Topic: Account hacked (Read 1472 times)

I wouldn't say exactly that the forum is turning a blind eye to such goings on, but they are leaving it up to the forum's participants to self monitor and dish out a kind of retribution in the form of trust, either positive, neutral or negative depending on the transgression.

There's nothing to stop retaliatory negative trust, or indeed false trust from an Alt to give the allusion of trust where non exists.

Most of the scams are for a couple of dollars so people aren't likely to go to the police for that kind of coin.  Unfortunately, all we can do is build up a profile of the scammers and mark each one accordingly with Red Paint ^TM and hope that punters in future are clued up enough to read the trust trusted, or in my case untrusted, and hope users make an informed decision about what is written.

@Timelord2067 That is one hell of a detailing my dear friend. I know you have spent an aweful lot of time investigating this scam or fraudster .You are indeed a scam buster and hats off to you and my question is is it possible to file an FIR against these individuals for fraud as i have seen an FIR being logged recently in India for scamming 1.5 BTC. I am not sure about how the end results will be but in this case the admins does have their IP address and i expect them to hand over the IP address when there is a police complaint.

I'm going to go out on a limb and say that [BTC]onFIRE was never hacked on the 8th of August and that [BTC]onFIRE is a chronic scammer with dozens of Alts.

The OP creates this thread https://bitcointalksearch.org/topic/account-hacked-1179091 on the 13 September 2015, 16:37:27 and less than ten hours later goes off-line permanently having posted just once...


When the signed message doesn't appear to hold up, whywefight ponders:


The actual post:

http://archive.is/6HZUj#selection-545.0-587.44


The signed message posted by [btc]onfire1


Message verified: http://coinig.com/?adr=1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM&msg=My+account+%5Bbtc%5Donfire+has+been+hacked%2Flost.+Please+reset+the+email+to+new.apache%40yahoo.com.+The+current+date+is+8+august+2015.&sig=H1VpZYbglS7uO4br2VPCZKYPKg%2BThvJNA5pIBksDwhMYaru%2BTSAZ5ciqbqBSN8faD9sn5fvwF9nFtIwcn4dLrs0%3D

Funds from 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM were shifted to 3Px19pCL9xmZattPzCajsqDdGQrVMMpcBG 0.0101613 BTC 2015-09-03 10:30:17 and have sat dormant ever since.  Both Wallet Addresses are the sole Wallet Addresses for their respective Wallets - Wallet [882c19fcb6] and Wallet [3bf18a15a6]

https://twitter.com/btconfire is still tweeting / retweeting - last such post was two days ago.  On the other hand...

https://twitter.com/bitcoinonfire returns: Sorry, that page doesn’t exist!

while the Wallet Address 1G53GvfHhuvxKsCJZLPX91oPppkWDRdq returns a Checksum does not validate as confirmed previously.

---

Right up until the day before the UID was "hacked", they were using the Wallet Address 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM used to then reclaim the account by [btc]onfire1:

First use is at top of post.

Second use:  http://archive.is/AAVdS#selection-3655.0-3681.23 (note the use of day-month-year)


Fourth use:  http://archive.is/4oTF0#selection-1573.0-1619.47


Fifth use:  http://archive.is/VKSv6#selection-7175.0-7203.34


Last use: http://archive.is/eoiUX#selection-4465.0-4484.8


all of which could have been modified by the "hacker" but weren't.

---

The fact the account has stopped being used tells me a scammer was in control of the account

[BTC]onFIRE wanted it to appear as though the account had been hacked and then abandoned.


The scammer has a sense of irony though:  http://archive.is/naNSu#selection-5805.47-5805.85

though I doubt I'll see any of the promised BTC 10.0 any time soon... 

http://archive.is/naNSu#selection-1581.0-1585.5
http://archive.is/naNSu#selection-2597.0-2597.82
http://archive.is/naNSu#selection-3965.0-3967.40

No-one followed up on this though:  http://archive.is/AOlSW#selection-4401.0-4421.244


No negative trust on their wall, and no scam accusation that I can see.

---

Still not sure how these codes actually work but given the short activity of titaniumfox I'd say they are an Alt of the scammer who took over the OP's main account.


 Re: [ 18.5+ BTC PAID! ] CryptoFATE.com == GET 150% INSTANTLY == TRANSPARENT AND FAIR
19 October 2015, 18:43:08 https://bitcointalksearch.org/topic/m.12726250 (Locked thread) http://archive.is/QxdUM#selection-2595.0-2617.34


http://archive.is/D4OIE#selection-4813.0-4833.107


http://archive.is/D4OIE#selection-4989.0-5009.107


http://archive.is/Yb60b#selection-4789.0-4809.107



Same page as alieksandrv post:  http://archive.is/Yb60b#selection-2015.0-2034.1


MAsterV referral use of that code on BCT: http://archive.is/rHmnX#selection-3963.0-3965.109 but doesn't appear to be otherwise connected. [1]

---

OK, so we have the following::

Accounts connected: [BTC]onFIRE, [btc]onfire1,

and separately, we have:

Accounts connected:

(unknown scammer), titaniumfox, alieksandrv,

So, where are we at?

I connected: ozgr, misteagle, reyhiesa, zhuravskij3, Desert Flame, nickaizoku, bms2013, Berthorl, SvintuS

here: https://bitcointalksearch.org/topic/m.14394021 using Wallet Address 1BwnkpAb7zxozGfsyEc4tbguhDuQi6RScr so if titaniumfox is using 1BwnkpAb7zxozGfsyEc4tbguhDuQi6RScr that means the hacker is an Alt of ozgr, misteagle, reyhiesa, zhuravskij3, Desert Flame, nickaizoku, bms2013, Berthorl, SvintuS and by extension, so are alieksandrv, planetroving, Lamigo, afidwildan, Nami, kingwasabi, Thresh, Shyvana,     

Proof:

titaniumfox

http://archive.is/qgpze#selection-2103.0-2127.6


http://archive.is/qgpze#selection-2275.0-2297.7


http://archive.is/qgpze#selection-2627.0-2649.8


planetroving

http://archive.is/bDnWq#selection-2247.0-2271.6


http://archive.is/qeD58#selection-5321.0-5345.6


http://archive.is/nbBVu#selection-927.0-951.6


http://archive.is/H9ytT#selection-5359.0-5383.6 (third Alt on the one page)


bms2013 and zhuravskij3 posts on the same page that Thresh posts three times:

http://archive.is/LIKnX#selection-3003.0-3025.7


http://archive.is/LIKnX#selection-7061.0-7083.25


http://archive.is/LIKnX#selection-8387.0-8763.6