdam. [1]

2. Oct 2009WARN

   The Pirate Bay moves in

   The Pirate Bay moved its hosting from Sweden to CyberBunker. In 2010 a Hamburg court barred CyberBunker (trading as CB3ROB Ltd & Co KG) from hosting it, with fines of up to €250,000 per violation. [1]

3. 2010INFO

   Whose bunker is it, anyway?

   A company called BunkerInfra later said it had owned the Kloetinge bunker since 2010, and that CyberBunker's claims of still operating from it were false. [1] For a business built on the mythology of the bunker, that was an awkward detail. What BunkerInfra did with the bunker →

02 / INCIDENT 2013-03A record DDoS on Spamhaus

In March 2013 the anti-spam organisation Spamhaus put CyberBunker on its blocklist. What followed was a DNS amplification attack on Spamhaus that peaked at about 300 Gbit/s. A typical large attack then was around 50 Gbit/s, and the previous publicly reported record was about 100 Gbit/s. [1] Five national cyber police forces investigated.

1. Mar 2013CRIT

   Attack on Spamhaus

   The attack had run for more than a week by 27 March. Spamhaus alleged that CyberBunker worked with criminal groups in Eastern Europe and Russia. [1]

2. 25 Apr 2013WARN

   Arrest in Spain

   Sven Olaf Kamphuis, CyberBunker's best-known spokesman, was arrested near Barcelona at the request of Dutch authorities. He spent 55 days in custody and was later convicted and sentenced to 240 days, suspended, with the time already served counted. [1] A London teenager was also arrested in connection with the attack.

03 / DE-MOSEL · BUNKER 2Bunker two: Traben-Trarbach, Germany

In 2013 a Dutchman bought a second, much larger bunker from the Bundeswehr's geoinformation office, in Traben-Trarbach on the Mosel. [3] It is a 13-hectare site with two office buildings and a bunker of about 5,500 m², several floors deep. [3] [4] Investigators named Xennt as the main suspect. [5]

Layout as described in reporting on the 2024 sale. [4] The bunker itself covers about 5,500 m².

According to the investigators, this second bunker hosted darknet marketplaces including Wall Street Market and Cannabis Road, the fraud forum Fraudsters and other illegal shops. [5] [6] German police later also attributed a 2016 attack on Deutsche Telekom routers to traffic from the bunker. [1] Investigators had a warrant to tap the company's internet traffic from 2015 onward. [1]

04 / INCIDENT 2019-09The raid

1. 26 Sep 2019CRIT

   Hundreds of officers storm the bunker

   German police raided the site and other locations in Germany and abroad. Reports put the number of officers at around 600 to 650. Seven people were arrested, among them four Dutch nationals, two Germans and a Bulgarian, and 13 suspects were identified. [6] [1] Several hundred servers were seized: early reports said about 200, and later reporting gave 403. [6] [7]

2. Before the raidINFO

   Getting the crew outside

   The arrests were made outside the bunker, not in it. [5] In the 2023 Netflix documentary, police describe how they lured Xennt and his team out of the bunker before going in. [1]

05 / LG TRIER · BGH 3 StR 306/22The trial: is a host responsible for its customers?

At the regional court in Trier, prosecutors charged eight people with running a criminal organisation, and also with aiding and abetting about 250,000 offences committed through the sites they hosted. [7]

1. 13 Dec 2021VERDICT

   Guilty of a criminal organisation, not of their customers' crimes

   After a trial of more than a year, all eight were convicted of forming or being members of a criminal organisation. They were acquitted of aiding and abetting the crimes on their servers: the court found no proof that they intended to help with specific offences. [7] [2]

2. 12 Sep 2023FINAL

   Federal Court of Justice upholds it

   The BGH rejected the appeals from both the defendants and the prosecution. It held that the organisation was aimed at particularly serious crimes, and sent back only the question of confiscating seized equipment to Trier. The sentences became final. [2] [8]

Why it matters: knowingly giving criminals a place to operate was not, under the law at the time, the same as helping with each of their crimes. The BGH's presiding judge noted that cybercrime is held to the same standards as offline crime, and that the offence of running criminal online trading platforms was only added to German law in 2021, after the bunker was raided. [8] The defence put it the other way round: a web host faces no penalty unless membership in a criminal organisation can be proven. [8]

What made it an organisation was how the bunker was run. The court found that the defendants shared the goal of running the "Cyberbunker", invested real effort in it and helped hide their customers' activities. Some of them lived on site, and staff were only taken on if they supported what the operation stood for. [8]

06 / STATUS · BUNKER 2The German bunker now

Ownership of the Traben-Trarbach site passed to the state of Rhineland-Palatinate in September 2023. [4] The state wants to sell the whole complex to the highest bidder, but setting a price is hard: it is a "special property" and it is unclear what anyone would use it for. Ideas floated over the years range from a cheese store and a wine cellar to a bunker hotel. [3] Most interested parties want to keep it in IT. [9]

1. Jul 2025INFO

   43 interested parties, no sale

   The Bundeswehr also showed interest during a site visit. [9]

2. Apr 2026INFO

   54 interested parties, still no sale

   No price has been published and no buyer chosen. Public bodies are also looking at a possible use. [10]

The original Kloetinge bunker is a separate story. Its connection to CyberBunker had long ended by the time the German bunker made the news. Read what happened to it after 2010.

FAQFrequently asked questions

REFSources

1. Wikipedia: CyberBunker (Kloetinge, 2002 fire, Pirate Bay, Spamhaus, Kamphuis, raid, documentary)
2. Jura Online: BGH zu Verurteilungen im „Cyberbunker-Verfahren" (2023)
3. Stuttgarter Zeitung: Rheinland-Pfalz will Cyberbunker an Meistbietenden verkaufen (June 2024)
4. DatacenterDynamics: CyberBunker data center to be repurposed as cheese or wine cellar and UNN (June 2024)
5. Krebs on Security: German cops raid "Cyberbunker 2.0" (Sept 2019)
6. The Local: German police bust "Cyber Bunker" hosting darknet sites (Sept 2019)
7. DatacenterDynamics: German court convicts eight (Dec 2021)
8. it-daily: BGH zur Cyberbunker-Bande: Keine anderen Standards für Webhoster (Sept 2023)
9. it-daily: status of the sale (July 2025)
10. aktuell4u / dpa: Cyberbunker vor Verkauf, Interesse wächst weiter (April 2026)
11. The Register: Cyberbunker, aka CB3ROB, shut down by German police (Sept 2019)
12. Netflix: Cyberbunker: The Criminal Underworld and FilmVandaag (Nov 2023)