# ## ######### ################ ############## ########################### ############################################### ################################################ ################################################# ################################################### #################################################### ##################################################### ##################################################### ####################################################### ######################################################### ######################################################### ########################################################### ########################################################### ############################################################# ################################## ##################################################### ################################################################## ########################################################################### #################################################################################### ############################################################################################ ############################################################################################### ############ ############## ################### ################### ######################## ####################### ######## ######## ######### ######### ###### ####### ####### ####### ###### ####################### ###### ###### ###################### ##### ##### #################### ###### ###### ##### ####### ##### ###### ##### ###### ##### ##### ##### ##### ###### ###### ###### ###### ###### ###### ###### ####### ###### ####### ####### ####### ####### ######### ######### ########## ########## ###################### ####################### ################# ################## ########## ############ .______ ______ _______.___________. _______ _______ .______ ____ ____ ____ ____ __ ______ __ ___ .___________. _______ | _ \ / __ \ / | || ____|| \ | _ \ \ \ / / \ \ / / | | / __ \ | | / \ | || ____| | |_) | | | | | | (----`---| |----`| |__ | .--. | | |_) | \ \/ / \ \/ / | | | | | | | | / ^ \ `---| |----`| |__ | ___/ | | | | \ \ | | | __| | | | | | _ < \_ _/ \ / | | | | | | | | / /_\ \ | | | __| | | | `--' | .----) | | | | |____ | '--' | | |_) | | | \ / | | | `--' | | `----./ _____ \ | | | |____ | _| \______/ |_______/ |__| |_______||_______/ |______/ |__| \__/ |__| \______/ |_______/__/ \__\ |__| |_______| ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║ As alleged in the complaint and the indictment, Incognito Market was an online narcotics bazaar that existed on the dark web. ║ ║ Incognito Market formed in October 2020. Since that time, and through its closing in March, Incognito Market ║ ║ sold more than $100 million of narcotics — including hundreds of kilograms of cocaine and methamphetamines. ║ ║ Incognito Market was available globally to anyone with internet access and could be accessed using the Tor web browser on ║ ║ the “dark web” or “darknet.” Lin operated the Incognito market under the online pseudonym “Pharoah” or “faro.” As “Pharoah” ║ ║ — the leader of Incognito market — Lin supervised all of its operations, including its employees, vendors, and customers, and had ║ ║ ultimate decision-making authority over every aspect of the multimillion-dollar operation. ║ ╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝ ⠀⠀⠀⠀⠀⠀⠀⢀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣤⣤⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⡀⣰⡿⠛⠛⠿⢶⣦⣀⠀⢀⣀⣀⣀⣀⣠⡾⠋⠀⠀⠹⣷⣄⣤⣶⡶⠿⠿⣷⡄⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⢰⣿⠁⠀⠀⠀⠀⠈⠙⠛⠛⠋⠉⠉⢹⡟⠁⠀⠀⣀⣀⠘⣿⠉⠀⠀⠀⠀⠘⣿⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⢸⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⠁⠀⠀⣾⡋⣽⠿⠛⠿⢶⣤⣤⣤⣤⣿⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⢸⣿⡴⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⣄⡀⠀⢈⣻⡏⠀⠀⠀⠀⣿⣀⠀⠈⠙⣷⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⣰⡿⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠛⠛⠛⠙⢷⣄⣀⣀⣼⣏⣿⠀⠀⢀⣿⠀⠀⠀⠀ ⠀⠀⠀⠀⢸⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠙⣿⡉⠉⠁⢀⣠⣿⡇⠀⠀⠀⠀ ⠀⠀⠀⠀⣿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠛⠗⠾⠟⠋⢹⣷⠀⠀⠀⠀ ⢀⣤⣤⣤⣿⣤⣄⠀⠀⠀⠴⠚⠲⠄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣶⡆⠀⠀⠀⠀⢀⣈⣿⣀⣀⡀⠀ ⠀⠀⠀⠈⣿⣠⣾⠟⠛⢷⡄⠀⠀⠀⠀⠀⠀⠀⡤⠶⢦⡀⠀⠀⠀⠀⠹⠯⠃⠀⠀⠀⠈⠉⢩⡿⠉⠉⠉⠁ ⠀⠀⣤⡶⠿⣿⣇⠀⠀⠸⣷⠀⠀⠀⠀⠀⠀⠀⠓⠶⠞⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢤⣼⣯⣀⣀⠀⠀ ⠀⢰⣯⠀⠀⠈⠻⠀⠀⠀⣿⣶⣤⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣰⡿⠁⠉⠉⠁⠀ ⠀⠀⠙⣷⣄⠀S& ⠙⢿⣆⠀https://discord.gg/rfXcEuFSaG ⠀⠀⠀⠈⠙⣷⠀⠀⠀⣴⠟⠉⠉⠀⠀⣿⣀⣀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⣠⣤⣾⠟⠉⠀⠀⠈⠉⠀⠀⠀ ⠀⠀⠀⠀⠰⣿⠀⠀⠀⠙⢧⣤⡶⠟⢀⣿⠛⢟⡟⡯⠽⢶⡶⠾⢿⣻⣏⣹⡏⣁⡿⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠹⣷⣄⠀⠀⠀⠀⠀⣠⣾⠏⠀⠀⠙⠛⠛⠋⠀⠀⢀⣽⠟⠛⠖⠛⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠙⠻⠷⠶⠿⠟⠋⠹⣷⣤⣀⡀⠄⣡⣀⣠⣴⡿⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠳⣍⣉⣻⣏⣉⣡⠞⠁ ╔═══╦═══════════════════════╦═══╦════════════════════════════════════════╦═════╗ ║░░░║ PERSONAL INFORMATION ║ + ║░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░║ VOZ ║ ╚═══╩═══════════════════════╩═══╩════════════════════════════════════════╩═════╝ Name ................ Rui-Siang Lin Name in Manarin ..... 林睿庠 Known as ............ Pharoah / faro Date of Birth ....... ??/??/2001 Age ................. 23 Gender .............. Male Race ................ Asian Height .............. 90pounds (source MentalOutlaw) Location ............ Taipei, Taiwan Languages ........... English / Mandarin Chinese Current address ..... https://www.bop.gov/locations/institutions/bro/ University .......... National Taiwan University Ocupation ........... Owner of Incognito Market ZenPeak Capital Email ............... hi@rs.me https://www.bop.gov/ Register Number: 12648-506 Prision hes currently in https://www.bop.gov/locations/institutions/bro/ Skills .............. Cryptocurrency Digital Forensics DDoS Mitigation Node.js TypeScript Back-End Web Development HTML JavaScript CSS C++ Blockchain Hyperledger Fabric Koa.js Express.js SQL typescript Linux networking Certifications ...... Google Cybersecurity Specialization Coursera Chainalysis Reactor Certification (CRC) Chainalysis Test Scores ......... GEPT Advanced Nov 2018 Passed TOEIC Nov 2017 990 ╔═══╦═══════════════════════╦═══╦════════════════════════════════════════╦═════╗ ║░░░║ Media ║ + ║░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░║ VOZ ║ ╚═══╩═══════════════════════╩═══╩════════════════════════════════════════╩═════╝ pfp ................. https://avatars.githubusercontent.com/u/49300088?v=4 https://files.offshore.cat/lwwwsMCx.webp Youtube Video ....... https://www.youtube.com/watch?v=zeNKUDR7_Jc Charges ............. https://www.justice.gov/opa/media/1352571/dl Divers License ...... https://files.offshore.cat/YRw9TIio.png Picture ............. https://files.offshore.cat/7oQXSJUJ.png Picture he sent himself per mail before creating Incognito Market https://files.offshore.cat/JTpCSVbI.png ╔═══╦═══════════════════════╦═══╦════════════════════════════════════════╦═════╗ ║░░░║ SOCIALS ║ + ║░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░║ VOZ ║ ╚═══╩═══════════════════════╩═══╩════════════════════════════════════════╩═════╝ Email ............... hi@rs.me Google Maps Review .. https://www.google.com/maps/contrib/100895024598089212019/reviews/@14.0543273,-60.9720637,13z/data=!3m1!4b1!4m3!8m2!3m1!1e1?hl=en&entry=ttu Personal website .... https://rs.me/ Twitter ............. https://x.com/ruisiang_tw Discord ............. (Irrelevant social, however, you can include it if you wish to) Github .............. https://github.com/RuiSiang Gitlab .............. https://gitlab.com/ruisiang Opensea ............. https://opensea.io/ruisiang Medium .............. https://ruisiang.medium.com/ Linkedin ............ https://www.linkedin.com/in/ruisiang/ Reddit .............. https://www.reddit.com/user/ruisiang/ ╔═══╦═══════════════════════╦═══╦════════════════════════════════════════╦═════╗ ║░░░║ opsec faluar ║ + ║░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░║ VOZ ║ ╚═══╩═══════════════════════╩═══╩════════════════════════════════════════╩═════╝ i. Lin Personal Email Account-1 is LIN’s email account. Lin Personal Email Account-1 is registered to the name “林睿庠,” which is the same name on the Taiwanese Driver’s License used to register Crypto Account-1 and the name used in Video-1. Lin Personal Email Account-1 is also registered to Phone Number-1, which is the same phone number associated with Crypto Account-1. Based on a review of the content in Lin Personal Email Account-1, it appears to be LIN’s personal email account. For example: 1. On or about May 4, 2022, Lin Personal Email Account-1 sent an email in response to a job post, which read, in substance and in part: “My name is RuiSiang Lin, and I’m currently a third year at National Taiwan University. I’ve developed blockchain and backend applications for 2.5 years now as an intern at [redacted]. Also, I’ve had a solid infrastructure and cybersecurity background.” Attached to the email was LIN’s English language resume which listed Phone Number-1 as LIN’s phone number and Lin Personal Email Account-1 as LIN’s email address. The resume listed various computer coding experience including links to LIN’s GitHub account. 2. On or about November 22, 2023, Lin Personal Email Account-1 received an email from a particular Taiwanese Bank. Attached to that email was a bank statement, which was password protected. The email from the bank indicated, in substance and in part and based on machine translations, that the password to decrypt the bank statements was LIN’s identification number. Law enforcement officers were able to decrypt the bank statement by using License Number-1. The bank statement indicated that LIN had over $1 million in his accounts. ii. Lin Personal Email Account-1 Searches Coincide with Administrator-1 Activities. As described above, law enforcement officers obtained a search warrant on Lin Personal Email Account-1, which provided law enforcement officers access to the content of that account including, among other things, the Google searches that the user of Lin Personal Email Account-1 ran, and learned as follows: ii. Lin Personal Email Account-1 Searches Coincide with Administrator-1 Activities. As described above, law enforcement officers obtained a search warrant on Lin Personal Email Account-1, which provided law enforcement officers access to the content of that account including, among other things, the Google searches that the user of Lin Personal Email Account-1 ran, and learned as follows: b. On or about May 7, 2021 at 18:40 UTC, Administrator-1 posted on Forum-1 a post titled “A Proposal for ML-proof improvement on DeCaptcha” within that post, Administrator-1 wrote, in substance and in part, “One pixel attacks should deem the spammers/DDoSers ML efforts to fail.” The post provided GitHub URL-1 as a link for further reading on the topic—i.e., the same link Lin Personal Email Account-1 visited earlier that day. 2. Marketplace-1 Casino a. On or about September 2, 2021, the user of Lin Personal Email Account-1 searched Google for “provable fair calculator.” On September 3, 2021, the user of Lin Personal Email Account-1 searched Google for “slot game terminology.” On or about September 4, 2021, the user of Lin Personal Email Account-1 performed several searches that appear to be related to animating dice rolling using a particular software coding language. On or about September 5, 2021, the user of Lin Personal Email Account-1 performed several internet searches regarding playing cards, poker, and blackjack. On or about September 7, 2021, the user of Lin Personal Email Account-1 performed several searches regarding animating card flips and blackjack mathematics. b. On or about September 7, 2021, the Marketplace-1 “Changelog” lists the following changes to Marketplace-1 “Integrated online casino [Marketplace-1 nickname]bets.”26 c. On or about September 15, 2021, Administrator-1 posted on Forum-1, in substance and in part, that Marketplace-1 offers “[Marketplace-1 nickname]bets.” The post contains the phrase “provably fair mechanism”—i.e., a phrase similar to what LIN searched thirteen days earlier. 3. Three-Way Chat Feature a. On or about September 19, 2021, the user of Lin Personal Email Account-1 searched Google for “three-way conversation.” b. On or about September 20, 2021, Administrator-1 posted on Forum-1, in substance and in part, that Marketplace-1 now offers a redesigned dispute system with “per-order three-way chats.” 4. Cryptopunk Generator a. On or about February 7, 2022, the user of Lin Personal Email Account-1 searched Google for “cryptopunk generator js,” “array.reduce,” “get random in array,” and “js random true false.” b. On or about February 28, 2022, the Marketplace-1 “Changelog” lists the following changes to Marketplace-1: “Added punk avatars, unique generated icons that represent you.” Similarly, as indicated above, on or about March 1, 2022, Admisntrator1 posted that Marketplace-1 “[a]dded punk avatars: randomly generated icons that represent you” on Forum-1. c. Based on my training and experience, the search “cryptopunk” was performed to locate images of a popular internet NFTs and memes. Those images were then used to create Marketplace-1 avatars. The other February 7, 2022 searches appear to be related to randomizing functions, thus enabling Marketplace-1 to randomly, and uniquely, assign a “cryptopunk” avatar to each user. 5. Troubleshooting an Offline Server a. On or about July 19, 2022, pursuant to a judicially authorized warrant, the FBI imaged a server, which hosted Marketplace-1. To execute that search warrant, the FBI took the Marketplace-1 sever offline at approximately 23:30 UTC. b. On or about July 20, 2022, at approximately 00:18 UTC, 00:19 UTC, 00:20 UTC, and 00:23 UTC, the user of the Lin Personal Email Account-1 searched Google for “pm2 crashed,” “view pm2 daemon logs,” “pm2 daemon logs,” and “pm2 changelog,” respectively c. Based on my training and experience, I have learned that “PM2” is process manager software which helps its users manage and maintain applications online. Thus, these July 20, 2022 searches—which were performed less than an hour after Marketplace-1’s server went offline—appear to be LIN attempting to troubleshot the fact that a Marketplace-1 server went offline. iii. LIN Emailed Himself a Diagram of a Darknet Marketplace 1. On or about March 12, 2020, the user of Lin Personal Email Account-1 emailed himself a diagram, which is pictured below. https://files.offshore.cat/JTpCSVbI.png b. This diagram appears to be a plan for a darknet market. Notably, the diagram indicated “vendor,” “listing,” “pgp key,” and “admin review,” all of which are features of Marketplace-1. c. In addition to the above mentioned Google searches performed by the user of Lin Personal Email Account-1, this diagram is further evidence that LIN is Adminstrator-1. ╔═══╦═══════════════════════╦═══╦════════════════════════════════════════╦═════╗ ║░░░║ Sources ║ + ║░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░║ VOZ ║ ╚═══╩═══════════════════════╩═══╩════════════════════════════════════════╩═════╝ https://youtu.be/OfejJ_YN2Pc?si=7RXezEOEMKxiXCUg https://youtu.be/nHo2hEnj8zw?si=DsjEwstEPDpkiLtH https://www.justice.gov/opa/pr/incognito-market-owner-arrested-operating-one-largest-illegal-narcotics-marketplaces ╔═══╦═══════════════════════╦═══╦════════════════════════════════════════╦═════╗ ║░░░║ The End ║ + ║░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░║ VOZ ║ ╚═══╩═══════════════════════╩═══╩════════════════════════════════════════╩═════╝ ................................. Violate ...................................... Website ............. https://liltoothpaste.quest/ Discord Server ...... https://discord.gg/rfXcEuFSaG Telegram group ...... https://t.me/jewsclub # ## ######### ################ ############## ########################### ############################################### ################################################ ################################################# ################################################### #################################################### ##################################################### ##################################################### ####################################################### ######################################################### ######################################################### ########################################################### ########################################################### ############################################################# ################################## ##################################################### ################################################################## ########################################################################### #################################################################################### ############################################################################################ ############################################################################################### ############ ############## ################### ################### ######################## ####################### ######## ######## ######### ######### ###### ####### ####### ####### ###### ####################### ###### ###### ###################### ##### ##### #################### ###### ###### ##### ####### ##### ###### ##### ###### ##### ##### ##### ##### ###### ###### ###### ###### ###### ###### ###### ####### ###### ####### ####### ####### ####### ######### ######### ########## ########## ###################### ####################### ################# ################## ########## ############