Bitcoin Forum
November 18, 2017, 11:59:10 PM *
News: Latest stable version of Bitcoin Core: 0.15.1  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: [1] 2 3 »  All
  Print  
Author Topic: The hunt for Triswardhani (Lithium - XLTH)  (Read 2264 times)
Gizfreak
Legendary
*
Offline Offline

Activity: 1092


Allergic to false promises


View Profile
January 23, 2017, 12:22:34 PM
 #1



Yes, it's yet another ICO scam (why do people keep falling for this shit anyway).
The scammer disappeared with almost no traces left, right after the goal of 40 BTC was reached.

The pre ann thread was closed and the XLTH website was taken down.

If you can help in any way to hunt down this criminal, you're welcome to post here or contact me.
And please no accusations without hard facts. I am taking this one very serious.

Another thread that is being used for this purpose is this one by Jimmy Recard btw.

BTC address used during the ICO: 1J5RjgAHg8YPe6jF44vBJPF6Epwgf65PFY
1511049550
Hero Member
*
Offline Offline

Posts: 1511049550

View Profile Personal Message (Offline)

Ignore
1511049550
Reply with quote  #2

1511049550
Report to moderator
1511049550
Hero Member
*
Offline Offline

Posts: 1511049550

View Profile Personal Message (Offline)

Ignore
1511049550
Reply with quote  #2

1511049550
Report to moderator
1511049550
Hero Member
*
Offline Offline

Posts: 1511049550

View Profile Personal Message (Offline)

Ignore
1511049550
Reply with quote  #2

1511049550
Report to moderator
Coinlancer is Disrupting the Freelance marketplace!
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1511049550
Hero Member
*
Offline Offline

Posts: 1511049550

View Profile Personal Message (Offline)

Ignore
1511049550
Reply with quote  #2

1511049550
Report to moderator
mvl
Jr. Member
*
Offline Offline

Activity: 32


View Profile
January 23, 2017, 12:30:55 PM
 #2

Yes, it's yet another ICO scam (why do people keep falling for this shit anyway).
The scammer disappeared with almost no traces left, right after the goal of 40 BTC was reached.

The pre ann thread was closed and the XLTH website was taken down.

If you can help in any way to hunt down this criminal, you're welcome to post here or contact me.
And please no accusations without hard facts. I am taking this one very serious.

Another thread that is being used for this purpose is this one by Jimmy Recard btw.


Let's use this for the factual stuff, not for the wild accusations just based on gut feelings.

I think the hack into the devs own account at his ICO and XLTH-Wallet accounts is a good starting point.
https://s29.postimg.org/5e327cerb/image.png

There it is.
Google the email address crt.ferguson@gmail.com

You will see it belongs to bct user 'templar77'
You can find it in many threads on the forum, like this one: https://bitcointalk.org/index.php?topic=600322.msg6683579#msg6683579

Templar77 was involved in many controversial actions (Libertycoin):
https://bitcointalk.org/index.php?topic=760653.0

Invest for yourself. He is the guy behind Grumpycoin and Dogenex

This is his profile page: https://bitcointalk.org/index.php?action=profile;u=150444
This is also a nice find (Honorcoin) : https://bitcointalk.org/index.php?topic=639043.msg7218665#msg7218665

Certainly someone with a "history".

I leave it to you to dig up more information for now. Feel free to send me a PM.

Oh, one more thing, just to show how ultimately stupid this guy is: the "exchange source code" that he sent out to level3 investors, contained a database dump. In that database dump, his username and password for the XLTH ICO and Wallet site were stored (password in clear text). How stupid is that? That is where the screenshots came from.

Please, let's just post hints and allegations that you were able to verify up to a certain level of certainty. There are more scams and more scammers on the forum, but they are not necessarily pulled by the same scammer just because yout gut feeling tells you so.
iqbal26
Sr. Member
****
Offline Offline

Activity: 406


View Profile WWW
January 23, 2017, 12:35:53 PM
 #3

Have rewards  Grin haha just kiding


  ███████████▄▄      ███████████▄▄▄    ███████████▄▄
  ██████████████▄    ██████████████▌   ██████████████
  █████    ▀█████▌   █████    ▐█████   █████    █████▌
  █████     ▐█████   █████▄▄▄▄█████▀   █████▄▄▄▄█████▌
  █████     ▐█████   ████████████▀     █████████████▀ 
  █████     ▐█████   █████  ██████▄    █████
  █████    ▄█████▌   █████   ▀█████▄   █████
  ██████████████▀    █████    ▀█████▌  █████
  ▀▀▀▀▀▀▀▀▀▀▀▀       ▀▀▀▀▀      ▀▀▀▀▀  ▀▀▀▀▀





             ▄██▄
     ▄      ▐████   ▄▄
   █████     ██████████
    █████████████████▀
 ▄████████████▀████▌
██████████     ▀████     
 ▀▀   █████     ██████████
      ▀████▌▄████████████▀
    ▄▄▄███████████████▌
   ██████████▀    ▐████
    ▀▀▀  ████▌     ▀▀▀
         ▀███▀

                 ▄████▄▄    ▄
██             ████████████▀
████▄         █████████████▀
▀████████▄▄   █████████████
▄▄█████████████████████████
██████████████████████████
  ▀██████████████████████
   █████████████████████
    ▀█████████████████▀
      ▄█████████████▀
▄▄███████████████▀
   ▀▀▀▀▀▀▀▀▀▀▀
fikihafana
Sr. Member
****
Offline Offline

Activity: 462



View Profile
January 23, 2017, 12:36:36 PM
 #4

gizfreak check PM
fikihafana
Sr. Member
****
Offline Offline

Activity: 462



View Profile
January 23, 2017, 12:37:17 PM
 #5

Have rewards  Grin haha just kiding

any bounty ? hahaha  kiding
JimmyRecard
Member
**
Offline Offline

Activity: 98


View Profile
January 23, 2017, 12:50:32 PM
 #6

loljosh, mintodev, templar77, Carlos RT Ferguson & nite69 are all confirmed alt accounts of the same user/team, if templar77 & CRT.Ferguson are linked to the addresses and username to the XLTH lithium dev Trishwardhani then you can be sure it is them.

Here is what I posted earlier in the other thread that is Fact:

Hi man, I want to join the project. I'm from Mexico. I'm Mid Level PHP dev, but I can also help with design, PR, advertising, and all that cool stuff. So  plz tell me if I can help with something. Smiley

So that's him. Apparently, he wanted to learn about creating an altcoin exchange but didn't get root access (https://bitcointalk.org/index.php?topic=320975.20) so he couldn't quite complete the one for lithium

Check this out:

https://bitcointalk.org/index.php?topic=595055.0

https://bitcointalk.org/index.php?topic=466908.0

Twitter Account: https://twitter.com/correosdelbosqu

Name: Josue Aguilar

Location: Panama

Facebook: https://www.facebook.com/josue.aguilar.165685

Name: Josue Aguilar

Location: Boston, New York

Occupation: Self-Employed Web Designer & Developer at Koby. https://www.facebook.com/pages/Koby/633701170023082?ref=br_rs (San Carlos, Panama, Panama)

Places Lived: Sweden 2001, Canada 2007, USA 2014


https://www.quora.com/How-do-I-read-and-then-catch-waves-when-surfing/answer/Josue-Aguilar-6 (Same account as Twitter)

https://bitcointalk.org/index.php?topic=600322.msg7027527#msg7027527
Quote
24hash.com was set up by the 2 scammers. they paid out some miners while they kept the bulk (it speculated around 3 million, but could be more). It was Templar77/Carlos RT Ferguson and loljosh the teen ager Canadian

The Email for Lithium was crt.ferguson@gmail.com remember now this guys name is Carlos RT Ferguson.... would you believe it the dumbass lol

Some chat logs from back in the day of 2014, pankkake seems to be loljosh from deciphering the chat logs......
http://btcbase.org/log/2014-08-20

pankkake trying to extort money on Bitcointalk
https://bitcointalk.org/index.php?topic=344219.0

Weird talk on hackernews by pankkake with a user named josephagoss posting as well.... (Facepalm)
https://news.ycombinator.com/item?id=7087839

Their hackernews comments:

https://news.ycombinator.com/threads?id=josephagoss

https://news.ycombinator.com/threads?id=pankkake

Nite69 on bitcointalk was one of his alts as well but he lost the password or was using a throwaway email since that account hasn't logged in since September 2014 Roll Eyes

Thats about it for now, probably more to link up due to those chatlog names Wink

Gizfreak
Legendary
*
Offline Offline

Activity: 1092


Allergic to false promises


View Profile
January 23, 2017, 12:51:40 PM
 #7

Have rewards  Grin haha just kiding

any bounty ? hahaha  kiding
For me the bounty is called justice and that's without kidding  Wink
vlom
Legendary
*
Offline Offline

Activity: 826



View Profile WWW
January 23, 2017, 12:57:33 PM
 #8

i just searched for the e-mail address crt.ferguson@gmail.com. thats all.

http://website.informer.com/email/CRT.FERGUSON@GMAIL.COM



http://website.informer.com/coinnuke.com

Quote
Domain Name: COINNUKE.COM
Registry Domain ID: 1853542653_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.enom.com
Registrar URL: www.enom.com
Updated Date: 2014-04-05 16:14:58Z
Creation Date: 2014-04-05 23:14:00Z
Registrar Registration Expiration Date: 2015-04-05 23:14:00Z
Registrar: ENOM, INC.
Registrar IANA ID: 48
Registrar Abuse Contact Email: abuse@enom.com
Registrar Abuse Contact Phone: +1.4252744500
Domain Status: clientTransferProhibited
Registry Registrant ID:
Registrant Name: CARLOS TORRES
Registrant Organization:
Registrant Street: EDIMBURGO 4
Registrant City: MEXICO
Registrant State/Province: DISTRITO FEDERAL
Registrant Postal Code: 03100
Registrant Country: MX
Registrant Phone: +52.5512545826
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: CRT.FERGUSON@GMAIL.COM
Registry Admin ID:
Admin Name: BRYAN APPERSON
Admin Organization: BITRONIC TECHNOLOGIES
Admin Street: P.O. BOX 1614
Admin City: SOUTHOLD
Admin State/Province: NY
Admin Postal Code: 11971
Admin Country: US
Admin Phone: +1.6318735817
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: ADMIN@BITRONICTECH.NET
Registry Tech ID:
Tech Name: BRYAN APPERSON
Tech Organization: BITRONIC TECHNOLOGIES
Tech Street: P.O. BOX 1614
Tech City: SOUTHOLD
Tech State/Province: NY
Tech Postal Code: 11971
Tech Country: US
Tech Phone: +1.6318735817
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: ADMIN@BITRONICTECH.NET
Name Server: NS1-MAYA.HOSTING-MEXICO.NET
Name Server: NS2-MAYA.HOSTING-MEXICO.NET
DNSSEC: unSigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
Last update of WHOIS database: 2014-04-05 16:14:58Z

Gizfreak
Legendary
*
Offline Offline

Activity: 1092


Allergic to false promises


View Profile
January 23, 2017, 01:01:11 PM
 #9

Reading Jimmy Recard's post, I come to the conclusion that there are maybe more connections going on, maybe even more people involved.
But for this thread i'll stick to Triswardhani and the Lithium Project and I think we are getting some good evidence together.
vlom
Legendary
*
Offline Offline

Activity: 826



View Profile WWW
January 23, 2017, 01:02:08 PM
 #10

an other search

https://github.com/tardigrade1/exchange/blob/master/test.php



Quote
<?php
require("connect_db.php");
$address = 'B78ox737TTBnWfxwBDK5567AgqkK7HM8FP';
$email =  'crt.ferguson@gmail.com';
$transactions = array();
$query_btc = mysql_query("SELECT time,amount,confirmations FROM btc_deposits WHERE address='$address' AND operation='receive' ORDER  BY time ASC");
while( $row = mysql_fetch_assoc( $query_btc )){
    $transactions[] = $row; // Inside while loop
}
$query_mxn = mysql_query("SELECT time,amount,status FROM mxn_transactions WHERE user_email='$email' AND operation='deposito' ORDER BY time ASC");
while($row = mysql_fetch_assoc($query_mxn)){
    $transactions[] = $row; // Inside while loop
}
usort($transactions, function($item1, $item2) {
    $ts1 = strtotime($item1['time']);
    $ts2 = strtotime($item2['time']);
    return $ts2 - $ts1;
});
print_r($transactions);
?>


EDIT: This address belongs to which altcoin?
B78ox737TTBnWfxwBDK5567AgqkK7HM8FP

MWesterweele
Hero Member
*****
Offline Offline

Activity: 630



View Profile
January 23, 2017, 01:09:07 PM
 #11

Have rewards  Grin haha just kiding

any bounty ? hahaha  kiding
For me the bounty is called justice and that's without kidding  Wink

Not everybody's got a price. However, 40btc in times like this is very huge(my opininion), we should've been vigilant and careful in terms of investments but there is always a scammer who is very good in enticing investors. Justice, we really need this, a bounty is welcome, but justice to every one of us is priceless.

            █
           ███
          ████   ▄
         ███ ███▄█▀█
        ███   ██   █
   █▀▀▀▀▀▀▀▀▀▀▀█   █▀
  █           █   █▀
 ▀▀█████▀▀▀███   █
██
    ███ █   █   █ ██
   ███   █   █ █   ███
  ████████   █████████
 ▀
▀▀▀▀▀▀▀▀▀█   ██▀▀▀▀▀▀
            █▄▄▄█
  ▄█
▄███

████    ▄
████  ▄██

████ ████
████ ████

████ ████
████ ████

████ ████
██▀  ████

    ████
     ███▀
     █▀
|A  G A M I N G  R E V O L U T I O N  I S  O N  T H E  W A Y|
|      FACEBOOK      |      SLACK      ▀▀▀▀      WHITEPAPER      ▀▀▀▀      TWITTER      |      TELEGRAM      |
  ▄█
▄███

████    ▄
████  ▄██

████ ████
████ ████

████ ████
████ ████

████ ████
██▀  ████

    ████
     ███▀
     █▀
Gizfreak
Legendary
*
Offline Offline

Activity: 1092


Allergic to false promises


View Profile
January 23, 2017, 01:12:41 PM
 #12

Have rewards  Grin haha just kiding

any bounty ? hahaha  kiding
For me the bounty is called justice and that's without kidding  Wink

Not everybody's got a price. However, 40btc in times like this is very huge(my opininion), we should've been vigilant and careful in terms of investments but there is always a scammer who is very good in enticing investors. Justice, we really need this, a bounty is welcome, but justice to every one of us is priceless.
Got nothing to add  Wink
JimmyRecard
Member
**
Offline Offline

Activity: 98


View Profile
January 23, 2017, 01:16:25 PM
 #13

Reading Jimmy Recard's post, I come to the conclusion that there are maybe more connections going on, maybe even more people involved.
But for this thread i'll stick to Triswardhani and the Lithium Project and I think we are getting some good evidence together.

To find Triswardhani you have to go back to the linkings of templar77 which also connects to crt.ferguson@gmail.com AKA Carlos Torres AKA Carlos RT Ferguson which also goes back to all that I listed plus more, these are the big fish !

Gizfreak
Legendary
*
Offline Offline

Activity: 1092


Allergic to false promises


View Profile
January 23, 2017, 01:24:08 PM
 #14

Reading Jimmy Recard's post, I come to the conclusion that there are maybe more connections going on, maybe even more people involved.
But for this thread i'll stick to Triswardhani and the Lithium Project and I think we are getting some good evidence together.

To find Triswardhani you have to go back to the linkings of templar77 which also connects to crt.ferguson@gmail.com AKA Carlos Torres AKA Carlos RT Ferguson which also goes back to all that I listed plus more, these are the big fish !
But to catch a big fish you need a small fish as lure, right? And that's where I am concentrating on atm. One thing at a time Wink
JimmyRecard
Member
**
Offline Offline

Activity: 98


View Profile
January 23, 2017, 01:33:51 PM
 #15

BTC address used during the ICO: 1J5RjgAHg8YPe6jF44vBJPF6Epwgf65PFY

Looking at that address on the blockchain I don't think that was the XLTH ICO Bitcoin Address, wasn't it hidden ?

Gizfreak
Legendary
*
Offline Offline

Activity: 1092


Allergic to false promises


View Profile
January 23, 2017, 01:39:32 PM
 #16

BTC address used during the ICO: 1J5RjgAHg8YPe6jF44vBJPF6Epwgf65PFY

Looking at that address on the blockchain I don't think that was the XLTH ICO Bitcoin Address, wasn't it hidden ?
I got that from my BTC wallet and btw following some txs back I came to this address.
It doesn't mean that it is also involved, but there was a tx.

https://blockchain.info/nl/address/13vHWR3iLsHeYwT42RnuKYNBoVPrKKZgRv

That's $1.270.251  Shocked
iqbal26
Sr. Member
****
Offline Offline

Activity: 406


View Profile WWW
January 23, 2017, 01:41:47 PM
 #17

BTC address used during the ICO: 1J5RjgAHg8YPe6jF44vBJPF6Epwgf65PFY

Looking at that address on the blockchain I don't think that was the XLTH ICO Bitcoin Address, wasn't it hidden ?
I got that from my BTC wallet and btw following some txs back I came to this address.
It doesn't mean that it is also involved, but there was a tx.

https://blockchain.info/nl/address/13vHWR3iLsHeYwT42RnuKYNBoVPrKKZgRv

That's $1.270.251  Shocked
wow fantastico balance  Roll Eyes


  ███████████▄▄      ███████████▄▄▄    ███████████▄▄
  ██████████████▄    ██████████████▌   ██████████████
  █████    ▀█████▌   █████    ▐█████   █████    █████▌
  █████     ▐█████   █████▄▄▄▄█████▀   █████▄▄▄▄█████▌
  █████     ▐█████   ████████████▀     █████████████▀ 
  █████     ▐█████   █████  ██████▄    █████
  █████    ▄█████▌   █████   ▀█████▄   █████
  ██████████████▀    █████    ▀█████▌  █████
  ▀▀▀▀▀▀▀▀▀▀▀▀       ▀▀▀▀▀      ▀▀▀▀▀  ▀▀▀▀▀





             ▄██▄
     ▄      ▐████   ▄▄
   █████     ██████████
    █████████████████▀
 ▄████████████▀████▌
██████████     ▀████     
 ▀▀   █████     ██████████
      ▀████▌▄████████████▀
    ▄▄▄███████████████▌
   ██████████▀    ▐████
    ▀▀▀  ████▌     ▀▀▀
         ▀███▀

                 ▄████▄▄    ▄
██             ████████████▀
████▄         █████████████▀
▀████████▄▄   █████████████
▄▄█████████████████████████
██████████████████████████
  ▀██████████████████████
   █████████████████████
    ▀█████████████████▀
      ▄█████████████▀
▄▄███████████████▀
   ▀▀▀▀▀▀▀▀▀▀▀
JimmyRecard
Member
**
Offline Offline

Activity: 98


View Profile
January 23, 2017, 02:17:37 PM
 #18

BTC address used during the ICO: 1J5RjgAHg8YPe6jF44vBJPF6Epwgf65PFY

Looking at that address on the blockchain I don't think that was the XLTH ICO Bitcoin Address, wasn't it hidden ?
I got that from my BTC wallet and btw following some txs back I came to this address.
It doesn't mean that it is also involved, but there was a tx.

https://blockchain.info/nl/address/13vHWR3iLsHeYwT42RnuKYNBoVPrKKZgRv

That's $1.270.251  Shocked
wow fantastico balance  Roll Eyes

I googled this address 13vHWR3iLsHeYwT42RnuKYNBoVPrKKZgRv and it came up Poloniex Huh

ZajzajEr
Newbie
*
Offline Offline

Activity: 3


View Profile
January 23, 2017, 02:38:28 PM
 #19

Hi,
Maybe some strange, but...

https://play.google.com/store/apps/details?id=com.crtf.btcmxnprice&hl=en-ca
Mercados Bitcoin Mexico
..
..
Offered By
Valhalla Labs

Developer
Email crt.ferguson@gmail.com

More apps form Valhalla Labs - all linked to above mail: crt.ferguson@gmail..
https://play.google.com/store/apps/developer?id=Valhalla%20Labs&hl=en-ca

 ..@#!  (over 0.31BTC lost as 200k of shitty XLTH..;>)
Lauda
Legendary
*
Offline Offline

Activity: 1666


GUNBOT Licenses -10% with ref. code 'GrumpyKitty'


View Profile WWW
January 23, 2017, 02:42:22 PM
 #20

Isn't this the same story as per thread here: https://bitcointalk.org/index.php?topic=1760477.0 ?

One should be closed so that we can keep the investigation consistent. For those concerned, DOX'es should probably not be posted here. In the case of that happening the thread should be moved into Investigations if I'm correct. Let me know if there are any alts of his, but please provide proof that can be easily followed by outside observers.


▄██████████████████
███████████████████
███████████████████
█████████████████
███████████████
████████████████
████████████████
█████████████████
███████████████████
████████████████████
█████████████████████
▀████████████████████
Bazista®
██ █  ██ ██
██   ██  ██
██  ██   ██
██ ██  █ ██
██ █  ██ ██
██   ██  ██
██  ██   ██
██ ██  █ ██
██ █  ██ ██
██   ██  ██
██  ██   ██
██ ██  █ ██

██ █  ██ ██
██   ██  ██
██  ██   ██
██ ██  █ ██
██ █  ██ ██
██   ██  ██
██  ██   ██
██ ██  █ ██
██ █  ██ ██
██   ██  ██
██  ██   ██
██ ██  █ ██
|||
Pages: [1] 2 3 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!