Skip to content

Back to the catalog

Inside EQIBank’s $84M seizure
protos.comarticle

Inside EQIBank’s $84M seizure

Protos investigative article unpacking the DOJ's $84M civil forfeiture against Capstone Limited, a payment processor used by Dominica-based EQIBank (which handles Tether reserves), for misrepresenting itself to Wells Fargo, JPMorgan Chase and Citibank as a software firm rather than a money services business. The piece uses OSINT techniques — corporate registry tracing, shared-hosting IP correlation, DNS lookups, and court filing cross-referencing — to map operator Kotaro Shimogori's decade-long history running shell payment processors (ComCopious, iCanPay, AuthPay, Pan Digital Network) for high-risk clients including gambling sites and, per the forfeiture complaint, impersonation-fraud scam proceeds funneled through Chase accounts. It also details EQIBank's EQIFi/EQX DeFi token, and links Marlin Capital Partners and Deltec Bank figures to Tether's banking history, drawing parallels to the earlier Crypto Capital Corp seizure.

TL;DR Deep OSINT-driven investigation into Capstone Limited's $84M DOJ seizure, exposing operator Kotaro Shimogori's shell-company payment-processing network and its ties to EQIBank, Tether, and impersonation-scam proceeds.
Open original ↗
Document

What it is

OSINT methodology for unmasking shell payment processors tied to Kotaro Shimogori — the operator behind Capstone Limited, ComCopious, iCanPay, AuthPay, and Pan Digital Network — using shared-hosting correlation and stale DNS resolution against a specific IP, 78.129.240.8.

How it works

Multiple domains tied to Shimogori's network resolve to the same hosting IP, 78.129.240.8, linking otherwise-separate shell entities (ComCopious, Caikhien, Secher, Capricorn Innovations, Trans Global Systems Ltd). One specific technique: niko-niko.co.uk no longer has public DNS entries, but querying 78.129.240.8 directly to resolve that hostname still returns the site, which still identifies AuthPay Limited as operator and credits Shimogori in its meta tags. A live sibling domain, nikoniko.co.uk, carries the same AuthPay/Shimogori attribution in its page source, corroborating the dead domain's content. Corporate registry tracing also disambiguates at least six similarly-named "Capstone"/"Pan Digital Network" entities across Hong Kong, Singapore, California, Montana, and the UK — critical because conflating them would misattribute liability.

Preconditions / Affected

Applies when a target's public DNS has been pulled but the hosting IP is known or discoverable (e.g., via historical DNS, shared-hosting fingerprinting, or certificate/ASN pivoting) — the origin server may still serve the site to direct IP+Host-header requests, and page source/meta tags often retain operator attribution even after the public-facing DNS trail is cut.

What to do

Reproducible technique: resolve a suspect hostname directly against a known shared-hosting IP (e.g., via curl --resolve domain:80:IP or an /etc/hosts override, or querying the IP's DNS service directly) rather than relying on public DNS, since takedown of DNS records doesn't necessarily take the underlying content offline. Pair this with corporate-registry cross-referencing to separate entities sharing near-identical names before attributing conduct to any one of them.

Caveats

The page doesn't specify how the IP 78.129.240.8 itself was discovered (no stated pivot method — e.g., no passive-DNS tool or cert-transparency source named), so the full reproduction chain from "find Shimogori domain" to "find shared IP" isn't documented, only the final confirmation step.

Organisations named here

  • AuthPay Limited
  • BankPro
  • Beyond Enterprises
  • Brad Yasar
  • ComCopious Limited
  • Deltec Bank and Trust
  • EQIFi
  • FinCEN
  • Fresh Horizons Limited
  • Helexo
  • iCanPay
  • impersonation fraud scam
  • Marlin Capital Partners
  • Pan Digital Network
  • Richard Heathcote
  • TechnoUnicorn Ltd
  • Twenty One
  • Unus Sed Leo
  • Zachary Lyons

Technologies named here

  • EQIBank
  • Tether
  • Bitfinex
  • EQX token
  • Unus Sed Leo token
  • Wells Fargo account x7500
  • JPMorgan Chase account x6970
  • Citibank
  • DBS Bank
  • Barclays Bank and Clear Bank accounts
  • Bitcoin

Techniques named here

  • Impersonation fraud
  • Business-purpose misrepresentation to banks
  • Fabricated contracts and invoices to disguise fraud proceeds
  • Mislocated/backdated regulatory registration claims
  • Shell-company layering across jurisdictions
  • Shared infrastructure obscured by stale/hidden DNS

Threat actors named here

  • Capstone Limited
  • Kotaro Shimogori
  • Mary Jeanne Thompson
  • Unidentified impersonation-fraud scammers
  • Crypto Capital Corp

Related in Threat Intel