The modern office building near the harbor in Iceland’s capital, Reykjavik, is best known as the home of the Icelandic Phallological Museum, which displays 320 specimens of mammal penises.

To those who track cyber mischief, however, the building also has a reputation as a virtual offshore haven for some of the world’s worst perpetrators of identity theft, ransomware, disinformation, fraud and other wrongdoing.

That’s because the museum’s street address, Kalkofnsvegur 2, is also the registered address for Withheld for Privacy, a company that is part of a booming and largely unregulated industry in Iceland and elsewhere that allows people who operate online domains to shield their identities.