Escrow Partner got tricked

[SebastianJu]

IIRC this sort of thing happened to me a long time ago when I asked for a loan..
Hacker sent message with a new address. Good thing the lender quoted the message and I asked him not to send the BTC.

Close call.
Sad this happened to you :/

Even though it was different with you it might be an idea to simply ask the seller if I either really should send to the address the seller sent, so that it is correct and quote the message. And quote the message from the buyer to release the coins.

Though there would still be the risk that the hacker reads the pm first, answers and deletes the pm.

[1714983903]

1714983903

[1714983903]

1714983903

[1714983903]

1714983903

[markj113]

Seems Ralobot.com is a scammer using fake links to the forum to harvest usernames and passwords :

https://bitcointalk.org/index.php?topic=1389494.0

[xetsr]

Seems Ralobot.com is a scammer using fake links to the forum to harvest usernames and passwords :

https://bitcointalk.org/index.php?topic=1389494.0

Knew it, amartin99 didn't want to listen but there you have it.

Someone needs to look more into how phishing sites work or expect their info to get stolen again and again.

Domain was registered back in January. Could have gone unnoticed for awhile because the phisher never changes password, deletes PMs and a few other things.

[SebastianJu]

Well, so all his non matching stories had a reason.

Amartin99, at least your password manager should have warned about it. No autofill of passwords would happen on the phising site.

[beel]

martin

i am sorry to hear that you lost some usd
 i have traded with martin for 150 usd btc for skrill
and he is legit


how come your account was compromised and the timming was perfect


i ask the forum guys is there something we all should be worried about

because i see this as a new method

and indeed its very dangerous of all method scammers use 

[amartin99]

Well, so all his non matching stories had a reason.

Amartin99, at least your password manager should have warned about it. No autofill of passwords would happen on the phising site.

honestly my mind was on the accusation that I was a scammer
I looked back and forth several times trying o make sense of it since I didn't know the user and the link was to another users feedback not mine
I did suspect the link was a fishing site and changed my pass (then stopped visiting it)
then the hole thread vanished and I figured the staff agreed with me
didn't give it more thought till making that last reply trying to think of any possible breach in my own security
but I did change my pass that day and this all happened several days later

with this loss and another $40 to another guy
and payza not getting around to send the $140 they owe me to BTC as requested
im a bit set back in my plans here
I have more $ but I think it is better used securing my RDP business which is bringing me a consent profit
ill invest more here again when im back stable
I still plan to get into currency trading big time
but it will take longer then id planned

[Mickeyb]

i ask the forum guys is there something we all should be worried about

Not at all. Don't stupidly click any link that any random stranger sends you and you are going to be alright

[amartin99]

I changed my pass after clicking that link

[amartin99]

wish that thread was still around so I could take another look at it
but as I recall the thread was on http://bitcointalk.org
and his link was on https://bitcointalk.org

at the time I thought I was being perinoid suspecting it was a fishing site cause the main domain was the same as the forum
I don't fully understand how these little changes in domain names work
http://bitcointalk.org
http://www.bitcointalk.org
https://www.bitcointalk.org
they should all be the same place but im not 100% sure
and that was the only dif I saw in his URL
I accused it of being a fishing site only cause I had to keep logging in

now im wondering about some other things I used to tinker with a few year back
dono if they can still be done
but there used to be a way to set a webpage coding so it would alter the URL being displayed in your address box
changing the real address of a link in the forum is easy if the forum is not set to prevent that

in the end the only reason I had to suspect the link was to a fishing site was the fact that I had to login
but that was enough for me to decide to change my pass just encase
I should have been safe

[SebastianJu]

wish that thread was still around so I could take another look at it
but as I recall the thread was on http://bitcointalk.org
and his link was on https://bitcointalk.org

at the time I thought I was being perinoid suspecting it was a fishing site cause the main domain was the same as the forum
I don't fully understand how these little changes in domain names work
http://bitcointalk.org
http://www.bitcointalk.org
https://www.bitcointalk.org
they should all be the same place but im not 100% sure
and that was the only dif I saw in his URL
I accused it of being a fishing site only cause I had to keep logging in

now im wondering about some other things I used to tinker with a few year back
dono if they can still be done
but there used to be a way to set a webpage coding so it would alter the URL being displayed in your address box
changing the real address of a link in the forum is easy if the forum is not set to prevent that

in the end the only reason I had to suspect the link was to a fishing site was the fact that I had to login
but that was enough for me to decide to change my pass just encase
I should have been safe

The url's you posted actually ARE the same. They all lead to this forum here.

You should have been cautious for having to login again. You should have been even more cautious when your firefox password was not autofilled. It surely wasn't and you had to manually login.

It was harder to see that the L in bitcointalk was replaced with an I. The little L looks very similar. And still it is a completely different URL and domain.

So the http is not a real problem. That the domain name was different, that was the problem. That domain had nothing to do with this forum except that it copied the contents from here and caught your password.

Though I surely don't know how he still could access it after you changed pass. Does your password change show up here: https://bitcointalk.org/seclog.php

Maybe you forgot to change or changed it to the old ony by mistake.

Theymos might put that domain name in autocorrect so that it automatically gets corrected.

[amartin99]

well it shows me changing my pass on February 27
must have been the day that thread was made

im pretty careful when changing passwords but anything is possible
he got in my account somehow

[amartin99]

if you had access to my computer then why bother with a trick/trade at all ?
why not just use the access to send yourself my money and avoid getting your account wrecked here ?

don't think I have seen an account so far into the red before hehehe

[amartin99]

Ralobot.com is persistently PMing me trying to convince me he has access to my home PC
but everything he shows me is outdated info likely gathered from a fishing site (faking this forum)

[justspare]

this is a vary strange situation

I was chatting with "SebastianJu"  https://bitcointalk.org/index.php?action=profile;u=18640
and  "Ralobot.com"  https://bitcointalk.org/index.php?action=profile;u=561660
over a traid

I sent "SebastianJu" 0.64329373 BTC https://blockchain.info/tx/5c8e38c069f06f69fefa68331c7eb0e2d6537cd1cb914aa839ced40843d1d6d5
worth $270 now
"Ralobot.com" was to send me $279.93 in PM or skrill
he has sent me nothing
but I got an email http://prntscr.com/ab344z
saying that "SebastianJu" sent me a PM saying he has received one from me telling him to release the BTC
I never sent "SebastianJu" any such PM
and I can't find this PM from him in my account
 I don't see my last PM to "SebastianJu" in my history either

but I see his BTC account is now empty
https://blockchain.info/address/1MUpPFyAbgs66Xjh4qd7SZ2LTdmS1YMFsS

I have not heard from either of them on this
feel I just got scammed out of $270

Maybe you are the one to blame for this issue. You might have been talking to a fake and then sent the Bitcoin to a fake address. You never know.

[amartin99]

this is a vary strange situation

I was chatting with "SebastianJu"  https://bitcointalk.org/index.php?action=profile;u=18640
and  "Ralobot.com"  https://bitcointalk.org/index.php?action=profile;u=561660
over a traid

I sent "SebastianJu" 0.64329373 BTC https://blockchain.info/tx/5c8e38c069f06f69fefa68331c7eb0e2d6537cd1cb914aa839ced40843d1d6d5
worth $270 now
"Ralobot.com" was to send me $279.93 in PM or skrill
he has sent me nothing
but I got an email http://prntscr.com/ab344z
saying that "SebastianJu" sent me a PM saying he has received one from me telling him to release the BTC
I never sent "SebastianJu" any such PM
and I can't find this PM from him in my account
 I don't see my last PM to "SebastianJu" in my history either

but I see his BTC account is now empty
https://blockchain.info/address/1MUpPFyAbgs66Xjh4qd7SZ2LTdmS1YMFsS

I have not heard from either of them on this
feel I just got scammed out of $270

Maybe you are the one to blame for this issue. You might have been talking to a fake and then sent the Bitcoin to a fake address. You never know.

yea I know that didn't happen because "SebastianJu" is threw out this thread saying he did get the BTC and pass it on

[Mickeyb]

Ralobot.com is persistently PMing me trying to convince me he has access to my home PC

Thats when you know he's desperate for even a few more satoshi. He's lying

[amartin99]

Ralobot.com is persistently PMing me trying to convince me he has access to my home PC

Thats when you know he's desperate for even a few more satoshi. He's lying

yea I don't see anything missing