Topic: Owner of IP address 73.225.159.251 is a hacker and tried to hack my account (Read 6977 times)

Because he was most likely the person who had hacked the forum.

edit: I am not sure it was hacked though

Why TF and not someone else ?

Ahhh, thanks for clearing that up. If your account was in fact breached because of when the forum was hacked then it was most likely TF who hacked your account.

My account was never sold. A breach in the forum database is what caused it I believe. I communicated privately through Theymos (I was not wardrick_hacked) to get it resolved. Unless my computer was infected, which is highly unlikely because nothing other than my Bitcoin profile was affected, then there was no way for the hacker to get my email in which they socially engineered the provider for and it was blank (I never used it for anything besides registering to this site and never logged back into it). Someone was intending to either sell my account when it was purchased or it was sold in that minimal time period because the hacker/user had shown no intentions to scam and was only using it for community purposes (discussion, investigating, leaving feedback, etc.). The hacker was definitely not a novice. Anyway, I am glad to have my account back

1 - the account was not hacked, it was most likely sold back in March (I think) and was then fake hacked in September
2 - the fake hack did not even use the secret question, it involved using a link to reset the password of the account, of which was posted in the OP

tl;dr: Never use secret question feature for an alternative login

Why is it stupid that you trust some idiot who got hacked whom you don't even know? I'm asking about  your trust list here. Why do you trust a hacked account? I am suggesting you own it or sold it, that's all. ...

That is a stupid question. Whose else trust list is he suppose to be on? The vast majority of people on DT are only on one person on Level 1 (of DT)'s trust list. He was never on any one else's trust list AFAIK

Cool story. But... Why is he only on BadBear's and your trust lists? Seems kinda odd to me. 

Theymos had previously said that he locked his account so based on the fact that he is posting means that either theymos or BadBear got involved.

probably the real/legitimate owner (whichever that is...) finally contacted theymos with the necessary proof to claim the account back.

Hey look who's back - https://bitcointalksearch.org/user/wardrick-85316

And wow... cleaned up trust, still on default I see.

Hmm.. Did Somebody sell an account on DT lately?

Trust summary for Wardrick

This user's password was reset recently.

That is right, he did leave a neutral rating for you. This fact strengthens my suspicion as to who was behind that account.

I see that someone has created an account with the handle "wardrick_hacked".....is there any update regarding if there is evidence that this person might be the rightful owner of wardrick, and if so if his account will be returned to him?

Now someone has created this account :

 -  https://bitcointalksearch.org/user/wardrickhacked-557613  (wardrick_hacked)

Let's see if he will be able to sign a message (to recover his forum account, if he is the real Wardrick).

Low American hack,this is so funny.

He also left to me a neutral trust rating and now it has been removed. The hack was only a poor skit and maybe you are right, his account was bought by someone who knows how the trust system works....

By compromised, you mean sold right? Wardrick had made his intentions pretty clear on his last few posts before he went inactive for several months:

^^his last post prior to him going inactive for several months.

If you say that something happened to Wardrick's account in May then I would confidently say that it was sold; I can even say with a good amount of certainty who purchased it, based on what was posted in various threads (but I am not going to speculate about this) (it was not me). I would say the reason that the owner of Wardrick has not contacted you is likely because the (new) owner of Wardrick (probably, but maybe not) got a signed message transferring ownership, then has never posted another BTC address (or anything else that can be signed from) since then, which would make proving ownership very difficult.

Even if the above is incorrect, Wardrick had expressed a disconnect with bitcointalk and had mentioned his disinterest in continuing to participate in the community. He had also expressed a strong opinion on one of his trust ratings. My major concern about removing recent trust ratings is that since you are not 100% certain the person leaving the trust ratings was not the rightful owner of the account (by some measure), then removing such trust ratings would be essentially moderating his trust ratings (as some of them were controversial), and this is very disconcerting. What is even more disconcerting is that this appears to be an example as to how a scammer can get away with scamming simply by complaining loud and long enough, and slings enough dirt at the person(s) calling them out then they will be able to scam without consequence.

The Wardrick account left a negative trust rating for tspacepilot and Brad Harrison, left a neutral rating for turtlehurricane (although I believe that may have been removed prior to yesterday), and left a positive trust rating for tomatocage. I don't think the account was hacked though because the "real" owner would have likely come back to attempt to claim the account sometime between May and now, especially considering the amount of business it was conducting prior to May (assuming he wanted to remain on bitcointalk).
It was most likely sold, see the above part of my post.

Did you happen to keep a record of these ratings? They might be useful in determining who stole his account. I wouldn't be surprised if they left positive trust for themselves and/or negative trust for their enemies. I can't see why else someone would hack a DT account and keep it secret for so long, they knew any trust they left would be worthless if it came to light that the account had been hacked.

Perhaps Wardrick hasn't come forward because he sold the account, I'm sure it would've been worth a fair amount.

Great, now if only Vod would remove his pointless one

Thank you. The original Wardrick had been inactive for a while until he rose up to this situation (I think) so he may have left the forum.

I suspect that Wardrick's account was compromised around May, though I'm not 100% sure. But I'm not hearing any evidence one way or another from anyone who previously owned the account, so I suppose the account will be locked for some time. Therefore, I removed Wardrick's recent sent trust ratings. He can rewrite them later if his account is ever restored.

I wish you would open a new thread in Scam Accusations and keep all your posts there.  No need to duplicate post everything in multiple threads. 

QS will be doxxed and nothing would stop me from publishing that. I'll probably post it today if everything goes right with my 2nd SE attempt to the PO to get some additional info. Otherwise I'll post up what I have tonight/tomorrow so people know I'm serious. Fuck you Quickseller, and fuck you "Wadrick".

Blazr remove the false negative feedback you left me. I have proof I didn't steal Wardricks email. Read the entire fucking post moron. And I've never attempted to extort Quickseller. That kid has been getting doxxed since the second I got his info. Maybe if you'd read the entire fucking post on that too you'd have seen that I was publishing it either way.

I'll update a post ASAP with personal info on Quickseller.

What are you going to do? Leave him some negative trust? He's already at -9999...

Trust: -9999: -21 / +10

That would be a score of 10-2**21 = -2,097,142 if it didn't max out at -9999!

Is that actually fine? People trust admins with...




I agree with that.

coinchat, I guess. TF gave (or sold, maybe) the site to the current admin around that time, AFAIK.

At least Vod and others that QS said would sue them deserve to know his identity, if Shadow_Runner is not bluffing

I do agree with that. I do not approve QS' actions, but doxxing him seems a step to far IMO.

It's it fair to dox someone who did not any scam? afik he just escrowed for himself!

I will have a full dox of Quickseller posted by Friday if not earlier and will continue to update it and bust his alts.

Where are they from?

All teh IPz I have on tspacepilot, very outdated but why not let it show up in Google?
('93.222.253.250', 'tspacepilot', '2013-07-30 20:29:19'),
('93.222.253.250', 'tspacepilot', '2013-07-30 21:29:13'),
('93.222.253.250', 'tspacepilot', '2013-07-30 22:36:36'),
('93.222.225.18', 'tspacepilot', '2013-07-31 09:12:41'),
('93.222.225.18', 'tspacepilot', '2013-07-31 11:08:21'),
('88.128.80.7', 'tspacepilot', '2013-08-03 10:05:16'),
('184.78.197.79', 'tspacepilot', '2013-08-05 14:25:24'),
('69.91.131.199', 'tspacepilot', '2013-08-05 20:47:27'),
('184.78.197.79', 'tspacepilot', '2013-08-06 14:59:50'),
('184.78.197.79', 'tspacepilot', '2013-08-06 15:59:01'),
('184.78.197.79', 'tspacepilot', '2013-08-06 16:13:48'),
('184.78.197.79', 'tspacepilot', '2013-08-06 22:57:36'),
('184.78.197.79', 'tspacepilot', '2013-08-06 23:19:17'),
('184.78.197.79', 'tspacepilot', '2013-08-08 00:06:06'),
('184.78.197.79', 'tspacepilot', '2013-08-08 03:51:57'),
('184.78.197.79', 'tspacepilot', '2013-08-08 05:43:45'),
('184.78.197.79', 'tspacepilot', '2013-08-08 14:31:38'),
('184.78.197.79', 'tspacepilot', '2013-08-08 15:12:33'),
('184.78.197.79', 'tspacepilot', '2013-08-08 15:43:32'),
('64.134.136.42', 'tspacepilot', '2013-08-08 19:52:06'),
('32.173.20.74', 'tspacepilot', '2013-08-08 20:39:42'),
('75.196.48.228', 'tspacepilot', '2013-08-08 20:59:05'),
('75.233.58.144', 'tspacepilot', '2013-08-08 22:13:48'),
('96.50.84.143', 'tspacepilot', '2013-08-09 04:59:26'),
('142.104.42.195', 'tspacepilot', '2013-08-09 07:04:26'),
('142.104.42.195', 'tspacepilot', '2013-08-09 13:10:34'),
('142.104.42.124', 'tspacepilot', '2013-08-10 20:33:15'),
('69.91.159.95', 'tspacepilot', '2013-08-12 19:58:57'),
('184.78.197.79', 'tspacepilot', '2013-08-14 21:09:27'),
('184.78.197.79', 'tspacepilot', '2013-08-15 00:12:27'),
('184.78.197.79', 'tspacepilot', '2013-08-15 17:05:01'),
('184.78.197.79', 'tspacepilot', '2013-08-15 18:55:20'),
('184.78.197.79', 'tspacepilot', '2013-08-16 04:47:08'),
('184.78.197.79', 'tspacepilot', '2013-08-16 05:11:15'),
('184.78.197.79', 'tspacepilot', '2013-08-16 05:32:06'),
('184.78.197.79', 'tspacepilot', '2013-08-16 05:38:20'),
('184.78.197.79', 'tspacepilot', '2013-08-16 05:56:24'),
('184.78.197.79', 'tspacepilot', '2013-08-16 15:51:28'),
('184.78.197.79', 'tspacepilot', '2013-08-16 18:46:17'),
('184.78.197.79', 'tspacepilot', '2013-08-16 23:30:04'),
('184.78.197.79', 'tspacepilot', '2013-08-17 05:08:01'),
('184.78.197.79', 'tspacepilot', '2013-08-17 05:08:05'),
('184.78.197.79', 'tspacepilot', '2013-08-17 16:33:57'),
('184.78.197.79', 'tspacepilot', '2013-08-17 19:35:41'),
('184.78.197.79', 'tspacepilot', '2013-08-18 01:14:56'),
('184.78.197.79', 'tspacepilot', '2013-08-18 16:51:03'),
('184.78.197.79', 'tspacepilot', '2013-08-19 06:32:59'),
('128.95.134.221', 'tspacepilot', '2013-08-19 20:27:42'),
('184.78.197.79', 'tspacepilot', '2013-08-20 05:51:57'),
('184.78.197.79', 'tspacepilot', '2013-08-20 15:23:51'),
('184.78.197.79', 'tspacepilot', '2013-08-21 23:43:43'),
('184.78.197.79', 'tspacepilot', '2013-08-22 06:48:26'),
('184.78.197.79', 'tspacepilot', '2013-08-22 06:57:59'),
('184.78.197.79', 'tspacepilot', '2013-08-22 07:07:13'),
('184.78.197.79', 'tspacepilot', '2013-08-22 07:09:59'),
('184.78.197.79', 'tspacepilot', '2013-08-22 07:11:46'),
('184.78.197.79', 'tspacepilot', '2013-08-22 07:13:02'),
('184.78.197.79', 'tspacepilot', '2013-08-22 07:15:46'),
('184.78.197.79', 'tspacepilot', '2013-08-22 07:19:39'),
('184.78.197.79', 'tspacepilot', '2013-08-22 07:20:00'),
('184.78.197.79', 'tspacepilot', '2013-08-22 07:24:20'),
('184.78.197.79', 'tspacepilot', '2013-08-22 07:30:55'),
('184.78.197.79', 'tspacepilot', '2013-08-22 07:32:16'),
('184.78.197.79', 'tspacepilot', '2013-08-22 07:34:02'),
('184.78.197.79', 'tspacepilot', '2013-08-22 07:40:08'),
('184.78.197.79', 'tspacepilot', '2013-08-22 07:51:56'),
('184.78.197.79', 'tspacepilot', '2013-08-22 16:58:35'),
('184.78.197.79', 'tspacepilot', '2013-08-22 17:01:04'),
('184.78.197.79', 'tspacepilot', '2013-08-22 17:02:10'),
('184.78.197.79', 'tspacepilot', '2013-08-22 17:02:22'),
('184.78.197.79', 'tspacepilot', '2013-08-22 17:17:59'),
('184.78.197.79', 'tspacepilot', '2013-08-22 17:22:21'),
('184.78.197.79', 'tspacepilot', '2013-08-22 17:36:29'),
('184.78.197.79', 'tspacepilot', '2013-08-22 18:36:34'),
('184.78.197.79', 'tspacepilot', '2013-08-22 18:59:19'),
('184.78.197.79', 'tspacepilot', '2013-08-22 19:21:47'),
('184.78.197.79', 'tspacepilot', '2013-08-22 20:07:30'),
('184.78.197.79', 'tspacepilot', '2013-08-22 21:19:46'),
('184.78.197.79', 'tspacepilot', '2013-08-22 21:24:56'),
('184.78.197.79', 'tspacepilot', '2013-08-22 22:28:46'),
('184.78.197.79', 'tspacepilot', '2013-08-22 22:39:18'),
('184.78.197.79', 'tspacepilot', '2013-08-22 23:29:38'),
('184.78.197.79', 'tspacepilot', '2013-08-23 02:51:20'),
('184.78.197.79', 'tspacepilot', '2013-08-23 02:53:36'),
('184.78.197.79', 'tspacepilot', '2013-08-23 04:40:42'),
('184.78.197.79', 'tspacepilot', '2013-08-23 05:08:46'),
('184.78.197.79', 'tspacepilot', '2013-08-23 05:13:45'),
('184.78.197.79', 'tspacepilot', '2013-08-23 05:18:50'),
('184.78.197.79', 'tspacepilot', '2013-08-23 05:22:28'),
('184.78.197.79', 'tspacepilot', '2013-08-23 07:33:03'),
('184.78.197.79', 'tspacepilot', '2013-08-23 07:33:26'),
('184.78.197.79', 'tspacepilot', '2013-08-23 07:35:08'),
('184.78.197.79', 'tspacepilot', '2013-08-23 07:36:48'),
('184.78.197.79', 'tspacepilot', '2013-08-23 07:38:43'),
('184.78.197.79', 'tspacepilot', '2013-08-23 07:41:12'),
('184.78.197.79', 'tspacepilot', '2013-08-23 07:42:14'),
('184.78.197.79', 'tspacepilot', '2013-08-23 07:49:22'),
('184.78.197.79', 'tspacepilot', '2013-08-23 07:58:43'),
('184.78.197.79', 'tspacepilot', '2013-08-23 13:10:18'),
('184.78.197.79', 'tspacepilot', '2013-08-23 13:10:55');

Is there any connection between that IP address and tspacepilot?

He returned in September, the day that his feedback was added, so if the theory that the one in control Wardrick's account since his return is not the same person that posted until May and that was added to default trust, then surely his feedback has not been left by the real Wardrick

btw: his name WardRick, not Wardick

Do you have some valid proofs?

I bet QS and Wardrick are the same people

It's very suspicious that Wardrick was absent for several months then literally the same day QS got removed from DT Wardrick returns & leaves a negative trust on TSP account (most of us know TSP & QS have had a long running feud/disagreement).

I'm almost certain that Wardrick should be removed from DT.

looks like it's a bad idea after all. 


not yet confirmed. that feedback might have been left by the real Wardick, for all we know.

Can I have my negative trust removed removed from Wardrick, it serves no purpose especially if his account is hacked

This is what I believe and am trying to prove. Please PM me theymos edit: nevermind just responded to your message

That might also be possible. I'm looking into that.

Would you wait 4 minutes and risk losing your account?

as someone already said: there is a chance the Wardrick faked his account being hacked because he wanted everyone think that tspacepilot tried to hack his account, so if it was proven false, then he would not be accused of being a scammer

there are rumors that Wardrick may have been hacked since some time ago, because he was not active for several months then returned after the database has been compromised

Sadly bad security practices are not uncommon here.

Problem is that the password was reset. It's quite amazing that a hero member would post a clear link to reset his password.

Maybe you got the user does not exist because someone reset the password before you clicked the link, making it invalid for others that try to use it.

Theymos himself that his account has been compromised because the link has been posted, and his password has been reset shortly after his thread was created.

So :


Today at 04:40:07 PM - Wardrick - password changed                   not Wardrick
Today at 04:35:53 PM - Wardrick - password reset via email    not  Wardrick
Today at 04:01:30 PM - Wardrick - password changed                  real Wardrick

No that was not the email I was given. The yahoo

Timeline (UTC):
04:00 Failed attempts to guess Wardrick's secret answer
16:31 This post
16:35 Wardrick's password reset using the code in the screenshot and an IP that Wardrick has never used

Shadow_Runner: Do you have the @gmail address? That's not Wardrick's actual email.


Nothing I did. Probably someone changed his trust list temporarily, and the change was cached for some people.

It doesn't actually mean that you were talking to the hacker. The account might be compromised once he posted the screenshot, meaning he posted the thread and very possibly the hacker may not have posted anything with the account, but he certainly was able to change the password.

He got "user does not exist" same as I did may be because someone already did it before him.

THANK YOU FOR CONFIRMING THIS.

what about Wardrick's name disappearing from DT for some time for some people only, as reported in the tspacepilot's topic:

https://bitcointalksearch.org/topic/m.12408773


Any idea about what happened?

  Now his account actually was compromised because he posted that link. I locked it for now.

Nope I immediately changed the accounts password and gave it to you. I still have the change password screen open and a confirmation that it was indeed changed, along with the PM of me sending it to you.

well i have read the thread.
i am not sure about your results and looking forward to see them (but as you said that will take a few days).

so you are saying you dont have access to his mail account? yes or no?
if you have it: you need to give it back. that simple...

Read the thread. Read it again. Now you probably saw that I had someone on teamviewer watch this happen. He never gave up email access to start. Just because I'm not posting evidence doesn't mean a thing. I'll complete this and only post as little evidence as needed. He still doesn't know how I caught onto him and is trying to bullshit his way through this thread hoping you guys don't read the previous pages.

do you see the contradiction here? im out of this thread, too much shit lately with the QS debacle.

Yes Shadow, you need to either publicly explain why you think it's OK to steal my account or give it back. I asked you nicely privately but now it seems you want to make this a public matter. I don't care much about the email account, you can keep it if you give me the real reason as to why you took it. If you don't want to do that, give it back.

even if you have proof and such things you should give him his mail account back.

man you seem really angry for someone whos confident enough to talk this much shit. after that im going to go ahead and assume youre trolling. thread isnt worth the attention.

Oh but I'm not hiding lol my real name is only in my username. You had access to the email account you know the IP is legit, I don't even know why you care so much, is it your friends IP address or something?

Then fuck off if that's what you would do. If you had CIRCUMSTANTIAL evidence like I said you would let the case build until it's solid. That is that

They will chime in on the scam report I open after I hear what theymos/badbear responds about the email & IP.

if you have "solid evidence" why are you stalling? also, "i did this and he reacted this way" or "he types like this guy here and here and sometimes here" isnt really evidence.

i didnt see him specify a depth 1 DT user, correct me if im wrong.

but to whoever does currently own shadow_runner, that would be theft of his email account (which can be recovered i assume) if you do not turn the account back over.

I have other accounts here I don't deny that. Which do you think are mine?

And who is this "DT level 1" witness you speak of?

Never a day on bitcointalk without some annoying asshat attacking you and hacking you.

And if you don't change the email account password back I'm going to give you negative.

I don't think he scammed anyone off this account. I've had circumstantial evidence linking him to another account as I said and now I believe I have solidified that. Scam report in a few days or you'll know I was wrong. I wouldn't post if I didn't have evidence I believed.

youre going to have to say who "them" is, from the way youre wording your posts and with the knowledge that you are not the original owner of that account, im inclined to think that youre trolling. you could be right, but youre keeping what youre saying so vague and just saying "OMG WARDRICK IS SCAMMER." exactly where did he scam? how much did he scam user x for? when?

also iirc wardrick's identity is known to some of the people on here. that is, if the person posting from the account is the same as the original owner of the account. not saying i think its been hacked, but its just a possibility.

The trap that involves you stealing my spare email account? lol wtf man ur weird. You ain't making friends here. Now you want to attack me too? are you tspacepilot?

No they saw you walk right into the set-up I previously told them (Which there is also proof of cause I'm not a young "adult" like yourself) and then they watched you react exactly the way I suspected you would. I'll fill out a proper scam report when I can do more than talk shit. I'm just letting everyone know you are busted before I risk you getting out of this and not being doxed.

So they saw you change my email password? lol, you know I can reset that using my phone shithead.

You could accuse me with that if nobody was watching you get set up from teamviewer

The problem is not the email, the problem is the 'hack attempt'. Can you explain why did you change 3 times your forum password?


Today at 04:40:07 PM - Wardrick - password changed
Today at 04:35:53 PM - Wardrick - password reset via email
Today at 04:01:30 PM - Wardrick - password changed


You are free to don't reply.

I can't wait to see what more bullshit accusations are going to come out. You already tried to steal my email account (LOL).

Well then I ask either theymos or BadBear to confirm they authenticity of this email.

whatever evidence you post should be absolutely solid, i doubt wardrick would give access to that email account is he had something to hide.
[/quote]


Trust me I know that. That is why I am working on how to properly format this evidence because the circumstancial evidence I had relied a lot on setting him up (Which he walked right fucking into) and watching how he replied. Based off his reactions I'm 100% certain I know who manages that account

So there is a chance that he really has been hacked.

Ir it is just the B plan, if I get caught I say I has been hacked so I won't be labeled as scammer

Now how to know the truth?

You just need to have Theymos or BadBear verify - should be very easy. Not a good idea to give anyone here your email login.

ip addresses can easily be faked, it isnt really definitive evidence.

whatever evidence you post should be absolutely solid, i doubt wardrick would give access to that email account if he had something to hide.

with the shit that's been happening on the forum these last few days, i really wouldnt be surprised. just more drama.

Yes that's why I have more than 1 very reputable person collaborating with me on this.

He can simple try to hack his account and staging all this scene. Who knows? It is just an assumption like yours @Wardrick.

Just change the email to another and add a much unpredictable secret question which is hard to guess.
and  dox the IP address for the people using it , i can see that it is distributed IP which is much easily provided by local LAN cables.

YES

Do you mean Wardrick

Do you mean he faked the evidences he shown in this topic?

THIS USER IS A SCAMMER! I will not be posting any evidence yet. I am in communication with someone helping properly format all of this info.

People try to hack people's accounts every day, and hero accounts that are in DT will attract hackers. Sometimes the hackers even success.

No need to speak like you survived a car bomb explosion or an assassination attempt

Wardrick is giving me access to the account I will confirm this info is valid or invalid as soon as I get the login

Seatlle 652.405 inhabitants, must be tspacepilot. Whats wrong with you?

I already did that.

you should change the email on your forum account for a bit if youre going to do that, password reset and all.

Yep.

Edit: Code is no longer valid. Otherwise, it would have been a pretty dangerous screenshot.

I can assure you this is not fake. I am being attacked by another member here from the Washington area. I will PM you the password to the email account as it only contains emails from bitcointalk anyway.

Give someone access it will clear your name from the circumstantial evidence linking you to another account. If this is fake I think the proof will be sufficient as is with that added on.

I'd like to see that you didn't edit the email text. Only a moron would send me the header as proof.

Do you not believe me? why not?

Here are the email headers:

LOL! It doesn't work, it says "user does not exist".

no comment on the hacking part. but is it a good idea to post a screenshot with a clear link for the password reset?

Theymos sent me this PM today advising that *someone* here might be trying to break into my account.



It's a good thing he did because I checked if everything was still OK and I found this email from the forum that somebody had tried to reset my password.



The IP address of the attempted hacker is 73.225.159.251. This is likely a Comcast IP in the Seattle, Washington area and it just so happens that forum member tspacepilot lives near there. The location of the IP was indicated by these anonymized traceroute results:



I am going to report this incident to [email protected] and I advise anyone else who has issues with this IP address to do the same.