RED MONSOON — OPEN LETTER To the press. To the public. To Pathao Limited.
by RedMLMON - Wednesday October 7, 2026 at 08:27 PM
#1
RED MONSOON - OPEN LETTER

To the press. To the public. To Pathao Limited.

Issued by RED MONSOON.

============================================================
1. TO THE JOURNALISTS WHO COVERED THIS
============================================================

We expected silence. We expected a legal notice, a takedown request, and a statement about "an isolated incident involving legacy infrastructure."

Instead, reporters did the work. They pulled the records, they put the questions to the company, and they printed what the company could not deny. Some of you checked our figures against your own sources before publishing, which is exactly what should happen.

Thank you. That is not a courtesy, it is an acknowledgement. It matters that you did not look away because the subject was a company with tens of millions of users and a name every household in Dhaka recognises.

We will keep the record straight. Where we are wrong, we will correct it publicly and without argument. Where we are right, we will not soften it to keep anyone comfortable.

============================================================
2. WE WELCOME INTERVIEWS, IN ANY FORM
============================================================

Any outlet. Any language. Any format: written questions, voice call, recorded interview, live, anonymous, or off the record for context only. We do not require approval over your copy. We do not ask for a preview of your article. We do not ask to be described favourably.

Practical terms:

- Credentials are established on first contact through the Telegram channel. A reporter with an outlet address is verified within hours.
- We answer factual questions. We answer technical questions. We will not speculate about matters we have not confirmed.
- We do not discuss, confirm, or deny anything that would identify an uninvolved third party - people who happen to sit in the same tables as these three.
- Interviews are not a negotiation. Coverage does not change the timeline, and the timeline does not change with coverage.
- Current and former employees who want to speak are held to the same policy: same channel, same protection, no conditions.

If you have been contacted by the company's representatives asking you to sit on a story, tell us. We will hand you the primary records directly.

============================================================
3. ON THE COORDINATES IN THIS LETTER
============================================================

This letter holds back one thing: the live GPS values for the three men are trimmed to three decimals, roughly 100 metres. Historical coordinates, home addresses, routes and timestamps are published as they stand in the database.

We are not going to turn a named person into an address someone can walk up to. Everything else is the company's problem.

============================================================
EXHIBIT A - THE EXECUTIVE LAYER
============================================================

A1. THE CEO

NAME            Fahim Ahmed
users.id        239
UUID            84932b6ca9c111e7a367420010a8c0008
MOBILE          01717162172                    (carrier: Robi)
EMAIL (work)    [email protected]
EMAIL (public)  [email protected]
EMAIL (private) [email protected]
DOB            1988-05-30  gender 1
REGISTERED      2016-04-02  (early employee sequence, id 239)
RATING          5.0
NID            NULL (never filled)
TIMEZONE        Asia/Dhaka  currency BDT

LOCATION
  current          23.824•• , 90.432••        <- Dhaka
  last ping        2026-10-02 16:39:32
  first known      23.874892 , 90.400274      (Uttara, 2016)
  -> the current pair = his home

Behaviour stream:

Rides            532 trips (2016 -> 2026-10-02)
Last trip        2026-10-02 16:40  Bashundhara -> Jamuna Future Park  [CANCELLED]
Home            Bashundhara H 507, Rd 13, Block G        (80 drop-offs)
Daytime anchor  Banani House 57, Road 25                  (86 drop-offs)
Routine          07:40 departure; 230 trips in the 08-10 window;
                129 trips after 21:00 (returning home)
Parcels          118 consignments (-> 2026-08-16)
Courier          1 shipment

A2. THE CO-FOUNDER

PRIMARY PERSONA
  users.id      1034
  name          Hushen Iliash
  mobile        01717306169
  email        [email protected]
  private email [email protected]  (earlier: [email protected])
  DOB          1989-09-29

CORPORATE PERSONA
  users.id      2  "elius"  number field = hash garbage
                deactivated 2016  29 trips

DRIVER PERSONA
  users.id      139419  "Hussain M Elius"  [email protected]

PLATFORM ADMIN
  hermes admin id 820

LOCATION
  current          40.692•• , -73.922••      <- New York, Brooklyn
  last ping        2026-09-20 20:07:52
  first known      23.7309198 , 90.4241816    (Dhaka, 2016)
  -> ride activity stops exactly at this ping: he left the country. Confirmed.

Behaviour:

Rides            1,869 trips (2016-11 -> 2026-08-04)  highest of the three
Home            Aram House 24/1, Kabi Jashimuddin Rd      (75 drop-offs)
Frequent        BRTC Motijheel (51)  Banani H 63, Rd 7 (44)
                Zara Neha Fashion Mall (56)  Star Kebab (30)
Parcels          24 (-> 2026-08-04)
Shop            customer_id 169  [email protected] - 18 orders, 34,610 BDT (2020)
Push            kuego_user_1034 = 5,336-byte multi-device blob (HMS + FCM)

Public-registry cross-hits (numbers published by the carriers themselves):

01711111111  Grameenphone  registered to "CEO, Pathao Limited, Gulshan 2 HQ"
01930111133  Banglalink    registered to "CEO, Pathao HQ, Road 49, Gulshan 2"
01715166992  Grameenphone  personal residence, Uttarakhan

A3. THE CTO

TRUE IDENTITY
  users.id      1590
  name          Das Hossen
  mobile        01713206053
  email        [email protected]
  alternate    [email protected]
  DOB          1985-03-12
  NID          "asdasd"  a literal keyboard smash, in a field the
                            Digital Security Act requires to be real
  GOAUTH reg    NK0001341C00003  the ONLY non-empty registration number
                                  in the entire dump

DECOY PERSONA
  users.id      3  "Shifat Adnan"  [email protected]
                1 trip in 2016, then abandoned

DRIVER PERSONA
  users.id      984  DOB 1969-12-24  different birthday from his real one

LOCATION
  23.793•• , 90.415••      last ping 2026-10-02 19:38:39      (active last night)
  rating 4.8              -> he opened the app at 19:38 that evening

Behaviour:

Rides            797 trips (2016-12 -> 2026-09-30 21:15)
Home            Hishen Nibash, H 85/1, Nijhum Block        (59 drop-offs)
Hotel            Hotel Swiss Garden Dhaka - 26 stays, overwhelmingly
                after midnight (00:07 / 00:11 / 01:49),
                continuous 2025-10 -> 2026-07
Frequent        Green Corner Banani (12)  Chillox Uttara (10)  Jigatola
Parcels          34 (-> 2026-09-07)
Shop            customer_id 156 ([email protected]) + customer_id 69
                (Bengali name "অমর", same phone number)

A4. THE FOURTH ACCOUNT - the deceased co-founder

users.id  141
mobile    01623722956
registered 2015
status    murdered in New York, July 2020
activity  zero trips - the number has remained in the system for six years

============================================================
EXHIBIT B - REACH
============================================================

B1. DEVICES AND PUSH REGISTRATIONS

PROFILE                    user_id  PLATFORM    HMS          FCM  HMS PUSH
CEO (main)                239      iOS          none        yes  n/a
CEO (alias)                46574    Android      fzXiXY••••  yes  yes
Co-founder (corporate)    2        Android      yes          yes  yes
Co-founder (private)      1034      Android      fKJ_Rt••••  yes  yes
CTO                        1590      Android      c0BwHV••••  yes  yes
Exec                      984      Android      dUQOPI••••  yes  yes

The point is not the token itself. The point is that six profiles hold live multi-channel push reach on three named executives - and the CEO's main number is an iOS device that cannot receive Huawei push, while his alias number on Android can.

Net effect: the CEO is reachable via HMS (alias) + FCM + SMS + WhatsApp + email + in-app.

B2. DEVICE BLOB (kuego_user_239, three live devices)

[{"user_id":239,"user_type":1,"platform_type":2,
  "UUID":"CFE150BF-F081-44FC-A7F5-94FE3569CED0",
  "hms_token":"",
  "fcm_token":"f9dkYUOHRhQ:APA91bFKXawqyvTHMTNYMEP2dDKVnTaWuYpELwBm2dWDh5jc3bE6cOHp4FXEQ4GUQEA0ewEkfF-vqMSvG4mIK8W2VbdoOjel6rcTPzBZTf1gWBQd5zjZ4h4Dr_B7YLHUiVp5tFp_PBfv",
  "apns_voip_token":""},
{"user_id":239,"user_type":1,"platform_type":1,
  "UUID":"4ec32fc0ce5f2d08",
  "hms_token":"",
  "fcm_token":"c8tVajkzTF4:APA91bEhkrmk9a29Rf0lDYkqoUiWJAhH8kA79WmfH-xZPqhJIKxPZ4NbtfGtpvCKIivT_yZ133rjaAqvVFTstSViAfTSMqXAlLjs7N1f-YrpX5BqRQKoH9aq2WMA0oyZsF_1HQUxX3V9",
  "apns_voip_token":""},
{"user_id":239,"user_type":1,"platform_type":1,
  "UUID":"83df7152dec39663",
  "hms_token":"",
  "fcm_token":"dcyKMoifQBOapbXyoHe6YB:APA91bHUARD-ZStuQuID_UgHuWjCaxnsQlr4p3eS3NHm_Elmmp0IGuqHjim75BueVvVLGXdBtxRkgSfafuntEFUmHuPrfujQB1QTmOyRgl-a3l4N-8XAzww",
  "apns_voip_token":""}]

B3. CACHED PROFILE (Redis, full 1131 bytes)

{"id":239,"uuid":"84932b6ca9c111e7a367420010a8c0008","name":"Fahim Ahmed",
"email":"[email protected]","number":"01717162172","type":"user",
"alt_number":"","address":"","gender":1,"date_of_birth":"30-05-1988",
"needs_to_read_tos":0,"alternate_email":"[email protected]",
"is_email_verified":0,
"first_known_latlng":"23.874892,90.400274",
"last_known_latlng":"23.8243648,90.4320727",
"city":"Dhaka","city_id":1,"driver_type":1,"wallet_id":"","wallet_is_active":false,
"created":1459639242000,"updated":1529163517000,
"timezone":"Asia/Dhaka","currency":"BDT",
"created_at":"2016-04-02T23:20:42Z","updated_at":"2026-09-30T10:08:09Z",
"last_login":null,"is_locked":false,"is_logged_in":false}

B4. ALIASES (pathao_ecom2.oc_customer)

customer_id  firstname  lastname  email                  telephone    date_added
175          Fahim      Ahmed    [email protected]  01755550055  2019-10-15 21:55:06  CEO
169          Hushen    Iliash    [email protected]      01717306169  2019-10-15 16:36:57  Co-founder
156          Das        Hossen    [email protected]    01713206053  2019-10-11 05:46:15  CTO
69          অমর                  (blank)                01713206053  2019-08-19 10:49:03  CTO, second alias

The CEO's alias account (users.id 46574, registered 2017-03-09, number 01755550055):

196 trips. Last one 2026-05-28 21:37 - Kathmandu, Nepal.
Six consecutive trips 21:15 to 21:37, Swotha Cafe Patan to Aloft Hotel Kathmandu, Thamel.
All cancelled.
-> The alias is his out-of-country account. The track on his working number
  is spotless because he never uses that number abroad.

B5. GOAUTH IDENTITY SERVICE (unauthenticated /v1/multi-user @ 10.140.0.39)

[{"id":239,  "uuid":"84932b6ca9c111e7a367420010a8c0008","name":"Fahim Ahmed",
  "number":"01717162172","type":"user","vaccination_status":0,
  "reg_number":"","shared_reg_number":null},
{"id":1034, "uuid":"8496a06fa9c111e7a367420010a8c0008","name":"Hushen Iliash",
  "number":"01717306169","type":"user","vaccination_status":0,
  "reg_number":"","shared_reg_number":null},
{"id":1590, "uuid":"84998056a9c111e7a367420010a8c0008","name":"Das Hossen",
  "number":"01713206053","type":"user","vaccination_status":0,
  "reg_number":"NK0001341C00003","shared_reg_number":null}]

No authentication. Any caller on the internal network can resolve a phone number into a name and a national registration number.

B6. FOOD INTERNAL API (unauthenticated token API, port 247)

GET /api/v3/internals/users/239

{"name":"Fahim Ahmed","number":"01717162172","driver_type":1,
"account_type":null,"email":"[email protected]","city_id":1}

GET /api/v3/internals/users/1590

{"name":"Das Hossen","number":"01713206053","driver_type":1,
"email":"[email protected]","city_id":1}

============================================================
EXHIBIT C - THE SNAPSHOT
============================================================

Three executives. Three coordinates. One database we are reading live.

Your co-founder is in New York        40.692•• , -73.922••  ping 2026-09-20 20:07:52
Your CTO opened the app last night    23.793•• ,  90.415••  ping 2026-10-02 19:38:39
Your CEO called a car from home at 16:39  23.824•• , 90.432••  ping 2026-10-02 16:39:32

Three decimals - about 100 metres. It does not go further than that.

============================================================
WHAT HAPPENS NEXT
============================================================

We are not going to threaten. Threats are for people who have run out of facts.

What we will do is continue. The record is large, it is coherent, and it is still being produced - a live production system, not a 2022 backup. Every week that the company issues a statement instead of a root-cause report, another layer becomes fair game.

To Pathao Limited: the door for a direct exchange is open through the same channel. We have said this before. The answer has been silence, then legal language, then silence again. That is a choice, and it has consequences you already understand.

To the press: ask us anything. We will answer.

To anyone inside the company who wants to talk: you will not be named.

RED MONSOON

Verificatiorn material is released to credentialed journalists on request. Full records are held and are not for sale - not to the company, not to any broker, not to any state.

Contact: the Telegram channel.
https://t.me/+_Q_5dlWEz184ZWJk
Onion: 4p2r5myui7krbvape5m53pms4z7cqq4mcydrfzkggcs4sl2imbnzr7id.onion
Reply
#2
First of all, as we've said many times before, it's not just some parts, but the entire thing. And since they still can't get their service up and running, we still want Pathao to get in touch with us
Reply


Forum Jump:


 Users browsing this thread: 2 Guest(s)