Author

Topic: Account hacked (Read 1477 times)

Timelord2067

legendary

Activity: 3696

Merit: 2219

💲🏎️💨🚓

Quote from: Clement Kaliyar on December 11, 2016, 09:06:33 AM

@Timelord2067 That is one hell of a detailing my dear friend. I know you have spent an aweful lot of time investigating this scam or fraudster .You are indeed a scam buster and hats off to you and my question is is it possible to file an FIR against these individuals for fraud as i have seen an FIR being logged recently in India for scamming 1.5 BTC. I am not sure about how the end results will be but in this case the admins does have their IP address and i expect them to hand over the IP address when there is a police complaint.

I wouldn't say exactly that the forum is turning a blind eye to such goings on, but they are leaving it up to the forum's participants to self monitor and dish out a kind of retribution in the form of trust, either positive, neutral or negative depending on the transgression.

There's nothing to stop retaliatory negative trust, or indeed false trust from an Alt to give the allusion of trust where non exists.

Most of the scams are for a couple of dollars so people aren't likely to go to the police for that kind of coin. Unfortunately, all we can do is build up a profile of the scammers and mark each one accordingly with Red Paint ^TM and hope that punters in future are clued up enough to read the trust trusted, or in my case untrusted, and hope users make an informed decision about what is written.

Clement Kaliyar

hero member

Activity: 1302

Merit: 532

Timelord2067

legendary

Activity: 3696

Merit: 2219

💲🏎️💨🚓

I'm going to go out on a limb and say that [BTC]onFIRE was never hacked on the 8th of August and that [BTC]onFIRE is a chronic scammer with dozens of Alts.

The OP creates this thread https://bitcointalksearch.org/topic/account-hacked-1179091 on the 13 September 2015, 16:37:27 and less than ten hours later goes off-line permanently having posted just once...

Code:

Name: 	[btc]onfire1 u=543354 http://archive.is/mTeoZ
Posts: 	1
Activity: 	1
Position: 	Newbie
Date Registered: 	09 August 2015, 04:28:48
Last Active: 	13 September 2015, 23:14:42
	
Total Time Spent Online: 	25 minutes.
Total Posts: 	1 posts
Total Topics Started: 	1 topics
Number of Polls Created: 	0 polls
Number of Votes Cast: 	0 votes

When the signed message doesn't appear to hold up, whywefight ponders:

Quote from: whywefight on September 14, 2015, 03:13:55 AM

here we go with a quote that can not be edited by the hacker/scammer https://bitcointalksearch.org/topic/m.11533372

The actual post:

http://archive.is/6HZUj#selection-545.0-587.44

Quote from: bitcoinmax88 on June 04, 2015, 09:25:51 AM

Quote from: [BTC]onFIRE on June 04, 2015, 07:19:30 AM

my tweet https://twitter.com/btconfire/status/606434895867449344
btc address 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM
thanks

You are welcome, just sent you your 0.001btc

The signed message posted by [btc]onfire1

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
My account [btc]onfire has been hacked/lost. Please reset the email to [email protected]. The current date is 8 august 2015.
-----BEGIN SIGNATURE-----
1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM
H1VpZYbglS7uO4br2VPCZKYPKg+ThvJNA5pIBksDwhMYaru+TSAZ5ciqbqBSN8faD9sn5fvwF9nFtIwcn4dLrs0=
-----END BITCOIN SIGNED MESSAGE-----

Message verified: http://coinig.com/?adr=1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM&msg=My+account+%5Bbtc%5Donfire+has+been+hacked%2Flost.+Please+reset+the+email+to+new.apache%40yahoo.com.+The+current+date+is+8+august+2015.&sig=H1VpZYbglS7uO4br2VPCZKYPKg%2BThvJNA5pIBksDwhMYaru%2BTSAZ5ciqbqBSN8faD9sn5fvwF9nFtIwcn4dLrs0%3D

Funds from 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM were shifted to 3Px19pCL9xmZattPzCajsqDdGQrVMMpcBG 0.0101613 BTC 2015-09-03 10:30:17 and have sat dormant ever since. Both Wallet Addresses are the sole Wallet Addresses for their respective Wallets - Wallet [882c19fcb6] and Wallet [3bf18a15a6]

https://twitter.com/btconfire is still tweeting / retweeting - last such post was two days ago. On the other hand...

https://twitter.com/bitcoinonfire returns: Sorry, that page doesn’t exist!

while the Wallet Address 1G53GvfHhuvxKsCJZLPX91oPppkWDRdq returns a Checksum does not validate as confirmed previously.

Quote from: [BTC]onFIRE on May 26, 2015, 10:37:02 PM

Followed and retweeted all done
my twitter https://twitter.com/bitcoinonfire
my btc address 1G53GvfHhuvxKsCJZLPX91oPppkWDRdq

Right up until the day before the UID was "hacked", they were using the Wallet Address 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM used to then reclaim the account by [btc]onfire1:

First use is at top of post.

Second use: http://archive.is/AAVdS#selection-3655.0-3681.23 (note the use of day-month-year)

Quote from: [BTC]onFIRE on June 08, 2015, 01:14:08 PM

# Username: [ btc ]onfire
# Bitcoin Address: 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM
# Member Type: full member
# Date Joined: 8-6-2015

Fourth use: http://archive.is/4oTF0#selection-1573.0-1619.47

Quote from: [BTC]onFIRE on July 13, 2015, 04:22:13 PM

type: google+

link:
https://plus.google.com/116219343947296102157/posts/973bMwnYqiW
https://plus.google.com/116219343947296102157/posts/Xci1mDik5mq
https://plus.google.com/116219343947296102157/posts/RMqKygGggth

btc address: 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM

Fifth use: http://archive.is/VKSv6#selection-7175.0-7203.34

Quote from: [BTC]onFIRE on July 20, 2015, 06:11:12 PM

RT’ed and followed done
my twitter https://twitter.com/btconfire
1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM

Last use: http://archive.is/eoiUX#selection-4465.0-4484.8

Quote from: [BTC]onFIRE on August 06, 2015, 09:51:34 AM

your faucet so mobile friendly
and i have claimed 500 satoshi thanks
i want free 10000 satoshi too
1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM thanks

all of which could have been modified by the "hacker" but weren't.

~~The fact the account has stopped being used tells me a scammer was in control of the account~~

[BTC]onFIRE wanted it to appear as though the account had been hacked and then abandoned.

Code:

Name: 	[BTC]onFIRE
Posts: 	223
Activity: 	223
Position: 	Full Member
Date Registered: 	04 February 2015, 11:22:39
Last Active: 	15 September 2015, 11:59:11

The scammer has a sense of irony though: http://archive.is/naNSu#selection-5805.47-5805.85

though I doubt I'll see any of the promised BTC 10.0 any time soon... Undecided

http://archive.is/naNSu#selection-1581.0-1585.5
http://archive.is/naNSu#selection-2597.0-2597.82
http://archive.is/naNSu#selection-3965.0-3967.40

No-one followed up on this though: http://archive.is/AOlSW#selection-4401.0-4421.244

Quote from: Straux on September 14, 2015, 02:47:55 AM

I can confirm that the hacker/current owner of the account BTConfire is Candystripes/Pierre11, who are serial scammers. This user has also scammed me out of 1.3~ BTC recently. DO NOT DEAL WITH THIS ACCOUNT UNTIL THE ORIGINAL OWNER GETS IT BACK.

No negative trust on their wall, and no scam accusation that I can see.

Still not sure how these codes actually work but given the short activity of titaniumfox I'd say they are an Alt of the scammer who took over the OP's main account.

Code:

Name: 	titaniumfox u=397979 http://archive.is/OWDHz
Posts: 	13
Activity: 	13
Position: 	Newbie
Date Registered: 	26 November 2014, 14:37:26
Last Active: 	22 October 2015, 13:16:23

Re: [ 18.5+ BTC PAID! ] CryptoFATE.com == GET 150% INSTANTLY == TRANSPARENT AND FAIR
19 October 2015, 18:43:08 https://bitcointalksearch.org/topic/m.12726250 (Locked thread) http://archive.is/QxdUM#selection-2595.0-2617.34

Quote from: [BTC]onFIRE on August 20, 2015, 05:45:10 PM

'I want to link my Bitcointalk name with BTCJam's. Verification code: 4374f135-d03f-4ee2-a586-a01178658eb2'

http://archive.is/D4OIE#selection-4813.0-4833.107

Quote from: titaniumfox on October 19, 2015, 03:05:11 AM

'I want to link my Bitcointalk name with BTCJam's. Verification code: 4374f135-d03f-4ee2-a586-a01178658eb2'

http://archive.is/D4OIE#selection-4989.0-5009.107

Quote from: titaniumfox on October 19, 2015, 03:20:01 AM

'I want to link my Bitcointalk name with BTCJam's. Verification code: 224b2b57-d504-46ae-8389-868d5e0603e6'

http://archive.is/Yb60b#selection-4789.0-4809.107

Quote from: alieksandrv on July 05, 2015, 04:00:58 PM

'I want to link my Bitcointalk name with BTCJam's. Verification code: 224b2b57-d504-46ae-8389-868d5e0603e6'

Code:

Name: 	alieksandrv u=530846 http://archive.is/mbkf8
Posts: 	1
Activity: 	1
Position: 	Newbie
Date Registered: 	06 July 2015, 06:58:47
Last Active: 	31 May 2016, 16:11:26

Same page as alieksandrv post: http://archive.is/Yb60b#selection-2015.0-2034.1

Quote from: MAsterV on June 26, 2015, 07:50:06 AM

'I want to link my Bitcointalk name with BTCJam's. Verification code: cd185ec0-03e3-43aa-9079-fae6acab87a9'

MAsterV referral use of that code on BCT: http://archive.is/rHmnX#selection-3963.0-3965.109 but doesn't appear to be otherwise connected. [1]

OK, so we have the following::

Accounts connected: [BTC]onFIRE, [btc]onfire1,

and separately, we have:

Accounts connected:

(unknown scammer), titaniumfox, alieksandrv,

So, where are we at?

I connected: ozgr, misteagle, reyhiesa, zhuravskij3, Desert Flame, nickaizoku, bms2013, Berthorl, SvintuS

here: https://bitcointalksearch.org/topic/m.14394021 using Wallet Address 1BwnkpAb7zxozGfsyEc4tbguhDuQi6RScr so if titaniumfox is using 1BwnkpAb7zxozGfsyEc4tbguhDuQi6RScr that means the hacker is an Alt of ozgr, misteagle, reyhiesa, zhuravskij3, Desert Flame, nickaizoku, bms2013, Berthorl, SvintuS and by extension, so are alieksandrv, planetroving, Lamigo, afidwildan, Nami, kingwasabi, Thresh, Shyvana,

Proof:

titaniumfox

http://archive.is/qgpze#selection-2103.0-2127.6

Quote from: titaniumfox on October 19, 2015, 02:51:51 AM

Username: planetroving

Thanks

http://archive.is/qgpze#selection-2275.0-2297.7

Quote from: titaniumfox on October 19, 2015, 03:27:08 AM

Username: Lamigo
Thanks.

http://archive.is/qgpze#selection-2627.0-2649.8

Quote from: titaniumfox on October 19, 2015, 04:10:59 AM

username : afidwildan
Thankyou

planetroving

http://archive.is/bDnWq#selection-2247.0-2271.6

Quote from: planetroving on March 21, 2015, 05:10:14 PM

Username: planetroving

Thanks

http://archive.is/qeD58#selection-5321.0-5345.6

Quote from: planetroving on March 31, 2015, 05:05:44 PM

Username: topkek

Thanks

http://archive.is/nbBVu#selection-927.0-951.6

Quote from: Nami on July 02, 2015, 05:48:33 PM

Username: planetroving

Thanks

http://archive.is/H9ytT#selection-5359.0-5383.6 (third Alt on the one page)

Quote from: kingwasabi on July 02, 2015, 09:29:37 PM

Username: planetroving

Thanks

bms2013 and zhuravskij3 posts on the same page that Thresh posts three times:

http://archive.is/LIKnX#selection-3003.0-3025.7

Quote from: bms2013 on October 14, 2015, 06:28:12 AM

my username: bms2013
thanks!

http://archive.is/LIKnX#selection-7061.0-7083.25

Quote from: zhuravskij3 on October 14, 2015, 10:41:29 AM

zhurYRA
Thanks for awesome promo!

http://archive.is/LIKnX#selection-8387.0-8763.6

Quote from: Thresh on October 14, 2015, 11:07:20 AM

Username: planetroving

Thanks

Quote from: Thresh on October 14, 2015, 11:08:56 AM

Username: TurboMen

Thank you !

Quote from: Thresh on October 14, 2015, 11:14:21 AM

Username: Dongtsy

Thanks

bms2013 also posts http://archive.is/RluQj#selection-3899.0-3921.10 on same page Shyvana posts to:

http://archive.is/RluQj#selection-5109.0-5133.6

Quote from: Shyvana on October 12, 2015, 06:24:31 PM

Username: planetroving

Thanks

Code:

Name: 	Nami u=336683 http://archive.is/JzTqn
Posts: 	193
Activity: 	168
Position: 	Full Member
Date Registered: 	29 May 2014, 01:48:05
Last Active: 	12 December 2015, 13:30:23

Code:

Name: 	Shyvana u=336824 http://archive.is/SXQwC
Posts: 	70
Activity: 	70
Position: 	Member
Date Registered: 	29 May 2014, 10:52:44
Last Active: 	07 November 2015, 07:16:24

Code:

Name: 	Thresh u=336846 http://archive.is/qcw5b
Posts: 	85
Activity: 	70
Position: 	Member
Date Registered: 	29 May 2014, 12:48:18
Last Active: 	02 May 2016, 04:37:17

Code:

Name: 	kingwasabi u=398520 http://archive.is/n7c3N
Posts: 	13
Activity: 	13
Position: 	Newbie
Date Registered: 	28 November 2014, 07:42:04
Last Active: 	03 July 2015, 15:19:25

Code:

Name: 	planetroving u=484567 http://archive.is/dBixz
Posts: 	1116
Activity: 	644
Position: 	Hero Member
Date Registered: 	19 March 2015, 17:35:00
Last Active: 	Today at 10:19:39

Website: 	Planet Roving's Official Site
Current Status: 	Offline Offline
Bitcoin address: 	1H9CYX8bk1t5o39B9qjDTey2fgEy9V4cUy

At this point, it almost appears to become exponential the number of Alts that are connected. Perhaps someone else might like to delve further into these Alts?

I'll let you ponder these three posts by [BTC]onFIRE and planetroving

Re: ToTheMoon.me | Big Giveaway | upto 10000 Bits per person | Fun Game!
01 July 2015, 16:30:32 https://bitcointalksearch.org/topic/m.11760611 (Locked thread) http://archive.is/hVQjd#selection-5485.0-5504.9

Quote from: planetroving on July 01, 2015, 04:32:18 AM

#157
Username: planetroving

Tweet link: https://twitter.com/spacemarsful/status/616176722526863361

http://archive.is/GKhUN#selection-2111.0-2145.7 (lasted edited 10 July 2015, 16:54:09 by planetroving)

Quote from: planetroving on July 09, 2015, 09:18:49 PM

Edited! with correct username!

Primedice Username: spacemarsful
Date Joined Primedice: 10th of July 2015

Thanks!

Two posts later (and nine minutes later at that)

http://archive.is/GKhUN#selection-2605.0-2627.25

Quote from: [BTC]onFIRE on July 09, 2015, 09:27:00 PM

Primedice username btconfired
date joined feb 10th 2015

and lastly: http://archive.is/QqgZG#selection-3169.0-3199.7

Quote from: planetroving on August 10, 2015, 05:33:31 AM

Primedice Username: spacemarsful
Date Joined Primedice: 10th of July 2015

I like Primedice because of its minimalistic and uncluttered site, which makes using the site very easy to use. It is very easy to navigate the site, unlike a few other dice sites. Also, the big community brings a sense of belonging to something big, which is great, especially in the chat. The faucet integrated within the site is great as well. However, the only gripe I have is the slow roll/bet speed, which brings the site down when compared to other dice sites.

Thanks!

Two out of three instances where planetroving posts the twitter spacemarsful [btc]onfire1 is in close proximity, so I began to wonder if they (and therefore all) of these Alts are connected?

http://archive.is/jPSqj#selection-4455.0-4487.60

Quote from: [BTC]onFIRE on June 09, 2015, 12:57:04 AM

my twitter https://twitter.com/btconfire
my tweet https://twitter.com/btconfire/status/608150254471409664
rollin.io bitcoin address 1PKpt7LrJyV6Ju1PxXSHtzdbVxBK8E9j1j

1PKpt7LrJyV6Ju1PxXSHtzdbVxBK8E9j1j is a Wallet Rollin.io so that's a dead end...

Every instance of 1FCkxmbqYKtgTTmjV771V6tkDcGNewToJr is in posts by [BTC]onFIRE that have been edited on the 14th of September 2015 which is *after* this thread was started.

http://archive.is/Z3qd5#selection-4999.0-5018.4
http://archive.is/75Zfh#selection-5221.0-5249.9
http://archive.is/8xb7g#selection-7351.0-7370.11
http://archive.is/QWqI6#selection-6349.0-6368.13
http://archive.is/lbB3d#selection-6101.0-6123.34 ozgr also appears 11 posts earlier on the same page - ( 47 and a half hours earlier ) with Wallet Address 1632Ni7QxA1wAEXgiogkEjfQy1FwXiCJvP http://archive.is/lbB3d#selection-3377.0-3399.34
http://archive.is/E0bgo#selection-2117.0-2172.0 - Coinbuddy appears on the same page further down... Roll Eyes

Perhaps BadBear can explore what the Wallet Addresses originally said?

1FCkxmbqYKtgTTmjV771V6tkDcGNewToJr is used to shunt funds ( BTC 0.5 ) from Wallet MtGoxAndOthers to Wallet PrimeDice.com-old4 on the 13th of September 2015 which is our OP thread date...

http://archive.is/i9tqa#selection-4949.0-4971.50

Quote from: [BTC]onFIRE on March 04, 2015, 07:44:28 AM

username btconfire
deposit address 1MYFoHk86vy6u37YsnbCrNFqvsBvR1Yi4Q

1MYFoHk86vy6u37YsnbCrNFqvsBvR1Yi4Q is part of Wallet [4856e6ad36] https://www.walletexplorer.com/wallet/4856e6ad362af80f/addresses and there are just two Wallet Addresses, they are:

Code:

191DfcDqgN68EP1m8xHYop3PYpWbqRATY8	0.         	1	346409
1MYFoHk86vy6u37YsnbCrNFqvsBvR1Yi4Q	0.         	1	346409

[1] http://archive.is/i9tqa#selection-1615.0-1639.43 (some 21 hours prior to the above post)

Quote from: MAsterV on March 03, 2015, 04:07:10 PM

Username: MAsterV
Currency: Blackcoin
Address: BTPDaCsTw2SmhoLfbgFUpXGJY2c58T7d2W

Re: Luckyballs.io Giveaway - 3 mBTC per twitter account
13 June 2015, 00:04:10 https://bitcointalksearch.org/topic/m.11600570 (Locked thread) http://archive.is/TunxI#selection-593.0-619.18

Quote from: vafelcz on June 13, 2015, 03:23:01 AM

#401
https://twitter.com/estrella_marce/status/609356898635157504
https://twitter.com/justin_arm_/status/609357401775456256
vafelcz

THANKS!! Cheesy

Three days later in the same thread:

Re: Luckyballs.io Giveaway - 3 mBTC per twitter account
13 June 2015, 12:53:29 https://bitcointalksearch.org/topic/m.11605212

http://archive.is/AdJw3#selection-3451.0-3479.13

Quote from: [BTC]onFIRE on June 12, 2015, 09:04:10 AM

#381
my tweet https://twitter.com/justin_arm_/status/609357401775456256
username btconfire

Code:

Name: 	nickaizoku u=164179 http://archive.is/UaMxR
Posts: 	2279
Activity: 	308
Position: 	Sr. Member
Date Registered: 	20 November 2013, 02:45:02
Last Active: 	22 October 2016, 13:05:50

Bitcoin address: 	12iLTrfVpoSGmcLJaZgsed9zBqVKG14vDf
Gender: 	Male
Age: 	31
Location: 	Malaysia
Trust: 	-8: -3 / +0

Code:

Name: 	catlove u=167451 http://archive.is/DucmL
Posts: 	152
Activity: 	152
Position: 	Full Member
Date Registered: 	23 November 2013, 23:49:23
Last Active: 	02 December 2016, 23:20:57

Code:

Name: 	vafelcz u=400712 http://archive.is/L1vb8
Posts: 	209
Activity: 	154
Position: 	Full Member
Date Registered: 	06 December 2014, 19:26:51
Last Active: 	24 July 2015, 19:41:15

Email: 	[email protected]

Trust: 	-16: -4 / +0
Warning: Trade with extreme caution!

previously their email was: http://archive.is/XDndd#selection-493.0-497.20

Code:

Other contact info: 	[email protected]

Their trust wall says it all:

Quote

shorena 60: -0 / +6 2016-01-29 0.00000000 Reference Alt of The Bad Guy, scammed 0.75 BTC.
Tomatocage Huh

: -1 / +23   2015-06-22   0.00000000      Alt of FattyPonzi
hedgy73 120: -0 / +12   2014-12-12   0.00000000   Reference   Scammer!!
John (John K.) 180: -0 / +18   2014-12-12   0.00000000   Reference   Scammer. Do not trust. Likely alt of xefuse and many other more. https://bitcointalksearch.org/user/xefuse-399194

Muhammed Zakir 40: -0 / +4   2015-06-11   0.00000000   Reference   Was 4 months and 11 days late to repay loan! Do your own due diligence when dealing with this user!

Additionally, he is a Fraudster. https://bitcointalk.org/index.php?topic=1078437.0;all

vafelcz is alt of nano-btc who is alt of Dalyb.

On one side of the ledger, we have Date Registered: 20 November 2013, 02:45:02 nickaizoku u=164179 http://archive.is/UaMxR who is connected to the Alt that "took over" [BTC]onFIRE while on the other side of the ledger, we have Date Registered: 23 November 2013, 23:49:23 catlove u=167451 http://archive.is/DucmL who is directly connected to [BTC]onFIRE.

I'm going to go out on a limb and say that [BTC]onFIRE was never hacked on the 8th of August and that [BTC]onFIRE is a chronic scammer with dozens of Alts.

Neither nickaizoku nor catlove are the Genesis Alt ^TM of this series of Alts.

Addresses:

Wallet [107b1853ee] https://www.walletexplorer.com/wallet/107b1853ee0317a1/addresses has 20 Wallet Addresses, they are:

Code:

177dYC5QNwWuMqxEZKju8qvR8T3NgKGRs8	0.00008035 	205	442532
114RXihBrcA966xSQ21bGVU6KnHPDggrZN	0.         	96	412569
17zC7NVzqATW2WXUmmMKRjcBthtQtyqJsb	0.         	86	415716
1BwnkpAb7zxozGfsyEc4tbguhDuQi6RScr	0.         	79	442532
1CAx5ffDU2ngJVt9tZfdymDets36rAeoox	0.         	18	380551
19LmwNTDgUfRHmP2bwisZeT3pUHQgDc2Sa	0.         	14	353539
18MGNMivEpQiG3G63g7ar8aEbNgLZsq8UH	0.         	7	435493
177ghCBWkzs9aafV1S9y4cdDCT6krD6MuE	0.         	7	382093
1MBL3Qkst1Bjs57KoLE7vTKAJzvVFe9pJi	0.         	5	437670
1HNt4ZKsKnCXt7U6WiuhFPVNjBvrmr3rct	0.         	5	382956
16THWCrw4vmvX1YKLNaitVxDsppbF5io2E	0.         	3	386284
1jj5LvMDEemtzTLLGK91ihPaKuYU5qPAn	0.         	3	360656
1BEwoMcMFjGSETqrq34MKGQBHPHXEj2cAp	0.         	3	355718
1L2Py6rTvtbKzFiUphVDD538FmiGhHrdMC	0.         	3	348040
1KLqK3QCXGTm9RP5t4ozffVaaQFQxhcDE	0.         	2	357628
14CUWhc3vgepxb9pz3JzoKSSTtGG6NHxpT	0.         	2	354386
158ThvB3e4zj9b9FRiMbhu3UXarXkxVoWq	0.         	1	407982
1RdAbSr143g6Sj1WEsH3VWX1ePYiZsSz4	0.         	1	403420
1MngvAJGmHxuTDJXBLELGoTQ2cLpHxocTh	0.         	1	375496
19QjvJabAumwPF28fh3GLUEecgRKzjNBR8	0.         	1	356128

(and I haven't even started to look through them yet)

Miscellaneous:

Searching for email

Code:

[email protected]

I've noticed:

Code:

Name: 	apachephp u=126954 http://archive.is/LlGkp 
Posts: 	1
Activity: 	1
Position: 	Newbie
Date Registered: 	06 June 2013, 15:00:40
Last Active: 	Today at 21:25:05

is online right now. Uncanny coincidence given there are just 17 UID's out of 920,000 that have Apache in their profile...

I'll wager @YoeN is an Alt... http://archive.is/75Zfh#selection-3469.0-3489.61

whywefight

legendary

Activity: 1078

Merit: 1042

www.explorerz.top

here we go with a quote that can not be edited by the hacker/scammer https://bitcointalksearch.org/topic/m.11533372

Straux

sr. member

Activity: 412

Merit: 251

ndnh

legendary

Activity: 1302

Merit: 1005

New Decentralized Nuclear Hobbit

Hacker edited the post after probably seeing this post on his thread:

Quote from: OmegaStarScream on September 13, 2015, 06:41:44 AM

This account is hacked , check here : https://bitcointalksearch.org/topic/account-hacked-1179091
don't trust OP unless he provide signed message from unedited posts he provided months ago .

BadBear

legendary

Activity: 1652

Merit: 1128

Original

Quote from: [BTC]onFIRE on May 26, 2015, 10:37:02 PM

followed and retweeted all done
my twitter https://twitter.com/btconfire
my btc address 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM

Edited

Quote from: [BTC]onFIRE on May 26, 2015, 10:37:02 PM

Followed and retweeted all done
my twitter https://twitter.com/bitcoinonfire
my btc address 1G53GvfHhuvxKsCJZLPX91oPppkWDRdq

Edited version is also an invalid address, and that twitter account doesn't seem to exist. Makes it more likely that the OP is legit, and the current owner is not.

I've locked the account for time being.

shorena

copper member

Activity: 1498

Merit: 1528

No I dont escrow anymore.

Quote from: [btc]onfire1 on September 13, 2015, 01:37:27 AM

-snip-
Here is the unedited post where I posted that address: https://bitcointalksearch.org/topic/m.11460242
-snip-

The post in question was edited 20 minutes ago.

[BTC]onFIRE

full member

Activity: 223

Merit: 100

Quote from: OmegaStarScream on September 13, 2015, 09:30:04 AM

Quote from: [BTC]onFIRE on September 13, 2015, 09:23:05 AM

this account wasn't hacked or sold people. I'm the only real BTConFIRE

How come he was able to sign a message ?
Maybe you should do the same to proof that you actually own the account but it wouldn't make much sense if both of you could do that .

How to using mycelium? 0.0

OmegaStarScream

staff

Activity: 3500

Merit: 6152

Quote from: [BTC]onFIRE on September 13, 2015, 09:23:05 AM

this account wasn't hacked or sold people. I'm the only real BTConFIRE

How come he was able to sign a message ?
Maybe you should do the same to proof that you actually own the account but it wouldn't make much sense if both of you could do that .

[BTC]onFIRE

full member

Activity: 223

Merit: 100

this account wasn't hacked or sold people. I'm the only real BTConFIRE

el kaka22

legendary

Activity: 3752

Merit: 1170

www.Crypto.Games: Multiple coins, multiple games

Quote from: OmegaStarScream on September 13, 2015, 03:44:28 AM

I don't see why you guys can't get it verified , got it easily . Here

Oh I got the [btc] tag as capital letters (i.e. [BTC]), which his account uses capital letters. This should be why the message don't verified.

BTW you can add this tag to prevent the [btc] becomes BTC automatically:

Code:

[nobbc][/nobbc]

OmegaStarScream

staff

Activity: 3500

Merit: 6152

I don't see why you guys can't get it verified , got it easily . Here

tspacepilot

legendary

Activity: 1456

Merit: 1081

I may write code in exchange for bitcoins.

Quote from: Quickseller on September 13, 2015, 02:30:00 AM

edit: I am also having difficulty trying to get the signature to verify...maybe you should try to sign a message that does not contain the "BTC" symbol as a test...

Indeed, the message as presented when you click the "quote" button, where the BTC symbol appears as [btc] fails to verify. So does using a "B" which is what my browser produced when I copy-n-pasted the BTC image from the web-page. The use of < > around sections of the message seems to indicate lack of familiarity with signing bitcoin messages.

@OP, see if you can get us a working signature. Check out this wonderful tutorial on the matter by Shorena: https://bitcointalksearch.org/topic/how-to-sign-a-message-990345

Quickseller

copper member

Activity: 2996

Merit: 2374

It seems that your account was recently (but before it was "hacked") promoting a scam:

Quote from: [BTC]onFIRE on July 09, 2015, 08:02:29 AM

Type: Twitter

Link:
https://twitter.com/btconfire/status/619128536276692992
https://twitter.com/btconfire/status/619128468815482880
https://twitter.com/btconfire/status/619128364385710082

Bitcoin Address: 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM

It was also recently willing to bet 10BTC that it was not in fact "sold" even though it pretty clearly was on or around May 15th as this is when many of it's posted BTC addy's were changed.

edit: I am also having difficulty trying to get the signature to verify...maybe you should try to sign a message that does not contain the "BTC" symbol as a test...

el kaka22

legendary

Activity: 3752

Merit: 1170

www.Crypto.Games: Multiple coins, multiple games

Verification failed. BTW please add [code] tags before and after you message, because [BTC ] without the space becomes BTC automatically.

[btc]onfire1

newbie

Activity: 1

Merit: 0

my account have been hacked on 8 august
i has sent a pm to theymos but still didn't get any reply

this is the proof
http://i60.tinypic.com/2qnxw7n.png

-----BEGIN BITCOIN SIGNED MESSAGE-----
My account BTConfire has been hacked/lost. Please reset the email to [email protected]. The current date is 8 august 2015.
-----BEGIN SIGNATURE-----
<1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM>

-----END BITCOIN SIGNED MESSAGE-----

Here is the unedited post where I posted that address: https://bitcointalksearch.org/topic/m.11460242

and now the hacker make a thread on service section please all member don't trust him and be carefull
link for his thread https://bitcointalksearch.org/topic/hiring-a-trusted-bitcointalk-user-1178955
and don't make some deal with him