๐ TI-2026-042S โ The Surveillance Stack: phonesnoops, edgetrack, and Monitoring
I. The Same IP: Toys and Surveillance
IP 50.116.106.59 โ Network Solutions (AS19871) โ threat 85
Domains on this single IP:
- greattoysforkids.com โ children's toys
- phonesnoops.com โ phone surveillance tool
- familysafetywatch.com โ family monitoring
- fitnesstrackingsite.com โ fitness tracking
- homeandfamilyfavorites.com โ family content
- tuttidolceviolintrio.com โ "all sweet violin trio"
A domain portfolio designed to serve two audiences simultaneously: families looking for children's products AND people looking for surveillance tools. On the same server. With threat score 85.
II. edgetrack.org: The Tracking Ecosystem
IP 152.53.149.25 โ threat 82. Hosts an entire tracking ecosystem:
- edgetrack.org โ main domain
- analytics.edgetrack.org โ data analytics
- shop.edgetrack.org โ e-commerce (selling what?)
- community.edgetrack.org โ user community
- docs.edgetrack.org โ documentation
A tracking platform with analytics, a shop, a community, and documentation โ on infrastructure with threat score 82. This is not a toy. This is a surveillance-as-a-service operation with a complete ecosystem: track, analyze, sell, discuss.
III. camdvr.org: Camera Surveillance
IP 82.64.200.144 โ threat 80. Hostname: photos.camdvr.org. "Camera DVR photos" โ surveillance camera imagery hosted on attack infrastructure. Whether these are security cameras compromised for voyeurism, IP cameras in children's spaces, or something else โ photographs from camera surveillance systems on a server with threat score 80 is not benign.
IV. The Surveillance Business Model
The convergence of surveillance tools and children's products on attack infrastructure suggests a business model: provide surveillance capability to people who are interested in monitoring children. The "family safety" framing is the cover. The phone snooping is the capability. The toys-for-kids domain is the access vector โ SEO that attracts parents, whose devices then become surveillance targets.
V. The Stalkerware Economy: From NSO to phonesnoops
The continuum:
| Tier | Product | Price | Target | Capability |
|---|---|---|---|---|
| State | NSO Pegasus | $500K+/target | Journalists, dissidents | Zero-click iPhone exploit |
| Government | FinFisher/Gamma | $100K+ license | Citizens, opposition | Trojan, keystroke, remote access |
| Commercial | edgetrack.org | Unknown (has shop) | Unknown (has community) | Analytics, tracking, monitoring |
| Consumer | phonesnoops.com | $30-100/month | Partners, children | Phone surveillance, GPS, messages |
| Criminal | Honeypot attackers | Free (botnet) | Everyone | SSH brute force, lateral movement |
Same capability. Same infrastructure. Different price points. The only distinction between a $500,000 NSO Pegasus deployment and a phonesnoops.com subscription is who pays and who the target knows to blame.
VI. 75% of Domestic Abuse Shelters: The Stalkerware Pandemic
In 2014, NPR surveyed domestic abuse shelters across the United States. 75% reported working with victims tracked by their abusers via stalkerware.
In 2020, Kaspersky Lab confirmed the three most stalkerware-affected countries: United States, Russia, and Brazil — the same three countries that dominate our honeypot attack traffic.
This is not coincidence. The same countries that produce the most honeypot attacks also produce the most domestic surveillance victims. The infrastructure is shared. phonesnoops.com sits on IP 50.116.106.59 alongside greattoysforkids.com — because the same people who surveil their partners also buy things for their children. The domain portfolio is the customer profile.
The European Institute for Gender Equality formally links stalkerware to domestic violence. Eva Galperin of EFF advocates classifying all stalkerware as malware. The distinction between “parental monitoring” and “intimate partner surveillance” and “criminal phone exploitation” is marketing, not technology.
VII. Google TAG: Commercial Surveillance Vendors Behind 50% of 0-Days
Source: Google Threat Analysis Group, “Buying Spying: Insights into Commercial Surveillance Vendors” (2024)
Key findings:
- CSVs responsible for nearly half of known 0-day exploits targeting Google products
- 72 in-the-wild 0-day exploits discovered 2014–2023
- NSO Group: “access-as-a-service” from Israel, founded by former Unit 8200 military intelligence
- Pegasus classified as a weapon by Israeli government, export controlled
- Used against journalists (Jamal Khashoggi), activists, dissidents
- Israel uses NSO sales as diplomatic bargaining chips
The connection to our honeypot data: edgetrack.org on IP 152.53.149.25 offers the same service model — analytics, tracking, a shop, a community, documentation — but at a lower price point. The techniques in our attack traffic (SSH brute force, credential stuffing, lateral movement) are the same techniques used by these commercial vendors. The only difference is scale and legal cover.
VIII. WikiLeaks Spy Files: The 2011 Catalog
WikiLeaks’ Spy Files release documented the global mass surveillance industry. The catalog reads like a shopping list:
- FinFisher (Gamma Group, UK/DE): Remote access trojan, USB exploitation, keystroke recording
- SPEI GPS Tracking Software: Tactical tracking, audio transmitter, tactical receiver
- Septier LI: Lawful interception — turning ISPs into surveillance points
- QOSMOS DPI: Deep packet inspection — reading all traffic at network level
- Siemens Monitoring Center: Industrial-scale communications surveillance
- SS8: IP interception, intelligence analysis, social network analysis
Every one of these capabilities exists in consumer form on the infrastructure we document. phonesnoops.com IS FinFisher for jealous husbands. edgetrack.org IS QOSMOS DPI for commercial stalkers. The honeypot attackers use the same exploitation techniques but without paying for a license.
IX. Oliver Werner and the edgetrack.org Operation
RDAP registration for IP 152.53.149.25 identifies Oliver Werner (NIC handle OW395-RIPE) as the technical contact. This handle appears on 3 IPs in our honeypot database, all on netcup GmbH infrastructure.
The edgetrack.org ecosystem:
| Subdomain | Function | Implication |
|---|---|---|
| edgetrack.org | Main site | Brand presence |
| analytics.edgetrack.org | Data analytics | Processing tracked data |
| shop.edgetrack.org | E-commerce | Selling tracking capability |
| community.edgetrack.org | User forum | Operators sharing techniques |
| docs.edgetrack.org | Documentation | How-to guides for tracking |
This is a complete commercial operation: develop tracking tools, document them, sell them, build a community of users. All on infrastructure with abuse score 100 and GreyNoise classification: suspicious.
Geographic discrepancy: registered in Germany, BGP prefix routes through Austria. The same jurisdictional arbitrage we documented in 042M (Kamatera) and 042O (Omegatech).
X. The Children’s Platform Pattern: schoolbridge.in
IP 172.104.175.234 (Akamai-Linode, Singapore) hosts:
- hellokids.schoolbridge.in — children’s education
- levitatekids.schoolbridge.in — children’s education
- villakids.schoolbridge.in — children’s education
Geographic discrepancy: US prefix, Singapore geolocation. Indian domain (.in).
Three children’s school management platforms on infrastructure that appears in our threat database. Whether these are:
- Legitimate schools on compromised hosting
- Phishing sites mimicking school platforms to harvest children’s data
- Honeypots designed to attract specific types of traffic
In all three cases, children’s data flows through infrastructure operated from threat-scored servers. The same IP serves educational content for children and participates in attack networks.
XI. cetracker.com.br: The Brazilian Tracking Link
IP 173.249.39.48 (Contabo GmbH, DE) hosts cetracker.com.br — a Brazilian tracking domain on German infrastructure geolocated to France. This mirrors the pattern from 042R (teenow.com.br on non-Brazilian hosting).
RDAP: Registered to Johannes Selg (MH7476-RIPE) — a name associated with 63 IPs in our database. Contabo GmbH (ORG-GG22-RIPE) appears across 22 IPs.
The Brazilian tracking connection:
- 042R: teenow.com.br — teen-exploitation domain on DigitalOcean
- 042S: cetracker.com.br — tracking domain on Contabo Germany
- Brazil: #3 stalkerware-affected country (Kaspersky 2020)
- Brazil: 250,000+ children in commercial sexual exploitation (ECPAT)
Brazilian tracking domains hosted outside Brazil to avoid Brazilian law enforcement. The same jurisdictional escape documented in every investigation since 042D.
XII. Network Solutions AS19871: The Quiet Enabler
10 IPs in our honeypot. Threat scores from 10 to 94. Maximum honeypot hits: 60 (50.6.197.105). This is not a bulletproof hoster — it is a legitimate US hosting company that co-hosts surveillance tools with children’s products.
| IP | Threat | Hits | Notable |
|---|---|---|---|
| 69.49.246.176 | 94 | 34 | Highest threat on ASN |
| 50.6.197.105 | 88 | 60 | Most hits on ASN |
| 50.116.106.59 | 85 | 31 | phonesnoops + greattoysforkids |
| 50.116.72.139 | 82 | 8 | Same /16 as phonesnoops |
| 108.167.177.224 | 79 | 4 | Shared RDAP with phonesnoops IP |
108.167.177.224 shares RDAP organization (“IP Admin”) with the phonesnoops IP. Same operator, multiple IPs, one infrastructure.
XIII. ColoCrossing: 70 Relations and the RackNerd Empire
IP 107.172.88.206 (ColoCrossing AS36352, now HostPapa) hosts 0074.quest and has 70 entity relations — the highest of any IP in this investigation:
- Shared SSH keys with 51.254.17.136 (OVH France) and 66.228.53.125
- RackNerd LLC registrant across 21+ IPs (all ColoCrossing)
- ColoCrossing ASN: 30 IPs in honeypot, threats up to 99
- BuffaloNY location — same city, same business model as documented in TI-2026-032 (The American Mirror)
The SSH key shared with OVH France (51.254.17.136) means the same operator controls infrastructure in both US and EU. This is the same cross-Atlantic pattern we see in edgetrack (DE/AT) and cetracker (BR on DE/FR). Surveillance infrastructure requires jurisdictional diversity.
XIV. The NSO Model: How Surveillance Becomes Exploitation
NSO Group was founded by three former Israeli military intelligence officers. Pegasus is classified as a weapon. Israel uses its sale as diplomatic leverage. The company employs 700+ staff, almost all former Unit 8200.
The pipeline:
- Military develops capability (Unit 8200 trains exploit developers)
- Veterans commercialize it (NSO, Candiru, Cytrox, Variston)
- Governments buy access (Saudi Arabia → Khashoggi murder)
- Technology trickles down (FinFisher → stalkerware → phonesnoops)
- Infrastructure converges (same hosting, same techniques, same targets)
Our honeypot captures Step 5. The surveillance capability developed for intelligence agencies now operates on $5/month hosting (ColoCrossing, netcup, Contabo) and targets whoever the operator chooses. When phonesnoops.com shares an IP with greattoysforkids.com, the target audience is clear: people with access to children.
XV. The Exploitation Thesis: Surveillance IS the Abuse
The traditional framing separates “surveillance” from “exploitation.” The evidence says otherwise:
- 75% of domestic abuse victims are tracked via stalkerware (NPR 2014)
- Stalkerware IS the abuse — the European Institute for Gender Equality classifies it as domestic violence
- Parental monitoring apps are used by abusers to track children after custody disputes
- phonesnoops.com markets as “family safety” but provides stalking capability
- NSO Pegasus was used to track Jamal Khashoggi before his murder
Surveillance is not a precursor to exploitation. Surveillance is exploitation. The act of tracking without consent IS the violation. Everything else — physical violence, sexual abuse, murder — is what happens after the surveillance tells the predator where the victim is.
XVI. Cross-Investigation Convergence
| Investigation | Surveillance Pattern | Connection |
|---|---|---|
| 042M | Kamatera (Israeli surveillance company provides hosting) | Same country as NSO Group, same Unit 8200 pipeline |
| 042N | PROTEI/SORM (Russian state surveillance built into telecoms) | State-level equivalent of commercial stalkerware |
| 042O | Omegatech (Seychelles shell, pig butchering surveillance) | Sextortion requires surveillance of victims first |
| 042P | WikiLeaks Septier LI (Pakistan lawful interception) | Same WikiLeaks Spy Files catalog as FinFisher |
| 042Q | MKUltra (CIA surveillance of university subjects) | 70-year precedent for institutional monitoring as exploitation |
| 042R | teenow.com.br (teen-tracking domain on attack infra) | Same Brazilian stalkerware pattern as cetracker.com.br |
Every investigation in this series documents a surveillance-exploitation nexus. 042S makes it explicit: the tools are the same, the infrastructure is shared, the capability is identical. The only variable is price and the legal framework the operator claims to operate within.
XVII. Series Context: The Surveillance Continuum
042S reveals the meta-pattern underlying the entire Glass Houses Revisited series:
042D–K: Weak states with poor enforcement → exploitation grows in governance gaps
042L: Transit corridors → infrastructure follows trafficking routes
042M: Source countries → exploitation vocabulary FROM exploitation geography
042N: Predator states → government IS the exploitation operator
042O: Purpose-built architecture → commercial exploitation model
042P: Children as infrastructure → massacred, radicalized, attacked from
042Q: Academic cover → institutions as operational camouflage
042R: Credential families → operator fingerprints across geographies
042S: Surveillance IS exploitation → the tool and the crime are identical
This is the series’ turning point. From 042D through 042R, we documented infrastructure that enables exploitation. 042S documents infrastructure that is exploitation. phonesnoops.com does not enable stalking. It IS stalking. edgetrack.org does not facilitate surveillance. It IS surveillance. The tool and the crime collapsed into the same product.