· 10 years ago · Dec 21, 2015, 03:18 AM
1==Luis aka CONTINUUM/XEON==
2
3http://www.hackforums.net/member.php?action=profile&uid=1261919
4
5jabber: continuum@exploit.im
6
7I had saved some scanner site login information he had given me at one point and never thought much of it until it hit me that he had ALWAYS used xeon in either his username or password to everything he ever gave me or linked me to. This is what I had saved
8
9=====
10(2:35:04 AM) continuum@exploit.im: xeon
11(2:35:06 AM) continuum@exploit.im: <removed>
12
13(2:33:21 AM) continuum@exploit.im: http://crypt4u.com/index.php/site/status
14(2:33:26 AM) continuum@exploit.im: http://crypt4u.com/index.php/site/prices
15=====
16
17Lead to searching for the name xeon+hackforums, using my google-fu I found this HF profile, twitter, and pastebin convo
18
19http://www.hackforums.net/member.php?action=profile&uid=693350
20
21http://pastebin.com/S6qgJA6j <old pastebin convo him and others doing prank calls, confirming identity. "Patrick" = Mountain Dew, more on him later. Contradiction = Napalm of Dildonia(http://www.hackforums.net/member.php?action=profile&uid=86312)
22
23http://www.twitter.com/_iXeon
24
25http://www.hackforums.net/member.php?action=profile&uid=693350
26
27Looking through twitter posts I noticed the account was originally created for something called 1337bin.com a website used to host 0days, dox, and other illegal shit for political hacktivists like the jester (@th3j35t3r, fights anonymous), Anonymous (?@AnonymousWiki, ddosed paypal/mastercard), Zer0pwn(@Zer0pwn, hacked pentagon and sony), IonCuber(@IonCuber, UGNazi, Nullcrew, TheWikiBoat), etc. Decided to do a whois..
28
29
30Whois records of 1337bin.com:
31Louis Heisenberg
32 550 Fuhrer Ave
33 Mansfield, OH 44904
34 US
35 Phone: +1.8153221272
36Email: nickwilg @ gmail.com
37
38I did a google search of "Louis Heisenberg Ohio" and found this facebook profile..
39
40https://www.facebook.com/luis.h.flores.56
41
42Luis Heisenberg Flores
43
44I wasn't sure this was him until I googled the gmail listed in the whois.. lead me to this post on this forum
45
46http://www.thetechgame.com/Archives/p=6579357.html#6579357
47
48A user named Carbon who appears to use this email address and also uses the AIM tah4txbox360
49
50http://www.thetechgame.com/-C4RB0N- (user appears to be banned, how surprising)
51
52I wasn't satisfied with what I had found so far, so I back tracked. Time to look through the posts on that HF account.. (http://www.hackforums.net/member.php?action=profile&uid=693350)
53
54Oh look, this post reassures us that his aol IM address (AIM) is none other than tah4txbox360!
55
56http://www.hackforums.net/showthread.php?tid=2135594 (confirms AIM is tah4txbox360 )
57
58And in THIS thread, he references ohio law.
59
60http://www.hackforums.net/showthread.php?tid=2190786 (ohio law reference)
61
62
63Past usernames for Xenon: (http://www.hackforums.net/misc.php?action=username_history&uhuid=693350)
64
65C4RB0Nv2 05-24-2011
66Team Stealth 06-15-2011
67-MySQL- 06-17-2011
68?Xenon? 06-17-2011
69?XenoNâ„¢? 06-18-2011
70?XenoNâ„¢? 07-17-2011
71ehsaan_Vip 07-18-2011
72?XenoNâ„¢? 08-27-2011
73Commandâ„¢ 09-27-2011
74Denial of Service 10-04-2011
75iPhone 4S 10-16-2011
76Xeon ? 11-19-2011
77???Xeon ? 07-26-2012
78iXeon 07-30-2012
79Xesn 09-06-2012
80+Xeon 04-28-2013
81+Phoenix 04-29-2013
82???Xeon 04-29-2013
83???Arizona 05-06-2013
84
85Past usernames for Continuum: (http://www.hackforums.net/misc.php?action=username_history&uhuid=1261919)
86
87XeonComplex 04-29-2012
88XeonComplexâ„¢ 08-15-2012
89CoreXaâ„¢ 01-19-2013
90Reboot.Xâ„¢ 07-13-2013
91Clarionâ„¢ 07-13-2013
92DeathSkullâ„¢ 08-05-2013
93
94Looking through his usernames, Clarion stuck out to me. I remember seeing a Clarion Crypter on the market not too long ago. In fact, I HAD BOUGHT IT AND IT WAS A PIECE OF SHIT. Decided to search on HF to see if this trash was still around.
95
96http://www.hackforums.net/showthread.php?tid=3650168
97
98
99Went on the market 7/29/2013 and the user has -29 rep. Not surprised.
100
101What DID surprise me is that alignment (the seller with -29 rep and 46 fucking username changes) had found another account to use, Miki.
102
103http://www.hackforums.net/showthread.php?tid=3716600&pid=34842323#pid34842323
104
105In the link above he "sold" the crypter to Miki. Luckily Omni noticed he was repeatedly vouching for it with both accounts and rep fucked alignment.. but not Miki. :\
106
107Checked Miki's username history, all Miki/Mik related.
108
109Checked Luis's (Cont/xeon) friends on facebook with the name Miki
110
111https://www.facebook.com/miki.tanaka2
112
113(Miki is also friends with DJ (IonCuber) and Patrick (Mountain Dew) on facebook which you will read about later which is why I don't believe all is coincedence)
114
115Miki is now selling a "new" crypter called DiverseCrypter..
116
117http://www.hackforums.net/showthread.php?tid=3844073
118
119Funny, the crypter design looks oddly familiar.. (its Clarion's UI, renamed..)
120
121I find this horrifying. I begin to look through Miki's (over 500) rep and find most of it was from bitcoin giveaways and the sale of this piece of shit.
122
123It was at this point the same list of members was vouching for a lot of these products
124
125In the DiverseCrypter sales thread..
126
127yogurt vouched (read about him later, he is IonCuber)
128
129
130
131
132All of this lead me to..
133
134=============================================================================
135
136==MOUNTAIN DEW==
137
138So I noticed while I was reading the posts on the older HF account (Xenon) he (Continuum/Xeon) works closely with HF user Mountain Dew (they were cross-vouching). Mountain Dew and Napalm (Napalm of Dildonia) were the people who brought us Barracuda HTTP Loader, the shitty .net bot that turned out to be a big scam. In 2012 they also scammed me for $200 in traffic I sold them..
139
140http://www.hackforums.net/member.php?action=profile&uid=831839
141
142Lets look at his posts..
143
144Mountain Dew sold a service called SpoofThisCall.com
145
146http://www.hackforums.net/showthread.php?tid=3709889
147
148Whois..
149
150Domain Name: SPOOFTHISCALL.COM
151Registry Domain ID: 1800180725_DOMAIN_COM-VRSN
152Creation Date: 2013-05-09 22:14:00Z
153Registrar Registration Expiration Date: 2014-05-09 14:14:00Z
154Registrar: ENOM, INC.
155Registrar Abuse Contact Phone: +1.4252744500
156Reseller: NAMECHEAP.COM
157Registrant Name: CJ SCULTI
158Registrant Organization:
159Registrant Street: 3 MEAD POND LANE
160Registrant City: RYE
161Registrant State/Province: NY
162Registrant Postal Code: 10580
163Registrant Country: US
164Registrant Phone: +1.9147153068
165Admin Email: SEEGEE1237@AOL.COM
166
167Out of curiosity, I started to type scu into Louis's (xeon/cont) facebook friends..
168
169
170Look who it is! DJ Scutti!
171
172https://www.facebook.com/djthesavior5
173
174
175Contact Us email address on SpoofThisCall.com: yo123babybree@gmail.com (this is the paypal email used when I was scammed by Mountain Dew and Napalm :O )
176
177Googled that.. look another HF account.
178
179http://www.hackforums.net/showthread.php?tid=2990939&pid=28227634#pid28227634
180
181Continuing out google search, looks like he owns Datawagon.net
182
183http://bgp.he.net/dns/datawagon.net
184
185https://twitter.com/DataWagon
186
187DataWagon
188@DataWagon
189Best in industry DDoS protected hosting solutions.
190Rye, NY · datawagon.net
191
192Searched DataWagon on HF..
193
194http://www.hackforums.net/showthread.php?tid=3636400 They're trying to sell hosting under account itzG0D. This stuck out to me, because g0d.ca was one of IonCuber's (@Ioncuber) websites (proof: http://pastebin.com/fbvEu0bf)
195
196Looks like they're up to no good on this domain, as recently as this this month (12/2013)
197
198http://app.webinspector.com/public/reports/18826951 - "Report for ‘ http://g0d.ca/stupidstuff/32.exe ’"
199
200Turns out he actually linked to the site from that profile as well in this thread.
201
202http://www.hackforums.net/showthread.php?tid=3605639
203
204
205So we're on to IonCuber. Checked his twitter, noticed he was promoting Dollarboot (http://dollarboot.com/) https://twitter.com/IonCuber/status/405103523357941760
206
207Dollarboot is being sold RIGHT NOW by "yugurt"
208
209http://www.hackforums.net/showthread.php?tid=3828677
210
211At this point I went back to the skype chat pastebin again, and re-read everything. I was confused. Initially I thought Mountain Dew was IonCuber because of the DataWagon/hosting sales on Mountain Dew's account, but MD posted from the name Patrick in the skype chat. Checked Mountain Dews past usernames on HF.. patpat and Phatty McPatty. Searched for Patrick in Xeon/Cont and CJ's friends, sure enough there is only one Patrick on both friends lists. Same highschool. No way it was a coincidence..
212https://www.facebook.com/patroche123
213
214To confirm that, I ended up finding IonCuber's dox available on the googles (he could have planted these though)
215
216http://pastebin.com/G0FaLfUs
217
218So now we have four identities. Lets review.
219
220Continuum = Xeon = Xenon = Luis Heisenberg Flores - https://www.facebook.com/luis.h.flores.56
221
222Mountain Dew = Patrick Roche - https://www.facebook.com/patroche123
223
224Miki = Miki Tanaka - https://www.facebook.com/miki.tanaka2
225
226yogurt = itzG0D = IonCuber = CJ/DJ Sculti/Scutti - https://www.facebook.com/cj.sculti, https://www.facebook.com/djthesavior5