Need your help! Trying to locate possible thief.

[Dimva]

Hello all,
First I will try to explain the story:

I run a big site with over 20k members. I had some problems with it so i decided to hire a guy to fix the mysql/php stuff to run better (I suck at all the server details etc)

So I found a guy which use to run sites in the same niches before and we agreed that he should fix the problems in 1-2 days. (this is more then 2 weeks ago now).

I had some "bad feelings" about him (and of course i should have listen to them) but I did ask about his personal info and this what he gave me:

Eric Nolan
4016 W. 93rd Pl.
Oak Lawn, IL 60453

Can someone verify if this is real info or he gave me false?
Later on i found out in a profile on a forum he said he was from Chicago.

Anyways, the conversation took place via MSN, and days went by without he contacted me. He was online on MSN and changed status to away, online several times , he also was online on the other forum several times. So he just avoided me. After some days he finally responded and he said I will fix it right now as its a really easy task then nothing happened.

I tried to contact him SEVERAL times via email, msn and PMs but he refuse to answer me. The trouble is I gave him the server logins etc, which gave him access to the entire server, including member databases, graphics, script and yes.. everything (password is encrypted though)
Most likely he just stole everything and never ever thought about fixing the problem i needed help for. If he just would have sent me a email or something "I don’t have time at the moment" I wouldn’t bother, but he choose to avoid me.

So now I need your help trying to locate him. He calls himself "ensworld" and using the email: [email protected] and [email protected]

As I said before he gave me this info before the deal:

Eric Nolan
4016 W. 93rd Pl.
Oak Lawn, IL 60453

If someone could be so kind and check if it's valid or not i would be happy!
Also i did some investigation on my own and found one of his older domains and this was the whois info:

ENS
Eric S (Whois Privacy and Spam Prevention by DomainTools.com)
+1.7022222222
Fax: +1.7022222222
9360 W. Flamingo Rd
Suite #110-181
Las Vegas, NV 89147
US

Also have his ip:
71.239.132.147

So if any member located in the states can try you verify the above info, or if you know anyway how I can get this guy please contact me!

Just want to mention again, the whole conversation took place on msn and not on DNF so I’m not sure if he is a member or not here!
Would really appreciate your help

Thanks,
Jens

 

[tekz999]

I think you can check the server logs for FTP downloads? and see what he has downloaded?

 

[Dimva]

I think you can check the server logs for FTP downloads? and see what he has downloaded?

Thanks for the suggestion, Gilbert!
Not sure if thats possible but I will look into it!
Cheers,
Jens

 

[Gramma]

OAK Lawn is close to Chicago - so it would be common to say "From Chicago"

I'm pretty sure I'd be changing my passwords - pronto

 

[Dimva]

OAK Lawn is close to Chicago - so it would be common to say "From Chicago"

I'm pretty sure I'd be changing my passwords - pronto

Thanks!
Yeah i changed password now, also did some research (afterwards) that someone created a thread "Beware of ensworld" on a forum. So most likely his intentions was bad.

 

[Johnn]

You are brave.
Whatever he did bad or good - it is already done.

What would happen if he download everything, CHANGE THE PASSWORD and never contact you again?

I am not sure if contacting him or find out about would do any good.

 

[Dimva]

You are brave.
Whatever he did bad or good - it is already done.

What would happen if he download everything, CHANGE THE PASSWORD and never contact you again?

I am not sure if contacting him or find out about would do any good.

Yeah, but im that kind of guy who dont let a thief just get away with things like this.. At least i deserve an explanation.

All my sites is running on my dedicated server, so i got fully access over all the accounts, so if he did change password i can easily rechange via whm. He "just" had access the server via cpanel and not whm.

Anyone that can verify the contact info above?

Can someone please verify the contact info i posted? Must be possible to check online or something?