IT.COM

information VPN.com LLC has filed a multimillion lawsuit

Spaceship Spaceship
Watch

Lox

____Top Member
Impact
12,380
VPN.com LLC has filed a multimillion lawsuit against long time domain investor George Dikian (California), Qiang Du (Hong Kong) and John Doe at the US District Court (California).

The lawsuit involves a $250,000 payment in Bitcoin and $6.625 million in owed commissions on multiple transactions involving 96 premium 2N.com and 3N.com domains.

read more
 
26
•••
The views expressed on this page by users and staff are their own, not those of NamePros.
I hope that all the relevant data is captured before it is shut down.
 
6
•••
Was it ever determined if/how @VPN.com had verified they were approached by the real Qiang Du?

Per the OnlineDomain.com article

I don't know much about Qiang Du or ZTE Holdings, but I noticed DomainNameWire.com had published a 2017 article where Qiang Du filed a lawsuit against John Doe for the alleged theft of BSH.com, which he claimed to have paid $100k for in 2016. (I don't know the outcode to that suit)

The VPN lawsuit lists Du's email address as <rhwdomains(@)gmail.com> but I can't seem to find any online record of that email address, besides that email being listed in VPNs lawsuit.

Qiang Du is still a mystery to me. I'm not sure how common of a name Qiang Du is, but it looks like the alleged ZTE holdings may have noting to do with the California Qiang Du that sued in 2017 for the theft of BSH.com?

I don't know where I read that RHWDomains(@)gmail.com is Qiang Du's email address; maybe I'm mistaken? The only google result for that email address is from PacerMonitor citing this case.


Point 14 of VPN.coms complaint states VPN was approached by Du, and that upon information and belief owns the entity called ZTE Holdings.

14. On March 8, 2022, VPN was approached by Du, who, upon information and belief, owns the entity called ZTE Holdings (中興新) (“ZTE”)

Point 30 of VPN.com's complaint lists a yingxiao @zte.com.cn email address that Qiang Du allegedly used to register his intermediar account. According to google translate, yingxiao = marketing

30. On April 15, 2022, Du confirmed to VPN that Du’s Intermediar account was registered under [email protected]. This statement was false, as Intermediar is a fraudulent escrow service.

So if ZTE Holdings is ZTE.com.cn, what infomration led to VPNs belief that Qiang Du owned the entity called ZTE Holdings??? Was it the yingxiao @zte.com.cn email address?

1670820636885.png
 
Last edited:
1
•••
Qiang Du is still a mystery to me. I'm not sure how common of a name Qiang Du is, but it looks like the alleged ZTE holdings may have noting to do with the California Qiang Du that sued in 2017 for the theft of BSH.com?

It's a common enough name. Since the odds are low that there was any actual Qiang Du with whom VPN was corresponding, then the question of which Qiang Du was intended to be impersonated is an open question. How many domainers are named "Qiang Du" might be a better question.

We may find out if VPN obtains a default judgment against a nominal "Qiang Du" and then attempts to obtain Du's domains, since obviously there is at least one Qiang Du who will litigate to keep them.
 
2
•••
But the versions of reality are quite distinct. Either Mr. Gargiulo is mistaken or Mr. Dikian is a thief.

Which reality do you believe to be more likely, and why?

Does the answer depend on if Mr. Gargiulo was talking to the real Mr. Dikian of [email protected], or as long as the emails did in fact come from [email protected], then there is no way Mr. Gargiulo can be mistaken? Or is it, as mentioned earlier in this thread by @Embrand that vitcims of hacked emails/identity fraud shouldn't be held responsible?

I don't think I read in Mr. Dikians response an admission that any of his email addresses were improperly authorized. Though, Mr. Dikian denied receiving March 8th emails to [email protected] or [email protected]. Mr. Dikian also denied sending a respond from those emails. However, Mr Dikian admitted to notifying the plaintiff by email from [email protected] on May 11th.

So if it's determined emails weren't spoofed, and emails were sent to/from [email protected] without the real Mr. Dikians knowledge, it seems for Mr. Gargiulo to be mistaken, then Mr Dikians accounts or emails would have to had been accessed by somebody (likely a bitcoin thief?) without the real Mr. Dikians authorization?

If Mr Dikian's yahoo account was accessed without his authorization, I assume/hope the real Mr. Dikian already:

-- looked at his yahoo account activity: https://login.yahoo.com/myaccount/activity

-- downloaded his Yahoo history: https://yahoo.mydashboard.oath.com/

-- checked to see if any filters were set/left in his account: https://mail.yahoo.com/d/settings/7

-- checked to see if any email addresses were set/left to block: https://mail.yahoo.com/d/settings/8



Further, if Mr. Dikians email or accounts were indeed hacked, what could have led to somebody gaining access to his accounts? Does Mr. Dikian have a history of account hacks leading to stolen domains or anything similar... or why now?

I found five email addresses based on historical WHOIS records that look (assumed, not confirmed) to have some type of connection to a George Dikian. (1) [email protected] (2) [email protected] (3) [email protected] (4) [email protected] (5) [email protected]

Besides some historical WHOIS Dikian connection, what else do these 5 email addresses have in common? All 5 were listed as being pwned in the September 2021 Epik hack which according to HaveIBeenPWNED.com cite the compromised data as: Email addresses, Names, Phone numbers, Physical addresses, Purchases.

As mentioned earlier, Intermediar.com trustPilot account was verified via "Contact details Google My Business account verified and synced" on January 2022.

It appears, if Epik had George Dikians physical address on file, then it may likely have been leaked. Not sure if that, in combination of other data was used to gain unauthorized access to Dikian accounts, but some may find it interesting to note if a epik leaked Dikian address was different than the L.A. address VPN initially listed for Dikian in the California civil summons.



namePros member @.X. appeared to report that his data wasn't just stolen from epik, but somebody had used his home address, and committed a crime with it.

...my data wasn’t just stolen from Epik, someone used my home address as their own address , that person committed a crime using my home address, and I got a call from the BIG men.

Now, there's no direct indication that the September 2021 epik hack led to Mr. Dikians account(s) being hacked. Checking email addresses across HaveIBeenPWNED.com is just one initial step to take when begining to question how an account may have been hacked/socialEngineered/accessedWithOut authorization. But, notable in this instance, the 5 email addresses I found that looked like it could have a George Dikian domain connection all appeared to have been pwned in the 2021 epik hack.



Lastly, since we are talking about missing bitcoin, there is a ledger of it being moved. I'm not a crypto guy, but some basic internet search seem to reveal wallet movement. IDK how to make much sense of that data, but if nothing else, I feel publishing those wallet addresses to this thread or elsewhere may leave a internet record which somebody by have knowledge of now, or in a cached future. Below is the wallet address provided to VPN by somebody alleging to be George Dikian, in case any crypto sleuths want to try to make sense of what happened to the BTC:::

36. On April 24, 2022, Dikian provided his Bitcoin wallet address to VPN in order for VPN to make the $250,000 payment once Intermediar confirmed completion of the transaction. Dikian provided the following Bitcoin wallet address: bc1qymcdwgqde47qxd8s7tk0jyufpgejrgtg4gw5qr.
51. On the evening of May 4, 2022, after Intermediar’s confirmation of the withdrawal that same morning, and after confirmation of the separate Escrow.com transaction which had verified Dikian’s identity, VPN wired Dikian 6.27 Bitcoin, which was worth $250,000 at the time of sending, from VPN’s Coinbase Pro Account, verified by the transaction hash: bc63bcff3eb86ae1dbfbf035ef51d6594d9d6d3b372d30f1038427e227c920aa.

52. Before sending the full amount, VPN sent a test transfer of .0001 Bitcoin, which Dikian confirmed receipt of via email, and verified by the transaction hash: 935dc7ef6f55ee0cd4a1159ef367324824ef1ccf239019154672e1630 cdaa81b.
 
Last edited:
1
•••
We may find out if VPN obtains a default judgment against a nominal "Qiang Du" and then attempts to obtain Du's domains, since obviously there is at least one Qiang Du who will litigate to keep them.

But if Qiang Du is a common name, how can VPN be sure they are going after the correct Qiang Du's domain names?

Would VPN be limited going after domains that are connected to a Qiang Du's email address that VPN communicated with?

The VPN lawsuit lists Qiang Du's email address as: [email protected] (no PWNED found)

But the California Qiang Du (possible domainer?) seems to have historically operated using [email protected] (multiple PWNED found; including 2021 epik hack)
 
Last edited:
0
•••
it looks like Intermediar is back online, appearing as Inter-Mediar.com registered on August 1st, 2022 at NameCheap.

Show attachment 228351
**Inter-Mediar.com is using a hubspot chat plugin.

Reported the new website to NameCheap. Sent link to this thread and domainname wire article and they replied saying they need more proof. 🤦

I replied with screenshot of the original website from archive.org yesterday. Let’s wait and see if they will do anything.

Looks like it's been taken down.

1670928322921.png



Something of note in the archive.org entires of Intermediar.com, is:

11 February 2022 = review from @garyford

1670928702830.png


compared to:

10 March 2022 = removed the name Gary Ford and replaced it with Qiang Du

1670928915560.png


...

The reason I say of note, is if, the data/dates is accurate in archive.org, then why would a Qiang Du of the United States have left a review on or before March 10th if it wasn't until April 23rd that Intermediar would tell VPN that Qiang Du had partially funded the transaction by depositing $2.2mil into intermediar; also, March 8th seems to be the day Qiang Du approached VPN.

Sparking curiousity to ask:

(1) Why does the review say Qiang Du of the United States? considering VPN lawsuit lists Qiang Du Hong Kong

(2) Was that Qiang Du review visible at the time VPN was negotiating with whom they believed to be the real George Dikian? considering this odd, if so, since it was alleged that George Dikian was the one who was insistent on using Intermediar over escrow.com
 
Last edited:
0
•••
Looks like it's been taken down.

Show attachment 228537


Something of note in the archive.org entires of Intermediar.com, is:

11 February 2022 = review from @garyford

Show attachment 228538

compared to:

10 March 2022 = removed the name Gary Ford and replaced it with Qiang Du

Show attachment 228539

...

The reason I say of note, is if, the data/dates is accurate in archive.org, then why would a Qiang Du of the United States have left a review on or before March 10th if it wasn't until April 23rd that Intermediar would tell VPN that Qiang Du had partially funded the transaction by depositing $2.2mil into intermediar; also, March 8th seems to be the day Qiang Du approached VPN.

Sparking curiousity to ask:

(1) Why does the review say Qiang Du of the United States? considering VPN lawsuit lists Qiang Du Hong Kong

(2) Was that Qiang Du review visible at the time VPN was negotiating with whom they believed to be the real George Dikian? considering this odd, if so, since it was alleged that George Dikian was the one who was insistent on using Intermediar over escrow.com
see the Gary Ford guy on here, guy was an obvious shill

https://www.namepros.com/threads/do-not-use-intermediar-com-silverbellxchange-com.1272591/
 
2
•••
👑 @=ThreadOP= @Lox 👑

I'm not sure if you dove into this 🕳️ yet; 🤔 if you 🕶️ any 🥕 or🐇❔
 
Last edited:
2
•••
I think Konstantinos Zournas has quite an interesting comment on his website:

"I am not too familiar with US law but I am pretty sure that in most countries you need to state your real name in a court to file an answer and you can not reply using an alias and sign the response as “Attorneys for Defendant sued as George Dikian”.

So, who is “George Dikian” on the VPN.com lawsuit?

If I was “George Dikian” and wanted to clear my name the first thing I would do is state my real name in the court. I wouldn’t use an alias in the first place but anyway…"

https://onlinedomain.com/2022/12/13/domain-name-news/who-is-george-dikian-on-the-vpn-com-lawsuit/

This case seems to have it all: A fake website, mysterious domain investors, unheard of commissions and some awesome domains...
 
1
•••
👑 @=ThreadOP= @Lox 👑

I'm not sure if you dove into this 🕳️ yet; 🤔 if you 🕶️ any 🥕 or🐇❔

I have asked x person to make in-person visit and there is no record of renting the office (po box) in Beethovenstraat building. The business/company is not registered in t NL chamber of commerce and has no legitimate physical address nor person name. Other "intermediar" companies registered in NL do not act as a collection agent or do not provide escrow service.

VPN & co just don't want to dig deeper, more like playing in the $and.

(but, I don't need to tell you that you should get paid for DD ... 1000s of dollars.)

Regards
 
Last edited:
2
•••
1
•••
I have asked x person to make in-person visit and there is no record of renting the office (po box) in Beethovenstraat building.
Ty @Lox!

On May 1st 2022, I've also removed the entry for that company from Google Maps (accepted).

1670956808797.png
 
4
•••
2
•••
https://www.blockchain.com/btc/address/bc1qymcdwgqde47qxd8s7tk0jyufpgejrgtg4gw5qr

This address has transacted 9 times on the Bitcoin blockchain. It has received a total of 28.38953714 BTC ($502,803.12) and has sent a total of 28.38953714 BTC ($502,803.12). The current value of this address is 0.00000000 BTC ($0.00).

I'm not sure how accurate that 28 BTC input/output # actually is. ((but I'm a blockchain novice, so this summary is my best assumption))

When looking at the blockchain.com transaction log, I see:

The first transaction looks like it was the .0001BTC that VPN sent as a test transaction with hash ID <935dc7ef6f55ee0cd4a1159ef367324824ef1ccf239019154672e1630 cdaa81b>

Blockchain.com seems to list 6.91589205 BTC as outPut but the wallet in question looks to only have received the .0001BTC input.

((ie. the BTC output may equal 28 BTC, but it doesn't look like the wallet actually received that amoiunt))

When I first took a stab at looking at the chain history, I used: https://www.blockonomics.co/#/search?q=bc1qymcdwgqde47qxd8s7tk0jyufpgejrgtg4gw5qr

It looks like:

4 May 2022 @1205: received: +0.0001 BTC
4 May 2022 @1246: received: +6.27 BTC
11 May 2022 @2128: sent -0.50002679 BTC
11 May 2022 @2138: sent -0.50002679 BTC
11 May 2022 @2233: sent -1.00002679 BTC
11 May 2022 @2255: sent -1.00002679 BTC
12 May 2022 @0011: sent -1.00002736 BTC
12 May 2022 @0057: sent -1.00002592 BTC
12 May 2022 @2143: sent -1.26993956 BTC


1670958677988.png


**(time stamps from blockchain.com | hyperlinks to blockonomics.co)

*** Notably, the transaction times on Blockchain.com and Blockonomics.co are a few minutes apart, so take the transaction times with a grain of salt
...

11 May 2022 @2128: sent -0.50002679 BTC >> looks to have been sent to wallet address: bc1qfu465pdlg5yfkdmq5nvkmehngzpxvgraam2x4j

1670959041784.png

bc1qfu465pdlg5yfkdmq5nvkmehngzpxvgraam2x4j (address history)

1670959172689.png

Looks to have been emptied to wallet address: 14FoANzjfuzx5kjcE2t9RHu5GyF21EDgwF
...

11 May 2022 @2138: sent -0.50002679 BTC >> looks to have been sent to wallet address: bc1qky0tpy908awklx78yczq3krg5f284ze3g6qarc

bc1qky0tpy908awklx78yczq3krg5f284ze3g6qarc (address history)
1670959946179.png


Looks to have been emptied to wallet address: bc1qrgdndftdm03kkdzs3crm85ter8prdcv5qgg5nn
...

11 May 2022 @2233: sent -1.00002679 BTC >> looks to have been sent to wallet address: bc1qz326c2yjfhmn2hh8vdpa5h5fe09gwu5v53atrg

bc1qz326c2yjfhmn2hh8vdpa5h5fe09gwu5v53atrg (address history)
1670960042384.png

Looks to have been emptied to wallet address: bc1qrgdndftdm03kkdzs3crm85ter8prdcv5qgg5nn or maybe 16hiTVsDsGJun1ZiufqPyVw9fbaWbeykQW

...

11 May 2022 @2255: sent -1.00002679 BTC >> looks to have been sent to wallet address: bc1qs5q5qeclklgn8j2lqkncjztp34tzjnxafyh8lj

bc1qs5q5qeclklgn8j2lqkncjztp34tzjnxafyh8lj (address history)
1670960199775.png


Looks to have been emptied to wallet address: bc1qrgdndftdm03kkdzs3crm85ter8prdcv5qgg5nn or 16hiTVsDsGJun1ZiufqPyVw9fbaWbeykQW
...

12 May 2022 @0011: sent -1.00002736 BTC >> looks to have been sent to wallet address: 19apZEZjdXQpVH9GJnwCJiaccXXgfLXvrc

19apZEZjdXQpVH9GJnwCJiaccXXgfLXvrc (address history)
1670960305282.png


Looks to have been emptied to wallet address: 1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC
...

12 May 2022 @0057: sent -1.00002592 BTC >> looks to have been sent to wallet address: 19apZEZjdXQpVH9GJnwCJiaccXXgfLXvrc (same address as above)

19apZEZjdXQpVH9GJnwCJiaccXXgfLXvrc (address history)
1670960305282.png

...

12 May 2022 @2143: sent -1.26993956 BTC >> looks to have been sent to wallet address: 127ygKZgJXDDk7g3mcUuEyrqRQ2MzXfF4Y

127ygKZgJXDDk7g3mcUuEyrqRQ2MzXfF4Y (address history)
1670960589428.png

Looks to have been emptied to wallet address: 1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC


Needless to say, all addresses that received BTC directly from the BTC address that VPN sent 6.2701 BTC to appears to have been emptied.

However, you can see the destination wallet address that these were emptied to. I didn't post some active wallets I found earlier because I don't know how to confirm or make sense of these transactions when these coins enter wallets with lots of activity.

For instance, take a closer look at the final transaction, <12 May 2022 @2143: sent -1.26993956 BTC>

The transaction input was:
bc1qymcdwgqde47qxd8s7tk0jyufpgejrgtg4gw5qr << that's the address alleged Dikian provided VPN>
1.26983956 BTC
bc1qymcdwgqde47qxd8s7tk0jyufpgejrgtg4gw5qr << that's the address alleged Dikian provided VPN>
0.0001 BTC

The transaction output was:
127ygKZgJXDDk7g3mcUuEyrqRQ2MzXfF4Y <<that's the gaining address>
1.26989974 BTC

The gaining wallet address <127ygKZgJXDDk7g3mcUuEyrqRQ2MzXfF4Y> then sent its remaining 1.269.. BTC to address <1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC>

The BTC Wallet Address <1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC> appears to have a BTC balance of 2659 BTC (= current value of apprx $47million)

In summary (for instance), VPN sent 6.27 BTC to alleged Dikian wallet > the alleged Dikian wallet sent the remaining apprx 1.269 BTC to wallet ending in XfF4y > the wallet ending in XfF4y looks to have been emptied to wallet ending in 5kmqC > wallet ending in 5kmqC appears to have a current balance 2659 BTC, albeit with lots of incoming/outgoing transaction history..

I have no idea how to identify the wallet <1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC> which has a $47mllion BTC balance... is it an exchange? a mixer? or...?
 
Last edited:
3
•••
I have asked x person to make in-person visit and there is no record of renting the office (po box) in Beethovenstraat building. The business/company is not registered in t NL chamber of commerce and has no legitimate physical address nor person name. Other "intermediar" companies registered in NL do not act as a collection agent or do not provide escrow service.

Oh how thy world is connected...

I'm walking distance to the Mountain View business address listed for the assumed California domainer Qiang Du. Several business at that address, at a relatively busy intersection.

Always fun to have a cup of coffee with another domainer.

But per the VPN lawsuit this case alleges a Hong Kong Qiang Du.
 
Last edited:
2
•••
So if it's determined emails weren't spoofed, and emails were sent to/from [email protected] without the real Mr. Dikians knowledge, it seems for Mr. Gargiulo to be mistaken, then Mr Dikians accounts or emails would have to had been accessed by somebody (likely a bitcoin thief?) without the real Mr. Dikians authorization?

Yes. That's a common pattern. You get into the email account, don't change anything, and simply use automated notifications to conduct correspondence with others while deleting the received and sent comms from the account as you go. It takes a real level of dedication, and perhaps more than one person at the switch, but it is something that happens.
 
4
•••
10
•••
This case seems to have it all: A fake website, mysterious domain investors, unheard of commissions and some awesome domains...

Not that this case/thread needs any more popCorn, but there is some additional headlining theatrics related to the California Qiang Du. But again, California Du may have nothing to do with Hong Kong Du.

(1) There is a current California case involving Qiang Du: https://www.pacermonitor.com/public/case/36223659/Reflex_Media,_Inc_et_al_v_Successfulmatchcom_et_al

(2) Qiang Du (California) might be the registrant of SugarDaddyMeet.com. This domain was in the fake news earlier this year after it seems to have been alleged that, "Lauren Boebert, a US Congresswoman from Colorado, apparently was an escort on the site and met the Koch family and then Ted Cruz because of it." ... CNN reached out to a representative of SugarDaddyMeet.com who identified only as "Alice" who supported Lauren Boeberts claim that she had never used the site.
 
Last edited:
2
•••
If I was “George Dikian” and wanted to clear my name the first thing I would do is state my real name in the court. I wouldn’t use an alias in the first place but anyway…"

Perhaps, but with trademark domains, typos, parking, and all the imaginable stuff domains can be used for, the real George Dikian may have various reasons for hiding his real identity. Beyond the normal concerns of wanting privacy to protect valuable assets (ie man gets 30 years in jail for trying to steal a domain name at gun point), there's probably many reasons why somebody may want to operate via alias.

One reason may be attempting to distance oneself from potential (past or future) arbitration/administrative decisions connected to previous cached email addresses, businesses, or names.

I can't confirm if email address [email protected] does in fact belong to the real George Dikian. That email address has historical WHOIS connections to a number of highly questionable trademark domains/typos and is historically connected to other believed Dikian domains. Additionally jtubul.yahoo.com is listed as the SOA for 89.com and other assumed George Dikian owned domains.

That [email protected] (assumed to be connected to Dikian) has an early arbitration histroy among other early internet histories. One such arbitration case where this email is listed as the domain registrant is: https://www.adrforum.com/domaindecisions/881337.htm

(c) In addition to the domain names at issue in this case, Respondent has infringed upon numerous third party marks and is a notorious cybersquatter. As noted above, Respondent intentionally uses various aliases and false mailing addresses to hide his/her identity. It is clear from reviewing the unique e-mail address ([email protected]) provided in the Whois records, however, that Respondent owns numerous infringing domain names, including “AltatVista.com” “Amritrade.com” “AskJevees.com” “Chevrolett.com” and “BritishAirlines.com.” It is apparent from this list that Respondent indiscriminately targets trademark owners from a variety of professions and businesses. Respondent’s intentional recidivism and knowing infringements constitute a bad faith use of the infringing domain names pursuant to Section 4(b)(ii) of the UDRP, and prevent Time Warner from reflecting its own marks in corresponding domain names. Respondent’s intentional and repeated use of a false mailing address further demonstrates Respondent’s bad faith intent.
 
Last edited:
1
•••
I'm not sure how accurate that 28 BTC input/output # actually is. ((but I'm a blockchain novice, so this summary is my best assumption))

When looking at the blockchain.com transaction log, I see:

The first transaction looks like it was the .0001BTC that VPN sent as a test transaction with hash ID <935dc7ef6f55ee0cd4a1159ef367324824ef1ccf239019154672e1630 cdaa81b>

Blockchain.com seems to list 6.91589205 BTC as outPut but the wallet in question looks to only have received the .0001BTC input.

((ie. the BTC output may equal 28 BTC, but it doesn't look like the wallet actually received that amoiunt))

When I first took a stab at looking at the chain history, I used: https://www.blockonomics.co/#/search?q=bc1qymcdwgqde47qxd8s7tk0jyufpgejrgtg4gw5qr

It looks like:

4 May 2022 @1205: received: +0.0001 BTC
4 May 2022 @1246: received: +6.27 BTC
11 May 2022 @2128: sent -0.50002679 BTC
11 May 2022 @2138: sent -0.50002679 BTC
11 May 2022 @2233: sent -1.00002679 BTC
11 May 2022 @2255: sent -1.00002679 BTC
12 May 2022 @0011: sent -1.00002736 BTC
12 May 2022 @0057: sent -1.00002592 BTC
12 May 2022 @2143: sent -1.26993956 BTC


Show attachment 228586


**(time stamps from blockchain.com | hyperlinks to blockonomics.co)

*** Notably, the transaction times on Blockchain.com and Blockonomics.co are a few minutes apart, so take the transaction times with a grain of salt
...

11 May 2022 @2128: sent -0.50002679 BTC >> looks to have been sent to wallet address: bc1qfu465pdlg5yfkdmq5nvkmehngzpxvgraam2x4j

Show attachment 228587

bc1qfu465pdlg5yfkdmq5nvkmehngzpxvgraam2x4j (address history)

Show attachment 228589

Looks to have been emptied to wallet address: 14FoANzjfuzx5kjcE2t9RHu5GyF21EDgwF
...

11 May 2022 @2138: sent -0.50002679 BTC >> looks to have been sent to wallet address: bc1qky0tpy908awklx78yczq3krg5f284ze3g6qarc

bc1qky0tpy908awklx78yczq3krg5f284ze3g6qarc (address history)
Show attachment 228591


Looks to have been emptied to wallet address: bc1qrgdndftdm03kkdzs3crm85ter8prdcv5qgg5nn
...

11 May 2022 @2233: sent -1.00002679 BTC >> looks to have been sent to wallet address: bc1qz326c2yjfhmn2hh8vdpa5h5fe09gwu5v53atrg

bc1qz326c2yjfhmn2hh8vdpa5h5fe09gwu5v53atrg (address history)
Show attachment 228592

Looks to have been emptied to wallet address: bc1qrgdndftdm03kkdzs3crm85ter8prdcv5qgg5nn or maybe 16hiTVsDsGJun1ZiufqPyVw9fbaWbeykQW

...

11 May 2022 @2255: sent -1.00002679 BTC >> looks to have been sent to wallet address: bc1qs5q5qeclklgn8j2lqkncjztp34tzjnxafyh8lj

bc1qs5q5qeclklgn8j2lqkncjztp34tzjnxafyh8lj (address history)
Show attachment 228593


Looks to have been emptied to wallet address: bc1qrgdndftdm03kkdzs3crm85ter8prdcv5qgg5nn or 16hiTVsDsGJun1ZiufqPyVw9fbaWbeykQW
...

12 May 2022 @0011: sent -1.00002736 BTC >> looks to have been sent to wallet address: 19apZEZjdXQpVH9GJnwCJiaccXXgfLXvrc

19apZEZjdXQpVH9GJnwCJiaccXXgfLXvrc (address history)
Show attachment 228594


Looks to have been emptied to wallet address: 1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC
...

12 May 2022 @0057: sent -1.00002592 BTC >> looks to have been sent to wallet address: 19apZEZjdXQpVH9GJnwCJiaccXXgfLXvrc (same address as above)

19apZEZjdXQpVH9GJnwCJiaccXXgfLXvrc (address history)
Show attachment 228594

...

12 May 2022 @2143: sent -1.26993956 BTC >> looks to have been sent to wallet address: 127ygKZgJXDDk7g3mcUuEyrqRQ2MzXfF4Y

127ygKZgJXDDk7g3mcUuEyrqRQ2MzXfF4Y (address history)
Show attachment 228595

Looks to have been emptied to wallet address: 1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC


Needless to say, all addresses that received BTC directly from the BTC address that VPN sent 6.2701 BTC to appears to have been emptied.

However, you can see the destination wallet address that these were emptied to. I didn't post some active wallets I found earlier because I don't know how to confirm or make sense of these transactions when these coins enter wallets with lots of activity.

For instance, take a closer look at the final transaction, <12 May 2022 @2143: sent -1.26993956 BTC>

The transaction input was:
bc1qymcdwgqde47qxd8s7tk0jyufpgejrgtg4gw5qr << that's the address alleged Dikian provided VPN>
1.26983956 BTC
bc1qymcdwgqde47qxd8s7tk0jyufpgejrgtg4gw5qr << that's the address alleged Dikian provided VPN>
0.0001 BTC

The transaction output was:
127ygKZgJXDDk7g3mcUuEyrqRQ2MzXfF4Y <<that's the gaining address>
1.26989974 BTC

The gaining wallet address <127ygKZgJXDDk7g3mcUuEyrqRQ2MzXfF4Y> then sent its remaining 1.269.. BTC to address <1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC>

The BTC Wallet Address <1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC> appears to have a BTC balance of 2659 BTC (= current value of apprx $47million)

In summary (for instance), VPN sent 6.27 BTC to alleged Dikian wallet > the alleged Dikian wallet sent the remaining apprx 1.269 BTC to wallet ending in XfF4y > the wallet ending in XfF4y looks to have been emptied to wallet ending in 5kmqC > wallet ending in 5kmqC appears to have a current balance 2659 BTC, albeit with lots of incoming/outgoing transaction history..

I have no idea how to identify the wallet <1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC> which has a $47mllion BTC balance... is it an exchange? a mixer? or...?
So technically, where is the Bitcoin can be traced because it is open ledger. I believe to cash in 250,000 $ through Exchanger will need ID Card for account holder. So can VPN.com report to Police for criminal and get back their 250,000$? It seems it is easier than asking multimillions $ to Dikian..
 
0
•••
I think Konstantinos Zournas has quite an interesting comment on his website:

"I am not too familiar with US law but I am pretty sure that in most countries you need to state your real name in a court to file an answer and you can not reply using an alias and sign the response as “Attorneys for Defendant sued as George Dikian”.

So, who is “George Dikian” on the VPN.com lawsuit?

If I was “George Dikian” and wanted to clear my name the first thing I would do is state my real name in the court. I wouldn’t use an alias in the first place but anyway…"

https://onlinedomain.com/2022/12/13/domain-name-news/who-is-george-dikian-on-the-vpn-com-lawsuit/

Some interesting back and forth in the comment section there. Hopefully it heats up like @OnlineDomainCom last related article.

Reading Konstantinos reply to @jberryhill in the comments of OnlineDomain.com last article, got me thinking to the mystery behind past historically well known domainers. Yun Ye comes to mind.

https://kesmodel.wordpress.com/2006/11/30/yun-ye-merely-human-but-very-smart/

Until journalists started reporting on the Chinese-born Ye (my favorite piece is here), some domain investors didn’t believe he was a real person; perhaps, they thought, there were 10 people working for Ultimate Search, and Ye was really just an alias for the firm. Still, little was known about Ye the man. Now, some new details are slowly emerging, thanks largely to the power of public records. Here are a few of those details: Ye was born in June 1972, which means he was merely 32 when he negotiated the sale of his portfolio to Marchex...

https://web.archive.org/web/2006020...usiness2_archive/2005/12/01/8364591/index.htm

His prowess quickly became clear. Chad Folkening, a domainer in Indianapolis, was disorganized in those years and sometimes missed renewal deadlines. He noticed that Ye was grabbing his expired names with lightning speed. After Ye had snapped up 100 of them, Folkening decided he needed to talk to Ye. "I was eating, sleeping, and drinking Yun Ye," he says. E-mail drew no response. Nor did phone calls. So in late 2001, Folkening traveled to an address near San Jose listed on Ye's domain registrations. "I figured I was going to walk up to his front door, knock, and say, 'Yun Ye, I just had to meet you,'" says Folkening, who now owns 7,000 names. Instead, the address led him to a Mail Boxes Etc. outlet. Folkening stuck Post-It notes on Ye's box asking him to call. Ye sent Folkening an e-mail a couple of days later, but the two never met up. Two years later, some acquaintances of Folkening's set up a get-together with Ye in a Los Angeles bar. "I did most of the talking, then he left," Folkening recalls. It wasn't until the next day that it dawned on Folkening that the man he'd had drinks with was probably an entirely different Yun Ye, which the real Ye confirmed to him in an e-mail. (Ye's attorney, John Barryhill, says Ye won't talk to the press, and he adds, "I don't answer questions about him.")

I assume there may be a heavier call for George Dikian to reveal himself considering emails were sent from his email address, but does that mean any email hacker should look for domain registrant alias's containing valuable domains to force the registrant to reveal themself or risk losing their domains to a default judgement?

Also, at what point does using a alias as a whois registrant break any ICANN or applicable rules? Could George Dikian be a legit DBA?
 
Last edited:
1
•••
1
•••
does that mean any email hacker should look for domain registrant alias's containing valuable domains to force the registrant to reveal themself or risk losing their domains to a default judgement?

But who would ultimately benefit from that scheme? 🤔
 
0
•••
Last edited:
0
•••
The only person I know to have met Yun Ye, other than myself, is Frank Schilling. I took a picture of Frank and Yun after a lunch one day, and had it made into a Canadian postage stamp…


Show attachment 228607

https://johnchow.com/making-money-with-domain-names/ (2006)

Ye sold his domain empire in November 2004 to publicly traded Seattle-based Marchex for, get this, $164 million. Since then, Ye has never been heard from again.
 
Last edited:
0
•••
  • The sidebar remains visible by scrolling at a speed relative to the page’s height.
Back