they have articles on mainstream news outlet websites all the time about the ease which illegal stuff can be found via Facebook or Twitter. Drugs delivered in 15 minutes, DM's from ISIS, etc. Not everything illegal or evil is located on the deep web. The same things are all used as reasons against VPN, anonymizer software, TOR, end to end encryption, and so on. Most of those reasons are based on real concerns, just usually overstated.

 

Damn @clone , rubbing salt on the wound, aren't you? I know that but it's depressing to think of.

You just forced me to roll a laugh-maker and re-watch "Madagascar" (thx for the excuse )

 

Another interesting e-mail from Katfile. I've got few of them before and today again. I never clicked on anything.
It looks like scam. It's weird.

 

they misspelled "HELLO"

 

it is interesting that they wrote in the email back at the start of this thread to use katfile.cloud domain, and now you get this from katfile.com.

So I asked AI:

what is 213.152.176.198

ChatGPT said:

Here’s what I found out about 213.152.176.198:

Spoiler

Basic Details
Property Value
IP Range / Network 213.152.176.0/24 IPXO+2IPinfo+2
Organization Global Layer B.V. IPXO+1
Assignment Type ASSIGNED PA (i.e. provider-aggregated block) IPXO
Country Netherlands IPXO+1
City / Region Amsterdam / Noord‐Holland IPXO
Other Notes

• The block has no hosted domains listed for most addresses in the 213.152.176.0/24 range. IPinfo+1
  
  
• Reverse DNS tends to show "connected-by.global-layer.com" for many addresses in this block. IPinfo
  
  
• The WHOIS data indicates this is a datacenter / hosting / VPS type IP space. IPXO
  

If you want, I can check whether this specific IP is known for spam, abuse, etc., or see if it's been blacklisted. Do you want me to look into that?


You said:
yes

ChatGPT said:
I wasn’t able to find credible public reports or listings specifically for 213.152.176.198 confirming abuse or blacklisting.

Here’s a summary of what I found and possible next steps if you're investigating further:

What I Checked

• I looked through blacklists, spam/reputation check tools (like AbuseIPDB, Spamhaus, etc.) for that exact IP.
  
  
• No reports or evidence showed up for that address in the sources I checked.
  

⚠️ Context & Nearby Evidence
While that specific IP didn’t show up, there are many reports of abuse for other IPs in the same /24 block (213.152.176.0-255) owned by Global Layer B.V. in the Netherlands. That block shows frequent reports for attacks like web app probing, brute force attempts, port scanning, etc.

Since IP reputation often is considered by block/ranges, that can mean an IP in that block might inherit some “guilt by association” in certain systems.

Why It Might Not Be Listed Yet

• The IP might be clean or relatively idle so far.
  
  
• Or it may have had some dodgy activity but not enough to be captured or reported by major tools.
  
  
• Some blacklist/reputation services have delays or thresholds — you might need repeated reports or certain severity of behavior before listing.
  

⚙ Possible Next Steps If You Want More Certainty

1. Use tools like AbuseIPDB, Spamhaus, or other IP reputation services directly to query 213.152.176.198.
   
   
2. Check logs on your end (if you control a server) to see if that IP has been engaging in suspicious behavior (repeated failed login attempts, scanning, etc.).
   
   
3. If you see suspicious activity and control a network firewall or similar, you might consider temporarily blocking or rate-limiting traffic from it.
   
   
4. Monitor to see if it becomes listed. Some systems allow you to subscribe to notifications or reputation monitoring.
   

If you like, I can run a more in-depth scan (using less common / paid-source tools) for that IP to try to find anything deeper. Do you want me to do that?


You said:
it is purporting to be katfile.com

ChatGPT said:
Here’s what I found about Katfile + whether the IP 213.152.176.198 being used by something claiming to be Katfile looks suspicious.

✅ What is the “real” Katfile setup

• The domain katfile.com resolves (via DNS) to IPs in Cloudflare’s network (for example 104.26.1.222, 104.26.0.222, 172.67.74.63). TraceMyIP+2ip-lookup.org+2
  
  
• Cloudflare usually acts as a reverse proxy / CDN, so these are the “front” IPs that users see. mmoapi.com+2ip-tracker.org+2
  
  
• There is also evidence in certain tools of other IPs (outside the Cloudflare ones) being linked (e.g. behind-the-scenes or legacy) with katfile.com, including 213.152.176.195 in some DNS‐resolving tools. mmoapi.com
  

⚠ Why 213.152.176.198 is suspicious / possibly malicious
Given your note that this IP claims to be Katfile.com, here are reasons that suggest this claim is not legitimate:

• Not matching known Katfile front-end IPs: The primary public IPs used by katfile.com are those in Cloudflare, not in the 213.152.176.x block. If a site claiming to be Katfile.com is using 213.152.176.198, that is a red flag.
  
  
• “Behind Cloudflare” IPs vs exposed IPs: Sometimes sites try to hide their real infrastructure behind Cloudflare or similar services. If someone is exposing an IP address behind Cloudflare and claiming it’s official, it might be phishing / spoof / misuse.
  
  
• No reports so far of abuse specifically for 213.152.176.198 (from my earlier checking), but that doesn’t guarantee safety.
  
  
• Impersonation is a frequent trick: Some phishing or malware sites will mimic legit services in name, look, domain, etc., to trick users. Using an IP not matching the known ones is often part of that.
  

Verdict: Is 213.152.176.198 likely fake?
Yes — it’s very likely that a site at 213.152.176.198 claiming to be Katfile is not legitimately Katfile.com, or at least not the public, official front-end.

If you were considering using that IP or accessing something via it, I’d strongly advise caution.

 

I asked the servers for their headers, but the tool I used is old and doesnt support https, so the identification of the server OS is missing :

Spoiler

Initiating server query ...
Looking up the domain name for IP: 213.152.176.195
The domain name for the IP address is: connected-by.global-layer.com
Connecting to the server on standard HTTP port: 80
Impossible Error!: 10013

Initiating server query ...
Looking up IP address for domain: global-layer.com
The IP address for the domain is: 104.21.0.166
Connecting to the server on standard HTTP port: 80
Impossible Error!: 10013

Initiating server query ...
Looking up the domain name for IP: 213.152.176.198
The domain name for the IP address is: mail.katfile.com
Connecting to the server on standard HTTP port: 80
Impossible Error!: 10013

Initiating server query ...
Looking up IP address for domain: mail.katfile.com
The IP address for the domain is: 104.26.1.222
Connecting to the server on standard HTTP port: 80
Impossible Error!: 10013

The servers'IPs for mail.katfile are not the same when looked by IP or by domain name. This is weird, but I'm not competent enough in Internet stuff.

I find all this very suspicious.
Sending kind warnings to pedos isnt a bad move that makes a company look bad, it is confessing being part of an Interpol level crime. I dont see any company doing this.
When a file hoster is sued by , say Disney or Warner Bros, thay talk vaguely about 'illicit content', swear that they've been abused by uploaders acting against their explicit terms of use, and so on. They dont send mails to random users including a confession of siding with criminals and so becoming accomplices. And they would have done it to save some universally hated pedos who probably return a lot less money than warez downloads ?
Also, it sounds weird that the taiwanese police asked something like : "hey, could you pass us info about your pedo users ?", followed by "Ho, you dont want to ?! We'll force you to change your domain name extension, that will teach you !"
Blocking a domain name is what is done for intellectual property infringement, not for true crimes.

Something doesnt click ; the more I think about it, the less I'm buying it.

I didnt search in depth, but I dont see headlines about the katfile pedo scandal. I dont hear about taiwanese police asking for international action.
It could be that those mails have been send to a handful of users only, which makes some scam very plausible. It was previsible that some of the emails recipients would go public, as it happened here.
If the goal was to make katfile lose business, the operation has been fully successful.

 

So Katfile helps to protect pedophiles and predators, so they can continue to abuse kids.. and Katfile makes money from it....
Spreading images of raped kids... how fucking low as a human can you get!? I feel sick that there are people like this out there.

These kind of people are the worst humans on earth. Don't use their services, ban all links going to them.
Anyone protecting rapists and child molesters should be prosecuted as well. How can anyone NOT agree to this?!

It's one thing that someone uploads shit on your services that you don't know about, but another things to protect the rapists and be PROUD about it - so much that they even tell these pedophiles what to do to avoid being caught.

If they do not help with removing that shit they should be banned for sure.

 

No mistake there, but I take it that you don't know SMTP. That's fine, most people don't know it by heart. I do though, as I've maintained mail servers, which is not fun.

HELO dummy.com
MAIL FROM: <[email protected]>
RCPT TO: <[email protected]>
DATA


Note that none of that makes this any less suspect. Something seems to be going on with KF but the mail headers seem to be good though.

 

all of this does seem very sus. Does katfile have a customer service address? or social media page like insta, facebook etc? may be worth messaging them away from the email and "official" addresses. Maybe they are under attack and can shed some light on the situation.

 

there were cloud storage services in the past who were shut down because the FBI has evidence that the owners upoaded the child porn themselves. just as they do with mainstream movies, too.

providing content to pretend to be a "user uploaded content system" it is part of their business model.

if it would be a "problem" they could easily protect themselves from such "abuse" or "breach of contract" by cooperating with the police. or check for and delete such content themselves. but they do not do that, so they are the cause for such political demands, which then one day also might hit filesharing, civil rights activists, or the privacy and data security of small businesses or scientists.

that criminal activites are used as pretext to reduce civil liberties and control the net (esp. under dicatorship but not only there) is correct, but excluding federal crimes from your own refusal to reveal user identities to authorities would be actually of help here.

 

@wanderer well keep in mind theyre not accomplices by saying, “if you have illegal content on our site delete it” - though morally its gross in this context, theyre well in their right to do that as a company. theyre not confessing to anything being there by doing that, theyre sending out a notice to protect themselves - theyre also well in their right to not cooperate with an investigation by foreign law enforcement without warrant. announcing that also isnt illegal or makes them an accomplice, though yes is disgusting in this case

idk about the laws in Taiwan but that may be legally all they can do is have the site blocked if theyre not going to cooperate; especially if they dont have any proof to bring to a agency like Interpol, suspicion of something isnt enough for that

 

You've got some points but I think that interfering with a police investigation about such facts is a criminal offense.

Doing what katfile is supposed to have done would have been an incredibly stupid move from a business view point, with a totally predictable outcome.
Hacking is much more believable.