[Graph]Megafarm accounts (Merit abuse) Involved 1 Legendary and 2 Hero accounts

[Alex_Sr]

Today I found a huge accounts farm

I thought it very strange that the accounts do not have a single post in Russian, suddenly began to send merit for shitty one-line posts written in Russian language!

Thanks DdmrDdmr for a great tool work - User Merit Network.



All accounts in this farm are linked to these 3 accounts:

Hero Member - Bfljosh (BPIP - Bfljosh) - Hacked?
Hero Member - mwheeleruk (BPIP - mwheeleruk) - Hacked?
Legendary - hanspeter77 (BPIP - hanspeter77) - The account was hacked, but then the owner regained control of it.





Farm distinctive features:

1. All accounts are registered in small periods of time:
- December 31, 2017, 12:03:07 PM - January 01, 2018, 09:10:34 PM
- January 13, 2018, 09:01:17 PM - January 15, 2018, 09:09:28 PM
- February 22, 2018, 02:04:12 PM - February 22, 2018, 03:28:56 PM
2. All messages received merit were written in one branch (https://bitcointalk.org/index.php?board=18.0).
3. All the posts deleted or this is a one-line shitposting

muklewire      BPIP -   muklewire   
vertolesrix      BPIP -   vertolesrix   
retihusleb      BPIP -   retihusleb   
cetukilsev      BPIP -   cetukilsev   
hesiterlops      BPIP -   hesiterlops   
tasedijers      BPIP -   tasedijers   
shipklovesa      BPIP -   shipklovesa   
wbiklemsip      BPIP -   wbiklemsip   
akselovite      BPIP -   akselovite   
xiklerszap      BPIP -   xiklerszap   
getiklems      BPIP -   getiklems   
revoiklets      BPIP -   revoiklets   
tiaverklet      BPIP -   tiaverklet   
xalanceg      BPIP -   xalanceg   
kiadenip      BPIP -   kiadenip   
degrasle      BPIP -   degrasle   
harinikis      BPIP -   harinikis   
vilsareb      BPIP -   vilsareb   
rukolksez      BPIP -   rukolksez   
ravinesolz      BPIP -   ravinesolz   
dukalote      BPIP -   dukalote   
subokletv      BPIP -   subokletv   
guklertim      BPIP -   guklertim   
fulletrok      BPIP -   fulletrok   
ateklinpov      BPIP -   ateklinpov   
ctinkervur      BPIP -   ctinkervur   
gabermoku      BPIP -   gabermoku   
jolkentres      BPIP -   jolkentres   
famlenayd      BPIP -   famlenayd   
phaneriks      BPIP -   phaneriks   
jenktosar      BPIP -   jenktosar   
gahavank      BPIP -   gahavank   
saurdinec      BPIP -   saurdinec   
toleomasd      BPIP -   toleomasd   
caderiank      BPIP -   caderiank   
detymalse      BPIP -   detymalse   
serekmetes      BPIP -   serekmetes   
nekozuru      BPIP -   nekozuru   
fekridal      BPIP -   fekridal   
gavikzal      BPIP -   gavikzal   

Code:

Name:			Posts:		Activity:	Merit:		Position:	Date Registered:
muklewire		260		210		10		Member		December 31, 2017, 12:03:07 PM
vertolesrix		250		250		10		Member		December 31, 2017, 05:59:36 PM
retihusleb		50		50		10		Jr. Member	January 01, 2018, 07:32:02 PM
cetukilsev		52		52		10		Jr. Member	January 01, 2018, 07:38:53 PM
hesiterlops		109		109		10		Member		January 01, 2018, 07:45:08 PM
tasedijers		143		143		10		Member		January 01, 2018, 07:54:31 PM
shipklovesa		64		64		10		Member		January 01, 2018, 08:12:02 PM
wbiklemsip		67		67		10		Member		January 01, 2018, 08:18:52 PM
akselovite		91		91		10		Member		January 01, 2018, 08:36:37 PM
xiklerszap		62		62		10		Member		January 01, 2018, 08:43:59 PM
getiklems		158		154		10		Member		January 01, 2018, 09:04:01 PM
revoiklets		51		51		10		Jr. Member	January 01, 2018, 09:10:34 PM
tiaverklet		64		64		10		Member		January 13, 2018, 09:01:17 PM
xalanceg		50		50		10		Jr. Member	January 13, 2018, 09:07:01 PM
kiadenip		55		55		10		Jr. Member	January 13, 2018, 09:34:48 PM
degrasle		174		140		10		Member		January 13, 2018, 09:56:06 PM
harinikis		63		63		10		Member		January 13, 2018, 10:08:18 PM
vilsareb		146		140		10		Member		January 13, 2018, 10:24:59 PM
rukolksez		76		76		10		Member		January 13, 2018, 10:34:41 PM
ravinesolz		134		134		10		Member		January 13, 2018, 10:49:45 PM
dukalote		52		52		10		Jr. Member	January 14, 2018, 02:13:15 PM
subokletv		53		53		10		Jr. Member	January 14, 2018, 02:26:10 PM
guklertim		54		54		10		Jr. Member	January 14, 2018, 02:39:24 PM
fulletrok		48		48		10		Jr. Member	January 14, 2018, 02:47:10 PM
ateklinpov		55		55		10		Jr. Member	January 14, 2018, 04:11:10 PM
ctinkervur		52		52		10		Jr. Member	January 14, 2018, 04:19:50 PM
gabermoku		46		46		10		Jr. Member	January 14, 2018, 07:08:42 PM
jolkentres		50		50		10		Jr. Member	January 14, 2018, 07:21:03 PM
famlenayd		49		49		10		Jr. Member	January 15, 2018, 08:13:03 PM
phaneriks		68		68		10		Member		January 15, 2018, 08:28:07 PM
jenktosar		171		171		10		Member		January 15, 2018, 08:37:48 PM
gahavank		49		49		10		Jr. Member	January 15, 2018, 08:44:07 PM
saurdinec		52		52		10		Jr. Member	January 15, 2018, 08:52:01 PM
toleomasd		112		112		10		Member		January 15, 2018, 09:02:38 PM
caderiank		50		50		10		Jr. Member	January 15, 2018, 09:09:28 PM
detymalse		102		102		10		Member		February 22, 2018, 02:04:12 PM
serekmetes		54		54		10		Jr. Member	February 22, 2018, 02:24:54 PM
nekozuru		134		134		10		Member		February 22, 2018, 02:32:09 PM
fekridal		132		132		10		Member		February 22, 2018, 03:06:42 PM
gavikzal		124		124		10		Member		February 22, 2018, 03:28:56 PM

[1714889619]

1714889619

[Lafu]

You are sure about hanspeter77 ?
He is posting in german board and looks like a German ! 
I will try to find something about .

[suchmoon]

You are sure about hanspeter77 ?
He is posting in german board and looks like a German !  
I will try to find something about .

Are you saying there couldn't be German-speaking hackers/farmers?

https://bitcointalk.org/index.php?action=trust;u=110642

This user's password was reset recently.

Edit:

https://bpip.org/profile.aspx?p=hanspeter77

4/7/2018 9:28:05 AM           password changed
4/9/2018 11:09:32 AM           password reset via email
1/20/2019 12:36:07 AM        password reset via email

The suspicious merits were sent on 4/7/2018 (April 7 2018) when the password was changed. So it's technically possible that someone hacked the account, sent merits, and then the real hanspeter77 regained access. Or it could be a convenient excuse for a merit farmer.

[morvillz7z]

Another explanation would be simply selling merit. Giving random profiles merit for oneliners in a different local board (Russian) on the same day within just 5 minutes apart is a little strange the least to say. Also, his password was changed almost immediately, a few minutes after the merit was handed out.

edit: suchmoon got me with that quick edit  

edit2: what Veleor brought up (account being hacked) explains pretty much everything.

[Lafu]

~~~~

No i dont say that !  And i dont have anything to do with him just saw him the last weeks and month in the german board !
Never looked deeper on him because there was no bad behave that I would have noticed.
But i know that dosnt mean anything !

[Veleor]

The suspicious merits were sent on 4/7/2018 (April 7 2018) when the password was changed. So it's technically possible that someone hacked the account, sent merits, and then the real hanspeter77 regained access.

If I'm not mistaken, on April 9 2018 hanspeter77 wrote in German board that administrators helped him to return the account.

. Aber deutsch ist wohl kein Qualitätsmerkmal in der Cryptowelt.

Nicht wirklich. Bis auf Lisk und Raiden habe/ hatte ich nirgends mein Geld  investiert.
Aber hier herrscht  sowieso gegenüber deutschen ICOs eine Art "Solidarität".

juhu ich hab mein account wieder zurück und da sging super schnell danke an die admins hier:=
ja ist nicht so wie sonst deutsche ware gute ware in crypto zählt da snicht

wow 
während wir hier alle noch um deinen account getrauert haben: https://bitcointalk.org/index.php?topic=2669291.600 hast du ihn dir aber wirklich schnell zurück geholt 
gratulation und ab sofort extra gut darauf aufpassen... und jetzt ende mit offtopic 

ja ging richtig fixe hatte glück ahb ein post gefunden wo ich ne btc adresse gefunden habe oder eher ein user und zwar der user -doubleU- an rieseiges dankeschön an ihn ohne ihn hätt eich mein account nicht leide rhatt der hacker meine mert,s alle verheizt sonst w+ürde ich ihm alle geben . ja jjetz tende mit offtopic.

[TalkStar]

Another good catch mate. Its really annoying to see someone who already achieved hero, legendary account and committing this kind of activies.

I beleive those accounts handling by someone else.  Maybe he is the new buyer of that account. Its such a shame i myself see on a freelancing marketplace "fiverr" where some guys opened service of selling bitcointalk accounts. I hope there will be a great change in the future when users will understand the value of their account.

[Lafu]

~~~~~

Yes you are right !


I have translated for you :

a was really fixe had luck to have found a post where I found a btc address or rather a user and although the user -doubleU- huge thanks to him, without him I would not have my account, unfortunately, the hacker has burned all my merits otherwise I would give it all. yes now end with offtopic.

[suchmoon]

~~~~~

Yes you are right !


I have translated for you :

a was really fixe had luck to have found a post where I found a btc address or rather a user and although the user -doubleU- huge thanks to him, without him I would not have my account, unfortunately, the hacker has burned all my merits otherwise I would give it all. yes now end with offtopic.

Can you suggest to hanspeter77 to contact theymos and ask to reverse the merit transactions? He's done this before for a hacked account. This would also kill the farmed accounts.

I'd PM him myself but might work better if you do it in German.

[Lafu]

~~~~

I will do that laters thanks !

Edit :  I have sent him the PM . And explained to him !

[Alex_Sr]

The suspicious merits were sent on 4/7/2018 (April 7 2018) when the password was changed. So it's technically possible that someone hacked the account, sent merits, and then the real hanspeter77 regained access.

If I'm not mistaken, on April 9 2018 hanspeter77 wrote in German board that administrators helped him to return the account.

Ok. I added a comment in the first post. Other 2 accounts (Bfljosh and mwheeleruk) seems hacked. From the moment of sending merits of 4 and 5 April 2018 for the forum they are not logged in.

[hanspeter77]

hello guys yeha im german
thx for that great work im whrite am pm maybe im get back my merit,s

[madnessteat]

~snip~

Well done work. I apologize for the offtopic. I wonder if there is a topic on the forum that will help me learn how to find such users? Or maybe some tips from experienced users where should I start?

[YOSHIE]

Maybe a little strong evidence about [@hanspeter77] what happened to him, I'm sure what @suchmoon, @Lafu, @Veleor said about accounts @hanspeter77 before the merit process had already started his account on the terrace,
Anyone can see the proof below,
my goal is just to straighten out the @hanspeter77 that happened to him.
Original account: https://bitcointalk.org/index.php?action=profile;u=110642[hanspeter77]
Account when the original account is on the terrace. https://bitcointalk.org/index.php?action=profile;u=2012345[hanspeter777]

ich versuche mein account wiederherzustellen weil meiner gehackt wurde hanspter77
jetzt kann ich aber maxi 2 pom,s am tag schreiben so dauert das ja ewig.
immer wenn ich eine pm schreiben will komt jetzt hab limit erreicht für heute und dann das :
Buying a Copper membership may increase yo
kann man sich eine höhere mitgliedschafft kaufen

ich danke dir sehr hab die pm erhalten haste eine zurück bekommen reicht das wenn ich mal btc adressen gepostet habe wenn ich die signiere als beweis? hab den mega text vorbereitet ^^.

Durch Mega Texte will sich kein Admin durchwühlen, einfach genau so kurz und knapp wie unter https://bitcointalk.org/index.php?topic=497545.0 beschrieben.

ok aber wa sist damit gemieint :
-----BEGIN BITCOIN SIGNED MESSAGE----- soll ich dei daten im btc wallet eintragen und die nachricht signieren
My account <account> has been hacked/lost. Please reset the email to <email>. The current date is <date>.
-----BEGIN SIGNATURE-----
<insert address here>
<insert signature here>
-----END BITCOIN SIGNED MESSAGE----- und hier nach die nachricht signieren und dann die signatur an den admin schicken und darunter den post mit meim account von der btc adresse
oder wie kann der admin nur durch die signature meine nachricht lesen?

Der Admin braucht die Adresse, die Nachricht mit deinen Daten, die Signatur und den Link zu deinem alten Post wo die Adresse zu finden ist.

ja das versteh ich schon nur muss das alles im btc wallet bei nachricht signieren rein gemacht werden schicke ich dem admin nur meine signatur und den link mit der adresse??
sieht das dan so aus ?:


 hier : den link mit dem post von btc adresse.
dann hier die btc adresse.
und hier die signatur
in der signautr stehen ja die restlichen daten stimmt das so ??

danke für deine hilfe ich sehe gerade das der wo mic gehackt hatt schön meri,ts verteilt hat schaut mal :
https://bitcointalk.org/index.php?action=merit;u=110642
was man für merit,s alles tut

Schöner Mist, hoffentlich bekommst du deinen Account wieder zurück. Wenn das klappt frage auch gleich, ob die vergebenen Merits gestrichen werden können, damit niemand einen Vorteil davon hat.
Ich verwende seit längerer Zeit nur mehr Passwörter mit mehr als 20 Zeichen und mit allem was die Tastatur hergibt.

ja hab mich vertifieziert heir im forum jetzt nachdem ganzen
und dir nochmal ein riesen dankeschön wollte dir gerade merit,s geben aber hatte 70 stück die hatt alle der rissiche hacker ausgegben
hoffentlich bekoomm ich die zurück dann bekommst du sie

[Alex_Sr]

Well done work. I apologize for the offtopic. I wonder if there is a topic on the forum that will help me learn how to find such users? Or maybe some tips from experienced users where should I start?

You can start with a section Paзнoe (https://bitcointalk.org/index.php?board=18.0) in the Russian local Board. I think there's more farms. And most have yet to be discovered.

[YOSHIE]

I found 4 accounts that were connected well with ETH Address and misused using Smerit and Merit, but I have reported this to mod,
Is this enough to prove that the account is related.
for me there is no doubt about accounts, how you need to be corrected or 100% of accounts connected.

Connected account:
1. crazy_max Member
2. valdemar97 Full Member
3. morkovka23 Member
4. lumon2112 Member

Connected evidence:

ETH address: 0x508A85305431F57f2e7e7d2936bA17eDE1859c58

Eth adress: 0x508A85305431F57f2e7e7d2936bA17eDE1859c58

Merit:SENT:

тaк этo дoвoльнo нeплoxo, вeдь ecли двa чeлoвeкa xoтят дpyг дpyгa тo пoчeмy бы и нeт, вoзмoжнo oни и paды этoгo вcтpeтилиcь, 21 вeк вce жe)))

Merit : RECEIVED:

кaк пo мнe пocлe шaxмaт тaкoй aктивный вид cидячeгo cпopтa кaк кибepcпopт пo oпpиopии являeтcя cпopтoм, кaкиe мoгyт быть пpитeнзии y кoгoтo пocлe шaxмaт?

Я тaк caмo кoгдa тeмa зaxoдит o кибepcпopтe, cpaзy пpoвoжy пapaллeль c шaxмaтaми) нy нe пpизнaн я этoт вид дeятeльнocти cпopтoм, xoтя кaccy тaм paзнocят пpиличнyю

Дa yж, и пpaвдa yкpaинцы мaccoвo выeзжaют зa гpaницy. Кoнeчнo в ocнoвнoм чиcтo нa зapaбoтoк и в этoм мoмeнтe иx мoжнo пoнять. Кaждый вeдь xoчeт xopoшo жить, a в нaшeй cтpaнe пoкa чтo пpocтo выживaют. Интepecнo вoт чтo, пoляки нeдoвoльныe cвoим пoлoжeниeм и выeзжaют тoжe, нaпpимep в тy жe Дaнию, Чexию и тд. A вoт мы, yкpaинцы paды и тoмy, чтo пoлyчaeм в Пoльшe, тo ecть eдeм paбoтaть зa пoлякoв. Boпpoc в тoм, кaк дoлгo eщё бyдeт пpoдoлжaтьcя этa пyтaнинa? Кoгдa нaкoнeц-тo вcё cтaнeт нa cвoи мecтa и люди бyдyт paды пoднимaть экoнoмикy и ypoвeнь жизни имeннo в cвoeй cтpaнe?

Кoнeчнo cмoжeт. Ecли oн eгo вocпитaeт, тo пo cпoкoйнo cмoжeт cчитaть eгo cвoим peбёнкoм

More detailed evidence:
1. morkovka23   BPIP-crazy_max
2. crazy_max  BPIP-morkovka23
3. crazy_max  BPIP-lumon2112
4. crazy_max  BPIP-valdemar97

[madnessteat]

You can start with a section Paзнoe (https://bitcointalk.org/index.php?board=18.0) in the Russian local Board. I think there's more farms. And most have yet to be discovered.

Thanks for the answer. I thought there was some particular search strategy. I will try to look at the weekend, as this week is very busy with work.

[Alex_Sr]

<...>

Yes, it looks like these accounts are controlled by 1 person.