Topic: IS kwukduck AvalonShenzhen ? FOLLOW THE $$$ TIME FOR ANSWERS! (Read 1566 times)

why you bump a topic thats over 1 year old 

KwukDuck is a Dutch man, Mr Peter Stultiens, born 31-01-1986, Concordiastraat 24, 6092 NM, Leveroy, the Netherlands.
Link to Mr Peter Stultiens CV: pstultiens.com/cv-peterstultiens.pdf (Link removed. Search for cached link.)

Mr Peter Stultiens is the owner of Mr Peter Stultiens Webdesigner & Grafisch vormgever uit Leveroy.
Link with photos of Mr Peter Stultiens: www.pstultiens.com

Link to Mr Peter Sultiens Linkedin: nl.linkedin.com/in/peterstultiensleveroy (Link removed. Search for cached link. A new page with a picture of Mr Peter Stultiens with hair on his head and a beard is up. Mr Peter Stultiens real style is shaven head and no beard. Search for Peter Stultiens on Linkedin.)
Mr Peter Stultiens owns theperfectboobs.net, clipteez.com and mykink.xxx.
Theperfectboobs.net started 2009, clipteez.com and mykink.xxx 2012. According to the Dutch tax authority, Belastingdienst Eindhoven, Mr Peter Stultiens hasn´t paid any tax for theperfectboobs.net, clipteeze.com or mykink.xxx.

Mr Peter Stultiens Bitcoin account: 1KWUKDuCkwWA3RQdtzLDiUUB5a5ntazQts also unknown to the Dutch tax authority.

Mr Peter Stultiens works as Content Manager at Smartwares Home Improvement. Maybe Mr Peter Stultiens will be promoted to a higher office if you inform the company of his porn sites: http://smartwareshomeimprovement.eu/nl-nl/contactus

Link to Smartwares Home Improvement: http://smartwareshomeimprovement.eu/nl-nl/

https://bitcointalk.org/index.php?topic=488463.20
?

https://bitcointalksearch.org/topic/m.5227345 new and final topic for catching this guy

ok the email I got:

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
 s=N1-0105; d=Safe-mail.net;
 b=A+H0fClN3AOWeiR4eNfDjWJ1ZZ6pvGqSWuCXZ4J+PEK1j7Xn5wVIzcP/L46rOXyw
 pVDPck5y0ZKRYq9KfoD5WbNW/4Z3wx2UxS+V/x1yZLOZZyADAdvKB2YEUOcT0Da6
 0FPf841EBlbiXZJ+rJpug2jaxwa8dHNVhv6bXNg6BJ0=;
Received: from pc ([77.109.139.26]) by Safe-mail.net with https
Subject: Re: 1 miner please
Date: Thu, 13 Feb 2014 04:49:24 -0500
From: AvalonShenzhen
To: machinationus
X-SMType: Regular
X-SMRef: N1B-jH81_IrbWX
Message-Id: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-SMSignature: hCGishGLDT1qp2YGOkmZfgLy4yO9KDkBLz1+Q3AZuTOMxK6i3mV88fgYL4wfeRaB
 OWyng1lkQSIGuFDfB6zjlKHe2CtrEOVHeDPy4ULR/W1PvxBvWRvuNoIF9wD3enhm
 zZAS5dilBIPiS5k9ziWU3en2XCZIKsqcnvtDxqM8Pqk=


"Received: from pc ([77.109.139.26]) by Safe-mail.net with https"
domain   spftor5e1.privacyfoundation.ch
CONTINENT CODE    N/A
COUNTRY CODE    CH
COUNTRY NAME    Switzerland
REGION CODE    N/A
REGION NAME    N/A
CITY    N/A
LATITUDE    47
LONGITUDE    8
PROVIDER (ISP)    AS13030 Init Seven AG


So far 3 different proxy's.

"Received: from pc ([5.199.142.195]) by Safe-mail.net with https"

http://my-addr.com/custom-ip-info-and-ip-lookup/domain-city-country-geo-location-region/ip_info.php?ip=5.199.142.195&x=21&y=8

COUNTRY NAME    Germany

and

"Received: from pc ([85.17.24.95]) by Safe-mail.net with https"

COUNTRY NAME    Netherlands
REGION CODE    07
REGION NAME    Noord-Holland
CITY    Amsterdam
LATITUDE    52.35
LONGITUDE    4.9167
PROVIDER (ISP)    AS16265 LeaseWeb B.V.

could be a nice path.......

here are my headers ,from the mails i received from him:
 Return-Path: [email protected]
Received: from tamar.safe-mail.net ([213.8.161.229]) by mx-ha.web.de (mxweb006) with ESMTPS (Nemesis) id 0MREsR-1VkjW92FY7-00UeA5 for <[email protected]>; Fri, 14 Feb 2014 12:32:02 +0100
Received: by tamar.safe-mail.net with Safe-mail (Exim 4.66) (envelope-from <[email protected]>) id 1WEGzu-0003Ie-VP for [email protected]; Fri, 14 Feb 2014 06:31:58 -0500
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=N1-0105; d=Safe-mail.net; b=EtHwhNS+6AQPFKm1mUckveDdpB5Py1aFsUdT76xTs5p/fxhPRxG4MTKKzT+S+7FM Bvh8/KwKu+YCCcKMo0L/HYMI4OpzAy8BbX9lCr24kzItp4Y27eg+vtyfZpNvSHLc QeSQjrHq/p5LYeycgKcm2Zv6i/PS6lK5WPidnsMnJl4=;
Received: from pc ([5.199.142.195]) by Safe-mail.net with https
Subject: Re:
Date: Fri, 14 Feb 2014 06:31:58 -0500
From: [email protected]
To: [email protected]
X-SMType: Regular
X-SMRef: N1B-BiPQHnb4T5
Message-Id: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-SMSignature: Sr+sIMwBg8PCNCLJQcvSa6JYZ2FawSEOOIF1cYr5wL+QrGWAS1H4dgWYttzHv6kT 1N92J9t84ikVXRbqltjAPgoMZGmuE9J29vZER1irJuGji3HF2SyYDdZB1uHwtUNI KIzpYr4VxHB/qrYp1Yj6ndjNzd3/rcZlRbAxCRSeOvE=
Envelope-To: <[email protected]>
X-UI-Filterresults: unknown:5;V01:K0:8e8lDM5l6ro=:Dp8do4W6/McsH11FkfICUINC51 Gejklav6ycNfAoPQxCk2qxe2Zy0vaZFBUtD8gMCJ9HXfaVM7AkuxejGA+eChXAzWXXDQgP1XX eNw/d8uJZfDDCwll7/M/zkPbgIkHBI47wNymzlAfO/VHZzoSFspTyNByq1/3OarUa8niiiuLH tPCEQjPrFtuEgXuJl6kgg6hW/aMh8rAKXQPfvN23HPBWG1mW+g2ztX6SKDOj+so5nS8xYawad q3Uy7NPumRssLvf61mVtfqB4XEr9LLF5K5CIk80ZwxTM3iT3nER4gPnC3rrQujJx2t0mtG1RF hS1ENbu3avzzvq3zgQpeLg7XmFGsnkd52Rb7PAvwr3UQJw3Q8+jxOIgVynmkAeCRim+6c+bGx 3pY/21OTLK4GKuL+6HMZzjKCS+ZX1563Lgn9Rp33BqtXCFCQXAMILreg0DWnhosL5mOk++mC3 7nUMlQHZ4xUZRJzd4LTwV80isX4CDJYzS7zOmqRuQHGA4QaYHiKgj+jFV9RTfH82RxIrNUhE4 33Yw/gvRv02R7Iy5cnulXjDUm8WLnsxSWYj0CL6s1a0a2uTTCHC8Fz6mpS+6KvcXvwF48mfJd PSoTpWH4ZGGoWNNCPDHXW8+6asH6p97uTJrkTcqNl7d/+WAV+OG+eVbh1rUoACCeubXAd/tIt m6SsdXm0vHXHIndRXOGXKGBYJ3GbK47kVe199BksEByskBllgR0axsD8PY7W7qJfXUIH5qri5 fen/wZhREgyfrii+/CrWXoDmGrw5egYETDqVCrqjimTVKkGIxlcyCD0fFE4RDhbAHHv9YmXSf mYeOLNi+XfEvIRAFhKzr+ZMtzkHszKPmJVn82jU/fhgpzqgi8A6117sCQSqoQfKOajl85duQ7 VBKyKQE3xNJjHSIbTBA1Q/4R2hSE9qERq0Jx2KNbCTtmFxnL7aVqrS98AUH9jXNmFqRDC7EQm Tr9Ug4Nt+fUQGyubOuSthiBu05UUpHOkK2FjocgC25/sK3cPfx2gUP6G55sKHuo9iDsopoCxF tv8p8pohus5tDAfQekpTqVBrGzfWKotPQkwCpChpvberD2hlI1V6eiDU4lmDWWHYQVfH6IvgZ M+0J74y5zaMdLp0nj7TmCc0p0jiBu2BrXPUpdT4wjfokFcMvXK24ZaKLVIkc6uram0Gf/rvf6 rwkcETp2E8A6Tf0BZphnSWZncSa/rfUnIph6UOlOw47caEseeLu7ob04xSx8MKQ4CfyO9E4k5 H+BPu5aBl60+6vEFIdojNgureSIP+FRaPgeBtbWBmh6xzj77fFEmyEjMH9WxyJ1Ksc7tAo8Qk PQa6





 Return-Path: [email protected]
Received: from tamar.safe-mail.net ([213.8.161.229]) by mx-ha.web.de (mxweb004) with ESMTPS (Nemesis) id 0MVw6q-1Vh5322aKW-00X6nd for <[email protected]>; Thu, 13 Feb 2014 21:55:12 +0100
Received: by tamar.safe-mail.net with Safe-mail (Exim 4.66) (envelope-from <[email protected]>) id 1WE3JH-0003D9-94 for [email protected]; Thu, 13 Feb 2014 15:55:03 -0500
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=N1-0105; d=Safe-mail.net; b=Ne5AsSn7JAEy9bKH2OqS05iYNc67Ol2IWqMPn1qA9nKe5oKplCe26abuAf7u75vg 8ZfvUN5wxv/0+AGM+A0b7cOvOszBCrw/E/Xai32D8nXUYDevyTzyfTu+vvE+Gss5 Bie72uvzorGvqtYDvUBxtFbuGvpl+yBeFx7+ElfmeNk=;
Received: from pc ([85.17.24.95]) by Safe-mail.net with https
Subject: Re: order
Date: Thu, 13 Feb 2014 15:55:03 -0500
From: [email protected]
To: [email protected]
X-SMType: Regular
X-SMRef: N1B-PeFjV6kojl
Message-Id: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-SMSignature: zDs2Oj3hPnKwHZB2QGEx+qjxizBmeaaX510DQN6TXzqAMZojGW8qbjQlV9wUBmiM jE25UfehCqTHK3ClIejV94PiABtg3D1P/EeC50OARisZnrFvBwLNWxEuUR4TO8wl re+04niwe/pmAMuZQILWCaNqh7CivfE187phdSo3iQQ=
Envelope-To: <[email protected]>
X-UI-Filterresults: unknown:5;V01:K0:L3xZBZREsXc=:kaLny729fab2X5flydbOx4drOD k/xS/jT9cjsNX6FV3s7XTwbN+ent0IVwMURjUWJWzr0bAo2QEk3PX/frIpaxIcWuFBIDuIAxa 4ABsIPnqT5MAtWli/lPu6L73Fpb60vtxtGelgEFy9yeIfHpuJD5rwQy9AJCnB6NiMattUPe+6 IZGQaDeYjCO/ylMU616yrgU95lhcSSlF3l+To4AZgP7SOBsO2ZheT/+MChBR62AKeayDZdZfI SfiS64gm6lyR0VEoCejj8izwBb2CCa63zrgKPgHba3Dj9f3vVIRjANP0LKzbDm5+8EqBduYRi BTzmBVLbSdSMcUL3VWl0TaEOMuY7GeIUCBl0VL80vIgM/Zt7WD2EjPRoUDDz2I/45OAuTL9am RB7WzpqtqMGoandkB33qFzKarM/IgYU+sKHsvp4D0EWdhTcPeVGTR5qYfPilLP1GIKKxQBG6W WuR0c7cr3pnA3BnTKDrWxgu9kyA66vI+VxaDunCfs043Rs9zzxWlHAC8T0j2QrvAytXKqUm4R CxOt8lxo+1uT9QgflYPqAnhqRwSayjHeygA0xE47+ZU/1OWyyDudQ6L7dKSpxvHg2frQkAWaY 8FT9kIWFVDG2+Re0/Wu5uDSHCmhK5TnPXiNH1ZLM9xtHBHBVn5D4oqH7QhisW3ksmMQdDXFE3 idtg4CSt8nqL6Jhw8UScagoVUbNatlcXccy3Ioa3Ap7ipplkxhjoFo/SSlEDxmS1681WEvmy0 EQpjkrY7/dUDn69bLUOXVcbIdo9MkT9GHs+RgqXOQp8ndAuG7+6QVRYNLOfqA310O2H4LRy3I HHive68n7caz6PhQRVl+r1VYyB8akTewHz0oUJAkMKyiInsBHDvyJALQOx5OpDSmOcnF6THRV rXeHZAybytsSnL/pSb7zBLvTtXueIZIGXAVooqweD5Tecy7pX8DIjVvAmbWn7fDqW6DcTMh38 vDY1R16kRFEWgsVSmymmieaackDMhRsWrU5QkIcjt00RDy15VSe5v9EytYfm94ztyVWT+CVQw rw8cRmgyCZYmMLxoiwhHI9Nzev9qbXAxX2gnqRyaWYoqN12I7J5QU/wSgZueB0Mks3MY7hb9B yni/KQu7DogbAA/fJnQh7REIH1orLNYFkU3ZZz+9Eo0vxlAQoUFT9EL9dPduMN1PgWT2ReVrZ esoLjpp7miwwrkIiYfpFTkaVE0jWlnAoQFOt2U6enEcVw9mlD1duun8EIseCPVGzN4F/11YRk paHmbNL95CwdfilM8IucYvuPST8Knnch2hMtEeerZkUBkLAMWUF6ojcdm2b+V4ny7OWFOiLjD ZroG


mayby it could help...


falseflag

Great work i hope we can catch this guy/guys at least get an adress then its done.....

I was out 2.2Bitcoin, so would be nice seeing them again.

I also lost money to this person 1.1BTC. However going by the IP who relayed the transaction is not reliable. Bitcoin protocol holds no information about who relayed what transaction and the information displayed on blockchain is only from who blockchain received the transaction from. Looking at blockchain for that ip it seems that node relays tons of transactions:

https://blockchain.info/ip-address/188.142.36.95

I agree to an extent, not many facts have been posted other than who sent bitcoins to 1Mzyo7PYfsxNLyNWhnznUYfiX1Kf6LFqkh
and some speculation about where the email's were sent from without providing IP's or headers. I'm sure the authorities will be looking at
a pile of info to finger this thief. whomever the thief is would be well served to make sure all bitcoins end up back where they came from,
before they are caught red handed. 50K is a lot of money by most standards, but is it worth 10-20 years in prison?

I will be passing this info along to the proper authorities in both countries and let them decide.
Coincidence? I think NOT!

AFAIK nodes have nothingto do with the owner of the BTC.

Follow the money here > https://blockchain.info/address/e659a2b53fec5c8864213fe9af39b7aad6c0b825

Money is moving!

From:
1Mzyo7PYfsxNLyNWhnznUYfiX1Kf6LFqkh

https://blockchain.info/address/e659a2b53fec5c8864213fe9af39b7aad6c0b825

To:
1HuXTzmxQUvarrbufx1CEitNskUMLG4mVM

https://blockchain.info/address/1HuXTzmxQUvarrbufx1CEitNskUMLG4mVM

NODE IP > https://blockchain.info/tx/f186f76bb83390f73e49217e9695da8c54596ebb06b4eb676536928f242732c8/1

Coincidence the bitcoin transfer node ip?

Relayed by IP  188.142.36.95    Shocked http://188.142.36.95/   http://188-142-36-95.ftth.ispfabriek.nl/
 
Whois record: http://myip.ms/info/whois/188.142.36.95/k/3853019107/website/theperfectboobs.net


WOW theperfectboobs.net Announced here on BCT by who?

Bitcoin Forum > Economy > Marketplace > Service Announcements > Cosmetic Surgery Crowdfunding @ theperfectboobs.net

Announcement by:

Name:  kwukduck
Posts:  661
Activity: 661
Position:  Hero Member

https://bitcointalksearch.org/topic/cosmetic-surgery-crowdfunding-theperfectboobsnet-145296

I personally PM'ed kwukduck with this info. I have not received a reply!