Topic: Is St4yInTh3D4rk a hacked or sold account? (Read 1423 times)

The problem is, that all bustadice participants receive their rewads in their bustadice account and in the spreadsheet is no BTC address.  

---

---

I've reviewed the other accounts and all of them seem to be sold accounts:


liuqi

Posted in chinese before he went inactive for more than 3 years and woke up later to apply for bounties:

Suspected last post original owner:

Suspected first post new owner:

http://archive.is/8qff2#selection-1661.1-1661.32

Could be a good idea to verify the accusations by giving a statement to the Chinese community if he's still speaking Chinese.

---

---

semobo

Looks also very sold: http://archive.is/7XgUX#selection-1109.1-1109.35

Suspected last post original owner:

Suspected first post new owner (December 04, 2017, 03:06:04 PM):
https://bitcointalksearch.org/topic/m.25729271

Started shitposting in the Altcoin section with his next post on November 23, 2017: http://archive.is/7JuH2#selection-2065.5-2065.22

Sent Merit to jrrsparkles: http://loyce.club/Merit/history/226526.html
https://bitcointalksearch.org/topic/m.32777813
http://archive.is/weTre#selection-5987.0-5987.11

Merit connection is too weak but there's still the accusation for account sales.

---

I'm looking for BTC addresses now and will edit the post later.
Edited:

St4yInTh3D4rk 12oJAhTPSm3u12kwEqDoBAYGCgxR4tZK6h (archive)
semobo 12thqwSQVwsfjFJ6FExGme6oiFv3h3fudB (archive)
jrrsparkles  ??
playboy654 16v4nLgFmrRZAJTLz284Vte1wLHte223LP (archive)
liuqi 1MsSegu175os53nvnV96EWNmp4aJtZsmqA (archive)
Thanasis 1BmohtHyKDfQEjq1jFW7tz5WG3HaJhRBtK (archive)
supermine 17zVShKX7WSiweM7ucyjaiBmUJfhCphDUi (archive)
zhekinsp 1Cp4Q3C6fr84dULkSA1wg5WrLA63e3H5Bf (archive), (archive)


(semobo, Thanasis and zhekinsp applied here within 4 minutes)

I am not asking for a tag actually but I think such accounts should also be not allowed to participate in campaigns.

Regarding jrrsparkles this is what I am talking about:


Reference: [1] http://archive.is/Za1US#selection-66051.0-66055.10


Other than this I don't find anything from jrrsparkles in seclogs but if you look the archive you will notice that jrrsparkles is one of the accounts which were waking up from inactivity. Every minute atleast 9-10 accounts were waking up and all had the same ranks. Suspicious isn't it? And also on the same page you will find Thanasis password resets as well.

---

I still have to check other accounts as well with their seclogs and I might be doing it today.

I'm now convinced that jrrsparkles, semobo, and St4yInTh3D4rk are under the control of the same person.  There may me more accounts yet to discover.  Those three accounts in particular seem to have the same posting styles, use the same broken English, and make the same punctuation errors.  The evidence is all circumstantial, and I would prefer to find blockchain connections between the addresses used by the accounts.  Unfortunately I have not been able to.  

If true, the owner of these accounts is abusing the Bustadice campaign by having the accounts jrrsparkles and St4yInTh3D4rk enrolled concurrently.

jrrsparkles: *none found*
semobo: 12thqwSQVwsfjFJ6FExGme6oiFv3h3fudB
St4yInTh3D4rk: 12oJAhTPSm3u12kwEqDoBAYGCgxR4tZK6h

Once again, St4yInTh3D4rk has been silent since the prospects of alt accounts was mentioned.  That also seems odd.

I looked back into archives earlier and jrrsparkles was one of the newbies in 2017 which woke up. Many newbies in that log were waking up just with some seconds apart. What further more suspicious is that jrrsparkles woke up 1-2 day near when Thanasis changed his password.

I have to look up into archives again.

Surprisingly jrrsparkles is also a hacked/bought account.
Before April 2014, he posted in mining (altcoins) only and went inactive. Came back at December 12, 2017 and posted in Help and Beginners, replied in a thread someone asking for best bounty.
Merit circle mostly limited to supermine, thanasis, stayinthedark. No doubt it's another alt of stayinthedark. Sorry stayinthedark, you are not anymore allowed to stay in the dark 

Nice research, I've not the time to start digging right now but it took me no more than 1 minute to get another posting gap for another user:

jrrsparkles

April 06, 2014
http://archive.is/TNlWu#selection-2239.0-2239.11

December 12, 2017
http://archive.is/UYuKO#selection-2355.0-2355.11

Post history: http://archive.is/S1Ew3#selection-1117.1-1117.35

---

About the Merit received / sent during Eroiy signature campaign I don't think that it's very meaningful, it was a few days after the Merit System started and people sent Merit frequently.
Address connections would be interesting here but I've no time to dig deeper right now.

Good research anyway @Avirunes, +1

St4yInTh3D4rk was a participant in Eroiy signature campaign which started on 26th Jan 2018 and ended on 2nd March 2018. The campaign had special rates for those who had earned merits. St4yInTh3D4rk applied and was accepted on 27th Jan 2018.

This is the merit history of St4yInTh3D4rk



Interesting part is that user started receiving merit while in campaign. So I have marked all the accounts who have sent him/received merits.

Here is the catchy part: All those who I have marked as (suspected) have sent merits/received in their merit history to each others.

semobo (http://loyce.club/Merit/history/348980.html)
jrrsparkles (http://loyce.club/Merit/history/226526.html)
playboy654 (http://loyce.club/Merit/history/1330856.html)
liuqi (http://loyce.club/Merit/history/113294.html)
Thanasis (http://loyce.club/Merit/history/305365.html)
supermine (http://loyce.club/Merit/history/21690.html)


Want to know what others think of this?

---

I already checked one account of this list and it seems like this one Thanasis is a bought account.

The actual user used to post about his trading bot and posted last on September 25 , 2017 : https://bitcointalksearch.org/topic/m.22208725

On October 5, 2017 suddenly started posting in discussion threads https://bitcointalksearch.org/topic/m.22609061


Also on October 5, 2017 according to seclog's archive it seems like three password changes were made on that day.


Reference:
[1] http://archive.is/Za1US#selection-85995.0-85999.19
[2] http://archive.is/Za1US#selection-79643.0-79647.19
[3] http://archive.is/Za1US#selection-79275.0-79279.19

---

Just a side note: There is already a thread from ThePharmacist about supermine account being suspected as hacked/sold : https://bitcointalksearch.org/topic/m.48957146

At first, thanks for addressing the concerns here, @St4yInTh3D4rk

I believe you that you might not have the intention to scam anyone here and you look more trustworthy than the original owner (more due to the fact that the original owner pulled an exit-scam). But honestly I can't do much here. You know well that involvements in account sales are discouraged and accounts involved in it risk to get a red tag:

http://archive.is/OEDOK#selection-925.0-925.13

In comparison to most account buyers who deny their actions, I appreciate it that you admitted it having bought your account.

Since I'm relatively new to DT and not an experienced sold account detector I don't want to be a decisive factor about your account being tagged or not and I'm open to change my rating if some other DT members think you should be untagged. In addition, I will talk to your bounty manager.
Buying accounts is not a good idea, you know that. The date of your account purchase was way too late to be considered as legal (I don't know exactly when the view of the community regarding account sales changed).

And your story about Facebook is also a little bit weird, especially that your account was without mail. Like DireWolfM14 said I think it's not possible to have an account without mail and the questioned point of time was only a little bit than 1 year ago.

I would like if you can list the steps how you got the account from your first action until you posted the first post here. But I don't want to make too much hope for you, I don't know any case where a detected account buyer escaped without red tag lately.

I feel there is a very convenient language barrier, real or feigned. "got this from someone on facebook groups" means "met someone on facebook groups and got it from them", "change" means "add" or "reset", so "no email" can mean "no valid email" I guess. This is quite pointless.

Is that even possible?  I don't know how the forum functioned back then, but if I'm not mistaken an email address is mandatory for account creation.  I'm starting to regret attempting to help you save your account.  If this is indeed a hacked account that changes everything.


The thought occurred to me that St4yInTh3D4rk's lack of interest in defending the account might be due to having alts to which he could switch his focus.  Pm me what you've found and I'll try to make time to dig deeper as well.

Ok, not a bad story. It's possible that you would use password reset instead of password change and call it password change. I don't believe it but it's not me you have to convince.

When I got the account there is no email in it so I created new email and added it into this profile then later changed my password via email.

You're missing the point. There is no record of a password change or an e-mail change. You said you changed both, and it would make sense if you actually bought the account. But it doesn't look like you did.

Did I said I found username and pass on facebook? I found a user and he sold that to me.So he may sold me a hacked account.

^^Exactly^^

Your story of finding it from a facebook group is very hard to believe since it leaves why would a guy leave an account username and password on a facebook group. He could have sold it.

There are some further things that I find suspicious while you were in Eroiy's Signature campaign. I have no good proof of those accounts being linked but if anyone wants to go through their posting history and try to check with this user then I will send their names in Pm to run a check.



Hit the nail right at dot

Awesome. Except you didn't change the password or the e-mail address on that day, or at any point in 6 months prior, or 12 days after (didn't check later but it doesn't really mater). You reset the password on that day. I can think of two possible scenarios:

1) You're the original owner and forgot your password. Very unlikely due to the massive change in language proficiency.
2) You hacked (or otherwise obtained) the original owner's e-mail account and stole their Bitcointalk account. Very likely given that you just lied about how you got it.

Am I missing anything?

Yes,Exactly from this post: http://archive.is/GKVu0#selection-755.1-755.6

Was it November 8, 2017?

Yes,I started to post on the same day.

When was that? Date? Same day that you started posting on this forum?

To be honest,I got this from someone on facebook groups when I was searching for how to make money when I was in need.

Since that I am using this account and changed email and password immediately after I got it from him.

Post details how you got the account. I checked all the archive.is seclogs and found only two recorded that I had posted above.

There is no record in seclog between the post made by the last owner and the first post you made after account got under your possession. I am not convinced until proofs are posted publicly.

Thanks yahoo,

I hope other two people who left the negative will take this into consideration.

Revised my rating to a neutral as I don't feel the account has/will be used to scam.

Quoting for reference

Sorry everyone,as the evidence says I am not the same person who had this account until 2016 and pulled out an exit scam from zonecoin project.

Since I got this account I never involved any shady activity like taking loans or buying or selling anything or any other thing a scammer will do from high ranked accounts.I am just here to contribute to other fellow forum members with my crypto knowledge.I didn't really participated on many signature campaigns other than bustadice since that I am giving my effort to help other people.

I don't know I can be given an excuse for accepting the real fact,let the community decide what will be the result.

It's very odd that he has not responded. He's been online a few times since my pm.

As fas as my tag, I will remove the tag once he provides a proper response here and it does not involve him scamming to obtain the account. I have not been 1 that tags many account buyers/sellers unless the account bought/sold has a high trust rating. I feel like high trust rated accounts will be used more often for scamming intentions. I cannot speak for any other DT, they will do as they wish.

It's quite interesting that St4yInTh3D4rk has not commented on the subject, the silence is deafening. 

Ironically the old owner of the account appears to have pulled an exit scam, while the new owner has merely participated in sig campaigns since the alleged purchase.  The actions of the old owner are far more deserving of red-tags than anything the new owner has done.  There was a time when buying an account was not frowned upon the way it is today.  That was before my time, so I'm not sure when the transition in philosophy came to pass.  Looking back on the activities of the new owner for the past couple of years, I would almost be willing to give him a pass since he hasn't attempted to anything nefarious with the account. 

I know this is probably not a popular stance, but to those of you have tagged the account; would you be willing to revise your feedback to neutral if the new owner comes clean?  The only reason I make this suggestion is because there isn't any evidence the new owner intends to scam anyone.

@St4yInTh3D4rk, I would encourage you address this situation with honesty.  Obviously your silence has not helped you in any way.  Your account has been tagged, so you really don't have anything to lose at this point.

+1
I've left another feedback. Maybe he hasn't much to say to prove it wrong. 

Honestly, I wouldn't trust the old owner either for letting his investors "in the dark" about Zonecoin and failing to pay back his loans: https://bitcointalksearch.org/topic/m.17025366

I have tagged the account in question for now until they respond here and this is all figured out. It's likely the account is bought and in that case more DTs will tag him for account sales. That's why I believe he hasn't responded so far.

Alright, that's the same impression I had about social media accounts, especially if the mail address expires, someone can take over all the social media accounts by re-registering the mail and resetting the password via mail. (if they haven't changed hands already before in addition to the Bitcointalk account sale)

He posted some documents containing his name + some other information here. I don't know in which way these documents are manipulated but in case if it would be necessary to verify it, there's an address of the company he communicated with (goodall barnett james). It's an existing company but I think there's no need in contacting them, I don't know how serious shitcoin scams / failed projects were handled in the past.

---

Today St4yInTh3D4rk was active again but it seems he has no interest to respond here although yahoo62278 sent him a PM...
I'm busy tomorrow and will wait another day before taking any action although I think the case is clear.

With some social media platforms you can re-register an username that was already used previously. Like some email providers recycle the old email IDs (i.e. outlook). I wouldn' rely on that at 100%.
Not to mention the possibility of having access to the social media account (why not using a re-registered email?...)

If it was an account used for promotion of an ICO project it would seem that the social media accounts were also sold along with the forum account.  The only thing that makes me hesitant about this is that St4yInTh3D4rk posted what appears to be his real name.  Of course with a handle essentially claiming to "stay in the dark" the name Dominic Quick could be a fake.  Since the ZONECOIN project was abandoned with the investors left holding the bag, and apparently started out as an exit scam that seems like a safe assumption.

Many thanks for your reply! I'm also waiting for some more opinions as well as St4yInTh3D4rk to reply here. There is also a mail address ([email protected]) but the seclog looks like the account was most likely sold together with the mail address.

BTW what's the stand of everyone here on verifying ownership via Social Media accounts? Too weak?

Interesting. I was kind of involved in Zonecoin way back when and I do remember this user. In my mind there's no doubt that the account did in fact change hands, low effort posts and joining signature campaigns is a telling sign as is the change in his English skills. There was a similar case recently with a VIP user and that account ended up being tagged.

I'll give it a bit for him to reply in this thread but if there's no irrefutable evidence stating that it's still the same user I'll drop a trust rating. Thanks 1miau for bringing this to my attention!

Good observation, the first gap seems to be a normal one, also the content is very similar like his utilisation of BTCPOP:
Before the first gap: https://bitcointalksearch.org/topic/m.11143502
After the first gap: https://bitcointalksearch.org/topic/m.14607449

And the second gap is where the ownership changed, when he stopped managing the Zonecoin ANN and abandoned the project.

I've also sent a PM to Hhampuz.

Definitely, he changed the password before he made his first post after the gap: November 08, 2017, 12:34:28 PM

Seclog:


[1] http://archive.is/WwcT6#selection-51999.0-52003.10
[2] http://archive.is/WwcT6#selection-51735.0-51739.27

---

Totally matches with the timeline when new style of posting is noticed.


And, there is no logs of password changes since then. (I mean after the above in log block)

There's another large gap in posts from April 2015 to April 2016.  I don't see any difference in the quality of English from before and after the older gap, but the gap from 2016 to 2017 does result in a significant change.  For example:


A native English speaker would never write "bitcoin trading is more safer," regardless of how lazy he was at applying the written language.  And the lack of punctuation is another telling sign, although some native English speaker can be quite lazy about punctuation when writing.

The original post definitely seem to come from one who is a native English speaker, or at least one who's been well educated in the use of the language.

I have sent the user in question a message to respond here. Being as he is in the bustadice campaign managed by me, i'm curious to see what comes of this.

I'm not a native English speaker but the user definitely "unlearned" the language between Sep 2016 - Nov 2017, no question about that. Plus the lack of spaces after punctuation and some other minor details indicate it's a different person.

Good idea but I don't know if that would be enough proof, Social Media accounts can also be hacked or sold. He posted also an ETH-Address here: https://bitcointalksearch.org/topic/m.15630503
http://archive.is/5PJvA#selection-1563.27-1563.69

(0x32ce1e303f62e992c012866585bac0301badfb16)

Can ask an authentication post from twitter or reddit

https://bitcointalksearch.org/topic/m.15948807
Archive http://archive.fo/DQ5Xw
 
https://bitcointalksearch.org/topic/m.15847651
Archive http://archive.fo/H1J0i

I’ve detected an interesting account and I think it’s worth a closer look, here are the details:


Account: St4yInTh3D4rk https://bitcointalksearch.org/user/st4yinth3d4rk-409210

Suspected last post original owner: September 27, 2016

Suspected first post new owner: November 08, 2017

Archive: http://archive.is/GKVu0#selection-755.1-755.6


It’s not only a posting gap of more than one year, it’s also a change in the quality of his posts and where they are posted. The posts of the old owner are totally different. He was developer at Zonecoin (ZNE) and managed their Bitcointalk ANN. Hhampuz commented frequently in their ANN when he was a Member. I think he can help us to determine if the owner is still the same.

The old owner posted some details about his identity here and where he came from (native English speaker):
Dominic Quick, East Sussex, UK
https://bitcointalksearch.org/topic/m.15882291


The project of Zonecoin was abandoned in September 2016 and the investors of Zonecoin never heard again anything about it: https://bitcointalksearch.org/topic/m.16987146

But the Zonecoin-developer St4yInTh3D4rk started posting more than one year later again, this time with medium-quality posts in Gambling, Altcoins, Bitcoin Discussion etc.
And for my judgement (as a non-native English speaker) the quality of his posts is hardly the same like before.

Some examples made by the suspected new owner:

http://archive.is/mmpXO#selection-2137.0-2137.13

http://archive.is/pVBRS#selection-469.0-469.13

http://archive.is/CXHJC#selection-5591.0-5591.13

---

I would like to clarify a few things:

- If you are a native English speaker, please have a look at his comments he made before and after the suspected change of owner. The quality decreased a lot in my opinion which is a strong indicator for hacked / sold accounts.

- I would like to hear the opinion of Hhampuz if he can imagine that the developer of Zonecoin is now involved in signature campaigns.


It would also be interesting to hear St4yInTh3D4rk (if he is still the same owner) why he abandoned his Zonecoin project, let down his investors and started participating in signature campaigns one year later.