Account hacked

[[btc]onfire1]

my account have been hacked on 8 august
i has sent a pm to theymos but still didn't get any reply

this is the proof
http://i60.tinypic.com/2qnxw7n.png

-----BEGIN BITCOIN SIGNED MESSAGE-----
My account BTConfire has been hacked/lost. Please reset the email to new.apache@yahoo.com. The current date is 8 august 2015.
-----BEGIN SIGNATURE-----
<1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM>
<H1VpZYbglS7uO4br2VPCZKYPKg+ThvJNA5pIBksDwhMYaru+TSAZ5ciqbqBSN8faD9sn5fvwF9nFtIwcn4dLrs0=>
-----END BITCOIN SIGNED MESSAGE-----

Here is the unedited post where I posted that address: https://bitcointalk.org/index.php?topic=1066570.msg11460242#msg11460242

and now the hacker make a thread on service section please all member don't trust him and be carefull
link for his thread https://bitcointalk.org/index.php?topic=1178955.0
and don't make some deal with him

[el kaka22]

Verification failed. BTW please add [code] tags before and after you message, because [BTC ] without the space becomes BTC automatically.

[Quickseller]

It seems that your account was recently (but before it was "hacked") promoting a scam:

Type: Twitter

Link:
https://twitter.com/btconfire/status/619128536276692992
https://twitter.com/btconfire/status/619128468815482880
https://twitter.com/btconfire/status/619128364385710082

Bitcoin Address: 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM

It was also recently willing to bet 10BTC that it was not in fact "sold" even though it pretty clearly was on or around May 15th as this is when many of it's posted BTC addy's were changed.

edit: I am also having difficulty trying to get the signature to verify...maybe you should try to sign a message that does not contain the "BTC" symbol as a test...

[tspacepilot]

edit: I am also having difficulty trying to get the signature to verify...maybe you should try to sign a message that does not contain the "BTC" symbol as a test...

Indeed, the message as presented when you click the "quote" button, where the BTC symbol appears as [btc] fails to verify.  So does using a "B" which is what my browser produced when I copy-n-pasted the BTC image from the web-page.  The use of < > around sections of the message seems to indicate lack of familiarity with signing bitcoin messages.

@OP, see if you can get us a working signature.  Check out this wonderful tutorial on the matter by Shorena: https://bitcointalk.org/index.php?topic=990345.0

[OmegaStarScream]

I don't see why you guys can't get it verified , got it easily . Here

[el kaka22]

I don't see why you guys can't get it verified , got it easily . Here

Oh I got the [btc] tag as capital letters (i.e. [BTC]), which his account uses capital letters. This should be why the message don't verified.

BTW you can add this tag to prevent the [btc] becomes BTC automatically:

Code:

[nobbc][/nobbc]

[[BTC]onFIRE]

  this account wasn't hacked or sold people. I'm the only real BTConFIRE

[OmegaStarScream]

this account wasn't hacked or sold people. I'm the only real BTConFIRE

How come he was able to sign a message ?
Maybe you should do the same to proof that you actually own the account but it wouldn't make much sense if both of you could do that .

[[BTC]onFIRE]

this account wasn't hacked or sold people. I'm the only real BTConFIRE

How come he was able to sign a message ?
Maybe you should do the same to proof that you actually own the account but it wouldn't make much sense if both of you could do that .

How to using mycelium? 0.0

[shorena]

-snip-
Here is the unedited post where I posted that address: https://bitcointalk.org/index.php?topic=1066570.msg11460242#msg11460242
-snip-

The post in question was edited 20 minutes ago.

[BadBear]

Original

followed and retweeted all done
my twitter https://twitter.com/btconfire
my btc address 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM

Edited

Followed and retweeted all done
my twitter https://twitter.com/bitcoinonfire
my btc address 1G53GvfHhuvxKsCJZLPX91oPppkWDRdq

Edited version is also an invalid address, and that twitter account doesn't seem to exist. Makes it more likely that the OP is legit, and the current owner is not.

I've locked the account for time being.

[ndnh]

Hacker edited the post after probably seeing this post on his thread:

This account is hacked , check here : https://bitcointalk.org/index.php?topic=1179091.0
don't trust OP unless he provide signed message from unedited posts he provided months ago .

[Straux]

I can confirm that the hacker/current owner of the account BTConfire is Candystripes/Pierre11, who are serial scammers. This user has also scammed me out of 1.3~ BTC recently. DO NOT DEAL WITH THIS ACCOUNT UNTIL THE ORIGINAL OWNER GETS IT BACK.

[whywefight]

here we go with a quote that can not be edited by the hacker/scammer https://bitcointalk.org/index.php?topic=1071639.msg11533372#msg11533372

[Timelord2067]

I'm going to go out on a limb and say that [BTC]onFIRE was never hacked on the 8th of August and that [BTC]onFIRE is a chronic scammer with dozens of Alts.

The OP creates this thread https://bitcointalk.org/index.php?topic=1179091.0 on the 13 September 2015, 16:37:27 and less than ten hours later goes off-line permanently having posted just once...

Code:

Name: 	[btc]onfire1 u=543354 http://archive.is/mTeoZ
Posts: 	1
Activity: 	1
Position: 	Newbie
Date Registered: 	09 August 2015, 04:28:48
Last Active: 	13 September 2015, 23:14:42
	
Total Time Spent Online: 	25 minutes.
Total Posts: 	1 posts
Total Topics Started: 	1 topics
Number of Polls Created: 	0 polls
Number of Votes Cast: 	0 votes

When the signed message doesn't appear to hold up, whywefight ponders:

here we go with a quote that can not be edited by the hacker/scammer https://bitcointalk.org/index.php?topic=1071639.msg11533372#msg11533372

The actual post:

http://archive.is/6HZUj#selection-545.0-587.44

my tweet https://twitter.com/btconfire/status/606434895867449344
btc address 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM
thanks 

You are welcome, just sent you your 0.001btc

The signed message posted by [btc]onfire1

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
My account [btc]onfire has been hacked/lost. Please reset the email to new.apache@yahoo.com. The current date is 8 august 2015.
-----BEGIN SIGNATURE-----
1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM
H1VpZYbglS7uO4br2VPCZKYPKg+ThvJNA5pIBksDwhMYaru+TSAZ5ciqbqBSN8faD9sn5fvwF9nFtIwcn4dLrs0=
-----END BITCOIN SIGNED MESSAGE-----

Message verified: http://coinig.com/?adr=1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM&msg=My+account+%5Bbtc%5Donfire+has+been+hacked%2Flost.+Please+reset+the+email+to+new.apache%40yahoo.com.+The+current+date+is+8+august+2015.&sig=H1VpZYbglS7uO4br2VPCZKYPKg%2BThvJNA5pIBksDwhMYaru%2BTSAZ5ciqbqBSN8faD9sn5fvwF9nFtIwcn4dLrs0%3D

Funds from 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM were shifted to 3Px19pCL9xmZattPzCajsqDdGQrVMMpcBG 0.0101613 BTC 2015-09-03 10:30:17 and have sat dormant ever since.  Both Wallet Addresses are the sole Wallet Addresses for their respective Wallets - Wallet [882c19fcb6] and Wallet [3bf18a15a6]

https://twitter.com/btconfire is still tweeting / retweeting - last such post was two days ago.  On the other hand...

https://twitter.com/bitcoinonfire returns: Sorry, that page doesn’t exist!

while the Wallet Address 1G53GvfHhuvxKsCJZLPX91oPppkWDRdq returns a Checksum does not validate as confirmed previously.

Followed and retweeted all done
my twitter https://twitter.com/bitcoinonfire
my btc address 1G53GvfHhuvxKsCJZLPX91oPppkWDRdq

Right up until the day before the UID was "hacked", they were using the Wallet Address 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM used to then reclaim the account by [btc]onfire1:

First use is at top of post.

Second use:  http://archive.is/AAVdS#selection-3655.0-3681.23 (note the use of day-month-year)

# Username: [ btc ]onfire
# Bitcoin Address: 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM
# Member Type: full member
# Date Joined: 8-6-2015

Fourth use:  http://archive.is/4oTF0#selection-1573.0-1619.47

type: google+

link:
https://plus.google.com/116219343947296102157/posts/973bMwnYqiW
https://plus.google.com/116219343947296102157/posts/Xci1mDik5mq
https://plus.google.com/116219343947296102157/posts/RMqKygGggth

btc address: 1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM

Fifth use:  http://archive.is/VKSv6#selection-7175.0-7203.34

RT’ed and followed done
my twitter https://twitter.com/btconfire
1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM

Last use: http://archive.is/eoiUX#selection-4465.0-4484.8

your faucet  so mobile friendly
and i have claimed 500 satoshi thanks
i want free 10000 satoshi too
1D53GvfHhuvxKsCJZLPX91oPppkWDRdqNM thanks

all of which could have been modified by the "hacker" but weren't.


The fact the account has stopped being used tells me a scammer was in control of the account

[BTC]onFIRE wanted it to appear as though the account had been hacked and then abandoned.

Code:

Name: 	[BTC]onFIRE
Posts: 	223
Activity: 	223
Position: 	Full Member
Date Registered: 	04 February 2015, 11:22:39
Last Active: 	15 September 2015, 11:59:11

The scammer has a sense of irony though:  http://archive.is/naNSu#selection-5805.47-5805.85

though I doubt I'll see any of the promised BTC 10.0 any time soon... 

http://archive.is/naNSu#selection-1581.0-1585.5
http://archive.is/naNSu#selection-2597.0-2597.82
http://archive.is/naNSu#selection-3965.0-3967.40

No-one followed up on this though:  http://archive.is/AOlSW#selection-4401.0-4421.244

I can confirm that the hacker/current owner of the account BTConfire is Candystripes/Pierre11, who are serial scammers. This user has also scammed me out of 1.3~ BTC recently. DO NOT DEAL WITH THIS ACCOUNT UNTIL THE ORIGINAL OWNER GETS IT BACK.

No negative trust on their wall, and no scam accusation that I can see.


Still not sure how these codes actually work but given the short activity of titaniumfox I'd say they are an Alt of the scammer who took over the OP's main account.

Code:

Name: 	titaniumfox u=397979 http://archive.is/OWDHz
Posts: 	13
Activity: 	13
Position: 	Newbie
Date Registered: 	26 November 2014, 14:37:26
Last Active: 	22 October 2015, 13:16:23

 Re: [ 18.5+ BTC PAID! ] CryptoFATE.com == GET 150% INSTANTLY == TRANSPARENT AND FAIR
19 October 2015, 18:43:08 https://bitcointalk.org/index.php?topic=1203147.msg12726250#msg12726250 (Locked thread) http://archive.is/QxdUM#selection-2595.0-2617.34

number: 6
1BwnkpAb7zxozGfsyEc4tbguhDuQi6RScr

http://archive.is/VmQ2s#selection-2421.0-2441.107

'I want to link my Bitcointalk name with BTCJam's. Verification code: 4374f135-d03f-4ee2-a586-a01178658eb2'

http://archive.is/D4OIE#selection-4813.0-4833.107

'I want to link my Bitcointalk name with BTCJam's. Verification code: 4374f135-d03f-4ee2-a586-a01178658eb2'

http://archive.is/D4OIE#selection-4989.0-5009.107

'I want to link my Bitcointalk name with BTCJam's. Verification code: 224b2b57-d504-46ae-8389-868d5e0603e6'

http://archive.is/Yb60b#selection-4789.0-4809.107

'I want to link my Bitcointalk name with BTCJam's. Verification code: 224b2b57-d504-46ae-8389-868d5e0603e6'

Code:

Name: 	alieksandrv u=530846 http://archive.is/mbkf8
Posts: 	1
Activity: 	1
Position: 	Newbie
Date Registered: 	06 July 2015, 06:58:47
Last Active: 	31 May 2016, 16:11:26

Same page as alieksandrv post:  http://archive.is/Yb60b#selection-2015.0-2034.1

'I want to link my Bitcointalk name with BTCJam's. Verification code: cd185ec0-03e3-43aa-9079-fae6acab87a9'

MAsterV referral use of that code on BCT: http://archive.is/rHmnX#selection-3963.0-3965.109 but doesn't appear to be otherwise connected. [1]


OK, so we have the following::

Accounts connected: [BTC]onFIRE, [btc]onfire1,

and separately, we have:

Accounts connected:

(unknown scammer), titaniumfox, alieksandrv,

So, where are we at?

I connected: ozgr, misteagle, reyhiesa, zhuravskij3, Desert Flame, nickaizoku, bms2013, Berthorl, SvintuS

here: https://bitcointalk.org/index.php?topic=1206112.msg14394021#msg14394021 using Wallet Address 1BwnkpAb7zxozGfsyEc4tbguhDuQi6RScr so if titaniumfox is using 1BwnkpAb7zxozGfsyEc4tbguhDuQi6RScr that means the hacker is an Alt of ozgr, misteagle, reyhiesa, zhuravskij3, Desert Flame, nickaizoku, bms2013, Berthorl, SvintuS and by extension, so are alieksandrv, planetroving, Lamigo, afidwildan, Nami, kingwasabi, Thresh, Shyvana,     

Proof:

titaniumfox

http://archive.is/qgpze#selection-2103.0-2127.6

Username: planetroving

Thanks

http://archive.is/qgpze#selection-2275.0-2297.7

Username: Lamigo
Thanks.

http://archive.is/qgpze#selection-2627.0-2649.8

username : afidwildan
Thankyou

planetroving

http://archive.is/bDnWq#selection-2247.0-2271.6

Username: planetroving

Thanks

http://archive.is/qeD58#selection-5321.0-5345.6

Username: topkek

Thanks

http://archive.is/nbBVu#selection-927.0-951.6

Username: planetroving

Thanks

http://archive.is/H9ytT#selection-5359.0-5383.6 (third Alt on the one page)

Username: planetroving

Thanks

bms2013 and zhuravskij3 posts on the same page that Thresh posts three times:

http://archive.is/LIKnX#selection-3003.0-3025.7

my username: bms2013
thanks!

http://archive.is/LIKnX#selection-7061.0-7083.25

zhurYRA
Thanks for awesome promo!

http://archive.is/LIKnX#selection-8387.0-8763.6

Username: planetroving

Thanks

Username: TurboMen

Thank you !

Username: Dongtsy

Thanks

bms2013 also posts http://archive.is/RluQj#selection-3899.0-3921.10 on same page Shyvana posts to:

http://archive.is/RluQj#selection-5109.0-5133.6

Username: planetroving

Thanks

Code:

Name: 	Nami u=336683 http://archive.is/JzTqn
Posts: 	193
Activity: 	168
Position: 	Full Member
Date Registered: 	29 May 2014, 01:48:05
Last Active: 	12 December 2015, 13:30:23

Code:

Name: 	Shyvana u=336824 http://archive.is/SXQwC
Posts: 	70
Activity: 	70
Position: 	Member
Date Registered: 	29 May 2014, 10:52:44
Last Active: 	07 November 2015, 07:16:24

Code:

Name: 	Thresh u=336846 http://archive.is/qcw5b
Posts: 	85
Activity: 	70
Position: 	Member
Date Registered: 	29 May 2014, 12:48:18
Last Active: 	02 May 2016, 04:37:17

Code:

Name: 	kingwasabi u=398520 http://archive.is/n7c3N
Posts: 	13
Activity: 	13
Position: 	Newbie
Date Registered: 	28 November 2014, 07:42:04
Last Active: 	03 July 2015, 15:19:25

Code:

Name: 	planetroving u=484567 http://archive.is/dBixz
Posts: 	1116
Activity: 	644
Position: 	Hero Member
Date Registered: 	19 March 2015, 17:35:00
Last Active: 	Today at 10:19:39

Website: 	Planet Roving's Official Site
Current Status: 	Offline Offline
Bitcoin address: 	1H9CYX8bk1t5o39B9qjDTey2fgEy9V4cUy

At this point, it almost appears to become exponential the number of Alts that are connected.  Perhaps someone else might like to delve further into these Alts?


I'll let you ponder these three posts by [BTC]onFIRE and planetroving

Re: ToTheMoon.me | Big Giveaway | upto 10000 Bits per person | Fun Game!
01 July 2015, 16:30:32 https://bitcointalk.org/index.php?topic=1102726.msg11760611#msg11760611 (Locked thread) http://archive.is/hVQjd#selection-5485.0-5504.9
   

#154
User ID : btconfire  Cool

https://twitter.com/btconfire/status/616131515169161217  Smiley

Three posts later on the same page: (three hours to the minute later)

 Re: ToTheMoon.me | Big Giveaway | upto 10000 Bits per person | Fun Game!
01 July 2015, 19:32:18 https://bitcointalk.org/index.php?topic=1102726.msg11761647#msg11761647 (Locked thread) http://archive.is/hVQjd#selection-6617.0-6643.58
   

#157
Username: planetroving

Tweet link: https://twitter.com/spacemarsful/status/616176722526863361

http://archive.is/GKhUN#selection-2111.0-2145.7 (lasted edited 10 July 2015, 16:54:09 by planetroving)

Edited! with correct username!

Primedice Username: spacemarsful
Date Joined Primedice: 10th of July 2015

Thanks!

Two posts later (and nine minutes later at that)

http://archive.is/GKhUN#selection-2605.0-2627.25

Primedice username btconfired
date joined feb 10th 2015

and lastly:  http://archive.is/QqgZG#selection-3169.0-3199.7

Primedice Username: spacemarsful
Date Joined Primedice: 10th of July 2015

I like Primedice because of its minimalistic and uncluttered site, which makes using the site very easy to use. It is very easy to navigate the site, unlike a few other dice sites. Also, the big community brings a sense of belonging to something big, which is great, especially in the chat. The faucet integrated within the site is great as well. However, the only gripe I have is the slow roll/bet speed, which brings the site down when compared to other dice sites.

Thanks!

Two out of three instances where planetroving posts the twitter spacemarsful [btc]onfire1 is in close proximity, so I began to wonder if they (and therefore all) of these Alts are connected?


http://archive.is/jPSqj#selection-4455.0-4487.60

my twitter https://twitter.com/btconfire
my tweet https://twitter.com/btconfire/status/608150254471409664
rollin.io bitcoin address 1PKpt7LrJyV6Ju1PxXSHtzdbVxBK8E9j1j

1PKpt7LrJyV6Ju1PxXSHtzdbVxBK8E9j1j is a Wallet Rollin.io so that's a dead end...


Every instance of 1FCkxmbqYKtgTTmjV771V6tkDcGNewToJr is in posts by [BTC]onFIRE that have been edited on the 14th of September 2015 which is *after* this thread was started.

http://archive.is/Z3qd5#selection-4999.0-5018.4
http://archive.is/75Zfh#selection-5221.0-5249.9
http://archive.is/8xb7g#selection-7351.0-7370.11
http://archive.is/QWqI6#selection-6349.0-6368.13
http://archive.is/lbB3d#selection-6101.0-6123.34 ozgr also appears 11 posts earlier on the same page - ( 47 and a half hours earlier ) with Wallet Address 1632Ni7QxA1wAEXgiogkEjfQy1FwXiCJvP http://archive.is/lbB3d#selection-3377.0-3399.34
http://archive.is/E0bgo#selection-2117.0-2172.0 - Coinbuddy appears on the same page further down... 

Perhaps BadBear can explore what the Wallet Addresses originally said?

1FCkxmbqYKtgTTmjV771V6tkDcGNewToJr is used to shunt funds ( BTC 0.5 ) from Wallet MtGoxAndOthers to Wallet PrimeDice.com-old4 on the 13th of September 2015 which is our OP thread date...

http://archive.is/i9tqa#selection-4949.0-4971.50

username btconfire
deposit address 1MYFoHk86vy6u37YsnbCrNFqvsBvR1Yi4Q

1MYFoHk86vy6u37YsnbCrNFqvsBvR1Yi4Q is part of Wallet [4856e6ad36] https://www.walletexplorer.com/wallet/4856e6ad362af80f/addresses and there are just two Wallet Addresses, they are:

Code:

191DfcDqgN68EP1m8xHYop3PYpWbqRATY8	0.         	1	346409
1MYFoHk86vy6u37YsnbCrNFqvsBvR1Yi4Q	0.         	1	346409

[1]  http://archive.is/i9tqa#selection-1615.0-1639.43 (some 21 hours prior to the above post)

Username: MAsterV
Currency: Blackcoin
Address: BTPDaCsTw2SmhoLfbgFUpXGJY2c58T7d2W

 Re: Luckyballs.io Giveaway - 3 mBTC per twitter account
13 June 2015, 00:04:10 https://bitcointalk.org/index.php?topic=1084174.msg11600570#msg11600570 (Locked thread) http://archive.is/TunxI#selection-593.0-619.18
   

#381
my tweet https://twitter.com/justin_arm_/status/609357401775456256
username btconfire

So now we search for

 

Code:

justin_arm_

 Re: Luckyballs.io Giveaway - 3 mBTC per twitter account
13 June 2015, 18:23:01 https://bitcointalk.org/index.php?topic=1084174.msg11606506#msg11606506 (same locked thread) http://archive.is/TVApH#selection-599.0-618.9
   

#401
https://twitter.com/estrella_marce/status/609356898635157504
https://twitter.com/justin_arm_/status/609357401775456256
vafelcz

THANKS!! Cheesy

Three days later in the same thread:

 Re: Luckyballs.io Giveaway - 3 mBTC per twitter account
13 June 2015, 12:53:29 https://bitcointalk.org/index.php?topic=1084174.msg11605212#msg11605212

http://archive.is/AdJw3#selection-3451.0-3479.13
   

#390
https://twitter.com/estrella_marce/status/609356898635157504

user: catlove

...and who is at the top of the same page?

http://archive.is/AdJw3#selection-607.0-633.18

Re: Luckyballs.io Giveaway - 3 mBTC per twitter account
13 June 2015, 00:04:10 https://bitcointalk.org/index.php?topic=1084174.msg11600570#msg11600570 (Locked thread) http://archive.is/TunxI#selection-593.0-619.18
   

#381
my tweet https://twitter.com/justin_arm_/status/609357401775456256
username btconfire

Code:

Name: 	nickaizoku u=164179 http://archive.is/UaMxR
Posts: 	2279
Activity: 	308
Position: 	Sr. Member
Date Registered: 	20 November 2013, 02:45:02
Last Active: 	22 October 2016, 13:05:50

Bitcoin address: 	12iLTrfVpoSGmcLJaZgsed9zBqVKG14vDf
Gender: 	Male
Age: 	31
Location: 	Malaysia
Trust: 	-8: -3 / +0

Code:

Name: 	catlove u=167451 http://archive.is/DucmL
Posts: 	152
Activity: 	152
Position: 	Full Member
Date Registered: 	23 November 2013, 23:49:23
Last Active: 	02 December 2016, 23:20:57

Code:

Name: 	vafelcz u=400712 http://archive.is/L1vb8
Posts: 	209
Activity: 	154
Position: 	Full Member
Date Registered: 	06 December 2014, 19:26:51
Last Active: 	24 July 2015, 19:41:15

Email: 	ajdiajoidjo@gmail.com

Trust: 	-16: -4 / +0
Warning: Trade with extreme caution!

previously their email was:  http://archive.is/XDndd#selection-493.0-497.20

Code:

Other contact info: 	jakubdalik@yahoo.com

Their trust wall says it all:

shorena 60: -0 / +6   2016-01-29   0.00000000   Reference   Alt of The Bad Guy, scammed 0.75 BTC.
Tomatocage : -1 / +23   2015-06-22   0.00000000      Alt of FattyPonzi
hedgy73 120: -0 / +12   2014-12-12   0.00000000   Reference   Scammer!!
John (John K.) 180: -0 / +18   2014-12-12   0.00000000   Reference   Scammer. Do not trust. Likely alt of xefuse and many other more. https://bitcointalk.org/index.php?action=profile;u=399194

Muhammed Zakir 40: -0 / +4   2015-06-11   0.00000000   Reference   Was 4 months and 11 days late to repay loan! Do your own due diligence when dealing with this user!

Additionally, he is a Fraudster. https://bitcointalk.org/index.php?topic=1078437.0;all

vafelcz is alt of nano-btc who is alt of Dalyb.

On one side of the ledger, we have Date Registered:    20 November 2013, 02:45:02 nickaizoku u=164179 http://archive.is/UaMxR who is connected to the Alt that "took over" [BTC]onFIRE while on the other side of the ledger, we have Date Registered:    23 November 2013, 23:49:23 catlove u=167451 http://archive.is/DucmL who is directly connected to [BTC]onFIRE.

I'm going to go out on a limb and say that [BTC]onFIRE was never hacked on the 8th of August and that [BTC]onFIRE is a chronic scammer with dozens of Alts.

Neither nickaizoku nor catlove are the Genesis Alt ^TM of this series of Alts.


Addresses:

Wallet [107b1853ee]   https://www.walletexplorer.com/wallet/107b1853ee0317a1/addresses has 20 Wallet Addresses, they are:

Code:

177dYC5QNwWuMqxEZKju8qvR8T3NgKGRs8	0.00008035 	205	442532
114RXihBrcA966xSQ21bGVU6KnHPDggrZN	0.         	96	412569
17zC7NVzqATW2WXUmmMKRjcBthtQtyqJsb	0.         	86	415716
1BwnkpAb7zxozGfsyEc4tbguhDuQi6RScr	0.         	79	442532
1CAx5ffDU2ngJVt9tZfdymDets36rAeoox	0.         	18	380551
19LmwNTDgUfRHmP2bwisZeT3pUHQgDc2Sa	0.         	14	353539
18MGNMivEpQiG3G63g7ar8aEbNgLZsq8UH	0.         	7	435493
177ghCBWkzs9aafV1S9y4cdDCT6krD6MuE	0.         	7	382093
1MBL3Qkst1Bjs57KoLE7vTKAJzvVFe9pJi	0.         	5	437670
1HNt4ZKsKnCXt7U6WiuhFPVNjBvrmr3rct	0.         	5	382956
16THWCrw4vmvX1YKLNaitVxDsppbF5io2E	0.         	3	386284
1jj5LvMDEemtzTLLGK91ihPaKuYU5qPAn	0.         	3	360656
1BEwoMcMFjGSETqrq34MKGQBHPHXEj2cAp	0.         	3	355718
1L2Py6rTvtbKzFiUphVDD538FmiGhHrdMC	0.         	3	348040
1KLqK3QCXGTm9RP5t4ozffVaaQFQxhcDE	0.         	2	357628
14CUWhc3vgepxb9pz3JzoKSSTtGG6NHxpT	0.         	2	354386
158ThvB3e4zj9b9FRiMbhu3UXarXkxVoWq	0.         	1	407982
1RdAbSr143g6Sj1WEsH3VWX1ePYiZsSz4	0.         	1	403420
1MngvAJGmHxuTDJXBLELGoTQ2cLpHxocTh	0.         	1	375496
19QjvJabAumwPF28fh3GLUEecgRKzjNBR8	0.         	1	356128

(and I haven't even started to look through them yet)

Miscellaneous:

Searching for email

Code:

new.apache@yahoo.com

I've noticed:

Code:

Name: 	apachephp u=126954 http://archive.is/LlGkp 
Posts: 	1
Activity: 	1
Position: 	Newbie
Date Registered: 	06 June 2013, 15:00:40
Last Active: 	Today at 21:25:05

is online right now.  Uncanny coincidence given there are just 17 UID's out of 920,000 that have Apache in their profile...


I'll wager @YoeN is an Alt... http://archive.is/75Zfh#selection-3469.0-3489.61

[Clement Kaliyar]

@Timelord2067 That is one hell of a detailing my dear friend. I know you have spent an aweful lot of time investigating this scam or fraudster .You are indeed a scam buster and hats off to you and my question is is it possible to file an FIR against these individuals for fraud as i have seen an FIR being logged recently in India for scamming 1.5 BTC. I am not sure about how the end results will be but in this case the admins does have their IP address and i expect them to hand over the IP address when there is a police complaint.

[Timelord2067]

@Timelord2067 That is one hell of a detailing my dear friend. I know you have spent an aweful lot of time investigating this scam or fraudster .You are indeed a scam buster and hats off to you and my question is is it possible to file an FIR against these individuals for fraud as i have seen an FIR being logged recently in India for scamming 1.5 BTC. I am not sure about how the end results will be but in this case the admins does have their IP address and i expect them to hand over the IP address when there is a police complaint.

I wouldn't say exactly that the forum is turning a blind eye to such goings on, but they are leaving it up to the forum's participants to self monitor and dish out a kind of retribution in the form of trust, either positive, neutral or negative depending on the transgression.

There's nothing to stop retaliatory negative trust, or indeed false trust from an Alt to give the allusion of trust where non exists.

Most of the scams are for a couple of dollars so people aren't likely to go to the police for that kind of coin.  Unfortunately, all we can do is build up a profile of the scammers and mark each one accordingly with Red Paint ^TM and hope that punters in future are clued up enough to read the trust trusted, or in my case untrusted, and hope users make an informed decision about what is written.