Bitcoin Forum
July 18, 2019, 07:52:59 AM *
News: Latest Bitcoin Core release: 0.18.0 [Torrent] (New!)
 
   Home   Help Search Login Register More  
Pages: [1] 2 3 4 5 6 7 8 »  All
  Print  
Author Topic: VIP Member hacked?  (Read 2419 times)
hilariousetc
Legendary
*
Online Online

Activity: 1288
Merit: 2148


Pro board spammer


View Profile
November 18, 2018, 12:48:25 PM
Merited by Foxpup (2)
 #1

Just saw this user posting in the Cloudbet's Super 6 Soccer Predictor Competition:

https://bitcointalk.org/index.php?action=profile;u=18021     JusticeForYou June 04, 2011

He stood out because he's a VIP and I've never seen him before, and then noticed his details had been reset recently:

This user's password was reset recently.

This user recently woke up from a long period of inactivity.


This isn't the first time he's woken from a long period of inactivity either. He disappeared on May 26, 2015 to reappear on August 13, 2017.

On the 15th he then asked for a silly loan:

Well lets get straight to business.

I want to borrow Bitcoin.

Full Disclosure: I have no intention of paying them back, so I'll skip the sad story and great business plan.

I just figured every other method was used to get people to loan coins, why not just an honest one.

If you're interested deposit coins here vvv


Thank You for your time.


Best Regards,



Then nothing until November 07, 2018 where he posted in the Cloudbet giveaway thread.

1563436379
Hero Member
*
Offline Offline

Posts: 1563436379

View Profile Personal Message (Offline)

Ignore
1563436379
Reply with quote  #2

1563436379
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1563436379
Hero Member
*
Offline Offline

Posts: 1563436379

View Profile Personal Message (Offline)

Ignore
1563436379
Reply with quote  #2

1563436379
Report to moderator
coinlocket$
Hero Member
*****
Offline Offline

Activity: 616
Merit: 1050


One of the world's leading Bitcoin-powered casinos


View Profile WWW
November 18, 2018, 01:44:59 PM
Last edit: November 18, 2018, 06:01:05 PM by coinlocket$
 #2

We have not so much to work with.
Looking at post history he is/was rich (?) and used some addresses

2011 address

Code:
1tabCzGVPEK6kCJpQhFKwpXcsdnhTXyY4
https://bitcointalk.org/index.php?topic=53888.msg655867#msg655867
https://web.archive.org/web/20181118133953/https://bitcointalk.org/index.php?topic=53888.msg655867
Last transaction: 2015
https://www.walletexplorer.com/wallet/1ce41055bde615a6?from_address=1tabCzGVPEK6kCJpQhFKwpXcsdnhTXyY4
2012 address

Code:
1G12XfoPSLYiCdCH49qtN6NHMmHPQwPUta
https://bitcointalk.org/index.php?topic=76661.msg851287#msg851287
https://web.archive.org/web/20181118133957/https://bitcointalk.org/index.php?topic=76661.msg851287
Last transaction: 2014
https://www.walletexplorer.com/wallet/2e072bdb2773aaf3?from_address=1G12XfoPSLYiCdCH49qtN6NHMmHPQwPUta

2012 address
https://bitcointalk.org/index.php?topic=79099.msg881225#msg881225
Code:
14TmNWeLZNurQtmxAi62DH8RHn2pQPH2yc
https://web.archive.org/web/20181118175755/https://bitcointalk.org/index.php?topic=79099.msg881225
Last transaction: 2011
https://www.walletexplorer.com/wallet/ec65b769cf53b894?from_address=14TmNWeLZNurQtmxAi62DH8RHn2pQPH2yc



He owns these wallets
https://www.walletexplorer.com/wallet/1ce41055bde615a6/addresses
https://www.walletexplorer.com/wallet/2e072bdb2773aaf3/addresses

Code:
1tabCzGVPEK6kCJpQhFKwpXcsdnhTXyY4
13AV2U35JxfNBiw7tTjBUsbAtZZt32bBYH
1ABSKEnh51VSafuwEuNue9asc7X4TnU9iB
1PLGrwniHFUyXrhyQAswGJDQuKKx7D2VYF
1G12XfoPSLYiCdCH49qtN6NHMmHPQwPUta
1idL6feqziEfNvz5nZuotNeQqz39w4LN9
144c5cAfagPEURS5UT8d8oZvZuwdoKSQMw

A signed message from one of those address will prove the ownership.


SFR10
Legendary
*
Offline Offline

Activity: 1386
Merit: 1197



View Profile WWW
November 18, 2018, 05:43:24 PM
 #3

This isn't the first time he's woken from a long period of inactivity either. He disappeared on May 26, 2015 to reappear on August 13, 2017.
But recent password resets, points to a different case (I checked the relevant archived pages of "security log" but didn't find any password resets on previous period):

Quote
  • November 06, 2018, 07:23:19 PM - JusticeForYou - password reset via email
  • November 06, 2018, 07:05:09 PM - JusticeForYou - password changed
  • November 06, 2018, 03:55:44 PM - JusticeForYou - woke up
  • November 06, 2018, 03:55:34 PM - JusticeForYou - password reset via email

This is the correct address:

Code:
1G12XfoPSLYiCdCH49qtN6NHMmHPQwPUta

2012 address 100+btc transaction Huh
https://bitcointalk.org/index.php?topic=76661.msg851312#msg851312
Code:
14TmNWeLZNurQtmxAi62DH8RHn2pQPH2yc
You've linked another address. Correct one is:

Quote

Looking at post history he is/was rich (?)

~Snipped~

2012 address 100+btc transaction Huh
https://bitcointalk.org/index.php?topic=76661.msg851312#msg851312
Back then, it was just 504.98 USD.

Theb
Sr. Member
****
Offline Offline

Activity: 994
Merit: 401



View Profile
November 18, 2018, 05:48:00 PM
 #4

This account is possibly hacked, a big chunk of his activity was from 2011 to 2015 and just by seeing his post history it is the first time he posted something related to Football, and most of his post before then are more sensible compared to him "borrowing" BTC without paying back. I'm pretty sure that he can already be tagged by a DT member for asking a loan back in 2017 and admitting that he won't pay it back.

FORTUNEJACK
      ▄▄███████▄▄
   ▄████▀▀ ▄ ██████▄
  ████ ▄▄███ ████████
 █████▌▐███▌ ▀▄ ▀█████
███████▄██▀▀▀▀▄████████
█████▀▄▄▄▄█████████████
████▄▄▄▄ █████████████
 ██████▌ ███▀████████
  ███████▄▀▄████████
   ▀█████▀▀███████▀
      ▀▀██████▀▀
         
         █
...FortuneJack.com                                             
...THE BIGGEST BITCOIN GAMBLING SITE
       ▄▄█████████▄▄
    ▄█████████████████▄
  ▄█████████████████████▄
 ▄██
█████████▀███████████▄
██████████▀   ▀██████████
█████████▀       ▀█████████
████████           ████████
████████▄   ▄ ▄   ▄████████
██████████▀   ▀██████████
 ▀██
█████████████████████▀
  ▀██
███████████████████▀
    ▀█████████████████▀
       ▀▀█████████▀▀
#JACKMATE
WIN 1 BTC
▄█████████████████████████▄
███████████████████████████
███████████████████████████
██████████▀█████▀██████████
███████▀░░▀░░░░░▀░░▀███████
██████▌░░░░░░░░░░░░░▐██████
██████░░░░██░░░██░░░░██████
█████▌░░░░▀▀░░░▀▀░░░░▐█████
██████▄░░▄▄▄░░░▄▄▄░░▄██████
████████▄▄███████▄▄████████
███████████████████████████
███████████████████████████
▀█████████████████████████▀
coinlocket$
Hero Member
*****
Offline Offline

Activity: 616
Merit: 1050


One of the world's leading Bitcoin-powered casinos


View Profile WWW
November 18, 2018, 05:57:24 PM
 #5

~

Fixed, the spreadsheet used was messed up.
I agree with @theb looking the activity the account seems hacked now. The user's recent activity is very different back then in 2011, we can only ask for a signed message.

Veleor
Hero Member
*****
Offline Offline

Activity: 658
Merit: 812



View Profile
November 18, 2018, 06:01:01 PM
 #6

https://bitcointalk.org/index.php?action=profile;u=18021     JusticeForYou June 04, 2011

He stood out because he's a VIP and I've never seen him before, and then noticed his details had been reset recently

Perhaps you don't remember him because he has changed his nickname. His previous name was BTC_Bear.



Archive: http://web.archive.org/web/20171126120414/https://bitcointalk.org/index.php?action=profile;u=18021

LoyceV
Legendary
*
Online Online

Activity: 1554
Merit: 4302


Self-made Legendary outside Meta!


View Profile WWW
November 18, 2018, 06:08:09 PM
Merited by Foxpup (2)
 #7

Perhaps you don't remember him because he has changed his nickname. His previous name was BTC_Bear.
The name change was very recent. Around 2 weeks ago, Piggy scraped this data:
Code:
18021        BTC_Bear        0: -0 / +0      250     828     392     VIP     2011-06-04T06:07:49     2017-08-15T20:32:13                                     hidden  The ∑ Number Game 1ApJdWUdSWYw8n8HEATYhHXA9EYoRTy7c4              N/A             2018-11-03T15:18:28.056747

Findingnemo
Member
**
Offline Offline

Activity: 602
Merit: 64

Keep it simple,stupid!


View Profile
November 19, 2018, 06:54:46 AM
Last edit: November 19, 2018, 07:49:19 AM by Findingnemo
 #8

A VIP member is now trying to participate in a free games to make some bucks which not enough to identify that the account was hacked?

Hope he will be negged by DT member soon or he may scam the other forum people using the reputation of that account.

marlboroza
Legendary
*
Offline Offline

Activity: 1260
Merit: 1494


View Profile
November 19, 2018, 08:41:16 PM
 #9

A VIP member is now trying to participate in a free games to make some bucks which not enough to identify that the account was hacked?
Or they woke up after long time and changed password and email as they are not using forum on daily/monthly/yearly base. Or maybe cloudbet sent them PM to join contest, they've received notification in email and went to games and rounds. Or they sold account. Or account was hacked. Or they have alt account(s) and they know about contest. Or...or...or..


Anyway, they started this thread Server Compromised? after almost 1 year of inactivity:

Quote
Just received this:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

You are receiving this message because your email address is associated
with an account on bitcointalk.org. I regret to have to inform you that
some information about your account was obtained by an attacker who
successfully compromised the bitcointalk.org server. The following
information about your account was likely leaked [...]

Is there any way to check if password was changed between forum hack (May, 22. 2015.) and that email (May, 25. 2015.)? That could be good indicator.

S_Therapist
Sr. Member
****
Offline Offline

Activity: 280
Merit: 271



View Profile
November 20, 2018, 07:25:06 AM
 #10

Is there any way to check if password was changed between forum hack (May, 22. 2015.) and that email (May, 25. 2015.)? That could be good indicator.
I have tried to find out but seems there is no way to find users total password change/reset history. You may contact with @yogg since he was also searching for such kind of data last year.
Is there any way to check the seclog archives for between 2015 and 2017 ? Yeah, I know it's 24 months and it keeps only the last 30 days...  Grin

Edit- I also checked same as SFR10, got some archived page but didn't find any log for this user.

           ▀██▄ ▄██▀
            ▐█████▌
           ▄███▀███▄
         ▄████▄  ▀███▄
       ▄███▀ ▀██▄  ▀███▄
     ▄███▀  ▄█████▄  ▀███▄
   ▄███▀  ▄███▀ ▀███▄  ▀███▄
  ███▀  ▄████▌   ▐████▄  ▀███
 ███   ██▀  ██▄ ▄██  ▀██   ███
███   ███  ███   ███  ███   ███
███   ███   ███████   ███   ███
 ███   ███▄▄       ▄▄███   ███
  ███▄   ▀▀█████████▀▀   ▄███
   ▀████▄▄           ▄▄████▀
      ▀▀███████████████▀▀
DeepOnion
Anonymous and Untraceable
ANN  Whitepaper  Facebook  Twitter  Telegram  Discord 





      ▄▄██████████▄▄
    ▄███▀▀      ▀▀█▀   ▄▄
   ███▀              ▄███
  ███              ▄███▀   ▄▄
 ███▌  ▄▄▄▄      ▄███▀   ▄███
▐███  ██████   ▄███▀   ▄███▀
███▌ ███  ███▄███▀   ▄███▀
███▌ ███   ████▀   ▄███▀
███▌  ███   █▀   ▄███▀  ███
▐███   ███     ▄███▀   ███
 ███▌   ███  ▄███▀     ███
  ███    ██████▀      ███
   ███▄             ▄███
    ▀███▄▄       ▄▄███▀
      ▀▀███████████▀▀
.
actmyname
Copper Member
Legendary
*
Offline Offline

Activity: 1456
Merit: 1647


59p/hr | 650c/m | -1xrp/s


View Profile WWW
January 31, 2019, 02:29:54 PM
Last edit: January 31, 2019, 02:41:49 PM by actmyname
 #11

1LG9NweYZkmfaKW6XyLcB3uLhqR73WMCmv via The ∑ Number Game (archive)
and
1MsXYJikZmCaPgzTHGAMmjLbP9D7QRJ8E5
1Eh3JfsScTThANXZByTjno8PSJrHEtmB6j from the winner's transaction: tx (being from MtGox)

1Gdc8pDDemYFr5zTRs4bwNsVurF8dSxZHw from Christmas Auction IRC and address history
Gonna need a signed message.



WalletExplorer yields these results:

Code:
1LG9NweYZkmfaKW6XyLcB3uLhqR73WMCmv
1L6C4K8b7uvZbGXkSCPBuy12RBecpzuSZL
1DNoXfrzYKiyY6p6xDByRBKLmg1UnCu4jz
1JBMWNtWkyo1MFHMf7BFPyF5GuAaC5td3h
18BDV9v7hpqaeDLVKNDVvo8VSkmcqnFuvh
1Gdc8pDDemYFr5zTRs4bwNsVurF8dSxZHw
1HiMEgHQkppmW3gUfr1pudBUzp8pAmYXY8
1PLmuBCFiiWX2DjvcTvxssFs6Yyv5N1hDZ
1D8dqFQgT2zZdjEmLwRY3giCMK63DuQp2G

Or perhaps a signed message from the key used here: https://bitcointalk.org/index.php?topic=83059.msg5288700#msg5288700 (archive)
Or this one, if it's different. https://bitcointalk.org/index.php?topic=61080.msg717433#msg717433 (archive)


TMAN
Legendary
*
Offline Offline

Activity: 1204
Merit: 1537

www.gunbot.uk/tman/ - LEGENDARY SELF MADE BITCHES


View Profile
January 31, 2019, 02:51:17 PM
 #12

https://bitcointalk.org/index.php?topic=5099391.msg49396732#msg49396732

the user dodged the question when it was bought up before...

anyone want a bet its a compromised account?

.FORTUNE.JACK.
      ▄▄███████▄▄
   ▄████▀▀ ▄ ██████▄
  ████ ▄▄███ ████████
 █████▌▐███▌ ▀▄ ▀█████
███████▄██▀▀▀▀▄████████
█████▀▄▄▄▄█████████████
████▄▄▄▄ █████████████
 ██████▌ ███▀████████
  ███████▄▀▄████████
   ▀█████▀▀███████▀
      ▀▀██████▀▀
         
         █
...FortuneJack.com                                             
...THE BIGGEST BITCOIN GAMBLING SITE
       ▄▄█████████▄▄
    ▄█████████████████▄
  ▄█████████████████████▄
 ▄██
█████████▀███████████▄
██████████▀   ▀██████████
█████████▀       ▀█████████
████████           ████████
████████▄   ▄ ▄   ▄████████
██████████▀   ▀██████████
 ▀██
█████████████████████▀
  ▀██
███████████████████▀
    ▀█████████████████▀
       ▀▀█████████▀▀
#JACKMATE
WIN 1 BTC
▄█████████████████████████▄
███████████████████████████
███████████████████████████
██████████▀█████▀██████████
███████▀░░▀░░░░░▀░░▀███████
██████▌░░░░░░░░░░░░░▐██████
██████░░░░██░░░██░░░░██████
█████▌░░░░▀▀░░░▀▀░░░░▐█████
██████▄░░▄▄▄░░░▄▄▄░░▄██████
████████▄▄███████▄▄████████

███████████████████████████
███████████████████████████
▀█████████████████████████▀


The Avatar:
JusticeForYou
VIP
Sr. Member
*
Offline Offline

Activity: 490
Merit: 271


"Blockchain is the next big thing after Internet"


View Profile
January 31, 2019, 03:42:59 PM
 #13

~snip
I don't have access to this address now they are pretty old. I just have access to the email which I used from when I created this account.


5░░░░░░░▄▄▄▄▄▄
░░░░▄██████████▄
░░░██████████████
░░██████▐▌██████
█████░░░░░░░▀█████
██████▄▄░░▄▄░░██████
████████░░▀▀▄██████
████████░░▄▄▄░░█████
██████▀▀░░▀▀▀░░█████
█████░░░░░░░░█████
░░██████▐▌██████
░░░██████████████
░░░░▀██████████▀
░░░░░░░▀▀▀▀▀▀
░░░
░░░░░░░▄▄▄▄▄▄
░░░░▄██████████▄
░░░██████████████
░░██████▐▌██████
█████░░░░░░░▀█████
██████▄▄░░▄▄░░██████
████████░░▀▀▄██████
████████░░▄▄▄░░█████
██████▀▀░░▀▀▀░░█████
█████░░░░░░░░█████
░░██████▐▌██████
░░░██████████████
░░░░▀██████████▀
░░░░░░░▀▀▀▀▀▀
░░░
actmyname
Copper Member
Legendary
*
Offline Offline

Activity: 1456
Merit: 1647


59p/hr | 650c/m | -1xrp/s


View Profile WWW
January 31, 2019, 03:44:16 PM
 #14

~snip
I don't have access to this address now they are pretty old. I just have access to the email which I used from when I created this account.
How about the GPG key? This is 2014, before the leak.

qwk
Donator
Legendary
*
Offline Offline

Activity: 2198
Merit: 2130


Shitcoin Minimalist


View Profile
January 31, 2019, 05:02:54 PM
Merited by OgNasty (1)
 #15

anyone want a bet its a compromised account?
I suspect that it's not hacked, but that's just a gut feeling.
No bet. Wink

edit: theymos could possibly send an email to his last known email address.
The email I received returned:

Bad signature by Michael Marquardt <michael_m+pgp@mm.st>

All free men, wherever they may live, can use Bitcoin, and, therefore, as a free man, I take pride in the words "Ich bin ein Bitcoiner!"
JusticeForYou
VIP
Sr. Member
*
Offline Offline

Activity: 490
Merit: 271


"Blockchain is the next big thing after Internet"


View Profile
January 31, 2019, 05:05:02 PM
Last edit: January 31, 2019, 05:15:17 PM by JusticeForYou
 #16

How about the GPG key? This is 2014, before the leak.
As, I said I don't have access to the old keys because my old hard drive was crashed and I was not able to recover it.

Still, I have access to the original email and also many people here already know me.



edit: theymos could possibly send an email to his last known email address.
The email I received returned:

Bad signature by Michael Marquardt <michael_m+pgp@mm.st>
I would not be good with publishing my PMs publicly, but I can trust @qwk and send him a PM with a screen shot of my PMs from 2012 ( oldest once) which include my original email mentioned. And later he could confirm, what is my original email from much years.


5░░░░░░░▄▄▄▄▄▄
░░░░▄██████████▄
░░░██████████████
░░██████▐▌██████
█████░░░░░░░▀█████
██████▄▄░░▄▄░░██████
████████░░▀▀▄██████
████████░░▄▄▄░░█████
██████▀▀░░▀▀▀░░█████
█████░░░░░░░░█████
░░██████▐▌██████
░░░██████████████
░░░░▀██████████▀
░░░░░░░▀▀▀▀▀▀
░░░
░░░░░░░▄▄▄▄▄▄
░░░░▄██████████▄
░░░██████████████
░░██████▐▌██████
█████░░░░░░░▀█████
██████▄▄░░▄▄░░██████
████████░░▀▀▄██████
████████░░▄▄▄░░█████
██████▀▀░░▀▀▀░░█████
█████░░░░░░░░█████
░░██████▐▌██████
░░░██████████████
░░░░▀██████████▀
░░░░░░░▀▀▀▀▀▀
░░░
Hhampuz
Legendary
*
Offline Offline

Activity: 1106
Merit: 1668


Don't like me? Take a ticket, there's a long line.


View Profile
January 31, 2019, 05:20:25 PM
 #17

An email will hardly prove anything. Looking at your post history (Sure, it's been years), you look like a completely different person.

Now I won't judge too much, numerous things can happen which would change someones style of writing but in your case it is quite extreme.


Until address can be signed or other form of signing method I'll be in doubt. Could be wrong but that's just what it looks like (Especially since you instantly started voicing strong opinions after being inactive for years).

actmyname
Copper Member
Legendary
*
Offline Offline

Activity: 1456
Merit: 1647


59p/hr | 650c/m | -1xrp/s


View Profile WWW
January 31, 2019, 05:25:31 PM
 #18

As, I said I don't have access to the old keys because my old hard drive was crashed and I was not able to recover it.

Still, I have access to the original email and also many people here already know me.
Why did you change your name, exactly? And when did your hard drive crash?

JusticeForYou
VIP
Sr. Member
*
Offline Offline

Activity: 490
Merit: 271


"Blockchain is the next big thing after Internet"


View Profile
January 31, 2019, 05:42:21 PM
 #19

An email will hardly prove anything.
Yes, it proves much things about my identity, atleast to the people I know.

(Especially since you instantly started voicing strong opinions after being inactive for years).
Yes, I see this accusation because I am talking about some anti DT stuff, but that is what I read and felt right to support. Nothing personal just a way I could make the community more decentralized.



Why did you change your name, exactly?
Good question  Smiley

I did this as I thought it would be worth to become someone with better justice. It has pretty big meaning which I would explain, sometime in the future.

Quote from: actmyname link=topic=5071290.msg49519981#msg49519981
And when did your hard drive crash?
It was around Jan 2016 due to a electricity overload in my house.


5░░░░░░░▄▄▄▄▄▄
░░░░▄██████████▄
░░░██████████████
░░██████▐▌██████
█████░░░░░░░▀█████
██████▄▄░░▄▄░░██████
████████░░▀▀▄██████
████████░░▄▄▄░░█████
██████▀▀░░▀▀▀░░█████
█████░░░░░░░░█████
░░██████▐▌██████
░░░██████████████
░░░░▀██████████▀
░░░░░░░▀▀▀▀▀▀
░░░
░░░░░░░▄▄▄▄▄▄
░░░░▄██████████▄
░░░██████████████
░░██████▐▌██████
█████░░░░░░░▀█████
██████▄▄░░▄▄░░██████
████████░░▀▀▄██████
████████░░▄▄▄░░█████
██████▀▀░░▀▀▀░░█████
█████░░░░░░░░█████
░░██████▐▌██████
░░░██████████████
░░░░▀██████████▀
░░░░░░░▀▀▀▀▀▀
░░░
The Pharmacist
Legendary
*
Offline Offline

Activity: 1582
Merit: 3006



View Profile
January 31, 2019, 06:14:53 PM
Merited by Foxpup (3)
 #20

The post quality has changed since 2011, at least to my eyes.  Not that his English was perfect back then, but it seems to have been much better than what he's been writing lately. 

It's also a bit weird that an old-timer would suddenly inject himself into the middle of all of this forum drama after all this time, especially given those periods of inactivity.  Being inactive sort of makes me think he wouldn't care so much about the DT issues and whatnot...and then suddenly he appears.

I never noticed this thread, apparently--or I didn't pay attention to it when it was created.  Now I'm really curious as to whether it's the original owner posting.  Not sure how he can prove it if he can't sign a message.  PMs and e-mail are kind of iffy forms of proof, but I'll keep my eye on this thread.

Pages: [1] 2 3 4 5 6 7 8 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!