Scammer: DeluxeCITY

[faizy]

What happened::  well we agreed for an exchange of BTC to AGC. At first the guy would not send the code immediately and waited for confirmations. Then stops replying. half an hour later gives me an invalid code and then asks to teamview and goes offline.
Scammers Profile Link:  https://bitcointalk.org/index.php?action=profile;u=357282
Reference Link:  https://bitcointalk.org/index.php?action=profile;u=357282
Amount Scammed:  0.72btc / $300 BTC
Payment Method:  I paid BTC.
Proof of Payment:  https://btc.blockr.io/tx/info/bf9ca6d27aff44d9f63018738d815c2cd69fd47cab92f20d3e4fc3cfc9020c20
PM/Chat Logs:  will post if required

[james.lent]

Didnt it occur to you that he's either selling stolen/carded AGCs or it was just a scam attempt ? I'm pretty sure you knew and buying from him is only aiding his scheme.

[monbux]

Didnt it occur to you that he's either selling stolen/carded AGCs or it was just a scam attempt ? I'm pretty sure you knew and buying from him is only aiding his scheme.

And then... No escrow?  Honestly escrow wouldn't help TOO much for these trades, but I'd suggest you do that for the future.

[james.lent]

Didnt it occur to you that he's either selling stolen/carded AGCs or it was just a scam attempt ? I'm pretty sure you knew and buying from him is only aiding his scheme.

And then... No escrow?  Honestly escrow wouldn't help TOO much for these trades, but I'd suggest you do that for the future.

Yeah that too, but honestly escrows shouldn't be willing to hold something like this as it's source is definitely illegal.

[mexxer-2]

Seems I should be publicly posting about my suspicions, before the scam happens 

[faizy]

interestingly the guy offered to escrow and i contacted ognasty but he wasnt available on his forum account so i wasnt sure and i went ahead anyway ... seems you learn the hard way... ognasty was availble on skype but not on his account ..

oh and i didnt know about the stuff being stolen and shit .. but oh well

[xinzark]

interestingly the guy offered to escrow and i contacted ognasty but he wasnt available on his forum account so i wasnt sure and i went ahead anyway ... seems you learn the hard way... ognasty was availble on skype but not on his account ..

oh and i didnt know about the stuff being stolen and shit .. but oh well

Dude you should at least wait to come Ognasty online. $300 is a very big amount. And every cheap offer have something hidden in it which brings unexpected results
Sorry for your loss

[Joel_Jantsen]

Not very surprised.The account had positive trust from Tomatocage ,mostly,the account was hacked for scamming purposes .You can easily make out from the recent posts,the original owner stopped posting after 2015 and then suddenly starts here https://bitcointalk.org/index.php?action=profile;u=357282;sa=showPosts;start=20  Maybe the account is sold.Recently,I saw a few threads of selling Green Hero members.If the original account ever comes back and provided a signed message,he is getting this account back.

[erikalui]

I saved myself again but not dealing with him. He contacted me two days back and wanted to buy 1.5 BTC for his PM and said either I should go first as he has a positive trust or use an escrow. I told him I dint have BTC and there was no reply. I read his ratings and all pointed out that he might be a scammer as he had no real trade history. He was banking on 1 +ve given by TC for irrelevant reasons.

[bitbollo]

escrow is a must, but also the escrow need to be trusted
master-p scam was a lesson for all... but how we can see a lot of people buying account with high level rank only for scam!

[Timelord2067]

If we assume the transaction was indeed https://blockchain.info/tx/bf9ca6d27aff44d9f63018738d815c2cd69fd47cab92f20d3e4fc3cfc9020c20 and BTC 0.72 was sent to deluxeCITY we can deduce the following:

1KjbyD4HwFJRY6hzUyZa2csizupA5fqTR2 sends to 1NWQdFPb7uHKxHENumLUwKGRDLYvvSuQFk 0.72 BTC

Those funds are sent with other funds to 1C7dxUeYPaezHEos3KHVLTod6irSLysdvm 0.91038806 BTC in the transaction https://blockchain.info/tx/67e79e6d39c4fc7edaec191cc578bc8bfc73c6889ba369324082ae71e6300ea5

so we know that at least these Wallet Addresses exist.

Code:

1EJi2aEqQXycZmmc61xL99arckKRSTtz9g
13NK25p9mAGHRTgw7GCTFXpAQ1a99z72oK
13pK5ePBfNxSRQnas7fua6PwRxYCzXdYEE
1Dxi4mDKsgvbSAng4Xo6hzi3iBhRMXNefj
1BitEg9GnC5znKbjwJqW9WWMu61bvgAFKh (BitEnlarge Deposits )
1NWQdFPb7uHKxHENumLUwKGRDLYvvSuQFk
1BTPwm8SicSRuXj4a7ADUjjWpddEzJ5x1C

These Wallet Addresses are a part of Wallet [01e19caca6] https://www.walletexplorer.com/wallet/01e19caca679a146/addresses and have 25 Wallet Addresses, they are:

Code:

1BitEg9GnC5znKbjwJqW9WWMu61bvgAFKh	0.         	65	400163
1K4PMiPmUGVHNEVYEevAAMK9A1wmRfyWev	0.         	16	426475
1927y8HQtEacWoY6Kk4QdsczYfYEZfQrtM	0.         	9	426475
1NPexCQNWTd29jXfi3UeJfA7pBuUwQRwj7	0.         	9	425182
1BTPwm8SicSRuXj4a7ADUjjWpddEzJ5x1C	0.         	9	411942
18zYri9FYE6vgXP5xR6TPQmNUTadWM3cME	0.         	8	424552
149Yti5s3n7SoShijyjAQCD9N8XYRZ1BkT	0.         	7	424978
1DZSsYNsGtqmbxuap2RUDdQQNFvZ64aGfw	0.         	7	424552
1MKkm9DaMZYNaC3i6UWtttgAsc5GLdvv4T	0.         	7	424552
141BJA2tWGxzxMqjX4MambDc5sQHzUVSTS	0.         	6	424552
1EEdpfUm2mKhgXs4nPrN7PpEr3PTnMats8	0.         	6	424552
1FxP6f2Xr2YDDymQkYWDeyQEzbfpPuxBcB	0.         	6	424552
18nb5ynnywCnX6rPDNzpqdTEJ1cH8gVNXq	0.         	5	428935
13NK25p9mAGHRTgw7GCTFXpAQ1a99z72oK	0.         	5	400163
1DQVbAvhDFXtuvzptfKbL4zyw8duBMMfRk	0.         	4	424552
1CQ2DbRbhKkJJrg3tD49tAMRg1iPoBDm6y	0.         	4	424193
1HAvGrkf3BoBzSk1fBdCB8Rx1RAQLWkWga	0.         	3	424552
13pK5ePBfNxSRQnas7fua6PwRxYCzXdYEE	0.         	3	400163
1339xiJXaYYiGizh689zinEpPrsQssC53z	0.         	2	423562
1Dxi4mDKsgvbSAng4Xo6hzi3iBhRMXNefj	0.         	2	400163
1DywBWqkB1ueurjkQMn9XbTjAfGpuxXauH	0.         	1	423274
1FQipxnZGp1eJ2dGuTVsgVw49QxRJ8Hfku	0.         	1	405820
1EJi2aEqQXycZmmc61xL99arckKRSTtz9g	0.         	1	400163
1NWQdFPb7uHKxHENumLUwKGRDLYvvSuQFk	0.         	1	400163
1FacSfxZfBaNYTXPDwLZ9MsQfFrxrsrdEZ	0.         	1	397526

smit1237 -7: -3 / +1 https://bitcointalk.org/index.php?action=profile;u=363314 uses Wallet Address 1BitEg9GnC5znKbjwJqW9WWMu61bvgAFKh here: https://bitcointalk.org/index.php?topic=1365423.0 - http://archive.is/YhDD5#selection-717.0-717.34

adoell -2: -1 / +0 https://bitcointalk.org/index.php?action=profile;u=406918 uses Wallet Address 1927y8HQtEacWoY6Kk4QdsczYfYEZfQrtM here: https://bitcointalk.org/index.php?topic=996260.msg11208759#msg11208759 - http://archive.is/z8a7p#selection-5921.0-5925.34 (just seven posts after twister u=361475 claims) http://archive.is/z8a7p#selection-5921.0-5925.34

cdmacrunk -2: -1 / +0 https://bitcointalk.org/index.php?action=profile;u=628756 uses Wallet Address 18zYri9FYE6vgXP5xR6TPQmNUTadWM3cME here: https://bitcointalk.org/index.php?topic=1576446.msg15828825#msg15828825 - http://archive.is/M5j7I#selection-4289.0-4315.58 ( A Ponzi started by adoell )

Over the page gentledan -2: -1 / +0 https://bitcointalk.org/index.php?action=profile;u=628778 uses Wallet Address 1MKkm9DaMZYNaC3i6UWtttgAsc5GLdvv4T to lure punters in... https://bitcointalk.org/index.php?topic=1576446.msg15829109#msg15829109 - http://archive.is/Xddai#selection-1751.0-1779.48

Back to page one... cerals28 -2: -1 / +0 https://bitcointalk.org/index.php?action=profile;u=516751 uses Wallet Address 141BJA2tWGxzxMqjX4MambDc5sQHzUVSTS here: https://bitcointalk.org/index.php?topic=1576446.msg15828493#msg15828493 - http://archive.is/M5j7I#selection-3287.25-3274.8

same page Chichong -2: -1 / +0 https://bitcointalk.org/index.php?action=profile;u=191061 uses Wallet Address 1EEdpfUm2mKhgXs4nPrN7PpEr3PTnMats8 here: https://bitcointalk.org/index.php?topic=1576446.msg15828466#msg15828466 - http://archive.is/M5j7I#selection-3041.0-3069.18

Unremarkably, the who is for bitcoinbloom.com yields nothing:

http://www.whois.com/whois/bitcoinbloom.com http://archive.is/uyB3o

Code:

bitcoinbloom.com registry whois
	Updated 1 second ago - Refresh
Domain Name: BITCOINBLOOM.COM
Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Name Server: DNS1.NAMECHEAPHOSTING.COM
Name Server: DNS2.NAMECHEAPHOSTING.COM
Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Updated Date: 04-aug-2016
Creation Date: 04-aug-2016
Expiration Date: 04-aug-2017
bitcoinbloom.com registrar whois
	Updated 1 second ago
Domain Name: BITCOINBLOOM.COM
Registry Domain ID: 2049265463_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.enom.com
Registrar URL: www.enom.com
Updated Date: 2016-08-04T01:40:55.00Z
Creation Date: 2016-08-04T08:40:00.00Z
Registrar Registration Expiration Date: 2017-08-04T08:40:00.00Z
Registrar: ENOM, INC.
Registrar IANA ID: 48
Reseller: NAMECHEAP.COM
Domain Status: clientTransferProhibited https://www.icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: WHOISGUARD PROTECTED
Registrant Organization: WHOISGUARD, INC.
Registrant Street: P.O. BOX 0823-03411
Registrant City: PANAMA
Registrant State/Province: PANAMA
Registrant Postal Code: 00000
Registrant Country: PA
Registrant Phone: +507.8365503
Registrant Phone Ext:
Registrant Fax: +51.17057182
Registrant Fax Ext:
Registrant Email: email@WHOISGUARD.COM
Registry Admin ID:
Admin Name: WHOISGUARD PROTECTED
Admin Organization: WHOISGUARD, INC.
Admin Street: P.O. BOX 0823-03411
Admin City: PANAMA
Admin State/Province: PANAMA
Admin Postal Code: 00000
Admin Country: PA
Admin Phone: +507.8365503
Admin Phone Ext:
Admin Fax: +51.17057182
Admin Fax Ext:
Admin Email: email@WHOISGUARD.COM
Registry Tech ID:
Tech Name: WHOISGUARD PROTECTED
Tech Organization: WHOISGUARD, INC.
Tech Street: P.O. BOX 0823-03411
Tech City: PANAMA
Tech State/Province: PANAMA
Tech Postal Code: 00000
Tech Country: PA
Tech Phone: +507.8365503
Tech Phone Ext:
Tech Fax: +51.17057182
Tech Fax Ext:
Tech Email: email@WHOISGUARD.COM
Name Server: DNS1.NAMECHEAPHOSTING.COM
Name Server: DNS2.NAMECHEAPHOSTING.COM
DNSSEC: unSigned
Registrar Abuse Contact Email: email@enom.com
Registrar Abuse Contact Phone: +1.4252982646
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2016-08-04T01:40:55.00Z <<<

For more information on Whois status codes, please visit https://icann.org/epp


The data in this whois database is provided to you for information
purposes only, that is, to assist you in obtaining information about or
related to a domain name registration record. We make this information
available "as is," and do not guarantee its accuracy. By submitting a
whois query, you agree that you will use this data only for lawful
purposes and that, under no circumstances will you use this data to: (1)
enable high volume, automated, electronic processes that stress or load
this whois database system providing you this information; or (2) allow,
enable, or otherwise support the transmission of mass unsolicited,
commercial advertising or solicitations via direct mail, electronic
mail, or by telephone. The compilation, repackaging, dissemination or
other use of this data is expressly prohibited without prior written
consent from us.  

We reserve the right to modify these terms at any time. By submitting
this query, you agree to abide by these terms.
Version 6.3 4/3/2002

And then there's this:

20 July 2014, 05:29:56 Date Registered:    ACCTseller u=357263
20 July 2014, 06:40:20 Date Registered:    deluxeCITY u=357282
21 July 2014, 01:31:08 Date Registered:    Panthers52 u=357487
22 July 2014, 15:51:40 Date Registered:    Quickseller u=358020

[Timelord2067]

Name:    Chichong
Posts:    28
Activity:    28
Position:    Newbie
Date Registered:    15 December 2013, 19:20:28
Last Active:    26 September 2016, 18:22:39

Name:    deluxeCITY
Posts:    684
Activity:    532
Position:    Hero Member
Date Registered:    20 July 2014, 06:40:20
Last Active:    25 February 2016, 10:28:03

Name:    smit1237
Posts:    210
Activity:    210
Position:    Full Member
Date Registered:    06 August 2014, 10:38:36
Last Active:    25 February 2016, 13:57:37

Name:    adoell
Posts:    346
Activity:    346
Position:    Sr. Member
Date Registered:    29 December 2014, 16:09:57
Last Active:    10 August 2016, 04:43:42

Name:    cerals28
Posts:    159
Activity:    126
Position:    Full Member
Date Registered:    28 May 2015, 11:09:22
Last Active:    01 October 2016, 00:50:58

Name:    cdmacrunk
Posts:    57
Activity:    57
Position:    Jr. Member
Date Registered:    03 November 2015, 02:37:59
Last Active:    27 September 2016, 03:42:24

Name:    gentledan
Posts:    6
Activity:    6
Position:    Newbie
Date Registered:    03 November 2015, 02:44:58
Last Active:    29 September 2016, 13:27:10

[Quickseller]

And then there's this:

20 July 2014, 05:29:56 Date Registered:    ACCTseller u=357263
20 July 2014, 06:40:20 Date Registered:    deluxeCITY u=357282
21 July 2014, 01:31:08 Date Registered:    Panthers52 u=357487
22 July 2014, 15:51:40 Date Registered:    Quickseller u=358020

deluxeCITY was originally created by myself, however was sold well over a year ago. The person that purchased deluxeCITY from me also purchased other accounts from me, and sold some of those other accounts, so I think it is probably safe to say that deluxeCITY may have been sold since then one (or more) times.

If you are going to try to use blockchain evidence to link the scammmer's alts together, you will need to look at the security log to see when the account was potentially sold, along with when various addresses were posted.

[Timelord2067]

And then there's this:

20 July 2014, 05:29:56 Date Registered:    ACCTseller u=357263
20 July 2014, 06:40:20 Date Registered:    deluxeCITY u=357282
21 July 2014, 01:31:08 Date Registered:    Panthers52 u=357487
22 July 2014, 15:51:40 Date Registered:    Quickseller u=358020

deluxeCITY was originally created by myself, however was sold well over a year ago. The person that purchased deluxeCITY from me also purchased other accounts from me, and sold some of those other accounts, so I think it is probably safe to say that deluxeCITY may have been sold since then one (or more) times.

If you are going to try to use blockchain evidence to link the scammmer's alts together, you will need to look at the security log to see when the account was potentially sold, along with when various addresses were posted.

We only have your word that you sold it http://archive.is/nkVPY#selection-2029.0-2057.77 , but we also have your admission that it *is* one of your Alts http://archive.is/FO1Yo#selection-5653.0-5653.43