vdragon Erupter-Groupbuy-Scam : Task Force - page 8.

nottm28

hero member

Activity: 574

Merit: 500

Quote from: green65 on July 26, 2013, 01:17:26 PM

I have been googling and contacting some of the owners of the outputs in the blockchain and they confirm that the transactions relate to bitcoins they bought on bitstamp. Getting the info from bitstamp should not be too much of an issue as they are a UK registered company therefore they have to follow the proceeds of crime act and money laundering regulations.

Does anyone from the group buy live in London and would be happy to contact the Mets E-Crime unit?

Can someone contact bitstamp by every means they can ASAP and get them to freeze his account as he may not have withdrawn the funds yet.

This is the address we need to be looking at: https://blockchain.info/address/1CSPFR5CrkcxHmNG9yra3rL2BW6BHttJHL

This address is his bitstamp address https://blockchain.info/address/1meLbV7TMMSpWrW9Nw6QUAbf9XJRztXL8 all the outputs are our coins being sold (i contacted the outputs owners).

green, you should contact them direct yourself asap - https://online.met.police.uk/

green65

newbie

Activity: 27

Merit: 0

I have been googling and contacting some of the owners of the outputs in the blockchain and they confirm that the transactions relate to bitcoins they bought on bitstamp. Getting the info from bitstamp should not be too much of an issue as they are a UK registered company therefore they have to follow the proceeds of crime act and money laundering regulations.

Does anyone from the group buy live in London and would be happy to contact the Mets E-Crime unit?

Can someone contact bitstamp by every means they can ASAP and get them to freeze his account as he may not have withdrawn the funds yet.

This is the address we need to be looking at: https://blockchain.info/address/1CSPFR5CrkcxHmNG9yra3rL2BW6BHttJHL

This address is his bitstamp address https://blockchain.info/address/1meLbV7TMMSpWrW9Nw6QUAbf9XJRztXL8 all the outputs are our coins being sold (i contacted the outputs owners).

augustocroppo

vip

Activity: 756

Merit: 504

Quote from: Xer0 on July 26, 2013, 01:01:32 PM

Is there a possibility to trace his laundry attempts by some clever analysis?

I randomly clicked through the flow and found this fresh and heavy loaded:
https://blockchain.info/de/address/1LFMjVQgW2dCqmDGc1hJzuZeMNvpgKAGdu

Yes, it is of course. However it is very exhaustive and only with the cooperation of the Bitcoin services used by vdragon that would result anything meaningful.

escrow.ms

legendary

Activity: 1274

Merit: 1004

Quote from: Xer0 on July 26, 2013, 01:01:32 PM

Is there a possibility to trace his laundry attempts by some clever analysis?

I randomly clicked through the flow and found this fresh and heavy loaded:
https://blockchain.info/de/address/1LFMjVQgW2dCqmDGc1hJzuZeMNvpgKAGdu

His sent bitcoins are relayed by blockchain.info.
https://blockchain.info/tx/5030c77e169e72ad1dcdce1fbb82b95b1312946b0af970aa13710fd4d08068af

Relayed by IP Blockchain.info

Xer0

hero member

Activity: 826

Merit: 1000

°^°

Is there a possibility to trace his laundry attempts by some clever analysis?

I randomly clicked through the flow and found this fresh and heavy loaded:
https://blockchain.info/de/address/1LFMjVQgW2dCqmDGc1hJzuZeMNvpgKAGdu

escrow.ms

legendary

Activity: 1274

Merit: 1004

https://wisepass.com/tx/1D0673A313A575C41BF61F7C28446341DD950A98743CB5EAC6735FE3308C45C2

So yeah he did withdrawal using bitstamp.

augustocroppo

vip

Activity: 756

Merit: 504

Quote from: escrow.ms on July 26, 2013, 12:28:42 PM

Is there anyone from bitstamp here? if yes.. he wrote about bitstamp on many post,so i think you can ask them to match his details (email address, bank info etc) with their customers.

Oh yeah, I just came across this:

https://bitcointalksearch.org/topic/m.2431654

Quote from: vdragon on June 10, 2013, 11:28:47 AM

rP7vYMsX3TTMS1FQJNKhyefeHUJL1kuCph

https://wisepass.com/tx/06C0C0AA42A610FBA30BE12AFB8B21326745F91DF9A3A15D784A420C35BEBB07

Quote

Transaction
06C0C0AA42A610FBA30BE12AFB8B21326745F91DF9A3A15D784A420C35BEBB07

Ledger
1007452

Type
Trusting

Time
2013-06-10 19:35:40 UTC

By
rP7vYMsX3TTMS1FQJNKhyefeHUJL1kuCph

Trust
rvYAfWj5gh67oV6fW32ZzP3Aw4Eubs59B for USD 10000

https://wisepass.com/ripple/rvYAfWj5gh67oV6fW32ZzP3Aw4Eubs59B

Quote

Address
rvYAfWj5gh67oV6fW32ZzP3Aw4Eubs59B

Type
Gateway

Name
BitStamp

escrow.ms

legendary

Activity: 1274

Merit: 1004

Is there anyone from bitstamp here? if yes.. he wrote about bitstamp on many post,so i think you can ask them to match his details (email address, bank info etc) with their customers.

augustocroppo

vip

Activity: 756

Merit: 504

Quote from: albon on July 26, 2013, 12:21:49 PM

When I sent him the invoice it came up as the person I was sending it to on paypal

26 Jul 2013
Invoice To Stefan Darin Pending Details Invoice To Stefan Darin Choose Remind

sent it to his email address on his profile page

True, I just verified my Paypal account and now the name is show over the email address!

albon

legendary

Activity: 1932

Merit: 1549

Quote from: augustocroppo on July 26, 2013, 12:17:04 PM

Quote from: albon on July 26, 2013, 11:23:41 AM

Well I just sent him an invoice from paypal and his name comes up

Stefan Darin ([email protected])

He must have a certified paypal account

I sent an invoice as well but no name came up. How exactly did you obtained this information?

When I sent him the invoice it came up as the person I was sending it to on paypal

26 Jul 2013
Invoice To Stefan Darin Pending Details Invoice To Stefan Darin Choose Remind

sent it to his email address on his profile page

augustocroppo

vip

Activity: 756

Merit: 504

Quote from: albon on July 26, 2013, 11:23:41 AM

Well I just sent him an invoice from paypal and his name comes up

Stefan Darin ([email protected])

He must have a certified paypal account

I sent an invoice as well but no name came up. How exactly did you obtained this information?

augustocroppo

vip

Activity: 756

Merit: 504

Quote from: escrow.ms on July 26, 2013, 09:10:22 AM

there is a site linked in his profile,but i doubt it's his site.

https://exicom.hu/php/index.php?lang=hu
http://who.is/domain-history/exicom.hu

Just in case...

http://centralops.net/co/DomainDossier.aspx?addr=exicom.hu&dom_dns=1&dom_whois=1&net_whois=1

Quote

inetnum: 178.238.210.0 - 178.238.210.255
netname: MAXER-NET
descr: MAXER Hosting Kft.
descr: HU 9024 Gyor Repce u. 24.
country: HU
admin-c: ZV41-RIPE
tech-c: ZV41-RIPE
status: ASSIGNED PA
mnt-by: DENINET-MNT
changed: [email protected] 20110328
source: RIPE

person: Zoltan Virag
address: H-1132 Budapest, Victor Hugo u. 18-22.
address: HU
phone: +3612960075
fax-no: +3612960076
nic-hdl: ZV41-RIPE
notify: [email protected]
e-mail: [email protected]
mnt-by: DENINET-MNT
remarks: ---------------------------------------------
remarks: Please send all abuse and spam complaints to:
remarks: [email protected]
remarks: ---------------------------------------------
changed: [email protected] 20071018
source: RIPE

http://www.domain.hu/domain/English/domainsearch/whois.html?domain=exicom.hu&ekes=exicom.hu&crypt=ew60p53wm6h5hltdol99oj6f2gwhwmiw&printable=&code=82hqnw7

Quote

domain:   exicom.hu
registrant:   Exicom Rendszerház Kft.
registrant:   Exicom Rendszerház Kft.
address:   Tisza Lajos Krt. 47
address:   6722 Szeged
address:   HU
phone:   +36703895328
fax-no:
hun-id:   1002879674
admin-c:   2003534900
tech-c:   2003534901
zone-c:   2003534902
name server:    ns1.maxer.hu
name server:    ns2.maxer.hu
registered:   2005-05-03 12:35:33
changed:   2011-12-27 11:19:54
registrar:   1000236692

admin-c:   MAXER Hosting Kft
address:   Repce u. 24.
address:   9024 Gyor
address:   HU
phone:   +3612579913
fax-no:   -
hun-id:   2003534900

tech-c:   MAXER Hosting Kft
address:   Repce u. 24.
address:   9024 Gyor
address:   HU
phone:   +3612579913
fax-no:   -
e-mail:   [email protected]
hun-id:   2003534901

zone-c:   Nyers Peter
address:   Repce u. 24.
address:   9024 Gyor
address:   HU
phone:   +3612579913
fax-no:   -
hun-id:   2003534902

registrar:   Deninet Ltd.
registrar:   Deninet Kft. (Registrar)
address:   Bercsényi u. 79/b.
address:   1188 Budapest
address:   HU
phone:   +36-1-2960075
fax-no:   +36-1-2960076
hun-id:   1000236692

John (John K.)

legendary

Activity: 1288

Merit: 1227

Away on an extended break

PS: Only theymos can access his IP right now, although I doubt that he wasn't using TOR/VPN if he were intending to scam all the way here. Have anyone shipped anything to him previously?

augustocroppo

vip

Activity: 756

Merit: 504

Quote from: speciall on July 26, 2013, 06:55:15 AM

it seems that vdragon owns or owned an avalon,
maybe we can trace back via this way?

https://bitcointalksearch.org/topic/m.2356609
https://bitcointalksearch.org/topic/m.1635436

I assume the avalon owners are pretty limited and the company maybe can help tracing

Or via Pool owners, they maybe record ip addresses
https://bitcointalksearch.org/topic/m.2030686

All right, let's assume vdragon really owns a massive quantity of GPU cards to mine Bitcoins. If he really lives in Szeged, Hungary, this must be one of his IP addresses:

http://getaddr.bitnodes.io/1/hungary/szeged/

Quote

Szeged, Hungary
The table below lists all the active Bitcoin nodes (based on run #0001) found in Szeged, Hungary as of May 12, 2013.

ALL NODES (71)
1 160.114.128.7
2 160.114.149.1
3 160.114.152.251
4 178.164.136.143
5 178.164.136.175
6 178.164.177.175
7 178.164.177.179
8 178.164.177.73
9 178.164.203.70
10 178.164.229.206
11 178.164.231.177
12 178.164.231.63
13 178.164.231.9
14 188.143.107.23
15 188.143.35.31
16 188.143.41.228
17 188.36.34.177
18 188.36.37.169
19 188.36.39.55
20 188.36.41.88
21 188.36.42.216
22 188.36.46.221
23 188.6.10.210
24 188.6.13.214
25 188.6.168.14
26 188.6.168.255
27 188.6.8.123
28 194.38.110.253
29 194.38.114.82
30 195.38.124.132

31 195.38.124.246
32 31.46.72.68
33 31.46.78.37
34 46.107.243.59
35 46.107.38.151
36 46.107.39.158
37 62.165.234.45
38 84.0.37.149
39 84.0.37.227
40 84.0.37.67
41 84.236.109.58
42 84.236.11.147
43 84.236.12.167
44 84.236.14.136
45 84.236.15.71
46 84.236.9.19
47 84.3.11.35
48 84.3.173.188
49 84.3.175.63
50 84.3.2.182
51 84.3.2.41
52 84.3.236.227
53 84.3.238.195
54 84.3.5.213
55 84.3.9.134
56 85.238.88.53
57 85.238.89.160
58 87.97.11.2
59 91.82.137.152
60 91.83.13.11

61 91.83.13.92
62 91.83.15.223
63 91.83.18.252
64 91.83.3.122
65 92.249.193.173
66 94.21.217.165
67 94.21.217.74
68 94.21.217.75
69 94.21.254.159
70 94.21.254.223
71 94.21.254.242

http://getaddr.bitnodes.io/74/hungary/szeged/

Quote

Szeged, Hungary
The table below lists all the active Bitcoin nodes (based on run #0074) found in Szeged, Hungary as of Jul 26, 2013.

ALL NODES (14)
1 178.164.136.159
2 194.38.115.208
3 91.83.9.227
4 188.36.41.88
5 62.201.102.42
6 160.114.36.196
7 84.0.36.240
8 84.3.5.213
9 91.83.15.177
10 178.164.177.142
11 178.164.222.212
12 91.83.28.139
13 160.114.49.225
14 94.21.252.165

Xer0

hero member

Activity: 826

Merit: 1000

°^°

Quote from: albon on July 26, 2013, 11:23:41 AM

Well I just sent him an invoice from paypal and his name comes up

Stefan Darin ([email protected])

He must have a certified paypal account

my Paypal says "User is currently not able to receive Payments" or so (in german) - maybe phished acc

albon

legendary

Activity: 1932

Merit: 1549

Well I just sent him an invoice from paypal and his name comes up

Stefan Darin ([email protected])

He must have a certified paypal account

Xer0

hero member

Activity: 826

Merit: 1000

°^°

Quote from: kuusj98 on July 26, 2013, 10:59:15 AM

We can trace the shop and see if there is a second floor with the logo on it.

checked shop and around with streetmap, logo nowhere found
we need someone who can hungary and an active forum there

MPOE-PR

hero member

Activity: 756

Merit: 522

Quote from: ?? on ??

What is you definition to know if it is a random idiot?

Here we have a group buy from an account with a good activity and also yxt posted that at the begin of the group buy:

You have got to be kidding me.

Think about it this way: it costs a few cents to replicate this "good activity".

Quote from: ?? on ??

These arguments are easy but in fact it was impossible to know and finaly it is the bitcoin world, we are never sure at 100% about what we order until bitcoin has another platform than a forum to organize group buy.

No. This is long discredited nonthink. You don't get to do something stupid and then get out of jail free because you didn't know better. There is another platform to organize a group buy as well as anything else. We are sure and we do know. Get with the program.

kuusj98

hero member

Activity: 812

Merit: 1000

I <3 VW Beetles

We can trace the shop and see if there is a second floor with the logo on it.

escrow.ms

legendary

Activity: 1274

Merit: 1004

there is a site linked in his profile,but i doubt it's his site.

https://exicom.hu/php/index.php?lang=hu
http://who.is/domain-history/exicom.hu

Topic: vdragon Erupter-Groupbuy-Scam : Task Force - page 8. (Read 45983 times)