Joshua Moon Drop 3.0 Josh & Singapore, Fancy Bear, Cock.li
This is the most packed drop so far so it will be split into parts for clarity.
I have taken some of your posts here into consideration and combined them with my own lore to expand on the leads I can hopefully provide. Thx
There are many more of these to come and I really appreciate the feedback.
I will talk about things in my previous drop so if you haven’t seen that please see: https://www.onionfarms.com/threads/joshua-moon-2tsuki-sneed-king-of-cows-null.3338/page-2#post-52624
Part 1 Fancy Bear
There have been big discussions around Kiwi Farms User Fancy Bear.
https://kiwifarms.net/members/fancy-bear.16862/
Profile Archive: https://archive.ph/KGy7Q
The writing in the orange box next to True & Honest Fan (Проверенный Медведь) Google translates to: “Verified Bear” and where he’s from (Ca-Петербург) Google translates to: “St Petersburg”.
The debate around Fancy Bear is about whether or not the user is an actual member of Russian Government affiliated hacking and spy organization Fancy Bear
https://en.m.wikipedia.org/wiki/Fancy_Bear
Archive: https://archive.ph/J2B0w
or if the username is just being used for the lulz.
Last night the Kiwi Farms 2019 Database Leak was posted in one of many chats.
Here is his account information and the email he signed up with:
Looking at Fancy Bear’s breached conversations (the leak only grabbed participants and subject titles) some parts stood out to me in relation to the question of if Fancy Bear really is a hacker. I have highlighted usernames & conversation titles. Users that start the conversation appear above those who are participants:
Full Account Dump:
(You have to refresh the links as soon as you click on them)
In these caps you can see that Fancy Bear has moderator roles “### Moderator tools”.
Fancy Bear Account Info: (interesting)
https://archive.ph/4mFBe
Fancy Bear Contributed: (really fucking boring don’t even bother)
https://archive.ph/slSRb
Fancy Bear Conversations: (super interesting)
https://archive.ph/3THf9
Fancy Bear Hp: (boring)
https://archive.ph/TByWQ
Fancy Bear Proving: (boring)
https://archive.ph/27ZQI
Fancy Bear Started: (boring)
https://archive.ph/lBaYQ
Fancy Bear Tts: (boring)
https://archive.ph/ADD0x
Previously in this thread someone provided the link to a post made here originally about Josh, Fancy Bear and Flow Chemical Pty Ltd:
https://www.onionfarms.com/threads/joshua-conner-null-moon.621/page-12#post-20754
The user since posting this information disappeared completely and deleted all of his accounts and claimed he was being stalked by underground groups.
The post referenced https://hungrybear.cooking as one of the websites who also used the 16 Nobby Beach PO Box alongside Flow Chemical Pty Ltd, Vincent Zhen and Joshua Moon.
Website Whois Info:
YouTube: (contains one suspicious web usage tutorial explained by an Australian, and someone heavy breathing while recording)
https://youtube.com/@hungrybear.cooking187
Archive: https://archive.ph/7gpVf
Video:
Website: https://hungrybear.cooking
Archive: https://archive.ph/trgK4
Terms and Conditions: https://hungrybear.cooking/about/terms-and-conditions
Archive: https://archive.ph/UGWQJ
Privacy Policy: https://hungrybear.cooking/about/privacy-policy
Archive: https://archive.ph/5yLPE
Contact Us: https://hungrybear.cooking/about/contact-us
Archive: https://archive.ph/vDi6Z
Get Started Meal Planning: https://hungrybear.cooking/how/get-started-meal-plan
Archive: https://archive.ph/45Nuz
Get Started with My Cookbook: https://hungrybear.cooking/how/get-started
Archive: https://archive.ph/eUXsN
Facebook: https://www.facebook.com/hungrybear.cooking
Instagram: https://instagram.com/hungrybear.cooking?igshid=YmMyMTA2M2Y=
Emails:
DenHQ@hungrybear.cooking
privacy@hungrybear.cooking
unsubscribe@hungrybear.cooking
Numbers:
+61 (0)7 3157 1633
Address: Hungry Bear Cooking Pty Ltd (19738)
PO Box 16
Nobby Beach Qld 4218, Australia
Company Page:
Hungry Bear Cooking Pty Ltd ACN 604 026 557
https://abr.business.gov.au/AbnHistory/View?id=16604026557
Archive: https://archive.ph/6faPN
https://connectonline.asic.gov.au/R...ype=OrgAndBusNm&_adf.ctrl-state=15f68z4cn8_15
Pay attention to the Terms & Conditions and Privacy sections of Hungrybear.cooking compared to what they used to be on Flowchemical.com.au (Home Page Archive:
https://web.archive.org/web/20180224172917/http://flowchemical.com.au/
Terms & Conditions:
https://web.archive.org/web/20180310223957/http://flowchemical.com.au/terms
Acceptable Use Policy:
https://web.archive.org/web/20180310224002/http://flowchemical.com.au/acceptable-use)
Comparison of certain parts: (I’ve highlighted phrases and words and labeled Flow vs Hungry Bear for further clarity.)
Parts of the wording are almost identical.
There was a news articles about 16 Nobby Beach (Flow & Hungry Bear’s PO Box).
This article links 16 Nobby Beach directly to Russian cyber spies.
https://www.michaelsmithnews.com/2016/08/po-box-16-nobby-beach-come-in-please-over.html
Archive: https://archive.ph/hpnld
I have reverse searched images of food Hungry Bear claims to have made and posted on their Instagram:
As well as the image of children they use as their Facebook background:
Fancy Bear’s website (which appears in one of the caps of his account breach linked)
https://fancybear.net is coincidentally currently barely loading after suffering a series of DDOS attacks. Deep Thunk.
Take from this what you will.
Part 2 Cock.li
This has been spoken about by a few people recently.
What led me to finding this was typing the email ending Fancy Bear signed up with (kek@rape.lol) into the URL bar.
I typed in rape.lol which automatically redirects to cock.li, yet this domain and email option isn’t listed anywhere on their site.
Hosting Records for rape.lol show that it is owned by cock.li:
Source: https://myip.ms/info/whois/37.120.193.123/k/1802749523/website/rape.lol#a
Archive: https://archive.ph/2Rl3u
Enigma Software found @rape.lol emails as being encrypted with malware that usually follows extortion and makes victims files inaccessible:
Article: https://www.enigmasoftware.com/evolutionrapelolransomware-removal/
Archive: https://archive.ph/v7pi6
“The 'evolution@rape.lol' Ransomware is designed to make the victim's files inaccessible and then demand a ransom payment from the victim in exchange for returning access to the compromised data. Typically, the 'evolution@rape.lol' Ransomware is delivered to the victim via spam emails in the form of a file attachment that downloads and installs this threat onto the victim's computer.”
This probably means anyone who visits cock.li or rape.lol is being actively injected with malware and Trojans.
Cock.li’s listed email address options:
Website:
https://cock.li
Archive: https://archive.ph/8JAId
Report Abuse: https://cock.li/abuse
Archive: https://archive.ph/U0Kit
Terms of Service: https://cock.li/tos
Archive: https://archive.ph/Rhi7G
Privacy Policy: https://cock.li/privacy
Archive: https://archive.ph/znOFa
OvO Systems Ltd: https://ovo.sc
Archive: https://archive.ph/5Ij0F
Donate: https://cock.li/donate
Archive: https://archive.ph/Uv0ui
Help: https://cock.li/help
Archive: https://archive.ph/oLbOp
Mailing List: https://cock.li/mailinglist
Archive: https://archive.ph/ufss8
Contact: https://cock.li/contact
Archive: https://archive.ph/nb1wr
Webmail: https://mail.cock.li
Archive: https://archive.ph/HrNBB
Login: https://cock.li/login
Archive: https://archive.ph/2uG1r
Register: https://cock.li/register
Archive: https://archive.ph/W7ue6
Server: https://cock.li/server
Archive: https://archive.ph/djn5F
File: https://vc.gg/files/otr.txt
Archive: https://archive.ph/llW6R
This email service has been promoted an innumerable amount of times by Joshua Moon who refers to its owner Vincent Canfield, as “a great guy”.
Is Vincent a great guy?
Turns out Vincent has been sending users of Cock.li’s services’ information to the FBI as well as being in deals with them regarding freezing people’s accounts, sending around information and assisting in federal investigations.
https://cock.li/transparency
It is hard to tell from the email exchanges and subpoenas how much Vincent tells the police, but in comparison to most of these types of hosting services owners who would have a meltdown if asked to give out user information, Vincent seems almost a little too willing. Here are a series of oddly friendly email exchanges with law enforcement and Vincent, whether it’s him wishing them a good weekend, them giving him a personal point of contact, them telling them to ring their personal phone numbers, them addressing emails to Vincent with “Hello Folks” as if he’s included Vincent in group exchanges with police multiple times, something about these email exchanges rings alarm bells.
Cock.li has been subpoenaed multiple times, including for child exploitation material.
Vincent seemingly flits between claiming the feds are harassing him and also giving them anything they ask for at the drop of a hat and more. He has gone from willingly handing things over to telling the feds he seems to have regular contact with to subpoena him as protocol and cease just asking for data.
He made a jokey April fools post about being arrested in Romania:
https://cock.li/transparency/april-fools-2016.txt
Archive: https://archive.ph/nnDeL
Although he is transparent about these emails, some of them even contain parts that state he shouldn’t be sharing them:
This transparency should not leave people assuming Vincent is trustworthy and here’s why:
The transparency page is not linked on the home page and let’s be real, most users won’t think to search for /transparency
- Him posting some of his exchanges with the feds still doesn’t make him not someone handing over user data to glowies
- There are almost no transparency posts since 2018. There is no way the police just randomly stopped being aware of cock.li
- There is no evidence that these are ALL the emails he’s received from the feds and not just the ones that are the least “problematic” in terms of if users found them.
- No explanation for ceasing transparency logs.
He also said he isn’t surprised that Russian intelligence use his site:
https://www.vice.com/amp/en/article/dyv87z/cockli-admin-russian-intelligence-svr-fbi-dhs-cisa-report
Archive: https://archive.ph/DGfpR
Still want to use Cock.li?
Vincent Canfield
Twitter: https://twitter.com/gexcolo?s=21&t=4cEEJAZuIHckWurH2Y1Vkw
Archive: https://archive.ph/oFxRg
Phone Numbers:
+1 (662) 625-6266
+1 (206) 203-6677
+49 375 5092 517
Emails:
vc@cock.li
JDGlazock vc@cock.li
abuse//cock.li
Fediverse: vc@shitposter.club
Archive: https://archive.ph/6B9FS
Gab: https://gab.com/vc
Archive: https://archive.ph/qLdqv
Address:
18 Monroe Street
Augusta, ME 04330
(Vincent Canfield doesn’t seem to exist on white pages anywhere and there seem to be 4 random people living at this address.
+1 (207) 242-8662 is one of their numbers and the voicemail is the automated “leave a voicemail for” and then a man’s voice saying something inaudible followed by “forums”. His name is according to Whitepages is Jacob J Forbes also associated with a Chinese email address: zhue.xie@msn.com will look further into this.)
Another site of his: https://vc.gg
Archive: https://archive.ph/YxSFe
Another: http://horsefucker.org
Archive: https://archive.ph/AWlk4
Never trust Vincents.
Part 3 Josh’s International not-so-private Private Companies
I along with other posters here wondered if Flow existed somewhere in the world as well as Australia.
I finally have found something very convincing.
Both Flow Chemical Pty Ltd and Hungry Bear Cooking Pty Ltd exist in an almost mirrored way in Singapore under the names Flow Chemicals Pte Ltd (previously named Flow Chemical Pte Ltd) and Hungry Bear Pte Ltd.
Flow Chemical Pte Ltd: https://www.sgpbusiness.com/company/Flow-Chemicals-Pte-Ltd
Archive: https://archive.ph/Xs29W
Hungry Bear Pte Ltd: https://www.sgpbusiness.com/company/Hungry-Bear-Pte-Ltd
Archive: https://archive.ph/VwcWb
Another company that exists in Singapore is Chris Chandler Consulting which is currently in the process of cancellation. This could be unrelated, I just thought it was funny.
Chris Chandler Consulting: https://www.sgpbusiness.com/company/Chris-Chandler-Consulting
Archive: https://archive.ph/op0bf
Flow Chemicals Pte Ltd and Hungry Bear Pte Ltd are the only companies in Singapore who use that name. There are almost no other companies with a similar name.
Flow Chemicals Pte Ltd seems to be in the fields of chemical and gas and oil production and its previous name was Flow Chemical Pte Ltd and was registered in 2013 and struck off in 2017.
This needs further research.
This drop was more focused around info, the next one will be more funny and drama related. I was trying to continue on from things being posted about in this thread and hopefully provide people with some leads
I am considering posting a mini drop before the next one containing a list of KF accounts who use Cock.li emails and could potentially be compromised by law enforcement or hackers injecting them with malware to extort them. I feel it’s important to let people know.
As always, you can contact me via email
2022Odysseus@proton.me with any non public info regarding Josh or Kiwi Farms that you don’t want to post yourself. Everyone will be kept anonymous.
Stay safe & God bless
Last edited by a moderator: