Thanasis -- Hacked account?

[Csmiami]

After reading the last post from the Pharmacist on the "Arcas -- bought account?" thread, I tought: Well, I do indeed have shitload time to waste, so why don't I do a quick check on some random profiles I come accross and if something seems off, I may dig a bit deeper to see if there's something there? And earlier than expected, I already have my first candidate

Forum Hero Member Thanasis. I found this profile rather randomly, as he replied to the 777 signature campaign with one of those asslicking "thank you for accepting me sir" post. Side note; I'm not saying that thanking the campaign manager is a bad thing; but there are ways of doing it; I don't want to sound ungrateful. After a couple of things that raised some minor flags, I found the following:

Hypothesis:
This account was most likely hacked and then sold during the months of September/October 2017. From the post history, there's no reason or indication that leads me to believe that the user sold the account willingly; but that's pure speculation.

-BPIP doesn't show any password/email change at that time, but I'm not sure how far back the records go (@suchmoon I'd appreciate a little clarification there; altough I'll try to find that as soon as I finish this thread).

The user before October 2017

• This user did most of his posting in a thread he himself had created, called Thanasis Collection Pack there, he sold some bots he had programmed and used to answer to doubts that arose on the thread.
• Spoke in a native or at least really good english
• There's no signature campaign application or a single post made on the service board
• 2 Bitcoin addresses mentioned in the bot selling thread: 3NMF6K93oFEzkN74gfHbPkyDs26mL4hbHa and 13j4F6LmXsb3mth3DZMpe3QmpyXtWKKoP1

The user after October 2017 (included)

• Starts posting on spam boards
• Never replies to his bot selling thread again
• English turns form good to broken
• Starts applying to signature campaigns
• Starts posting with "sir" in the sentences

As with the other thread; most of this content, call it proof or evidence if you want to, is highly subjective. A user changing posting habits or changin the way they talk is not a flag per se, and it's something that can happen organically. But when you look paying a bit of attention to some things, do stand up.

If anyone feels like checking; the posting changes happen on post 2470; post history page 124.

I will not jump into conclusions too fast and start tagging accounts because my gut is telling me they are using a sold/hacked account; but this is a forum, and after some discussion, and if the account involved doesn't come forward, it will most likely be the right thing to do.


Edit regading the link between Thanasis and akram143:

Telegram username used by Thanasis here: (archive link)

Already joined in telegram channel telegram username:@starbucks143

BTC address :1BmohtHyKDfQEjq1jFW7tz5WG3HaJhRBtK

Thank you.

Same telegram username used by akram143 to joing bounties 3 times: (Archive 1) (Archive 2) (Archive 3)

@Sstarbucks143

this not valid telegram user name what is actual user for telegram

@starbucks143 is the actual username.

Hi sir,I am joined in telegram campaign,but I made a spelling mistake while filling google form,if it is possible please update my username as @starbucks143.
Spreadsheet no:15.
Thank you.

Joined on facebook and telegram campaign.

Facebook link : https://www.facebook.com/akram.raja.143
friends:3117
telegram:@starbucks143


--snipped part--

[1713417093]

1713417093

[1713417093]

1713417093

[hosseinimr93]

-BPIP doesn't show any password/email change at that time, but I'm not sure how far back the records go (@suchmoon I'd appreciate a little clarification there; altough I'll try to find that as soon as I finish this thread).

BPIP started to record the seclog in March 2018. [Ref.]

The user in question changed the password three times in October 2017. [Ref.]
1. October 03, 2017, 06:55:48 PM
2. October 05, 2017, 11:51:04 AM
3. October 05, 2017, 01:31:23 PM

[Rikafip]

You are definitely onto something here, there are simply too many differences before and after October 2017. People may change writing style over time and their English usually becomes better, but there is no reason to become worse. Based on  the account name  and few posts, original owner is most likely Greek

Living in Greece, Summer 2014
http://www.youtube.com/watch?v=YpKlUIDf4oY

https://bitcointalk.org/index.php?topic=643235.msg7766775#msg7766775

Do not fool any disaster, because luck is the same and the future is invisible.

Ancient Greek proverb.

https://bitcointalk.org/index.php?topic=643235.msg8593079#msg8593079


And then after 2017 you can see Thanasis being active in Indian Cricket Premier League thread. Beside his newly found interest in Indian cricket, he also started using "kindly" and "sir", words he never used prior October 2017. I had few Indian colleagues in the past, and they do like to use word "kindly" quite often, usually instead "please".

Just look at one of the first posts after that sudden change of posting behavior and English level, in which he is interested in 777Coin signature camoaign

What is special senior member position?

can i apply for that position?
kindly reply me soon sir.

In my opinion account changed the owner, so I am leaving neutral for now. The only question is whether it was sold or hacked.

[Csmiami]

And then after 2017 you can see Thanasis being active in Indian Cricket Premier League thread. Beside his newly found interest in Indian cricket, he also started using "kindly" and "sir", words he never used prior October 2017.

WOW, thanks for catching this one, it did help connect a couple of dots. Searching for telegram handles that this user has had over the years; I found that he joined a bounty campaign using the following handle:

Code:

@starbucks143

Doing another search for that handle, we find the following profile: akram143. Now, guess what.... this user is active in the 777coin signature campaign, and is active in Indian boards, and you guessed it too: cricket threads.

@CryptopreneurBrainboss may want to take a look at this, if the accounts are handled by the same user, he is abusing the sigcamp

[lovesmayfamilis]

Interestingly, @Avirunes and @ 1miau have been busy with this question.
On their suspicions, in addition to Thanasis, there were several more purchased accounts.

https://bitcointalk.org/index.php?topic=5124012.msg50353545#msg50353545
Probably need to take a deeper look at every one.

[Csmiami]

---

I did see that thread; but the merit connection.... it did only go one way, and even if it was some sort of shitpost, that's too thin for me. But if anyone does know how to actually investigate that, feel welcome to do so

[CryptopreneurBrainboss]

@CryptopreneurBrainboss may want to take a look at this, if the accounts are handled by the same user, he is abusing the sigcamp

Thank you for calling my attention to this issue. Be rest assured if no convincing explanation are provided by both users they would be tagged for abusing a campaign under my management and also get blacklisted from joining future campaigns. OP, you should make your accusations very convincing too as until then I can't take any action, kindly archived and provided the thread those usernames where used in by both users until then your accusation won't look valid.

To make things faster, I'll be sending a DM to both users after summiting this reply to come defend themselves on this thread or risk getting the above judgement as stated. For now an investigation tag is attached to their username on the spreedsheet.

Edit: Both accounts are now blacklisted and red tagged for  cheating. Had my doubt about accepting Thanasis but I'm glad I did because it exposed another cheater and give the opportunity to remove both.

[Csmiami]

---

Updated OP with the links to BTT and the Archive, now we can only wait and see what excuses they come up with....

(anyone taking bets on the family member one?)

[dkbit98]

akram143 and Thanasis are alt accounts and they are using same telegram account and I have left them both negative trust feedback.
Let's wait and hear their stories, and after that I will maybe consider changing my feedback.

Hi sir,I am joined in telegram campaign,but I made a spelling mistake while filling google form,if it is possible please update my username as @starbucks143.

Already joined in telegram channel telegram username:@starbucks143