/baphomet/ - Deepweb, Hax, Casual Chat, Raids

I have some more data on this:

Nmap scan report for 1babe.ph (14.177.207.175)
Host is up, received syn-ack ttl 19 (0.28s latency).
Scanned at 2016-01-17 20:06:13 Eastern Standard Time for 265s
PORT      STATE    SERVICE            REASON         VERSION
25/tcp    open     smtp               syn-ack ttl 19 Alt-N MDaemon mail server 14.5.0
|_smtp-commands: Couldn't establish connection on port 25
| ssl-date: 
|_  ERROR: Unable to obtain data from the target
80/tcp    open     http               syn-ack ttl 19
110/tcp   open     pop3               syn-ack ttl 19 MDaemon pop3d 14.5.0
| ssl-date: 
|_  ERROR: Unable to obtain data from the target
143/tcp   open     imap               syn-ack ttl 19 Alt-N MDaemon imapd 14.5.0
| imap-capabilities: 
|_  ERROR: Failed to connect to server
| ssl-date: 
|_  ERROR: Unable to obtain data from the target
443/tcp   open     ssl/http-proxy     syn-ack ttl 19 HAProxy http proxy
| http-cisco-anyconnect: 
|_  ERROR: Not a Cisco ASA or unsupported version
| ssl-date: 
|_  ERROR: Unable to obtain data from the target
465/tcp   open     ssl/smtp           syn-ack ttl 19 Alt-N MDaemon mail server 14.5.0
|_smtp-commands: Couldn't establish connection on port 465
| ssl-date: 
|_  ERROR: Unable to obtain data from the target
587/tcp   open     smtp               syn-ack ttl 19 MDaemon smtpd 14.5.0 (Unregistered)
|_smtp-commands: Couldn't establish connection on port 587
| ssl-date: 
|_  ERROR: Unable to obtain data from the target
993/tcp   open     ssl/imap           syn-ack ttl 19 Alt-N MDaemon imapd 14.5.0
| imap-capabilities: 
|_  ERROR: Failed to connect to server
| ssl-date: 
|_  ERROR: Unable to obtain data from the target
995/tcp   open     ssl/pop3           syn-ack ttl 19 MDaemon pop3d 14.5.0
| ssl-date: 
|_  ERROR: Unable to obtain data from the target
3389/tcp  open     ssl/ms-wbt-server? syn-ack ttl 19
| ssl-date: 
|_  ERROR: Unable to obtain data from the target

Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: specialized|WAP|phone
Running: iPXE 1.X, Linux 2.4.X|2.6.X, Sony Ericsson embedded
OS CPE: cpe:/o:ipxe:ipxe:1.0.0%2b cpe:/o:linux:linux_kernel:2.4.20 cpe:/o:linux:linux_kernel:2.6.22 cpe:/h:sonyericsson:u8i_vivaz
OS details: iPXE 1.0.0+, Tomato 1.28 (Linux 2.4.20), Tomato firmware (Linux 2.6.22), Sony Ericsson U8i Vivaz mobile phone
TCP/IP fingerprint:
OS:SCAN(V=7.01%E=4%D=1/17%OT=25%CT=%CU=%PV=N%G=N%TM=569C3B8E%P=i686-pc-wind
OS:ows-windows)ECN(R=N)T1(R=N)T2(R=N)T3(R=N)T4(R=N)U1(R=N)IE(R=N)
Service Info: Host: mail.oahay.com; OS: Windows; Device: load balancer; CPE: cpe:/o:microsoft:windows

lamo, this is the same guy thats posting the "t.o.pb.a.b.e.r.u" links. really BO and mods should just ban him. fucking pedo. did a lookup on "t.o.p.b.a.be.r.u" (spam filter) , it looks like its hosted in Vietnam too. though i really doubt that its the actual hosting location. also, clearnet CP? jfc this guy either wants to get V& or is a complete dumbass.

>>107680

>this guy either wants to get V& or is a complete dumbass

Either that, or he's some organized crime figure and knows he's nigh-untouchable. Possibly out of Thailand, since that's practically the Singapore of international child trafficking.

I was able to temporarily knock the site down (on accident) yesterday by overwhelming the server with login attempts. The version of phpBB is pretty old, several years at least, and probably has some unpatched vulnerabilities.

DoSing it would be, pardon the sick pun, child's play, but the real coup would be to get a hold of the server logs, and track down every babyfucking bastard who wasn't smart enough to use proxies.

>>107737

CP is pretty much beyond morality. It's not about social justice, it's about ensuring a future for our children. Even evil has its standards. If you don't, you're not a human, you're just an animal that needs to be put down.

Also, they spammed us. Pretty sure that means the gloves come off.

>>107751

I don't exactly agree with you, but it's not like I care either. For you, the CP is an excuse to rek a spammer. For me, the spam is an excuse to go fuck some pedophiles' shit up. The goal is the same.

It's really tough to say whether 1babe.biz is part of the topbabe network. The traceroutes are completely different. The choice of domains though is certainly a very suspicious coincidence.

>>107754

I'm sure they do. That's why I don't just want to take a site down, I want to get in there and see if I can dig up any identifying information. The smart ones won't have left anything, but we can still get the stupid ones.

>>107759

A government honeypot that spams other clearnet sites and is based out of Vietnam? Nuh-uh, I don't think so.

Even if it is, it's not illegal for a private citizen to investigate potential crime. Highly discouraged, yes, but not illegal.

You guys checked tophatchan yet? they got a board named Dead Chans where they meet up and spam the same links onto dead chans, including here 8chan.

>>107828

Is that just a codename for masterchan's /General/ board? Isn't that entire site just a honeypot for the Dutch police?

>>107841

So it's a hidden service then? Can you spot me a link?

>>107897

KMar as in the Dutch gendarmerie?

Well, I don't know if you really are one of them, and if so, that you're telling the truth. It doesn't matter either way. I'm already pretty convinced upon investigation that it's not, and only an official communique in my mailbox can convince me otherwise now.

Also, I'm trying to merge this discussion into >>107495 since it's the larger thread. Operational plans are detailed there.

>>107919

Well, that sounds all fine and dandy, except:

a) I'm not a Dutch citizen

b) I don't read or speak Dutch

c) I don't have an international calling plan

and

d) I'm pretty sure that undercover police operations, like honeypots, get exempted from FOIA-type requests

Again, please direct further comments to >>107495 and have a pleasant day.

Guess whos back spamming their site!

same deal as before, just different shortened link (that i can see)