bitcoin-trader.biz

[cmine]

Someone post this on the FB (official group), as they're asking for it. Just don't want my ID up there...

http://pastebin.com/6GLX3BPG

It's an email header they wanted.

Thanks ranlo, unfortunately I think 10.xxx.xxx.xxx ips are all local and could be located anywhere.

If I am wrong, please let me know what anyone finds.

[corygto]

This is the general gist from Facebook:

A bitcoinbountyhunter.com bounty has been placed for information and is awaiting approval.

The transaction from DataClub S.A. is the strongest independent lead.

The public BT Team is as pissed as anyone and they are going to release all the info they have ASAP. (Hopefully tomorrow).

Another domain may have surfaced. bitcoin_trader.biz (awaiting confirmation)

Michael Brandenburg seems to be the only person that says they have physically met "John Carley". 3 times.

Several international fraud agencies have been contacted.

The BTC addresses believed to be associated with BT look like funds are being mixed rapidly.

Hope this helps.

C

Glad to see that people are taking action. Let's hunt him down like that dog that he is and put him in prison.

[Grinder]

Haha!  We are obviously wasting our time arguing about the use of a word that we are never going to agree about. You think greed is wanting anything more than communism would provide for. I think greed only deals with taking "more than you need" so other people can't have it.

I have only pointed to an established definition of the word, the rest is all in your head.

[Phildo]

Does that 500k include "reinvestment" because that money never existed, so it's going to be awfully hard to find/get back.

[ranlo]

Someone post this on the FB (official group), as they're asking for it. Just don't want my ID up there...

http://pastebin.com/6GLX3BPG

It's an email header they wanted.

Thanks ranlo, unfortunately I think 10.xxx.xxx.xxx ips are all local and could be located anywhere.

If I am wrong, please let me know what anyone finds.

I believe they are all Google IPs... I went through all emails I got and they are all the same. But someone had requested headers anyways so wanted to submit them.

[removebeforeflight]

I think the best approach is some decent media exposure. At least make the known
characters sweat. Anyone know what's going on with the
Bitcoin car that was touring (with their logo all over it)?

[Attie707]

Hi everyone,

I did not loose a lot; but I was very close in investing $2k.

So, here is what we need to do. The domain was registered (and obviously paid via) eNom.com

This eNom.com uses a login id which I am not sure if we will be able to guess although you are more than welcome to try?

But... any registrar of this nature should comply with international law of some sort (hopefully) and will comply to the request by a chief investigator officer or then maybe an attorney that have the necessary documentation to request that the person that registered the domain's name be made available... including the payment method and credit card or banking details made available.

We can use this payment details to track the bank that was used to do the payment and request the bank to provide the details of the owner of the bank account. Obviously the bank would only provide such details with a letter from an entity as per above.

What I need from any one of you is the legal document(s) or if you like to approach eNom.com and later the bank(s) yourself to follow the above procedure(s) and lets see if we can find the real person behind this scam.

We can decide how to deal with the responsible party(ies) once we confirmed their physical location.

Regards
A

[pawlo74]

Hi everyone,

I did not loose a lot; but I was very close in investing $2k.

I remember that the Facebook Group for these bastards was opened by a South African guy. I will never forget his profile photo which looked like a real "boertjie" with a real Afrikaans surname.

Now I am dead sure that he is responsible or partly responsible for this whole scam.

He must have deleted his profile; funny enough that the Bitcoin Trader group is still alive.

I want to ask if any one of you can remember his name. Because I am going to find him and bring him to the jury.

And he will face consequences.

So please; think back... this John Carley (I think) is a ghost. The correct trail starts with the owner of the facebook group (Bitcoin Trader).

Thanks!

Cheers

[Grinder]

I think the best approach is some decent media exposure. At least make the known
characters sweat. Anyone know what's going on with the
Bitcoin car that was touring (with their logo all over it)?

I hope you don't get your wish. Yet another bitcoin scam case in the media is exactly what we don't need, and why I have been warning about this obvious scam for so long. On the other hand, even the most high profile Bitcoin conferences let them in despite warnings. Maybe there is no hope that the community as a whole will learn to be business smart enough to not dig it's own grave.

[sunny1]

Hi everyone,

I did not loose a lot; but I was very close in investing $2k.

I remember that the Facebook Group for these bastards was opened by a South African guy. I will never forget his profile photo which looked like a real "boertjie" with a real Afrikaans surname.

Now I am dead sure that he is responsible or partly responsible for this whole scam.

He must have deleted his profile; funny enough that the Bitcoin Trader group is still alive.

I want to ask if any one of you can remember his name. Because I am going to find him and bring him to the jury.

And he will face consequences.

So please; think back... this John Carley (I think) is a ghost. The correct trail starts with the owner of the facebook group (Bitcoin Trader).

Thanks!

Cheers

Actually the official facebook group was created by someone with the name of Süper Näsh. Somebody from Sri Lanka: https://www.facebook.com/supernash786

[thomasm1964]

I know from the domain registration information that the domain name details were protected by http://www.whoisguard.com/ . I wrote to them severzl days ago to express my concerns but perhaps now we need somehow to get the authorities to force http://www.whoisguard.com/ to reveal what they know now that "John Carley" has stolen our money.

As their site says: When protection is turned on (can be turned off easily) our email and address shows up. When some one sends an email to your uniquely generated xyz.protect@whoisguard.com address, we will in-turn forward it your real email address which you specify. This essentially masks your email from the outside world!

The Closure email I received from BitCoin  Trader has all its sending headers masked - presumably because they have gone through http://www.whoisguard.com/

Their Contact Us page says:

Address Information:

WhoisGuard, Inc.
Attn: <domainnamehere.com>
P.O. Box 0823-03411
Republic of Panama

Their email contact:

You can also contact us through email. Please send us an email to support@whoisguard.com to send us your question. Please send the following information in your email.

- Email/ Domain in Question
- Phone number where you can be reached
- Email headers if applicable.



I also used their tool to check whether BitCoin Trader really does use their service. As of today's date, they still have a valid subscription.

http://yellowpowder.co.uk/bct/bct_whoisguard.jpg

According to someone else I have been in contact with, the company was registered with the Panama authorities a few months ago. He forwarded screenshots of what I believe is the official online registration form at the Panama equivalent of Companies House (UK).

http://yellowpowder.co.uk/bct/bct_registration_1.jpg
http://yellowpowder.co.uk/bct/bct_registration_2.jpg

I'm beginning to think that our only hope is that the Panama legal authorities choose to investigate this case.


From the legal page of http://www.whoisguard.com


3. DISCLOSURE OF NONPUBLIC PERSONAL INFORMATION
It is WhoisGuard policy to never disclose nonpublic personal information, or any other information, except either as required or permitted by law or with your authorization.


4. PROTECTION AND SECURITY OF WHOIS DIRECTORY INFORMATION
WhoisGuard retains records relating to the Service provided to you through the TOS, incorporated herein by reference, or through your service provider utilizing the Services, so that WhoisGuard may better assist you with your privacy needs and to also ensure that WhoisGuard is in compliance with its obligations under the Internet Corporation for Assigned Names and Numbers (“ICANN”) including the Uniform Domain Name Dispute Resolution Policy (“UDRP”) and the terms, conditions and policies imposed by your service provider, or other laws and regulations. In addition, WhoisGuard may maintain physical, electronic and procedural safeguards that comply with regulations to guard your nonpublic personal information and to ensure that your privacy is consistently maintained.

12. NECESSARY DISCLOSURE
WhoisGuard will not share your personal information except with a third party to assist in the processing or securing of your personal information or when WhoisGuard is required by law, and as may be described further in the WhoisGuard TOS, or unless WhoisGuard has given you notice and choice, in the good-faith belief that such action is necessary in order to conform to the edicts of the law, or WhoisGuard must comply with a legal process served on the WhoisGuard website. WhoisGuard will also share your information to the extent necessary to comply with ICANN's rules, regulations and policies. WhoisGuard may also need to give out your information if one of WhoisGuard’s service partners requires it. WhoisGuard does not condone the use of the internet for illegal activities and will assist law enforcement agencies wherever possible.
If you are a law enforcement agency and think that WhoisGuard can assist you in relation to an investigation, please contact support@whoisguard.com.


They used Shadowscript software (http://shadowscripts.com/) to run the client fund side of things and they hosted their website on Cloudflare (https://www.cloudflare.com). I know this from the occasional error message I received from Clouflare when they could not deliver the website itself.

I also wonder whether this is the same John Carlery - the nature of the fraud looks similar: http://www.sec.gov/litigation/admin/33-8508.htm  See also https://www.sec.gov/litigation/aljdec/id292jtk.pdf  - if this is the same man then he is known to the American authorities.

To report a scam to the Panamanian authorities: http://www.ministeriopublico.gob.pa/minpub/Denuncias/Estafa.aspx  . The screenshot below is a mechanical Google translation of the page.

http://yellowpowder.co.uk/bct/panama_public_ministry.jpg

See also http://www.panamatramita.gob.pa/tramite/denuncia-por-estafas-y-otros-fraudes . Again, the screenshot shows the page as mechanically translated by Google.

http://yellowpowder.co.uk/bct/panama_fraud_report.jpg

Sorry - that's all I have for the moment.

Thomas.

[pawlo74]

[...]

Sorry - that's all I have for the moment.

Thomas.

That is a lot for a start. Thank you Tom

[thomasm1964]

I've been able to add a bit more since the original post.

Isn't the internet a wonderful thing! Not all the above is my own work, by the way: others have helped but I think it important to share as much as possible.

Thomas.

[tangopoint]

Even if the WhoisGuard anonymous registration is lifted, there is likely a registration with invalid information under it.

I was able to login to the Panamanian Public Registry and saw the data in the Screen shot is authentic. 

I do not believe John Carley is a real name, so it is likely that the Panamanian company was setup with fake identification.  The other names on the registration are likely Panamanian nominee directors that put their name on 1000's of companies for a fee.  The registered Agent is supposed to have a way to contact "John Carley" but oddly there is no address or phone for "NANCY ORANTES"

There where likely no bank accounts in the "BITCOIN TRADER HOLDING INC." name and only 1 owner, so there was no need to ever register a Panamanian Company for anything other than showing up on a publicly available registry.

Cloudfare is a proxy to protect against attacks.  It relays the information from another server.  The server for bitcoin-trader.biz is likely hosted with http://bitcoinwebhosting.net/.  The server was likely paid with bitcoin.

If WhoisGuard, Cloudfare, BitCoin Web Hosting, or Google will give their access logs for an IP would be the best way to get a lead at this point.


Can Thomas or Michael provide any details on any of the methods used to pay for any of the expenses?

[planecrash]

I submitted an abuse report to CloudFlare the day before the website disappeared.  This was their response.  Please note, they identify a hosting provider, Secured Servers, that differs from some of the other information people have already provided.  Hope this helps!

CloudFlare received your abuse report regarding:
bitcoin-trader.biz

Please be aware CloudFlare is a network provider offering a reverse proxy, pass-through security service. We are not a hosting provider. CloudFlare does not control the content of our customers.

Accepted URL(s) on bitcoin-trader.biz:
https://bitcoin-trader.biz/

        Hosting Provider:
        -----------------
        SECUREDSERVERS
        SECURED SERVERS LLC
        SSL-65

        Abuse Contact:
        --------------
        ABUSE1536-ARIN
        Abuse
        +1-480-422-2022
        abuse@securedservers.com



We have notified our customer of your report, and we have forwarded your report on to the responsible hosting provider. You may also direct your report to:

1. The provider where bitcoin-trader.biz is hosted (provided above);
2. The owner listed in the WHOIS record for bitcoin-trader.biz and/or;
3. The contact listed on the bitcoin-trader.biz site.

Note: A lookup of the IP for a CloudFlare customer website will show CloudFlare IPs because we are a pass-through network. The actual website is still hosted at the hosting provider indicated above. If the hosting provider has any questions, please have the hosting provider contact us directly regarding this site. Due to attempted abuse of our complaint reporting process, we will only provide the IP of bitcoin-trader.biz to the responsible hosting provider if they contact us directly at abusereply@cloudflare.com.

Regards,

CloudFlare Abuse

[tangopoint]

Looking at the offering between Secured Servers and Bitcoin Web Hosting, I am guessing that Bitcoin Web Hosting is a reseller of Secured Servers offerings.

http://www.securedservers.com/index.php

http://bitcoinwebhosting.net/bitcoin-dedicated-servers/

The offerings, datacenter locations and configuration options are pretty much identical.  I am assuming it was hosted with Secured Servers and paid for by Bitcoin through Bit Coin Web Hosting.  Both of those companies may be able to provide a lead.

[Rannasha]

Looking at the offering between Secured Servers and Bitcoin Web Hosting, I am guessing that Bitcoin Web Hosting is a reseller of Secured Servers offerings.

http://www.securedservers.com/index.php

http://bitcoinwebhosting.net/bitcoin-dedicated-servers/

The offerings, datacenter locations and configuration options are pretty much identical.  I am assuming it was hosted with Secured Servers and paid for by Bitcoin through Bit Coin Web Hosting.  Both of those companies may be able to provide a lead.

From the FAQ at BitcoinWebhosting on anonymous hosting:

You thought we didn’t? We’re big on privacy around here. As long as you pay with Bitcoin, we do not require any personal details. All we need is a good email to reach you at for billing purposes and account issues.

[Johnson43]

Testimonial on BWH website:

"Other companies don't come close to BWH when it comes to reliability and fast support. It simply is a pleasure to recommend them.
John Carley // Bitcoin-Trader.biz"

They've been in some type of communication w/ bitcoin-trader...under the same alias John Carly....

[c0c0]

Karma will be a bitch to you @bitcoin-trader :-)

Maybe we should start to collect numbers?

icecreamgenius  = $40k
joystickj = $37k
Casimir1904 = $25k
....

We have a list going on in the Unofficial group.. So far our tally is at $500,000+

Add me... 

c0c0 = $10K

[pawlo74]

Karma will be a bitch to you @bitcoin-trader :-)

Maybe we should start to collect numbers?

icecreamgenius  = $40k
joystickj = $37k
Casimir1904 = $25k
....

We have a list going on in the Unofficial group.. So far our tally is at $500,000+

Add me... 

c0c0 = $10K

add me

pawlo74 = $12k