Case Study

In accordance with the contract signed between American Public University System (APUS) and JLA Enterprise, APUS conducted secondary analysis on report findings provided by Dr. Kevin Malone titled “Attempted 10/15/2019 Fraud against JLA Enterprise Examination Report” along with all necessary evidence associated with that analysis. APUS’s findings are in section three and provided in chronological order predicated on Coordinated Universal Time (UTC), all other times will be identified appropriately. APUS’s investigation is designed to provide nonbiased additional analysis of Dr. Malone’s initial conclusion.

The following APUS team members were assigned to conduct the secondary analysis on the report findings provided by Dr. Kevin Malone:

Over a 48-hour period between October 15 - 17, 2019, Michael SCOTT (Managing Partner, DSS Venture Partners LTD and former consultant to JLA Enterprise) attempted to extort $2.3M USD via wire transfer to a bank in East Hun Chiu from JLA Enterprise using a sophisticated phishing scam. SCOTT crafted 15 emails, created a counterfeit JLAENTREPRISE.COM domain, and five counterfeit email accounts with the purpose of building reputability to attempt to defraud JLA Enterprise. SCOTT fabricated email responses to ensure the individuals in the email chain would believe HE was not involved. On October 17, 2019, at 0237 hours, JLA Enterprise personnel identified the counterfeit domain triggering an internal investigation and seeking external professional assistance.

The table below is designed to provide a quick view of all the identified findings Each link will take you to the section with a detailed report of the findings.

On October 15, 2019, at 1938 hours, Michael SCOTT (Managing Partner, DSS Venture Partners LTD and former consultant to Flow Pharma) accidentally sent an email to Jim Halpert (General Manager, JLA Enterprise) at [email protected] to confirm JE (Forensic Comment: APUS believes JE stands for JLA Enterprise) requested $2.3M USD from an East Hun Chiu based company, who was investing in JLA Enterprise research through Dwight Schrute (former subcontractor to DSS Venture Partners LTD and current Business Partner and Investor in JLA Enterprise). The money was to be transferred to JLA Enterprise’s EHC (Forensic Comment: APUS believes EHC stands for East Hun Chiu) trading account upon closing. SCOTT requested the wire instructions and said HE would forward them to HIS business partner Dwight Schrute.

Analyzing the raw email message information, APUS determined the email was auto-forwarded by Halpert’s jlaenterprise.com email account to [email protected] (Halpert’s personal email account) The email message originated (“x-originating-ip” located in the raw email header) from 2601:98a:100:57b:206f:26a1:323a:fb5c, a Scranton, PA, USA, Comcast Internet Protocol Version 6 (IPv6) address (Figure 2 and 3).

On October 15, 2019, at 1947 hours, SCOTT identified HIS mistake and replied to HIS original email at 1938 hours to explain HE wrote Jim Halpert in error. Within the email, HE mentioned that Dwight Schrute wrote to SCOTT and the account is being set up to wire to JD (Forensic Comment: APUS believes JD is a typo for JE for JLA Enterprise). Analyzing the raw email message information, the email was delivered to [email protected] (Figure 4). The message originated (“x-originating-ip” located in the raw email header) from 83.110.250.231, an Emirates Telecommunications Corporation, United Arab Emirates (Figure 5 and 6).

The timestamp on the message in Figure 4 is Tuesday, October 16, 2019, 3:38:14 AM, indicated that SCOTT’s local client is operating in the +0800 (UTC+8) time zone, which corresponds with East Hun Chiu local time and HIS signature block location. SCOTT sent the message to cover up the mistake made in Email 1. In this second message, SCOTT changed HIS IP address, which indicates a VPN or Proxy; however, Figure 5 below reported the IP was not a proxy or VPN.

On October 15, 2019, at 2054 hours, the counterfeit domain JLAENTREPRISE.COM (Forensic Comment: Switching the er to re) was registered and set up to use Microsoft Office 365/online Outlook mail according to an MX (Mail eXchange) query that shows JLAENTREPRISE.COM was registered as “jlaentreprise-com.mail.protection.outlook.com.” It is very significant since Outlook 365 includes “x-originating-ip” headers on all sent messages, which include the IP address sending the messages.

According to WHOIS (Figure 9), the jlaentreprise.com domain was registered with GoDaddy.com, LLC and a creation date of October 15, 2019 at 2054 hours. Figure 10 displays the geographical location as Scottsdale, AZ, coinciding with GoDaddy.com, LLC headquarters.

(Forensic Comment: Due to size of email, it has been split into two images, Figure 12 and 13).

On October 16, 2019, at 0653 hours, SCOTT sent an email from HIS counterfeit Jim Halpert account to Dwight Schrute and Pam Beesly (Forensic Comment: APUS confirmed in later emails that [email protected] belongs to Pam Beesly). SCOTT included on carbon copy HIS email ([email protected]) and the counterfeit email addresses for Andy Bernard ([email protected]) and Jim Halpert ([email protected]). In the email, Jim Halpert (Forensic Comment: APUS believes SCOTT wrote this email) told Dwight he discussed with Michael SCOTT, that JE (Forensic Comment: APUS believes JE to be JLA Enterprise) will need the $2.3M USD transferred to a trading account in EHC (Forensic Comment: APUS believes EHC to be East Hun Chiu) bank and attached the wiring instructions (Appendix A).

The message originated (“x-originating-ip” located in the raw email header) from 23.239.21.243, Hosting Services, Inc, located in Fremont, CA, which is confirmed as a VPN as shown in Figure 14 and 15. This is the first attempt by SCOTT to use a VPN. Since SCOTT used several different emails, the VPN showed a different location than when HE emailed directly from [email protected].

Figure 16 - Email 4 - Jim Halpert (Counterfeit Account) to Dwight Schrute (Phishing Attempt)

On October 17, 2019, at 1123 hours, SCOTT sent an email response from HIS counterfeit Jim Halpert account to SCOTT’s and Dwight Schrute’s legitimate email accounts, while sending a carbon copy to the counterfeit Jim Halpert email address ([email protected]). SCOTT’s original email sent at 0534 hours (Figure 19), questioned if the BR# (Forensic Comment: APUS believes BR# is bank routing number) was in place and if the transfer would be completed on Friday or Monday when the bank is open. SCOTT’s fraudulent response thanked HIMSELF and asked if the transfer of $2.3M USD would come in a one-time transfer since they had waited a long time for the money.

The message originated (“x-originating-ip” located in the raw email header and Figure 17) from 83.110.250.20, an Emirates Telecommunications Corporation, United Arab Emirates (Figure 18). The email chain in Figure 19 further confirmed SCOTT created both counterfeit Jim Halpert accounts ([email protected] and [email protected]).

On October 17, 2019, at 1209 hours, SCOTT sent another counterfeit email, however this time posing as Dwight Schrute ([email protected]) with the goal of establishing further legitimacy for the wire transfer (Forensic Comment: SCOTT’s first email using the counterfeit Dwight Schrute email account). In the email, SCOTT (as Dwight Schrute) asked Dr. Jim (Forensic Comment: APUS believes this to be Jim Halpert) to be the contact person with Prof. Kapoor (Vice-chancellor, East Hun Chiu University Medical School) (Forensic Comment: SCOTT is using this part of the email message to establish HE is Dwight Schrute and knows a project that JLA Enterprise is working). In the second part of the email, SCOTT stated his (Dwight Schrute’s) company now runs the East Hun Chiu investor, since the DSS contract with JLA Enterprise had already expired. The message originated (“x-originating-ip” located in the raw email header and Figure 20) from 192.155.90.47, a Microsoft Corporation, an outbound outlook mail server in Newark, NJ (Figure 21).

On October 17, 2019, at 1337 hours, SCOTT sent another counterfeit email, however this time posing as Andy Bernard ([email protected]) addressed to Dwight Schrute’s and Pam Beesly’s legitimate email accounts while sending a carbon copy to the counterfeit Jim Halpert email address ([email protected]). Andy Bernard (Forensic Comment: The email account is controlled by SCOTT) stated HE (as Andy Bernard) would read all the emails again and provide an answer later that day. However, HE (as Andy Bernard) asked Dwight Schrute to acknowledge the new wiring instructions as confirmed by Dr. Jim (Forensic Comment: APUS believes this to be Jim Halpert). Andy Bernard asked Dwight Schrute to work directly with him on the project. The message originated (“x-originating-ip” located in the raw email header and Figure 26) 83.110.250.20. The same IPv4 address used during section 3.7 Email 5: Sabre Project - October 17, 2019 - 1123 hours and section 3.9 Email 7: Sabre Project - October 17, 2019 - 1325 hours. The IPv4 address is now associated with SCOTT, Jim Halpert’s counterfeit email account and Andy Bernard’s counterfeit email account.

On October 17, 2019, at 1431 hours, SCOTT sent a second email to Andy Bernard from HIS counterfeit Dwight Schrute with hopes of Andy Bernard approving the wire transfer to Dwight Schrute. SCOTT’s fraudulent email stated that SCOTT was becoming a nuisance by emailing and texting via WhatsApp 2 to 3 times a day asking for the progress of the money transfer. SCOTT was attempting to convince Andy Bernard that he (Dwight Schrute) would still pay SCOTT even though on past contracts, HE did not perform appropriately by Dwight Schrute. SCOTT as Dwight Schrute even offered to call the government office to help move along the $2.3M USD money transfer.

On October 17, 2019 at 1443 hours, SCOTT sent an email from HIS counterfeit Dwight Schrute email account to Andy Bernard’s legitimate email account and HIS counterfeit Jim Halpert and Pam Beesly email accounts. SCOTT’s fraudulent email as Dwight Schrute attempted to make Andy Bernard believe he (Dwight Schrute) spoke with SCOTT and confirmed the East Hun Chiu account was available for JLA Enterprise to transfer the money. The message originated (“x-originating-ip” located in the raw email header and Figure 29) 173.230.128.135, a Microsoft Corporation mail server, Atlanta, GA (Figure 30).

On October 17, 2019 at 1459 hours, SCOTT included an email chain (Wiring Instruction) with confirmation on the wire instructions from Andy Bernard and Pam Beesly. At the beginning of the email chain (Figure 38), SCOTT included Andy Bernard’s response confirming the wire instructions from an email discussion between 1445 hours and 1455 hours. The next two emails in the chain (Figure 37 and 38), Dwight Schrute wrote to Pam Beesly explaining that JLA Enterprise would like the wire transfer to go to the East Hun Chiu account (Appendix A) and not the Wells Fargo account. Pam Beesly replied expressing that if the company is not blacklisted the transfer to the East Hun Chiu account should be fine. Pam went on to explain the necessary information needed regarding contract paperwork and banking information to make the transfer possible.

In the last part of the email chain (Figure 37), SCOTT included an email from HIS counterfeit Pam Beesly email account to Andy Bernard mentioning the wire transfer to the East Hun Chiu account was not good to go, to keep with the original wire transfer and HE (as Pam Beesly) would update if there was more information. The final email (Figure 37), SCOTT emailed HIS counterfeit Pam Beesly email account and carbon copied the real Andy Bernard email account using HIS counterfeit Dwight Schrute email account. In this email, as Dwight Schrute, SCOTT told Andy Bernard they will be sending the wire to HIS (as Dwight Schrute) account as confirmed. The message originated (“x-originating-ip” located in the raw email header and Figure 35) 45.33.17.101, another Microsoft Corporation mail server in Dallas, TX, (Figure 36).

On October 19, 2019 at 1202 hours, SCOTT sent an email from HIS counterfeit Jim Halpert email account to Dwight Schrute and Pam Beesly and carbon copied HIS counterfeit Andy Bernard email account. In the email, SCOTT (as Jim Halpert) asked Pam and Dwight if the money transfer of $2.3M USD was still on track and if they had the BR# (Forensic Comment: APUS believes BR# is bank routing number)(Appendix A) to complete the transaction. HE later asked once the contract and instructions were provided, would the wire transfer for $2.3MM be good to go. At the end of the email, HE asked for them to confirm immediately. The message originated (“x-originating-ip” located in the raw email header and Figure 44) from 83.110.250.232, an Emirates Telecommunications Corporation, United Arab Emirates (Figure 45), an IP address that is considered low risk and not a VPN (Figure 46).

On June 01, 2019, at 0710 hours, SCOTT sent an email to Andy Bernard from an IPv6 address (2601:98a:100:57b:206f:26a1:323a:fb5c), showing Scranton, PA, a location used to send emails in section 3.2 Email 1: Sabre Project - October 15, 2019 - 1938 hours and section 3.5 Email 3: Sabre Project - October 15, 2019 - 2258 hours.

On August 02, 2019, at 1808 hours, SCOTT sent an email to Andy Bernard that had an IP address of 23.239.21.243 (a mail server) located in Fremont, CA with an IPv6 address (2601:98a:100:57b:206f:26a1:323a:fb5c), showing Scranton, PA, a location used to send emails in section 3.2 Email 1: Sabre Project - October 15, 2019 - 1938 hours and section 3.5 Email 3: Sabre Project - October 15, 2019 - 2258 hours.

APUS concurs with Dr. Kevin Malone's recommendations as outlined below:

1. A 2-factor approach be established in advance to handle any transfer of funds. Use at least 2-communication channels (Phone, E-mail, Text Messages, Secure Chat).

2. Use Corporate e-mail addresses only.

3. Leveraging secure messaging technology, such as Signal and Wire, when available.

If needed, this APUS forensic report is written with the intent of being referred to potential law enforcement agencies for further investigation.

1 | Page

21 | Page