The rapidly growing webtoon market in Korea is plagued by copyright issues due to the proliferation of illegal webtoon sites. Even when discovered and shut down, these sites quickly reappear under new domains, often hosted overseas to evade law enforcement.
Among these, ‘Newtoki’ (newtoki9999[.]com) stands out as one of the most notorious sites. In this article, we use the OSINT-based threat hunting tool Criminal IP to uncover the Real IP addresses of ‘Newtoki’ and trace information about its operators.
Tracking the Real IP Address of ‘Newtoki’ Using a Threat Hunting Tool
At the time of writing, the domain address newtoki9999[.]com is mapped to two IP addresses:
- 104[.]21[.]19[.]32
- 172[.]67[.]184[.]237
However, it is not easy to trace operator information solely based on the discovered IP address. These are Cloudflare IP addresses used by Newtoki’s operators to conceal their Real IP address and evade detection.
If we could uncover the Real IP address behind these obscured ones, we could gather more information about the operators of ‘Newtoki’. By utilizing Criminal IP Domain Search, an OSINT CTI engine, we can trace the actual IP hidden by Cloudflare.
Domain Search allows users to search the Real IP section from the real-time domain scan of ‘Newtoki’. In the Real IP section, the actual IP address of this illegal website is 91[.]209[.]70[.]73. This is the real server IP address the owner uses to run the ‘Newtoki’ website.
Location Information of the Illegal Webtoon Site Confirmed with Newtoki’s Real IP
When checking this IP address with Criminal IP Asset Search, we were able to confirm the AS Name as SIA VEESP. This AS Name is associated with domains hosted by a hosting company called Veesp (https://veesp.com/).
The country code ‘BZ’ in the confirmed Real IP location information indicates Belize in Central America. Central America is known for hosting several countries with a strong influence from criminal organizations, which potentially facilitates covert support or overlooking illegal activities. Notably, the illegal streaming site ‘NunuTV’, notorious for illicit Korean video streaming, was also based in the Dominican Republic, located in Central America.
Additional information revealed that the IP address hosts MariaDB (port 3306) and SSH (port 22) services.
Using Criminal IP’s search filter, we can detect other web servers hosted by SIA VEESP. The Asset Search revealed approximately 23,000 servers hosted, spread across four countries: Lithuania, Russia, Belize, and the Netherlands.
Essential Detection of Real IP for Tracking Illegal Sites
As demonstrated, using Criminal IP’s Real IP detection feature can uncover illegal sites hidden behind concealed IP addresses. However, determined operators can hide their activities even further.
Cybercriminal organizations that operate persistent illegal webtoon sites by repeatedly closing and creating new ones make it challenging to pinpoint the actual server locations. In such cases, using threat-hunting OSINT tools like Criminal IP is invaluable.
For further reading, refer to the article K-Pop Deepfake Porn Sites: Sneaky Criminals Hiding Real IP Address with Cloudflare.
This report is based on data from Criminal IP, a Cyber Threat Intelligence search engine. Sign up for a free Criminal IP account today to explore the search results mentioned in the report and delve into comprehensive threat intelligence.
Source: Criminal IP(https://www.criminalip.io/)
Related Article(s):