[macic]

AnonFiles was very sketchy. They had extremely generous file size limits and were apparently funded completely through donations. On their footer they linked to other file sharing sites, which linked to even more file sharing sites. All of them had the exact same layout and generous file size limits. They also shared the exact same IPs. There were around 15 of them. A lot of them impersonated other defunct file sharing websites which shut down such as MegaUpload. All of these sites are now offline. Make of this what you will, but to me it sounds like a honeypot.

[toyg]

>Make of this what you will, but to me it sounds like a honeypot.

You say honeypot, I say free government-provided cloud storage, w00t!

[xcdzvyn]

Considering the plausibility of people downloading CP from government run sites over a government run anonymity network from a government run file host is interesting.

[fragmede]

Supposedly, one of the biggest distributors of CSAM is US military networks. If you have access to them, you're not supposed to go trawling around just looking being curious because there's officially "need to know" stuff out there (and you don't need to know). Which makes it a great place to hide that sort of stuff.

[CobaltFire]

I can’t speak to that generally, but in my anecdotal experience in 22 years in the US Military (in IT for most of that):

I dealt with one case that was completely horrific, and two minor. The horrific case involves the PRODUCTION of CP using other service members children via the spouses daycare, then distribution from our network. The other two were relatively simple storage/redistribution via workstations.

It happens, but from my viewpoint if it’s that rare it must be extremely rare elsewhere if your statement is true.

[Ms-J]

It's true about the mil networks. Also, the US gov is one of the largest provider and host of CP with their honeypots.

[toyg]

Take that logic and apply it to narcotics and South American geopolitics, and some interesting things come up.

[smsm42]

That's a pretty routine thing. Remember how the government sold arms to Iran, or facilitated drug trade in Central America, or trafficked firearms for Mexican cartels? It's different when they do it, because they are the good guys.

[editional]

Agreed. The moment i saw AnonFiles i was out of there, even considered uploading the declaration of indepence in pdf form to get my social credits up.

I dont know where the servers were, but i feel like it was used for less lovely purposes by the owners and a lack of identifiers & internet curated mess would obfuscate law enforcement's efforts

Edit: my theory however falls flat if there were multiple websites, since having a one large database would be in their best interest. You could argue that there were multiple entities self-hosting the same thing, but why would they link to eachother? Coupled with the VPN ad, sounds like data harvesting all around (honeypot or not)

[duskwuff]

> Edit: my theory however falls flat if there were multiple websites, since having a one large database would be in their best interest.

If they're all hosted on the same server -- which, to all appearances, they were -- there's little practical distinction.

[duskwuff]

I did a bit of digging; here's a full list of the associated sites I was able to find:

- https://web.archive.org/web/20230801/https://anonfiles.com/

- https://web.archive.org/web/20230801/https://bayfiles.com/

- https://web.archive.org/web/20230801/https://file.bz/

- https://web.archive.org/web/20230801/https://filechan.org/

- https://web.archive.org/web/20230801/https://forumfiles.com/

- https://web.archive.org/web/20230801/https://hotfile.io/

- https://web.archive.org/web/20230801/https://letsupload.cc/

- https://web.archive.org/web/20230801/https://lolabits.se/

- https://web.archive.org/web/20230801/https://megaupload.nz/

- https://web.archive.org/web/20230801/https://myfile.is/

- https://web.archive.org/web/20230801/https://openload.cc/

- https://web.archive.org/web/20230801/https://rapidshare.nu/

- https://web.archive.org/web/20230801/https://share-online.is...

- https://web.archive.org/web/20230801/https://upload.st/

- https://web.archive.org/web/20230801/https://uplovd.com/

- https://web.archive.org/web/20230801/https://upvid.cc/

- https://web.archive.org/web/20230801/https://vshare.is/

- https://web.archive.org/web/20230801/https://zippysha.re/

All of them were hosted by a single IP in svea.net, with a couple of associated IPs at the same host for "cdn##" subdomains.

[loosescrews]

I looked through the internet archive and it looks like this started on June 20th, 2022: https://web.archive.org/web/20220620143322/https://anonfiles...

There never appeared to be more than a few at a time and I did not find too many in total.

https://web.archive.org/web/20220620143327/https://bayfiles....

https://web.archive.org/web/20220623051910/https://openload....

https://web.archive.org/web/20220620170814/https://myfile.is...

https://web.archive.org/web/20230401012418/https://filechan....

https://web.archive.org/web/20230401012318/https://letsuploa...

They also started advertising ovpn.com as a "court-proven VPN" on June 23rd 2022: https://web.archive.org/web/20220623173752/https://anonfiles...

It looks like from June 24th 2022 through August 10th 2023 (or 16th, likely whenever they changed their index to announce the shutdown) they only listed filechan.org and letsupload.cc.

On July 4th 2022 they dropped ovpn.com: https://web.archive.org/web/20220704154732/https://anonfiles...

All of the file sharing sites listed do appear to be parodies of other popular websites, some of them file sharing. They also appear to all be identical except for the site name and styling. All of the file sharing sites except for anonfiles.com now return NXDOMAIN. (ovpn.com appears to still exist.)

The obvious parodies of file sharing websites does call into question their assertion that they didn't want abuse.

[tgv]

It does sound fishy, but why a honeypot? Why not a place to hide traffic? With populair large up/downloads, it's practically impossible to trace all of it. Or perhaps it was a communication board for some shady, rich organization.

[Fnoord]

My take is a RU honeypot who couldn't pay their bills anymore due to 'circumstances'.