Spamhaus DDoS suspect extradited to the Netherlands

A judge decided to keep the suspect in custody for 14 days pending the outcome of an investigation, the Public Prosecution Service said

A 35-year-old Dutchman suspected of participating in a large DDoS attack on antispam organization Spamhaus was extradited from Spain to the Netherlands on Monday evening, the Dutch Public Prosecution Service said Wednesday.

A judge in the Rotterdam District Court Wednesday ruled to keep the suspect in jail for an initial 14 days, as requested by the Public Prosecution Service, said a service spokesman, Paul van der Zanden. "I can say nothing substantive about the case because it is still under investigation," he added. The investigation is led by the Team High Tech Crime of the Dutch police.

In two weeks, the court will decide whether to keep him in custody for a longer period pending the outcome of the investigation, Van der Zanden said.

At the moment, it is impossible to give an estimate of how long the investigation will take, Van der Zanden said.

The Public Prosecution Service did not name the suspect, referring to him only as S.K. However, he has been identified by an official close to the investigation as Sven Kamphuis, who was a spokesman of the Stophaus movement. That group's members included companies and individuals flagged as spammers by Spamhaus, a non-profit organization that develops widely used lists of networks identified as sending spam.

Stophaus claimed responsibility for attacks against Spamhaus, including one of the largest DDoS (distributed denial of service) attacks on record, with an estimated 300G bps peak, although the attack's intensity was later disputed by security experts.

The Dutchman is suspected of performing large-scale DDoS-attacks targeting Spamhaus, the Public Prosecution Service said. Performing a DDoS attack is a criminal offense under Dutch law.

The attacks were carried out against Spamhaus partners in the U.S, the Netherlands and the U.K., and the attackers used forged IP addresses, according to the Public Prosecution Service.

At the time of the attacks in March, Kamphuis denied his personal involvement and said that it was launched by Stophaus members from China and Russia.

The Dutchman was arrested late last month by Spanish authorities in Barcelona. He drove around Spain in a van he used as a mobile office, according Spain's Interior Ministry. The ministry also released a video of his home, which was the target of a raid by the police.

On Tuesday evening local time, the Dutch government websites and were hit by a large DDoS attack, reported Dutch news site Webwereld. Recently, Dutch banks and DigiD, an identity management platform used by Dutch government agencies, also experienced service disruptions due to DDoS attacks.

People who said they are supporters of Kamphuis claimed to be responsible for some of the attacks in a post on Pastebin Tuesday.

Loek is Amsterdam Correspondent and covers online privacy, intellectual property, open-source and online payment issues for the IDG News Service. Follow him on Twitter at @loekessers or email tips and comments to

Join the CSO newsletter!

Error: Please check your email address.

Tags CriminalSpamhaussecuritylegalcybercrime

More about IDG

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Loek Essers

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts