An Illegal Dark website called ElHerbolario that sells Cannabis drug Leaked its secret server IP address online due to poor server configuration made by their server admins.
The Darkweb, invisible web, or hidden web are parts of the World Wide Web whose contents are not indexed by standard search engines for any reason.
This part of the Internet is known as the Deep Web, and it is about 500 times Bigger than the size of the Web that we know.
Also Read: Mysterious Deep Web : Secrets from the Dark Side of the Internet
In this case, Leaked original IP Address leads to track the original site owner and seize the server and later Law enforcement will be playing against the owner.
This Drug selling Dark Website is an intermediate seller so that possible rate of doing illegally selling things like this type of Cannabis drug is obvious one.
This Dark Website is highly rated one Even though this belongs is Darkweb site that makes researcher go into a deep investigation.
How Does the Investigation go on – Dark Website
Initially, Researcher starting the investigation by checking the String of ElHerbolario which is the name of this illegal website.
Later To find the content management system (CMS) for this site, he was checked by applying the “wp-admin” at the end of the URL which is unique to a WordPress site. but the attempt was failed due to the admin of the site ower disabled the wp-admin login form link.
Later Right click on it and click on “Investigate Element” to open the Network tab and reload it.The status is 200. 200 because Riku was sent to when you reload es means that capital was normal. So, it means that a folder called / wp-content / existed.
According to Researcher, So it was confirmed that owner of this site was using WordPress.The reason why we wrote about this folder is that in the same way, the database leaked out due to mistakes in folder permission setting on another drug seller’s site in the past.
German #darknet drug store, directory listing exposing SQL backup. #opsec fail 😱 h/t @Sh1ttyKids pic.twitter.com/iNhTCynASz
— x0rz (@x0rz) September 27, 2017
In this case, he felt that E and L Seem unnatural, later he found that it means a herbalist in Spanish.so he confirmed that the person who built this server is a person who is related to Spain.
Later investigation revealed that website Server is NGINX and OS use Debian. But IP Address didn’t find in this area.
Last but not least, we do have a deep search Engines to find some mysterious things that we cant get it on google.
So he used one of the deep web Search engine called  Censys and search by using the characteristic word ElHerbolario.
There is “El Herbolario Personal Shop” on the top of the results in Dark Website list. and its shows the IP Address of the website.
Later by checking the IP address to confirm the original site of the IP, it has been checked with Tor Brower.
Finally,  DDoS attack was found that it is a mirror server to be used when subjected to. In addition, the server uses Blazing fast.
This is famous as a bulletproof server. As you can see there are other uses of Debian and nginx. It is the same as the original server.
