Weird emails and pms about a paypal transaction I never made - page 3.

HCP

legendary

Activity: 2086

Merit: 4361

Just out of curiosity... what exactly are you using to sign these messages? Huh

As far as I'm aware, Bitcoin Core (aka Bitcoin-qt) does not support signing messages with bech32 (aka "bc1") addresses... and Electrum does not put "Version: Bitcoin-qt (1.0)" in signed messages.

Also, I'd feel far more comfortable with these signed messages, if you included a "datetime" and a more specific reason. Such a generic message could be easily re-used... something like this:

Quote

This is kenzawak
Signing a message on
To prove ownership of this account due to bitcointalk thread: https://bitcointalksearch.org/topic/weird-emails-and-pms-about-a-paypal-transaction-i-never-made-5150479

DarkStar_

legendary

Activity: 2772

Merit: 3284

Did you reuse the password for your Bitcointalk account anywhere? Do you remember when the last time you changed it was?
Also, please run a malware/virus scan (Malwarebytes, Avira are two free ones that work well from what I've seen).

kenzawak

hero member

Activity: 658

Merit: 851

Quote from: DireWolfM14 on June 03, 2019, 10:23:31 PM

Quote from: kenzawak on June 03, 2019, 10:13:08 PM

Theymos just answered me :

Just out curiosity, can you tell when the breach started? You can copy the code into a text editor and redact your IP address with a search and replace, then post the code here.

Apparently on June 1st (I definitely wasn't in Stockholm).

Other IPs are in France (home address or 4g address)
And the ones before that (the ones in New York) do match. I was in New York at the time, I posted about it in the Wall Observer thread.
https://bitcointalksearch.org/topic/m.51213854

DireWolfM14

copper member

Activity: 2338

Merit: 4543

Join the world-leading crypto sportsbook NOW!

Quote from: kenzawak on June 03, 2019, 10:13:08 PM

Theymos just answered me :

Just out curiosity, can you tell when the breach started? You can copy the code into a text editor and redact your IP address with a search and replace, then post the code here.

kenzawak

hero member

Activity: 658

Merit: 851

Quote from: morvillz7z on June 03, 2019, 07:30:43 PM

@kenzawak

You can send theymos a pm and ask him to give you your recent IP logs. See if there are any irregularities, logs from IPs you don't necessarily recognize.

There have been at least two recent cases of hacked accounts to my knowledge. bbvedf and Mrengage

Theymos just answered me :

I also tried to alert telegram about this but I can't find @wakenz .

kenzawak

hero member

Activity: 658

Merit: 851

Quote from: DireWolfM14 on June 03, 2019, 09:24:55 PM

Can you sign a message with the address quoted below from December 2017?

Quote from: kenzawak on December 05, 2017, 01:38:44 PM

Followed : yes
Twitter : https://twitter.com/MuscuPassion
RT link and liked : https://twitter.com/MuscuPassion/status/938115035070595072
btc address : 15Ctuz7BCcoHnu9Tnm3hbDSuAMVuM2WeDh

http://archive.fo/iypg5#selection-2942.1-2951.56

I'm afraid not, it's a Binance address.

DireWolfM14

copper member

Activity: 2338

Merit: 4543

Join the world-leading crypto sportsbook NOW!

Can you sign a message with the address quoted below from December 2017?

Quote from: kenzawak on December 05, 2017, 01:38:44 PM

Followed : yes
Twitter : https://twitter.com/MuscuPassion
RT link and liked : https://twitter.com/MuscuPassion/status/938115035070595072
btc address : 15Ctuz7BCcoHnu9Tnm3hbDSuAMVuM2WeDh

http://archive.fo/iypg5#selection-2942.1-2951.56

Looks like you used it January of this year.

Quote from: kenzawak on January 23, 2019, 01:53:29 AM

Btctalk name : kenzawak
Rank : Sr. Member
BTC Address : 15Ctuz7BCcoHnu9Tnm3hbDSuAMVuM2WeDh
Wear Appropriate Signature : Yes
Wear Personal Text: Yes
Wear Avatar: Yes

https://bpip.org/profile.aspx?p=kenzawak (69th most merited member, 640th poster with an activity of only 476)

http://archive.fo/5e0ge#selection-8575.0-8575.67

marlboroza

legendary

Activity: 1932

Merit: 2272

Quote from: kenzawak on June 03, 2019, 07:31:51 PM

Like I said, I reset my password here about two hours ago. Do you guys think that's enough ?

Run anti virus. Maybe you are infected or something...

DarkStar_

legendary

Activity: 2772

Merit: 3284

Quote from: kenzawak on June 03, 2019, 07:31:51 PM

Thanks, I'll do that. Good idea.

Like I said, I reset my password here about two hours ago. Do you guys think that's enough ?

Could you sign a message from an older address of yours?

Quote from: kenzawak on June 03, 2019, 07:31:51 PM

EDIT AGAIN : I also removed the tag I left to ichanger.

I removed my counter.

kenzawak

hero member

Activity: 658

Merit: 851

Quote from: getpaidz on June 03, 2019, 07:49:15 PM

Quote from: kenzawak on June 03, 2019, 07:47:25 PM

Quote from: getpaidz on June 03, 2019, 07:46:23 PM

I received a pm yesterday from him.

Quote from: kenzawak on June 03, 2019, 12:06:53 AM

Hi, I want to exchange 14k $ pp. Do you have such a sum?

Did you make any transaction ?

I pm him back that I can only do $200 per transaction. And he seems not interested.

Good !

I want to make it clear again, I have never traded here and if I ever do, it will not be with paypal.

getpaidz

jr. member

Activity: 93

Merit: 1

Quote from: kenzawak on June 03, 2019, 07:47:25 PM

Quote from: getpaidz on June 03, 2019, 07:46:23 PM

I received a pm yesterday from him.

Quote from: kenzawak on June 03, 2019, 12:06:53 AM

Hi, I want to exchange 14k $ pp. Do you have such a sum?

Did you make any transaction ?

I pm him back that I can only do $200 per transaction. And he seems not interested.

kenzawak

hero member

Activity: 658

Merit: 851

Quote from: getpaidz on June 03, 2019, 07:46:23 PM

I received a pm yesterday from him.

Quote from: kenzawak on June 03, 2019, 12:06:53 AM

Hi, I want to exchange 14k $ pp. Do you have such a sum?

Did you make any transaction ?

getpaidz

jr. member

Activity: 93

Merit: 1

I received a pm yesterday from him.

Quote from: kenzawak on June 03, 2019, 12:06:53 AM

Hi, I want to exchange 14k $ pp. Do you have such a sum?

kenzawak

hero member

Activity: 658

Merit: 851

Quote from: morvillz7z on June 03, 2019, 07:30:43 PM

@kenzawak

You can send theymos a pm and ask him to give you your recent IP logs. See if there are any irregularities, logs from IPs you don't necessarily recognize.

There have been at least two recent cases of hacked accounts to my knowledge. bbvedf and Mrengage

Thanks, I'll do that. Good idea.

Like I said, I reset my password here about two hours ago. Do you guys think that's enough ?

EDIT AGAIN : I also removed the tag I left to ichanger.

morvillz7z

legendary

Activity: 2212

Merit: 2061

Join the world-leading crypto sportsbook NOW!

@kenzawak

You can send theymos a pm and ask him to give you your recent IP logs. See if there are any irregularities, logs from IPs you don't necessarily recognize.

There have been at least two recent cases of hacked accounts to my knowledge. bbvedf and Mrengage

DarkStar_

legendary

Activity: 2772

Merit: 3284

Quote from: iChanger on June 03, 2019, 07:06:09 PM

https://www.youtube.com/watch?v=2Ur9b7_m5-0&feature=youtu.be

Watch a video on your PC.
Oh the phone the quality is better.

Could you use the "Report to Admin" button on the PM and link them to this thread so that they can confirm the PM is valid? Or allow a trusted member to temporarily access your account to confirm the PM.

I think you're telling the truth at this point, but it's better to have confirmation. The email notifications about PMs from kenzawak also lines up with this.

Quote from: iChanger on June 03, 2019, 06:42:30 PM

It seems like this "guy" has access to your account on forum. Does not he? Or maybe it is you and you are profiting from situation that you are verified user and I am newbie on forum?)

Even if he was hacked, the most likely expectation would be for him to reimburse you out of pocket if you can't chargeback.

kenzawak

hero member

Activity: 658

Merit: 851

WTF

Is it possible that my account here has been compromised without me noticing ?
I changed my password here about an hour and 20 minutes ago just in case.

EDIT : I also just contacted user "getpaidz" (the one I mention in op) via pm telling him to stay away from anyone pretending to be me, that I do not trade on this forum, especially via paypal.
I don't have a Nigerian name, I'm French. My telegram name is not "kenz". I never traded on this forum and would never use paypal if I did.

iChanger

newbie

Activity: 18

Merit: 1