Hacking accusation: zTheWolfz, Aleks09, Mr Felt, shdvb - discussion needed.

[xtraelv]

What happened::

Legendary account erre was hacked and recovered.
https://bitcointalk.org/index.php?topic=3652698

Before recovery large amounts of merit was sent to three accounts.

One of those accounts has feedback from DT2

EDIT: Additional proof was found that Aleks09 , Mr Felt and zTheWolfz are alts of the same person who has been vouching for themselves as an exchanger.

All accounts show strong signs of being hacked or bought. (see proof in the thread)

Profile Link:

Aleks09
Mr Felt
zTheWolfz
shdvb-assistant
shdvb

This DT2 prolfile gave positive feedback to one of the profiles. This user also has hack allegations against it.



https://bitcointalk.org/index.php?topic=3061930.msg31532524#msg31532524  shdvb hacked account accusation.


Gave feedback to the "mr felt" account around the time of the hack.

shdvb
shdvb-assistant

I'll change the negative feedback to neutral but something still doesn't seem 100% right about this. The fact that he deals in bitcoin for years yet can't provide a signed message from an address associated with the account is a bit suspicious.

Not I cannot I have explained many times before, those wallets I used are ALL from exchanges. I don't have any private keys to them. Also, change my assistant's negative to neutral, please. Nothing happened to us. No one scammed, nothing.

My Assistant's Account:
https://bitcointalk.org/index.php?action=trust;u=1895733

Additional Notes:

In May, my account was hacked (see here for reference).

The process of recovering was extremely long and painful, but thanks to the new  system I was finally able to get my account back a couple of days ago

A few hours after the hack, i locked my account. The hacker was not able to post anything in my name, but according to this site he was able to send my sMerit to a couple of Russian users (zTheWolfz and Aleks09).

I think additional investigation are needed, because I probably spotted two of my hacker's accounts.

"MrFelts" appears to have received that "trusted feedback" from an account that has a suspected hacking allegation against it.

https://bitcointalk.org/index.php?action=trust;u=318030

I've sent a message to vod who appears to know / trust him.



All three look extremely suspect.







It would be nice to hear their response before deciding to paint them red.

[shasan]

The hacker can sell those merits (or took merit to his accounts) or hacker can send merit randomly. If these accounts are connected then we would be able to tell undoubtedly that those are engaged with hacking or merit abusing.

[xtraelv]

The hacker can sell those merits (or took merit to his accounts) or hacker can send merit randomly. If these accounts are connected then we would be able to tell undoubtedly that those are engaged with hacking or merit abusing.

It would be a huge co-incidence to have never received merits and then get 50 merits randomly from a hacked account.

Why would a hacker give away free merits (maximum allowable) to random accounts when they can sell them ?

I have strong suspicions that the accounts are either associated to the hacker or th merit was bought - either deserves red tagging.

Mr Felt got merits from a hacked account AND got trust from a different account with a hacking accusation against it.

[shasan]

The hacker can sell those merits (or took merit to his accounts) or hacker can send merit randomly. If these accounts are connected then we would be able to tell undoubtedly that those are engaged with hacking or merit abusing.

It would be a huge co-incidence to have never received merits and then get 50 merits randomly from a hacked account.

Why would a hacker give away free merits (maximum allowable) to random accounts when they can sell them ?

I have strong suspicions that the accounts are either associated to the hacker or th merit was bought - either deserves red tagging.

Mr Felt got merits from a hacked account AND got trust from a different account with a hacking accusation against it.

Usually, it engaged with merit trading and/or sending merit to his/her own account. But sometime it may happen sothat we can concentrate on the merited person so that hacker can stay away. But as merited accounts are not high ranked that possibility is too low. There might have 5-10% chance to be random. If they trade those merit then it will be difficult to catch though we imagine they are engaged merit trading but if those are altered then we could tell 100% confidently. I will try to visit those profiles and try to get if there is any matching info.
Edit:
All merit has been sent within 6 minutes so there is more chance to alter account of the hacker.
All accounts received merit only from the hacked account.
They have not used any smerit. So, if they bought they could sell too. It is more chance to be altered of the hacker account.
Your mentioned 3 positive feedback was long ago in the meantime anyone's mind can be changed.

[erre]

Thank you for opening this scam accusation.

I think there are enough proof that these account are my hacker and his socketpuppets, and no one answered in public or private despite my PMs, so I left them red trust. Waiting for DT members to do the same, also some additional investigation (like ip checking) would be great.

I'm pretty passed off and I could consider the option of a formal crime accusation too, but I'm also very curious about how I was hacked, so I will state here that a detailed explanation about how I was hacked will stop my intention to sue the hacker (I will not use any info against him if he tells me honestly what happened).

[xtraelv]

Thank you for opening this scam accusation.

I think there are enough proof that these account are my hacker and his socketpuppets, and no one answered in public or private despite my PMs, so I left them red trust. Waiting for DT members to do the same, also some additional investigation (like ip checking) would be great.

I'm pretty passed off and I could consider the option of a formal crime accusation too, but I'm also very curious about how I was hacked, so I will state here that a detailed explanation about how I was hacked will stop my intention to sue the hacker (I will not use any info against him if he tells me honestly what happened).

I've left negative feedback to the accounts that got 50 merits and a neutral to the one that got 12 (The post that got 12 is not a bad post) but still suspect due to the hacking accusation against the person that left positive feedback to that hero account.

[Rambotnic]

Firstly, i would like to note that i do not defend shdvb.
From what i know for the years i trade with shdvb he is chinese.
His english skills are worst than mine also...
I don't believe he actually have more than one account more as assistant because that's how he used to work back in the Runescape gold sales.
This user is also known as "shine20078" in the runescape community with positive feedbacks since 2011.
I personally don't like shine/shdvb because of his politics for sales, prices and arrogant language.
But also i never seen him scamming, hacking or any malicious activity for those 8+ years so far.
Shine can be easy googled, he have 20-30,000+ positive feedback in few different websites/forums for online trading most for runescape gold.
Also, that doesn't mean people don't change and he didn't bought merit.

A deeper research should be done before any claims.
Based on my experience trading with this person for last years, i can clearly say he is not hacker or scammer for sure, but there is still possibility for merit abuse/purchase.

[erre]

Firstly, i would like to note that i do not defend shdvb.
From what i know for the years i trade with shdvb he is chinese.
His english skills are worst than mine also...
I don't believe he actually have more than one account more as assistant because that's how he used to work back in the Runescape gold sales.
This user is also known as "shine20078" in the runescape community with positive feedbacks since 2011.
I personally don't like shine/shdvb because of his politics for sales, prices and arrogant language.
But also i never seen him scamming, hacking or any malicious activity for those 8+ years so far.
Shine can be easy googled, he have 20-30,000+ positive feedback in few different websites/forums for online trading most for runescape gold.
Also, that doesn't mean people don't change and he didn't bought merit.

A deeper research should be done before any claims.
Based on my experience trading with this person for last years, i can clearly say he is not hacker or scammer for sure, but there is still possibility for merit abuse/purchase.

Nobody is questioning shdbv's honour.
What probably happened here is that shdbv account had been hacked (additional proofs: https://bitcointalk.org/index.php?topic=3061930.0) by the same hacker who hacked me, and the other accounts are either the hacker's account or his socketpuppets.

[Quickseller]

This really doesn’t work prove anything.

[erre]

This really doesn’t work prove anything.

Of course not. My hacker dropped my merits to some users during a timespan of 6 minutes, and one of this users was green painted by a trusted user who was recently tagged as an hacked account, and act and behave strangely. This doesn't exactly prove anything. But there are lot of clues.

I'm waiting for explanations from the involved users (I even sent PMs), but as now I would bet we spotted the hacker and his friends (or alts).

Why you felt the urge to post here to state we didn't still "work proved" anything?

[sapta]

IIRC, shdvb wasn't even on DT2 back when his account allegedly compromised.

[erre]

Mr felt contacted me by pm, and told me he own all the 3 accounts and buyed merit from deliveryman (https://bitcointalk.org/index.php?action=profile;u=307899), a user that is indeed selling accounts and merit.

I changed my feedback to neutral and I will now investigate deliveryman's activity deeper...

[suchmoon]

Mr felt contacted me by pm, and told me he own all the 3 accounts and buyed merit from deliveryman (https://bitcointalk.org/index.php?action=profile;u=307899), a user that is indeed selling accounts and merit.

I changed my feedback to neutral and I will now investigate deliveryman's activity deeper...

You changed feedback to neutral for a merit-buying puppeteer, am I reading this right? Please ask Mr Felt to come over here to comment on this. Sounds like a very interesting story.

[erre]

Mr felt contacted me by pm, and told me he own all the 3 accounts and buyed merit from deliveryman (https://bitcointalk.org/index.php?action=profile;u=307899), a user that is indeed selling accounts and merit.

I changed my feedback to neutral and I will now investigate deliveryman's activity deeper...

You changed feedback to neutral for a merit-buying puppeteer, am I reading this right? Please ask Mr Felt to come over here to comment on this. Sounds like a very interesting story.

Yep, I already asked everyone to come here to give their version, but nobody did...

Deliveryman is obviously an account made for selling hacked accounts, and he is related to some accounts who made more elaborate scams (https://bitcointalk.org/index.php?topic=930649.0). Probably he have many alts. But he seems not to be a Russian speaker, so I think Mr felt's accounts are not controlled by deliveryman. But I will try to make some checks using timestamps, If I still can retrieve the mail I got when the hacker changed the password.

[shasan]

Mr felt contacted me by pm, and told me he own all the 3 accounts and buyed merit from deliveryman (https://bitcointalk.org/index.php?action=profile;u=307899), a user that is indeed selling accounts and merit.

I changed my feedback to neutral and I will now investigate deliveryman's activity deeper...

Do you support merit abusing (merit buying), and multi accounts which have been used as merit abusing. As far as I know, merit trading is not allowed, so how merit buying can be trusted. They may not be engaged with account hacked but according to their words which you told they are merit abuser (merit trader) in this case, they can't be trusted. In this situation, I could not understand the reason to change your mind from negative to neutral.

Yep, I already asked everyone to come here to give their version, but nobody did...

They have not kept their words but you have kept. Though there is still a chance they may create post on here.

You changed feedback to neutral for a merit-buying puppeteer, am I reading this right? Please ask Mr Felt to come over here to comment on this. Sounds like a very interesting story.

You see the right thing which you wrote. I do not think merit buyer will tell publicly, As it will happen same for merit buying.

[xtraelv]

You put a negative feedback about the merits from hacked account, I want to clarify this situation, i am owner of this three accounts (Mr.felt) (zTheWolfz) and Aleks09 I keep these accounts for promotion of my trading topic for buying and selling cryptocurrency and i am not a hacker! and i bought this merits from user of this forum, I have already shared all the information about this user with (erre).
And honestly I thought that having several accounts and buying merit is not prohibited here , maybe there is some way to return these merits and that you would remove your negative feedback?

Is this where you are vouching for your own exchange service using an alt account ?

Excellent exchanger, exchanged some BTC for qiwi, after the first confirmation the money was already in my account.

Thank you for your feedback! Waiting for you again)

https://bitcointalk.org/index.php?topic=2752732.0

https://bitcointalk.org/index.php?topic=2752732.120

Archived:
https://archive.fo/AHqTa

https://archive.fo/r3pJg

[erre]

I turned my feedback to neutral because he was collaborating, i now asked to post here the tx were he paid the seller for further investigation. Anyway, I still clearly state in my feedback what happened.

But there's something even more fishy about mr felt:

Mail I received on 8th May 12.02 am:

Dear erre,

Your Bitcoin Forum (bitcointalk.org) email address was just changed from ---@gmail.com to olegrozman6966@gmail.com by IP address 108.59.2.227. If you did not do this, then you can visit the following link within 14 days in order to lock the account:


On the same day, from 10.16 to 10.22 am, the hacker dropped my merit on mr felt and his account.

That could be a matter of server time (I'm gmt+1), but the two events are really close, so I asked for additional explanations about were and how he buyed the merit so fast.

[xtraelv]

"Once again I used the services, everything was clear, without delay. Keep it up!"


Aleks09 - likely a juvenile who writes with errors.

https://bitcointalk.org/index.php?topic=2725216.msg28041595#msg28041595

https://archive.fo/1J3Br (archived)

"I do not work yet. I go to school"

But after January 14 is a very clear text with services.

bitcointalk.org/index.php?topic=2752732.0

Account likely hacked or bought.


zTheWolfz - Old account, writes about mining in excellent technical English.
Till December 07, 2017, 02:20:05

Starting with January 19, 2018, 11:07:45
He only writes about the Russian exchange.
In Russian.

Account likely hacked or bought.

[erre]

Yes, a basic linguistic and style analysis makes clear that the account are hacked.
Combining this with the timestamps, I am red trusting again mr felt, this time for hacking/possession of stolen goods, which in my view is a far worst crime than merit buying.

[xtraelv]

Mr Felt



Prior to October 2016 only posts in high level English

One year of no posts.

After October 2017 posts in Russian and broken English.

Account likely hacked or bought.