SARMENB.COM INVESTIGATION — OPEN QUESTIONS & REMAINING LEADS
==============================================================
Date: 2026-03-04

PRIORITY 1 — CRITICAL QUESTIONS
---------------------------------

1. DID PIRAGENEH OPERATE THE KOREAN ESCORT DIRECTORY?

   Evidence FOR:
   - Domain was his personal brand for 5+ years
   - His tech stack (PHP, Laravel, MySQL, Kali Linux) matches Gnuboard CMS
   - Domain returned after 2021 hijack — someone reclaimed it
   - Wildcard cert issued Jan 2026 = active infrastructure expansion
   - GitHub updated Jan 2026 = still active online in same period
   - Domain was his personal brand — unlikely hijacked twice unnoticed
   - 107 GitHub stars include privacy tools (private-gpt)

   Evidence AGAINST:
   - Korean escort directories are typically Korean-operated
   - No Korean language tied to his personal accounts
   - Domain may have been sold to Korean operator
   - The Chinese phase (2021) proves the domain was compromised before

   UNRESOLVED. Need WHOIS history to determine if ownership transferred.

2. WHAT IS AYSALIST ACTUALLY BUILDING?

   Known: API, payment processing, file storage, Armenia + USA expansion
   Unknown: What service does it provide? Directory? Marketplace? Logistics?
   The "Coming Soon" page has been up since Jun 2024 while backend is active.
   The Armenia subdomain is notable given his Armenian heritage.

3. WHY THE RELOCATION TO DALLAS?

   GitHub sarmenb updated to "Dallas, Texas" by Jan 19, 2026.
   Possible reasons:
   - Distancing from California activities
   - Cost of living
   - Business reasons
   - Law enforcement pressure
   - Personal reasons (post-divorce fresh start)

PRIORITY 2 — FOLLOW-UP LEADS
-------------------------------

4. AYSASOFT 2018-2019 SNAPSHOTS
   The Wayback captures are 1.1 MB and 1.9 MB respectively.
   These large JavaScript applications have not been fully analyzed.
   They may reveal what AysaSoft was building during its active phase.

5. CROSS-DOMAIN CERTIFICATE CONNECTIONS
   aysalist.com shares certs with:
   - orcus.mx (notable name — Orcus RAT exists)
   - jazzassist.com
   - sunderdeepworld.in
   - caleb-eason.live
   Investigate these domains. Are they Pirageneh's? Client sites? Unrelated?

6. GOOGLE ANALYTICS G-4ZC7SV3YM4
   Found on aysasoft.com (2021 Persian Angular SPA).
   This GA4 property may be linked to other sites under the same Google account.

7. FACEBOOK PROFILE FROM PHOTO ID
   Filename: 564174_2809407884551_1423162769_n.jpg
   Old Facebook format: {albumID}_{photoID}_{sequence}_n.jpg
   The number 2809407884551 may resolve to a Facebook photo or profile.
   Requires authenticated Facebook access to test.

8. ELSA STUDIO — 4 UNKNOWN DOMAINS
   Registered March 2, 2015. Names partially redacted on ClustrMaps:
   C*****.info, A*****.info, C*****.org, C*****.us
   Historical WHOIS lookup services may reveal full domain names.

9. "HAZAL" EMPLOYEE AT AYSASOFT
   Listed as "Hazal hazal Hazal" on LinkedIn — suspicious formatting.
   Is this a real person or fabricated? Investigate further.

10. ELVIN BALYANS — EX-SPOUSE
    Administrative Clerk at LA County Dept of Mental Health.
    Ran "ED Transportation" business.
    May have knowledge of Pirageneh's activities during their marriage.

PRIORITY 3 — LONG-SHOT LEADS
-------------------------------

11. TURKISH PHONE 0216 521 3280
    Istanbul landline for AysaSoft office in Umraniye.
    Still active? Registered to whom?

12. HAVE I BEEN PWNED
    Check sarmenbj@gmail.com against breach databases.
    Requires direct HIBP lookup (not found via web search).

13. CALIFORNIA/TEXAS BUSINESS FILINGS
    Check CA Secretary of State for:
    - ELSA STUDIO (DBA filing)
    - AYSA International Group (entity filing)
    Check TX for any new filings post-relocation.

14. UHERE.NET ACTIVE PROBING
    Domain is live behind Cloudflare (104.21.80.165 / 172.67.151.197).
    Was returning 522 errors (origin down) during investigation.
    May come back online — monitor.

15. SARMENB.COM DOMAIN RE-REGISTRATION
    Domain is in pendingDelete at Namecheap.
    When it drops, it will be available for re-registration.
    Could be purchased for further investigation or to prevent re-use.

16. IRANIAN CONNECTION
    aysasoft.com (2021) is in Farsi (lang="fa").
    "Pirageneh" may be an Iranian surname.
    Investigate Iranian diaspora business networks in Glendale/Istanbul.

17. FINANCIAL TRAIL
    A site with 186K daily visitors generates significant revenue.
    Payment processing on aysalist.com (pay + payment subdomains).
    Follow the money — who receives payments?

METHODOLOGY NOTES
-----------------
- All collection was passive OSINT (no active probing of live sites)
- Sources: Wayback Machine, crt.sh, GitHub API, web search, public records
- No accounts were accessed, no credentials tested
- No active scanning or vulnerability testing performed
- Domain probing was limited to publicly cached data