Topic: Is St4yInTh3D4rk a hacked or sold account? (Read 1381 times)

The problem is, that all bustadice participants receive their rewads in their bustadice account and in the spreadsheet is no BTC address.  

---

---

I've reviewed the other accounts and all of them seem to be sold accounts:


liuqi

Posted in chinese before he went inactive for more than 3 years and woke up later to apply for bounties:

Suspected last post original owner:

Suspected first post new owner:

http://archive.is/8qff2#selection-1661.1-1661.32

Could be a good idea to verify the accusations by giving a statement to the Chinese community if he's still speaking Chinese.

---

---

semobo

Looks also very sold: http://archive.is/7XgUX#selection-1109.1-1109.35

Suspected last post original owner:

Suspected first post new owner (December 04, 2017, 03:06:04 PM):
https://bitcointalksearch.org/topic/m.25729271

Started shitposting in the Altcoin section with his next post on November 23, 2017: http://archive.is/7JuH2#selection-2065.5-2065.22

Sent Merit to jrrsparkles: http://loyce.club/Merit/history/226526.html
https://bitcointalksearch.org/topic/m.32777813
http://archive.is/weTre#selection-5987.0-5987.11

Merit connection is too weak but there's still the accusation for account sales.

---

I'm looking for BTC addresses now and will edit the post later.
Edited:

St4yInTh3D4rk 12oJAhTPSm3u12kwEqDoBAYGCgxR4tZK6h (archive)
semobo 12thqwSQVwsfjFJ6FExGme6oiFv3h3fudB (archive)
jrrsparkles  ??
playboy654 16v4nLgFmrRZAJTLz284Vte1wLHte223LP (archive)
liuqi 1MsSegu175os53nvnV96EWNmp4aJtZsmqA (archive)
Thanasis 1BmohtHyKDfQEjq1jFW7tz5WG3HaJhRBtK (archive)
supermine 17zVShKX7WSiweM7ucyjaiBmUJfhCphDUi (archive)
zhekinsp 1Cp4Q3C6fr84dULkSA1wg5WrLA63e3H5Bf (archive), (archive)


(semobo, Thanasis and zhekinsp applied here within 4 minutes)

I am not asking for a tag actually but I think such accounts should also be not allowed to participate in campaigns.

Regarding jrrsparkles this is what I am talking about:


Reference: [1] http://archive.is/Za1US#selection-66051.0-66055.10


Other than this I don't find anything from jrrsparkles in seclogs but if you look the archive you will notice that jrrsparkles is one of the accounts which were waking up from inactivity. Every minute atleast 9-10 accounts were waking up and all had the same ranks. Suspicious isn't it? And also on the same page you will find Thanasis password resets as well.

---

I still have to check other accounts as well with their seclogs and I might be doing it today.

I'm now convinced that jrrsparkles, semobo, and St4yInTh3D4rk are under the control of the same person.  There may me more accounts yet to discover.  Those three accounts in particular seem to have the same posting styles, use the same broken English, and make the same punctuation errors.  The evidence is all circumstantial, and I would prefer to find blockchain connections between the addresses used by the accounts.  Unfortunately I have not been able to.  

If true, the owner of these accounts is abusing the Bustadice campaign by having the accounts jrrsparkles and St4yInTh3D4rk enrolled concurrently.

jrrsparkles: *none found*
semobo: 12thqwSQVwsfjFJ6FExGme6oiFv3h3fudB
St4yInTh3D4rk: 12oJAhTPSm3u12kwEqDoBAYGCgxR4tZK6h

Once again, St4yInTh3D4rk has been silent since the prospects of alt accounts was mentioned.  That also seems odd.

I looked back into archives earlier and jrrsparkles was one of the newbies in 2017 which woke up. Many newbies in that log were waking up just with some seconds apart. What further more suspicious is that jrrsparkles woke up 1-2 day near when Thanasis changed his password.

I have to look up into archives again.

Surprisingly jrrsparkles is also a hacked/bought account.
Before April 2014, he posted in mining (altcoins) only and went inactive. Came back at December 12, 2017 and posted in Help and Beginners, replied in a thread someone asking for best bounty.
Merit circle mostly limited to supermine, thanasis, stayinthedark. No doubt it's another alt of stayinthedark. Sorry stayinthedark, you are not anymore allowed to stay in the dark 

Nice research, I've not the time to start digging right now but it took me no more than 1 minute to get another posting gap for another user:

jrrsparkles

April 06, 2014
http://archive.is/TNlWu#selection-2239.0-2239.11

December 12, 2017
http://archive.is/UYuKO#selection-2355.0-2355.11

Post history: http://archive.is/S1Ew3#selection-1117.1-1117.35

---

About the Merit received / sent during Eroiy signature campaign I don't think that it's very meaningful, it was a few days after the Merit System started and people sent Merit frequently.
Address connections would be interesting here but I've no time to dig deeper right now.

Good research anyway @Avirunes, +1

St4yInTh3D4rk was a participant in Eroiy signature campaign which started on 26th Jan 2018 and ended on 2nd March 2018. The campaign had special rates for those who had earned merits. St4yInTh3D4rk applied and was accepted on 27th Jan 2018.

This is the merit history of St4yInTh3D4rk



Interesting part is that user started receiving merit while in campaign. So I have marked all the accounts who have sent him/received merits.

Here is the catchy part: All those who I have marked as (suspected) have sent merits/received in their merit history to each others.

semobo (http://loyce.club/Merit/history/348980.html)
jrrsparkles (http://loyce.club/Merit/history/226526.html)
playboy654 (http://loyce.club/Merit/history/1330856.html)
liuqi (http://loyce.club/Merit/history/113294.html)
Thanasis (http://loyce.club/Merit/history/305365.html)
supermine (http://loyce.club/Merit/history/21690.html)


Want to know what others think of this?

---

I already checked one account of this list and it seems like this one Thanasis is a bought account.

The actual user used to post about his trading bot and posted last on September 25 , 2017 : https://bitcointalksearch.org/topic/m.22208725

On October 5, 2017 suddenly started posting in discussion threads https://bitcointalksearch.org/topic/m.22609061


Also on October 5, 2017 according to seclog's archive it seems like three password changes were made on that day.


Reference:
[1] http://archive.is/Za1US#selection-85995.0-85999.19
[2] http://archive.is/Za1US#selection-79643.0-79647.19
[3] http://archive.is/Za1US#selection-79275.0-79279.19

---

Just a side note: There is already a thread from ThePharmacist about supermine account being suspected as hacked/sold : https://bitcointalksearch.org/topic/m.48957146

At first, thanks for addressing the concerns here, @St4yInTh3D4rk

I believe you that you might not have the intention to scam anyone here and you look more trustworthy than the original owner (more due to the fact that the original owner pulled an exit-scam). But honestly I can't do much here. You know well that involvements in account sales are discouraged and accounts involved in it risk to get a red tag:

http://archive.is/OEDOK#selection-925.0-925.13

In comparison to most account buyers who deny their actions, I appreciate it that you admitted it having bought your account.

Since I'm relatively new to DT and not an experienced sold account detector I don't want to be a decisive factor about your account being tagged or not and I'm open to change my rating if some other DT members think you should be untagged. In addition, I will talk to your bounty manager.
Buying accounts is not a good idea, you know that. The date of your account purchase was way too late to be considered as legal (I don't know exactly when the view of the community regarding account sales changed).

And your story about Facebook is also a little bit weird, especially that your account was without mail. Like DireWolfM14 said I think it's not possible to have an account without mail and the questioned point of time was only a little bit than 1 year ago.

I would like if you can list the steps how you got the account from your first action until you posted the first post here. But I don't want to make too much hope for you, I don't know any case where a detected account buyer escaped without red tag lately.

I feel there is a very convenient language barrier, real or feigned. "got this from someone on facebook groups" means "met someone on facebook groups and got it from them", "change" means "add" or "reset", so "no email" can mean "no valid email" I guess. This is quite pointless.

Is that even possible?  I don't know how the forum functioned back then, but if I'm not mistaken an email address is mandatory for account creation.  I'm starting to regret attempting to help you save your account.  If this is indeed a hacked account that changes everything.


The thought occurred to me that St4yInTh3D4rk's lack of interest in defending the account might be due to having alts to which he could switch his focus.  Pm me what you've found and I'll try to make time to dig deeper as well.

Ok, not a bad story. It's possible that you would use password reset instead of password change and call it password change. I don't believe it but it's not me you have to convince.

When I got the account there is no email in it so I created new email and added it into this profile then later changed my password via email.

You're missing the point. There is no record of a password change or an e-mail change. You said you changed both, and it would make sense if you actually bought the account. But it doesn't look like you did.

Did I said I found username and pass on facebook? I found a user and he sold that to me.So he may sold me a hacked account.

^^Exactly^^

Your story of finding it from a facebook group is very hard to believe since it leaves why would a guy leave an account username and password on a facebook group. He could have sold it.

There are some further things that I find suspicious while you were in Eroiy's Signature campaign. I have no good proof of those accounts being linked but if anyone wants to go through their posting history and try to check with this user then I will send their names in Pm to run a check.



Hit the nail right at dot

Awesome. Except you didn't change the password or the e-mail address on that day, or at any point in 6 months prior, or 12 days after (didn't check later but it doesn't really mater). You reset the password on that day. I can think of two possible scenarios:

1) You're the original owner and forgot your password. Very unlikely due to the massive change in language proficiency.
2) You hacked (or otherwise obtained) the original owner's e-mail account and stole their Bitcointalk account. Very likely given that you just lied about how you got it.

Am I missing anything?

Yes,Exactly from this post: http://archive.is/GKVu0#selection-755.1-755.6

Was it November 8, 2017?

Yes,I started to post on the same day.

When was that? Date? Same day that you started posting on this forum?