Data Breach & credentials logs: thousands of pedophile forum users are exposed

This is a research article in collaboration with the Evil Rabit Security team, who are a team of people who do very good research and decided to help the fight against CumOnPrintedPics by doing an investigation and revealing relevant information. I thank Pavel founder of Evil Rabbit Security for his great work. You can follow him on twitter (X) if you want more information or you can also go to the Evil Rabbit Security site.

CumOnPrintedPics (TributePrintedPics):

CumOnPrintedPics , TributePrintedPics and publictributes is a pedophilia and sexual harassment forum where thousands of sexual predators from all over the world come together in one place to commit crimes against children and women. Different media outlets, mostly in the United States, have written articles about CumOnPrintedPics, including The Bloomberg, VICE, The Journal and some others. Most of the articles mention child victims of sexual predators registered

The CumOnPrintedPics admin has a history of blackmailing revenge porn victims and looking the other way regarding illegal content uploaded by registered sexual predators on the pedophile forum. It is not necessary to give more details about. The website administrator, not happy with this, just a few months ago threatened the president of the United States, the FBI and the former president of the USA and made reference to Child Sexual Abuse Material (CSAM) and terrorism

For months now, a man with different users began to promote a pedophile forum that copies the COPP format and openly promotes itself as a forum where there are no bans, with “untraceable” servers in Ukraine and where there is no FBI “unlike COPP “

sexual predators and pedophiles feel untouchable while they profit from the suffering of children. These images are not from the dark web, this is in the supposed “clear web” of which we are all part. In this article I will give these people a reality check. This article will have 2 parts, the first part is about the pedophilia forum that is promoted on COPP and the second part is about CumOnPrintedPics, the investigation carried out by the Evil Rabbit Security and a list of hundreds of users.

in BanFamaleHateSubs 3 months ago different users publicly denounced the pedophile forum and showed how the owner of the website with the nickname “snow” sold access to illegal pornography and a category on the website called “Extreme”. The “extreme” category of the pedophile forum showed posts that referenced “rape content” and Child Sexual Abuse Material (CSAM). It seems that every day different users upload videos and images of child rape and other types of illegal content.

The pedophile forum is used by the worst scum of society to commit crimes against children. These monsters feel untouchable behind a username and show the worst of themselves in a pedophile forum used to distribute Child Sexual Abuse Material (CSAM). This is a SQL file with a database of more than 4k pedophiles who registered on the pedophile forum to access illegal pornography, distribute and chat with other sexual predators. This is not the complete database but there are thousands of users.

Different information about cybercriminals is mentioned in the NoLimit Forum database. here is the list:

• username
• email address
• encrypted passwords
• password decryption key
• user ID
• cybercriminal time zone (Country , City)

The NoLimit Forum (NLF) database is now in the public domain and anyone can access the database. You can access and view user information from the browser or by downloading the original SQL file from here. and the question is… how do I have this database, right? The owner of the pedophile forum sent me the database along with other user information from an email address. It’s the biggest plot twist ever, yes.

When he contacted me I began to argue with him because he seemed to want to justify his activities by saying that he scams his users and seemed to claim that pedophilia are just a “moral” issue…

This is the message he sent me with an attached .SQL file. I honestly thought it was a virus or some type of exploit, for that reason I downloaded the database a few days later from Kali Linux and there I discovered that it was a database. This happened in April. Honestly, it’s strange and a case study. If a lot of people want me to publish all the conversations with this person, just let me know by email and if they ask me a lot, I will do it. By the way I think there is another database

Since there are no IP address records in the database, I assume that there were 2 databases and the one I have is the users’ database. The owner of the forum showed me this screenshot so that I believed it was him and that’s how I deduced this.

• database access: Rabbit Evil Security – Raw Database
• Database (Original .SQL): ProtonDrive – Forum Database

The owner of the pedophile forum is dedicated to attracting sexual predators who use CumOnPrintedPics PublicTributes / TributePrintedPics to then scam via Paypal. so it seems that the hidden sections of the pedophile forum are where sexual predators get scammed.

I wouldn’t mind this if it weren’t for the fact that what it does is attract pedophiles and allow them to post on the forum and distribute Child Sexual Abuse Material (CSAM). This person thinks he is doing things right when he benefits from child abuse and pedophilia networks. I guess he knows very well that he is harming a lot of children by doing this and he probably felt guilty and tried to cleanse his inner guilt by sending me the database, probably knowing that I was going to make it public domain.

Now, as the database is in the public domain, it can be used by authorities, researchers and OSINT tool developers who integrate data breaches into their tools.

CumOnPrintedPics and login credentials:

The Evil Rabbit Security team investigated registered users on CumOnPrintedPics and managed to collect the login credentials of hundreds of users. Most of the credentials include username and password and another part shows email addresses. The first user that I will analyze from that database is “MalaniPanterTremblay” who is a user who openly calls himself zoophilic, Catoophile and it seems that his CumOnPrintedPics profile deals only with sexual abuse of animals.

This sexual predator, the only post he has, was published on October 8, 2020 at 2 in the morning in a post related to zoophilia and sexual abuse of animals. In this post he spammed a Facebook account and described himself sexually abusing a cat.

This user seems to be posing as a woman but the user behind this account is a man. The email address used in the sexual predator’s account is “[email protected]”, which has many fingerprints that we are now going to analyze. This man is the owner of this account, that photo is from a profile photo uploaded to an xvideos profile with the username “leetart” registered on August 15, 2012. The IP address of a data breach shows that He is from Quebec, Canada.

The next on the list is “LoliconFinder” who with just the username we already know what type of person he is. It was registered on March 22, 2016 at 11PM and has 8 posts in total. Before discovering who this person is, we will analyze their profile in CumOnPrintedPics & TributePrintedPics.

on the same day he registered in COPP exactly 20 minutes later, what he did was create a thread where he asked pedophiles to “cumtribute” or “Fakes” photos of teenagers. The first photo is clearly a little girl.

is a list of images in which children and small children appear. These posts were uploaded in 2016 on CumOnPrintedPics and currently have more than 900 visits from sexual predators. obviously the website admins don’t care about any of this. The most disturbing image uploaded by the sexual predator is of a very small girl using floats for water and the image appears to have a filter or be in poor quality. I guess monsters show their true colors when they think they are anonymous.

The email address behind the user “loliconfinder” on CumOnPrintedPics is “[email protected]” and the real name of this sexual predator is Patrick Hill and he was born in the United States. From 2016 to 2024 he used different usernames. on CumOnPrintedPics (COPP) he uses the username “loliconfinder” but on websites and social networks that do not involve shady or illegal things he uses the username “X32patrick32X” and “illusiveGhost” to refer to himself.

With a search in OSINT Industries we can see the different connections that the linked email address has and know that he lives in the United States, has the Windows 10 Home operating system

Through the profile photo of the CashAPP account and a photo uploaded to the Facebook account of a person with exactly the same name and in the same country we can discover the Facebook of this person. The account was created in 2009. The Facebook account is linked to an Instagram account named illusiveghostx which is the same username mentioned above. The account information shows that he lives in Sanford, Florida, USA and works at AutoZone.

The username most often used on the internet is “Illusive Ghost”, following the digital footprints of the different profiles of this pedophile we discovered his SoundCloud, Twitch, Social Club, Xbox Live and Steam accounts. In the Social Club account it has 3 games, in the XBOX account it has 30 games and in the Steam account it has more than 113 games. It seems that he plays a lot of video games and spends a lot of money buying video games on PC and XBOX.

In the Facebook, SoundCloud and Instagram profile there is a link to a store that uses a TeesPring subdomain, this appears to be a sub-website selling clothing and products. the store is called “illusive Ghost” just like the username.

The 2 characters that appear in the image on the website appear to be underage girls which makes a lot of sense connecting it to the fact that Patrick Hill is the same person who used the name “loliconfinder” on CumOnPrintedPics. Next on the list is the user “jizzking55” who registered with COPP in 2019 to ask other sexual predators to make DeepFakes (“Fakes”) of women he knew and even paid another pervert to NCSEI

The email address behind this pervert’s account is [email protected] and he registered on CumOnPrintedPics on February 7, 2019 with the username “jizking55”. Looking at the public data breaches we can see that he is from the USA, Maryland. He has a Twitter account inked to the email address, this Twitter account uses the username “Joshking55” and appears to show his real face and the account is mainly about video games, the account is listed as being located in Maryland , USA.

He also has an xvideos account created on February 10, 2014 with the username “jman5566” where his age appears to be 35 years old and in the account information he claims to live in Maryland, United States in the city of Germantown. on Twitter (X) he uses a Linktree link where a list of his accounts appears. He has 2 YouTube accounts, 1 Instagram account and 2 Twitter accounts. In his Insta account mentioned there he follows himself with another account called “Josh_king3322”

This is just a sample of these 3 users. perverts who under a username show the worst of themselves and in real life are simple weirdos who hide their murky truth on the internet under users in forums. and these are not the only ones. The Evil Rabbit Security team uploaded to their website the list of access credentials (passwords and usernames) and another list of email addresses registered with CumOnPrintedPics. We could do this all day with different COPP users

They also made a data dump of more than 4,320 COPP users who mentioned their real location in their COPP profile. This, adding the above information, could provide many fingerprints of different sexual predators registered with COPP. He will continue to give some updates with more files and information about COPP users, by June 7, 2024 as I write this they are working to provide more updates