Is it Merit abuse?

[Master of Shitcoins]

I just came over two accounts which are using the same BTC addresses to apply for bounty campaigns and I have posted my research in known alts: https://bitcointalk.org/index.php?topic=2544574.msg49437820#msg49437820

Accounts: sham100899, hisori, fakegurutu


I digged a bit deeper and found a circle of sending Merits between them, involved another account, fakegurutu:

hisori received his Merit from fakegurutu, who sent also 3 Merit to sham100899 and received 5 Merit from sham100899.

BPIP fakegurutu  https://bpip.org/profile.aspx?p=fakegurutu
BPIP sham100899  https://bpip.org/profile.aspx?p=sham100899
BPIP hisori  https://bpip.org/profile.aspx?p=hisori

Merit history of fakegurutu:




fakegurutu and sham100899 both applied to join BitBlender signature campaign (only 5 minutes difference between posts):

sham100899: http://archive.is/PiQH6#selection-3915.0-3915.10
fakegurutu: http://archive.is/PiQH6#selection-5285.0-5285.10

It looks like these accounts are trading the Merit and are most likely alts.  

[1715464771]

1715464771

[1715464771]

1715464771

[1715464771]

1715464771

[1715464771]

1715464771

[shasan]

I don't think your proof is sufficient. Only giving merit each other can't proof merit abuse or merit trader. I think you should obtain more info if possible.

[Master of Shitcoins]

I don't think your proof is sufficient. Only giving merit each other can't proof merit abuse or merit trader. I think you should obtain more info if possible.

If they are alts they will be tagged for sending merits to alts. I can't prove yet, that fakegurutu is an alt, but it's very fishy.
At least hisori and sham100899 are alts because they used same BTC address.

Let's wait how DT decides if fakegurutu is another alt of hisori/sham100899.

[shasan]

I don't think your proof is sufficient. Only giving merit each other can't proof merit abuse or merit trader. I think you should obtain more info if possible.

If they are alts they will be tagged for sending merits to alts. I can't prove yet, that fakegurutu is an alt, but it's very fishy.
At least hisori and sham100899 are alts because they used same BTC address.

Let's wait how DT decides if fakegurutu is another alt of hisori/sham100899.

Okay. I think below information might be helpful for you.
Both are from Pilipinas. Archive: sham100899 and fakegurutu
Also, both person uses all small letters. Which you can see from the above archive.
Edit:
fakegurutu sent 3 merit to sham100899 at 6/6/2018 4:29:58 AM and
sham100899 sent 2 merit to fakegurutu 6/6/2018 4:36:41 AM That means merit exchanged only within 7 merits.
Both are using the same platform of bitcoin wallet. sham100899 and fakegurutu

[coinlocket$]

I've tried to look at their post history (for the 2 jr members) The only relevant thing found is this one

https://www.blockchain.com/btc/tx/30a2751bd2aa9ff5979dbb75385562e22bc96d407ea592fee87454b260ca6a25

Their addresses are on this transaction but Is not clear what it is.

Also, they applied to the same campaign

sham100899 https://bitcointalk.org/index.php?topic=5100568.msg49358622#msg49358622 3PJdNRCtsd2jfY82JunoCz5vYC8nLj2dtv http://archive.fo/PdcKX#selection-3867.29-3867.63
fakegurutu https://bitcointalk.org/index.php?topic=5100568.msg49358661#msg49358661 3ERcX6VK2DdvNppxWNFYTyoUWum75sqMQc http://archive.fo/PiQH6#selection-5391.29-5391.63

[Master of Shitcoins]

Edit:
fakegurutu sent 3 merit to sham100899 at 6/6/2018 4:29:58 AM and
sham100899 sent 2 merit to fakegurutu 6/6/2018 4:36:41 AM That means merit exchanged only within 7 merits.
Both are using the same platform of bitcoin wallet. sham100899 and fakegurutu

Also, they applied to the same campaign

sham100899 https://bitcointalk.org/index.php?topic=5100568.msg49358622#msg49358622 3PJdNRCtsd2jfY82JunoCz5vYC8nLj2dtv http://archive.fo/PdcKX#selection-3867.29-3867.63
fakegurutu https://bitcointalk.org/index.php?topic=5100568.msg49358661#msg49358661 3ERcX6VK2DdvNppxWNFYTyoUWum75sqMQc http://archive.fo/PiQH6#selection-5391.29-5391.63

Thanks, good research. I'll look into it later to find a hard proof of same addresses between fakegurutu and sham100899.

The application for the BitBlender campaign was only 5 minutes difference between both accounts.  

EDIT: another coincidence (maybe one too many)

Both accounts edited their messages 30 minutes later:

originally posted:

sham100899:    January 22, 2019, 03:01:52 AM
fakegurutu:      January 22, 2019, 03:06:36 AM

less than 5 minutes difference

last edited:

sham100899:    January 22, 2019, 03:34:39 AM
fakegurutu:      January 22, 2019, 03:33:45 AM

less than 1 minute difference

[VINSIN]

They might be friends, but I don't think it's merit abuse, checked their posts with google translate..i don't think there is some abuse

[Avirunes]

They might be friends, but I don't think it's merit abuse, checked their posts with google translate..i don't think there is some abuse

No, but there is a slight chance there is some abuse going over here. Just found out this report and searching for some regular transactions between these 3 accounts:

Username: fakegurutu
ETH ADDRESS: 0xac454c2e083706f7b85fd5f4ea0748c24c5f8369  |  Staked Here  |  http://archive.is/vdmRO
0x5912b6fdc8ac4015d11456aac786db92fcdfb800  |  Staked Here  |  http://archive.is/d3OlD

Username: kaya11
ETH Address: 0xa79d58b3e4566e57526e40d0844290580b325872  | Staked here  |  http://archive.is/PkE9l

Connection:

Code:

https://ethplorer.io/tx/0x26d76f32db5e8cdb208c6ecd9ebb55a37d9b2cfb024c24cfcb653b59420bdc9c

Username: hisori
ETH Address: 0x80A8D0DDF75231A04F60B8CbA67802d0815BEF66  | Staked here  |  http://archive.is/ARSNg

Connection:

Code:

https://ethplorer.io/tx/0x418e80cd4239022092d62498f9db8daf2e6a8aec36a1d0233ef038f801ff3b7f

Archived: http://archive.is/1kxhd

[VINSIN]

As I said before they might be friends, locals have a lot of common trade groups on telegram

[coinlocket$]

As I said before they might be friends, locals have a lot of common trade groups on telegram

Can be but it's hard to be since they posts and EDIT posts basically at the same time.
While 2 or more post can be posted in a short distance of time, I find harder to edit 2 posts on the same thread in a few minutes.

[VINSIN]

As I said before they might be friends, locals have a lot of common trade groups on telegram

Can be but it's hard to be since they posts and EDIT posts basically at the same time.
While 2 or more post can be posted in a short distance of time, I find harder to edit 2 posts on the same thread in a few minutes.

Yeah that's true, but seeing how they act I don't think they are alts. They are friends or members of the same community.

And now seriously..if they were smart enough they could've used different addresses, i still find amazing how some people are using the same addresses.

Most of the reported cases I don't find them as being the same person, I just see them as being stupid as fuck.

[shasan]

They are friends or members of the same community.

I agree with it only about 25% rest 75% they are alter. Experienced merit abuser detector will be able to judge properly what that actually should be.

[Avirunes]

How do you guys view them if they are dealing frequent transactions amongst themselves? Need your opinion actually.

Right now I have fakegurtu dealing frequently with kaya11's old address and some token transactions with hisori.

[Master of Shitcoins]

Yeah that's true, but seeing how they act I don't think they are alts. They are friends or members of the same community.

At least hisori and sham100899 are alts, they are using the same BTC address 3PJdNRCtsd2jfY82JunoCz5vYC8nLj2dtv several times:

hisori: http://archive.is/CQJck
sham100899: http://archive.is/KTidw

Therefore, I have only tagged hisori and sham100899 yet, not sure about the connection of fakegurutu. It's a clear circle of sending Merit between them and it wouldn't surprise me if they get tagged.

And the report from CaptainLance is also pointing out a connection between those accounts.

How do you guys view them if they are dealing frequent transactions amongst themselves? Need your opinion actually.

Right now I have fakegurtu dealing frequently with kaya11's old address and some token transactions with hisori.

A few transactions (1 or 2) are in my opinion not enough evidence to connect accounts, but when more coincidences appear, the evidence will become clearer. Coinlocket$ does analysis of ETH transactions maybe he can give his opinion about abuse.

[Avirunes]

How do you guys view them if they are dealing frequent transactions amongst themselves? Need your opinion actually.

Right now I have fakegurtu dealing frequently with kaya11's old address and some token transactions with hisori.

A few transactions (1 or 2) are in my opinion not enough evidence to connect accounts, but when more coincidences appear, the evidence will become clearer. Coinlocket$ does analysis of ETH transactions maybe he can give his opinion about abuse.

Well apparently there are more than 1-2 count so it really seems to me that they are most likely alts now.

Yeah coinlocket$ opinion would be of some help in this matter.

[coinlocket$]

hisori: http://archive.is/CQJck
sham100899: http://archive.is/KTidw

Solid prof, tagged. Let's see if we can find more on this farm.


I've looked yesterday on sham100899 and fakegurutu ETH, I found nothing suspicious at first view between them, let me check again.

[Avirunes]

I've looked yesterday on sham100899 and fakegurutu ETH, I found nothing suspicious at first view, let me check again.

Here are some to look at

Fakegurutu: 0xac454c2e083706f7b85fd5f4ea0748c24c5f8369

kaya11: 0xE8A675bc39dB29345FEb7B27d502b2EEa324395c


Transactions

Last page: https://etherscan.io/txs?a=0xa79d58b3e4566e57526e40d0844290580b325872&p=3 has 15 transactions including outgoing and incoming transactions between 0xac454c2e083706f7b85fd5f4ea0748c24c5f8369 and 0xE8A675bc39dB29345FEb7B27d502b2EEa324395c

And 0xE8A675bc39dB29345FEb7B27d502b2EEa324395c was used by kaya11 (https://bitcointalk.org/index.php?action=profile;u=1154250) here : http://archive.is/i7GGS


Fakegurutu: 0x5912b6fdc8ac4015d11456aac786db92fcdfb800

hisori: 0x80A8D0DDF75231A04F60B8CbA67802d0815BEF66


Transactions:

I found out 18 token transfers b/w these addresses. Page: https://etherscan.io/tokentxns?a=0x80a8d0ddf75231a04f60b8cba67802d0815bef66&p=1

And 1 normal eth transaction of 0.002 ETH (probably a transaction to move tokens to other addresses or exchange- activity that I have usually seen in bounty abusers)

[The Sceptical Chymist]

Well apparently there are more than 1-2 count so it really seems to me that they are most likely alts now.

Just playing devil's advocate here, but if you looked at how many times I've sent bitcoin to one of gameristo's wallets you might suspect we're alt accounts--but we're not.  I wouldn't discount the possibility that a lot of deals are being done off-forum, and I've been tricked by that before when tagging bounty abusers.  On the other hand, when you've got merit-swapping happening on top of the money being sent, that might be more conclusive as to whether two (or more) accounts are alts--but even then, they could be friends or family and not a single individual.

I don't think it's right to give merit to someone just because they're your friend or family member, but I wouldn't tag a person for doing that.  If you've got someone in a bounty/campaign who's doing it and you're the manager, you might think twice about letting those accounts participate.  We've all seen cases of bounty abuse and we know it happens.  What you do depends on how much you're willing to give them the benefit of the doubt.

[coinlocket$]

~

Yes, but as you wrote we haven't found transactions between Fakegurutu and sham100899,

If we consider others accounts the story is different.

Sadly I'm really busy these weeks and I haven't a lot of time.

[Master of Shitcoins]

What you do depends on how much you're willing to give them the benefit of the doubt.

I agree, until we haven't a real proof it's not justified to give a tag and I didn't tagged fakegurutu yet. When the Merit system was introduced most people just tried how to use it and didn't know that they can run into problems.
Another thing are their posts back-to-back in the same signature campaign and editing them both 30 minutes later.

Sadly I'm really busy these weeks and I haven't a lot of time.

No problem, thanks everyone to look into it so far.