bitcoinblackfriday.info - Do NOT use their website.

[Quickseller]

I'm surprised that theymos issued warnings about this, I thought the forum doesn't moderate scams or does anything about them.

We don't, but since they bought an advertisement from us, we should take at least some responsibility as we "promoted" their website. Theymos has done this perfectly in my opinion.

What's been moderated?

theymos took down the forum ad that they had up and he put up a warning in the news section of the forum.

[saturn643]

http://tools.tracemyip.org/lookup/172.98.67.28
http://www.ip-adress.com/whois/172.98.67.28

is that the email senders ip?

That is the ip of the mail service, which is hosted it seems, so it doesn't tell us too much unfortunately.

[freedomno1]

This whole story should be used as a reference: I can't believe they managed to run this so smoothly. It's good that there are some very clever users around who tagged this scam. I'm sorry for you guys who got basically scammed by these criminals. Another lesson learned.

I am drinking my morning coffee, reading through the thread and I can't believe this crap! 21 BTCs scammed as we are speaking and probably even more!

Are we ever gonna move past the stuff like this as a community? Or will ever gonna be this easy to scam the people around here?

These type of elaborate scams always leave a bad taste in my mouth, especially since this is an event to highlight the good part of Bitcoin not the well darker aspects of it. It reminds me of when I first joined the forums and entered a raffle for Anyroll and was sent a phishing link from a PM in 2013.  Only this scam was far more sophisticated and required a lot more work, perhaps someone can dig into the host domains for each of the fake domains and registrants although that is assuming they are the same person.

I do wish that their were ways to prevent these type of attacks but well executed zero day ones still get through and this was a case where there was a reason to keep the merchant list till the last minute even for malicious intent, it's times like this that I'm glad some in the community caught it quickly and limited the spread.

The main issue is for those who are outside the forums and as long as the site is up (down now) and the domain active it remains a risk google reporting it and nuking the heck out of it seems the best way to address that so people will be given a redirection warning on most browsers, that said I was happy the real bitcoinblackfriday sent users a message and a warning users about the impostor site.
(For those who signed up an e-mail with the fake site it makes sense to unsubscribe from that e-mail list if you have not already, unless you want to keep it for tracking malicious spam sent through the mailing network.)
Web of Trust Rating sent in gave it a Red needs a few more for a status change to kick in for those that use WOT

[jdh015232]

OP posted about it 6 hours before i sent my order. i immediately realized it was bullshit like 5 seconds after i clicked send BTC, i dont know how i didnt catch it 5 seconds before, but i didnt. so i posted here https://bitcointalk.org/index.php?topic=1267954.0  6 hours after your forum post had started. so we got it figured out and stopped within 12 hours, which is pretty amazing work by the community. im just the idiot who got the worst of it
unfortunately i had not been very active as of late, and did not see your post, but i tried to immediately allert anyone else to not use the site.

[tokeweed]

Ah so Litecoinguy was right after all.  

https://bitcointalk.org/index.php?topic=1262512.msg13064892#msg13064892

[EcuaMobi]

Ah so Litecoinguy was right after all.  

https://bitcointalk.org/index.php?topic=1262512.msg13064892#msg13064892

Actually he was complaining just for the lack of answers and once he recieved one he closed the case and locked the thread. It was hard to see this coming before they posted those links to phishing sites yesterday. But with this precedent hopefully people will pay more attention in the future.

[bit1]

Thank you, For this kind of warnings in the news section of the forum. Really a very good idea.

[peonminer]

https://bitcointalk.org/index.php?action=profile;u=525055

Here's the sad excuse for human flesh's profile now.

 Summary - GotaPauj   Picture/Text
Name:   GotaPauj
Posts:   385
Activity:   168
Position:   Full Member
Date Registered:   June 23, 2015, 06:06:34 AM
Last Active:   November 27, 2015, 02:27:08 PM
ICQ:   
AIM:   
MSN:   
YIM:   
Email:   hidden
Website:   
Current Status:   Offline Offline
Bitcoin address:   1H8Pm29JPzX3KjjapjmgpYSCUySVnHKfWT
Gender:   
Age:   N/A
Location:   
Local Time:   November 28, 2015, 05:49:13 PM
Trust:   -4093: -12 / +3
Warning: Trade with extreme caution!

[DimensionZ]

Wow I was looking through the offers the other day and was going to engage but thankfully I saw this in the last minute.

[jdh015232]

Wow I was looking through the offers the other day and was going to engage but thankfully I saw this in the last minute.

everyone but me

and jynger so far

[tokeweed]

Ah so Litecoinguy was right after all.  

https://bitcointalk.org/index.php?topic=1262512.msg13064892#msg13064892

Actually he was complaining just for the lack of answers and once he recieved one he closed the case and locked the thread. It was hard to see this coming before they posted those links to phishing sites yesterday. But with this precedent hopefully people will pay more attention in the future.

That thread made me stay away actually and never looked back at that thread again.  I was suprised when it was indeed really a scam.

[jdh015232]

every website should have a date of when it was created, so like https:/06/11/2009/www.blahblahblah.com
this would make it obvious if its a phishing site which was just created

[jdh015232]

so even though theymos has the IP of the guy logged into the bitcointalk account to scam, it was through a proxy, 100%, so theirs no chance of identifying anything?

[no-life]

so even though theymos has the IP of the guy logged into the bitcointalk account to scam, it was through a proxy, 100%, so theirs no chance of identifying anything?

even tho if you had his ip you could not do anything about it.
people are too naive and they lost money. move on and research before you want to buy/trade something.

[saturn643]

I analyzed the email headers that I posted earlier and it looks like the scammer was using godaddy for email, so he probably used it for domain registering as well. Do you think it will be possible to contact godaddy and ask them if they can provide information about that guy?

[Lutpin]

I analyzed the email headers that I posted earlier and it looks like the scammer was using godaddy for email, so he probably used it for domain registering as well. Do you think it will be possible to contact godaddy and ask them if they can provide information about that guy?

IIRC most domains affiliated with this have been registred with namespace, and they have been already contacted.
You can take a shot on godaddy though, if you want to.

[peonminer]

GET THIS ASSHOLE DOX'D ASAP

http://www.whoisguard.com/contact-us.asp
support@mail.whoisguard.com

IF YOU WERE SCAMMED SEND WhoIsGuard Inc. AN EMAIL LETTING THEM KNOW THEY ARE AIDING AN IMPERSONATOR AND THIEF AND THEY WILL BE RECEIVING SUBPOENA FOR THEIR CRIMINAL CLIENT'S INFORMATION.  

https://whois.icann.org/en/lookup?name=bitcoinblackfriday.info

Showing results for: BITCOINBLACKFRIDAY.INFO
Original Query: bitcoinblackfriday.info

Contact Information
Registrant Contact
Name: WhoisGuard Protected
Organization: WhoisGuard, Inc.
Mailing Address: P.O. Box 0823-03411, Panama Panama 00000 PA
Phone: +507.8365503
Ext:
Fax: +51.17057182
Fax Ext:
Email: ae71322874d547dd9529cef1ca872436.protect@whoisguard.com
Admin Contact
Name: WhoisGuard Protected
Organization: WhoisGuard, Inc.
Mailing Address: P.O. Box 0823-03411, Panama Panama 00000 PA
Phone: +507.8365503
Ext:
Fax: +51.17057182
Fax Ext:
Email: ae71322874d547dd9529cef1ca872436.protect@whoisguard.com
Tech Contact
Name: WhoisGuard Protected
Organization: WhoisGuard, Inc.
Mailing Address: P.O. Box 0823-03411, Panama Panama 00000 PA
Phone: +507.8365503
Ext:
Fax: +51.17057182
Fax Ext:
Email: ae71322874d547dd9529cef1ca872436.protect@whoisguard.com
Registrar
WHOIS Server:
URL:
Registrar: NameCheap, Inc
IANA ID: 1068
Abuse Contact Email:
Abuse Contact Phone:
Status
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
Important Dates
Updated Date: 2015-11-25
Created Date: 2015-09-30
Registration Expiration Date: 2016-09-30
Name Servers
MOLLY.NS.CLOUDFLARE.COM
ZEUS.NS.CLOUDFLARE.COM
Raw WHOIS Record
Domain Name: BITCOINBLACKFRIDAY.INFO
Domain ID: D56143722-LRMS
WHOIS Server:
Referral URL:
Updated Date: 2015-11-25T15:37:11Z
Creation Date: 2015-09-30T09:12:27Z
Registry Expiry Date: 2016-09-30T09:12:27Z
Sponsoring Registrar: NameCheap, Inc
Sponsoring Registrar IANA ID: 1068
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
Registrant ID: SRWOCGETCDZZOKUZ
Registrant Name: WhoisGuard Protected
Registrant Organization: WhoisGuard, Inc.
Registrant Street: P.O. Box 0823-03411
Registrant City: Panama
Registrant State/Province: Panama
Registrant Postal Code: 00000
Registrant Country: PA
Registrant Phone: +507.8365503
Registrant Phone Ext:
Registrant Fax: +51.17057182
Registrant Fax Ext:
Registrant Email: ae71322874d547dd9529cef1ca872436.protect@whoisguard.com
Admin ID: MY2OTT3HAM42HASP
Admin Name: WhoisGuard Protected
Admin Organization: WhoisGuard, Inc.
Admin Street: P.O. Box 0823-03411
Admin City: Panama
Admin State/Province: Panama
Admin Postal Code: 00000
Admin Country: PA
Admin Phone: +507.8365503
Admin Phone Ext:
Admin Fax: +51.17057182
Admin Fax Ext:
Admin Email: ae71322874d547dd9529cef1ca872436.protect@whoisguard.com
Tech ID: QQMNEAHU1EDROXMT
Tech Name: WhoisGuard Protected
Tech Organization: WhoisGuard, Inc.
Tech Street: P.O. Box 0823-03411
Tech City: Panama
Tech State/Province: Panama
Tech Postal Code: 00000
Tech Country: PA
Tech Phone: +507.8365503
Tech Phone Ext:
Tech Fax: +51.17057182
Tech Fax Ext:
Tech Email: ae71322874d547dd9529cef1ca872436.protect@whoisguard.com
Billing ID: G4WBKW032AYFNESA
Billing Name: WhoisGuard Protected
Billing Organization: WhoisGuard, Inc.
Billing Street: P.O. Box 0823-03411
Billing City: Panama
Billing State/Province: Panama
Billing Postal Code: 00000
Billing Country: PA
Billing Phone: +507.8365503
Billing Phone Ext:
Billing Fax: +51.17057182
Billing Fax Ext:
Billing Email: ae71322874d547dd9529cef1ca872436.protect@whoisguard.com
Name Server: MOLLY.NS.CLOUDFLARE.COM
Name Server: ZEUS.NS.CLOUDFLARE.COM
DNSSEC: unsigned
>>> Last update of WHOIS database: 2015-11-25T15:39:19Z <<<

"For more information on Whois status codes, please visit https://icann.org/epp"

Access to AFILIAS WHOIS information is provided to assist persons in determining the contents of a domain name registration record in the Afilias registry database. The data in this record is provided by Afilias Limited for informational purposes only, and Afilias does not guarantee its accuracy.  This service is intended only for query-based access. You agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to(a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the data recipient's own existing customers; or (b) enable high volume, automated, electronic processes that send queries or data to the systems of Registry Operator, a Registrar, or Afilias except as reasonably necessary to register domain names or modify existing registrations. All rights reserved. Afilias reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy.

http://www.whoisguard.com/legal-tos.asp

7. RESERVATION OF RIGHTS
WhoisGuard reserves the right to limit or refuse users access to the Site or any Service. WhoisGuard reserves the right to change the requirements for accessing the Site and the Services at any time and for any reason at its sole discretion, including changes to membership fees or other fees for Services. WhoisGuard reserves the right to alter, suspend, or discontinue the Site or any of the Services at any time and for any reason, without prior notice to you. The Site may become unavailable due to maintenance or malfunction of computer equipment or other reasons. WhoisGuard may at any time block your access to the Site if:

You have breached any provision of the TOS (or have acted in a manner that clearly shows you do not intend to, or are unable to, comply with the TOS);
WhoisGuard is required to do so by Law (for example, where the provision of the Site, Services or Content to you is, or becomes, unlawful);
The provision of the Site or Services to you by WhoisGuard is, in WhoisGuard's opinion, no longer commercially viable; or
WhoisGuard has elected to discontinue the Site or Services (or any part thereof).
WhoisGuard shall not be liable to you or any third party for any termination or cancellation of your access to, or use of, the Site.
You will retain the right to sell, transfer, or assign each Protected Domain. You will retain the right to control and set the DNS settings for the Protected Domain(s). You will retain the right to renew each Protected Domain name registration upon expiration (subject to WhoisGuard's applicable rules and policies). You will remain responsible for resolving any and all monetary or other legal claims that arise in connection with your Protected Domain(s), subject to the remaining provisions of this TOS, and any other agreement you may have with any other service provider.

8. THIRD PARTY WEB SITES
The Site may provide links to third-party websites, which are not under the control of WhoisGuard. WhoisGuard makes no representations about third-party web sites. WhoisGuard is not responsible for the reliability of any data, opinions, advice, or statements made on third-party sites. WhoisGuard provides these links merely as a convenience. The inclusion of such links does not imply that WhoisGuard endorses, recommends, or accepts any responsibility for the content of such sites. WhoisGuard shall not be liable, directly or indirectly, for any damage or loss caused or alleged to be caused by the use of a third-party web site or any information or materials received from a third-party web site.


9. TERM AND TERMINATION
You remain bound by these terms and conditions until and unless the TOS is properly terminated. You may terminate the TOS provided that you have no outstanding payment or other obligations due to WhoisGuard. WhoisGuard may terminate the TOS and/or your access to the Site or any Services at any time, with or without cause or notice, and without liability. Notwithstanding termination of the TOS by you or by WhoisGuard, the provisions in this TOS shall remain in full force and effect. Upon termination, you will no longer have access to any data or information you had previously created, maintained, managed, or stored in or through the Site, and WhoisGuard is under no obligation to maintain any such data or information.
You understand that the term of the Services administered by WhoisGuard begins on the date your attempt to purchase the Services is accepted by WhoisGuard and that it shall run for the unit of time which you order (“Term”). You understand that the Term may be different than the registration term of the Protected Domain which is associated with WhoisGuard. If a Protected Domain registration expires and is deleted before the end of the Term of the associated Services, then the Services associated with the domain will end when the Protected Domain is deleted, and you understand that there will be no refund for any resulting unused portion of the Term. If the Term ends while the registration term for the Protected Domain is still ongoing, then the Services will no longer be provided, the personal information specified in this TOS shall be listed in the public WHOIS Directory output for the (then former) Protected Domain, and the communications forwarding services specified in this TOS will no longer be provided.
Notwithstanding your purchase of the Services administered by WhoisGuard, WhoisGuard reserves the right in its sole judgment and discretion to disclose your personal protected information, or instruct WhoisGuard to disclose such information, in the event any of the following occur:

If the Protected Domain(s) is (are) alleged to violate or infringe a third party’s trademark, trade name, copyright interests or other legal rights of third parties;
If you breach any provision of this TOS;
If you breach any provision of the Agreements incorporated herein by reference;
If necessary to comply with any applicable laws, government rules or requirements, subpoenas, court orders or requests of law enforcement;
If WhoisGuard is named as a defendant in, or investigated in anticipation of, any legal or administrative proceeding arising out of your use of the WHOIS Privacy Services or a Protected Domain;
If necessary to comply with ICANN’s Dispute Resolution Policy or other policies promulgated by ICANN;
If necessary to avoid any financial loss or legal liability (civil or criminal) on the part of WhoisGuard or its parent companies, subsidiaries, affiliates, shareholders, agents, officers, directors and employees;
If necessary to protect the integrity and stability of the applicable domain name registry; or
If it comes to Backend Service Provider’s attention that you are alleged to be using the WHOIS Privacy Services administered by WhoisGuard for purposes of engaging in, participating in, sponsoring or hiding your involvement in illegal or morally objectionable activities, including but not limited to, activities which are designed, intended to or otherwise:
Appeal primarily to prurient interests;
Defame, embarrass, harm, abuse, threaten, or harass;
Violate state or federal laws of the United States and/or foreign territories;
Involve hate crimes, terrorism or child pornography;
Are tortious, vulgar, obscene, invasive of a third party’s privacy, race, ethnicity, or are otherwise objectionable;
Impersonate the identity of a third party;
Harm minors in any way; or
Relate to or transmit viruses, trojan horses, access codes, backdoors, worms, timebombs or any other code, routine, mechanism, device or item that corrupts, damages, impairs, interferes with, intercepts or misappropriates any software, hardware, firmware, network, system, data or personally identifiable information.
In the event WhoisGuard decides to take any of the actions set forth above or in the event you elect to cancel the Services administered by WhoisGuard for any reason, WhoisGuard shall not be liable for fees paid by you for the Services administered by WhoisGuard.

[hashmaster1]

I'm glad you found out that this was a scam I have been scam once by mintpal then hashra they scam me good I had ordered 6 miners never got them the last one was about a month ago  I downloaded a wallet and I guess it had a Trojan virus  key logger  and they stold all my coin that I had on my computer that was over 5btc  even stold the coin I had sent to local bitcoins to sell to go buy food for my family that was 0.75 btc and this how I been living off what I make so yes I hate scammers .........

[The Sceptical Chymist]

Good looking out for the community,  Mr. Nico.  Fuck these bastards and the holidays they celebrate.

[Quickseller]

[color= red][size= 20pt]GET THIS ASSHOLE DOX'D ASAP

[size= 10pt][color= red]http://www.whoisguard.com/contact-us.asp
support@mail.whoisguard.com[/color][/size]

[color= red][size= 10pt]IF YOU WERE SCAMMED SEND WhoIsGuard Inc. AN EMAIL LETTING THEM KNOW THEY ARE AIDING A THIEF AND THEY WILL BE RECEIVING SUBPOENA FOR THEIR CRIMINAL CLIENT'S INFORMATION.  [/size][/color]
--snip--

whois information is self provided and might as well be gibberish. When a registrar is made aware of a fake registration, they will simply cancel the domain, however whois guard prevents this because it is difficult to see that there is a fake registration behind the whois guard. The only thing getting past whois guard will do is allow whatever self-provided information is on the domain's registration.