WARNING - Sr-Accounts hijacked by Theymos impersonator - How to get them back ?

[louvois]

Edit : no doubt possible at that point : my "locked" account recently became active and is currently being used to promote UBEX ICO  https://bitcointalk.org/index.php?action=profile;u=307514

The individual who got into possession of my account has now changed my avatar and deleted most of my informations. Be assured that this is definitely a hacking attempt and DO NOT answer the "acctcomp15@theymos.e4ward.com" , this is a trap.


To everyone having the same problem ( fake "locked by theymos" signatures )
Please keep this topic active so the mods will notice it and hopefully take some action.

I am currently trying to contact Bitcointalk admins as well as UBEX staff so hopefully I can track down whoever is using my account and eventually get it back, as I have all the infos needed to prove ownership.

[original message ]

Hi there, it seems that my account has been locked by an admin last week.

I run a fairly large Bitcoin Luxury marketplace https://delouvois.com so I'm pretty worried that might be a scam, since the address I've been given sounds like what a scammer could use to impersonate Theymos .

I deleted my actual bitcoin wallet address from my signature years ago for security reasons ( I could sign it, admitting it's still somewhere in the logs ) .

If it's not in the logs, the only way I can guarantee my ownership of this account is by writing a message through my Bitcoin Luxury Marketplace ( which is linked publicly to my Bitcointalk account under my avatar ) so I just did that.  

https://delouvois.com/californiaquail-account-verification-bitcointalk-org


I'm pretty worried, god knows who the hell they might scam out here with this account.

"acctcomp15@theymos.e4ward.com"


I have not posted since March 2018.

https://bitcointalk.org/index.php?action=profile;u=307514

Has this ever happened to anyone ? What's the point of this ?




Thanks for your understanding and have a nice day,

[1714171215]

1714171215

[LoyceMobile]

That email address looks legit, its like this to prevent spam.

[louvois]

Then I have no idea how to unlock my account.

This is terrible.

[Vod]

Then I have no idea how to unlock my account.

This is terrible.

Post the account name - mods may be able to tell you what went wrong and how to fix it.

[Flying Hellfish]

https://bitcointalk.org/index.php?topic=497545.0

Hilarious might be able to take care of this request if you can sign a message, it verifies and he sees it.

Good luck.

[Thirdspace]

Hi there, it seems that my account has been locked by an admin last week.
---snip---
Has this ever happened to anyone ? What's the point of this ?

locked? happened to many accounts that were inactive since dbhack in 2015
point? to secure the account from hacker who manages to brute force the password
but as I said in your other thread, signature changed to show account being locked is new (afaik)

btw, please keep only one open thread for the same topic for better response
it is more appropriate in this subforum, so I suggest you to lock the other thread

[digaran]

Sold account, email was changed recently. good job theymos for tackling these issues. would this be good if admin could disable the signature for any account with email change? this could prevent garbage posters from buying accounts just to take part in campaigns.

[hilariousandco]

The account isn't locked or banned (unless someone just unlocked it). Not sure who put that message in the signature either so if it wasn't you it's probably been compromised in some capacity.

[louvois]

The account isn't locked or banned (unless someone just unlocked it). Not sure who put that message in the signature either so if it wasn't you it's probably been compromised in some capacity.

Thanks everyone for the help. I locked the other topic.  

I googled that Theymos address and it looks like I'm not the only one who have had this issue in the last few months :



If it's some kind of ransom-scheme, the individual behind it does not seem to care about the ransom, no one have recieved any answer from this email (as far as I searched) even months after.

-

I deleted my actual bitcoin wallet address from my signature years ago for security reasons ( I could sign it, admitting it's still somewhere in the logs ) .

-

If it's not in the logs, the only way I can guarantee my ownership of this account is by writing a message through my Bitcoin Luxury Marketplace ( which is linked publicly to my Bitcointalk account under my avatar ) so I just did that.  


https://delouvois.com/californiaquail-account-verification-bitcointalk-org


Also, feel free to check the IP logs and verify that the recurrent IP addresses from both account ( main and current ) does actually matches.


I hope this will be helpful, I’m really looking forward to getting this account back but so far, no one has responded me.



  If anyone has any idea, I'm ready to try it  

Thanks again and have an nice day

[louvois]

I understand that Bitcointalk is a free service, and that I'm not entitled to any type of claim, but please god I'd really appreciate some kind of guidance here.


Thanks.

[Flying Hellfish]

I understand that Bitcointalk is a free service, and that I'm not entitled to any type of claim, but please god I'd really appreciate some kind of guidance here.


Thanks.

What exactly seems to be the problem?  Hilarious up thread says the account is not locked, are you saying you don't have access to the account anymore?

If you need to recover the account the link was left for you already on how to do this.  Unfortunately recovering accounts even with signed staked messages seems to take a long time or never happen.  Recovery without a signed staked address I have not seen, although I guess technically possible.

[pugman]

Usually when accounts are compromised, users are supposed to give a bitcoin signed message or PGP signed message that they had previously staked on this forum. So unless you provide enough proof, theymos or anybody won't be able to help you out here. Also do know that, even when users provide fully legitimate proof, their account remains to be compromised.

[flag49]

Hello!

I registered this account just to be able to write here about my real account
https://bitcointalk.org/index.php?action=profile;u=155876

I am banned from posting or sending PM and this message appears on my page

"Sorry flag39, you are banned from posting or sending personal messages on this forum.
You have been banned by a forum moderator. You may appeal here: banappeals-w6pquw43@theymos.e4ward.com "

This email to appeal I suppose is there just as a formality because they never reply.

So anyone can tell me whats going on

[louvois]

No doubt possible at that point : my "locked" account recently became active and is currently being used to promote UBEX ICO.  https://bitcointalk.org/index.php?action=profile;u=307514

The individual who got into possession of my account has now changed my avatar and deleted most of my informations. Be assured that this is definitely a hacking attempt and DO NOT answer the "acctcomp15@theymos.e4ward.com" , this is a trap.


To everyone having the same problem ( fake "locked by theymos" signatures )
Please keep this topic active so the mods will notice it and hopefully take some action.

I am currently trying to contact Bitcointalk admins as well as UBEX staff so hopefully I can track down whoever is using my account and eventually get it back, as I have all the infos needed to prove ownership.


To any moderators who sees this : for the love of god, please take some action, my whole business depends on getting this account back.

Thanks in advance

[roosbit]

No doubt possible at that point : my "locked" account recently became active and is currently being used to promote UBEX ICO.  https://bitcointalk.org/index.php?action=profile;u=307514

Second time of posting, the ubex ico\bounty have concluded and account has remained inactive

The individual who got into possession of my account has now changed my avatar and deleted most of my informations. Be assured that this is definitely a hacking attempt and DO NOT answer the "acctcomp15@theymos.e4ward.com" , this is a trap.

if your avatar and info has been altered then definitely your account is compromised, but then again how is it that you are still getting emails/notifications from your account??? And AFAIK based on what others have reported based on similar situations the theymos message shows up after you login.....so do you mean to say you can still login into your account

To everyone having the same problem ( fake "locked by theymos" signatures )
Please keep this topic active so the mods will notice it and hopefully take some action.

I am currently trying to contact Bitcointalk admins as well as UBEX staff so hopefully I can track down whoever is using my account and eventually get it back, as I have all the infos needed to prove ownership

Thanks in advance

If you have the information needed to show proof of ownership to your account, follow the instructions outlined on this thread >>>https://bitcointalk.org/index.php?topic=497545.0  to get back your account

[louvois]

I can't log into my original account.

The Theymos "locked" message appeared in my signature, but obviously it was a fake, since the account info and avatar has been altered. ( which was not the case when I first posted this thread ).

Frankly at this point, I have no idea what to do, and I highly doubt that Theymos or Cyrus would give a flying f* about this issue.

[eddie13]

Frankly at this point, I have no idea what to do

Send negative trust to your old account "This was my account and it was hacked (date)"
See what you can do to get some DT to leave a negative on the hacked account, figure out what evidence you can muster and what evidence they will accept to place a negative.
Continue with your new account and start over. Start your company related OPs over again, warn in your old ones, and maybe you can get a mod to lock them.

I wouldn't hold out hope for recovering your old account. I'll give you a merit to help get you started fresh.
Take more proactive measures to not get hacked again. Stake a f'n address.

[ibminer]

According to the BPIP profile page for the account in question, the account was autobanned, at least several months ago, and hasn't been "active" since July. Although I'm not sure exactly when the autoban happened, I don't foresee it doing much scamming. (edit: was banned for copy/paste plagiarism)

Also, OP claims there was an address under his signature which was deleted "years ago" which he could sign a message from. In 2014, 2015, 2016, it appears to have only been "have a nice day!" in the signature (reference), sometime in 2016/17 it changed to an address - the same time it became branded with this "Luxury" marketplace that this person is now hoping to use to recover the account... I don't think this account is going to be recovered anytime soon.

[louvois]

I wouldn't hold out hope for recovering your old account. I'll give you a merit to help get you started fresh.
Take more proactive measures to not get hacked again. Stake a f'n address.

I know, I should have,  frankly I had no knowledge of that address staking topic before that... Thanks though, it warms my heart. but I just can't let it go, I knew I should have changed my password after Bitcointalk database hack, but I did not. And that's my cross to bear  

Thanks again  

Also, OP claims there was an address under his signature which was deleted "years ago" which he could sign a message from. In 2014, 2015, 2016, it appears to have only been "have a nice day!" in the signature (reference), sometime in 2016/17 it changed to an address - the same time it became branded with this "Luxury" marketplace that this person is now hoping to use to recover the account... I don't think this account is going to be recovered anytime soon.

I'm not even sure that there was my btc address under my signature, more likely under "Bitcoin Address" on my profile, it stayed there for a while, but then I assumed that it would make me a target for hackers, so I changed it to a bogus address, and of course, that's the only screenshot Web.Archive has >> http://web.archive.org/web/20171126205221/https://bitcointalk.org/index.php?action=profile;u=307514 ... I want to shoot myself in the foot right now.

Although there might have been an address under my signature at some point, I have never thought of using wayback machine to prove my claims, maybe if there was an address under my signature at some point I could find using wayback machine, thanks a lot for the idea, I'll try and wayback each and every message I ever wrote, even if there is a slightest chance that I could prove my claim.



Bottom line is, I won't let that go, even if it's the last thing I do, that old 2014 account has way too much sentimental value to let it go, I'll do whatever it takes.


Hey, I even contacted the UBEX ICO's team so I could track down and email whoever is using my account now and buy it back from him, turns out he never claimed his tokens so they don't have his email address in their XLS payout file. Another f*n dead-end.

I have also conducted business through my marketplace with an old timer member ( https://bitcointalk.org/index.php?action=profile;u=162183  ) who could assess my story and also has my bitcoin address but everything went through gmail, so that's another dead-end I guess.


Wish me luck I guess ... Any other ideas/inputs would be greatly appreciated.

[californiaquail]

Well, they eventually came through and helped me get my account back.

Thanks again to the Bitcointalk recovery account team.

 So f* thankful for that    Please let me know if you have a physical address so I can send you a cake or something.



Cheers...