🏠 TI-2026-042M — The Indonesian Triangle: CloudHost, Kamatera, and daddygirl2

I. The daddygirl2-eyecandy Proof

II. CloudHost: The Intersection Point

CloudHost Pte Ltd (AS138608, Singapore) hosts:

One cloud provider hosts: a girl exploitation domain, Middle East financial fraud, a Saudi sovereign wealth fund impersonation, an Indonesian Islamic school, AND the IP that sends daddygirl2. This is not a hosting provider with diverse clients. This is an infrastructure provider for a multi-faceted operation.

III. misraudlatulislam.sch.id — The Second School

On CloudHost infrastructure: misraudlatulislam.sch.id — an Islamic school in Indonesia (.sch.id is the official Indonesian domain for schools). Threat score 68. On the same provider as girlallaroundx.site and the daddygirl2 IP.

SchoolBridge.in has 60+ schools on a compromised server (042C). Now we find a second school — an Islamic school — on the same provider that hosts exploitation domains and exploitation credentials. Different country. Different religion. Different platform. Same provider. Same pattern.

IV. The Indonesian Context

Indonesia is the world's largest Muslim-majority country (275 million people). It has documented trafficking problems — the US State Department's TIP Report consistently identifies Indonesia as a source, transit, and destination country for trafficking. Indonesian children are trafficked for both domestic servitude and sexual exploitation.

CloudHost operates from Singapore but serves Indonesian clients. The .sch.id domain proves the school is Indonesian. The provider bridges Singapore's financial opacity with Indonesia's trafficking vulnerability. This is geographic arbitrage applied to exploitation infrastructure.

VII. The Credential That Names Itself: daddygirl2

Before we discuss infrastructure, we discuss the word.

The FBI Intelligence Bulletin (31 January 2007, Cyber Division, Innocent Images National Initiative — available in our OSINT Library) documents:

"Pedophiles, to include those who sexually abuse children as well as those who produce, distribute, and trade child pornography, are using various types of identification logos or symbols to recognize one another and distinguish their sexual preferences."

Symbols. Logos. And language. The credential daddygirl2 is that language — used not on a forum, not in a chat, but in an SSH authentication attempt. The operators carry their identity into their technical work.

VIII. Three Countries, One Credential

root:daddygirl2 appears in our honeypot from three IP addresses:

Indonesia. United States (Israeli-owned). Vietnam. Three countries. One credential. This means a shared credential list — distributed among operators who share the same vocabulary, the same tools, and the same targets. The credential was not independently invented three times. It was distributed once and deployed across multiple jurisdictions.

IX. Indonesia: Where Children Disappear

The United States Department of State Trafficking in Persons Report classifies Indonesia as a source, transit, AND destination country for trafficking in persons — the worst possible triple classification:

This is the country where 103.250.11.118 sits — the first source of daddygirl2. An Indonesian IP with Singapore ASN registration (geographic discrepancy). The same country where children's birth dates are falsified by recruitment agencies also produces SSH credentials using child exploitation vocabulary. The infrastructure and the exploitation share operators.

X. The OSINT Library Evidence: Sex Slaves, 48 Countries

Our OSINT Library contains "Sex Slaves: Human Trafficking" (Jennifer Regan-Sachs), documenting trafficking operations across 48 countries:

XI. Kamatera: The Israeli Architecture of Opacity

The second source of daddygirl2 is IP 138.128.240.172 — owned by Kamatera Inc. (AS36007). Kamatera is not Indonesian. Kamatera is Israeli.

Israeli ownership. US registration. Netherlands subsidiary. 24 global data centers. 7+ companies under one parent. This is not a hosting company — this is a jurisdictional architecture. The same structural pattern that Epstein used (private islands, offshore companies, multiple jurisdictions) but applied to digital infrastructure.

The EU Parliament's 2022 Pegasus Investigation (in our OSINT Library) documented how Israeli surveillance technology — from the same ecosystem of Unit 8200 alumni — was exported to authoritarian regimes who used it to target journalists and activists. Pegasus "can take control of the targeted device and make use of its functionalities." Israel exports both surveillance capability AND hosting infrastructure. The same national tech ecosystem produces tools to watch people AND tools to hide from being watched.

XII. The Triangle: Indonesia → Israel → Vietnam

Three points of a credential distribution network:

XIII. CloudHost and Lintasarta: Indonesian Attack Infrastructure

Beyond the daddygirl2 credential, Indonesia hosts substantial attack infrastructure:

State telecom. Enterprise ISP. Private hosting. All three tiers of Indonesian internet infrastructure participate in attack operations. The same networks that Indonesian citizens use — that trafficking victims' communications traverse — carry attack credentials including exploitation vocabulary.

XIV. The Virginia Giuffre Pattern: Jurisdictional Arbitrage for Exploitation

Our OSINT Library contains the Virginia Giuffre biography documenting Epstein's operations:

"She was the best at procuring young girls for him. On their last night on Little St James, they went over to neighbouring St James island where Epstein suggested they go to a club and see whether they could pick up..."

The Epstein model: multiple jurisdictions + corporate opacity + extreme wealth = exploitation without accountability. Private islands (US Virgin Islands), offshore companies (multiple), international travel (UK, France, Israel) — all designed so no single authority has complete jurisdiction.

The Kamatera model is structurally identical:

• Israeli ownership (OMC Group, Azulai brothers)
• US registration (liability shield)
• Netherlands subsidiary (EU data protection as opacity tool)
• 24 data centers (dozens of jurisdictions)
• 7+ subsidiary companies (corporate complexity)

Different medium. Identical architecture. One exploits children across physical jurisdictions. The other provides hosting across digital jurisdictions — and carries the credential daddygirl2 on its infrastructure.

XV. Convergence: Why Trafficking Countries Host Exploitation Infrastructure

This is not coincidence. This is functional convergence:

XVI. Sources and Methodology