The modern office building near the harbor in Iceland’s capital, Reykjavik, is best known as the home of the Icelandic Phallological Museum, which displays 320 specimens of mammal penises.

To those who track cyber mischief, however, the building also has a reputation as a virtual offshore haven for some of the world’s worst perpetrators of identity theft, ransomware, disinformation, fraud and other wrongdoing.

That’s because the museum’s street address, Kalkofnsvegur 2, is also the registered address for Withheld for Privacy, a company that is part of a booming and largely unregulated industry in Iceland and elsewhere that allows people who operate online domains to shield their identities.

While the practice has become commonplace for website owners seeking to protect themselves from harassment or spam, it has also helped others cover their tracks from prying regulators, law enforcement officials or victims.

Withheld for Privacy and other so-called proxy services have turned Iceland into a global hub for illicit activity far out of proportion to the country’s size.

The company — created in 2021 by Namecheap, one of the world’s largest providers of websites — has effectively shielded tens of thousands of sketchy internet sites. Even local authorities said they had tried and failed to reach the company’s representatives when problems had arisen.