Case Timeline
Reconstructed from email, Google Chat, WhatsApp OCR, and voice transcripts.
- 2026-06-17·Ameer HamzaWARNING
Peak Drive access on Master MIS 2025
1,516 events from 110.93.244.209 (PK-SD) against ' Team-Master MIS 2025' owned by hassan@backcheckgroup.com.
- 2026-06-05·Muhammad Yousuf KhanCRITICAL
Outbound: Stationary Stock Log emailed externally
'Stationary Stock Log - 2025.xlsx' sent as email attachment to noorbcg1@gmail.com from 72.255.61.202 (PK).
- 2026-05-12·GoogleCRITICAL
'Suspicious Activity' Alert
Google security alert triggered on noreply@backcheckgroup.com.
- 2026-05-11·noreply@backcheckgroup.comCRITICAL
App Password Created — 'SMTP of Backcheck Portal'
Persistent SMTP relay credential generated. OCR: Screenshot 2026-05-11 042313/042708.
- 2026-05-11·Kashif Wali accountCRITICAL
Google Takeout Completed
Takeout export coincides with account manipulation.
- 2026-05-10·Vikash HarjeewanWARNING
RDP & Server Config Discussion
Discussions of RDP access and server configuration.
- 2026-05-10·Unknown OperatorCRITICAL
Kashif Account Disabled / Re-enabled
Account toggled; password rotated; 20 recovery emails purged; 2FA removed.
- 2026-05-09·Vikash HarjeewanWARNING
Anomalous WhatsApp Volume
26 voice notes in a single day discussing 'suspicious' setups and data manipulation.
- 2026-05-08·noreply@backcheckgroup.comINFO
2SV Screenshot Captured
Screenshot evidence: 2-Step Verification active.
- 2026-05-07·noreply@backcheckgroup.comWARNING
QR Verification
QR code verification captured for noreply mailbox.
- 2026-05-07·noreply@backcheckgroup.comWARNING
2-Step Verification Configured
Recovery phone set to 03007419191.
- 2025-11-10·Vikash HarjeewanWARNING
Scam Data.rar Discovered
18 GB archive (SDN, cross-check, wiki) on Vikash desktop.
- 2025-04-25·SECPWARNING
SECP Correspondence
Primary SECP filings and replies through May–June 2025.