Bitcoin Forum

Other => Meta => Topic started by: TheQuin on February 22, 2018, 06:09:14 AM



Title: Hacked account Patron92
Post by: TheQuin on February 22, 2018, 06:09:14 AM
Account Patron92 (https://bitcointalk.org/index.php?action=profile;u=300605) just woke up after being inactive since September 03, 2014.

Trust summary for Patron92
This user's email address was changed recently.

This user recently woke up from a long period of inactivity.

This user changed his/her password recently.


After changing email and password the first post received 90 merit from two accounts already tagged as hacked.
http://archive.is/EkdVT

https://bitcointalk.org/index.php?action=merit;u=300605
Received in the last 120 days
Today at 05:50:41 AM: 50 from superscommessebitcoin for A gift for the holiday with bitcoin!
Today at 04:44:14 AM: 40 from ifightformerkel for A gift for the holiday with bitcoin!

https://bitcointalk.org/index.php?action=trust;u=178502
https://bitcointalk.org/index.php?action=trust;u=206417


Title: Re: Hacked account Patron92
Post by: skorupi17 on February 23, 2018, 12:24:39 AM
The account ifightformerkel (https://bitcointalk.org/index.php?action=profile;u=206417) gave merit to 2 other accounts:

1. bitvelk (https://bitcointalk.org/index.php?action=profile;u=1462793) 10 Merits
2. udivkx (https://bitcointalk.org/index.php?action=profile;u=1437751) 10 Merits

Proof: https://bitcointalk.org/index.php?action=merit;u=206417

Both are ranked Member, thus, the merit given to them helped these accounts to rank up.

udivkx was engaged to account trade/sale based from Lauda's trust rating (https://bitcointalk.org/index.php?action=trust;u=1437751)

An obvious fact that bitvelk is linked to those accounts.

ETH wallet involved (I only managed to get 2 addresses that has connection)
Code:
0xe5571e1E1e727D7785FF02615fd916FDFF97b58a
0xf6700A5Bb3418D55953B7b4842dAbD662235ea91

Reference:
https://docs.google.com/spreadsheets/d/1X6ay0cfiAeNUqz16bawVPnIIVUGRIWVad7jLa71DFnE/edit#gid=299234142
#13 in Signature Campaign (bitvelk)
https://docs.google.com/spreadsheets/d/17qCZhKAmZQyWZR1ftIbWtMnUdN_nYA9j4KHX1IgDpSY/edit#gid=1503248699
#76 in Signature Campaign (uvidkx)

https://etherscan.io/address/0xe5571e1E1e727D7785FF02615fd916FDFF97b58a
uvidkx sent 0.03 ETH to bitvelk (most probably for gas)


I'll update this if I found something relevant to this.


Title: Re: Hacked account Patron92
Post by: Welsh on February 24, 2018, 10:10:53 AM
Nice find. You would think if they were capable of gaining access to an account through what ever means they used they wouldn't be so stupid to send a massive amount of merit out of the blue wouldn't you?

Keep an eye on this account and they'll likely make the same mistake twice and expose another hacked account.


Title: Re: Hacked account Patron92
Post by: TheQuin on February 24, 2018, 10:20:01 AM
Nice find. You would think if they were capable of gaining access to an account through what ever means they used they wouldn't be so stupid to send a massive amount of merit out of the blue wouldn't you?

Keep an eye on this account and they'll likely make the same mistake twice and expose another hacked account.

I guess accounts thieves aren't the brightest. The ifightformerkel (https://bitcointalk.org/index.php?action=profile;u=206417) account just sent 9 to WebTera (https://bitcointalk.org/index.php?action=profile;u=1681290). The same pattern of sending the required amount of merit to rank up but this one is a Jr account so looks to be being farmed rather than hacked.


Title: Re: Hacked account Patron92
Post by: TheQuin on March 23, 2018, 03:38:00 PM
Nice find. You would think if they were capable of gaining access to an account through what ever means they used they wouldn't be so stupid to send a massive amount of merit out of the blue wouldn't you?

Keep an eye on this account and they'll likely make the same mistake twice and expose another hacked account.

Looks like you were right. Patron92 (https://bitcointalk.org/index.php?action=profile;u=300605) just passed the extra 13 Merit fattyforhire (https://bitcointalk.org/index.php?action=profile;u=103589) needed to rank up to Full Member.

Trying to be a little more discrete this time did it in 4 small transactions.

Sent in the last 120 days
Today at 02:51:24 PM: 4 to fattyforhire for Re: Facebook & Google creating its own Cryptocurrency!
Today at 02:50:39 PM: 3 to fattyforhire for Re: is this great time to buy bitcoin???
Today at 02:50:15 PM: 3 to fattyforhire for (Deleted/Off-limits/Ignored)
Today at 02:49:15 PM: 6 to fattyforhire for Re: 1btc = 6k usd

Trust summary for fattyforhire

Timelord2067   2017-12-15   0.00000000   Reference (https://bitcointalk.org/index.php?topic=2544574.msg26164373#msg26164373)   fattyforhire u=103589 is self admitted alt of dasdo u=554226 who is banned (apparently)