Baptiste Robert Profile picture
Apr 7, 2020 23 tweets 9 min read Read on X
Good morning Twitter! Ready for a new thread?

Some people see the #Covid19 pandemic as an opportunity to make money on people fears. Someone on the Internet decided to sell the Oxybreath Pro, a "high-quality" crap. Let's find this assh*le ⬇️⬇️⬇️
Few days ago, I received a tip. A lot of french websites are redirected to a site which is selling a mask: jumps.me
The redirected websites are:
- cups-corp.fr
- christophe-beche.fr
- aulnois.net
- bourgeois-serigraphie.fr
- pose-ton-couplet.fr
- jeff64blog.fr
- justinepaper.fr

I can smell something here. I decided to investigate.
On jumps[.]me, if you click on "Check the availability" you are redirected to hyperstech[.]com to validate your order.
In the legal mentions of the website the name of the company is "Novads OU"
By searching this company name on the Internet, we can find the exact same legal mentions on amazingtechsale[.]com
According to the company registry, Novads OU is located in Tallinn, Estonia and they have only 2 employees dnb.com/business-direc…
They have a website novas[.]co where they sell some crappy gadgets
Did you notice the logo on the previous screenshot? The website drone720x[.]com is hosted on the same pair. This website is selling low quality drones
When you check the company address on maps, you can see... an UPS office. Weird 🤔
The reconnaisance phase is done. Now, it's time to find who is behind this company
The WHOIS record of drone720x[.]com gives us the name of "Pjotr Novikov" who is one of the Novas OU employee
Pjotr also registered shamannn[.]xyz with his personal email 😁
According to the company registry, Pjotr is the founder of Novads OU
In the WHOIS record of hyperstech[.]com, we can find a new name: "Laurent Astoul"
Laurent used the contact email address of advico[.]fr to register the website.
advico[.]fr and adscom[.]co are identical. On the website they wrote: "ADSCOM Advertising Agency is an integrated promotional advertising firm" and the credits at the bottom of the page are "Copyright © 2012 Adscom Ltd"
Adscom Ltd was a UK company dissolved on 2 July 2019 beta.companieshouse.gov.uk/company/111664…
It has been founded by Adam Harding
I'm not really surprised. Adscom Ltd also sell low quality drone on gadgethqs[.]com
This company is supposed to be dissolved. They don't have the right to sell stuff anymore...
Additional note on our friend Pjotr. Pjotr is a business man, he is part of the 6 company boards. Impressive for a 30 years old guy... teatmik.ee/en/personpriva…
That's the end of this #OSINT session. Hope you like it!

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Baptiste Robert

Baptiste Robert Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @fs0c131y

Jan 19
The IP address of DrugHub, a well-known dark web drug marketplace, has been exposed.

The website owner made a critical OPSEC blunder.

It's OPSEC time!
On the website's /info/market-links page, three links are provided:
- The primary .onion address
- A clearnet link
- A permanent mirror Image
Currently, drughub[.]xx is protected by Cloudflare, but two months ago, it was hosted on the IP address 186.2.171.6. Image
Image
Read 9 tweets
Jan 14
Worried about a TikTok ban? Americans are now flocking to Xiaohongshu (REDnote), another Chinese app.

Spoiler: Yes, it tracks its users.

Time to dive in! ⬇️ Image
When creating an account, you must verify your phone number by entering a code received via SMS.

The request sent to Xiaohongshu's server includes your phone number (of course), along with your IDFA and IDFV. Image
Image
What’s an IDFA? The Identifier for Advertisers (IDFA) is a unique device ID assigned by Apple to every iOS device.

Many actors, like data brokers, use it to profile you, track your location, and more.

Read 13 tweets
Jan 10
Only one country was represented at Kim Jong Un's New Year's Eve party. Can you guess which one?

At the Rungrado Stadium, Kim hosted a grand celebration. Before the fireworks, officials enjoyed a private party near the stadium

One attendee's face stood out 🕵️‍♂️

It’s OSINT time!
South Korean media focused on a 2-second clip of Kim Yo Jong, Kim Jong Un's sister, seen publicly with what seemed to be her children for the first time.

But they missed something important 👀
I came across the official video of the private party before the celebration. It shows key figures stepping out of their cars, mingling, and chatting around tables.

Something immediately caught my eye. Do you see it too?
Read 17 tweets
Jan 8
Hackers claim to have breached Gravy Analytics, a US location data broker selling to government agencies.

They shared 3 samples on a Russian forum, exposing millions of location points across the US, Russia, and Europe.

It's OSINT time! 👇 Image
The samples include tens of millions of location data points worldwide.

They cover sensitive locations like the White House, Kremlin, Vatican, military bases, and more.

Time to dig in! Image
Image
Image
Visualizing such a massive amount of location data is no easy task.

Google Earth Pro crashed at 500k location points, and our OSINT platform hit its limit at 1.5 million. Even if it is "just" a sample, rendering the entire dataset at once is a real challenge. Image
Read 27 tweets
Dec 28, 2024
5 days ago, an Instagram account shared a video from North Korea with the caption: "A brave tourist secretly captures restricted views of downtown North Korea"

Can we geolocate this footage?

It's GEOINT time!
I paused the video to screenshot this pink building. A quick Google Lens search reveals two matching photos of the location:
- alamyimages.fr/un-agent-de-po…
- flickr.com/photos/tobeyfo… Image
Image
Image
Image
The second link includes a street name and points to this location: 39.00493900995318, 125.73642620392643. Image
Image
Read 11 tweets
Dec 23, 2024
On Friday, December 20, 2024, the U.S. DOJ charged Rostislav Panev, a dual Russian-Israeli national, as a LockBit ransomware developer. Arrested in Israel, he awaits extradition to the U.S.

It's OSINT time! Image
You know the drill: with predictasearch.com and predictagraph.com, I traced and mapped Rostislav Panev's complete digital footprint.

Explore the graph here: predictagraph.com/graph/snapshot… Image
First things first, here’s the official information available:
- DOJ Press Release: justice.gov/opa/pr/united-…
- Superseding Complaint: justice.gov/opa/media/1381… Image
Image
Read 14 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(