Only on the Ethereum Mainnet, the address 0x7c9eb6df2349820d27d69805193d7806a7689ade (Ethereum Name fatfeemiddleman.eth and Ethereum Name
fatfee.eth, has received 167.5123 ETH from 59 addresses that are associated with PinkDrainer, AngelDrainer, InfernoDraine and other fraudulent addresses:

In addition to these 167.5123 ETH, the address 0x7c9eb6df2349820d27d69805193d7806a7689ade received funds in other tokens, as well as other networks that sent addresses for him that are associated with the scam. For example, on the Arbitrum network https://dashboard.misttrack.io/address/ETH-Arbitrum/0x7c9eb6df2349820d27d69805193d7806a7689ade:

This address 0x7c9eb6df2349820d27d69805193d7806a7689ade can be found in the repository on the GitHub page: https://github.com/FatBeeBHW/Twitter-Account-Checker/blob/main/README.md

In other words, the address 0x7c9eb6df2349820d27d69805193d7806a7689ade belongs to the owner of the GitHub account: https://github.com/FatBeeBHW

We also discovered illegal activity of Mr. FatBee, which is aimed at hacking other people’s social media accounts. In addition, Mr. FatBee is the owner of a Telegram group https://t.me/fatfees, which serves as a tool for laundering stolen funds (probably for this reason, the name fatfee.eth is reserved for the address 0x7c9eb6df2349820d27d69805193d7806a7689ade). Mr. FatBee, also previously owned a Telegram group for trading stolen Twitter accounts https://t.me/twitterfunhouse. In addition, he owns a proxy service of IP addresses https://t.me/beeproxies (https://www.beeproxies.com/) “Premium Residential Proxy Solutions”. This proxy service is very good for anyone who wants to hide their true IP.

So we see Mr. FatBee has created a very nice set of supporting tools that can come in handy for scammers who do the dirty work on Crypto-Drainers services.

In order for scammers to learn about Mr. FatBee’s tools, he joins Telegram groups that belong to Crypto-Drainers services, after which he offers his services directly in these groups:

The fact that Mr. FatBee advertises the tools he created in groups that are official Crypto-Drainers groups indicates that Mr. FatBee knowingly attracts scammers and thieves to cooperate with him, and knowingly profits from providing services for these scammers. In turn, the scammers pay for these services from the funds they have stolen. All of this makes Mr. FatBee an accessory to the crimes (thefts) committed by the scammers who carry out illegal activities using the malicious software provided to them by the Crypto-Drainers services.

If you study the incoming and outgoing transactions for address 0x7c9eb6df2349820d27d69805193d7806a7689ade, which belongs to Mr. FatBee, you will find specifics that occur frequently. For example, in most cases, stolen funds arrive at address 0x7c9eb6df2349820d27d69805193d7806a7689ade , and after a few minutes, about 90–95% of these funds, in outgoing transactions, go to other addresses. This specificity suggests that, most likely, Mr. FatBee 0x7c9eb6df2349820d27d69805193d7806a7689ade finds buyers for these stolen funds or acts as a guarantor in a private buy/sell transaction, with Mr. FatBee keeping about 5–10% as a reward for his services, plus network commissions, which can be clearly seen in the example I posted in the following screenshot:

This is not an isolated case, and such similar cases have happened many times. Thus, we can say that of all the tools that FatBee has created, it is the MM Vouches service that is the most popular, which helps fraudsters launder stolen funds.

But despite this, a single case was found when the victim claimed that it was the owner of the address 0x7c9eb6df2349820d27d69805193d7806a7689ade who took her funds. Unfortunately, the victim’s account has been deleted, so it’s hard to confirm this information.
So, address 0x7c9eb6df2349820d27d69805193d7806a7689ade, which belongs to FatBee, received 1.988 ETH from address 0xc8c57c976c0b91be4a86f6ec170798e13fa52d48 (https://etherscan.io/tx/0x318c47c0b6ad0f92554e7eebbf957d414e0555b3134c350d4cff72a770c31e7c). As seen in the deleted tweet https://twitter.com/HWX91/status/1785392282935419008, a Twitter user named @HWX91 made the tweet where he indicated that he was the victim of a phishing attack. Currently, the user page of @HWX91 has been deleted and this complaining tweet of his can only be spotted by google search.

Now let’s talk about Mr. FatBee’s identity as a real person, with a real first and last name, real citizenship and official job.

There is already an article on this subject, “Scam as a service: Pink Drainer” (https://medium.com/coinmonks/scam-as-a-service-pink-drainer-5b4165371916), which was published a few months ago by another researcher. I fully agree with the opinion of the author of this article and therefore, I will not repeat his evidence, but only provide additional similar evidence that he did not specify.

So, Mr. FatBee has an account on the Blackhatworld forum: https://www.blackhatworld.com/members/fatbee.859262/, where he has been registered since 2015

In 2015, Mr. FatBee was 19 years old, which he indicated with in his post https://www.blackhatworld.com/seo/hi.751746/:

On the same forum page, other users call him Alek. It is likely that Mr. FatBee originally took the username Alek when he registered on the Blackhatworld forum, but then changed it to FatBee, which is confirmed in his other post at https://www.blackhatworld.com/seo/fresh-start-news-web-vs-small-niche-websites-need-suggestion-starting-from-the-ground.751779/, where he signs his name Alek.

There are 30 posts on the Blackhatworld forum that link Mr. FatBee to the IT company Digital Present (digitalpresent.io). A list of these posts can be seen on 2 pages: https://www.blackhatworld.com/search/20050741/?q=DigitalPresent&o=relevance and https://www.blackhatworld.com/search/20050741/?page=2&q=DigitalPresent&o=relevance. All of these posts of his were created between 1919–1920 who indicates that Mr. FatBee had an employment relationship with Digital Present (digitalpresent.io) during this time period. This information has an important linking role for our investigation.

In a very long post (which is more of a revelation) from Mr. FatBee https://www.blackhatworld.com/seo/journey-early-july-goals-launching-a-saas-product.1243693/, you can see that he has been working hard with his friend. They worked together on proxy servers, they worked together on the http://contentbear.co/ project, they worked together on something else. That being said, his friend is a developer and Mr. FatBee is a Social Media Manager and Lead SEO. Also, this post says that Mr. FatBee’s friend had an attempt to teach Mr. FatBee the basics of Node.js (this is a very important detail — you need to remember this!!!).

Here, the key to solving the mystery is exactly http://contentbear.co/ and officially working as a Social Media Manager and Lead SEO — remember these important details (!!!!).

Now that you’ve memorized a few important details (http://contentbear.co/, Social Media Manager and Lead SEO, learning the basics of Node.js, officially working at Digital Present), I’ll continue my story by taking a small leap forward-it’s easier for a shorter explanation.

So, there are 2 friends/colleagues whose names are Aleksandar Mihailovski (https://www.linkedin.com/in/alekxyz/) and Dejan Božinoski (https://www.linkedin.com/in/deko96/). These colleagues/friends officially worked in the same projects (KIA Motors Macedonia, Digital Present).

As we can see, Mr. Dejan Božinoski was a developer at Digital Present. At the same time, Mr. Aleksandar Mihailovski was a social media manager. Now we will find out if these are really the 2 friends FatBee was talking about in his long message (revelation)?

The GitHub pages https://github.com/FatBeeBHW/ and https://github.com/deko96 are mutually subscribed (what’s that — friendship?):

Also, earlier linkedin pages, both of these friends/colleagues had information that they were directly related to the project site http://contentbear.co/, but they have now removed that information:

As we can see, these 2 people who work at Digital Present, as developer (Dejan Božinoski) and social media manager (Aleksandar Mihailovski), were also involved in the http://contentbear.co/ project, whose team consisted of only 2 people. And, as FatBee said in his long post/revelation (https://www.blackhatworld.com/seo/journey-early-july-goals-launching-a-saas-product.1243693/), through this http://contentbear.co/ project, his developer friend taught him the basics of Node.js.

Now for additional evidence….

Going to the forum page https://www.blackhatworld.com/seo/what-happend-to-contentbear-co.1311655/#post-14146308 we can find the thread “What happend to contentbear.co?”, where it is reported that the site contentbear.co belonged to FatBee:

When visiting the page https://www.blackhatworld.com/seo/discord-spam-house-reach-in-to-untapped-market-of-300m-users-discord-mass-dm-service.1352854/page-2#post-14765088, where FatBee has indicated his details and where we can find a link to Skype, clicking on it leads to the owner of the Skype account “ILearnSEO”:

Also, in one of the Blackhatworld forum posts, we see the post https://www.blackhatworld.com/seo/is-it-ok-to-make-an-article-from-youtubes-video-subtitles.1156815/#post-12401914, which also states that https://contentbear.co was maintained by the same person who has the same Skype account “ILearnSEO”:

The saved web archive, https://web.archive.org/web/20200109084543/https://contentbear.co/, indicates that the site https://contentbear.co is managed specifically by “ILearnSEO”:

Here on the page of the archived copy of https://contentbear.co (https://web.archive.org/web/20200109084543/https://contentbear.co/), we can read the reason of what exactly happened to the site https://contentbear.co, where it is indicated who owns the idea of creating this site, as well as the purpose of its creation and the reasons for its dissolution. And as a friend of the author of this message, a certain developer is indicated. This text was written by “ILearnSEO”, that is, by the same person who on the Blackhatworld forum, under the pseudonym FatBee, indicated his Skype “ILearnSEO” as a contact.

Currently, personal pages belonging to Aleksandar Mihailovski and Dejan Božinoski have suffered changes. And this applies not only to their personal linkedin pages, but also to other pages. The page https://deko96.dev/, which belongs to Dejan Božinoski, was also changed by the author. In this modified version of the page there is no mention of https://contentbear.co. But an older version of this page https://deko96.dev/ has a mention of https://contentbear.co, where this site is mentioned as a personal project of Dejan Božinoski:

Thus we can see that the site https://contentbear.co was a personal project of Dejan Božinoski, i.e. officially belonged to him. But based on the message on the site https://web.archive.org/web/20200109084543/https://contentbear.co/, we can see that the very idea of the project https://contentbear.co belongs to Aleksandar Mihailovski, which essentially says that either of these two friends had the right to call it their project.

However, as we mentioned above, Dejan Božinoski is a developer and he does not own the name “ILearnSEO”. In turn, as stated above, there are several facts that the name “ILearnSEO” belongs to a specialist Social Media Manager and Lead SEO with the real name Aleksandar Mihailovski, who also has the alias FatBee and who owns the address 0x7c9eb6df2349820d27d69805193d7806a7689ade, and who has a practice of hacking Twitter accounts, brokering the trade of stolen Twitter accounts, providing Proxy Server services, and most importantly, providing services to launder the funds that are taken by fraudsters during phishing attacks using Crypto-Drainers tools (FatBee advertises these services in official Telegram groups owned by Crypto-Drainers).

So, we can see that under the FatBee mask there is a Macedonian specialist named Aleksandar Mihailovski (https://www.linkedin.com/in/alekxyz/), who used to be an employee of the IT company Digital Present (https://www.linkedin.com/company/digital-present/, https://digitalpresent.io/). According to the updated page https://www.linkedin.com/in/alekxyz/, Aleksandar Mihailovski’s last official job was the marketing company Monks Agency (https://www.linkedin.com/company/monksagency/, https://monks.agency/), where he held the position of SEO Panda.

___________________________________________________________

I am publishing this result of this investigation as an NFT:

Feel free to add this NFT to your collection, as there are several more such NFTs coming soon that reveal the identities of other scammers and hackers, and that may assist victims in catching abusers or their co-conspirators.