Escrow Partner got tricked

[mexxer-2]

I mean ran a brute force to get one users account ID/pass

One can make a login attempt every 45 sec. , from an IP. Do the maths, its very unlikely unless the hacker had an unlimited amount of IPs and your pass was weak

they setup a script to try and collect users login/pass

You yourself said you have neither installed anything on your PC , nor do you remember going on a phising site


On a related note, this might've been connected to your site hack

[1714758702]

1714758702

[1714758702]

1714758702

[1714758702]

1714758702

[amartin99]

yes brute forcing that pass would be hard
that is why I used it

but I have not logged into this forum anywhere but from home
but they are not privately owned places they are large businesses
I haven't downloaded anything
or been in contact with him outside of the forum
he has no way to know my home IP

I can't think of any access he could possible have to me other then threw the forum
anyway got to be going out now

[mexxer-2]

I can't think of any access he could possible have to me other then threw the forum

Sounds like you're in complete denial about it being your fault your account(s) were compromised.

FTFY

[Ralobot.com]

i didnt hack you. i got a msg telling me to pay to an other pm account and i did than i got my money from escrow thats all i can say good bye .

yes brute forcing that pass would be hard
that is why I used it

but I have not logged into this forum anywhere but from home
but they are not privately owned places they are large businesses
I haven't downloaded anything
or been in contact with him outside of the forum
he has no way to know my home IP

I can't think of any access he could possible have to me other then threw the forum
anyway got to be going out now

[xetsr]

yes brute forcing that pass would be hard
that is why I used it

but I have not logged into this forum anywhere but from home
but they are not privately owned places they are large businesses
I haven't downloaded anything
or been in contact with him outside of the forum
he has no way to know my home IP

I can't think of any access he could possible have to me other then threw the forum
anyway got to be going out now

Sounds like you're completing fucked. I would keep a close eye on ALL your accounts. Read the message above about server requests. brute forcing your account would not be profitable considering the CPU usage and time that would be required.

Just trying to help but I guess I'll stop. Again, good luck.

[amartin99]

I mean ran a brute force to get one users account ID/pass

One can make a login attempt every 45 sec. , from an IP. Do the maths, its very unlikely unless the hacker had an unlimited amount of IPs and your pass was weak

they setup a script to try and collect users login/pass

You yourself said you have neither installed anything on your PC , nor do you remember going on a phising site


On a related note, this might've been connected to your site hack

IP limits are useless to hackers
my site wasn't hacked  one of my VPS's where but even that should not give him access to my account here
it is not connected
neither is my site actually
if I where to GIVE someone full access to my site or my VPS I see no way that would give them access here
 even the 2 sites I used the pass at  are new to me and not used on the VPS
anyway im out of time here

[SebastianJu]

i didnt hack you. i got a msg telling me to pay to an other pm account and i did than i got my money from escrow thats all i can say good bye .

*lol* Sounds like you have a lot ot time... now changing your story back. But still you don't want to provide proof for either of your claims.

[xetsr]

i didnt hack you. i got a msg telling me to pay to an other pm account and i did than i got my money from escrow thats all i can say good bye .

*lol* Sounds like you have a lot ot time... now changing your story back. But still you don't want to provide proof for either of your claims.

He's trying to get as much $$$ now as possible. Easy to see that

[Ralobot.com]

Dude you are crazy i said i've cleared my inbox ... if you want the pm transaction id i can post it here even if its not a proof so all i can do is laugh.... cause i didn't lose anything.

i didnt hack you. i got a msg telling me to pay to an other pm account and i did than i got my money from escrow thats all i can say good bye .

*lol* Sounds like you have a lot ot time... now changing your story back. But still you don't want to provide proof for either of your claims.

[xetsr]

Dude you are crazy i said i've cleared my inbox ... if you want the pm transaction id i can post it here even if its not a proof so all i can do is laugh.... cause i didn't lose anything.

i didnt hack you. i got a msg telling me to pay to an other pm account and i did than i got my money from escrow thats all i can say good bye .

*lol* Sounds like you have a lot ot time... now changing your story back. But still you don't want to provide proof for either of your claims.

Negative feedback was added for something else, either way. LOL.

[SebastianJu]

i didnt hack you. i got a msg telling me to pay to an other pm account and i did than i got my money from escrow thats all i can say good bye .

*lol* Sounds like you have a lot ot time... now changing your story back. But still you don't want to provide proof for either of your claims.

He's trying to get as much $$$ now as possible. Easy to see that

It looks like it. Though the info about how the hack happened would have been interesting. I wonder if he surely awaited that amartin99 would have paid him so much and that he would not even use an escrow for the $20.

Guess that guy is a troll too. Too much time on hands while claiming to have not the time to make a screenshot of the pm transaction.

[Ralobot.com]

Seb i said i dont give a fuck witch means i dont wanna waste my time on something stupid like a screanshout or a random pm transaction that can easly be faked if im a scammer.

anyways already told you my inbox was cleared for empty space .

So Seb how will u do escrow next time any new rules ?

[Indianacoin]

Indianacoin

What signed message? You realize that most persons don't have a staked address? Then I would have to get one address at the start of the trade only for the case that the account might be compromised and the hacker did not change the pass.

You know, I can offer that but I'm pretty sure either no one will do it or it will be a huge amount of time just to teach most of them that they learn how to sign messages, what a private key is, where to get it. I already had this alot. It is a mess to explain.

Well, if you really mean we now have to distrust every account that way then man, I would not like doing escrow anymore. It costs so much time already and pays practically nothing. Many big escrows already left because of the time needed and no reward.

I wonder if you ever tried to explain someone how to sign a message.

True.
But you must keep Shorena's how to sign a message thread^[1] handy from next time onwards just in case someone does not know about it.

Yeah I know escrows are a waste of time  if there is no reward for it.
It would be better if you start escrowing with a minimum fee of 0.01 BTC just as OGNasty started doing it already.
Heck I welcome every escrow providers to start at a base fee. This will be productive overall


[1] https://bitcointalk.org/index.php?topic=990345.0

[Ralobot.com]

sign a message can be bypassed easly ....

Indianacoin

What signed message? You realize that most persons don't have a staked address? Then I would have to get one address at the start of the trade only for the case that the account might be compromised and the hacker did not change the pass.

You know, I can offer that but I'm pretty sure either no one will do it or it will be a huge amount of time just to teach most of them that they learn how to sign messages, what a private key is, where to get it. I already had this alot. It is a mess to explain.

Well, if you really mean we now have to distrust every account that way then man, I would not like doing escrow anymore. It costs so much time already and pays practically nothing. Many big escrows already left because of the time needed and no reward.

I wonder if you ever tried to explain someone how to sign a message.

True.
But you must keep Shorena's how to sign a message thread^[1] handy from next time onwards just in case someone does not know about it.

Yeah I know escrows are a waste of time  if there is no reward for it.
It would be better if you start escrowing with a minimum fee of 0.01 BTC just as OGNasty started doing it already.
Heck I welcome every escrow providers to start at a base fee. This will be productive overall


[1] https://bitcointalk.org/index.php?topic=990345.0

[amartin99]

ok didn't say the sites before cause I didn't want to take the time to change the pass
done that now so

A-
the Pass I used here was also used at   payoneer.com   and   advcash.com
and I completely reject the thought that either of them have come here to rip me off
so my pass was not fished as there was no where to fish it from

B-
I do have a number of privet VPS that I setup on my own servers just to get a unique IP (have several Paypal accounts)
I use these PP accounts mostly to pay for my servers so rather then put in my Data-center passwords and links manually I just copied over my FF profile
I did this before joining this forum
then a few days ago (interesting timing) 2 of my VPS's got hacked
someone was in using the built in admin (I do all my work form that account)
first one was using an RDP scanner to search for more RDP's that he could brute his way into (im assuming it was a scan of my IP ranges from SYS that found my VPS's)
since I have never told anyone about them (well gave one person permission to us the one)
in the second I found the hacker using a password scanner to copy all my passwords from firefox (nice little program he left behind)
did a scan myself and it find 205 of my passwords (I get a round a bit hehehe)
the pass I used here is among them but this sites URL isn't
so it is POSSIBLE that the hacker copied all my passwords and ran a script to test them on a bunch of sites he knows of where he could run a scam
and found a connection here
it's HIGHLY unlikely but possible
however if this happened why would he send SebastianJu a message telling him to send the BTC on to Rolobot ?
if it was Rolobot that hacked my VPS how did he learn of it ?
I consider it nearly impossible that my VPS was the leek of my pass in this case
something else has happened here

C-
just before I traded with Rolobot I had a trade with "beel123"
I set my BTC fee's to low and the payment never got confirmed
it took me 4-5 days to get him his BTC (he was really understanding)
along the way I learned that I had to get the unconfirmed transaction removed from my BTC core to get the funds back
beel123 said to look here  https://bitcointalk.org/index.php?topic=35214.0
that thread got me to download this file https://github.com/jackjack-jj/pywallet
I opened it looked at it had no idea what to do with it and went another route (altering the run properties for the BTC core)
could that file I downloaded have somehow copied my password and sent it to someone else ?
I don't think so but this is the ONLY thing I have downloaded since joining this forum

D-
SKYPE
I have talked to a few people in skype
could they somehow infect my computer threw skype
I don't think so

======================================================

I have ran out of ways to blame my own security for this hack
I am not trying to blame the forum security out of pride or denial
I simply see no way that this could be my fault
if you can think of another way please tell me, as I would love to find that I am responsible
that would mean it's something I can fix


----------------------------------------------------------------------
just thought of one more
maybe 4-5 days ago somone joined new and used there first post to acuse me of being a scammer
linking to somone elces trust report as so called proof (a report that did not even have one referince to me on it)
every time I went to see that lionk I had to re-login
I suspected it was a fishing site so I reported the thread to a MOD and rushed off to change my pass
by the time I got that done the thread had been removed
I dono if that was a fishing URL or not
it looked real but the only time I had to login was when I clicked his link
MAYBE it was more then a fishing site  maybe it installed something that copied my pass every time I changed it
as the thread is gone I can't point you to it
this is the ONLY thing I can think of with any real chance of being the source of my problems

[xetsr]

just thought of one more
maybe 4-5 days ago somone joined new and used there first post to acuse me of being a scammer
linking to somone elces trust report as so called proof (a report that did not even have one referince to me on it)
every time I went to see that lionk I had to re-login
I suspected it was a fishing site so I reported the thread to a MOD and rushed off to change my pass
by the time I got that done the thread had been removed
I dono if that was a fishing URL or not
it looked real but the only time I had to login was when I clicked his link
MAYBE it was more then a fishing site  maybe it installed something that copied my pass every time I changed it
as the thread is gone I can't point you to it
this is the ONLY thing I can think of with any real chance of being the source of my problems

I have ran out of ways to blame my own security for this hack
I am not trying to blame the forum security out of pride or denial
I simply see no way that this could be my fault

You fell for it once, you don't think it's possible the second time? Hackers usually continue to target the suckers (no offense) they find.

Clear your browsing history lately? If not, might wanna take the time to go through each and every site you visited between now and then.

BTW, of course they look real. They are usually EXACT copies of the site. Only thing that's changed is the user name and password form. See here for an example: https://bitcointalk.org/index.php?topic=1378303.0

[amartin99]

other then that thread for removing unverified transactions I haven't clicked any off forum links
I have been mostly just responding to PM's and waiting on BTC to return my funds
I don't do much browsing around as im to busy with my RDP business

[Quickseller]

Quickseller, mexxer-2, lutpin

Well, I don't know. Quickseller, mexxer-2, lutpin... what is your opinion. Should I remove the red trust because in doubt removing?

The below is ignoring the fact there is apparently evidence that Ralobot.com is an alt of a scammer.

It looks like that Ralobot.com is claiming that he received a PM from amartin99 requesting that fiat be sent to a different PM address/account, however he is also claiming that he has deleted this PM. Depending on how long the alleged PM was in either amartin99 or Ralobot.com's inbox, the deleted PM may be recoverable by theymos (or anyone else with access to the forum's backups), although it is a fair amount of trouble to restore PMs that have been deleted by both the sender and the recipient so theymos may not be willing to go through the trouble of doing this.

As it stands now, it appears that Ralobot.com has not disputed the fact that he received BTC to the address that he requested BTC to be sent to. Ralobot.com could dispute this fact in the future, however this potential dispute could be refuted by providing PM logs showing evidence that Ralobot.com requested BTC to be related to a specific address as well as the txid of the btc being sent to such address.

Additionally, it looks like both parties agreed that Ralobot.com was to receive ~.64BTC in exchange for $279.93 sent to amartin99 via either PM or skrill. Ralobot.com also does not appear to dispute this fact, however if he did choose to dispute this, either amartin99 or your could show PM logs in which Ralobot.com agreed to these terms.

From what I can gather, it looks like Ralobot.com is not able to provide any kind of evidence that he sent any amount of PM/skrill to amartin99 at an address provided by amartin99.

Based on the above, it looks like amartin99 has carried out his side of the agreement, but Ralobot.com has not. Based on this fact, I would say that negative trust would be warranted for Ralobot.com. If however Ralobot.com is able to provide some kind of evidence that he received instructions to send PM/skrill to a certain address by amartin99 and that he did in fact send the appropriate amount of PM/skrill to such address, then depending on how believable such evidence is, I would consider removing such negative feedback. I would not however simply take his word for it.

[SebastianJu]

Ralobot.com

Seb i said i dont give a fuck witch means i dont wanna waste my time on something stupid like a screanshout or a random pm transaction that can easly be faked if im a scammer.

anyways already told you my inbox was cleared for empty space .

So Seb how will u do escrow next time any new rules ?

You say that you don't have the time to take a simple screenshot and post it. That is the work of maximum 2 minutes. Though in turn you post around, stories about you being the hacker, trying to get something for revealing the trick then suddenly change your story back because you don't receive the money.

You waisted hours posting and reading this and you still try to convince us that you don't have time to post a screenshot? Seriously... would you believe yourself?

Regarding new rules... well, it sounds hard to find a rule. I think maybe a warning to check the trading partners trust first and only proceed then. And an offer to the seller and buyer to give me an address of theirs before the trade and ask me to release the bitcoins only to an address that is in a message signed with the address of the seller and only release the bitcoins when it is in a message signed with the address of the buyer.

Together with a link to shorena's thread.

But seriously. I already know this will become a big mess. I already see the huge amount of questions I will receive then.

Well done sir...

sign a message can be bypassed easly ....

How would you bypass it? I only imagine faking it though of course a message makes only sense when checked.


Indianacoin

But you must keep Shorena's how to sign a message thread^[1] handy from next time onwards just in case someone does not know about it.

Yeah I know escrows are a waste of time  if there is no reward for it.
It would be better if you start escrowing with a minimum fee of 0.01 BTC just as OGNasty started doing it already.
Heck I welcome every escrow providers to start at a base fee. This will be productive overall


[1] https://bitcointalk.org/index.php?topic=990345.0

Yes I know this thread and it is quite usefull though I can ensure you if you try to explain it with a link to a newbie... that is not all. It will be a big mess.

A base fee is fine and all but what should I do with 0.01 Bitcoin? That's $4 for the whole deal and believe me deals take alot of time often enough. With problems it will be many hours, and so on. Though ok, I have many deals where I don't receive anything. Maybe I really should value my time more and think about that.

I will see how I can deal with that. First I will ask other escrows what they think.


amartin99



If you would come over a phising website then your browser password would not show up. As well when you use a password database with browser extension. Such things can help preventing to go to phishing sites. As long as you don't put in the password per hand.

Did you do somewhere?

If a hacker gets a number of passwords then he really might be hacking bitcoinrelated. Maybe searching for wallets on VPS or something. Passwords he would most probably put in his password database though the forum has a 5 minute ban for logins into the same account. He could try it out on bitcointalk though he would have to know your username. Did you somewhere use the same username so that he could have checked if such a user exists on BCT?

It would have taken a bit but he would have been able to login.

Exactly... why telling me to send the coins to the address ralobot sent me? I mean ralobot wrote that he received his coins. That would mean the hacker would only have been interested in the PM. Then his scam was over after he received it. Sending this pm would only stir shit, like it happened when you got involved.

So seriously, this makes only sense when ralobot would be the hacker since he would then have both. His pm and his coins. And surely he never sent pm which is why he can't give a screenshot.

I don't know about the github script. Surely they will host all kind of code stuff and not controlling it.

You mentioned somewhere that you had to relogin into BCT every time visiting a link. Did you login manually or autofill? It might have been a phising link. Surely the hacker would have changed the link by now or deleted the pm.

If you changed the pass afterwards then I wonder how he should be notified. No email is sent out when sending pass. And when he was logged in on another pc at that time then he would be logged out after the change.

Otherwise, I'm not sure, it might be that the session of bitcointalk failed when the hacker logged in. He did not set to stay logged in and so your account was logged out after some time. Then you would have to relogin even though you do it with staying logged in enabled.

I don't know about skype but I think I heard about risks of skype besides privacy issues.

You should stop blaming the forum because it makes no sense that it is the forums fault. You are a small new user. Don't you think a hacker would hack another account on here then? There are users with huge piles of cash, unfortunately Iam not one of them even as escrow , and you surely would not have been the target.

Did you have set up recover account by hidden question?


Quickseller


Thanks for your opinion!

Yes, I think it is unlikely that he can't even spend the 2 minutes to make a screenshot and post it but instead posting on here for hours, telling stories of he being the hacker, trying to get money for the trick and then back out as being not the hacker anymore. Makes no sense.

It makes even less sense that, when the hacker received his PM, he would send a pm to me so that I pay ralobot. I mean it would be useless for the hacker. In fact dangerous. Drawing attention on the case.

The hacker would only do this when he would gain something from it.

In my opinion that shows pretty well that ralobot was the scammer. He has coins and pm now and he surely didn't bother sending the PM fiat out. That's the only reason he can't provide the screenshot.

[Emerge]

IIRC this sort of thing happened to me a long time ago when I asked for a loan..
Hacker sent message with a new address. Good thing the lender quoted the message and I asked him not to send the BTC.

Close call.
Sad this happened to you :/