# Forensic Extraction — VEAVOR group + AUS Laos Greg chats

Source: /Users/Office/Downloads/WhatsApp/extracted/{VEAVOR,AUS-Laos-Greg}/
Coverage: May 2025 → May 2026. Extracted 2026-06-11 by subagent read of full transcripts.

---

## 1. CHRONOLOGICAL TIMELINE

**MAY 19–21, 2025: Initial Setup**
- **5/19/25, 12:33 PM** — Greg initiates contact. Sam receives Greg's number from Gary.
- **5/19/25, 12:36 PM** — Greg makes Sam admin of Modern Lao Homes Facebook page; requests credentials for transfer.
- **5/19/25, 12:44–12:50 PM** — Facebook business account setup. Sam creates new admin account (Skill Whales / skillwhales@gmail.com). Transfer completes.
- **5/19/25, 12:51–12:57 PM** — **CRITICAL:** Greg discloses hosting architecture. Toto (unknown entity) deleted old webpage. Greg maintains shared cPanel with 12 other sites; will not grant root access. Greg's email `greg@modernlaohomes.com` = 9-year primary (must preserve). Greg agrees to send old files to new host once deployed.

**MAY 21–23, 2025: Domain Transfer Initiation**
- **5/21/25, 10:44–10:49 AM** — Sam proposes cPanel email backup + Cloudflare nameserver delegation to avoid downtime. Greg agrees, returning from Laos Saturday; prefers next week (5/26+).
- **5/23/25, 9:25 AM** — Greg deletes a message (content unknown).

**MAY 27–28, 2025: DNS Configuration**
- **5/27/25, 2:27–2:39 PM** — Sam requests hosting transfer clarity. Greg confirms: website was deleted (against his advice), only email setup needed. Sam proposes creating new host + updating DNS for seamless transition.
- **5/27/25, 3:02 PM** — Sam reports: new hosting created, email address created, mail forwarding set up to greg@bunnasia.com.
- **5/28/25, 8:02 AM–2:45 PM** — Greg requests nameserver IPs. Sam provides Cloudflare (indie.ns.cloudflare.com, matias.ns.cloudflare.com). Greg asks if Bluehost; Sam clarifies different provider. Greg acknowledges nameservers changed.

**MAY 29, 2025: Email Crisis & Resolution**
- **5/29/25, 5:57–7:45 AM** — **MAJOR INCIDENT:** Greg reports email forward + website down (urgent). Sam investigates (15 min response window). Issue: bounce from old Bluehost server. First-pass "fixed" but sender error persists ("user doesn't exist"). Greg provides LMTP error diagnostics. Sam commits: "It will be done 💯✅"
- **5/29/25, 7:05–8:46 AM** — Sam confirms incoming/outgoing working from his end. Greg agrees DNS propagation may take 24h. Sam sends Bluehost email (escalation). Email credentials shared: greg@modernlaohomes.com (forwarded to greg@bunnasia.com, not IMAP).
- **5/29/25, 8:08–8:42 AM** — Email still bouncing 6h later. Greg traces DNS (all correct). Sam expects 24h propagation window. Greg requests domain transfer EPP/auth code.
- **5/29/25, 7:28–7:42 AM** — Landing page + nameservers updated. Greg requests email for domain transfer. Sam provides: skillwhales@gmail.com. Greg sends EPP code (7:41 AM).

**MAY 30–31, 2025: Domain Transfer Completion**
- **5/30/25, 11:35–11:38 AM** — Sam updates: awaiting release from previous owner. Greg confirms GoDaddy shows no further action needed.
- **5/31/25, 2:40–2:44 PM** — **DOMAIN RELEASED.** Greg confirms. Sam asks: emails working properly? Greg thinks yes.
- **5/31/25, 4:39–7:16 PM** — **SECOND ISSUE:** Sam cannot download files from Greg's OneDrive (1drv.ms link). Greg updates link with new sharing token. Resolved.

**JUNE 26, 2025 → MARCH 26, 2026: Silent Period (9+ months in VEAVOR)**
- **6/26/25** — VEAVOR: Gary "Thank you," Sam replies.
- **6/29/25–7/16/25** — Laos Gary leaves/rejoins VEAVOR group. Sam sends PDF (Variations 12-07-2025).
- **7/16–7/17/25** — Laptop backup/storage work.
- **8/7/25** — Two DOC files sent. **8/26/25** — Laos GS leaves VEAVOR. Group dormant 8/26/25 → 3/23/26.
- AUS-Laos-Greg silent 6/1/25 → 9/4/25.

**SEPTEMBER 4–5, 2025: Email Failure (Repeat)**
- **9/4/25, 5:09 PM** — Sam: Gary reported hosting issue. Greg: **emails not working again.** Sam promises permanent solution in hours; apologizes "very important emails are missing due to this issue."
- **9/5/25, 11:17–11:24 AM** — Greg: "yes I think it is working now thanks."

**DECEMBER 25, 2025 → JANUARY 11, 2026: Holiday + Facebook Fraud**
- **12/25/25, 11:40 PM** — Sam sends Christmas greeting (first outreach in 3+ months).
- **1/11/26, 4:25 PM** — **CRITICAL:** Greg reports: email down AGAIN + **Facebook fraud**: Modernlaohomes account hacked, scammers ran malicious ads, **Facebook charged Greg $900** on his ad-account credit card. Greg asks: fix email, transfer Facebook off his ad account, create new FB account.
- **1/11/26, 4:58–5:56 PM** — Email "seems to be working now." Sam: "Emails working fine, they will not stop. Facebook = zero idea, will check with Gary." Acknowledges $900 "not small amount," promises solution. Greg confirms he sent Gary screenshots.

**MAY 7, 2026: Email Routing Migration (Latest)**
- **5/7/26, 7:12–7:27 PM** — Sam migrates email to **Cloudflare Email Routing**; Greg clicks verification link; Sam: "It's done! It's working if any issues let me know." Greg: "thanks."

---

## 2. MONEY MENTIONS

| Date | Amount | Who | Quote/Context | Status |
|------|--------|-----|---------------|--------|
| 5/21/25, 1:13 PM | USDT/crypto setup | Gary → Sam | "can you open a binance account for veavor" / "fiat xfer out from usdt" / "its time to rock and roll" | Not completed — Laotian KYC blocked Binance; Mexc/Bybit offered; no follow-up |
| 7/16/25, 1:18 PM | $15.12 USD | Sam (VEAVOR) | 2TB storage upgrade; Gary approves "Whatever is best for now" | Likely paid; no receipt visible |
| 1/11/26, 4:25 PM | **$900 USD** | Greg | Facebook fraud charge on Greg's card | **UNRESOLVED** — no follow-up visible through 5/7/26 |

---

## 3. PROMISES (kept/broken)

| Date | Who | Promise | Status |
|------|-----|---------|--------|
| 5/21/25 | Sam → Gary | Binance corporate account for VEAVOR | Not executed (KYC blocked; alternatives never revisited) |
| 5/29/25 | Sam → Greg | "It will be done 💯✅" (email fix) | Worked, but failed again 9/4/25 and 1/11/26 |
| 9/4/25 | Sam → Greg | "Permanent solution for your emails — won't have any issues at all" | Failed again 1/11/26; final fix = Cloudflare migration 5/7/26 |
| 1/11/26 | Sam → Greg | "$900 is not small amount, I will definitely check and update you" | No documented follow-up through 5/7/26 |
| 5/7/26 | Sam → Greg | Cloudflare email "It's done!" | Unconfirmed by independent test |

---

## 4. MISSED CALLS & RESPONSE GAPS

- No missed-call log lines in these two chats. Gaps instead:
- 6/1/25 → 9/4/25 (95 days, Greg chat): silence post-domain-transfer; email failure discovered at end of gap.
- 9/5/25 → 12/25/25 (112 days): no proactive checks; email fails again 1/11/26.
- 1/11/26 → 5/7/26 (147 days): Facebook fraud promise has zero follow-up; next contact is email-migration notice.
- VEAVOR group dormant 8/26/25 → 3/23/26.

Pattern: fixes declared complete → months of silence → failure rediscovered by Greg.

---

## 5. WORK SAM DELIVERED

### VEAVOR chat (artifacts present in folder)
| Date | Work | Files | Status |
|------|------|-------|--------|
| 5/21/25 | Domain registration/DNS | 4 IMG screenshots | Delivered |
| 5/22/25 | MacBook backup consult | 2 IMG | Consulting |
| 5/31/25 | Domain + hosting acquisition — "Modern Lao — Domain Transferred To us (We own it) + Hosting is with us" | — | Delivered |
| 7/16/25 | Storage plan (30GB $7.56 vs 2TB $15.12) | 2 IMG + PDF | Delivered |
| 7/16–17/25 | Data backup + laptop management; "eliminate toto" request postponed | — | Partial |
| **7/22/25** | **LOGO DESIGN PACKAGE — 13 files** (logo.ai, WHITE LOGO.ai, NEW LOGO1–6.ai, mlh logo.docx, Variations 12-07-2025 docx+pdf; "sign 2 fix.ai" omitted from export) | 13 files | **Delivered** |
| 8/7/25 | Project documentation | DOC-20250807-WA0016/0017 | Delivered |
| 3/23–3/31/26 | GPT project shares + Google Meet test | links | Referenced |

### AUS-Laos-Greg chat
| Date | Work | Status |
|------|------|--------|
| 5/19/25 | Facebook page admin transfer (Skill Whales account) | Delivered |
| 5/19–28/25 | Domain + hosting transfer, Cloudflare DNS | Delivered |
| 5/27–29/25 | greg@modernlaohomes.com → greg@bunnasia.com forwarding | Partial (recurring failures) |
| 9/4–5/25 | Email troubleshooting | Incomplete (failed again 1/11/26) |
| 5/7/26 | Cloudflare Email Routing migration | Pending verification |

---

## 6. ASSOCIATES

- **Gary** (Laos MLH Office Gary / Laos Gary / Canada Gary): principal, owner Modern Lao Homes. Initiates requests (domain, crypto, storage, laptops); approves designs; delegates execution to Sam. Asked for Binance/USDT corporate setup 5/21/25 — stalled.
- **Greg** (AUS Laos Greg): technical custodian of old hosting (shared cPanel, 12 sites), 9-year primary email greg@modernlaohomes.com, controlled domain transfer authority. Technically competent (LMTP diagnostics, DNS traces). Absorbed $900 Facebook fraud charge. Patient, professional escalations.
- **Toto**: unknown contractor — deleted the old website against Greg's advice; Gary ordered "eliminate toto from everywhere" (laptop, 7/16/25).
- **Deepak/Deepu**: creative department; Sam: "I am really putting effort with Deepak" (7/17/25).

---

## 7. HIGH-VALUE OMITTED MEDIA

| Date | Sender | Context | Significance |
|------|--------|---------|--------------|
| 7/22/25, 11:45 AM | Gary | "sign 2 fix.ai" in logo batch | 1 AI file missing from export |
| 1/11/26, ~4:25 PM | Greg | Facebook fraud evidence screenshots (IMG-20260111-WA0010/0011 present in folder) | Fraud evidence — present, verify |

(Most media for these two chats IS included in the zips — 41 files total.)

---

## 8. OPEN THREADS AT CHAT END

1. **Crypto account (Binance/Mexc/Bybit)** — stalled since 5/21/25, never executed.
2. **Facebook fraud $900** — reported 1/11/26 with evidence; no resolution documented.
3. **Email reliability** — 3 failures over 8 months; Cloudflare migration 5/7/26 unverified.
4. **Laptop "toto elimination"** — postponed 7/16/25, no follow-up.
5. **modernlaohomes.com website rebuild** — "ready to ask developers" 5/31/25; no site built in this chat's window.
6. **Old website files from Greg's cPanel** — offered 5/19/25, never transferred.

---

## DOSSIER SUMMARY (this slice)

- **Work delivered by Sam:** full digital-infrastructure takeover (Facebook page, domain, hosting, DNS, email) May 2025; 13-file logo/branding package Jul 2025; storage/laptop ops; Cloudflare email migration May 2026.
- **Gary's pattern visible here:** delegates everything, pushes crypto setup ("time to rock and roll") then drops it; Greg (his associate) left carrying a $900 fraud charge with no resolution from Gary's side.
- **Caveat for publication:** this chat also shows gaps on Sam's side (email re-failures, $900 follow-up) — cross-check before publishing one-sided claims.