Ok a little update, so it looks like Chris has been reading this topic and has taken some actions to hide his tracks even more
http://pastebin.com/VpQzEuhhhttp://pastebin.com/kuruZ5mJOriginal User List:
+----+-----------------+-----------------+
| Id | Login | Name |
+----+-----------------+-----------------+
| 1 | geegee | Chris |
| 2 | cucu | Vasile |
| 3 | ionion | Ion |
| 4 | lavinia | Vasilica Gigi |
| 5 | z34b19ry0 | z34b19ry0 |
| 6 | johncena | John Cena |
| 7 | anne | Anne Smith |
| 8 | lavinia-schipor | Lavinia Schipor |
| 9 | | |
| 10 | dirtybit | David |
+----+-----------------+-----------------+
New User List:
+----+----------+----------+
| Id | Login | Name |
+----+----------+----------+
| 5 | johncena | johncena |
| 7 | 0100110 | 0100110 |
| 8 | 020btc | 020BTC |
| 9 | 0nie13 | 0nie13 |
| 10 | 0rphane | 0rphane |
+----+----------+----------+
Basically the user list has changed from the original scan. All the "real" original accounts have been deleted. geegee/cucu/ionion/lavinia and a couple others. In addition he's started to add news as a sub page of farm payments instead of making a wordpress "post" like he used to. The only reason I can see for him doing that is because pages don't show who the author is like posts do.
It doesn't prove very much but it indicates two things to me:
1. He is reading these threads and watching what we say (seems highly coincidental he would make these changes without having seen the information posted here)
2. He has reason to try hide the above information
The scans also show that nothing besides those changes have occurred. No extra security, no additional plugins. What has happened in all that downtime? Seems like basically he's just spent the time trying to cover his tracks.
let him read this, 1 month+ patient for him to deliver the payment, and now he is asking for tax, pretty silly, if he intended to run, better scrub off whats left or people will come to hunt him down.
Show Posts
?.
