TL;DR, Josh's IP range sits inside of a larger IP range that belongs to Flow Chemical, a Shell company situated in Australia with ties to Russian intelligence agencies and cybercrime. Beneath this company are many smaller shell companies.
I am not the one who conducted this research. I do not understand the terminology. As such this is disorganized and I'm not qualified to give my own personal thoughts on it. All of the information contained within this post has been derived from the Flow Chemical PDF presented on the Onionfarms Discord and research into its existence.
Quick rundown:
- Josh uses Moscow time to refer to his local time. His location.
- Fancy Bear joining KF coincides with Josh moving to parts unknown. "East Europe".
- Flow Chemical is listed as a contact location for Fancy Bear at the website "hungrybear.cooking". This site is down.
- Josh's IP range sits inside of the Flow Chemical IP range. (See below statement on the IP ranges of Josh and Flow)
- Flow Chemical is operating out of a normal residential apartment. Not a commercial building.
- Vincent Zhen, a main figure of Flow Chemical, has no online existence and may very well not exist at all. Online documentation points to him being involved with Flow Chemical for over 10 years, additional history pointing to him working with a related entity 5 years even before this.
- Flow Chemical is related to a numerous amount of entities. It is listed a a contact for dozens of "companies" that based on first impressions are very likely shells.
- The poster of the Flow Chemical evidence within our chat room claims that Flow Chemical is the location where Josh's large subscription-like donations are sent.
- Australian news has reported Russian spy correspondence at/near the location of Flow Chemical.
- Fancy Bear's site has been seized by the FBI for cybercriminal activity.
- Fancy Bear has publicly posted hacking successes on Kiwifarms in a boastful manner. Does this turn Kiwifarms into a site for organizing crime? Fancy Bear posts archived further below.
- Fancy Bear has apparently donated large sums of BTC to Josh via chat. (In the Thousands)
- Josh has been silent about finances for years. Even when a close friend of his was organizing multiple $100/mo subscribers for him, he refused to release internal billing information. He claims this is to "keep his enemies (Vordy) in the dark".
---
Doing some research on the IP ranges. flow chemical's /23 is "allocated portable", meaning they got it from APNIC themselves. Flow chemical's ip range is 103.114.190.0-103.114.191.255. Josh's ip range is 103.114.191.0-103.114.191.255. Josh's /24 is "allocated non-portable" meaning he must have been given it by an LIR.
https://www.apnic.net/manage-ip/using-whois/guide/inetnum/
---
On February 3rd a mysterious individual by the name of "Hotload911" had entered the official Onionfarms Discord server. Within the server they had posted strange information regarding Josh's 1776 hosting, Josh's connection to an Australian-based company by the name of "Flow Chemical", and other miscellaneous information.
First appearance:
(Josh's name change PDF can be found at the bottom of this post)
What exactly _is_ Flow Chemical?
https://wyobiz.wyo.gov/Business/Fil...127143077132130035027094038122174129088154221https://www.abuseipdb.com/whois/103.114.191.4https://www.aubiz.net/company/flow-chemical-pty-ltd-154040490/https://connectonline.asic.gov.au/R...Type=OrgAndBusNm&_adf.ctrl-state=8jpzfsju0_15Flow Chemical PDF may be found at the bottom of this post


Where did they get their information from?
This individual in the Discord claimed Flow Chemical is the location Josh's largest Donations are sent.
Based off of the Flow Chemical extract, we know that:
- Flow Chemical is based in a normal residential apartment.
- This apartment was bought for $380,000 in 2009
- The owner, a "Mr. Vincent Zhen" does not exist on White Pages or anywhere else on the internet.
- Mr. Zhen has a very odd, broken job title as "The OnSite Manager", somehow related to real estate.
- Flow chemical doesn't use 1776 hosting but some sites that keep track of IPs say that it used it at some point in time, it has a linode nameserver and IP. Kiwi Farms used to use linode.
- The company has existed for 10+ years based on ASIC filings. This costs substantial amounts of money to renew on a yearly basis.
https://www.reverseaustralia.com/lookup/0733711171/https://www.reverseaustralia.com/lookup/0733710463/https://www.reverseaustralia.com/lookup/0738708802/https://www.reverseaustralia.com/lookup/0433371741/All of these are on websites dedicated to recording numbers cold calls which are linked to the address, and one of the numbers was recorded to be owned by another dude with a Chinese sounding name in 2009 before the property sold, but another number linked to the address in 2005 has Vincent Zhen's name on it. This is weird.
Post Archive Links
---------
Information about Flow Chemical and its related Entities:
PO Box 16 Nobby beach at the gold coast is listed under flow's whois contact.
Listed as a contact for devpoint, possibly a software development firm?
http://www.devpoint.com.au/contact/ (
https://archive.is/9ghud)
And also a company called "each day is a gift", a gift basket company.
https://www.hotfrog.com.au/company/1072177009377280
https://archive.is/h2MrK
Listed as contact for "hungry bear"
Site is down but is archived.
http://web.archive.org/web/20200124222824/http://hungrybear.cooking/
NEWS REPORTS LINK THIS TO RUSSIAN CYBERSPOOKS
https://archive.is/20jp3There are some articles by The Australian but they're paywalled.
----
https://abr.business.gov.au/ABN/View?id=16604026557https://archive.is/wip/uXOq6Hungry Bear Cooking is using the Russian PO Box.
----
https://www.righttoknow.org.au/request/request_to_right_of_review_of_thhttps://archive.is/wip/VDNQ9----
A brumby 600 airplane is also registered under the address.
PO Box is also registered as contact for a company called sharepoint pro
https://www.sharepointpro.com.au https://archive.is/k5s4x
Listed as a contact address for a superfund (you americans would know it as a 401k) called V-B Fund
https://superfundlookup.gov.au/ABN/View?id=67258963250 https://archive.is/MvoqV
Listed under contact address for an essay writing service called "EssayMinds"
https://au.enrollbusiness.com/BusinessProfile/913037/EssayMinds-Nobby-Beach-QLD-4218 https://archive.is/vdl67
Listed as contact address for "hot snail"
https://www.zoominfo.com/c/hotsnail-blog/353527901https://archive.is/wip/MZMHf
Listed under contact for "shuttle digital"
https://archive.is/G7P6J----
PO Box 16 showed up in this excel spreadsheet on google.
Link was
https://www.google.com/url?url=http...ingbody.xlsx&usg=AOvVaw3TRxgyYGCaUqLg4D-1szDs
----
Listed as contact for "Luxe de Vie"
https://luxedevie.com/contactus.html https://archive.is/zXGPv
This too
https://archive.is/ZqLX8
Listed on contact page for a fake shopping site
https://www.vivadevine.com.au/pages/contact-us https://archive.is/AYAm6
Listed as a contact for something to do with buddhism
https://maitriyana.com/contact/ https://archive.is/dgkIp
Listed as contact for a mowing business
http://www.quickmow.com.au/contact.htm https://archive.is/sLL5b
Listed under ANOTHER superfund
https://superfundlookup.gov.au/ABN/View?id=97858032877 https://archive.is/s4u9x
A website here says that a death threat was sent via mail with the return address as the PO box:
http://www.anzmi.net/index.php/14-site
https://www.seabreeze.com.au/forums/Kitesurfing/General/Scam-kite-websites?page=2&groupID=1020https://archive.li/wip/iS5aLKitesurfing forum says a lot of scam equipment websites use the PO box.
----
This too:
http://www.innovote.com.au/https://archive.li/wip/qbIfC----
https://www.lawyersclubindia.com/forum/Lci-server-error-messages-61286.asphttps://archive.li/wip/6OlUqPO Box mentioned on an Indian lawyer forum.
----
http://ausmilitary.com/forums/viewtopic.php?f=11&t=3003&start=70https://archive.li/wip/0fELU
Take from this what you will.