Feds Used an IP Logger to Catch a Pedophile
A 47-year-old man from Dwight, Nebraska, was sentenced to a total 500 months in prison for production and possession of child pornography. The defendant shared thousands of self-produced child abuse content on various chat rooms and darkweb forums.
According to an announcement by the U.S. Attorney’s Office District of Nebraska, the investigation against 47-year-old Michael Dean McCullar began in February 2019. Homeland Security Investigations (HSI) Special Agents in Omaha started the investigation after they received a lead regarding the possible production of child pornography by a suspect in Dwight, Nebraska, from agents in Massachusetts.
The Boston agents were investigating individuals using darkweb forums and chat rooms to discuss and exchange child pornography images and videos. During the course of the investigation, the agents came across McCullar who was sharing self-produced child abuse images and started messaging him on an undisclosed platform (based on other information available, it appears as if law enforcement first made contact over Ricochet). McCullar sent an undisclosed number of child pornography images to the agents.
It was during conversations with McCullar–who used the name “dadotlolibaby” online–that investigators obtained the defendant’s IP address.
From the plea agreement:
“[T]he individual using the screen name “dadotlolibaby” engaged in a conversation with an undercover officer regarding the sexual abuse of children and their “mutual” likes of pornography available on the open web. During the course of this conversation, the undercover officer provided the individual using the screen name “dadotlolibaby” with a URL that was created using the IP Logger service. An IP Logger is a free and publicly available service that will provide the IP address of an individual that visits the URL as a method to identify the IP address of the computer user. On February 7, 2019 17:37:23 (EST), the link sent using the IP Logger service was accessed indicating that the individual accessing a particular website was doing so using the TOR browser.”
The plea agreement described the investigation
And after obtaining the IP address, according to court documents, they grabbed it one more time:
“On February 8, 2018, HSI Boston agents sent a summons to Windstream Communications requesting the account details of the individual assigned IP address 75.88.41.114 on February 7, 2019 17:37:54 (EST) and February 7, 2019 17:48:33 (EST). On February 8, 2019, Windstream Communications provided the information that the user assigned that IP address was the Defendant with a residential address in Dwight, Nebraska. A check of the Butler County, Nebraska assessor’s office found Defendant and his wife own the address referenced by Windstream”
In late February, the agents executed a search warrant on McCullar’s residence and established that McCullar was on a business trip in Tampa, Florida. The agents went to Tampa, arrested McCullar, and took him back to Nebraska. The agents seized McCullar’s electronic devices and recovered more than 30,000 child pornography images and 1,500 videos. On being questioned the defendant admitted that he produced and shared the child pornography images.
Defendant stated he created the “dadoflolibaby” username approximately IO years ago. Defendant accessed the internet through the TOR network, a means and facility of interstate and foreign commerce. Defendant said the reason for creating this account was to browse for child pornography. Defendant stated he had an account in a dark web forum called, “BabyHeart.” Defendant stated he recently started using, Ricochet, a chat function on the TOR network, to communicate with an individual with the username “NorthernDad.”
On February 19, 2020, Chief United States District Judge John M. Gerrard sentenced McCullar to 360 months in prison for production of child pornography and 140 months for possession of child pornography. The judge also ordered McCullar to pay $154,136 in restitution and assessments of $30,200. In addition to registering as a sex offender, the defendant will be placed under supervised release for the rest of his life after being released from prison.
As some have pointed out in the comments, there is likely much more to this story than we know. How did an IP logger grab the actual IP address of someone using the Tor Browser?