Almost 800 Hungarian government email addresses and associated passwords are circulating online, revealing basic vulnerabilities in the security protocols of ministries involved in classified and sensitive work.

A Bellingcat analysis of breach data shows that 12 out of the government’s 13 ministries have been affected, which in some cases have exposed the confidential information of military personnel and civil servants posted abroad. 

Among those affected were a senior military officer responsible for information security, a counter terrorism coordinator in the foreign affairs department, and an employee whose role was to identify hybrid threats against the country.

The revelations come as Hungarians head to the polls this Sunday to decide if Viktor Orbán, leader of the right-wing populist party Fidesz and the country’s longest-serving prime minister, will be elected to a fifth consecutive term.

This is not the first time that deficiencies in the Hungarian government’s IT security have been revealed. In 2022, ahead of Hungary’s last election, Direkt36 reported that Russia’s intelligence services had gained access to the computer network of the Hungarian foreign ministry, including its internal communications channels.

It said Russian cyber attacks against the Hungarian government had been occurring for at least a decade and extended to the foreign ministry’s encrypted network for transmitting classified data and confidential diplomatic documents.

At the time, the foreign ministry denied it had been hacked. But in 2024, news outlet 444 published a letter that had been sent from Hungary’s National Security Service to the foreign ministry six months before the cyberattack was first reported. The letter linked the attacks to Russia and described more than 4,000 workstations and 930 servers as “unreliable”.

As part of this new analysis, Bellingcat identified a total of 795 unique email and password combinations among thousands of search results for Hungarian government domains in breach databases. Key departments that handle the country’s governance, defence, foreign affairs and finances were the worst affected.

The analysis does not include central government agencies that operate under the government’s official ministries and use separate domains, such as the tax and customs administration or the police – meaning breaches affecting government employees could be even more widespread.

The findings are not evidence of high-tech infiltration of Hungarian government systems. Instead, our analysis indicates that the breaches are more likely the result of poor digital hygiene. In many cases, staff used simple passwords along with their government email addresses for what appear to be non-work-related matters, such as signing up to dating, music, sport and food websites.

Some government workers used easy-to-guess passwords such as variations of the word “Password” or the number sequence “1234567”. One employee whose credentials were exposed in the 2012 LinkedIn hack used the password “linkedinlinkedin”. Another, in the defence ministry, used their surname. One leaked password from an employee in the foreign affairs ministry was “embassy13hungary”. 

Multiple breaches also contained phone numbers, addresses, dates of birth, usernames and IP addresses – data that, when exposed, could pose security risks.  

Additionally, a search of breach databases showed instances where computers have been infected with malware designed to steal login credentials. These records show that 97 machines across Hungarian government departments had been compromised, with stealer logs from as recently as last month found in the data.

Bellingcat contacted the Hungarian government’s spokesperson and the Prime Minister’s office, but did not receive a response.

The Weakest Link: Searching Breach Data

Breach databases are large collections of credentials harvested from previous cyber incidents. These databases can be searched by domain to identify email addresses belonging to a specific organisation, company or government. 

Bellingcat used Darkside, a paid service by District 4 Labs, to search the main email domains assigned to each of the Hungarian government’s 13 ministries. 

In total, 795 breaches containing government emails and associated passwords were identified. But most – 641 breaches – were linked to just four central institutions. 

In the examples detailed below, staff have been anonymised. However, Bellingcat has confirmed these accounts are genuine by cross-checking the employees named in the breaches against media reports and online profiles, such as LinkedIn.  

Ministry of Interior – this “super-ministry” oversees everything from health and education to the police, immigration, disaster management and local government 

Bellingcat identified 170 sets of emails and passwords linked to the domain used by the ministry in charge of domestic affairs. Passwords used by staff in this department included “Arsenal” and “Paprika”. Some used passwords that contained only three or four letters. We traced these accounts to professional profiles and government web pages listing both junior and senior staff.

One senior official in the prison service used the password “adolf”. After it appeared in breach databases the password was changed twice – first to a five-digit number and then to what appeared to be the name for a pet dog. The passwords were subsequently breached again. Bellingcat identified this employee through several instances of their name and email address being listed on public-facing documentation, including a press release celebrating an award for outstanding professional work.  

Ministry of Defence – responsible for national defence policy and directing the country’s defence forces

The credentials of staff working for the Ministry of Defence were found in 120 compromised records. This includes a 2023 breach of NATO’s eLearning services which resulted in 42 records containing emails, passwords and phone numbers becoming public.

The breaches peaked in 2021 but continued up to 2026. Included in the data were stealer logs, indicating that machines within the department may have been infected. 

Military personnel from junior ranks to command positions were identified. A Brigadier General used a common six letter nickname, based on his own, to sign up to a film festival. A Colonel specialising in “information security” took inspiration from an English football manager for his password: “FrankLampard”. A district director used the password “123456aA”, while a high-ranking member of Hungary’s delegation to NATO used a password that translates in English to “cute”. 

Ministry of Foreign Affairs and Trade – responsible for international relations, Hungarian embassies and consulates operate under the direction of the department

The credentials of current and former foreign affairs personnel have been exposed in dozens of data breaches from 2011 to February 2026. In total, there were 107 email and password combinations linked to this government ministry. 

Among the staff affected was a deputy head of mission, consuls, diplomats and communications personnel posted in Europe, the Americas and the Middle East. These include a counter terrorism coordinator, an EU spokesperson, and an individual whose role was to identify hybrid threats to Hungary.

Although the breaches peaked in 2020, with emails being found in 42 separate breaches indexed by Darkside, MFA emails have been circulated, often with passwords, in 36 separate breaches since the beginning of 2024. The most recent breaches were in 2026.  

Simple passwords appear to have left Hungary’s foreign affairs ministry vulnerable. In some cases, employees used a password that consisted of their own name and a two digit number. Others appeared to take inspiration from pop culture: “porsche911”, “frogger” and “Batman2013” are examples of real passwords used by staff.

Ministry of National Economy – oversees economic policy and financial strategy, including budget preparation and reducing national debt

Bellingcat’s analysis shows that staff in the Ministry for National Economy suffered 99 breaches. The Ministry of Finance, which was merged into this department in 2025, had suffered 145 breaches.

Among the breached data were the credentials of a deputy state secretary, who used the password “snoopy”. Other staff members used their date of birth or the word “Jelszo” – the Hungarian word for password.

A senior advisor who currently works in the ministry had their credentials breached four times using four different passwords, including “Kurvaanyad1” (roughly translated to “your mother is a wh**e”).

Cybersecurity Not Taken Seriously

Szabolcs Dull, a political analyst and the former editor-in-chief of the independent Hungarian news websites Index and Telex, said the government had failed to prioritise data security. 

“It’s clear from the data breaches that have come to light that government agencies did not take data security seriously,” he said. 

“This suspicion arose even when Russian hackers breached the foreign ministry’s IT system. That is why I believe Hungarian politicians and the public will interpret this new information as a continuation and confirmation of the Russian hacking story.”

Dull added that he was not aware of any investigation having been launched following the 2022 revelations of the Russian hack.

Kata Kincső Bárdos, a cybersecurity expert in Hungary, said it was difficult to understand why stricter controls would not be consistently enforced in government environments handling sensitive data.

She said governments should not only apply baseline rules for passwords – such as that staff use long, unique passwords and multi-factor authentication (MFA) – but also continuously monitor for compromised credentials and suspicious access patterns.

“Without MFA, systems become significantly more vulnerable to common attack methods such as phishing and credential stuffing,” she said. “A single compromised password can provide immediate access to internal systems.” 

Bárdos added that unauthorised access to government systems should automatically trigger incident response procedures, investigation and containment measures.

“It is also important to note that targeting lower-level employees is a well-documented and common tactic,” she said. “Attackers frequently gain initial access through phishing or weak credentials and then move laterally within systems.”

Bellingcat’s Ross Higgins and investigative journalist Eva Vajda contributed to this article.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post ‘Snoopy’, ‘Adolf’ and ‘Password’: The Hungarian Government Passwords Exposed Online appeared first on bellingcat.

This article is the result of a collaboration with Josimar. You can find Josimar’s corresponding piece here.

A European academic used a false name to represent an opaque Asian-facing bookmaker that is sponsoring Croatia’s national football team in the run up to the 2026 FIFA World Cup.

Croatia’s national governing body of football, the Croatian Football Federation (HNS), struck the deal to make gambling website Dragon Z6 the team’s “exclusive betting partner” across Asia in May 2024.

Promotional footage of the ceremony to ink the two-year agreement was filmed in Zagreb, with Croatian national team players Marco Pašalić, Lovro Majer and Josip Juranović in attendance.

A video posted to Dragon Z6’s website shows HNS International’s chief executive Dennis Lukančić and the federation’s head of marketing Ante Cicvarić signing the contract with the bookmaker’s representative.

“We hold Dragon Z6.com in high regard,” Cicvarić said in the clip. “A brand with a 25 year legacy and a stellar reputation for providing an exceptional gaming experience. Their motto, ‘Life is a gamble’, resonates deeply with us.”

Dragon Z6’s representative, who is named on screen and in a placard as “Alexander Smith”, described the deal as a “momentous partnership”. 

He said: “The Dragon Z6.com family proudly welcomes the Croatian national football team. We embark on an exciting journey to realise our shared ambitions.”

But the man who appears in the footage on behalf of Dragon Z6 is not Alexander Smith. He is Branko Balon, a senior lecturer in computer science at Algebra Bernays University in Zagreb. 

The Croatian national was identified using facial recognition search engine PimEyes, with images from his Facebook, university profile and media reports confirming the match.

In addition to his university position, Balon is the president of non-profit group the Croatian-Chinese Friendship Society for Cultural, Scientific and Economic Cooperation (CCFS).

He appears to have visited China on several occasions, including last July when he took part in a visiting scholar programme with the Nishan World Center of Confucian Studies in eastern China’s Shandong province, according to his Facebook posts.

Six months before the signing ceremony with HNS, Balon reportedly addressed a Zagreb sports and tourism symposium whose attendees included representatives from the Croatian Football Federation.

After initially confirming receipt of an email from Bellingcat, Branko Balon did not respond to questions. Dragon Z6 did not respond to multiple emails.

Dennis Lukančić said the Croatia Football Federation respected the rules and regulations of the sport’s governing bodies as well as Croatian law, but did not answer specific questions about how it became involved with Dragon Z6 or if it was previously aware of Balon’s real identity.

“Regarding the signing ceremony, we note that the Croatian Football Federation did not publish or officially communicate the identity of the Dragon Z6 representative present at the event,” he said. “As is customary with such ceremonies, the event itself was of a promotional nature and did not constitute the formal execution of contractual documentation.”

“The Croatian Football Federation is not in a position to comment on the internal decisions, communications, or presentation choices of Dragon Z6, including the use of names or identities in their own materials or appearances. Any questions regarding the identity or representation of Dragon Z6 at promotional events are best addressed to Dragon Z6 or their representatives. 

“In any of our proceedings we always negotiate in good faith and we respect all rights and obligations that arise from any agreement.”

Lukančić said the federation had carried out “standard compliance and due diligence procedures” before entering the deal and that the agreement was executed between the relevant legal entities, with Dragon Z6 “represented by their duly authorised signatories”. 

Asked which country Dragon Z6 was headquartered in, who its beneficial owner was, and for the name of the person who signed the contract on behalf of the gambling company, Lukančić said: “In our previous email we gave you already all answers and our position in this matter.”

We also asked if the Dragon Z6 deal includes sponsorship during the upcoming FIFA World Cup, but did not receive a response. England is Croatia’s first opponent, facing off against the Three Lions in Dallas on June 17.

The Many-Headed Dragon

Open source findings suggest that Dragon Z6 – sometimes referred to in Chinese as “Zunlong Kaisheng” – is just the latest iteration of an Asian-facing online gambling platform that has been sponsoring Western sports teams under different names for more than a decade. Dragon Z6 appears to be associated with the Hong Kong-linked gambling company KashBet, also known as KB88.

Gambling does not occur directly on the Z6.com domain. The site is essentially a gateway that redirects users to a fluctuating number of mirror websites with alphanumeric string domains. These Chinese-language sites host the gambling content, including live-streamed card games, and provide clues about Dragon Z6’s association with KashBet.

The image of Dutch former professional footballer Robin van Persie is featured prominently on Dragon Z6’s mirror sites. In the “About” section of these websites, the online casino says it signed van Persie as its brand ambassador in 2021. The same photograph of him is used interchangeably to promote both Dragon Z6 and the KashBet brand.

Van Persie’s agent, Kees Vos, said the footballer had not entered into a partnership with Kashbet, was not involved with Dragon Z6, and had not been aware that his image was being used on these websites.

Related articles by Bellingcat

Europe

Stream Teams: Battery Farming Sport For Bets

“We have taken notice of the abuse of the image of our client Robin van Persie by several Asian gambling platforms, and we will instruct our lawyers to take legal action against these parties,” Vos said.

Z6’s mirror sites also say Zunlong Kaisheng is the “official sponsor” of Bundesliga clubs Bayer Leverkusen and Augsburg, Brazilian side Fluminense, Italian club Roma, English league team Wigan Athletic and Dutch club Ajax. 

However, it was KashBet that signed sponsorship deals with these football teams in 2017 and 2019. No record of a sponsorship with FC Augsburg was found, but KB88 was promoted in pitchside advertising during one of the team’s 2019 home games.

In 2019, Australian football team Melbourne Victory dropped their AFC Champions League sponsor “Kaishi Entertainment” after concerns were raised about the company’s link to Kashbet. 

KashBet’s representative at the signing with Bayer Leverkusen was the same person who represented Kaishi Entertainment during the Melbourne Victory announcement in the same year.

A YouTube channel branded as “Zunlong Kaisheng” and featuring the Dragon Z6 logo hosts a 2024 video titled “Welcome to Dragon Casino”. It shows a tour of a facility where female croupiers are live-streamed operating table games. 

The video also features framed photographs purporting to show various ceremonies. These include the KashBet image of van Persie, as well as club teams AS Roma and AFC Ajax’s Asian betting partnerships with KB88 in 2017. Another photo claims to show former Real Madrid, Chelsea and Belgium footballer Eden Hazard becoming a Dragon Casino “brand ambassador” in 2020.

Bellingcat’s emails to representatives for Eden Hazard, who was recently announced as a “global ambassador” for online gambling platform Stake, were not returned.

The location of the facility is not stated but open source evidence shows it was filmed in the Philippines, where offshore gaming operators were banned in 2024. Reverse image searches confirm one section of the promotional video was shot in the five-star Peninsula Hotel in Makati City, Manila.

Offshore Corporate Labyrinth

Dutch club Ajax, who were sponsored by KB88 in 2017, said their deal involved Hong Kong firm KB88 Entertainment Culture Limited. A company based in the British Virgin Islands is also behind trade names linked to KB88, according to a 2023 investigation by Dutch outlet NRC. But the entities purportedly in control of the gambling platform do not stop there.

Dragon Z6’s site links to a 2012 statement posted by English Championship club, Queen’s Park Rangers (QPR), announcing a one year deal to make KashBet the club’s international betting partner. The press release, which was removed from QPR’s website earlier this year, said KashBet was “fully owned and operated by Keen Ocean Entertainment (IOM) Limited” and licensed and regulated by the Gambling Supervision Commission (GSC) on the Isle of Man.

Records from the Isle of Man company registry show a company named Goldenway Investments (UK) Limited was incorporated in 2010 and changed its name to Keen Ocean Entertainment (IOM) Limited a month later. The company’s two directors were all residents of the Isle of Man, adding Hong Kong resident Yong Tang as the third director in November of that year. A company acting as the secretary, Rivercroft Limited, is also named in documents.

An archive of the Isle of Man’s Gambling Supervision Commission’s 2012-13 annual report shows that Keen Ocean Entertainment obtained a full online gambling license. This enabled it to enter into the QPR deal as the regulated body behind Kashbet.

Filings on the Isle of Man register are low on detail. Balance sheets are not filed, and the only documented activity about the company was the occasional movement of Isle of Man-based directors. By November 2015, Yong Tang was the sole director of the company. 

In 2016, Keen Ocean Entertainment was informed by the Companies Registry that it did not have the authority to maintain its registered office at the address it had given as its premises. Yong Tang did not respond to this correspondence, according to the available documents, and the company was subsequently struck off the register.

Gaming Compliance International (GCI), a regulatory intelligence firm that monitors the global online gambling market, said Dragon Z6 and KashBet did not have a current gaming license in any credible jurisdiction.

Ismail Vali, GCI president and the founder and former chief executive of Yield Sec, which tracks gambling and streaming marketplaces, said Dragon Z6 “ruthlessly” targeted audiences in China – where gambling is illegal – but that did not mean the operators were based there.

“Generally, in the illegal gambling model, they use triangulation and separation,” he said. “It’s the most basic form of organised crime: operate your business in one place, incorporate your business in another, make your money from many places, bank your money in many places, and, finally, invest and spend it everywhere to create more crime. Separating the elements of the illegal activity creates problems for tracing, policing and enforcement.”

Vali said Western football associations that are struggling to operate on shrinking budgets could be lured into sponsorship deals with unregulated and illegal gambling companies, which were focused on building brand recognition through live-broadcast games.

“The illegal gambling companies aren’t focused upon making money from the direct audience of the clubs or from the football association’s footprint in Croatia,” he said. “What they are making money from is the audience the football matches are broadcast to globally. They want to communicate what the brand is and because it’s associated with international soccer people think it must be trustworthy.

“The whole point here is to recruit you through sports. That’s the cheapest way to get you interested because you want to place a bet on Croatia versus the Czech Republic in the World Cup qualifiers. Once they recruit a customer cheaply via sports events, they can then cross-sell or migrate them into casino and more products – where the profit margin is far higher.

“Unregulated gambling companies want a blended customer – they don’t just want you for sports betting, they want you for everything.”

Ross Higgins and Connor Plunkett contributed to this article.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Croatia’s Football Team Signed Deal With Gambling Sponsor Whose Rep Used Fake Name appeared first on bellingcat.

This article is the result of a collaboration with The Sunday Times. You can find their corresponding piece here.

Bellingcat and The Sunday Times last week published photographs showing ex-UFC fighter Mounir “The Sniper” Lazzez with wanted cartel leaders Christy and Daniel Kinahan. 

The images, captured during the 971 Fighting Championship in Dubai last June, mark the most recent sighting of the Irish narco-traffickers since the US government put multi-million dollar bounties on their heads in 2022.

At different points during the six-hour fight night, Lazzez, who ran the event at the Coca-Cola Arena, is seen talking to both crime bosses, who were seated cageside at opposite ends of the front row, on white sofas designated for VIPs.

Lazzez is captured with Daniel Kinahan in a since-deleted high-resolution image uploaded to a professional photographer’s website, and in a picture posted to Instagram by a spectator. 

He is also visible in the official live-stream. About two hours in, Lazzez taps Christy Kinahan, the founder of the eponymous drug cartel, on the arm. Three hours later, he crouches in front of the 68-year-old while looking at this phone, before sitting on the arm of Kinahan’s chair.

Today, we reveal that Lazzez — an outspoken supporter of Daniel Kinahan — has business interests extending far beyond the world of combat sports.

Documents uncovered by Bellingcat link the 38-year-old to multimillion dollar shipping deals, orchestrated by companies in a secrecy jurisdiction, for crude oil tankers that were later sanctioned by the US government for helping the Iranian regime.

The firms that bought these ships were headquartered at an address used for registering offshore companies — including a separate firm that owned a Kinahan cartel-linked bulk carrier loaded with more than two tonnes of cocaine.

Who is Mounir Lazzez?

Lazzez has been held up as an icon in the world of combat sports as the first Arab born-and-raised fighter to be signed to the UFC.

Originally from the port city of Sfax in Tunisia, he said he had a “tough life” and had to “fight to get everything”. In one interview, Lazzez explained how he started MMA classes as a teenager. A “skinny kid” who was being bullied, his parents thought the sport would boost his confidence.

Eventually, Lazzez said, he went on to compete nationally and then, in his early 20s, moved to Canada to hone his skills. It was a “business opportunity” that drew him to Dubai, where he also started his professional MMA career.

The 6’1″ welterweight was signed to the UFC in 2020 after being recommended to long-time president Dana White by a friend of White’s teenage son. Earning the nickname “The Sniper” for his precision strikes, he fought four times between 2020 and 2023.

For the latter part of his MMA career, Lazzez was represented by MTK Global, the now-defunct sports management company co-founded by Daniel Kinahan, who authorities have said is responsible for managing the cartel’s drug trafficking operation.

Lazzez has spoken publicly about his relationship with Daniel Kinahan, describing him as a “good friend, brother and advisor”. In 2021, he wrote on social media: “I’ve never met a man like him”.

He made headlines in 2022 when he thanked Kinahan from inside of the cage after a win in Las Vegas. “Without him, I would never be the man who I am today,” Lazzez told the crowd.

When questioned about his comments later, Lazzez said the cartel boss – who had been sanctioned just days before — was “a friend and adviser.”

Now retired from combat sports, Lazzez had, until recently, lived in Dubai and was listed as the part-owner of a gym, the 971 MMA & Fitness Academy, in the industrial district of Al Quoz.

He launched the 971 Fighting Championship in 2024, promising to “change the face” of combat sports. Last year’s outing at the Coca-Cola Arena was its second event.

But our investigation has uncovered records tying Lazzez to other ventures before he started the 971 Fighting Championship.

In 2023, he was listed as the director of two companies that paid more than $80 million for two oil tankers. Both ships were sanctioned the following year for their roles in assisting the Iranian regime.

The Sunday Times has previously reported on the Kinahan cartel’s involvement in arms smuggling and money laundering, and its alliances with other crime fraternities. Among the gang’s alleged clients are Iran’s intelligence services and the Lebanon-based Islamic militant group Hezbollah. 

The new findings uncovered in this investigation raise serious questions about Lazzez’s relationship with the most senior members of the US-sanctioned Kinahan Organised Crime Group.

Bellingcat contacted Mounir Lazzez by phone, email and social media but did not receive a response.

A staff member who answered the phone at Dubai’s 971 MMA & Fitness Academy said Lazzez has had no involvement in the business since October 2025. Asked how Lazzez could be contacted, the man said: “That’s the problem, we don’t have anything from him since he left. He doesn’t work here with us anymore.” 

A series of messages and calls to the gym’s management and two other owners were not answered.

Further enquiries last week found that Lazzez had moved to Italy, where his wife is from, late last year. In October, Marco Fioravanti, the mayor of Ascoli Piceno, a town in central Italy, posted a photo of him meeting with the ex-UFC fighter.

A local news report published in December said the “combat sports icon” was now offering personal training sessions from two gyms in the region. “Today, my motivation is teaching,” Lazzez was quoted as saying. “I’ve lived the athlete’s life at the highest level, and now I want to pass on my experience to others.”

New Instagram and Facebook profiles set up under the name “ML MMA & Fitness” and advertising personal training with Lazzez included an email address in his name and an Italian mobile number.

The social media accounts were deleted or made private last week immediately after Bellingcat sent messages. Phone calls and emails to Lazzez were not returned.

Lazzez, who founded the 971 Fighting Championship in 2024, said he was focused on expanding the event. After the 14-bout card last June, the 971 FC Instagram page asked fans who they wanted to see perform at the next fight night, and posted: “We’re just getting started”. Lazzez said there was “more in the pipeline”. In an interview at the time, he was also quoted saying: “This is not just a business. We’re not doing this for profit. This is about legacy.”

After more than a decade living in the UAE, it is not known why Lazzez and his young family relocated to Italy in recent months.

MMA to Multi-Million Maritime Deals

Bellingcat ran Mounir Lazzez’s name through open source corporate databases to determine if he was involved in any business activities other than his Dubai gym, the 971 Fighting Championship, and his new venture in Italy.

Two results were returned via Horizons, a platform that aggregates public records and which was created by Washington DC-based nonprofit C4ADS. The files, sourced from the Panama Flag Registry, include title documents showing the owners of ships registered under the Panama flag up until August 2024.

$41.75M

$42.75M

Mounir Lazzez

Director

Company 1

Marshall Islands

SANCTIONED

Oil Tanker

Panama Flagged

SANCTIONED

Company 2

Marshall Islands

Oil Tanker

Panama Flagged

SANCTIONED

The documents reveal that Lazzez was listed as the director of two companies that bought two ships over a three month period in 2023.

He was listed as the director of Dragon Road Limited, a Marshall Islands-registered company that bought an oil tanker called “Alisha” in July 2023.

The oil tanker, which was sold by Dragon Road last year, has gone by four different names since 2013. Source: Image posted to MarineTraffic in 2024 by Ivan Meshkov.

A bill of sale for the Panamanian-flagged ship shows that Dragon Road paid US $41.75 million for the vessel, which was then renamed “Serene I”.

Documents showing Dragon Road’s purchase of Alisha (renamed Serene I). Source: C4ADS Horizons

The following year, in September 2024, Dragon Road was sanctioned, along with Serene I.

The US government said it had loaded products belonging to the Islamic Revolutionary Guard Corps-Qods Force (IRGC-QF) on behalf of a company affiliated with Hezbollah.

The records from Horizons also show that Mounir Lazzez was listed as the director of a second Marshall Islands-based company called Faith Enterprise Limited in 2023.

Faith Enterprise bought a 330m Panamanian-flagged oil tanker called “Luna Lake”.

The vessel has since been sold to unknown owners and renamed Eternity. Source: Image posted to MarineTraffic in 2025 by Christoph Ortmann.

The 2023 bill of sale said Faith Enterprise paid US $42.75 million for the vessel, which was renamed “Phonix”. The paperwork was notarised at the Panamanian consulate in Dubai, where Lazzez lived at the time.

Documents showing Faith Enterprise’s purchase of Luna Lake (renamed Phonix). Source: C4ADS Horizons

The tanker was sanctioned by the US government in December 2024 for allegedly transporting Iranian oil. Faith Enterprise was dissolved by the time the ship was sanctioned and it is unclear who the owner was. A third company, India-based Vision Ship Management LLP, was also sanctioned for managing and operating Phonix. While this company has no known ties to Lazzez, shipping data platform Equasis shows that the same company also managed Serene I.

Tracking data from Global Fishing Watch shows that both Serene I and Phonix departed the Singapore Strait, toward the Persian Gulf, weeks after they were sold to the firms that listed Lazzez as their director. Both tankers then made at least two round trips between the Persian Gulf and China in the following months.

Source: Global Fishing Watch

The Sunday Times reports today that tankers of this size could carry up to 1.1 million barrels of oil which, at market rates, represents a cargo worth US $90 to $100 million. It said entities facilitating such shipments could earn as much as 10 per cent of each trade – US $10 million per voyage.

In each of the shipping documents, Lazzez's signature is declared authentic by a named ambassador or consul general of Panama. Lazzez’s method of identification used in the sale of Serene I, which was detailed in the documents, was an Italian passport.

Bellingcat confirmed Lazzez’s Italian passport number through a Bing search, which returned a document from the Government of Dubai’s official website showing that it was used on a commercial licence for Nine Seven One Rising Mixed Martial Arts Academy LLC — the entity behind Lazzez’s gym, 971 MMA & Fitness Academy.

Lazzez posted on social media in 2022 about becoming an Italian citizen.

Corporate documents list Lazzez as one of three owners of Nine Seven One Rising Mixed Martial Arts Academy LLC. According to the documents, Lazzez has a 25 per cent share in the business. 

The other two owners are both citizens of the Caribbean Island of Dominica. One of these people, according to their public profiles, studied law in Iran and specialises in maritime law. The other is named in the Panama Papers and appears to be involved in the global shipping industry.

Neither of these people responded to questions from Bellingcat.

Dragon Road and Faith Enterprise were both set up in 2023, three months and one month respectively before buying the vessels, according to records accessed via International Registries, Inc.

Dragon Road was annulled in September 2024, the same month the sanctions were imposed. Faith Enterprise was dissolved in September 2024, nine weeks before the ship it bought was sanctioned.

The names of company directors, shareholders and beneficial owners are not publicly accessible in the Republic of the Marshall Islands. While Lazzez was listed as the director of Dragon Road and Faith Enterprise in 2023, according to the documents accessed via Horizons, it is not known if he was still a director in 2024. It is also unknown if these companies had other directors at the time.

What is known from the documents filed with the Panama Flag Registry is that both firms were headquartered at a Marshall Islands address that is commonly used for registering offshore companies, including Matthew Maritime Inc, which owned cocaine freighter the MV Matthew.

The Panamanian-flagged vessel was seized off the Irish coast in September 2023 and found to be carrying more than two tonnes of South American cocaine worth €157 million. It was the largest drugs seizure in Irish history.

The smuggling operation was reportedly part of a conspiracy involving the Kinahans and the Colombian Clan del Golfo. It was also reported that the operation was directed from Dubai, and that authorities suspected the involvement of Hezbollah and the Iranian government.

Connor Plunkett, Peter Barth, Beau Donelly and John Mooney contributed to this article. Scroll-driven interactive by Connor Plunkett and Miguel Ramalho.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Ex-UFC Fighter and Kinahan ‘Friend’ Mounir Lazzez Linked to Iran Sanctions appeared first on bellingcat.

This article is the result of a collaboration with The Sunday Times. You can find their corresponding piece here.

Kinahan cartel leaders Daniel and Christy Kinahan have been photographed in Dubai, marking the most recent sighting of the wanted crime bosses since the US government put multi-million dollar bounties on their heads.

The footage was captured just weeks after Kinahan cartel lieutenant Sean McGovern was extradited from the United Arab Emirates (UAE) to Ireland, where he was charged with murder and directing the activities of a criminal organisation.

Filmed during a mixed martial arts (MMA) event in June, the images are the first visual proof that the drug cartel’s leadership — who fled from Spain to Dubai in 2016 — were still in hiding in the desert city as recently as last summer.

Christy Kinahan, 68, and his two sons, Daniel, 48, and Christopher Jr, 45 — the most senior members of the Kinahan Organised Crime Group — are wanted by authorities around the world. The three Irishmen have been sanctioned by the US government and are the subject of a collective $15 million reward for information leading to their arrest.

Bellingcat and The Sunday Times have previously revealed how Christy Kinahan left a trail of Google reviews exposing his movements and travel partners over a five year period. We also uncovered the gang’s links to a German businessman charged with trafficking cocaine in 2024, and to an Australian pilot who was killed during a failed drug run in South America last year.

Bellingcat discovered this new footage of the narco-traffickers after running a photo posted to social media of one of Daniel Kinahan’s adult sons — whose name was published last year — through face recognition search engine PimEyes.

It returned a professional photograph of Daniel Kinahan that was taken during the 971 Fighting Championship (971 FC) at the Coca-Cola Arena in Dubai’s City Walk district on June 14, 2025.

Pictured wearing a black top, baseball cap and glasses, he is sitting ringside next to the event’s founder and former Ultimate Fighting Championship (UFC) athlete, Mounir “The Sniper” Lazzez.

(The image, which had been posted to a Dubai photography company’s website, was removed yesterday, hours after Bellingcat contacted a representative for the Kinahans to seek comment.)

A frame-by-frame sweep of official footage and user-generated content from the arena revealed that Christy Kinahan, the founder of the eponymous drug cartel, was also among the reported 6,000 spectators at the fight night.

The elusive crime boss — nicknamed “The Dapper Don” — is seen wearing a Panama hat, blue Polo shirt, white trousers and blue trainers.

These images of the cartel leaders are the first to emerge since Bellingcat published the most recent known photograph of Christopher Kinahan Jr in 2024, captured during a meeting with his father in a Dubai restaurant the year before.

The new footage of Daniel Kinahan marks the first time he has been pictured since the US government levied sanctions on the transnational organised crime group in April 2022.

The Man in the Panama Hat

The Kinahan cartel is one the world’s most notorious criminal organisations. Worth an estimated €1.5 billion, it is involved in drug trafficking, arms smuggling and money laundering operations around the world. Investigators have also linked the gang to Iran’s intelligence services and the Lebanon-based Islamic militant group Hezbollah.

It was reportedly part of a “Super Cartel”, a criminal network that controlled much of Europe’s cocaine trade. Five of the network’s key members have been arrested since 2017, but one — Daniel Kinahan — remains at large.

Daniel Kinahan, who authorities say is responsible for managing the cartel’s vast drug trafficking operations, has been heavily involved in combat sports since the early 2010s. He co-founded MTK Global, a boxing management firm that signed high-profile boxers including former world heavyweight champion Tyson Fury.

Kinahan has previously been pictured with boxers and at sporting events, but there have been no confirmed public sightings of him in years. In 2022, after the US sanctions were announced, MTK Global shut down. With multi-million dollar bounties on their heads, the Kinahans fled their luxurious Dubai homes and have kept a low profile since.

After discovering the photo of Daniel Kinahan from the 971 Fighting Championship, Bellingcat searched for additional footage to verify the gangland figure was in the crowd. Multiple videos confirmed he was in attendance, seated in the stadium’s VIP section.

During this process, we also identified a man who strongly resembled his father and the founder of the drugs cartel, Christy Kinahan.

This man and Daniel Kinahan were seated at opposite ends of the front row, immediately around the eight-sided cage, on white sofas designated for VIPs.

We analysed the official footage from the event, a more than six-hour video from sports streaming service TrillerTV. In most of the footage in which the man is visible, his hand partially obscures his face.

However, it was clear that the man shared many of the physical characteristics of Christy Kinahan, including a similar build, facial features, and hair colour and length. The official live-stream, as well as footage posted to social media, showed his appearance was consistent with that of a man in his late sixties.

The man was also wearing a white Panama hat with blue band, a style the cartel leader has been known to wear.

In the image below, posted to social media six months before the 971 FC event, a close relative of Christy Kinahan poses with a Panama hat and wrote in the caption that it belonged to him. Bellingcat has not identified this person because they have no known involvement in crime.

Additionally, the person seated next to the man in the Panama hat throughout the fight night strongly resembled one of Christy Kinahan’s immediate family members. Bellingcat has not identified this person because they have no known involvement in crime.

Two individuals seated behind the man also closely resembled people that Bellingcat and its publishing partner The Sunday Times have linked to the cartel.

It was subsequently confirmed that the man in the Panama hat was Christy Kinahan. The Sunday Times confirmed his identity with three sources who either knew the cartel leader personally or have investigated his activities.

Fight Night, Familiar Faces

Christy Kinahan has served prison time in Ireland, the Netherlands and Belgium but has evaded capture for more than a decade. He has received anti-surveillance training to conceal his identity and avoid drawing attention and, in recent years, used aliases to fly under the radar.

But Kinahan is visible throughout the entire live-stream of the 971 Fighting Championship — adding up to the longest known footage of the cartel leader that has ever been made public.

The Sunday Times reports today that his presence at a high profile event that live-streamed online was uncharacteristic for a criminal who has made a career of escaping detection.

“His appearance in the open, seated in such a public place, is all the more remarkable because it is so likely to draw attention, a stark departure for Kinahan, who typically operates like a ghost,” it said.

Bellingcat’s analysis showed that Christy Kinahan was in his seat at the very beginning of the event, when the VIP area was almost entirely empty, and stayed until the end of the last fight, more than six hours later.

He was also seen standing, walking and communicating with other people during the fight night. Kinahan was observed talking to 971 FC founder Mounir Lazzez, who sat next to him during the first round of the Junior Karanta vs Oli Thompson bout. At one point, Lazzez tapped Kinahan on the arm.

Daniel Kinahan appears to have spent less time in the arena, and is first seen in his seat almost four hours into the event. He is captured talking to Lazzez in this photo, taken shortly after Kurdistani fighter Namo Fazil won his bout.

Daniel Kinahan is not seen again after Irish fighter James Gallagher won his bout an hour later, which is when the professional photo of Kinahan and Lazzez was taken.

Tunisian-born Lazzez lived, until recently, in Dubai, where he is listed as a part-owner of a gym called the 971 MMA & Fitness Academy. He launched the 971 Fighting Championship in 2024, promising to “change the face” of combat sports.

Footage from the first 971 FC event, at The Agenda arena in Dubai in May 2024, was not clear enough to identify people in the crowd, but social media posts confirm that an immediate relative of Daniel Kinahan’s was present.

Lazzez has publicly backed Daniel Kinahan despite the global law enforcement efforts to apprehend him. In April 2022, days after the sanctions against the cartel were announced, he thanked Kinahan in a post-fight speech and subsequent media interview in Las Vegas. Lazzez has spoken about their relationship on multiple occasions, including describing Kinahan as a “good friend, brother and advisor”.

Bellingcat contacted Mounir Lazzez by phone, email and social media but did not receive a response.

Bellingcat also identified the people sitting on either side of Daniel Kinahan when the professional photograph was taken. They are a man and a woman who were both involved behind the scenes at 971 FC.

The man, who has previously worked in boxing promotion, had a senior role at the Coca-Cola Arena in June last year, including during the fight night, according to his LinkedIn profile.

The woman, who lists her most recent employment as an MMA event coordinator, appeared in footage posted to 971 FC’s social media that described her as being part of the production team. She is tagged in multiple posts about the event, including from an MMA fighter who participated on the night. The woman is also seen hugging Daniel Kinahan, talking to his adult son and sitting next to Mounir Lazzez.

This means that Kinahan, once a “major player” in the combat sports business, was surrounded by the 971 FC founder and two people who worked at the event. 

The man and woman did not respond to Bellingcat’s questions. There is no suggestion they are involved in any criminal activity.

No clear footage of the younger Kinahan meeting with his father was identified at the 971 FC event. However, during a mid-event performance by American rapper Lloyd Banks, shortly after the professional photo was taken, Daniel Kinahan’s seat was empty and a person wearing similar clothing (light coloured trousers, a dark top and baseball cap) is seen moving along the front row, greeting people, and embracing Christy Kinahan. 

The identity of this person could not be verified due to the low quality of the footage.

The Sunday Times reports today that the Kinahans continue to enjoy a VIP lifestyle in Dubai despite the UAE’s insistence that it has taken action against the cartel. “These findings suggest that the imposition of American sanctions has failed to significantly weaken the cartel and may, in fact, have made it more resilient,” it said.

“The Emiratis claim to have frozen €200 million in assets across UAE-registered businesses and mapped the organisation’s front companies and proxies; however, the Kinahans’ continued ability to operate in the open suggests these enforcement efforts have yet to strike a decisive blow.”

An extradition treaty between Ireland and the UAE was ratified in 2025, but to date it has only been enforced on Kinahan cartel lieutenant Sean McGovern, who was returned on an Irish military plane last May.

In December, Detective Chief Superintendent Séamus Boland, the head of Ireland’s drugs and organised crime bureau, said investigations into the Kinahan cartel were ongoing and that he hoped 2026 would be a “significant year”.

He was speaking ahead of the 10 year anniversary of Dublin’s Regency Hotel attack, when a rival gang attempted to assassinate Daniel Kinahan at a boxing weigh-in. The attack left Kinahan gang member David Byrne dead and sparked a bloody gangland feud that has resulted in 18 deaths.

Bellingcat contacted a representative for the Kinahans to seek comment but did not receive a response.

Correction: This article has been updated after originally stating that Mounir Lazzez “lives” in Dubai. Lazzez lived in Dubai until recently, but moved to Italy in late 2025. The article was updated on March 19, 2026.

Connor Plunkett, Peter Barth, Beau Donelly and John Mooney contributed to this article.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here. 

The post New Footage Shows Wanted Kinahan Cartel Kingpins Post-Sanctions appeared first on bellingcat.

This article is the result of a collaboration with The Sunday Times. To stay up to date on our latest investigations, join Bellingcat’s new WhatsApp channel here.

An Australian pilot who recently died when his small plane crashed in South America during a failed drug run has links to an alleged Kinahan cartel associate who is facing charges over the importation of a multimillion dollar cocaine shipment to Western Australia.

The body of former Melbourne stockbroker Timothy James Clark was reportedly found at the wreckage of his single-engine Sling 4 in Brazil’s north-east on September 14, along with about 200kg of cocaine.

Local media said Clark was the sole occupant of the aircraft, which had been fitted with additional fuel tanks and appeared to have its transponder turned off.

Melbourne newspaper The Age reported on Thursday that Clark’s failed mission in South America was not his “first rodeo” and quoted a confidential source who alleged that the 46-year-old had been involved in a drug smuggling operation in Western Australia last year.

The Australian Federal Police (AFP) charged German businessman Oliver Andreas Herrmann and Melbourne man Hamish Falconer with trafficking a commercial quantity of a controlled drug in December after a search of their hotel rooms uncovered 200kg of cocaine, packed in suitcases in single one-kilogram blocks, along with night vision goggles, aviation equipment and a hardware cryptocurrency wallet.

Related articles by Bellingcat

Africa

Nowhere to Run: The Online Footprint of an Alleged Kinahan Cartel Associate

Herrmann had allegedly met a “small aircraft” at the remote Overlander Airstrip the day before his arrest. The AFP has not disclosed the make and model of the aircraft but said it had not seized an aircraft as part of its investigation.

Investigators estimated the street value of the drugs to be AUD $65 million and said an “organised crime syndicate” was likely responsible for the scheme.

In March, Bellingcat published an open source analysis of Herrmann’s online footprint and traced the champion marathon runner and international businessman to locations associated with the US-sanctioned Kinahan Organised Crime Group.

It followed reporting by our publishing partner The Sunday Times, which revealed that Herrmann had “close financial ties” to Christy Kinahan, the 68-year-old founder of the eponymous international drug cartel. Herrmann had no previously known links to organised crime. 

Bellingcat has now uncovered evidence linking alleged Kinahan cartel associate Herrmann to Timothy Clark, the Australian who was killed when his plane crashed in Brazil two weeks ago.  

Using online tools that consolidate publicly available information and reverse image searches, Bellingcat found more than a dozen accounts registered to Clark across social media platforms, travel websites and review platforms.

This open source review shows that the Australian pilot – who used the moniker “The Broker” on X and Instagram – documented his travels to more than 20 countries across Africa, South America, Europe and Asia over the past decade.

Clark frequently used Tripadvisor to post reviews, including about chartering a catamaran in Bali and the VIP service at a Saint-Tropez bar where he spent €5,500 on “ultra topshelf” drinks.

Clark was also an associate of Oliver Herrmann; the German businessman’s Facebook profile shows he was “friends” with the Australian pilot. And a 2018 restaurant review posted by Clark included a photo that shows the pair dining together in the Zimbabwean capital of Harare. 

The filename of the photo is dated March 2, the same day that Herrmann logged a run in Harare on the fitness app, Strava. In the same week, Clark posted a review for a Harare bar close to where Herrmann recorded another GPS-tracked run on the same day.    

Herrmann, an acclaimed runner who won the 2016 Munich Marathon, logged more than 2,500 activities across dozens of countries on Strava between 2013 and 2023. His use of the fitness app provided an extensive overview of his travels during that period. 

Corporate records show Herrmann has been involved at senior levels with companies active in the fields of fintech, mining and consulting.

Like Christy Kinahan, Clark had an active Google Maps profile where he posted reviews, photos and ratings. His profile used the alias “John Smithe”, but Clark is pictured in one of the images posted by the account and his real name is used in a reply from one of the venues, confirming it belongs to him.

Clark also left Tripadvisor reviews for two Zimbabwean venues – the Amanzi Lodge and Thetford Estate – which Christy Kinahan later attended, according to the cartel leader’s own Google Maps profile.

Clark, who lived in South Africa before his death, was also just one of eight X followers of Adam Wood, a known associate of Christy Kinahan in Africa.

South African news outlet City Press reported last week that Clark also operated a second aircraft for “legitimate” flights, a Beechcraft King Air 350 with Malawi registration number 7Q-YAO.

Bellingcat previously revealed that this aircraft was purchased in the US by an Indonesian company linked to Oliver Herrmann’s partner. It was then flown to Southern Africa by a ferry pilot who had also piloted a Pilatus PC-12 previously associated with a Kinahan-linked company.

Clark posted a Google review for a business at Lanseria Airport in Johannesburg on the same day in April 2024 that the Beechcraft King Air 350 landed there, according to tracking data from ADS-B Exchange.

The Sunday Times reports today that the Sling 4 kit-plane piloted by Clark had been heavily modified for transatlantic flights. A source told the newspaper that Clark replaced the engine at least once in Brazil, indicating he was continuously flying it long-haul, and may have fitted a third engine due to the number of flying hours he was accumulating. 

Clark’s plane crashed about an 11-hour flight from the Amazon basin, a region that has become a major trafficking route for cocaine bound for Europe, the drug’s fastest-expanding market. 

Tonnes of the drug flow from neighbouring Peru and Colombia, moving through the Amazon before being shipped to Europe and Africa.

The Sunday Times said Clark and Herrmann’s alleged activities suggested the Kinahan cartel had opened new smuggling routes for smaller shipments following a succession of seizures of cocaine consignments by police forces across Europe. 

Oliver Herrmann, who has no known convictions, has not yet entered a plea. His case is listed for a committal mention in Perth Magistrates Court on October 10.

Peter Barth, Connor Plunkett, Beau Donelly and John Mooney contributed to this article.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here. With the unpredictability of social media algorithms making it harder for news outlets to reach audiences consistently, we have also started a WhatsApp channel that you can join to stay updated on our stories.

The post Australian Cocaine Pilot Killed in Brazil Plane Crash Linked to Kinahan Drug Cartel appeared first on bellingcat.

This article is the result of a collaboration with Japanese publishing partner Nikkei. You can find Nikkei’s investigation here.

Earlier this year, a man and a woman stood trial in a New York courtroom on charges related to the illicit drugs trade. They had been arrested as part of an undercover sting by the US Drug Enforcement Administration (DEA) after more than 200 kilograms of precursor chemicals used to make the synthetic opioid fentanyl were shipped from China to the US. It was enough to make 25 million deadly doses of the drug, authorities said. 

The Chinese nationals were also accused of conspiring to import tonne-quantities of fentanyl precursors to the US, where tens of thousands of people die from opioid overdoses every year. After a two-week trial, a Manhattan jury found the pair guilty of conspiracy to import fentanyl precursors and conspiracy to commit money laundering. 

Qingzhou “Bruce” Wang, 36, and Yiyi “Chiron” Chen, 32, worked for Hubei Amarvel Biotech (AmarvelBio), a chemical firm based in the Chinese city of Wuhan. They were arrested in 2023 after being lured from China to Fiji as part of a DEA operation and subsequently extradited to the US. The case marked the first time US authorities prosecuted Chinese company executives for trafficking fentanyl precursors.

But court documents showed there may be links to another East Asian country. Bellingcat was contacted by the Japanese newspaper Nikkei, which was investigating AmarvelBio’s connection to Japan, suspecting the country was being used as a command post for the cross-border smuggling operation. 

Nikkei was looking into Xia Fengzhi, a Chinese man referred to in the New York legal proceedings as “the boss in Japan”. It had found an individual by that name who was listed as the owner of a Chinese company selling raw chemical materials called Fushikai Trading Co Ltd, which according to Nikkei was active under the brand name “Firsky”. A website for Firsky China included a certificate for Fushikai Trading with the same identification code seen on Fushikai’s corporate records. The company, according to its website, was a wholly owned subsidiary of Firsky Co. Ltd., which was registered in Nagoya, an industrial city in central Japan. 

Nikkei pulled the corporate records for Firsky in Japan, which showed Xia headed the company. Records obtained by Nikkei also showed that the Chinese company’s supervisor was listed as Qingzhou Wang, the same name as one of the two AmarvelBio executives convicted in the US.

Nikkei asked Bellingcat’s financial investigations team to leverage its expertise in open source research to independently verify the Japanese company’s connection to AmarvelBio. Our investigation uncovered evidence showing the two companies are not only part of the same international smuggling network – they are effectively one and the same. This is how we did it.

The Japan Connection

Linking AmarvelBio and Firsky through domain records was not possible because both websites were registered through a provider that uses privacy protection, which conceals personal details from the public. However, information obtained by US law enforcement can become public during court proceedings.

CourtListener’s Advanced RECAP Search is a free tool operated by the non-profit Free Law Project that allows users to search millions of federal court documents made available through the Public Access to Court Electronic Records (PACER) service. 

A CourtListener search for “amarvelbio.com” returned multiple results, including an exhibit from the federal case against AmarvelBio. This contained subpoenaed domain registration data, which showed that convicted AmarvelBio employee Yiyi “Chiron” Chen registered a number of domains, including for AmarvelBio, its “sister company” Wuhan Wingroup, and Firsky (in both China and Japan).

Another domain (firskytech.com) that was not included in the documents available on CourtListener was registered months after Chen’s 2023 arrest and remains online as of publication. This website lists an address in Wuhan and describes itself as a wholly Japanese-owned supplier of “high purity” chemical intermediates. While its registration details remain private, the contact email listed on the site uses the domain for Firsky China – “firsky-cn.com” – which was registered by Chen and is therefore linked to the network.

Bellingcat also found Chen’s personal gmail address in the source code in archives of three websites (here, here and here) that were in both the subpoenaed registration records and a list of 12 domains US authorities seized after linking them to AmarvelBio, further corroborating her involvement.

Additional domain links between AmarvelBio and the Japanese iteration of Firsky were identified in archived advertisements from the darknet marketplace Breaking Bad, which were found via leak aggregator intelx.io. The chemicals ads were posted under AmarvelBio’s rebranded name, AmarvelTech, following the Chinese company’s indictment in 2023. 

Some of the ads led to whrchem.com – one of the 12 websites seized by the DEA. Domain records discovered via intelx.io revealed that whrchem.com was controlled by two email accounts, one of which used the domain for Firsky Japan – “firsky-jp.com”. The same email is also listed as an “author” on an archive of whrchem.com.

Bellingcat’s analysis of AmarvelBio and Firsky’s profiles, advertisements and salespeople uncovered further links between the two companies, including recycled phone numbers, photographs, watermarks, company bios and compliance certificates that could not be verified.

Searches for Firsky on the Breaking Bad forum returned an existing profile for a salesperson called “Cindy”, whose contact website was listed as bmkpmkbdo.com. A 2024 archive of the site displays Cindy’s WhatsApp number which, searches show, had previously been used in an AmarvelBio advertisement posted on Breaking Bad. 

Firsky has a seller profile with more than 350 active listings on the e-commerce platform ChemicalBook. But in one ad, under descriptions of the company, Firsky is interchangeably described as AmarvelBio.

While many Firsky ads included stock images branded with its watermark, some products advertised by Firsky were clearly branded as AmarvelBio and displayed the “Hubei Amarvel Biotech Co., Ltd” watermark. One Firsky website and AmarvelBio’s ChemicalBook profile both displayed an image of the same factory.

AmarvelBio also has a ChemicalBook seller’s profile and displays a certificate (though “Amarvel” appears to be misspelled “Amarbel”) claiming to show it passed a third party quality inspection. An image of a certificate bearing an identical report number and date, but with Firsky listed under “company name”, was found on one of Firsky’s websites. Under the “General Comments” section, both the Amarvel and Firsky certificates contain a reference to “Huibei Amarbel Biotech Co., Ltd., located in Wuhan”.

The company said to have issued the certificates, SGS-CSTC Standards Technical Services Co. Ltd., told Bellingcat it was unable to verify the documents because they were incomplete.

Earlier this year, Bellingcat and the Estonian outlet Postimees investigated the online sale of nitazene opioids from Chinese suppliers. It found that entities involved in selling the super-strength drugs also used Russian Doll-like setups involving multiple companies sharing the same contact details, salespeople, advertisements and website layouts.

‘Room for Exploitation’

Illicit fentanyl sourced from China and Mexico has fueled the most lethal drug crisis in America’s history. The synthetic opioid is 50 times more potent than heroin – a dose as small as 2mg can be lethal. While fatalities have declined in recent years, the opioid epidemic killed more than 100,000 people between February 2022 and January 2023, and overdose remains the leading cause of death for Americans aged 18 to 44. 

The US government this year imposed tariffs on China aimed at putting pressure on Beijing to stem the flow of fentanyl precursor chemicals into the country. In June, China added two fentanyl precursors to the list of controlled substances in what it described as an initiative to fulfill UN drug control obligations, reflecting its “attitude of actively participating in global drug governance”. At least one of these precursors has been advertised by AmarvelBio and its affiliated companies, including some listings that remain online on third-party trading websites. 

Takehiro Masutomo, a Tokyo-based journalist and the author of Run Ri: Tracing the Footsteps of Chinese Elites Escaping to Japan, has written extensively about the new wave of immigration to Japan by Chinese people, who now make up that largest group of foreign residents in the country. He told Bellingcat that Japan was an attractive destination not only because of its proximity to China, cultural ties, and the relative ease with obtaining long-term residential status via business routes, but also because there were fewer regulatory barriers. He said this left “room for exploitation” by criminals. 

“It’s really easy to set up a company here, and everything is cheap compared with other global cities. That’s the main reason,” Takehiro said. “I have been interviewing a lot of newly arrived Chinese people here, and I came across some people, including criminals. Japan may face a potential increase in financial crimes, including money laundering, involving individuals from China.” 

Nikkei reported that Japan may have been chosen as a base because it is not widely associated with trafficking fentanyl precursors and therefore less likely to have shipments inspected. While Firsky has been liquidated in Japan, Nikkei said AmarvelBio’s network continues to operate in China. The whereabouts of Xia Fengzhi, described in US court documents as “the boss in Japan”, remain unknown.

In response to a question on the Breaking Bad forum about the case against AmarvelBio in 2023, a user tagged as an “AmarvelBio Vendor” said US sanctions have “no effect” on Chinese companies. “The only thing they can do is blocking [sic] our website,” they said. “This is no pain to us, we will build a lot of new websites”.

Xia Fengzhi did not respond to requests for comment from Nikkei. Lawyers for Wang and Chen, who are due to be sentenced this month, did not respond to requests for comment as of publication.

George Katz and Connor Plunkett contributed to this article.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post A Chinese Fentanyl Smuggling Network’s Footprints in Japan appeared first on bellingcat.

This article is the result of a collaboration with TjekDet, Denmark’s fact-checking media outlet, Danish newspaper Politiken, and the Canadian Broadcasting Corporation (CBC). Watch CBC’s documentary here. 

Warning: This article discusses non-consensual sexually explicit content from the start.

MrDeepFakes billed itself as the “largest and most user-friendly” platform for celebrity deepfake pornography. The website, which was visited millions of times every month, hosted almost 70,000 explicit and sometimes violent videos, which had collectively been viewed more than 2.2 billion times.

They show mostly famous women whose faces have been inserted into hardcore porn with artificial intelligence – and without their consent.

In the background, an active community of more than 650,000 members shared tips on how to generate this content, commissioned custom deepfakes, and posted misogynistic and derogatory comments about their victims.

For years, the website has been shrouded in secrecy, existing in a legal grey area and concealing the identity of those who control it. Until now.

Bellingcat, in collaboration with Danish outlets Tjekdet, Politiken and the Canadian Broadcasting Corporation (CBC), has conducted an investigation to reveal the identity of a key administrator behind MrDeepFakes.

David Do is a 36-year-old Canadian pharmacist who, based on open source information, lives an unassuming and respectable life in the suburbs outside of Toronto. Photos and videos posted online show him with family, friends and colleagues. The university graduate has a well-paying job in a public hospital and drives a new Tesla.

But Do has been living a double life: in secret, he is the most prominent figure identified to have had control over the administration of MrDeepFakes. He was also an influential member of its growing online community, producing his own deepfake porn and assisting users who want to make their own.

Online posts show Do is a technically minded individual with a long-standing interest in creating and distributing adult content, and provide an insight into efforts to obfuscate his identity.

We identified Do by cross-referencing data from massive credential leaks, which are publicly available via breach databases. A series of burner emails, IP addresses, repeated usernames, and a unique password reveal a more than decade-long digital trail that allowed researchers to link him to MrDeepFakes.

Bellingcat, Tjekdet, Politiken and CBC have sent Do multiple requests for comment since late March but did not receive a response as of publication. Last month, the CBC hand-delivered correspondence to Do setting out the findings of this investigation, but he declined to comment.

Shortly after, Do’s Facebook page and the social media accounts of some family members were deleted. Do then travelled to Portugal with his family, according to reviews posted on Airbnb, only returning to Canada this week.

On Sunday, the MrDeepFakes site was shut down. “A critical service provider has terminated service permanently,” a notice on the platform says. “We will not be relaunching. Any website claiming this is fake.”

CBC approached David Do again on Monday but he refused to answer questions about his involvement with MrDeepFakes. “I don’t want to be recorded please,” he said. “I have to go. I’m busy right now.”

Update: David Do is on leave from his position as a hospital pharmacist, his employer confirmed on May 13, while an internal investigation is underway. Separately, the Ontario College of Pharmacists has said it is “taking immediate steps to look into this matter further and determine the necessary actions we need to take to protect the public”.

‘Fake It Till You Make It’

The identity of the person or people in control of MrDeepFakes has been the subject of media interest since the website emerged in the wake of a ban on the “deepfakes” Reddit community in early 2018.

But the porn site’s hosting providers have bounced around the globe and premium memberships can be bought with cryptocurrency, which have made it virtually impossible to trace ownership.

Support Bellingcat

Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

Donate

Adam Dodge, the founder of EndTAB (End Technology-Enabled Abuse), said MrDeepFakes was an “early adopter” of deepfake technology that targets women. He said it had evolved from a video sharing platform to a training ground and marketplace for creating and trading in AI-powered sexual abuse material of both celebrities and private individuals.

“Our digital world is really good at empowering people who want to do harm by allowing them to remain anonymous while simultaneously making it almost impossible for victims to unmask them,” he said.

In January, Bellingcat, in collaboration with the German YouTube channel STRG_F, examined the companies behind two apps used for creating deepfakes that it advertised prominently on its homepage.

For this investigation, researchers conducted a forensic analysis of the forums on MrDeepFakes’ website. The forums are a virtual marketplace where members commission deepfakes and trade tips on making videos with the same technology that is used for creating revenge porn.

Videos posted to the tube site are described strictly as “celebrity content”, but forum posts included “nudified” images of private individuals. Forum members referred to victims as “bitches”and “sluts”, and some argued that the womens’ behaviour invited the distribution of sexual content featuring them. Users who requested deepfakes of their “wife” or “partner” were directed to message creators privately and communicate on other platforms, such as Telegram.

A search of the forums returned two accounts for MrDeepFakes “staff members”. One joined in March 2019 and is also listed as a “moderator”. The other joined in February 2018 and is also listed as an “administrator” (two additional administrator accounts, created in 2018 and 2021, were not listed as staff members, and one now-defunct account previously tagged as staff and moderator was created in the year after the site was set up).

Therefore, the focus of this investigation ​was the​ oldest account in the forums, with a user ID of “1” in the source code, which was also the only profile found to hold the joint titles of staff member and administrator. The long-time handle used by this account was “dpfks”.

Researchers began by analysing the profile. The dpfks bio contained little identifying information, but an archive from 2021 shows the account had posted 161 videos which had amassed more than five million views. It earned the badge of “Verified Video Creator”.

Forum posts document dpfks’ involvement as a creator and leader in the community. Archives show dpfks posted an in-depth guide to using software that creates deepfake porn, published website rules and content guidelines, advertised for volunteers to work as moderators, and gave technical advice to users. 

Dpfks’ posts carried the tagline: “Fake it till you make it.”

In a 2019 archive, in replies to users on the site’s chatbox, dpfks said they were “dedicated” to improving the platform. “There is a reason why we are the biggest deepfake site. I care about the community and teaching others.

“I don’t think other site owners care enough to make their own deepfakes, and keep uptodate [sic] with it. My first few deepfakes were s**t too, the more you make, the better you get.”

David Do’s Links to MrDeepFakes

Pirated Movies to Deepfake Porn

David Do keeps a low profile under his own name, but photos of him have been published on the social media accounts of his family and employer. He also appears in photos and on the guest list for a wedding in Ontario, and in a graduation video from university.

Do’s Airbnb profile displayed glowing reviews for trips in Canada, the US and Europe (Do and his partner’s Airbnb accounts were deleted after CBC approached him on Monday). His home address, as well as the address of his parents’ house, have both been blurred on Google Street View, a privacy feature that is available on request.

In the late 2000s, while studying at university, Do was involved in the creation of Xinoa (xinoa.net), a warez forum. Do’s personal Hotmail address, which includes his full name, is visible in source code as an admin contact for the site, archives from 2008 show.

The profile page “ddo” is tagged as the “Root Admin” and “Xinoa Owner”, and lists a date of birth matching that of Do. The profile includes download links to television shows, one of which was accompanied by a comment about “exam week” in 2009, when Do was studying at university. This username is also similar to Do’s Instagram profile (“ddo.jpg”), a link to which was included in the bio section of his Facebook account under the name “Doh Dave”. Both social media accounts have been deleted.

An account on an internet marketing forum was registered using a Xinoa administrator email address, breach data shows. That account was linked to an IP address owned by the University of Waterloo, where Do earned degrees in biomedical science in 2010 and pharmacy in 2014, according to Rocketreach.

The 2015 Ashley Madison data breach shows user “ddo88” registered on the dating site with Do’s Hotmail address and was listed as an “attached male seeking females” in Toronto. They described themselves as being of Asian ethnicity, 173 cm tall and weighing 66 kg. The breached profile was linked to a Toronto-based address and also contained a date of birth, which matches Do’s birth date in public records.

Xinoa would become the springboard for a more sophisticated operation.

In February 2018, when Do was working as a pharmacist, Reddit banned its almost 90,000-strong deepfakes community after introducing new rules prohibiting “involuntary pornography”. In the same week, MrDeepFakes’ predecessor site dpfks.com was launched, according to an archived changelog.

An analysis of the now-defunct domain shows the two sites share Google analytics tags and back-end software – as well as a forum admin who used the handle “dpfks”. Archives from 2018 and 2019 show the two sites redirecting or linking to each other. In a since-deleted MrDeepFakes’ forum post, dpfks confirms the link between the two sites and promises the new platform is “here to stay”.

“MrDeepFakes.com was formerly dpfks.com and we opened our doors shortly after the Reddit ban,” the 2018 post said. “I know joining a new forum or community feels like starting fresh, and starting over, but the community is small, and all the important players will stick together. I promise to keep this community running as long as I can, so that the deepfake community does not have to scramble and relocate again.”

Later in 2018, in a post on Voat, a defunct online message board similar to Reddit, dpfks said they “own and run” MrDeepFakes. In response to another user, dpfks refers to their life outside of operating a porn website. “I just got home from my day job,” the post said, “now back to this!” Some of dpfks’ earliest posts on Voat were deepfake videos of internet personalities and actresses. One of dpfks’ first posts on the MrDeepFakes’ forums was a link to a deepfake video of video game streamer Pokimane.

Other targets included the American politician Alexandria Ocasio-Cortez, for whom dpfks shared a folder containing more than 6,000 images that could be used to create deepfake pornography. Before it shut down this week, MrDeepFakes hosted 125 graphic videos tagged with Ocasio-Cortez that had collectively received more than 5.3 million views. After discovering she had been transposed into a deepfake porn video last year, Ocasio-Cortez told Rolling Stone that “digitizing violent humiliation” was akin to physical rape and sexual assault. 

Another target of dpfks was American YouTube personality Gibi_ASMR, who gained popularity online with her ASMR (Autonomous Sensory Meridian Response) videos. Dpfks created and shared pornographic deepfakes of the YouTuber on the MrDeepFakes forums. In a statement published by EqualityNow in 2021, she said: “They’re running this business, profiting off my face doing something that I didn’t consent to, like my suffering is your livelihood. It made me really mad, but again, there was nothing I could do so I just had to leave it.”

In 2018, dpfks posted a two minute deepfake video of an Academy Award-winning American actress with the description: “[Name omitted] doesn’t do porn, but in this fake video she is completely naked with her legs spread in the air. Watch her face … while she struggles to take it.”

Forum posts under various aliases match those found in breaches linked to Do or the MrDeepFakes Gmail address. They show this user was troubleshooting platform issues, recruiting designers, writers, developers and search engine optimisation specialists, and soliciting offshore services.

The username “AznRico” was commonly associated with Do’s email account and could be found across several postings online. In 2009, years before MrDeepFakes was launched, this now-banned user posted to an internet marketing forum discussing online money-making techniques, including the monetisation of video traffic.

AznRico also posted on an auto lighting forum in 2009 to ask for advice about fixing headlights for a car in Canada – a 2006 Mitsubishi Lancer Ralliart. In another thread on the same forum, AznRico uploaded several images of the car, one of which was archived and contained metadata indicating that it was captured on a Sony Ericsson K850i.

In 2008, on a separate forum, AznRico said he had this model phone and posted about troubleshooting the device (that forum was subject to a data breach exposing David Do’s personal Hotmail address and unique password).

Public records obtained by CBC confirm that Do’s father is the registered owner of a red 2006 Mitsubishi Lancer Ralliart. While Do’s parents’ house is now blurred on Google Maps, the car is visible in the driveway in two images from 2009, and in Apple Maps imagery from 2019. CBC confirmed the car was still at the house last week.

In 2011, on a freelance job board, AznRico asked for help building a video streaming plugin. This profile also listed that the user was based in the same Ontario city where Do’s parents’ home is located. In 2018 – the same year MrDeepFakes was launched – AznRico asked for advice to fix slow load times on their porn site, which they said received about 15,000 to 20,000 visitors a day. Breach data shows this account was linked to Do’s personal Hotmail address.

In one forum post from January 2020, user “dj01039” complains that PayPal had limited their “stealth account”, which was used to “sell virtual goods” (PayPal was intermittently available as a payment option on MrDeepFakes). The username dj01039 matches the abbreviation of an email address (davidjames01039@gmail.com) that was linked to a PayPal donation button on MrDeepFakes in December 2019. 

In June 2020, on another forum, a user with the same alias (who later changed it to “ac2124”) said their stealth account had been permanently closed and wanted to know about front companies that could accept payments on their behalf. The user described themself as the “webmaster of an adult tube site” who takes a cut from creators who post original porn videos, and also earns revenue from running ads. By December 2020, ac2124 said their website was earning between $4,000 and $7,000 a month.

Breach data also links the MrDeepFakes Gmail to an account on support forums for Kernel Video Sharing (KVS), a commercial content management system, where user “mongoose657” (formerly dj01039) sought help managing a video tube site. The discussions, from 2021 to 2024, were consistent with backend issues encountered when running a large website: storage solutions, ticket system failures, and outsourcing development work.

On the adult webmaster forum GoFuckYourself.com in 2020, dpfks (subsequently changed to “mjmango”) enquired about anonymous debit cards, which were advertised as allowing users to withdraw cash or pay for purchases anonymously. In 2021, mjmango responded to another user’s enquiry about how to monetise tube sites.

In another forum, ac2124 enquired about countries to form an offshore company and expressed concern about “know your customer” checks, which are used by the banking sector to confirm the identity of their customers. In a 2020 post, ac2124 said they had decided to make a “dummy site/front” for their adult site and enquired about online payment processing and “safe funds storage”.

In 2022, ac2124 sought advice for a Canadian citizen who operates an “adult niche website” and asked about “a company setup that focuses on privacy”. The post said: “At a bare minimum, this person shouldn’t be listed on any public registrar (as director, shareholder, UBO, etc). Open to using nominees, opening trusts, etc. What are some setups, or jurisdictions that should be looked into?” This user also asked specifically about setting up a company in the British Virgin Islands or Cayman Islands, both secrecy jurisdictions.

In late 2023, mjmango left positive feedback for an adult graphic designer below a post from the designer containing a MrDeepFakes logo. “Purchased another logo recently. As always great communication and allowed multiple re-edits,” the comment said. In March 2024, ac2124 posted about delays accessing a service that creates a “proxy” for a “high-risk website” so it can process transactions from the online payment processor, Stripe.

In April 2024, Dutch outlet Algemeen Dagblad (AD) reportedly made contact with the owner of MrDeepFakes, who was anonymised in their subsequent reporting. AD reported that this person claimed to have sold the website, but did not provide any evidence to support this claim. Our investigation could not confirm whether the site was ever sold, and if so when. 

David Do did not respond to multiple requests for comment about his involvement with MrDeepFakes.

Correction: This story initially said the AznRico post about the K850i phone was from 2009, when it was 2008. The article was updated on May 8 to reflect this.

Ross Higgins, Connor Plunkett, Beau Donelly, George Katz, Kolina Koltai and Galen Reich contributed to this article.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Unmasking MrDeepFakes: Canadian Pharmacist Linked to World’s Most Notorious Deepfake Porn Site appeared first on bellingcat.

This article is the result of a collaboration with The Sunday Times. You can find their corresponding piece here.

On the last Friday in December, a German businessman in his mid-40s allegedly met a small aircraft on a dusty runway in remote Western Australia. The following evening in Perth, seven hours’ drive south, he and another man were arrested and charged with trafficking a commercial quantity of a controlled drug.

Police said a search of their hotel rooms uncovered 200kg of cocaine, packed in suitcases in single one-kilogram blocks, along with night vision goggles, aviation equipment and a hardware cryptocurrency wallet.

It was the culmination of a three-month Australian Federal Police (AFP) investigation codenamed “Operation Mirkwood”. Authorities estimated the street value of the drugs to be AUD $65 million and AFP Inspector Chris Colley said an “organised crime syndicate” was likely responsible for the scheme.

The German businessman was Oliver Andreas Herrmann, a 44-year-old champion marathon runner and the director of multiple companies with diverse interests spanning various jurisdictions.

Herrmann and the other man who was charged are due to face court again in May. They have not yet entered a plea and the presumption of innocence applies. Herrmann, who has no known convictions, had not responded to multiple requests for comment as of publication. 

The Sunday Times reported in January that Herrmann has “close financial ties” to Christy Kinahan, the 67-year-old founder of the eponymous international drug cartel who is wanted by authorities around the world. Last month it reported that Herrmann “acted as Kinahan’s representative on the ground” in Indonesia and quoted a source who said Herrmann once introduced him to the cartel leader.

“Kinahan was Oliver’s boss,” the source told The Sunday Times. “He was afraid of him. Kinahan was always shouting at him.” 

Bellingcat and The Sunday Times have previously reported on the US-sanctioned Kinahan Organised Crime Group, using Kinahan’s own Google Maps profile to plot his movements over five years and identify the cartel leader’s business associates.

That investigation revealed that the normally elusive crime boss – known as the “Dapper Don” – posted hundreds of reviews under the alias Christopher Vincent, disclosing his precise locations across three continents, including in Dubai where he lives in hiding. Bellingcat contacted Kinahan but did not receive a response.

We have now conducted an open source analysis of Herrmann’s online footprint to build a picture of the man Australian authorities accuse of trafficking drugs last Christmas. The findings paint a portrait of an avid runner and international businessman who is more accustomed to poolside video conferences than an alleged drug drop in the Australian desert.

This investigation has traced Herrmann to locations associated with the cartel. These include a building in South Africa that Kinahan reviewed on his Google Maps profile, and to the Zimbabwean capital of Harare the day before a conference that the Irish drug lord said he attended.

It also sheds light on the complex network of international firms linked to Herrmann, either directly or through his associates. One of these firms shares an address with a company that reportedly received payments ultimately destined for Christy Kinahan.

Racing Around The World

Oliver Herrmann is a German national who has referred to Munich as his “home city”. He is also a South African resident, according to the AFP, and reportedly travels on a Swiss passport. Herrmann gave his nationality as Swiss in company documents filed in Singapore, while in registration documents in the UK he said he was German. He has listed his country of residence as Indonesia and Singapore.

Corporate records indicate that Herrmann has been involved at senior levels with companies active in the fields of fintech, mining and consulting. Until recently Herrmann was on the executive board of a German “international raw materials company” whose parent company, according to its website, is to be listed on the Düsseldorf Stock Exchange. The company told Bellingcat in February that Herrmann was removed from his board position after it learned about the allegations in Australia and said he no longer had any role with the organisation.

Herrmann’s Instagram account is set to private but he has a public profile on Strava, a fitness app used for recording exercise that often includes GPS-tracked routes (see Bellingcat’s Strava activity map guide here).

An acclaimed runner who won the 2016 Munich Marathon, Herrmann regularly logged his runs on Strava. Photos posted to the account confirm he is the same person pictured in an Australian media report about his court appearance in January over the alleged drug bust.

Herrmann’s Strava account has logged more than 2,500 activities in 29 countries across Europe, Asia, Africa, South America and the Middle East between 2013 and 2023. He has also posted at least 130 photos documenting his extensive travels. They show a dedicated athlete who appears to enjoy a jet-setting lifestyle, with many featuring scenic and tropical locations.

Herrmann’s Strava account shows that, like Kinahan, he has frequently traveled to Zimbabwe. An analysis of Herrmann’s runs shows he logged almost 500 activities in Harare between February 2018 and May 2022. Meanwhile, Kinahan posted 25 Google reviews in Harare between June 2019 and September 2021.

In one of these reviews, the leader of the transnational organised crime syndicate said he spent four nights at the Amanzi Lodge hotel for a “business networking conference” that was hosted by two companies. The conference ran from October 8 to 11, 2019, according to one of the company’s social media accounts. In two photos posted online, an individual with similar features to Kinahan is seen at the event.

On October 7, the day before the conference began, Herrmann logged a run just 5.5 km from the venue where Kinahan said he stayed. Herrmann’s 2019 Strava activity in Harare suggests he spent time close to this location, near the city’s affluent suburb of Borrowdale, with dozens of runs starting and ending on the same residential road. After October 7, Herrmann’s next Strava run was recorded three days later in Dublin, Ireland.

Two of Herrmann’s runs from 2021 and 2022 take place in downtown Dubai, about 250 meters and 550 meters from the office of a sanctioned company that the US government said is owned or controlled by Christy Kinahan’s son, Daniel Kinahan.

The 2021 run starts and ends outside a five-star hotel where Daniel Kinahan was photographed. The photo in the since-deleted tweet, which was the subject of media coverage at the time, was posted three days after Herrmann’s Strava run and geotagged to Dubai. A reverse image search shows that the picture of Daniel Kinahan was taken inside the Dubai hotel.

Herrmann’s Strava profile also displays information about his business activities. A 2018 post, captioned “Office view in ZIM”, includes a photo of an open document on a laptop screen. Titled “Mining Project Teaser”, the document touts the attractiveness of Zimbabwe’s “open for business” policy for foreign investors.

On the header is “Gemini Global Pte Ltd”, a Singapore-based company of which Herrmann is the director and secretary, according to corporate records. Herrmann reportedly filed a police complaint after Gemini lent US $500,000 for an Indonesian mining project that failed in the early 2010s. More than two dozen runs logged by Herrmann begin and end at the registered address for the Singapore company.

Other locations logged on Strava appear to be linked to companies Herrmann is involved in, suggesting his frequent travel may be business-related. Some runs explicitly mention an office, including one in Singapore in 2015 and three in Dublin in 2016.

Herrmann is listed on Crunchbase as the chief financial officer of defunct Irish fintech, Leveris Limited, which reportedly collapsed in 2021 with debts of €38 million. Records from Ireland’s Companies Registration Office show he was also a director of the company. Herrmann has logged Strava runs in Minsk and Prague, other cities where Leveris had business connections.

Running Mate

A series of companies involved in trade, real estate and corporate finance appear to be linked to Herrmann’s domestic partner. This woman was identified through an analysis of social media posts. In the comments of an Instagram post about his Munich Marathon win, several users tagged the woman’s account. Herrmann’s Strava profile also follows a user by the same name, and includes a photo of him with an identical-looking woman during a run in France.

An analysis of the woman’s Strava account shows that multiple runs logged in different countries over six years match where Herrmann’s GPS-tracked routes start and finish. She is tagged as a companion in at least one run recorded on Herrmann’s profile.

Three videos posted to the woman’s now-deleted Instagram account show a man strongly resembling Herrmann during a hike at Cape Town’s Table Mountain, visiting Mapungubwe National Park, and on a game drive with two boys near Lake Kariba. Photos also show a boat trip and a beach outing with several children in which a man with similar features to Herrmann is seen with his back to the camera. A photo posted to the woman’s Twitter account a decade ago also shows a man who resembles Herrmann.

The woman is also tagged in an Instagram post by a Thai mining magnate whose company is listed as a shareholder of the German company that recently removed Herrmann from its board. The Thai woman’s Instagram includes photos of Herrmann and his partner going back years, including during a 2022 “business trip” in Dubai.

The Corporate Web

An open source search identified a person with the same first and last name as Herrmann’s partner involved in three companies. Corporate records show she was listed as the owner of defunct Indonesian firm PT. Gemini Nusa Land, which was involved in real estate, and previously the director of another company, also headquartered in Indonesia.

The third company is South Africa-registered 247 Capital Group, where business data provider b2bhint.com lists her as a director. These details were verified through South Africa’s official registry. A generic-looking website for the firm says it is a leading “corporate finance group” staffed by “specialist capital raising managers”. The website’s contact section lists two addresses: one is a small house on Long Island, New York; the other is a high-rise building in Johannesburg called The Leonardo.

Herrmann’s Strava profile shows he has logged two morning runs ending directly outside The Leonardo, in April and May 2022. Kinahan has also been to The Leonardo: he wrote about visiting the building and posted photos of the interior in Google reviews from September 2021.

An analysis of 247 Capital’s website using ViewDNS, a tool that examines websites, determined that it shares an IP address with three other sites. There are multiple reasons why websites can share IP addresses and it does not necessarily mean they are related. In this case, however, there is evidence that 247 Capital may be linked to the other sites.

The first is for a US-based company called Ryba LLC; the second is for an Indonesia company called PT. Sukses Dagang Bersama (abbreviated to “SDB Trading” online); and the third is a placeholder for a web developer that designed the sites for 247 Capital, Ryba LLC, and PT. Sukses Dagang Bersama.

Herrmann’s partner had not responded to requests for comment as of publication. There is no suggestion that she is involved in illegal activity.

Ryba LLC

Last year, The Sunday Times reported that a company with a mailing address at the Trump Building was the recipient of two payments totalling US $850,000. It said the funds were lodged to a company account in South Dakota and the beneficiary was listed as Adam Wood, a known associate of Kinahan who attended a 2019 aviation conference in Egypt with the cartel leader. The newspaper said these payments were part of a series of international wire transfers totalling US $1.25 million of which Kinahan was the ultimate beneficiary.

Today, The Sunday Times reveals that the payments of US $850,000 were made to Ryba LLC.

Ryba LLC’s website lists its address as the Trump Building on Wall Street in New York. Companies with this name are registered in the US, but corporate records show that none are located in New York.

The phone number on Ryba LLC’s website was linked to a New York law firm via the crowd-sourced contact book app, TrueCaller. An online search for the firm shows it has an office in the Trump Building, and searches for the Long Island address listed on 247 Capital’s website returned a hit for a lawyer who works at this firm.

The Long Island address also appeared in a small-claims court record, which named the home owner as the lawyer who works in the Trump Building. A digital copy of the deed from the Nassau County Clerk shows the lawyer bought the house 25 years ago. Bellingcat called the Clerk’s office to confirm the deed was still current.

According to the lawyer’s bio, they are an “Anti Money Laundering Specialist” who works in wealth and tax planning, trust and estate administration, and asset protection. The lawyer and the firm had not responded to requests for comment as of publication. There is no suggestion that the lawyer or firm are involved in illegal activity.

Searches on LinkedIn for staff who work for Ryba LLC returned a result for an employee who lists their current role as a senior project finance manager at the company. Their previous position, according to the profile, was head of accounting at Leveris, the Irish company where Herrmann previously served as chief financial officer.

In the photo on Herrmann’s Strava account showing the mining proposal document, a meeting notification for the employee is visible in the top right of the laptop screen. The employee’s LinkedIn account is no longer online, but their details have been saved on RocketReach, a site that aggregates professional data from online platforms.

The employee had not responded to requests for comment as of publication. There is no suggestion that they are involved in illegal activity.

PT. Sukses Dagang Bersama

Bellingcat purchased the Indonesian corporate record for PT. Sukses Dagang Bersama. Its “commissioner” is listed as Conor Fennelly, Herrmann’s former business partner and one-time chief executive of Leveris.

However, Fennelly told Bellingcat that he had “never heard of” the Indonesian company and had “no knowledge” of its operations. He also said he had no business connection to Herrmann outside of Leveris and had not been in contact with him since the Irish tech firm collapsed in 2021.

After providing a copy of the Indonesian business documents showing his listing as commissioner, Fennelly said he “didn’t authorise this” or sign paperwork taking on any role at the company. He confirmed that his name, address and passport information on the document was accurate.

“Oliver and several others at Leveris would have had that,” he said. “The company was founded [in] 2021 and interestingly this is months after Leveris went under and months after my last contact with Oliver, assuming he is the reason my name appears here.”

Fennelly said he met Herrmann through an associate at Leveris in 2016, and that Herrmann subsequently invested in the company and became its chief financial officer. Fennelly found Herrmann to be “reliable, calm, competent and trustworthy”, he said, adding that news of his arrest in Australia came as a “complete shock”. Fennelly said he believed Herrmann had been living in Zimbabwe and training as a runner.

Corporate records also show that PT. Sukses Dagang Bersama was originally established in 2013 under a different name, Maksimum Jaya Segar. A person with the same first and last names to Herrmann’s partner is listed as a director of the company from December 2017 to November 2021. Her listed address is in a residential neighbourhood west of Jakarta, where Herrmann and his partner have logged dozens of runs.

Aircraft and International Trade

PT. Sukses Dagang Bersama was involved in the sale of an aircraft that was exported from the US to Africa last year, Federal Aviation Administration (FAA) records show. The FAA documents say the company bought the plane – a Beechcraft King Air 350 – in early 2024.

Flight tracking website ADS-B Exchange shows that the twin-turboprop aircraft arrived in Harare after the last leg of its journey on February 23, 2024. The ferry pilot who transported the aircraft posted images of the trip to Facebook, which were tagged in Harare on the same date. The plane has been active since its delivery, travelling to airports in Zimbabwe, South Africa and Botswana. Images from plane spotters in South Africa in April and May 2024 show the aircraft with Malawi registration number 7Q-YAO on its side.

Two days after the plane was delivered to Harare the pilot posted a photo of himself with three other men in front of the aircraft, captioned “Acceptance demo flight”. The pilot and one of these men have previously flown a different aircraft, a Pilatus PC-12, that has been associated with a Kinahan-linked company.

The US $850,000 payment to Ryba was linked to a dispute over the purchase of this aircraft, according to The Sunday Times.

The pilot posted a photo to Facebook before transporting the Pilatus PC-12 from South Africa to the US in 2022 after it was sold to an unrelated buyer. But three years earlier, the Pilatus PC-12 was pictured in a Twitter post by CVK Investments LLC, a company that Irish police said was associated with Kinahan.

The July 2019 post said CVK was investing in the aircraft for an “air ambulance joint-venture business in Africa”. The aircraft pictured in the post shows its serial number “342”, matching the plane in the pilot’s Facebook post. While an aircraft’s registration number can change, the serial number is assigned by the manufacturer and remains the same (see Bellingcat’s flight-tracking guide here).

The second man is an employee at Malawi’s aviation authority who is referenced in a Facebook photo as being one of the pilots during an August 2021 flight in the Kinahan-linked Pilatus PC-12.

The identity of the Malawi-registered plane was confirmed by its registration number at the time, “7Q-XRP”, visible on the control panel in the photo. The cockpit is identical to one pictured in a Google review posted by Kinahan a month later in September 2021.

The pilots had not responded to requests for comment as of publication. There is no suggestion that they are involved in illegal activity or that either of the planes has traveled to Australia.

PT. Sukses Dagang Bersama is also listed in publicly available import/export records for mining-related and narcotic products between countries including India, Nigeria, Peru, Turkey and Russia.

Records from import/export data provider 52wmb show that in one 2023 shipment from India to Nigeria, PT. Sukses Dagang Bersama is listed in the product description for a delivery of the narcotic “Pentazocine Injection”, an opioid used in medicine that is also reportedly misused and sold on the underground market in Nigeria.

Also listed in the product description field is another company, Turkoca Import Export Transit Co Ltd. This Korean-based company was sanctioned by the US in May 2022 for being part of an Iran-linked oil smuggling and money laundering network.

The product description usually contains information about the items being exported. A potential explanation for company names appearing in this section is that they are “notify parties”, which are entities such as buyers, suppliers and brokers who should be informed when the cargo arrives. PT. Sukses Dagang Bersama appears as a “notify party” in the product description for another shipment to Nigeria from a different Indian pharmaceutical company.

PT. Sukses Dagang Bersama is also listed in 2024 import records for shipments of accessories for heavy machinery to Turkey from a Peruvian company that makes mining equipment. In records from Dataontrade.com it also appears as an exporter of “spare parts” for similar machinery, this time from Turkey to Russia.

Oliver Herrmann had not responded to requests for comment as of publication. Herrmann’s lawyer said: “I am not instructed to comment on these matters.”

Emails to 247 Capital Group, Ryba LLC and PT. Sukses Dagang Bersama were not returned.

Australian Cocaine Charges

Oliver Herrmann and his co-accused, Australian man Hamish Scott Falconer, 48, appeared in Perth Magistrates Court in January. Both men have been charged with one count of trafficking a commercial quantity of cocaine.

Herrmann also faces four counts of failing to comply with an order, according to a report in The West Australian, while Falconer is also facing one count of possessing a controlled drug and one count of failing to comply with an order.

Local media reported that neither of the men applied for bail and no pleas were entered.

The Australian Federal Police said the men were arrested in Perth’s central business district on December 28 as part of an operation that began in October.

The AFP alleges that the men met at Perth Airport in November and drove to Kojonup Airport, about 250km south of Perth. Investigators said the pair departed Western Australia in the following days but later returned separately.

Falconer returned to Perth on December 26, according to police, where he hired a vehicle and transported multiple suitcases and jerry cans. Herrmann allegedly met a small aircraft at the Overlander Airstrip on December 27, returning to Perth and meeting Falconer the following day. Police said that the men bought more suitcases, before discarding them along with jerry cans in a shopping centre rubbish bin.

Police said a search of Falconer’s hotel room uncovered about 200kg of cocaine, in six suitcases, as well as electronic devices, night vision goggles and an airband VHF radio. They said they searched Herrmann’s hotel room and seized four empty suitcases, aviation navigational equipment, a hardware cryptocurrency wallet and other electronic devices.

Both men were charged with trafficking a commercial quantity of a controlled drug, which carries a maximum penalty of 25 years’ imprisonment.

Local media reported that Herrmann and Falconer are due to appear in court again in May. 

Connor Plunkett, Peter Barth and Beau Donelly contributed to this article.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Nowhere to Run: The Online Footprint of an Alleged Kinahan Cartel Associate appeared first on bellingcat.