# ##
######### ################
############## ###########################
###############################################
################################################
#################################################
###################################################
####################################################
#####################################################
#####################################################
#######################################################
#########################################################
#########################################################
###########################################################
###########################################################
#############################################################
##################################
#####################################################
##################################################################
###########################################################################
####################################################################################
############################################################################################
###############################################################################################
############ ##############
################### ###################
######################## #######################
######## ######## ######### #########
###### ####### ####### #######
###### ####################### ######
###### ###################### #####
##### #################### ######
###### ##### ####### #####
###### ##### ###### #####
##### ##### ##### ######
###### ###### ###### ######
###### ###### ####### ######
####### ####### ####### #######
######### ######### ########## ##########
###################### #######################
################# ##################
########## ############
_____ _ _ _ ___ ___ ___ ___
| __ \ | | | | | | / _ \ / _ \__ \ / _ \
| |__) |__ ___| |_ ___ __| | | |__ _ _ | | | |_ _| | | | ) | (_) |
| ___/ _ \/ __| __/ _ \/ _` | | '_ \| | | | | | | \ \/ / | | |/ / > _ <
| | | (_) \__ \ || __/ (_| | | |_) | |_| | | |_| |> <| |_| / /_| (_) |
|_| \___/|___/\__\___|\__,_| |_.__/ \__, | \___//_/\_\\___/____|\___/
__/ |
|___/
╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
║ As alleged in the complaint and the indictment, Incognito Market was an online narcotics bazaar that existed on the dark web. ║
║ Incognito Market formed in October 2020. Since that time, and through its closing in March, Incognito Market ║
║ sold more than $100 million of narcotics — including hundreds of kilograms of cocaine and methamphetamines. ║
║ Incognito Market was available globally to anyone with internet access and could be accessed using the Tor web browser on ║
║ the “dark web” or “darknet.” Lin operated the Incognito market under the online pseudonym “Pharoah” or “faro.” As “Pharoah” ║
║ — the leader of Incognito market — Lin supervised all of its operations, including its employees, vendors, and customers, and had ║
║ ultimate decision-making authority over every aspect of the multimillion-dollar operation. ║
╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝
⠀⠀⠀⠀⠀⠀⠀⢀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣤⣤⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⡀⣰⡿⠛⠛⠿⢶⣦⣀⠀⢀⣀⣀⣀⣀⣠⡾⠋⠀⠀⠹⣷⣄⣤⣶⡶⠿⠿⣷⡄⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⢰⣿⠁⠀⠀⠀⠀⠈⠙⠛⠛⠋⠉⠉⢹⡟⠁⠀⠀⣀⣀⠘⣿⠉⠀⠀⠀⠀⠘⣿⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⢸⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⠁⠀⠀⣾⡋⣽⠿⠛⠿⢶⣤⣤⣤⣤⣿⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⢸⣿⡴⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⣄⡀⠀⢈⣻⡏⠀⠀⠀⠀⣿⣀⠀⠈⠙⣷⠀⠀⠀⠀
⠀⠀⠀⠀⠀⣰⡿⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠛⠛⠛⠙⢷⣄⣀⣀⣼⣏⣿⠀⠀⢀⣿⠀⠀⠀⠀
⠀⠀⠀⠀⢸⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠙⣿⡉⠉⠁⢀⣠⣿⡇⠀⠀⠀⠀
⠀⠀⠀⠀⣿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠛⠗⠾⠟⠋⢹⣷⠀⠀⠀⠀
⢀⣤⣤⣤⣿⣤⣄⠀⠀⠀⠴⠚⠲⠄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣶⡆⠀⠀⠀⠀⢀⣈⣿⣀⣀⡀⠀
⠀⠀⠀⠈⣿⣠⣾⠟⠛⢷⡄⠀⠀⠀⠀⠀⠀⠀⡤⠶⢦⡀⠀⠀⠀⠀⠹⠯⠃⠀⠀⠀⠈⠉⢩⡿⠉⠉⠉⠁
⠀⠀⣤⡶⠿⣿⣇⠀⠀⠸⣷⠀⠀⠀⠀⠀⠀⠀⠓⠶⠞⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢤⣼⣯⣀⣀⠀⠀
⠀⢰⣯⠀⠀⠈⠻⠀⠀⠀⣿⣶⣤⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣰⡿⠁⠉⠉⠁⠀
⠀⠀⠙⣷⣄⠀S& ⠙⢿⣆⠀https://discord.gg/SC9Uz3RR
⠀⠀⠀⠈⠙⣷⠀⠀⠀⣴⠟⠉⠉⠀⠀⣿⣀⣀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⣠⣤⣾⠟⠉⠀⠀⠈⠉⠀⠀⠀
⠀⠀⠀⠀⠰⣿⠀⠀⠀⠙⢧⣤⡶⠟⢀⣿⠛⢟⡟⡯⠽⢶⡶⠾⢿⣻⣏⣹⡏⣁⡿⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠹⣷⣄⠀⠀⠀⠀⠀⣠⣾⠏⠀⠀⠙⠛⠛⠋⠀⠀⢀⣽⠟⠛⠖⠛⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠙⠻⠷⠶⠿⠟⠋⠹⣷⣤⣀⡀⠄⣡⣀⣠⣴⡿⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠳⣍⣉⣻⣏⣉⣡⠞⠁
╔═══╦═══════════════════════╦═══╦════════════════════════════════════════╦═══════╗
║░░░║ PERSONAL INFORMATION ║ + ║░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░║ 0x028 ║
╚═══╩═══════════════════════╩═══╩════════════════════════════════════════╩═══════╝
Name ................ Rui-Siang Lin
Name in Manarin ..... 林睿庠
Known as ............ Pharoah / faro
Date of Birth ....... ??/??/2001
Age ................. 23
Gender .............. Male
Race ................ Asian
Height .............. 90pounds (source MentalOutlaw)
Location ............ Taipei, Taiwan
Languages ........... English / Mandarin Chinese
Current address ..... https://www.bop.gov/locations/institutions/bro/
University .......... National Taiwan University
Ocupation ........... Owner of Incognito Market
ZenPeak Capital
Email ............... [email protected]
https://www.bop.gov/ Register Number: 12648-506
Prision hes currently in https://www.bop.gov/locations/institutions/bro/
Skills .............. Cryptocurrency
Digital Forensics
DDoS Mitigation
Node.js
TypeScript
Back-End Web Development
HTML
JavaScript
CSS
C++
Blockchain
Hyperledger
Fabric
Koa.js
Express.js
SQL
typescript
Linux
networking
Certifications ...... Google Cybersecurity Specialization
Coursera
Chainalysis Reactor Certification (CRC)
Chainalysis
Test Scores ......... GEPT Advanced
Nov 2018 Passed
TOEIC
Nov 2017 990
╔═══╦═══════════════════════╦═══╦════════════════════════════════════════╦═══════╗
║░░░║ Media ║ + ║░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░║ 0x028 ║
╚═══╩═══════════════════════╩═══╩════════════════════════════════════════╩═══════╝
pfp ................. https://avatars.githubusercontent.com/u/49300088?v=4
https://files.offshore.cat/lwwwsMCx.webp
Youtube Video ....... https://www.youtube.com/watch?v=zeNKUDR7_Jc
Charges ............. https://www.justice.gov/opa/media/1352571/dl
Divers License ...... https://files.offshore.cat/YRw9TIio.png
Picture ............. https://files.offshore.cat/7oQXSJUJ.png
Picture he sent himself per mail before creating Incognito Market
https://files.offshore.cat/JTpCSVbI.png
╔═══╦═══════════════════════╦═══╦════════════════════════════════════════╦═══════╗
║░░░║ SOCIALS ║ + ║░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░║ 0x028 ║
╚═══╩═══════════════════════╩═══╩════════════════════════════════════════╩═══════╝
Email ............... [email protected]
Google Maps Review .. https://www.google.com/maps/contrib/100895024598089212019/reviews/@14.0543273,-60.9720637,13z/data=!3m1!4b1!4m3!8m2!3m1!1e1?hl=en&entry=ttu
Personal website .... https://rs.me/
Twitter ............. https://x.com/ruisiang_tw
Discord ............. https://discord.gg/SC9Uz3RR
Github .............. https://github.com/RuiSiang
Gitlab .............. https://gitlab.com/ruisiang
Opensea ............. https://opensea.io/ruisiang
Medium .............. https://ruisiang.medium.com/
Linkedin ............ https://www.linkedin.com/in/ruisiang/
Reddit .............. https://www.reddit.com/user/ruisiang/
╔═══╦═══════════════════════╦═══╦════════════════════════════════════════╦═══════╗
║░░░║ opsec faluar ║ + ║░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░║ 0x028 ║
╚═══╩═══════════════════════╩═══╩════════════════════════════════════════╩═══════╝
i. Lin Personal Email Account-1 is LIN’s email account. Lin Personal Email
Account-1 is registered to the name “林睿庠,” which is the same name on the Taiwanese Driver’s
License used to register Crypto Account-1 and the name used in Video-1. Lin Personal Email
Account-1 is also registered to Phone Number-1, which is the same phone number associated with
Crypto Account-1. Based on a review of the content in Lin Personal Email Account-1, it appears
to be LIN’s personal email account. For example:
1. On or about May 4, 2022, Lin Personal Email Account-1 sent an
email in response to a job post, which read, in substance and in part: “My name is RuiSiang Lin,
and I’m currently a third year at National Taiwan University. I’ve developed blockchain and
backend applications for 2.5 years now as an intern at . Also, I’ve had a solid
infrastructure and cybersecurity background.” Attached to the email was LIN’s English language
resume which listed Phone Number-1 as LIN’s phone number and Lin Personal Email Account-1
as LIN’s email address. The resume listed various computer coding experience including links to
LIN’s GitHub account.
2. On or about November 22, 2023, Lin Personal Email Account-1
received an email from a particular Taiwanese Bank. Attached to that email was a bank statement,
which was password protected. The email from the bank indicated, in substance and in part and
based on machine translations, that the password to decrypt the bank statements was LIN’s
identification number. Law enforcement officers were able to decrypt the bank statement by using
License Number-1. The bank statement indicated that LIN had over $1 million in his accounts.
ii. Lin Personal Email Account-1 Searches Coincide with Administrator-1
Activities. As described above, law enforcement officers obtained a search warrant on Lin
Personal Email Account-1, which provided law enforcement officers access to the content of that
account including, among other things, the Google searches that the user of Lin Personal Email
Account-1 ran, and learned as follows:
ii. Lin Personal Email Account-1 Searches Coincide with Administrator-1
Activities. As described above, law enforcement officers obtained a search warrant on Lin
Personal Email Account-1, which provided law enforcement officers access to the content of that
account including, among other things, the Google searches that the user of Lin Personal Email
Account-1 ran, and learned as follows:
b. On or about May 7, 2021 at 18:40 UTC, Administrator-1
posted on Forum-1 a post titled “A Proposal for ML-proof improvement on DeCaptcha” within
that post, Administrator-1 wrote, in substance and in part, “One pixel attacks should deem the
spammers/DDoSers ML efforts to fail.” The post provided GitHub URL-1 as a link for further
reading on the topic—i.e., the same link Lin Personal Email Account-1 visited earlier that day.
2. Marketplace-1 Casino
a. On or about September 2, 2021, the user of Lin Personal
Email Account-1 searched Google for “provable fair calculator.” On September 3, 2021, the user
of Lin Personal Email Account-1 searched Google for “slot game terminology.” On or about
September 4, 2021, the user of Lin Personal Email Account-1 performed several searches that
appear to be related to animating dice rolling using a particular software coding language. On or
about September 5, 2021, the user of Lin Personal Email Account-1 performed several internet
searches regarding playing cards, poker, and blackjack. On or about September 7, 2021, the user
of Lin Personal Email Account-1 performed several searches regarding animating card flips and
blackjack mathematics.
b. On or about September 7, 2021, the Marketplace-1
“Changelog” lists the following changes to Marketplace-1 “Integrated online casino bets.”26
c. On or about September 15, 2021, Administrator-1 posted on
Forum-1, in substance and in part, that Marketplace-1 offers “bets.”
The post contains the phrase “provably fair mechanism”—i.e., a phrase similar to what LIN
searched thirteen days earlier.
3. Three-Way Chat Feature
a. On or about September 19, 2021, the user of Lin Personal
Email Account-1 searched Google for “three-way conversation.”
b. On or about September 20, 2021, Administrator-1 posted on
Forum-1, in substance and in part, that Marketplace-1 now offers a redesigned dispute system with
“per-order three-way chats.”
4. Cryptopunk Generator
a. On or about February 7, 2022, the user of Lin Personal Email
Account-1 searched Google for “cryptopunk generator js,” “array.reduce,” “get random in array,”
and “js random true false.”
b. On or about February 28, 2022, the Marketplace-1
“Changelog” lists the following changes to Marketplace-1: “Added punk avatars, unique generated
icons that represent you.” Similarly, as indicated above, on or about March 1, 2022, Admisntrator1 posted that Marketplace-1 “dded punk avatars: randomly generated icons that represent you”
on Forum-1.
c. Based on my training and experience, the search
“cryptopunk” was performed to locate images of a popular internet NFTs and memes. Those
images were then used to create Marketplace-1 avatars. The other February 7, 2022 searches
appear to be related to randomizing functions, thus enabling Marketplace-1 to randomly, and
uniquely, assign a “cryptopunk” avatar to each user.
5. Troubleshooting an Offline Server
a. On or about July 19, 2022, pursuant to a judicially authorized
warrant, the FBI imaged a server, which hosted Marketplace-1. To execute that search warrant,
the FBI took the Marketplace-1 sever offline at approximately 23:30 UTC.
b. On or about July 20, 2022, at approximately 00:18 UTC,
00:19 UTC, 00:20 UTC, and 00:23 UTC, the user of the Lin Personal Email Account-1 searched
Google for “pm2 crashed,” “view pm2 daemon logs,” “pm2 daemon logs,” and “pm2 changelog,”
respectively
c. Based on my training and experience, I have learned that
“PM2” is process manager software which helps its users manage and maintain applications
online. Thus, these July 20, 2022 searches—which were performed less than an hour after
Marketplace-1’s server went offline—appear to be LIN attempting to troubleshot the fact that a
Marketplace-1 server went offline.
iii. LIN Emailed Himself a Diagram of a Darknet Marketplace
1. On or about March 12, 2020, the user of Lin Personal Email
Account-1 emailed himself a diagram, which is pictured below.
https://files.offshore.cat/JTpCSVbI.png
b. This diagram appears to be a plan for a darknet market.
Notably, the diagram indicated “vendor,” “listing,” “pgp key,” and “admin review,” all of which
are features of Marketplace-1.
c. In addition to the above mentioned Google searches
performed by the user of Lin Personal Email Account-1, this diagram is further evidence that LIN
is Adminstrator-1.
╔═══╦═══════════════════════╦═══╦════════════════════════════════════════╦═══════╗
║░░░║ Sources ║ + ║░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░║ 0x028 ║
╚═══╩═══════════════════════╩═══╩════════════════════════════════════════╩═══════╝
https://youtu.be/OfejJ_YN2Pc?si=7RXezEOEMKxiXCUg
https://youtu.be/nHo2hEnj8zw?si=DsjEwstEPDpkiLtH
https://www.justice.gov/opa/pr/incognito-market-owner-arrested-operating-one-largest-illegal-narcotics-marketplaces
╔═══╦═══════════════════════╦═══╦════════════════════════════════════════╦═══════╗
║░░░║ The End ║ + ║░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░║ 0x028 ║
╚═══╩═══════════════════════╩═══╩════════════════════════════════════════╩═══════╝
................................. 0x028 ......................................
Website ............. https://liltoothpaste.quest/
Discord Server ...... https://discord.gg/SC9Uz3RR
Telegram group ...... https://t.me/jewsclub
leave a +rep at ..... https://doxbin.com/user/0x028
_____ _ _ _ ___ ___ ___ ___
| __ \ | | | | | | / _ \ / _ \__ \ / _ \
| |__) |__ ___| |_ ___ __| | | |__ _ _ | | | |_ _| | | | ) | (_) |
| ___/ _ \/ __| __/ _ \/ _` | | '_ \| | | | | | | \ \/ / | | |/ / > _ <
| | | (_) \__ \ || __/ (_| | | |_) | |_| | | |_| |> <| |_| / /_| (_) |
|_| \___/|___/\__\___|\__,_| |_.__/ \__, | \___//_/\_\\___/____|\___/
__/ |
|___/
# ##
######### ################
############## ###########################
###############################################
################################################
#################################################
###################################################
####################################################
#####################################################
#####################################################
#######################################################
#########################################################
#########################################################
###########################################################
###########################################################
#############################################################
##################################
#####################################################
##################################################################
###########################################################################
####################################################################################
############################################################################################
###############################################################################################
############ ##############
################### ###################
######################## #######################
######## ######## ######### #########
###### ####### ####### #######
###### ####################### ######
###### ###################### #####
##### #################### ######
###### ##### ####### #####
###### ##### ###### #####
##### ##### ##### ######
###### ###### ###### ######
###### ###### ####### ######
####### ####### ####### #######
######### ######### ########## ##########
###################### #######################
################# ##################
########## ############