HKCEx breaks the market. 8.88% bonus on deposit, high rates and more!

[CaptainClaw]

Just got back another response from Sunny Vision.

They said HKCEx told them they would fix their issues, but they haven't heard a response, "but now not response,We will chase his."

HKCEx appears to be down at the time of writing this.

The people hiding their identity are cloudflare, submit an abuse report here: https://www.cloudflare.com/abuse/

[1714985815]

1714985815

[1714985815]

1714985815

[1714985815]

1714985815

[1714985815]

1714985815

[BTCalexxx2.0]

Yeah. It's gone. Finally...

But it seems like they didn't move coins, yet. Mine are still in the provided deposit address. Is there any way to mark those coins as stolen?

  

[MrWDunne]

Yeah. It's gone. Finally...

But it seems like they didn't move coins, yet. Mine are still in the provided deposit address. Is there any way to mark those coins as stolen?

  

No way that they can't get around in a flash.

Its very easy to tumble any amount of coins

[CaptainClaw]

Interesting..

HKCEx has just replied back with a generic message:

Greetings,

We are an honest and transparent business have all the necessary permits and licenses to conduct this activity.

As for the rumors.
We have our internal security checks and suspend some accounts for suspicious activity.
It's about 10% of whole amount of transactions.
Anyway, we contact each user to resolve every issue.

--
Best regards,
Lavin Lam,
Marketing & PR,
HKCEx
www.hkcex.net

However, the name they have replied with is Wu Haisheng

This is probably the true name of the owner, but I can't confirm anything - they most likely replied with their email client to the support ticket and their name was on there.

I don't know how common a name this is, but it's not (wasn't) listed anywhere on their site.

Interestingly, the name appears as a member of the bitcoin foundation.

Will update if I find anything else.

[CaptainClaw]

Captain
Did they reply of contact@hkcex.net

No, I have his personal live.jp address from Sunny Vision.

[strombert]

Yeah. It's gone. Finally...

But it seems like they didn't move coins, yet. Mine are still in the provided deposit address. Is there any way to mark those coins as stolen?

  

wasn't it like sending 10 cents to the adress and add the HATE-NOTE in the field on top?

[BTCalexxx2.0]

However, the name they have replied with is Wu Haisheng

Interestingly, the name appears as a member of the bitcoin foundation.

Will update if I find anything else.

Are you fucking kidding? WOW, that would be a real blow!!!

[BTCalexxx2.0]

wasn't it like sending 10 cents to the adress and add the HATE-NOTE in the field on top?

Yeah, but as correctly mentioned by MrWDunne already, they are probably going to tumble the coins and that is pretty much it.

But with those traces to specific individuals involved, we still have a good chance to get them back before they just disappear. Let's fucking hunt those cunts down! As I said earlier they were complete amateurs not knowing what exactly they are doing! Scam n0000bs so to say.

So, please keep this thread updated and pumping, fellas. We need any support now!


All the best!

[rext]

hope you get your money back

[bigplum]

Captain
Did they reply of contact@hkcex.net

No, I have his personal live.jp address from Sunny Vision.

personal live.jp address ? did you mean this is a hkcex person?
I think it is would be helpful to show this address public to all of us.

[CaptainClaw]

Captain
Did they reply of contact@hkcex.net

No, I have his personal live.jp address from Sunny Vision.

personal live.jp address ? did you mean this is a hkcex person?
I think it is would be helpful to show this address public to all of us.

I don't know if it's just a throwaway, his actual address or an something else completely but it's the one he signed up to sunny vision with.

vnet@live.jp

Any message I send I recieve this:

已經關閉了這個用戶的相關服務：
Hostname:hkcex.net（ IP Address:124.248.221.134） -- 已關閉

The name in the header is "VNET HK" -- perhaps a company hired to register the domain on his behalf?

THAT twitter Account Bitcoin Ticker had been releasing prices of HKCEX the last time until dead
https://twitter.com/vonSchle
Somebody knows, it says located in San Fracisco and release a web which is not finished. Something BAD Honk hong and san francisco. We can search more.

Nice find, how did you find it?

The twitter page says San Francisco, the whois says it's located in Germany and it's a Hong Kong exchange that may have been based in Singapore...

Very odd that it only ever seemed to report HKCEx prices.

Edit:

Looking at the email headers, it seems vnet@live.jp is a forwarding address to smtpbg308.qq.com

There was also this: X-Originating-IP: 58.253.117.79

From wikipedia:

The X-Originating-IP (not to be confused with X-Forwarded-For) Email header field is a de facto standard for identifying the originating IP address of a client connecting to a mail service's HTTP frontend. When clients connect directly to a mail server, its address is already known to the server, but web frontends act as a proxy which internally connect to the mail server. This header can therefore serve to identify the original sender address despite the frontend.

Could 58.253.117.79 be the IP of the sender?

Running it through WHOIS we find a Chinese ISP:

http://who.is/whois-ip/ip-address/58.253.117.79

[CaptainClaw]

(encrypted/useless parts removed)
Authentication-Results: hotmail.com; spf=pass (sender IP is 65.55.116.80) smtp.mailfrom=vnet@live.jp; dkim=none header.d=live.jp; x-hmca=pass header.id=vnet@live.jp
X-SID-PRA: vnet@live.jp
X-AUTH-Result: PASS
X-SID-Result: PASS
X-Message-Status: n:n
Received: from BLU004-OMC3S5.hotmail.com ([65.55.116.80]) by BAY004-MC2F44.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.22678);
    Fri, 30 May 2014 20:18:59 -0700
Received: from BLU436-SMTP63 ([65.55.116.72]) by BLU004-OMC3S5.hotmail.com with Microsoft SMTPSVC(7.5.7601.22701);
    Fri, 30 May 2014 20:18:59 -0700
X-Originating-Email: [vnet@live.jp]
Message-ID: <BLU436-SMTP63D345C4AC6300E13DE9B7D1260@phx.gbl>
Return-Path: vnet@live.jp
Received: from smtpbg308.qq.com ([120.196.211.86]) by BLU436-SMTP63.smtp.hotmail.com over TLS secured channel with Microsoft SMTPSVC(8.0.9200.16384);
    Fri, 30 May 2014 20:18:57 -0700
X-HAS-ATTACH: no
X-QQ-BUSINESS-ORIGIN: 2
X-Originating-IP: 58.253.117.79
X-QQ-STYLE:
X-QQ-mid: webmail767t1401506333t130365
From: <vnet@live.jp>
To: (REMOVED)
Subject: Re:My withdrawal
MIME-Version: 1.0
Content-Type: multipart/alternative;
Content-Transfer-Encoding: 8Bit
Date: Sat, 31 May 2014 11:18:53 +0800
X-Priority: 3
X-QQ-MIME: TCMime 1.0 by Tencent
X-Mailer: QQMail 2.x
X-QQ-Mailer: QQMail 2.x
X-QQ-SENDSIZE: 520
X-OriginalArrivalTime: 31 May 2014 03:18:58.0152 (UTC) FILETIME=[0F9AAE80:01CF7C7F]

[jbrnt]

The guy we are looking for is mostly likely in china. China Unicom is a mobile netwrok in China, and QQmail he used almost only used in China. I think the IP addresses are a dead end, we should ask for the names of the identification used when registering for hosting from Sunny Vision.

[BTCalexxx2.0]

I want to know Why BTC world like coindesk Cryptonews cointelegraph and others haven't notified anything about that Theme. if a lot of people are losing their savings funds.

The only reason why don't write freakin word can have two major reasons IMFAO.

First, they don't want to admit that they were promoting an obvious scam before. When HKCex allegedly collected $3m it was spread all over the major BTC "news" websites. By the way, it seems pretty obvious that Coindesk (e.g) is getting paid to promote shady companies accepting Bitcoin anyways. Just take a look at those trading platforms they write/wrote about. Usually, they are the worst one can find. And they know! Or don't ever research those companies, doing C/P journalism.

The other reason is quite simple. They are part of that scheme and are getting paid to shut up.

Well, both scenarios are, at least, not very unlikely

Shame on those wannabe-journalists!

[BTCalexxx2.0]

However, the name they have replied with is Wu Haisheng

Any update regarding that trace?

I did a quick search on that name and found this guy very capable of setting up such scheme >>> http://www.linkedin.com/in/wuhaisheng

In general, the name is obviously all but common!

 

Could we think they are changing server again? Or could we think they seal us?

Seems like they wanna be sure that they left no evidence which might identify them before they start moving coins. Once those crooks feel save, our moniez will be insta-gone...

[BTCalexxx2.0]

Looking up hkcex.net on domainwhitepages.com we get the following traceroute which might be helpful to those who understand it. I don't

Traceroute

Tracing route to hkcex.net [124.248.221.134]...
hop    rtt    rtt    rtt         ip address    fully qualified domain name
1    0    0    0         208.101.16.73    208.101.16.73-static.reverse.softlayer.com
2    0    0    0         66.228.118.157    ae11.dar02.sr01.dal01.networklayer.com
3    0    0    0         173.192.18.252    ae14.bbr01.eq01.dal03.networklayer.com
4    34    34    34         173.192.18.141    ae0.bbr01.cs01.lax01.networklayer.com
5    30    30    30         173.192.18.167    ae7.bbr02.cs01.lax01.networklayer.com
6    41    41    41         173.192.18.150    ae0.bbr02.eq01.sjc02.networklayer.com
7    132    132    132         50.97.18.161    ae0.bbr01.eq01.tok01.networklayer.com
8    140    140    140         50.97.18.163    ae7.bbr02.eq01.tok01.networklayer.com
9    183    183    183         50.97.18.167    ae0.bbr01.pn01.hkg01.networklayer.com
10    176    176    176         202.40.160.139    sunnyvision3-10g.hkix.net
11    184    184    184         123.242.225.10    te3-3.core3.hk01.hkngn.com
12    *    *    *            
13    *    *    *            
14    *    *    *            
15    *    *    *            

Trace aborted



The bold IP is referring to another domain HKIX.NET


Queried whois.internic.net with "dom hkix.net"...

   Domain Name: HKIX.NET
   Registrar: DOMAIN.COM, LLC
   Whois Server: whois.domain.com
   Referral URL: http://www.domain.com
   Name Server: NS1.CUHK.EDU.HK
   Name Server: NS2.CUHK.EDU.HK
   Name Server: NS3.CUHK.EDU.HK
   Status: ok
   Updated Date: 12-mar-2012
   Creation Date: 23-apr-1995
   Expiration Date: 24-apr-2021

>>> Last update of whois database: Sun, 01 Jun 2014 01:21:32 UTC <<<

Queried whois.domain.com with "hkix.net"...

Domain Name: HKIX.NET
Registry Domain ID:
Registrar WHOIS Server: whois.domain.com
Registrar URL: www.domain.com
Updated Date: 2012-06-26 23:41:31
Creation Date: 1995-04-23 04:00:00
Registrar Registration Expiration Date: 2021-04-24 04:00:00
Registrar: Domain.com, LLC
Registrar IANA ID: 886
Registrar Abuse Contact Email: compliance@domain-inc.net
Registrar Abuse Contact Phone: +1.6027165396
Reseller: MyDomain
Reseller: support@mydomain-inc.com
Reseller: +1.8004057875
Domain Status: ok
Registry Registrant ID:
Registrant Name: Network Administrative Contact
Registrant Organization: The Chinese University of Hong Kong
Registrant Street: Information Technology Services Centre G/F, Pi Chiu Building, CUHK
Registrant City: Shatin
Registrant State/Province: New Territories
Registrant Postal Code: 00000
Registrant Country: HK
Registrant Phone: +852.39438801
Registrant Phone Ext:
Registrant Fax: +852.26035001
Registrant Fax Ext:
Registrant Email: noc-admin@cuhk.edu.hk


And the bold italic IP belongs to the domain HKNGN.COM


Queried whois.internic.net with "dom hkngn.com"...

   Domain Name: HKNGN.COM
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com
   Name Server: NS1.HKSEEKER.COM
   Name Server: NS2.HKSEEKER.COM
   Status: ok
   Updated Date: 20-may-2014
   Creation Date: 17-jun-2013
   Expiration Date: 17-jun-2015

>>> Last update of whois database: Sun, 01 Jun 2014 01:27:49 UTC <<<

Queried whois.enom.com with "hkngn.com"...

Domain Name: HKNGN.COM
Registry Domain ID: 1809120000_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.enom.com
Registrar URL: www.enom.com
Updated Date: 2014-05-20 02:37:53Z
Creation Date: 2013-06-18 01:26:15Z
Registrar Registration Expiration Date: 2015-06-18 01:26:00Z
Registrar: ENOM, INC.
Registrar IANA ID: 48
Registrar Abuse Contact Email: abuse@enom.com
Registrar Abuse Contact Phone: +1.4252744500
Domain Status: ok
Registry Registrant ID:
Registrant Name: DOMAIN ADMINISTRATOR
Registrant Organization: JIAPEI GROUP LIMITED
Registrant Street: ROOM 604, WELLTECH CENTRE, PAT TAT STREET, SAN PO KONG,
Registrant Street: KOWLOON, HONG KONG
Registrant City: HONG KONG


As admitted, I don't know much about that stuff. Maybe you can find a hint...

[CaptainClaw]

So in summary:

VNET is a company that have set up hosting services with Sunny Vision on behalf of HKCEx.

When I contacted Sunny Vision and informed them of HKCEx's fraud, they took down HKCEx's server.

Wu Haisheng works for VNET, and forwarded emails to and from HKCExadm@yahoo.com.hk (address now inactive)

VNET have provided the following address:

Room 1408, 15F, SPA Centre, 53-55
Lockhart road
Wanchai
Hong Kong

We cannot verify if this address is accurate as VNET did not verify addresses.

VNET has this address from HKCEX's paypal information, but anyone with a prepaid card can setup a paypal account and enter fake information.

Our only lead is the above address, someone in Hong Kong want to go check it out?

[BTCalexxx2.0]

We must verify that address, telephone and that ip`is from another VPS service. We must ask too

Very well done, sir! I have a feeling we are getting somewhere in the end...


Following screenshots from Google Streetview








Even though this address is most likely a fake one, maybe they were not chosen randomly. Would be great if someone in HK could go there to have a look.

[BTCalexxx2.0]

Man or woman?

The question is if the identity was just stolen or not? I guess it was I mean, people hiding behind multiple VPN providers won't give their name to anyone.

Well, we just need to keep digging...

[strombert]

Why not contact a hongkong based news station and tell them to  GO FOR IT, SEARCH ..
they would be first with such a ''story'' and maybe it's a win-win situation.