Arthur Fernandez Barbosa born January 19th, 1972 making him 52 at the time of writing. Not Much is known about Arthur except some details that were obtained from the Brazilian Government's Citizen Database. What is known is Arthur runs a profitable Child Abuse Ring under a few different aliases most notably: ArtBBS. Unfortunately this blog entry is a Full Disclosure Post and not something we actually enjoy having to write. We wished to do this post-arrest of Mr. Barbosa and more specifically post-sentencing the issue is that's becoming more of a dream then a reality. Here at Evil Rabbit Security We do not dream of things. We Achive greatness and this what we felt was the best course of Action. The United States Federal Bureau Of Investigation as well as the Brazilian Federal Police have been made aware of Arthur's many crimes and yet have failed to act accordingly. We say they've failed on the grounds that Operation Pacifier from the moment they identified the Administrator and Infrastructure was taken down in 13 days.
I find no different then Task Force Argus taking down the Love Zone nor any other operation that involved Infra being discovered by law enforcement in the past 20 years. It is embarassing and quite frankly disgusting we had to alert the general public to a large child pornography ring since it would seem since August of 2023 the FBI & it's partners have failed to respond to several larger dark net operations including "Alice In Wonderland" "Xonions" and "The Exchange" Without the assistance the FBI would not have gained a foothold in half a dozen dark web child exploitation websites including the likes of "KidFlix" "Alice In Wonderland" "Xonions" "The Exchange" and several others we don't actually have names for. We'll discuss how exactly we gained a foothold and passed it along later in this blog entry as it was not fucking complex whatsoever. This will be a full disclosure entry out of disappointment for Law Enforcement so we appologize in advanced.
As you can see I had to redact some parts of the image for legal and privacy reasons but the forum arthur runs focuses on mostly girls aged 14-17 Years old with the ocassional legal thread but as to be epexected not everything is as it seems, Arthur's "Friend Sites" are ran by himself and this is verified in several differnt ways. We won't discuss that just yet but we'll discuss some other cases websites going forward. For Legal reasons I will not publish to domain. I am very aware it would not take much to discover the website in any capacity. But how did we discover this website and where exactly is it being hosted from?
That's all questions I'll answer in the best of my abilities. In June of 2023 me and a friend were messing with cenys and did a keyword search for I believe the dark web, Following some rather good hits on Shodan (This will be discussed in the History of Online Child Abuse Entry in depth). During a censys search we tossed another keyword in and walked out with 38 results the number is now in the low 40s e.g. 43 results. Regardless this specific entry was interesting all but one instanse was not state side.
You may notice the IP server is located in Florida (In fact it's very close by to me) regardless let's not focus on the Location but rather the domain ending in .com.br now the picture I used here is well, Arthur's Facial Sketch. But it's a little interesting how we found it. In January of 2024 we did some digging into the administrator's username. "ArtBBS" which we first came across his github page which Artbbs here was Just so wonderful as to provide us with a lot of data to work with.
I'm absolutely sure everyone just face palmed reading his github page. For those who dunno anything Artbbs's page has a "Location" enable so, as you see it Says Brasilia. Which if we recall the server in florida ending in .com.br we should be able to guess that Arthur is Brazillian since BR is the 2-letter code for Brazil =) but I know my "Fan Club of Haters" will try and defend Arthur and claim I suck at OSINT so, let's go back and make them look ignorant.
The Big F***ing mistakes
As to be expected with pedophiles, Arthur would make several mistakes and it would allow us to map out an accurate timeline. 2 Key Databreaches will be used as "time posts" or a means of setting a timeline of events across 2 different events. These 2 being the Adobe Databreach & The Duolingo Datascrape occuring around a decade apart giving us an accurate timeline
October 3, 2013: The Adobe Data Breach
The databreach exposed 152,445,165 sets of credentials including Email addresses, Password hints, Passwords, Usernames and according Have I been Pwned (HIBP) the encryption of passwords was done poorly to a point that many more were reversed and the password hitns were also not encrypted making it a bit easier to guess based on other data sources. However one single set of credentials was exposed and that belonged to a man using the email: artbbs at hotmail dot com however there is no "personal PII" Just usernames and passwords so nothing is found here other than it's been an email he's used since 2013 at the very earliest
January 24th 2023: The Duolingo Datascrape
2,676,696 were exposed during the attack that was carried out by enumerating a vulnerable API and the breach data contained: email addresses, names, the languages being learned, XP (experience points), and other data related to learning progress. There was a specific juicy tidbit here I want you to focus on: "Names" Arthur has in at least 2 different cases shown a lack of good operational security aka "OPSEC" and this leads to him making some pretty bad mistakes leading to him being known as the actual administrator and this scrape is one such occurance.
The 2021 Stealer Logs Logs
I Honestly love pissing off the haters telling me "I'm lying" about someone being a pedo when it's clear as day to everyone such is the case so this is a knock out punch for any of the critics and my fan club I call the "Merry band of idiots" who deny my work but here's that not working out for them. First up: Arthur gets pwned and everything hangs out except well you know.
Them credentials
Lolita City credentials
With obvious reasons for redactions I did leave out a speciifc thing in all the entries: Artbbs & gapa1972 remember how I said Arthur was born January 19th, 1972 yeah does it perhaps make a little more sense? Why he'd look like a middle aged man, and have a password that has a year of birth? Well I know there's still some fence sitters. Sure, you got some circumstancial evidence that ties the two together but this isn't the worst mistake remember how he "LOVES BRAZIL" so much he has a .com.br domain and Brasilia in his GitHub page? Yeah well great
Arthur's Network of Pedophiles
WARNING: Redactions are made for legal & privacy reasons. No Links are present, No victims are identifable/viewable
Below will be some screenshots and no commentary until all the images are presented to you the reader as there's some other things I wish to discuss but for now I need you outraged with this unacceptable problem that has grown since 2013. I will name drop the sites but expect 0 links to be visable in any of the screenshots presented I also blurred the faces and any likeness of any victims.
Bunnyland
Absolute Teens
Sexy File
A Modern Day Sex Slave Trade
Now, why do I show you a very select amount of sites? Surely they can't be worse? Except they do, Now look for your own sanity and my freedom I ain't speaking any further on "How Bad" something gets on those sites. Now, I have to attend another therapy session but worth it. Now I guess you're wondering why don't Registars or Hosting Providers do anything? Simple: None of the CSAM is hosted on the host/website itself. Therefore they're usually unwilling to act either that or they'll referr your complaint to the fucking administrators and alert them to being "identified" by someone who ain't having none of that shit. I Believe it shall be illegal to be lazy and inform a client of illegal content if the entire website is being used to commit a crime. However it never ends does it?
The next issue revolves around: "File Sharing Services" in total I've counted ~200 or so sites. If you need to know what services are common leechlisting dot com is the essential "go-to" for learning about all the file sharing services offering a "Free or low cost access to premium file sharing services" And, yes you can use leech listing for very limited samples of contents of these sites now I have scraped 2 websites and I can assure you the majority of files exceed the daily threshhold of allowed data transfers by a long shot.
But... How do you know that?
The simple answer is: I scraped the forums and viewed the majority of all leech services most cap Emload (One of the most popular) at 300 MBs/day meaning you'd never be able to download more then 3-4 videos out of the 7 files allowed daily before running into "traffic limits"
You scraped the forum say what?
Indeed, I did in fact scrape 2 forums here's some stats
You may have noiced the time.py script shows there's only 3.4 TBs this is due to how the script is setup, It's not capible of ripping data from other formated entries and it only indexes around 2-3 people out of around 60 users who engage in posting. The 2 sites combined have around 24,000 members. However the true amount of files is seen in the second picture. It is exactly 3,679,852 or three million, six hundred seventy nine thousand eight hundred fifty two files and there is absolutely no dubplicate entries. This was 2 forums and mind you it's not the "Full Picture" site one (Bunnyland) was not fully scraped. It did not focus on Jav or any other content outside of the teen videos and teen pictures subforums. However both sites also did not access the forbidden area of the forum due to obvious legal reasons which involves "paying to view prohibitted content"
WHERE'S THE F***ING FEDS?
Great Fucking question, as I said earlier they're seemingly not fucking interested. Now we can tell you Arthur's made around $40k selling access to the prohibitted areas of the forum but that's not surprising is it? No. As we said with their recent "spring to action" behavior you'd expect more vigor when it comes to children... or not. Seeing how they waited to all the Epstine Victims turned 18 and became essentially excempt from seeking Justice in a criminal court but you know how shit goes. However with Operation Pacifier the identified infra and lunged within a week, had the site offline after 13 days and it's really annoying that it takes this long to lunge and kill this monster but of course here I am on a early monday morning writing this. This isn't Project Spade and there's no viable excuse for this long time frame. Arthur's Infra is STILL, LEMME REPEAT THAT: STILL THE SAME INFRA FROM LAST FUCKING AUGUST (2023). Now, Arthur was identified in early January (2024) up until a 2 months ago I never really spoke about him and i got tired of waiting we know where he lives, we have his National ID, Phone Number, Court Records the whole book of dirty secrets and a bag of chips. Brazil's Federal Police are aware, The FBI is aware, USSS is aware, The Brits are aware the fucking Chinese, Dutch and etc are all fucking aware but nothing is done
Closing Notes
Honestly this case was my most notable one, However the OSINT was straight forward. Honestly I am kinda disappoited it took this long to do this blog entry and showcase the extent of Arthur's empire and by no means did I do my "absolute best" truth is this shit is exhausting and I have other parts of the website to update. I'll return and leave a changelog/updates pinned to the front page that way you'll always be able to check if or when I update a page. Arthur's empire overflows into really bad topics including sexually assualting newborns and I honestly didn't wanna have to tell you the extent of his depravity but with the feds not doing shit for a decade I figured I'd do the public a service and well
SHOW YOUR TAX PAYER DOLLARS BEING WASTED
Oh, Before you go have a bit of a rhyme
Remember, Remember Arthur's an Offender, who's balls will be put in a fucking blender
Pavel the BDSM Rope Bunny over & out