Case | 1:25-cv-00779 (Jones et al v. Abel et al)

Case name: Jones et al v. Abel et al
Court: United States District Court, Southern District of New York (S.D.N.Y.)
Judge: Lewis J. Liman
Case #: 1:25-cv-00779
Nature of Suit: 190 — Contract / Other Contract
Cause of Action: 28 U.S.C. § 1332 — Diversity (Breach of Contract)
Link: https://www.courtlistener.com/docket/69581767/jones-v-abel/

1. Scope and Criteria for Organization

This page organizes the context in which the domain minheejin.net appears and its observable technical characteristics, based on court filings from the above case (the US lawsuit complaint and its attached materials) and publicly verifiable data regarding the online materials mentioned in those documents (domain information, backlink data, archive captures, etc.).

The goal of this page is not to advance the arguments of a specific party or personal opinions, but to separate and organize, as much as possible, the content stated in court documents from items verified through external data.

In the US lawsuit complaint, various online materials (websites/social accounts, etc.) are mentioned as "instances spreading aggressive content or negative framing," and minheejin.net is included as one of the examples in that list. The document describes minheejin.net to the effect that it is "a site attacking Min Hee-jin, known as the former CEO of the Korean label ADOR."

In other words, minheejin.net is incorporated into the document not as a simple related link, but as an example of an attack site targeting a specific individual.

However, the body of the complaint does not reproduce the entire page content of minheejin.net, nor does it definitively state that the operating entity has been legally confirmed. The plaintiff side identifies the domain as part of a 'defamatory website network' likely created by the defendants, but this remains at the stage of an allegation requiring technical verification during the trial process.

Therefore, this page clearly distinguishes and records the following two items:

(1) Items confirmed within the scope of "being stated as such" in court filings.
(2) Items observed through external data (domain creation/expiration, backlink structure, etc.).

Furthermore, items requiring definitive conclusions, such as the operating entity, intent, or attribution of responsibility, are treated solely using technical language regarding possibility, similarity, and pattern matching, unless additional evidence is secured.

In the following sections, the four items below are combined to summarize how the domain mentioned in the document was actually integrated into link networks and search visibility structures.

(a) (a) Domain timeline of minheejin.net (WHOIS/DNS)
(b) Actual recovered site (files and snapshots)
(c) Semrush backlink data (4 types of CSV)
(d) SEO and infrastructure analysis criteria presented in expert reports

2. Context of Appearance within US Court Documents

2.1 Nature of the Lawsuit Documents and Scope of Organization

In this page, the term 'complaint' refers to the Proposed Amended Complaint submitted by the plaintiffs in the Jones et al v. Abel et al case pending in the US District Court for the Southern District of New York.

This complaint is a document submitted to the court summarizing the plaintiffs' claims and factual allegations. This chapter focuses on summarizing specifically how minheejin.net is described within the body of the complaint.

2.2 Method of Mentioning minheejin.net in the Body of the Complaint

In the body of the complaint, minheejin.net is described with the following phrase:

“https://minheejin.net attacking Min Hee-jin, the former CEO of South Korean recording label ADOR.”

This phrase indicates that within the complaint, minheejin.net is referred to as a website with the nature of attacking a specific individual, Min Hee-jin (former ADOR CEO).

Through this expression, the complaint merely summarizes the existence and nature of the domain briefly; it does not quote the full text of individual content posted on the site, nor does it describe the overall page structure, timing of posts, or method of operation in detail.

Furthermore, in this section, the operating entity, the background of production/planning, or the attribution of legal liability for minheejin.net are not specified or definitively stated. In other words, the complaint mentions the domain only at a descriptive and summary level.

2.3 Position within the List of Examples and Context of Parallel Presentation

The aforementioned expression appears as part of a list enumerating various websites as examples in the body of the complaint. In other words, minheejin.net corresponds to one of several items presented to explain 'instances of aggressive websites' in the complaint.

Each item included in this list consists of:

• The domain address
• A brief description in the format of 'attacking [Person]'

Websites targeting different individuals are listed in parallel.

This parallel presentation suggests that the complaint presents minheejin.net not as a standalone case for in-depth analysis, but as a single case grouped to explain a specific type of online material (a group of websites with the nature of attacking individuals).

2.4 Scope and Limitations Confirmed Through the Complaint's Description

Based on the description in the complaint above, the scope that can be confirmed from the document is as follows:

• minheejin.net is mentioned in the body of the complaint as an illustrative example of an aggressive website targeting a specific individual.
• The domain functions as one of the items constituting the type of aggressive websites described in the complaint.

On the other hand, the body of the complaint does not explicitly define or confirm the following matters:

• The operating entity of the site
• The background of the site's production and planning
• Verification of facts or truthfulness of posted content
• Attribution of legal liability
• Implication that Min Hee-jin is a party to the lawsuit

Therefore, the mention of minheejin.net in the complaint should be understood as being placed in an illustrative position to support the plaintiffs' arguments, rather than as a description presupposing a legal judgment or attribution of liability for the individual domain.

However, the litigation documents forming the basis of this analysis were filed in a US federal court. US civil litigation includes a mandatory pre-trial process known as 'discovery'. Under this process, parties are required to disclose relevant evidence to the opposing side and face legal sanctions for submitting false evidence. Therefore, the complaint and expert reports cited on this page are distinguished from mere unilateral allegations, as they are documents submitted in a procedure where legal liability applies.

3. Analysis Criteria Presented in the Expert Report

3.1 Document Nature and Application Principles

'Exhibit 20: Horton Expert Report' (hereinafter referred to as the 'Report' or 'Expert Report') is an expert opinion document submitted in the above litigation procedure. It is not a document intended to definitively determine the operating entity or legal liability of a specific website or domain.

Based on publicly accessible materials (OSINT) and data provided by the client, this Report aims to analyze the technical and structural characteristics repeatedly observed among online materials and summarize them as an expert opinion.

This page does not adopt the Expert Report as a basis for factual judgment or legal conclusions. Instead, for the technical data analysis to be performed in the following chapters (4~7), the analysis criteria and observational frames adopted by this Report are used solely as reference standards.
In other words, on this page, the Expert Report functions not as evidence providing conclusions, but as a 'criterion document' establishing the direction and scope of the analysis.

Definition of Terms and Principles of Judgment Language

Overall, the Expert Report excludes language such as 'confirmation' or 'conclusion' and thoroughly distinguishes between observable facts and the technical opinions derived from them. Accordingly, this page also adheres to the following principles:

• Expressions such as 'confirmation' or 'specification' are not used.
• Only technical judgment language such as 'observation,' 'match,' 'repetition,' and 'possibility' is used.
• Judgments related to the operating entity, planning intent, and legal liability are reserved in the absence of additional evidence.

To this end, this page uses key terms necessary for analysis, such as SEO, search spam, and backlinks, only within the scope of their general definitions. These terms are all limited to technical tools for explaining observation results.

[Definition of Key Terms]

• SEO (Search Engine Optimization)
  A general technique of adjusting content and technical elements to improve a webpage's exposure on search engines. This page uses this term only in a technical context to interpret search visibility and link structures.
• SEO Farm / Content Farm
  A group of sites that systematically mass-produce and distribute low-quality content or meaningless backlinks for the purpose of high search ranking exposure. This page uses this term to explain the structural characteristics of 'Wiki-Clone' sites pointed out by the Expert Report or a network of defamatory sites sharing a specific IP range.
• Link spam
  Abnormal links artificially created and placed to influence search rankings. This page uses this term as an analytical term to observe and classify link creation patterns and structures.
• Backlink (Inbound link)
  A hyperlink connecting from an external website to a specific site. This page uses observable characteristics such as the number of backlinks, creation timing, and repetition as units of analysis.
• Anchor text
  The clickable text displayed on a hyperlink. This page uses it as a technical indicator to observe through which expressions links are connected.
• nofollow (링크 속성)
  One of the attributes attached to a link, signaling to search engines "do not reflect this link in ranking evaluation." This page uses it only as a technical concept to distinguish the presence or absence of that attribute.
• Domain name (도메인)
  An address name used to identify a specific website on the Internet. This page uses it as a basic identifier for site-level analysis.
• WHOIS / RDDS
  An information system that allows public lookup of domain registration information (registration date, expiration date, etc.). This page refers to it to check the domain lifecycle.
• DNS (Domain Name System)
  A system that connects human-readable domain names to actual server addresses (IP). This page uses it as a basic concept to understand which infrastructure a domain is connected to.
• Spam / Spam policies
  Refers to all acts intended to artificially increase exposure by bypassing or manipulating search engine quality standards. This page does not conclude on violations but uses the term solely for the purpose of explaining the conceptual standards defined in spam policies.

3.3 Key Observational Frames

The basic unit of analysis presented by the Expert Report is not the truthfulness of individual content or the appropriateness of expression. The Report focuses on structural and formal characteristics that appear repeatedly across multiple online materials, and this perspective is summarized in three axes:

First, the repetition of site structure and templates.
When comparing and analyzing multiple websites, the Report uses the repetition of formal elements such as page organization methods, menu structures, category arrangements, and layout similarities as key observational indicators. This is a characteristic difficult to grasp with a single site alone, and meaningful patterns can only be discovered through comparison between multiple sites.

Second, the characteristics of content creation and expression methods.
Rather than the content of individual sentences, formal patterns of content production such as sentence length, expression density, title composition methods, and contributor or author notation methods become objects of observation. Regardless of the correctness of specific claims or opinions, these patterns are utilized as indicators explaining how content is produced and arranged.

Third, domain lifecycle patterns.
Whether the creation timing, active period, expiration, or deletion timing of domains are concentrated in a specific period acts as an important observational indicator in case group analysis, not single domain analysis. The Report presents such similarities in lifecycles as one of the technical observation results.

3.4 Diffusion and Boosting Analysis Criteria

The Expert Report treats how a website is connected and diffused externally as more important than the existence of the website itself. Here, the core subject of analysis is the backlink structure.

In the Report, backlink analysis is not simply about counting the number of links but is conducted by examining items such as:

• The distribution of link creation timing
• Repetition of identical or similar anchor texts
• Structural characteristics such as the nature and distribution of link source domains

These observations are not grounds for concluding whether it was designed for search exposure, but merely technical analysis criteria to explain how the website is connected to external networks.

This page also adopts these criteria as they are, using them only to observe and classify backlink data in subsequent chapters.

3.5 Infrastructure and Technical Fingerprint Analysis Criteria

The Expert Report takes not only the surface elements of websites but also characteristics at the network and infrastructure level as important objects of observation. These include elements such as:

• Repetition of IP addresses and IP ranges
• Network affiliation observation at the ASN level
• Similarity in hosting environments and nameserver configurations

Such infrastructure analysis is not a means to confirm the 'same operating entity,' but a criterion to observe how much the technical environment is shared or similar among different websites. The Report also presents these observation results only within the realm of possibility and does not link them to legal attribution or definitive conclusions about the operating entity.

This page applies the same criteria and treats infrastructure analysis results only as pattern observation data.

3.6 Case Group Comparison Method and Limitations of Analysis

The analysis in the Expert Report consistently premises the limitations of single-site analysis. It is difficult to fully explain structural repetition or network characteristics with just one individual website. Therefore, the Report adopts a 'site cluster' analysis method that groups and compares multiple similar cases.

The purpose of this comparative analysis is not to emphasize commonalities. The purpose is to distinguish 'which indicators appear repeatedly' from 'which elements do not appear consistently.'

This page also accepts these limitations as they are, and strictly distinguishes and organizes all technical analysis results to be presented in subsequent chapters into verifiable ranges and ranges requiring reservation.

3.7 Application Principles on This Page

Based on the above criteria, this page utilizes 'Exhibit 20: Horton Expert Report' in the following ways:

• Only the analysis criteria and observational frames are adopted.
• It does not stop at simply citing the conclusions of the Expert Report, but uses it as a tool to technically cross-verify whether the attack patterns proven in the Report are identically observed in the actual data of minheejin.net.
• All technical analyses are limited to the organization of observation results, and judgments on the operating entity, intent, and responsibility are reserved.

These application principles are intended to clearly define in advance the interpretive scope of the Site Entity Analysis(Chapter 4), Backlink Structure Analysis (Chapter 5), Infrastructure Observation Results (Chapter 6), and Comparison of Identical Case Groups (Chapter 7) to be covered in subsequent chapters.

4. Information on minheejin.net

This chapter describes the construction environment and management status of minheejin.net as they are, based on the source code and resource files secured through archives.

4.1 Construction Platform and Framework

First, as a result of partially restoring the site structure using web archives, it was identified that the site was built based on WordPress, a Content Management System (CMS) widely used globally. (Refer to Appendix 9.4 Web Archive Links)

• CMS: WordPress (Confirmed via the /wp-content/ path and structure within the source code)
• Theme: Avada (Confirmed via the Avada-Child-Theme name within the source code)
  • Note: Avada is one of the most widely used multipurpose commercial themes in the WordPress ecosystem, featuring a builder function that allows site construction without professional development knowledge.

4.2 Singularities in Resource Filenames

Distinctive patterns allowing for the inference of the operator's file management habits are identified in the names of image files posted on the site.

(1) Identification of Copy-Copy Pattern

• Observed Data: Patterns such as kpop-banner-rev-Copy-Copy.jpg and crying-Copy.jpg are identified in major image filenames.
• Analysis: The repetitive inclusion of 'Copy' in filenames suggests that files copied in a local PC environment were used without a separate renaming or organization process. This differs from the work processes (use of optimized filenames) of typical web agencies or professionals.

(2) WordPress Default Media Processing

• Observed Data: Multiple files with resolution figures attached, such as ...-800x247.jpg, exist.
• Analysis: These are thumbnail files automatically generated by the WordPress Media Library to correspond to various device environments when uploading original images; this is a common technical characteristic of WordPress-based sites.

4.3 Metadata and Content Composition

The site's metadata settings are optimized for the exposure of specific keywords.

(1) Title and OG Tag Settings

• The <title> in the HTML header and the Open Graph (OG) tags for social media sharing are set to 'Min Hee-Jin, K-pop Criminal'.
• This means the title of the site itself is defined by combining the Entity (person's name) with a crime-related keyword (Criminal).

(2) Site Structure

• It is configured as a One-page form without a separate menu (Global Navigation Bar, GNB) or sub-pages. It features a structure where prepared text and images are sequentially exposed through scrolling.

4.4 Contact Point

In the footer of the site, a channel to contact the operator is set up as follows:

• Call to Action: "Please write here with your tips so we can bring her to justice."
• Email Address: [email protected]
• Singularity: ProtonMail, a service emphasizing anonymity and security, was used instead of a general portal or corporate email.

4.5 Summary

minheejin.net is a one-page site created using popular tools such as WordPress and the Avada theme. Unrefined traces of file management are observed in image filenames (Copy-Copy), and the site's title and metadata are fixed with a negative keyword (Criminal) regarding a specific individual. An anonymous mail service (ProtonMail) is used as the contact point.

5. External Link Structure and Technical Observation of minheejin.net

5.1 Scope of Organization and Data Source

This chapter is drafted based on four types of backlink data extracted from Semrush, a highly reliable web data analysis tool widely used by global marketers. Semrush is an analytical tool used as a standard in the global SEO and digital marketing industries, and a similar methodology was adopted in the Expert Report (Exhibit 20: Horton Expert Report) of this lawsuit. The purpose is to observe and record exactly how the minheejin.net domain is connected to the external internet space.

Here, 'observation' refers to quantitative data values recorded in the original CSV files, such as the number of backlinks, link attributes (nofollow/UGC, etc.), Anchor Text distribution, and the distribution of referring domains and IPs.

The dates cited in this chapter (First seen/Last seen) are all original data provided by Semrush. 'First seen' refers to the time point when Semrush's collection robot first discovered the link, not the actual creation date of the link. Therefore, this data should be understood as a technical indicator to identify trends in when the links were actively observed, rather than as evidence confirming the legal 'creation time'.

This chapter thoroughly excludes speculation or value judgments (e.g., "it is an attack," "it is manipulation") and objectively describes only the connection structure confirmed by data.

5.2 Total Link Volume and Target URL Composition

We prioritize observing the total volume of links flowing into minheejin.net from the outside and which pages within the site they connect to.

5.2.1 Total Number of Backlinks: 701

Based on the minheejin.net-backlinks.csv file (raw data), there are a total of 701 backlinks connected to minheejin.net. This exactly matches the sum of data aggregated by anchor text.

5.2.2 Target URL Composition

As a result of checking which paths of minheejin.net the external links are pointing to, all 701 observed links are directed solely to the main page (root domain).

• https://minheejin.net/: 572 links
• http://minheejin.net/: 129 links

Generally, websites have a mix of links connecting to specific image files, attachments, or URL parameters. However, for this domain, no connections to such detailed paths are observed.

This shows that external traffic is concentrated solely on the site's main page, which aligns with the fact that the site was operated as a one-page form without any substructure.

5.3 Nature (Attributes) and Form of Links

The results of analyzing the signals these observed links send to search engines are as follows:

5.3.1 Link Attribute Flags

• Nofollow (566 links, approx. 81%)
  A marker by which the linking site informs the search engine, "Do not trust this link."
• UGC (224 links, approx. 32%)
  An abbreviation for 'User Generated Content,' indicating links included in areas written by general users, such as comments or bulletin boards.

The fact that the majority of links carry the Nofollow attribute is a technical characteristic suggesting that these links were likely generated in comments or auto-generated pages rather than being officially recommended by site operators.

5.3.2 Link Forms

• Text (676 links)
  Forms where the link is applied to text (characters).
• Image (25 links)
  Forms where the link is applied to image banners, etc.
• Sitewide (0 links)
  No banner-type links fixedly exposed across an entire site (menus, footers, etc.) were found.

5.4 Time Axis Observation: First seen / Last seen Range

The period during which the Semrush system discovered and tracked these links is as follows:

5.4.1 Observation Date Range

• First seen: October 12, 2024 ~ December 09, 2025
• Last seen: June 1, 2025 ~ December 10, 2025

5.4.2 Link Fluctuations (New and Lost)

• New link (20 links)
  Links newly discovered recently (November ~ December 2025).
• Lost link (246 links)
  Links that existed in the past but have now disappeared or become inaccessible. This includes cases where the original post was deleted or the linking site itself was closed, severing the connection.

5.5 Anchor Text Distribution

'Anchor text' refers to the actual text displayed as a blue link. Through this, it is possible to identify how external sources referred to minheejin.net when linking to it.

5.5.1 Summary of Phenomenon: Concentration on Few Keywords

The total number of unique anchor text types observed is 90. However, a distinct concentration on specific expressions is evident, with the top 10 phrases accounting for approximately 80% of the total links.

5.5.2 Top 20 Anchor Texts (Raw Data)

The most frequently used phrases are the domain address itself or a specific name (min hee-jin).

5.6 Referring Domains Distribution

A total of 266 different sites (domains) are linking to minheejin.net.

5.6.1 Summary of Phenomenon: Large Volume of Links from Few Sites

The majority of sites (130) provide only a single link, whereas a few top sites are directing dozens of links intensively. This indicates the possibility that the links were repeatedly displayed through banners or sidebars within specific sites.

5.6.2 Top 20 Referring Domains (Raw Data)

5.7 Referring IPs Distribution

Even if domains are different, they may share the same server (IP address). If a domain is the 'nameplate' of a website, the IP address corresponds to the 'physical address' where the actual server computer is located. The results of reclassifying the data by IP unit to verify this are as follows.

5.7.1 Summary of Phenomenon: Multiple Domains Observed on Identical IPs

A total of 268 IPs were identified. While most IPs host only one domain, a phenomenon is confirmed in 5 specific IPswhere a single IP hosts multiple domains (2~4) simultaneously while directing links.

5.7.2 Top 20 Referring IPs (Raw Data)

5.7.3 List of Referring IPs with Domains > 1 (Raw Data)

Technically, this data implies a form of 'multiple families (domains) living under one roof (server).' This could be shared hosting, where multiple users split a single server, or a case where a specific operator collects and manages multiple sites in one place.

This chapter does not conclude which case it is, but merely records the fact that a technical pattern of sharing the same server infrastructure exists.

5.8 Auxiliary Indicators: Country and Page ascore

• Country Information
  In the raw CSV data, a significant portion of IP country information is empty (NaN) or inaccurate, so it is treated only as auxiliary information.
• Page ascore
  This is a page score calculated by Semrush, and 531 items appear as 0. This suggests that the quality index of the linked pages is generally not high.

5.9 Confirmed Facts and Reserved Judgments

5.9.1 Confirmed (Observable) Matters

• The total volume of backlinks is 701 (Matches the sum of raw data and anchor aggregation).
• The Target URL connects only to two forms based on the root (/): http and https (572 for https / 129 for http).
• The Nofollow attribute constitutes the majority (566), and some UGC markers (224) exist.
• A total of 90 types of Anchor texts are observed, but links are concentrated on the top 10 phrases (Top 10 share approx. 80.03%).
• 266 unique Referring Domains and 268 unique Referring IPs are observed.
• There are 5 cases among Referring IPs where the Domains value exceeds 1 (All listed in the table above).

5.9.2 Reserved (Matters not judged in this chapter)

• The purpose, intent, or campaign status of link creation.
• Specification of the operating entity or legal attribution.
• Whether a specific domain or IP implies the same operating entity.
• Interpretation connecting date distribution directly to external events.

5.10 Transition to the Next Chapter

This chapter recorded the results of observing the link structure surrounding minheejin.net in isolation. In the following chapters, based on the distributions confirmed here (anchor concentration, referring domain and IP structure, nofollow/UGC markers, fluctuation flags, etc.), we will organize the link network into more granular units of observation. However, even in that process, we do not conclude on the operating entity or intent, and strictly reserve judgments that exceed the observable scope.

6. Establishment of Comparable Scope and Application Criteria

6.1 Purpose and Premises

The purpose of this chapter is not to immediately perform a comparison with other sites. Rather, prior to the full-scale comparative analysis, it is to determine 'what and by what criteria to compare.' In other words, using the analysis criteria of the 'Expert Report (Horton Expert Report)' examined in Chapter 3 as a yardstick, this is the stage to verify whether the minheejin.net data secured in Chapter 4 can indeed be an analysis target that meets those criteria.

The core principles guiding this entire analysis project are as follows:

• Limitation of Input Values
  오We use solely the isolated observation data of minheejin.net analyzed in Chapter 4. (Comparative data will be handled in subsequent stages, but their interpretation criteria strictly follow the principles established in this section.)
• Fixation of Standards
  The framework of analysis follows the methodology presented by the Expert Report, but original text is cited when necessary to clarify the criteria.
• Reservation of Judgment
  Speculation regarding "operating entity, intent, or responsibility" is excluded. Instead, technical judgment language such as "corresponds to / partially corresponds to / does not correspond to" is used regarding whether the data meets the analysis criteria.
• Meaning of Dates
  It is premised that date data represents only the time point when the Semrush system discovered the link (observation date), not the legally confirmed creation/deletion date.

6.2 Re-fixing the Horton Expert Report Criteria (Analysis Indicators)

The Expert Report explains that search engines use Link Structure and network composition as key signals when evaluating the authority of a webpage. In particular, it emphasizes the structural characteristics where artificial link networks such as "SEO farms" or "wiki-clones" influence search visibility.

To apply this perspective of the Report to this archive project, we decompose the analysis clues into the following three Layers for application.

(A) Link Layer (Quantitative Indicators)

• Total volume of backlinks and distribution of Target URLs (destinations).
• Types of Anchor texts (link phrases) and concentration phenomena.
• Link attributes (signals sent to search engines such as Nofollow, UGC).
• Distribution of Referring Domains and Referring IPs (concentration by specific sources).

(B) Actual Site Layer (Content Format)

• Similarity of page structure and templates.
• Repetitive sentences or styles of expression.

(C) Infrastructure Layer (Technical Environment)

• The Expert Report analyzed both the 'hosting of the target site' and the 'infrastructure of the backlink sites'.
• However, since the CSV data of this project includes only the IP information of the backlink (referring) sites, the scope of analysis is limited to "observation of infrastructure patterns from which external links were sent," and tracking of the operating server (ASN) of minheejin.net itself is not performed.

6.3 Criteria – Observation Value Mapping Table (Verification of Correspondence Possibility)

We have organized in a table whether the 'analysis criteria' presented by the Expert Report and the 'minheejin.net data' we secured align with each other. This table serves as the basis for proving that the subsequent comparative analysis is technically valid.

Correspondence Status between Expert Report Criteria and minheejin.net Data

Based on the table above, key indicators of the '(A) Link Layer' mostly fall under the '✔ Applicable' level. Therefore, performing a precise comparison with other sites focusing on these indicators in the subsequent stages is technically valid.

6.4 "Comparable Items" and "Items Not to be Compared" in the Link Layer

Just because data exists does not mean everything can be compared or concluded. We clarify the boundaries of how far the observation values from Chapter 4 can be interpreted. In this process, the key data tables confirmed in Chapter 4 are presented again to serve as the basis for comparison criteria.

6.4.1 Comparable Areas (Quantitative Facts)

(1) Total Backlinks and Target URL Concentration

• minheejin.net has a total of 701 backlinks, and all these links connect only to 2 URLs (https:// and http:// root domains).
• This corresponds to the "basic unit of link analysis" mentioned in the Expert Report and supports the fact, data-wise, that the site is a One-page structure without sub-pages.

(2) Anchor Text Distribution (Concentration)

• A total of 90 types of Anchor texts are observed, but a phenomenon where links are concentrated on a few top keywords is distinct. The Expert Report also considers the repetition of specific keywords as an important analysis indicator.
• Refer to the table in 5.5.2 for the 'Top 20 Anchor Text List' to be used as a comparison criterion.

Link Attributes (Nofollow Proportion)

• Approximately 81% (566 links) of the total links carry the Nofollow attribute. This is a quantitative indicator suggesting the possibility that the link generation background is related to auto-generation or mass distribution rather than natural recommendation.

(4) Referring Domain Distribution

• A total of 266 domains provided links, but an imbalance is observed where a few specific domains provide a large volume of links.
• Refer to the table in 5.6.2 for the 'Top 20 Referring Domains List' to be used as a comparison criterion.

(5) Referring IPs and Multi-domain Observation

• Most IPs host only 1 domain, but a phenomenon where multiple domains are operated on a single server (Domains > 1) was captured in 5 specific IPs.
• Refer to the tables in 5.7.2 / 5.7.3 for the 'Top 20 Referring IPs' and 'Referring IPs with Domains > 1' to be used as comparison criteria.

6.4.2 Limitations and Cautions in Data Interpretation

Although the Expert Report mentions "nearly identical backlink structures," the following conclusions cannot be drawn from minheejin.net data alone:

• "It has the same structure as other domains"
  Even if comparison data exists, the identity of the operating entity cannot be confirmed based solely on simple structural similarity.
• "It is an SEO Farm"
  Quantitative figures can be presented, but whether this corresponds to a 'Farm' model is a realm of subjective interpretation, so it is strictly excluded from this analysis.
• "It is a specific platform (Wiki-clone)"
  We do not hastily conclude the nature of the platform based solely on the domain name.

6.5 Principles for Using Time Indicators (Observation Dates)

Dates in Semrush data (First seen, Last seen, New/Lost link) represent only the time point when the link was captured by the system, and may not exactly match the actual link creation date or the site operation period. Therefore, this date information is used strictly for the purpose of checking the "range of the observation period" and the "distribution of fluctuations," and connecting this directly to external events as a causal relationship is reserved.

6.6 Scope Limitations and Excluded Items of Analysis

To maintain the objectivity of the analysis as much as possible, the following items are explicitly excluded from this entire analysis project:

1. Specification of Operating Entity: Judgment on who created it.
2. Judgment of Intent: Interpretation of purposes such as "attack," "manipulation," or "design."
3. ASN-based Analysis: The original CSV data does not contain ASN information. Therefore, a systematic ASN analysis for the entire backlink source is not performed.
   Exception: An IP (195.20.19.178) commonly appearing across all 7 target sites was discovered in the cross-analysis in Chapter 7. ASN and reverse lookup were performed via public lookup tools only for this specific IP.
4. Conclusion on Similarity with Other Domains: Similarity judgment is reserved as this is the stage prior to comparison execution.

6.7 Connection to Subsequent Items (Execution of Comparison)

The 'Comparison Criteria (Mapping Table)' established in this chapter will be utilized in the next stage as follows:

• First, indicators of the same format (Total backlinks, Anchor distribution, Referring IPs, etc.) as the data extracted for minheejin.net are extracted from other comparison target sites.
• Then, a cross-comparison is performed by placing the two datasets side by side to determine whether they are "Similar / Identical / Different."

6.8 Summary

As a result of reviewing based on the link analysis mechanism presented by the Expert Report (Horton Expert Report), the data of minheejin.net includes multiple indicators that are technically applicable to the report's analysis criteria, such as total backlinks, concentration of Target URLs (one-page characteristic), Anchor text distribution, proportion of Nofollow attributes, and Referring IP patterns. Therefore, it is valid to compare structural similarities with other sites utilizing these indicators. However, regardless of whether comparison data is secured, it is stated that interpretations exceeding the scope of technical observation are not the subject of analysis in this project.

7. Cross-Comparison with Identical Case Group Sites and Infrastructure Analysis

7.1 Purpose of Analysis and Selection of Targets

The purpose of this chapter is to determine whether the backlink data and operational form of minheejin.net analyzed earlier are isolated phenomena, or if they share infrastructure with other sites having similar purposes. To this end, 6 domains mentioned as similar cases in the lawsuit documents (Jones et al v. Abel et al) and the Expert Report are set as the comparison group, and a technical and behavioral cross-analysis is performed according to the criteria established in Chapter 6.

Comparison Target Group: Total 6

• Site A: stephaniejoneslies.com
• Site B: stephaniejonesleaks.com
• Site C: amandaghostsucks.com
• Site D: alexanderbrothersextorted.com
• Site E: lookbackfraud.com
• Site F: paigejimenez.com

Note: Site A and Site B target the same individual (Stephanie Jones) and have identical content. However, there are differences in their creation timing and operational history.

Site B was registered first on May 6, 2024, and was deleted due to action by the hosting provider.
Site A was registered 4 days later on May 10 through a different hosting provider and remained operational until the summer of 2025.
In other words, Site A is described as a replica site created to replace the deleted Site B.

7.2 Structural Similarity of Link Layer

As a result of a comprehensive analysis of backlink data for the 7 target sites (including the subject of this analysis), structural identity without exception is confirmed in the site design methods and external link generation patterns.

7.2.1 Concentration on One-page Structure

정상적인 웹사이트는 다양한 서브 페이지로 백링크가 분산되는 것이 일반적이다. 그러나 본 분석 대상인 7개 도메인은 모두 백It is common for normal websites to have backlinks distributed across various sub-pages. However, all 7 domains subject to this analysis show a singular structure where 99%~100% of backlinks are concentrated on just the main page (Root URL).링크의 99%~100%가 메인 페이지(Root URL) 단 하나로 집중되는 단일 구조를 보인다.

Detailed Comparison of Backlink Concentration Across 7 Sites

This is a clear technical indicator showing that all 7 sites have no content depth and are designed in the form of standalone Landing Pages solely to attack specific targets.

7.2.2 Negative Keyword Mapping and Potential for Search Algorithm Exploitation

As a result of analyzing the backlink anchor texts of the 7 sites, a pattern was identified where the target person's real name and specific Negative Keywords are repeatedly combined.

• Min Hee-jin + Criminal
• Lookback(Joe Dunn) + Fraud
• Alexander Brothers + Extortion/Sexploited
• Amanda Ghost + Sucks
• Stephanie Jones + Lies/Leaks

As seen in the cases above, there is no natural citation or context, and the texts consist only of inflammatory expressions capable of damaging the target's reputation.

This keyword mapping method can influence the Related Searches and Autocomplete algorithms of search engines like Google. The act of consistently exposing 'Name' and 'Negative Keyword' together from multiple external sources is presumed to be intended to induce search engines to evaluate the semantic association between the two words highly, thereby imprinting a negative image on the public.

7.2.3 Consistency in Call to Action (CTA) Patterns

단순한 비방을 넘어, 방문자에게 '익명 제보'를Beyond simple attacks, similarities were discovered in the UX (User Experience) design soliciting 'anonymous tips' from visitors and the logic structure of the phrasing. 유도하는 UX(사용자 경험) 설계와 문구의 논리 구조(Logic)에서 유사성이 발견되었다.

Comparison of Tip Solicitation Methods and Email Patterns by Site

Checking the tables and images above, the following similarities appear:

• Presentation of Justification
  Instead of simple slander, they foreground moral justifications such as "Justice," "Investigators," or "End abuse" to grant psychological legitimacy to the informant.
• Use of In-text Links
  A similar UI pattern is observed where hyperlinks are inserted into the text within sentences rather than using buttons.
• Use of ProtonMail
  The three sites where email addresses were specifically confirmed (minheejin.net, Site D, Site F) all use ProtonMail, a secure mail service, and share a similar naming convention of creating disposable accounts containing the 'target' name.
  The remaining sites (Site A, B, E) also show similar UX patterns collecting information through on-site forms.
  What is noteworthy in this analysis is not the use of the ProtonMail service itself, but the composite pattern where all three sites ① choose the same secure mail service AND ② use email addresses with a similar structure of 'Target Name + Tip Solicitation Keyword (tips, about, tell_me_about, etc.)'.
  The probability of these two coinciding simultaneously is significantly lower than the probability of simply choosing the same service by chance.

7.3 Infrastructure Layer Analysis: Backlink Supply Chain Consistency

As specified in Chapter 6, the original CSV data does not contain ASN information. Therefore, a systematic ASN analysis for the entire backlink source was excluded from the scope of this project.
However, a singular result was discovered during the IP-level cross-analysis. A single IP, 195.20.19.178, appeared in common in the backlink sources of all 7 target sites. This was the only IP that overlapped across all 7 sites.
Considering the singularity of this IP, additional analysis through public lookup tools (ASN lookup, Reverse IP lookup) was performed only for this specific IP..

As a result of analyzing the IP information of Referring Domains generating backlinks, a pattern was observed where multiple domains were repeatedly identified on the same few IP addresses.
This suggests the possibility that while links appear to be generated from multiple different websites on the surface, in reality, multiple domains are being operated within a limited IP range.

Status of IP Reuse by Backlink Generating Domains

As a result of the cross-analysis of the full dataset (ip_overlap_report), the backlink infrastructure shows the following statistical distribution.
However, these results are merely statistical observations based on IP duplication. They do not directly prove the identity or intent of a specific operating entity. Especially if these IPs are part of a large Shared Hosting service, multiple unrelated users may share the same IP. Therefore, an association between operating entities cannot be concluded based on IP matching alone.

• Core Overlap
  A total of 18 IPs were confirmed to be associated with 5 or more target sites simultaneously.
  In particular, the top IP, 195.20.19.178, is confirmed by IP registration information to be owned by a Moldovan entity(S.C. INFOTECH-GRUP S.R.L., AS201670). It was confirmed that the site (or sites) hosted on this IP are generating backlinks to all 7 target sites subject to analysis. This is the only IP among the backlink sources of the 7 target sites that forms an intersection with the entire group.
  As a result of a Reverse IP Lookup on this IP, it was confirmed that only 25 domains are hosted on this server. This suggests that it is a relatively small-scale Dedicated Server or VPS, rather than a large Shared Hosting environment (which typically hosts thousands to tens of thousands of domains).
  Analyzing the nature of these 25 domains, approximately 68% are classified as related to SEO or backlink generation. Therefore, there is a possibility that this IP is being operated as dedicated infrastructure for SEO or backlink generation purposes.
  (Below are some examples; refer to Appendix 9.5.1 for the full list of 25 domains)
  • URL Shortening Services: aceshrink.baby, amoebaurl.click, byteshort.xyz, etc. (10 domains)
  • Backlink Tools: backlinks-checker.com (1 domain)
  • Content Farm Patterns: blogsphere.top, creativeposts.top, dailymusings.top, etc. (6 domains)
• Broad Network
  When relaxing the analysis criteria, a total of 121 IPs were confirmed to overlap across at least 3 target sites.
  This indicates the possibility that more than 121 IPs are involved in the backlink generation process, and among them, the existence of 18 high-density overlapping IPs suggests intensive connections with multiple target sites.

7.4 Identity of Referring Domains

A phenomenon was confirmed where not only the server (IP) is shared, but the list of websites providing links (Referring Domains) itself overlaps on a large scale.

7.4.1 Domain Intersection Analysis (47 Common Denominators)

As a result of the cross-analysis of the full dataset, a total of 47 domains were found to match 100% across 6 sites (minheejin.net, Site A, C, D, E, F), excluding Site B (stephaniejonesleaks.com). In particular, the identified common domains explicitly state their purpose and identity (PBN, link sales, expired domains, etc.) in their names.

Here, the background for the exclusion of Site B from the set of 47 common domains is estimated as follows:

① May 6, 2024 - Site B Domain Registration
According to the 'Publication Summary' of the Expert Report, the Site B (stephaniejonesleaks.com) domain was registered on 2024-05-06 T20:28:03Z.

② May 9, 2024 - Intensive Backlink Generation for Site B
According to the Expert Report, backlinks using anchor texts such as "Stephanie Jones Leaks," "Stephanie Jones Scandal," and "Stephanie Jones Extortion" were intensively generated on May 9, 2024, from multiple European Wiki-clone platforms like colibris-wiki.org, fleurslocales.eu, and sourcier34lr.info.

③ May 9 ~ 10, 2024 - Site B Deletion Action (Estimated)
According to the Complaint, after Jones raised an objection regarding the defamatory and abusive nature of the website to the domain hosting service, the service took action to delete Site B.

④ May 10, 2024 - Site A Domain Registration
According to the Expert Report, Site A (stephaniejoneslies.com) was registered on 2024-05-10 T18:13:31.00Zthrough a different hosting provider (Namecheap). Also, the Complaint explains that 'Site A was posting identical content to Site B.'

⑤ Until Summer 2025 - Site A Operation Maintained
The Complaint specifies, "This website remained online and accessible until the summer of 2025."

As described above, since Site B was deleted early, two possibilities exist:

First, due to the deletion, the initial backlink sources may have shifted their target from Site B to Site A, or new backlinks may have been generated targeting only Site A. In fact, looking at the Publication Summary in the Expert Report, the backlink from intelligenceline.com dated June 1, 2025, targets Site A (stephaniejoneslies.com), not Site B.

Second, at the time backlink analysis tools like Semrush collected data, the links to Site B might have already been broken, or crawling might have been impossible because Site B itself did not exist.

Due to these reasons, it appears that Site B was not observed to have the same set of backlink sources as the other 6 sites.

Analysis of Overlapping Domains Common to 6 Sites - Major Cases among 47 Total

The set of these 47 domains exists identically in the backlink lists pointing to 6 different sites. This can be viewed as a technical pattern suggesting the possibility that the backlinks for each site were generated through similar or identical backlink supply chains, rather than being established independently.
However, this analysis did not verify whether these 47 domains ① generated backlinks only for the analysis target sites, or ② similarly generated links for numerous unrelated sites. In the case of ②, the matching of the 47 domains might reflect indiscriminate activity of a backlink network rather than an association between the sites.

7.5 Analysis Conclusion

The observation results summarized below could be coincidences or general web operation patterns if viewed independently. However, it is important that patterns are observed simultaneously in all of the following 5 items.

1. Identity of Site Structure
2. Repetition of Keyword Mapping Patterns
3. Similarity in Call to Action Methods
4. Overlap of Backlink Infrastructure
5. Identity of Backlink Source Domains

The appearance of similarities across all 5 layers can be considered a technically significant observation result.

Furthermore, the technical similarities observed in this analysis can be interpreted in two ways:

1. Possibility that the same or related operating entity created multiple sites.
2. Possibility that unrelated operators coincidentally used the same external service (backlink provider, hosting, etc.).

This analysis does not judge which of these two possibilities is correct. Such judgment can only be made through securing additional evidence or legal procedures.

Synthesis of Data-Driven Precise Cross-Analysis Results:

• Overlap Patterns of Backlink Infrastructure:
  • As a result of a comprehensive analysis of IP addresses used by hundreds of source domains generating backlinks for the 7 target sites, a pattern where specific IPs repeatedly appear across multiple target sites is confirmed.
  • In particular, the IP address 195.20.19.178 is confirmed as the only common intersection found in the backlink sources of all 7 target sites subject to analysis.
  • Besides this, a Singapore-based IP (118.139.178.200) and a Cloudflare CDN IP (172.67.179.139) are confirmed to overlap in the backlink sources of 6 sites, excluding Site B.
  • Overall, a total of 18 IPs are connected to 5 or more target sites, and 121 IPs are confirmed to overlap across at least 3 or more target sites.
  • Specifically for 195.20.19.178, additional analysis was performed. Reverse lookup results showed that only 25 domains were hosted on that server. About 68% of these had characteristics related to SEO/backlink generation, such as URL shortening, backlink tools, and Content Farms. This suggests the possibility that it is dedicated infrastructurefor a specific purpose, rather than large-scale Shared Hosting (hosting thousands to tens of thousands of domains).
    However, since such additional analysis was not performed for the remaining IPs, it cannot be determined without further analysis whether the IP overlap is intentional infrastructure sharing or coincidental overlap in a large-scale Shared Hosting environment.
• Exact Match of Backlink Source Domains:
  • The 6 sites (including minheejin.net) excluding Site B share a set of 47 identical backlink source domains. The exclusion of Site B from this common set is presumed to be because the site was subject to deletion around May 2024, causing initial backlink sources to be lost, or the links were already broken at the time of backlink data collection.
  • These 47 domains are classified into types such as 'PBN explicit,' 'Link sales,' 'Expired domain recycling,' and 'Similar name masquerading,' revealing relevance to backlink generation services in the domain names themselves.
  • This can be viewed as a technical pattern revealing the possibility that the backlinks for each site were generated through similar or identical backlink supply chains, rather than being established independently. However, whether these 47 domains extensively generated links for other sites outside the analysis targets was not confirmed within the scope of this analysis.
• Similarity in Site Structure and Operation Method:
  • All 7 sites show the identical structural characteristic where 99~100% of backlinks are concentrated on a single main page.
  • Each site shows a common operational pattern of soliciting tips by foregrounding moral justifications such as "Justice," "Investigators," and "End abuse."
  • In particular, minheejin.net, Site D, and Site F are confirmed to use ProtonMail, a secure mail service, and follow similar email naming conventions including the target person's name (MHJtips@, tell_me_about_the_brothers@, aboutjimenez@).

Comprehensive Judgment:
The above analysis results show that minheejin.net shares structural similarities in multi-layered aspects such as technical infrastructure, backlink sources, and operation methods with sites mentioned in other litigation cases and Expert Reports.

Points to note specifically include:

• Common Infrastructure Point:
  A server located in Moldova is identified as the only common IP penetrating all 7 target sites, and a centralized infrastructure usage pattern is observed where a total of 18 IPs are redundantly connected to 5 or more sites.
• Exact Match of Backlink Sources:
  6 sites (excluding Site B) are receiving backlinks from 47 identical suspicious domains, suggesting the possibility of utilizing the same backlink supply chain.
• Consistency in Operation Methods:
  Similar patterns consistently appear in the one-page structure, tip solicitation methods, and email systems.

Although evidence directly specifying the operating entity was not confirmed, this multi-layered (Infrastructure + Backlink Source + Operation Method) match suggests the possibility that these sites share a common backlink supply path or similar technical infrastructure.

8. Final Conclusion

8.1 Reconfirmation of Purpose and Scope of Analysis

This page aimed to organize the technical characteristics of the minheejin.net domain mentioned in the complaint of the Jones et al v. Abel et al case pending in the US District Court for the Southern District of New York, based on publicly verifiable materials.

The principles consistently adhered to in the analysis process are as follows:

• Strictly distinguish between matters specified in court filings and matters observable through external data (WHOIS, archives, Semrush backlinks, etc.).
• Exclude language of 'confirmation' or 'conclusion' and use only technical judgment language such as 'observation,' 'match,' and 'possibility.'
• Reserve judgments on the operating entity, production intent, and attribution of legal liability without additional evidence.

Below, the observation results derived from each chapter are synthesized to organize matters confirmed and unconfirmed through this analysis.

8.2 Synthesis of Analysis Results

8.2.1 Position within Lawsuit Documents

minheejin.net is described in the body of the complaint as a "website attacking Min Hee-jin (former ADOR CEO)" and is presented in parallel as part of a list of examples enumerating various aggressive websites.

However, the complaint did not explicitly define or confirm the operating entity, production background, truthfulness of posted content, or attribution of legal liability for the domain. Also, there is no implication that Min Hee-jin is a party to the lawsuit.

8.2.2 Site Entity Analysis Results

As a result of analyzing the structure of minheejin.net restored through web archives, the following technical characteristics were observed:

• Construction Environment: Produced using popular tools, WordPress and the Avada theme.
• Site Structure: Configured as a One-page form without separate menus or sub-pages.
• Metadata: HTML title and OG tags are set to "Min Hee-Jin, K-pop Criminal," fixing negative keywords regarding a specific person as the site identity.
• File Management: 'Copy-Copy' patterns are repeatedly identified in image filenames, showing traces of unrefined file management.
• Contact: Uses a secure mail service (ProtonMail) emphasizing anonymity, and features a structure soliciting tips from visitors under the pretext of "Bring her to justice."

8.2.3 Backlink Structure Analysis Results

As a result of analyzing backlink data extracted from Semrush, the following quantitative characteristics were confirmed:

• Total Backlinks: 701
• Target URL Concentration: All 701 observed links are connected solely to the main page (root domain). No distribution to sub-pages or individual content was observed.
• Link Attributes: Approximately 81% (566 links) of total links carry the Nofollow attribute, and 224 (32%) UGCmarkers exist. This suggests the possibility that a significant portion of links originated from comments, bulletin boards, or auto-generated pages.
• Anchor Text Concentration: A total of 90 types of anchor texts were observed, but a distinct concentrationphenomenon exists where the top 10 phrases account for approximately 80% of total links.
• Referring Domain Distribution: Links originated from a total of 266 domains, but an imbalance is observed where a few specific domains provide a large volume of links intensively.
• Referring IP Patterns: Most IPs host only 1 domain, but a phenomenon where a single server simultaneously hosts multiple domains and sends links is confirmed in 5 specific IPs.
• Link Fluctuations: 246 links are confirmed to be currently Lost, which includes deletion of original posts or closure of link source sites.

8.2.4 Cross-Analysis Results with Comparison Case Group

As a result of cross-comparing minheejin.net with 6 domains (stephaniejoneslies.com, stephaniejonesleaks.com, amandaghostsucks.com, alexanderbrothersextorted.com, lookbackfraud.com, paigejimenez.com) mentioned as similar cases in lawsuit documents and Expert Reports, the following multi-layered similarities were observed.

(1) Identity of Site Structure
All 7 sites show the identical One-page structure where 99%~100% of backlinks are concentrated on the single main page. This suggests they were designed as standalone Landing Pages targeting specific subjects without content depth.

(2) Repetition of Keyword Mapping Patterns
Combinations of "Target Name + Negative Keywords (Criminal, Fraud, Sucks, Lies, Extortion, etc.)" are repeatedly observed in the anchor texts of each site. They consist only of inflammatory expressions without natural citation contexts.

(3) Similarity in Call to Action Methods
All 7 sites show a common UX pattern soliciting anonymous tips by foregrounding moral justifications such as "Justice," "Investigators," and "End abuse." In particular, the 3 sites where email addresses were confirmed (minheejin.net, alexanderbrothersextorted.com, paigejimenez.com) all use ProtonMail and follow similar email naming conventions including the target person's name.

(4) Overlap of Backlink Infrastructure
As a result of a comprehensive analysis of IP addresses of Referring Domains that generated backlinks, a pattern where specific IPs repeatedly appear across multiple target sites was confirmed.

• The site(s) hosted on an IP owned by a Moldovan entity (195.20.19.178, AS201670) are generating backlinks to all 7 sites subject to analysis. It is noteworthy that this is the only IP that overlaps with the entire group of 7 sites.
• Reverse lookup results for this IP show only 25 domains hosted on this server, and about 68% are classified as related to SEO/backlink generation such as URL shortening, backlink tools, and content farms. This suggests the possibility that the IP is dedicated infrastructure for a specific purpose rather than large-scale shared hosting, lowering the probability of interpretation as 'coincidental IP overlap.'
• A total of 18 IPs are redundantly connected to 5 or more target sites, and 121 IPs are confirmed to overlap across at least 3 or more target sites.

(5) Exact Match of Backlink Source Domains
The 6 sites excluding Site B (stephaniejonesleaks.com) share a set of 47 identical backlink source domains. Site B was deleted due to hosting provider action after being registered on May 6, 2024, and it is presumed that the same backlink source set as other sites was not observed because initial backlink data was lost.
These 47 domains include keywords such as 'PBN,' 'Link sales,' and 'Expired domains' in their names, suggesting potential infrastructure related to backlink generation services. However, it was not confirmed whether these domains extensively generated links for other sites outside the analysis targets.

8.3 Matters Confirmed Through This Analysis

Synthesizing the above observation results, matters that can be technically confirmed through this analysis are as follows:

1. Position within Lawsuit Documents
   minheejin.net is explicitly mentioned in the US lawsuit complaint as an example of an aggressive website targeting a specific individual.
2. Technical Characteristics of the Site
   The site possesses typical formal characteristics observed in defamatory Landing Pages, such as a one-page structure, fixed negative keywords, and solicitation of anonymous tips.
3. Irregularity of Backlink Structure
   Structural characteristics distant from natural link generation patterns are observed, such as concentration of all links on a single URL, overwhelming Nofollow attributes, and concentration on a few anchor texts.
4. Structural Similarity with Case Group
   minheejin.net shares a high level of similarity in multi-layered aspects—site structure, keyword mapping, tip solicitation methods, backlink infrastructure, and backlink source domains—with the 6 comparison target sites mentioned in lawsuit documents and Expert Reports.
5. Existence of Common Backlink Sources
   • Common IP: IP 195.20.19.178 is commonly confirmed in the backlink sources of all 7 sites.
   • IP Nature Analysis: Only 25 domains are hosted on that IP, and 68% of them relate to SEO/backlink generation. This suggests the possibility of dedicated infrastructure for a specific purpose rather than large-scale shared hosting.
   • Common Domains: 6 sites (excluding Site B) are receiving backlinks from 47 identical domain sets.

While individual explanations may be possible for each of the above 5 items, the key observation result of this analysis is that all these patterns are observed simultaneously across the 7 sites.

8.4 Limitations and Reserved Matters of This Analysis

This analysis used only publicly accessible materials and is not a judgment based on professional qualifications or technical authority. Therefore, the following matters are outside the scope of this analysis and cannot be confirmed without additional evidence.

1. Specification of Operating Entity: Judgment on who created and operated this site.
2. Conclusion on Production Intent: Interpretation of purposes such as "attack," "manipulation," or "campaign."
3. Attribution of Legal Liability: Judgment on liability regarding specific individuals or groups.
4. Same Operator Status: Concluding that they are the same operating entity solely based on sharing similar infrastructure.
5. Legal Confirmation of Date Data: Semrush's observation dates (First seen/Last seen) represent only the time point when the system discovered the link and may not exactly match the actual creation/deletion dates.

8.5 Conclusion

This analysis aimed to organize the technical characteristics of the minheejin.net domain mentioned in the US lawsuit complaint as they are, based on public materials, and to observe structural patterns through comparison with similar case groups.

As a result of the analysis, minheejin.net is observed as part of a site cluster sharing similar structure, operation methods, and backlink infrastructure, rather than as an individual site existing in isolation. In particular, the fact that four characteristics—One-page structure, Negative keyword metadata, Anonymous tip solicitation, and Identical backlink sources—appear simultaneously across all 7 sites is a pattern difficult to explain as a coincidental match of individual characteristics.

However, such technical observations alone cannot specify the operating entity, intent, or responsibility, and such judgments can only be made through court proceedings or the securing of additional evidence.

9. Appendix

This appendix organizes the sources and verification methods of the materials used in the analysis from Chapters 1 to 8. It was written to secure the transparency and reproducibility of the analysis. Original data files are not provided to protect copyright and comply with service terms of use.

9.1 Summary of Litigation Case

The basic information of the lawsuit covered in this page is as follows:

• Case name: Jones et al v. Abel et al
• Court: United States District Court, Southern District of New York (S.D.N.Y.)
• Judge: Lewis J. Liman
• Case #: 1:25-cv-00779
• Nature of Suit: 190 — Contract / Other Contract
• Cause of Action: 28 U.S.C. § 1332 — Diversity (Breach of Contract)

9.2 List of Court Filings

본 분석에서 인용한 법원 제출 문서는The court filings cited in this analysis are as follows: 다음과 같다.

• Exhibit 1: Proposed Amended Complaint (Link)
• Exhibit 20: Horton Expert Report (Link)

9.3 Backlink Data and Verification Guide

The backlink data used in this analysis was extracted via Semrush Analytics. Original data files are not provided to protect the copyright and terms of service of the provider.

If verification of the analysis results is required, you may directly query the data under the conditions below. However, please note that backlink data is subject to constant fluctuation, so figures may vary depending on the time of the query.

• Analysis Tool: Semrush Analytics
• Analysis Targets: minheejin.net, stephaniejoneslies.com, stephaniejonesleaks.com, amandaghostsucks.com, alexanderbrothersextorted.com, lookbackfraud.com, paigejimenez.com
• Data Types: Backlinks, Anchors, Referring Domains, Referring IPs

9.4 Web Archive Links

The web archive snapshots referenced in this analysis are as follows. Web archives are publicly accessible materials and can be checked directly via the links below.

9.4.1 minheejin.net Archive

Main Page (Archived on 2024.12.14.)

Website Source (wp-content, Avada Theme | Reference 9-1)

Image Filename (Copy-Copy Pattern | Reference 9-2)

HTML Title / OG Tag (Reference 9-3)
"Min Hee-Jin, K-pop Criminal"

Footer Tip Solicitation Phrase (Reference 9-4)
"Please write here with your tips so we can bring her to justice."

9.4.2 Comparison Target Site Archives

Site A: stephaniejoneslies.com (Link)

Site B: stephaniejonesleaks.com (Link)

Site C: amandaghostsucks.com (Link)

Site D: alexanderbrothersextorted.com (Link)

Site E: lookbackfraud.com (Link)

Site F: paigejimenez.com (Link)

9.5 IP and Domain Lookup Related Materials

The IP address and ISP information referenced in the infrastructure analysis in Chapter 7 were queried through the following services.

Note: ISP and location information of IP addresses may vary depending on the time of query. The information presented in this analysis is based on results queried in December 2025.

The results of the additional query performed on the common IP 195.20.19.178 mentioned in Chapter 7 are as follows. (Link)

• ASN: AS201670 - S.C. INFOTECH-GRUP S.R.L. (Moldova)
• Reverse Lookup Result: 25 domains hosted on the corresponding IP
• Lookup Tool: ViewDNS.info Reverse IP Lookup
• Query Date: December 2025

Full List of 25 Domains Hosted on the Corresponding IP

Among the 25 domains above, 10 are related to URL shortening services (40%), 1 is a backlink tool (4%), and 6 exhibit content farm patterns (24%); thus, approximately 68% of the total are classified as having characteristics related to SEO or backlink generation. This indicates the possibility that the corresponding IP is not a general web hosting server, but dedicated infrastructure for a specific purpose (SEO/backlink generation).

9.6 Full List of 47 Common Backlink Source Domains

The full list of the "47 identical backlink source domains shared by 6 sites excluding Site B" mentioned in Chapter 7 is as follows.

This page is subject to update if relevant information is additionally secured in the future or if new facts are confirmed as the litigation progresses.