November 22, 2024, 07:38:46 PM

Welcome, Guest

News: Latest Bitcoin Core release: 28.0 [Torrent]

Bitcoin Forum>Other>Meta

Pages:

Author

Topic: I just got a really weird PM (Read 593 times)

philipma1957

legendary

Activity: 4256

Merit: 8551

'The right to privacy matters'

Quote from: PowerGlove on July 16, 2022, 09:53:14 AM

Normally I wouldn't share something I've received by PM, but this feels dodgy and I have no idea who this person is:

Quote from: santhosh121081 on July 16, 2022, 12:06:56 PM

Hello PowerGlove,

I've replied to you
https://bitcointalksearch.org/topic/help-needed-with-blockchaincom-please-5406168

This person didn't participate in that thread and the "link" is some kind of messed up BBCode (which I sanitized before quoting above):

Code:

[flash=200,200]https://[/flash][url=https://bitcointalk.login-index.php-topic.794551.0.thegermanaccess.com/?u=PowerGlove&l=5406168.0]bitcointalk.oгg/index.php?topic=5406168.0[/url]

Anybody know anything? Huh

Edit: Here's an image of the message for anyone still interested:

Notice how the link is blue when it should be green. Also, notice the weird underlining that stops short of extending all the way to the left.

I've condensed what I learned from other members into a simple guide: Don't get your Bitcointalk account "phished" (Desktop/Laptop). Thanks everybody!

my alt got that and the person sending the message is tagged for fishing passwords.

this is the guy that sent to my alt.

tuannguyentn1

https://bitcointalk.org/index.php?action=trust;u=1343680

this is what he sent to my alt (a1 Hashrate LLC2022)

Quote from: tuannguyentn1 on July 17, 2022, 06:49:51 PM

Hello a1 Hashrate LLC2022,

I've replied to you
[url. =. http. ://. https : //bitcointalk . login-index.php-topic. 794551.0. PHISHING LINK REMOVED /?u= a1 Hashrate LLC2022 &l= 5405852.0] bitcointalk.oгg /index.php?topic = 5405852.0. [/ url]

I chopped it up a bit to make it safe

Lucius

legendary

Activity: 3234

Merit: 5637

Blackjack.fun-Free Raffle-Join&Win $50🎲

Quote from: hilariousandco on July 21, 2022, 12:51:03 PM

Well I finally got a response after I left him feedback haha:

It seems that you have found his weak point, because he obviously knows how the trust system works considering how he reacted. However, there is one positive thing in everything - now he knows that the forum has its own detectives who can very easily find out who is sending merits to whom, and also connect it all to possible alt accounts.

Quote from: hilariousandco on July 21, 2022, 12:51:03 PM

I figured he might at least own up to selling merit rather than hacking accounts. I wonder if his account is actually hacked? It's an account from early 2018 but has long periods of inactivity. He mentions he's based in the UK in an earlier post but the messages he's sent me are in broken English, or at least it seems English isn't his first language.

I'm not an expert in such matters, so I'll leave it to someone else - although it is possible that someone really lives in the UK, but that he is an immigrant whose English is not his native language, and this can especially be seen in written expression. Perhaps it would be easiest to detect whether the owner has changed through IP logs, but if I'm not mistaken, only admins have access to this data?

PowerGlove

hero member

Activity: 510

Merit: 4005

Quote from: santhosh121081 on February 26, 2019, 08:18:28 AM

#JOIN & #Proof of authentication

Facebook URL (personal): https://www.facebook.com/santhosh121081

Telegram username: @santhosh1981

ERC20 wallet for token distribution: 0x759b7576f2Ada6cD031A71Dd8070834e69e54DfD

Well played @SIXMJ, it's not at all suspicious to lose your shit and have a meltdown instead of answering the question. Cheesy

hilariousandco

global moderator

Activity: 3990

Merit: 2717

Join the world-leading crypto sportsbook NOW!

Quote from: Lucius on July 18, 2022, 09:58:09 AM

Quote from: hilariousandco on July 18, 2022, 07:16:41 AM

I messaged sixmj on the 16th asking if there was any good reason why he merited the earlier post and got no response.

It would be really strange if you got an answer, at least any meaningful one. The only reason why he gave merit to that post is to make that member Jr. Member, and besides, he probably thinks that no one will find out because the post is buried deep in the middle of some megathread from 2018. They want to cheat the system, but luckily they didn't even understand how it works.

Well I finally got a response after I left him feedback haha:

Quote from: santhosh121081 on February 26, 2019, 08:18:28 AM

Lucius

legendary

Activity: 3234

Merit: 5637

Blackjack.fun-Free Raffle-Join&Win $50🎲

Quote from: hilariousandco on July 18, 2022, 07:16:41 AM

I messaged sixmj on the 16th asking if there was any good reason why he merited the earlier post and got no response.

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

Quote from: LoyceV on July 18, 2022, 02:52:20 AM

Quote from: NotATether on July 18, 2022, 02:07:39 AM

The subdomains are hidden, so that less people get fooled. Most people will only look at the left-most part of the URL to see what website they are on, and hackers take advantage of that.

I'd hate it too, but there is no default configuration that satisfies everyone's wants at once. That's why I said there should be a settings option to toggle showing everything in the URL.

Quote from: LoyceV on July 18, 2022, 02:52:20 AM

I already dislike how Chromium hides the "http://", which only pops up when I click to edit (and then moves the entire URL to the right).

Chrome developers have decided that for "aesthetic reasons" that they should not allow this and other settings to be configured.

I mean there are many ways you can implement a trap door where you can enable "minimalist" and "advanced" settings, without cluttering the settings dialog itself (chrome://experiments, command-line options, config files, the list goes on). That's a pretty narrow-minded design decision if you ask me.

hilariousandco

global moderator

Activity: 3990

Merit: 2717

Join the world-leading crypto sportsbook NOW!

That sixmj account merited the below post yesterday:

Quote from: tuannguyentn1 on July 31, 2018, 08:15:32 AM

#Proof of authentication
telegram: @tnusa2
Bitcointalk profile link: https://bitcointalksearch.org/user/tuannguyentn1-1343680

Which was also banned for phishing yesterday: https://bitcointalksearch.org/topic/m.60584411

I messaged sixmj on the 16th asking if there was any good reason why he merited the earlier post and got no response.

LoyceV

legendary

Activity: 3290

Merit: 16489

Thick-Skinned Gang Leader and Golden Feather 2021

Quote from: NotATether on July 18, 2022, 02:07:39 AM

The subdomains are hidden, so that less people get fooled. Most people will only look at the left-most part of the URL to see what website they are on, and hackers take advantage of that.

I would hate that "feature" in my browser. I like being able to see the subdomains, and my screen is big enough to highlight an unexpectedly long URL. It could be useful on small mobile screens though.

I already dislike how Chromium hides the "http://", which only pops up when I click to edit (and then moves the entire URL to the right).

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

Quote from: PowerGlove on July 18, 2022, 02:33:55 AM

@NotATether, I see. I thought you were saying that you don't see anything in the lower-left when you hover over a link.

Nah, that part has always been good. I use vanilla chromium with no extensions anyway.

I forgot to include this part, but when hovering over the link, the box should make the main domain name in bold text, for damn's sake.

PowerGlove

hero member

Activity: 510

Merit: 4005

@NotATether, I see. I thought you were saying that you don't see anything in the lower-left when you hover over a link.

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

Quote from: PowerGlove on July 17, 2022, 11:34:28 PM

Quote from: NotATether on July 17, 2022, 10:57:26 PM

That still works for me in both Firefox and Chrome (Windows and Linux). It is pretty small though. Maybe you have some unusual extension installed?

That box is exactly what I'm talking about, but let me clarify it with some ASCII drawings.

Right now, when you are loading a page on Chrome and Firefox, they look like this, with the url in the lower-left status trimmed (unless you move your mouse there, then it moves to the lower-right, and vice versa):

Code:

=============================================================
# <- -> % |bitcointalk.org.hackers.inc/login.php | : #
#-----------------------------------------------------------#
# #
# #
# #
# #
# #
# CONTENT #
# #
# #
# #
# #
# #
# #
# #
# #
# #
#------------------------ #
#Loading https://hack...| #
=============================================================

It's not proportional, the real browser window makes the status bar about half of this size, and slightly more text, but you get the idea.

What I believe they should be showing is this:

Code:

=============================================================
# <- -> % | **hackers.inc** | : #
#-----------------------------------------------------------#
# #
# #
# #
# #
# #
# CONTENT #
# #
# #
# #
# #
# #
# #
# #
# #
# #
# #
#------------------------ #
#Loading https://hack...| #
=============================================================

There is only the root domain name in bold inside the URL bar (if you click inside the URL bar, then you will be able to see the full URL). The subdomains are hidden, so that less people get fooled. Most people will only look at the left-most part of the URL to see what website they are on, and hackers take advantage of that.

They already design it like that on mobile, but IMO this should be on desktop too, ideally with a setting to revert to the old behavior.

PowerGlove

hero member

Activity: 510

Merit: 4005

Quote from: NotATether on July 17, 2022, 10:57:26 PM

That still works for me in both Firefox and Chrome (Windows and Linux). It is pretty small though. Maybe you have some unusual extension installed?

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

Quote from: crwth on July 16, 2022, 10:06:43 AM

Be careful with these types of weird messages. It's best to open links in incognito, or better yet, never open them. It's easy to spot, though, if you are used to checking the links before clicking. I have seen some posts, IIRC, that swap out something like that.

Why have Chrome and Firefox stopped showing the links in big fat text at the bottom of the screen? (instead of the small tiny url cramped into one corner only when loading the page, which is for all practical purposes invisible to most users)??

In lynx for comparison, there is a huge prominent notice at the last terminal line where I can clearly see the URL being loaded. You know what, maybe I'll continue browsing like this, unless I want to see images then maybe I can open Chrome as a guest. It's like PGP-encrypting your account before logging in.

Quote from: hilariousandco on July 16, 2022, 10:34:46 AM

SIXMJ who merited that post is worth looking into. He received 3 merits from dragospirvu75 who has sent merit to the following:

   June 28, 2022, 01:12:32 AM: 3 to SIXMJ for Re: Want to buys some NFTs, please share your art...
   June 24, 2022, 12:26:27 AM: 1 to Irinatoken for Re: ð¥BLAZEPROTOCOL ð¥ Official Bounty Program
   June 12, 2022, 09:25:02 PM: 1 to Pktunnn for Re: ð [BOUNTY]!V! NOTCH COIN - ð°[100 000 000 NOTCH]ð° REWARD! ð
   June 11, 2022, 05:39:43 PM: 1 to ewck1442 for [ANN] Bitcoin Protocol - A Protocol to fulfulling Satoshi's Vision
   April 24, 2022, 02:43:32 PM: 1 to greenzon for Re: ð¥[BOUNTY]PIPSCHAIN - HYBRID EXCHANGE (Fiat & crypto currency in one platform)ð¥
   April 10, 2022, 04:43:42 AM: 1 to LoyceV for Re: I just began to run full node. Where do I see my contribution?

All are banned apart from Loyce. And guess what they're all banned for? Sending the same phishing PM including dragospirvu75. So either they're linked to the phishing or they're involved in selling merit to the phisher.

I can say that I had no idea that dragospirvu75 was harvesting merit for account farms, as someone who merited quite a few of his less shady posts.

Benkbeny

newbie

Activity: 25

Merit: 1

Quote from: dkbit98 on July 17, 2022, 10:55:32 AM

Quote from: PowerGlove on July 16, 2022, 09:53:14 AM

Anybody know anything? Huh

This is a known phishing scam attempt and it happened to me in bitcointalk forum few years ago, by hacked a now banned member kingpin4321.
I see this member who sent you message is now also banned, but best way is to report messages like this to moderator right away, and never click on any links you receive.
Generally speaking I don't trust any links I receive in forum or by emails and I always double check them.

Scammer has gone an extra mile to define mean to trap people by sending just a link to click in and once that is done your IP address display to them and them defines means to track your record and hack your account. Let's all be careful on link we click.

dkbit98

legendary

Activity: 2212

Merit: 7064

Quote from: PowerGlove on July 16, 2022, 09:53:14 AM

Anybody know anything? Huh

PrimeNumber7

copper member

Activity: 1652

Merit: 1901

Amazon Prime Member #7

Quote from: LoyceV on July 17, 2022, 12:47:40 AM

Quote from: PrimeNumber7 on July 17, 2022, 12:10:39 AM

The URL is clickable, but the forum has implemented a security feature that will display links to the bitcointalk forum as green when the user hovers their mouse over the link, and will display as blue for all other links.

That "green" is barely noticeable on my screen, and I bet I'm not alone.

I am aware of the feature and notice it. The feature may not be all that well known.

Quote from: LoyceV on July 17, 2022, 12:47:40 AM

I'm wondering why the security feature that stops fake links to be labeled "Bitcointalk.org" didn't kick in. Example:
http://google.com

Code:

[url=google.com]bitc ointalk.org[/url]

Converting the text to upper case answers it: BITCOINTALK.OГG.

Code:

google.com

It seems that using the above BB code will result in "google.com" to be displayed, however it will show as "bitcointalk.org" when previewing the post. It seems that saving the post will actually remove the BB code, and will only have the link after the "url=". Probably another good feature

PowerGlove

hero member

Activity: 510

Merit: 4005

Quote from: Fivestar4everMVP on July 17, 2022, 06:21:30 AM

I checked the Bitcointalk link i believe the spammer sent you and it seems a genuine Bitcointalk link which actually lead to a thread where a user is asking for help with Blockchain.com, this post is in the Beginners and Help Board.

I cleaned the link before posting it, to make it safe for other users to click. It's now a genuine Bitcointalk link, but it was a phishing link before (see BBCode in OP).

Fivestar4everMVP

legendary

Activity: 2422

Merit: 1083

Leading Crypto Sports Betting & Casino Platform

Quote from: PowerGlove on July 16, 2022, 09:53:14 AM

Normally I wouldn't share something I've received by PM, but this feels dodgy and I have no idea who this person is:

Quote from: santhosh121081 on July 16, 2022, 12:06:56 PM

Hello PowerGlove,

I've replied to you
https://bitcointalksearch.org/topic/help-needed-with-blockchaincom-please-5406168

But in as much as the link I quoted above looks genuine, I still did not understand why this user sent you this PM because I can also confirm that he didn't participate in the discussion on the thread, If he did, then maybe we would have given him the benefit of doubt and believe he probably wanted to PM another user but mistook you for that user by not taking notice of your username when he assumed he clicked the profile of the user he wanted to PM.

I will join other users to advice you report the PM and maybe block the user if you feel unsafe with your account., On no account should users unnecessarily PM other users on things that makes absolutely no sense, Bitcointalk is not Telagram where spammers have almost no restriction from PMing other random users.

Lucius

legendary

Activity: 3234

Merit: 5637

Blackjack.fun-Free Raffle-Join&Win $50🎲

Quote from: hilariousandco on July 16, 2022, 10:34:46 AM

One merit is still relatively hard to get, especially for a shitposter, but getting merit for this post today is a bit suspicious:

I don't agree that it's hard, not even for shitposters who will find a way to get it one way or another. It's no secret that there is a black market for merits, and if I'm not mistaken, the price is still 1 merit = $5. Given that a lot of bad things happen through PM, it would be good to think about blocking messages not only from Newbies but also from Jr.Members because I personally don't see any difference between those two ranks.

LoyceV

legendary

Activity: 3290

Merit: 16489

Thick-Skinned Gang Leader and Golden Feather 2021

Quote from: PrimeNumber7 on July 17, 2022, 12:10:39 AM

That "green" is barely noticeable on my screen, and I bet I'm not alone.

I'm wondering why the security feature that stops fake links to be labeled "Bitcointalk.org" didn't kick in. Example:
http://google.com

Code:

[url=google.com]bitc ointalk.org[/url]

Converting the text to upper case answers it: BITCOINTALK.OГG.

Quote from: hilariousandco on July 16, 2022, 10:34:46 AM

All are banned apart from Loyce.

I dodged the bullet there

Pages:

Bitcoin Forum>Other>Meta

Jump to: