In September 2019, 600 armed German cops seized the physical premise of a Bulletproof Hoster (BPH) referred to as CyberBunker 2.0. The hoster resided in a decommissioned NATO bunker and advertised to host everything but child porn and anything related to terrorism while keeping servers online no matter what. While the anatomy, economics and interconnection-level characteristics of BPHs are studied, their traffic characteristics are unknown. In this poster, we present the first analysis of domains, web pages, and traffic captured at a major tier-1 ISP and a large IXP at the time when the CyberBunker was in operation. Our study sheds light on traffic characteristics of a BPH in operation. We show that a traditional BGP-based BPH identification approach cannot detect the CyberBunker, but find characteristics from a domain and traffic perspective that can add to future identification approaches.

翻译：2019年9月,600名德国武装警察查封了被称为CyberBunker 2. 0的防弹客(BPH)的有形前提。东道主居住在退役的北约掩体中,广告上说除了儿童色情和任何与恐怖主义有关的东西之外,所有东西都存放在其中,而不管怎样都保持服务器在线。虽然对BPH的解剖、经济学和互连性特点进行了研究,但其交通特点并不为人所知。在这份海报中,我们首次分析了在CyberBunker运行时在主要的一级ISP和大型IXP所捕捉的域域、网页和交通。我们的研究揭示了BPH的交通特点。我们显示,传统的BGPBP识别方法无法探测CyBunker,但从域和交通角度找到特征,这可以增加未来的识别方法。