The complete story of the MCT+ Exit Scam
Part 4 of 4
Other parts
Part 1: https://issuu com/mctplus/docs/mct 2b exit scam
Part 2: https://issuu.com/mctplus/docs/mct exit scam 2
Part 3: https://issuu com/mctplus/docs/mct exit scam 3
Part 4: https://issuu com/mctplus/docs/mct exit scam 4
Investigation conducted by tax79
Version: 2021-01-04
Link to the original file: https://drive google com/open?id=106rsZiOJDNpaeHNI C3SjwS3tA1JZQ1gU2dGXRf0SBg
Contact me via Telegram: https://t me/tax79
Join the “MCT+ Exit Scam” channel: https://t me/MCTPlus
1
Table of contents PART III Information to be checked by the authorities 3 Domain name 3 IPaddresses 3 MCT+ explainer video 5 Vacation in Mallorca 6 Fingerprint 7 NordVPN 8 Agreement with WOLF 8 PART IV. Social connections 11 Social connections of the MCT+ founders 11 Autohaus Dosenberger 15 PART V Additional information 19 MCT+ Founders 19 Additional evidence thatAndrew[MCT+] isAndreas Kaltenhuber 22 Carina Fontan’s phrases 28 Vacation in Mallorca 30 Final thanks 34 2
PARTIII. Information to be checked by the authorities
Domain name
The mct plus domain was registered on 20 May 2018
The domain registrar is NameCheap
In order to find out in whose name the domain was initially registered in 2018 the authorities have to make a request to NameCheap
It is quite possible that the registrant provided false information about himself to the registrar as it is an often practice. That’s why the authorities also have to get information from the registrar about who was paying for the service Because it is quite simple to falsify the whois data but it is impossible to falsify your bank account
IPaddresses
Initially there were three IP addresses which the MCT+ founders recommended to put in the “mct.conf” file: addnode=138.201.90.61 addnode=159.69.10.186 addnode=95.216.149.253
They were needed to synchronize a wallet with the MCT blockchain
The following screenshot was taken on 06 December 2018 during beta testing of the new POS wallet (only the founders and moderators had access to this new POS wallet at that time) As we can see, only one node is available And it is one of the IP addresses mentioned above.
I
3
So we can say for sure that this IP address was under Andrew[MCT+]’s control from May until, at least, December 2018
All the IP addresses above belong to Hetzner hosting provider
II
The following IP addresses were being used by MCT+ from the beginning until the exit scam:
mct.plus historical A data
trade.mct.plus historical A data
explorer.mct.plus historical A data
t.mct.plus historical A data
IPAddresses Organization First Seen Last Seen Duration Seen 95 216 156 99 Hetzner Online GmbH 2018-07-10 2019-07-03 11 months 159 69 43 55 Hetzner Online GmbH 2018-07-09 2018-07-10 1 day 185 61 152 36 Namecheap, Inc 2018-05-21 2018-07-09 1 month https://securitytrails com/domain/mct plus/history/a
IPAddresses Organization First Seen Last Seen Duration Seen 192 124 249 61 Sucuri 2019-02-19 2019-09-30 7 months 95 216 146 60 Hetzner Online GmbH 2018-10-27 2019-02-19 3 months https://securitytrails com/domain/trade mct plus/history/a
IPAddresses Organization First Seen Last Seen Duration Seen 195 201 97 70 Hetzner Online GmbH 2019-01-02 2019-09-30 9 months https://securitytrails com/domain/explorer mct plus/history/a
IPAddresses Organization First Seen Last Seen Duration Seen 4
seeds.mct.plus historical A data
https://securitytrails com/domain/seeds mct plus/history/a
www.mct.plus historical A data
mail.mct.plus historical A data
As we see, most IP addresses being used by MCT+ belong to Hetzner hosting provider
In February 2019 there was a DDOS attack on the MCT+ site, that’s why Andrew[MCT+] was also paying for the antiDDOS protection service provided by Sucuri.
The authorities have to get information from the service providers mentioned above about who was paying for their service
MCT+ explainer video
MCT+ ordered an explainer video at some advertising agency called “Coco Video Production”, they are “Rabbit And Carrot” as well:
https://youtu.be/mrxOGNbDPvA
Their contacts:
https://www.facebook.com/cocovideoproduction
https://www.facebook.com/rabbitandcarrotuae
https://cocovideoproduction.com
https://www.rabbitandcarrot.com
They have different contact addresses in such countries as Canada, UAE and USA, but all their employees and, most likely, the founders themselves are from Pakistan
On their sites there is information that they accept Visa and Mastercard payments
So the authorities have to make a request to “Coco Video Production” (“Rabbit And Carrot”) in order to get information about who ordered the MCT+ explainer video and who paid for it
In the screenshot below we can even see that Facebook determined connection between “PushPanda” and “Coco Video Production”:
159 69 151 131
Online GmbH 2019-01-03 2019-09-30 9 months
Hetzner
mct
https://securitytrails com/domain/t
plus/history/a
Organization First Seen Last Seen Duration Seen 195 201 97 70 159 69 10 186 Hetzner Online GmbH 2019-06-13 2019-09-30 3 months
IPAddresses
IPAddresses Organization First Seen Last Seen Duration Seen 95 216 156 99 Hetzner Online GmbH 2018-07-10 2019-10-25 1 year 159 69 43 55 Hetzner Online GmbH 2018-07-09 2018-07-10 1 day 185 61 152 36 Namecheap, Inc 2018-05-21 2018-07-09 1 month
https://securitytrails com/domain/www mct plus/history/a
Organization First Seen Last Seen Duration Seen 159 69 10 186 Hetzner Online GmbH 2019-03-26 2019-09-30 6 months
com/domain/mail mct plus/history/a
IPAddresses
https://securitytrails
5
https://www facebook com/pushpanda io/ (screenshot taken on 27 May 2020)
Same we see on the “Hotel Grauer Bär” FB page:
https://www facebook com/grauerbaer innsbruckhotels (screenshot taken on 28 May 2020)
As we see, “PushPanda” and “Hotel Grauer Bär” have the same administrator - Carina Fontan
Vacation in Mallorca
On 06 August 2018 Andrew[MCT+] posted several photos of his vacation in Mallorca in the MCT+ Discord chat:
https://cdn.discordapp.com/attachments/448785954682175489/476022907714273281/IMG_20180806_073619.jpg
https://cdn.discordapp.com/attachments/448785954682175489/476025085250109441/20180806_093012.jpg
https://drive.google.com/file/d/1HiYK7Er_Fui3KrJYrQNTLuL3QdXl6wok/view?usp=sharing (not original link)
If we zoom in the last photo we can read the name of the hotel Andrew[MCT+] and Mari[MCT+] were staying at:
6
“Universal Hotel Cabo Blanco”, Colonia de Sant Jordi, Mallorca, Spain
The authorities have to make a request to “Universal Hotel Cabo Blanco” in order to find out whether Andreas Kaltenhuber and Carina (Karin) Fontan were staying at this hotel in the first half of August 2018
Note:
More info about their vacation in Mallorca can be found in the following chapter: Vacation in Mallorca
Fingerprint
On 13 July 2018 Andrew[MCT+] posted the following photo in the MCT+ Discord chat:
The original file is still available on the Discord server: https://cdn.discordapp.com/attachments/448785954682175489/467354607954427904/IMG_20180713_173638.jpg
If we zoom in the photo we will be able to see a clear fingerprint on the glass:
Most
7
likely, this fingerprint belongs to Andreas Kaltenhuber
The authorities can conduct a fingerprint examination of Andreas Kaltenhuber in order to find out whom the fingerprint above belongs to
NordVPN
As we can see from the screenshots below, Simon[MCT+] was using the NordVPN service in order to hide his real IP address:
Agreement with WOLF
On 14 January 2019 the WOLF coin was listed on the MCT+ Platform:
https://bitcointalk org/index php?topic=4315891 msg49232076#msg49232076
The WOLF team was not happy about that as it was ruining their Presale.
That’s why in February 2019 there was an agreement reached between MCT+ and the WOLF team about not trading their coin on the Platform during the Presale period
According to this agreement WOLF was paying 0 2 BTC per week to MCT+ In total WOLF transferred 2.2 BTC to Andrew[MCT+]’s private wallet from 24 February until 08 May 2019: https://bitinfocharts.com/bitcoin/address/33cK1BeRb4Ho4HXLbjuN2w7ZgCvJNQwQ8M
Before reaching the agreement there had been a DDOS attack on the MCT+ site from 14 February until 19 February 2019
That’s why after this Andrew[MCT+] started using the Sucuri antiDDOS protection.
The initiator of the DDOS attack with a very high probability was the WOLF team As it was only them who had resources to pay 500 USD per day to the Botnet owner:
https://bitinfocharts.com/bitcoin/address/1PJe7tiCNnYQddxGbZF8MxYa8PhBkMwLVk (WOLF’s BTC address)
The authorities can make a request to NordVPN about someone under the name of Simon Hibbert, a UK citizen.
8
In several days after the DDOS attack it was announced about partnership between WOLF and MCT+:
Note:
The WOLF team is not anonymous Their identities can be found in their old Whitepaper: WOLF's whitepaper pdf
On 23 May 2019 Simon[MCT+] mentioned about the agreement with WOLF in his announcement:
https://i imgur com/hSrga4J png (click to enlarge)
Right after the exit scam Simon[MCT+] reached me in order to find out what information I had got on Andrew[MCT+] and among other things he confesses how much the WOLF team was paying to Andrew[MCT+]:
ID 545390151975567361
ID 543931247056125962
9
In another Discord server Simon[MCT+] was writing the following:
As we can see, he denies that the agreement was connected with the DDOS attack. But it is quite possible that it was part of their deal
Here Simon[MCT+] is telling about a potential action against MCT+ including a lawsuit after the Incident on 14 May 2019:
https://i imgur com/XdL6XJM png (click to enlarge)
If he is talking about a lawsuit it means that some projects which coins were stolen during the Incident were aware of the MCT+ founders’ identities. And WOLF is the main candidate for that as there was a financial agreement between WOLF and MCT+
I asked the WOLF team about their relations with MCT+ via Discord and email but they did not respond. That’s why the authorities have to ask the same questions to the WOLF team officials as part of a criminal investigation
10
PARTIV. Social connections
Social connections of the MCT+ founders
As we see, Andreas Kaltenhuber and Carina Fontan have very strong connections in politics, media and business in Austria All their surroundings are very wealthy people and occupy significant positions in society
For example, two of his closest friends are in TOP 500 of the richest families of Tyrol:
https://issuu com/zielgruppenverlag at/docs/ranking top tirol 2002
Here we see how Andreas Kaltenhuber is having fun with a multimillionaire Peter Paul Mölk and his wife Sanela Mölk Bajo
11
https://www instagram com/p/BYB69nNnnID/
https://sscsc at
In the photo below we see Andreas Kaltenhuber with his previous wife Olivia Kornherr (sitting near him) in the company of Innsbruck millionaires and their wives:
12
Here is the Kaltenhuber family with the governor of Upper Austria Josef Pühringer:
Johanna, Andreas, Waltraud, Heinrich, Silvia Kaltenhuber
http://www2 land-oberoesterreich gv at/internetfoto/ViewDocument jsp?id=156382&mandantId=3
Carina Fontan in her previous life before Andreas Kaltenhuber also did not lose time in vain:
https://issuu com/magazinring/docs/september neu/210
Carina Fontan’s elder daughter, Marie-Therese Granbichler, probably with the help of Andreas Kaltenhuber’s mother, Waltraud Kaltenhuber, was even trying to be elected from the major Austrian party ÖVP:
13
In contrast to the above, let’s read the comments below:
https://i imgur com/KDOv3o4 png (click to enlarge)
https://i imgur com/S4PlZ8c png (click to enlarge)
https://i imgur com/XV4ehdZ png (click to enlarge)
Now scroll up and look at all the photos in the current chapter again.
14
Autohaus Dosenberger
Andreas Kaltenhuber has been working at Autohaus Dosenberger where his closest friend, Emanuel Jahn, is one of the directors.
All the Dosenberger executives including Emanuel Jahn have been informed many times with all the evidence that their employee, Andreas Kaltenhuber, was involved in criminal activities and several thousand people suffered from him
Nevertheless, Andreas Kaltenhuber is still Dosenberger’s employee and it is even highlighted in the local Tyrolian press
The article below published in September 2020:
https://issuu com/magazinring/docs/2010 t magazin gesamt issuu/180
Moreover, instead of firing an unreliable employee with a dubious reputation, they started hiding on the Internet themselves
So Emanuel Jahn first make his Instagram account private and then changed his Instagram account name:
15
https://www.instagram.com/emanueljahn81/
Also he deleted himself from Facebook: https://www.facebook.com/emanuel.jahn.73 (deleted)
https://www.instagram.com/instajahn1/
In October 2020 Dosenberger decided to delete its FB page with more than six thousand followers and create a new one The reason why they decided to do so is obvious - you can see it in the screenshot below:
https://www facebook com/autohaus dosenberger/ (screenshot taken on 20 March 2020)
Here is its new FB page:
16
https://www facebook com/dosenberger (screenshot taken on 31 December 2020)
Thus, it turned out that the link to the MCT+ FB page In the “Related pages” section was more significant than the loss of six thousand followers and a long history on Facebook
Same happened with the Dosenberger Instagram account They deleted their account with a long history:
And created a new one:
https://www instagram com/dosenberger/ (screenshot taken on 25 November 2019)
17
There was no reason to do that with their Instagram account as there were no links to MCT+ but as we know fear stokes the imagination
So now we know for sure that Dosenberger is ready to put itself, its clients and their private information at risk in order to keep criminal elements on its staff
instagram com/autohausdosenberger/ (screenshot taken on 31 December 2020)
https://www
18
MCT+ Founders
All information below was taken from open sources using Google and social networks:
Nickname:
Andrew [MCT+]
Mari [MCT+]
Name:
Andreas Kaltenhuber (14 03 1977)
Address:
Richard-Wagner-Straße 9/Tür 2 6020 Innsbruck,Austria
Phone number:
Carina
(07 09 1971)
+43 676 844311100
https://wwwfacebook com/kaltenhuber https://wwwinstagram com/andreaskibk/ https://twittercom/akaltenhuber
Social accounts:
+43 664 4373866
https://wwwfacebook com/carina fontan 1 https://wwwinstagram com/fontanella007/ https://twittercom/MrsFontan
Business:
Project K GmbH (https://www firmenabc at/project-k-gmbh OWNo)
Address:
Richard-Wagner-Straße 9 6020 Innsbruck,Austria
Site:
https://wwwpushpanda io Social accounts: https://wwwfacebook com/pushpanda io https://wwwinstagram com/pushpanda io/ https://twittercom/pushpanda io
factoryEC Andreas Kaltenhuber e U (https://www firmenabc at/factoryec-andreas-kaltenhuber-e-u Mcwk)
Address: Schwarzstraße 39 4040 Linz,Austria
https://at linkedin com/in/andreas-kaltenhuber-806812175
Resume:
Current job:
https://at linkedin com/in/carina-fontan-8a617473
PARTV.Additional information
(Karin) Fontan
CTO Public Relations Manager 19
Autohaus Dosenberger
Site: https://wwwdosenbergercom
https://wwwopel-dosenbergercom
Social accounts:
https://wwwfacebook com/dosenberger
https://wwwinstagram com/autohausdosenberger/
Hotel Grauer Bär
Site:
https://wwwgrauer-baerat
Social accounts:
https://wwwfacebook com/grauerbaerinnsbruckhotels
https://wwwinstagram com/hotel grauerbaer/ Gästehaus Hoch-Tirol
Site:
https://wwwhoch-tirol info
Social accounts:
https://wwwfacebook com/Gästehaus-Hoch-Tirol-112840338733344/ https://wwwinstagram com/hochtirol tux
Woodfire
Site: https://woodfire at
Social accounts:
https://wwwfacebook com/WoodfireSteakhouse/
Children:
Konstantin Kaltenhuber (02 02 2017)
Marie-Therese Granbichler (13 01 1993)
Social accounts:
https://wwwfacebook com/mt granbichler
https://wwwinstagram com/resiiimar/ https://twittercom/theresagra
https://wwwlinkedin com/in/marie-therese-granbichler-2647729a/ Julia Granbichler (23 02 1994)
Social accounts:
https://wwwfacebook com/julia gbichler
https://wwwinstagram com/juls gran/ https://wwwlinkedin com/in/julia-granbichler
Parents:
Heinrich (Heinz) Kaltenhuber (01 11 1948)
Address: Schwarzstraße 39 4040 Linz,Austria
Lions Club Site: https://wwwlions at Waltraud Kaltenhuber (24 12 1950)
Address: Schwarzstraße 39 4040 Linz,Austria
Site:
https://wwwlinzwiki at/wiki/Waltraud Kaltenhuber/ https://wwwlinz at/politik/gemeinderat 22521 php
Social accounts:
https://wwwfacebook com/people/Waltraud-Kaltenhuber/100008353030305
Ex-spouse:
Anneliese Kranebitter
Address: Vorderlanersbach 55, 6293Tux,Austria
Site:
https://wwwhoch-tirol info/
Olivia Kornherr
Social accounts:
https://wwwfacebook com/stellaoliviasunshine
https://wwwinstagram com/stellagemelaibk/ https://wwwlinkedin com/in/olivia-kornherr-68880516b
Martin Granbichler
Site:
https://wwwtyroltourat/datenschutzerklaerung
Social accounts: https://wwwfacebook com/martin granbichler https://wwwinstagram com/martingranbichler/
20
Johanna Schmoll Sister
Social accounts:
https://wwwfacebook com/johanna schmoll 79
Silvia Kaltenhuber Sister
Social accounts:
https://wwwfacebook com/silvia kaltenhuber
Other relatives:
Gerhard Fontan
Site:
https://wwwregionalmedien at/mitarbeiter/gerhard-fontan/
Social accounts: https://twittercom/GerhardFontan
Sieglinde Kranebitter Sister
Social accounts:
https://wwwfacebook com/sieglinde kranebitter1 https://wwwinstagram com/sieglinde k/
Simone Obersteiner Sister
Site: https://wwwkashuette com/
Social accounts:
https://wwwfacebook com/simone obersteiner https://wwwinstagram com/simone obersteiner/
Hobbies:
SSCSC Club
Site: http://wwwsscsc at Social accounts: https://wwwfacebook com/SSCSC
Golfclub Innsbruck-Igls
Site: https://wwwgolfclub-innsbruck-igls at
Coworking office Raum13
Site: https://wwwraum13 at Social accounts: https://wwwfacebook com/Raum13 Coworking https://wwwinstagram com/raum13coworking/
Andreas Kaltenhuber's Instagram
Other Info:
Some social accounts above were changed or deleted. Here are some “backup” copies:
https://wwwyoutube com/watch?v=FPwr7bLCuy4
Vacation in Malta (July 2019)
https://wwwyoutube com/watch?v=NaE0US nc0Q
Andreas Kaltenhuber's and Carina Fontan's Facebook https://wwwyoutube com/watch?v=vtU4yzfPsB0
Andreas Kaltenhuber's and Carina Fontan's Facebook (featured photos)
https://wwwyoutube com/watch?v=zkDZNPtSV3g
Marie-Therese Granbichler's Instagram
https://wwwyoutube com/watch?v=u5rWH64tssU
Julia Granbichler's Instagram
https://wwwyoutube com/watch?v=FXs0JdVRz6M
21
Additional evidence thatAndrew[MCT+] isAndreas Kaltenhuber
On 05 May 2019 Andrew[MCT+] posted the following photo of his dogs in the team channel:
https://cdn discordapp com/attachments/486622961563074578/574689673910288384/unknown png
The same type of golf carts we can find at the Golfclub Innsbruck-Igls:
I
22
https://www youtube com/watch?v=aHFWGxUHCMY
Andreas Kaltenhuber has been a member of the Golfclub Innsbruck-Igls for a long time:
https://www facebook com/SSCSC/photos/a
Simon[MCT+] confirms that Andrew[MCT+] has dogs:
306565629418087/306567046084612/
23
In the screenshot below you can see the “Ristorante Rosengarten” FB page. Andreas Kaltenhuber left several likes on this page:
II
24
https://www facebook com/Ristorante-Rosengarten-Isola-d-Ischia-189996007755176/
And Andrew[MCT+] confirmed that he knew this restaurant:
Simon[MCT+] confirms that Andrew[MCT+]’s real surname is Kaltenhuber:
III.
25
And he is from Austria:
IV.
Andreas Kaltenhuber wears the same type of glasses that we can see on the screen of Andrew[MCT+]’s computer
The original photo Andrew[MCT+] posted in the MCT+ Discord chat:
On the right part of the screen we can see the MCT+ Discord chat is open:
27
Carina Fontan’s phrases
She calledAndrew[MCT+] by his real name:
What she does:
Where the MCT+ founders are from:
28
The weather in Innsbruck on that day: Other: 29
Vacation
https://www instagram com/p/Bl54Utrhil / 01 08 2018 - Vienna,Austria
https://www instagram com/p/Bl8M6P6HSPy/ 02 08 2018 - Vienna,Austria
in Mallorca 31 07 2018 - Vienna,Austria
30
https://www facebook com/MCT-Plus-208985143115006/
03 08 2018 - Ibiza, Spain 31
- Mallorca, Spain (Universal Hotel Cabo Blanco - Colonia de Sant Jordi)
com/p/BmBUjMenb14/ 06 08 2018
08 2018 - Mallorca, Spain 12 08 2018 - Mallorca, Spain 32
https://www instagram
11
https://www instagram com/p/BmZLzeIBMEw/
13 08 2018 - Blindsee,Austria
15 08 2018 - Innsbruck,Austria 33
Final thanks
https://i imgur com/6FE8bJe png (click to enlarge)
-----
Contact me via Telegram: https://t me/tax79
Join the “MCT+ Exit Scam” channel: https://t me/MCTPlus
If my investigation helped you somehow - my BTC address for donations: 3PL9qo8LDRjjF4jC3UyMarjuBx9FgGVtqX
Additional materials:
Full MCT blockchain and cli wallet for Ubuntu 18.04 mct.tar.gz
Other parts
Part 1: https://issuu com/mctplus/docs/mct 2b exit scam
Part 2: https://issuu com/mctplus/docs/mct exit scam 2
Part 3: https://issuu.com/mctplus/docs/mct exit scam 3
Part 4: https://issuu com/mctplus/docs/mct exit scam 4 (current)
34