Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6242 Page 1 of 31
`
`
`
`
`
`
`
`
`
`
`EXHIBIT A
`
`
`
`
`
`
`
`
`
`
`
`
`EXHIBIT A
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6243 Page 2 of 31
`
`Znspiring
`
`N e
`
`t w
`
`r
`
`k s
`
`Inspiring Networks B.V.
`
`Fossielenerf 90
`6413 MA Heerlen
`
`wwwinspiringnetworks.com
`info@inspiringnetworks.com
`
`Total
`
`$50000.OOUSD
`
`Sub Total
`
`$50000.OOUSD
`
`Credit
`
`Total
`
`$0.OOUSD
`
`$50000.O0USD
`
`Invoice #67
`Invoice Date: 26/03/2013
`
`Due Date; 09/04/2013
`
`Invoiced To
`ADCONION DIRECT THE DIGITAL DISTRIBUTION PLATFORM
`ATTN. Justin Barredo
`9444 Waples Street Suite #350
`San Diego, CA 92121
`United States
`
`196.246.0.0/16 lmonth and 2 servers
`
`Description
`
`Transactions
`
`Transaction Date
`
`Gateway
`
`Transaction ID
`
`Amount
`
`No Related Transactions Found
`
`Balance
`
`$50000.00USD
`
`Bank: Rabobank
`
`KvK nr . 55810969
`NL851869221801
`IBAN: NL07RA6O0151714525
`-
`Rek.nr.: 15.17.14.525
`On all our deliveries nor lerms ardl condliions apply which are .avoiable an our weenie
`
`Bic: RABONL2U
`
`AMOBEE 1031993
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6244 Page 3 of 31
`
`
`
`
`
`
`
`
`
`
`EXHIBIT B
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6245 Page 4 of 31
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6246 Page 5 of 31
`
`
`
`
`
`
`
`
`
`
`EXHIBIT C
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6247 Page 6 of 31
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6248 Page 7 of 31
`
`
`
`
`
`
`
`
`
`
`EXHIBIT D
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6249 Page 8 of 31
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6250 Page 9 of 31
`
`
`
`
`
`
`
`
`
`
`EXHIBIT E
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6251 Page 10 of 31
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6252 Page 11 of 31
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6253 Page 12 of 31
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6254 Page 13 of 31
`
`
`
`
`
`
`
`
`
`
`EXHIBIT F
`
`
`
`FD-302 (Rev. 5-8-10)
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6255 Page 14 of 31
`- 1 of 2 -
`UNCLASSIFIED//FOUO
`FEDERAL BUREAU OF INVESTIGATION
`
`Date of entry 04/29/2022
`
`On 4/19/2022, Peter Holden was telephonically interviewed. Present for the
`interview was Holden’s attorney, Mark Adams, as well as FBI Special Agents
`Charles Chabalko, Assistant United States Attorneys Melanie Pierson, AUSA
`Sabrina Feve, and AUSA Candy Heath. Holden provided the following
`information:
`In October 2010, Holden started Hostwinds and originally operated the
`business from his home. In 2012, he rented his first office space on the
`10th floor located in a building at 9 E 4th Street in Tulsa, Oklahoma. The
`10th floor office had no heat or AC, and soon after, he moved the business
`to the 3rd floor. In 2016, Holden moved Hostwinds to Seattle and in 2017 or
`2018, he closed the Tulsa office.
`Holden advised that he knew Daniel Dye prior to doing business with Adconian
`Direct (ADR) and that Dye referred other clients to Hostwinds. Holden never
`met Dye in person.
`When asked how he was introduced to ADR, Holden stated that ADR first
`approached him and he was unsure how they originally found Hostwinds. Holden
`primarily dealt with Mark Manoogian and, on occasion, with Abdul Mohammed.
`Holden never met anyone from ADR in person and communicated with ADR by
`telephone, email and/or Skype Messenger.
`Holden stated that ADR used both his Internet Protocol addresses (IP) as
`well as third party IPs to send email. This was also one of the first times
`Holden ever announced other people’s IPs. When asked how he learned the
`process of using Letter of Authorization (LOA) to announce other IPs, Holden
`stated that a friend who worked at another data center explained the process
`to him. Holden did not do anything to verify the LOA or the netblock he was
`announcing. Holden believed that this verification process was the
`responsibility of his upstream provider.
`Holden recalled receiving an email from his upstream provider, CoreXchange,
`regarding an AFRINIC netblock being used by Adconian as being possibly
`hijacked. Holden forwarded this email to ADR and does not recall receiving
`
`UNCLASSIFIED//FOUO
`Investigation on 04/19/2022 at San Diego, California, United States (In Person)
`File # 288A-SD-4318838
`Date drafted 04/28/2022
`by Charles W. Chabalko IV
`This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents are not
`to be distributed outside your agency.
`
`ADCONION-DISC64-00249
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6256 Page 15 of 31
`FD-302a (Rev. 5-8-10)
`
`288A-SD-4318838
`Continuation of FD-302 of (U) Interview of Peter Holden
`
`UNCLASSIFIED//FOUO
`
`, On 04/19/2022
`
`, Page 2 of 2
`
`any response.
`
`UNCLASSIFIED//FOUO
`
`ADCONION-DISC64-00250
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6257 Page 16 of 31
`
`
`
`
`
`
`
`
`
`
`EXHIBIT G
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6258 Page 17 of 31
`
`Message
`
`From:
`Sent:
`To:
`Subject:
`Attachments:
`
`Info - Orbit-Diensten [info@orbitdiensten.com]
`5/13/2013 4:05:46 AM
`Justin Barredo
`rev
`image001.gif
`
`
`
`Hi Justin,
`
`Commented below.
`
`Thanks,
`
`mai kel
`
`Van: Justin Barredo [mailto:
`verzonden: vrijdag 10 mei 2013 18:30
`Aan: info@inspiringnetworks.com
`onderwerp: Blackstar IP's
`
`
`
`Hi Mai kel ,
`
`This is the info I've received from blackstar. Can you go over it and let me
`know what you can confirm from your side?
`
`1/10 - Details: Invoice #32 server and /16 as agreed for 110k usd per 2
`months. 30k usd will be paid up front. Prefix will be announced asap (upon
`release from afrinic) ***they had noted 196.190.0.0/16 but then followed up
`with an email that it was supposed to be 196.246.0.0/16
`
`wire was sent for 39,225.00 usd on 1/10.
`
`1/17 - $70,775.00 was sent for the balance on Invoice #32
`
`1/17 - Details: invioce #33 Rental of 196.194.0.0/16 Payments in 2 parts,
`1st payment today 16-01-2013 of 60k usd 2nd payment on 01-02-2013 of 32k
`usd. Wire sent on 1/17 for $60,000.00
`
`2/4 — Wire sent for the Balance on Invoice #33 in the amount of $32,000.00
`
`2/20 - Details: Invoice #37 5.183.0.0/17 for 2 months wire was sent in the
`amount of $60,000.00
`
`AMOBEE1028025
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6259 Page 18 of 31
`
`2/27 - Details Invoice #40 /16 for 2 months 110k usd /22 for 2 months 2k.
`Renewal for 5k after the first 2 months. The subnet for the /16 was not
`noted on the invoice. wire was sent in the amount of $112,000.00.
`
`Above all correct so far
`
`The 2.59/16 was given on Tuesday 12 march. According to them they only
`mailed a few days on them, well I don't know how that happened, but im sure
`I give the server and dns details to them on the 12th of march. I still have
`a few rDNS mails from ripe about when they got reversed.
`
`About the spamhaus listing or whatever spamhaus mentions on the SBL itself,
`I don't care because some of the info goes back t❑ 2011 or even before that,
`so it's not accurate.. and almost every SBL gets blocked by precaution or
`whatever spamhaus tells. But the "last" listing caused me to turn it back to
`ripe L I can't do anything about that.
`
`The 2.59.0.0/16 was listed on 4/15 and we only had a few days of mailing on
`them. In the listing it states the listing was made based off the
`announcement or acquisition by E-Rent LLC. Spamhaus listed it based on the
`LLC not from any abuse on our part. This block 5.182.0.0/16 was sbl'd upon
`arrival. You guys had it just prior to us and the listed the whole
`5.180.0.0/16 block again based of the LLC [-Rent. Spamhaus again noted it
`as a precautionary block. I completely understand when the SBL results from
`us mailing but these were not our fault rather the way they were set up by
`the provider that caused the listing. we paid them a lot for money for in
`march and because of the SBLs due to the E-Rent LLC being set for the swip.
`
`Thanks!
`
`Justin Barred()
`Business operations
`
`ADCONION DIRECT THE DIGITAL DISTRIBUTION PLATFORM
`Phone:
` I Fax: +1 858 638 1717
`9444 waples street Suite #350 I San Diego, CA 92121 I USA
`
`www.adconiondirect.com
`
`
`
`www.adconiondirect.com/>
`
`Geen virus gevonden in dit bericht.
`Gecontroleerd door AVG - www.avg.com
`Versie: 2013.0.3272 / virusdatabase: 3162/6289 - datum van uitgifte:
`05/01/13
`Interne virusdatabase is verouderd.
`
`AMOBEE1028026
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6260 Page 19 of 31
`
`
`
`
`
`
`
`
`
`
`EXHIBIT H
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6261 Page 20 of 31
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6262 Page 21 of 31
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6263 Page 22 of 31
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6264 Page 23 of 31
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6265 Page 24 of 31
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6266 Page 25 of 31
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6267 Page 26 of 31
`
`
`
`
`
`
`
`
`
`
`EXHIBIT I
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6268 Page 27 of 31
`
`Message
`
`From:
`Sent:
`To:
`
`CC:
`Subject:
`
`Allison Hall
`4/15/2013 3:53:52 PM
`Phi Duong
`
`
`
`; Jake Bychak
`
`]; Sasha Treviso
`
`
`AD SD Systems [sdsystems@adconiondirect.com]; AD SD Operations [sdoperations@adconiondirect.conn]
`RE: 196.246.0.0/16 SBL
`
`Thanks for letting us know, Phi!
`
`Allison Hall I sr. Marketing Manager
`
`Phone:
`
`<mai lto
`
`
`
`>
`
`
`
`From: Phi Duong
`sent: Monday, April 15, 2013 3:53 PM
`To: Allison Hall; Jake Bychak; Sasha Trevis❑
`Cc: AD SD Systems; AD SD Operations
`subject: RE: 196.246.0.0/16 SBL
`
`Team:
`
`196.246.0.0/16 have been archived in IPM
`
`Phi Duong I Linux Systems Administrator
`
`Phone: +1 202 6446 I Mobile:
`
`
`
`From: Allison Hall
`sent: Monday, April 15, 2013 1:12 PM
`To: Jake Bychak; sasha Treviso
`Cc: AD SD Systems; AD SD Operations
`subject: RE: 196.246.0.0/16 SBL
`
`Hi Jake,
`
`0d>
`
`That's too bad. Thanks for letting us know. Please keep us posted if
`you're able to remove the SBL.
`
`Thanks!
`
`Allison Hall I Sr. Marketing Manager
`
`Phone:
`
`
`
`AMOBEE1020710
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6269 Page 28 of 31
`
`
`
`From: ]ake Bychak
`Sent: Monday, April 15, 2013 12:47 PM
`To: Sasha Treviso; Allison Hall
`Cc: AD SD Systems; AD SD Operations
`Subject: 196.246.0.0/16 SBL
`
`Hey All,
`
`This range was SBL'd due to gmail mailings. We are working with the provider
`to see what we can do to get a refund or remove the SBL.
`
`http://www.spamhaus.org/sbl/query/SBL18161O
`
`Thanks,
`
`Jake Bychak
`
`Senior Operations Manager
`
`ADCONION DIRECT I DIGITAL ADVERTISING SOLUTIONS
`
`Phone: +1 858.202.6447 I Mobile:
`
` Fax: +1 858.638.1717
`
`9444 waples Street I San Diego, California, 921211 USA
`
`<mailto:First.last@adconiondirect.com>
`<http://www.adconiondirect.com/> www.adconiondirect.com
`
`I
`
`Follow us on <http://www.facebook.com/AdconionDirect> Facebook I
`<https://twitter.com/adconion_direct> Twitter I
`<http://www.linkedin.com/company/2145393?trk=tyah> Linkedin
`
`No virus found in this message.
`Checked by AVG - www.avg.com
`Version: 2012.0.2240 / Virus Database: 2641/5746 - Release Date: 04/15/13
`
`No virus found in this message.
`Checked by AVG - www.avg.com
`Version: 2012.0.2240 / Virus Database: 2641/5746 - Release Date: 04/15/13
`
`AMOBEE1020711
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6270 Page 29 of 31
`
`
`
`
`
`
`
`
`
`
`EXHIBIT J
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6271 Page 30 of 31
`
`Jake Bychak
`5/1/2013 5:00:22 PM
`Abdul Mohammed
`Mark Manoogian
`RE: 196.193.0.0/16 for Blackstar Gmail (SBL)
`
`
`
`
`Sasha Treviso
`
`
`
`Message
`
`From:
`Sent:
`To:
`CC:
`Subject:
`
`Thank you! ! !
`
`Jake Bychak I Director of Operations
`
`Phone: +1 858.202.6447 I Mobile:
`
`
`
`<mai lto : jake . bychakaadconi ondi rect corn>
`
`
`
`From: Abdul Mohammed
`Sent: Wednesday, May 01, 2013 5:00 PM
`To: Jake Bychak
`Cc: Mark Manoogian; Sasha Treviso
`Subject: RE: 196.193.0.0/16 for Blackstar Gmail (SBL)
`
`Hi Jake,
`
`Here's the login credentials:
`
`Server: 108.174.193.66
`
`Login: root/Temp123
`
`IP Range: 196.193.0.0/17
`
`Server: 108.174.193.67
`
`Login: root/Temp123
`
`IP Range: 196.193.128.0/17
`
`Thanks!
`
`Abdul Mohammed I Technical Operations Manager
`
`Phone: +1 858.202.6405 I Mobile:
`
`
`
`
`
`From: Jake Bychak
`Sent: Wednesday, May 01, 2013 4:54 PM
`To: Abdul Mohammed
`Cc: Mark Manoogian; Sasha Treviso
`Subject: 196.193.0.0/16 for Blackstar Gmail (SBL)
`
`AMOBEE1058249
`
`
`
`Case 3:18-cr-04683-GPC Document 403-2 Filed 05/05/22 PageID.6272 Page 31 of 31
`
`Hey Abdul!
`
`would you mind getting the 196.193.0.0/16 range set up for Blackstar? They
`are going to mail Gmail on it since it is SBL'd.
`
`Thanks!
`
`Jake Bychak
`
`Director of operations
`
`ADCONION DIRECT I DIGITAL ADVERTISING SOLUTIONS
`
`Phone: +1 858.202.6447 I
`
`I Fax: +1 858.638.1717
`
`9444 waples street I San Diego, California, 921211 USA
`
`<mailto:First.last@adconiondirect.com>
`<http://www.adconiondirect.com/> www.adconiondirect.com
`
`
`
`Follow us on <http://www.facebook.com/AdconionDirect> Facebook
`<https://twitter.com/adconion_direct> Twitter I
`<http://www.linkedin.com/company/2145393?trk=tyah> LinkedIn
`
`AMOBEE1058250
`
`
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
