[Investigation] Fighting The Account Mafia

[hZti]

First of all I want to address the general topic of account selling. There are two types of account selling, the "good" type aka transparent selling of accounts and the bad type aka secret selling of mostly stolen accounts. (example of transparent account selling)
Secret selling of bitcointalk accounts is problematic since it will use the trust that people give towards an established account to potential scam them or trick them into trusting them more than they should. Because not a lot of long time users are willing to give away their account for money it also encourages account sellers to steal accounts by hacking, phishing and other illegal methods.
To find potential buyers it happens from time to time that an account seller posts an offer in the marketplace section, without disclosing what accounts he has to offer. This makes the deal not transparent and therefore potentially dangerous to many users in the future.  
But these offers made me think: What if users would pretend to be interested in buying an account and therefore could uncover what accounts they are being offered by the accountseller. This way it would be easy to uncover what accounts are being sold!
So that is what I did and the result was rather overwhelming. I replied to an offer of user “Accountslegend” on Telegram.  He offered me the Accounts jkoil (Hero Member) and MatthewLM (Legendary) for the price of 500 USD and 1000 USD. Since during the talks the accounts came online on bitcointalk I was convinced that user “Accountslegend” would really the one who owns the email and password to that accounts. I was happy with the result for my first investigation.
After some time I thought: Maybe it would be possible to take this further and uncover more of the Accounts Mafia. So that’s what I did. I created a new telegram account and contacted him again. But this time I wanted more proof. I told him it was not enough that he could show me screenshots from the logged in account, but that I would need personal messages to my bitcointalk profile.
This is where things started to get interesting. Instantly I got a message from user “roslinpl” to confirm that the person I speak to on telegram is a Legendary member and that I could trust him. I got also a PM form the account that was offered to me this time “raffern” (Full Member). He offered me one more account "archive" (Full Member) and even offered me to buy his account “roslinpl” which I can only speculate would have been a scam and I would have never gotten the login data. To make things even better I got a PM form user “Monzsta” that asked me why I did not reply the day before to his offers from the other accounts. I also want to mention that even if I asked many times what user could act as an escrow I only got the answer that he prefers to do the deals directly with him.

So to summarize things up, with this simple investigation I was able to uncover the main actor behind most of the accounts for sale ads here: “roslinpl”. I was also able to uncover his two alt accounts “Monzsta” and “Accountslegend”.
Furthermore I was able to uncover four accounts that are being sold at the moment(MatthewLM, jkoil, raffern and archita), with one account that was already sold during the investigation (jkoil).

During the investigation I was also added to a Telegram chat group that it is run by “Accountslegend” aka “roslinpl”. In this group there are a lot more accountsellers like “roslinpl”. So this is where this thread comes to play: In the next post you will find a list, where I will add any account that a users can provide proof that the account was offered to him by an accountseller. Furthermore there will be one more list with known account sellers here on bitcointalk. This makes accountselling transparent and unattractive for scammers. I want to say again that the selling of account is not necessarily bad, but should be disclosed to the public.

Evidence: (Klick here for full size images: https://ibb.co/album/rb971s)

[hZti]

Accounts for sale or already sold:
 

Code:

MatthewPL
jkoil [recovered by original owner]
raffern
archita
glendall
nandnor
cicizhang
TanClan98
zackie
Zedster
Ntrain2k
nonnakip
narousberg
pant-79
J Gambler
fitty

Account sellers:
 

Code:

roslinpl
Monzsta
Accountslegend
SeW900
Rueduciel

[_BlackStar]

To make it easier for people to know a lot about the accounts you mention, I'll help you create a complete list with profile links for each account.
Please check each account's trust page, 3 out of 4 accounts have changed their password 1 to 2 times recently.

1. MatthewLM
2. jkoil
3. raffern
4. archita
5. glendall
6. nandnor
 
1. roslinpl
2. Monzsta
3. Accountslegend

But these offers made me think: What if users would pretend to be interested in buying an account and therefore could uncover what accounts they are being offered by the accountseller. This way it would be easy to uncover what accounts are being sold!

I'm curious, in principle this is a trap but is this allowed or recommended?

[LoyceMobile]

People tried this before, publishing private messages and lying for a sting operation isn't appreciated by everyone.

A red trusted Legendary who wants to cash in isn't really surprising. Nobody will trust the account anyway.

[hZti]

But these offers made me think: What if users would pretend to be interested in buying an account and therefore could uncover what accounts they are being offered by the accountseller. This way it would be easy to uncover what accounts are being sold!

I'm curious, in principle this is a trap but is this allowed or recommended?

It is perfectly legal (at least in my jurisdiction Germany) to ask somebody for the prices and for some samples of what he has to sell even if there is then no intention to buy it. It may not be the nicest thing to do but it is done by law enforcement everyday. You have to balance the interests and it is clear that the interest of the community to be possible scammed multiple times is more important than the interest of the seller not to expose the accounts that he sells.

[yahoo62278]

The only issue is selling accounts is not illegal, so tagging said accounts would be an abuse of power. A large portion of the community is against account sales so I'm not sure why it's not a rule. if theymos (or any high recognized name)account was to ever be sold, do you know the amount of btc he could get donated?

[logfiles]

roslinpl an account that was trusted changed hands, woke up and started participating in 1xbit signature campaign with shitposts and the whole story is here

The proof pointing to ownership change is here
They didn't even bother signing a message from the addy.

When the campaign they were promoting stopped. roslinpl's activity also stopped.

I am going to tag all the accounts involved after sometime. I can not trust the person who is currently behind roslinpl's account or all the accounts involved in the sale.

[The Sceptical Chymist]

People tried this before, publishing private messages and lying for a sting operation isn't appreciated by everyone.

Are you by any chance referring to that sting operation that Lauda and others did a couple of years back, or was there another attempt like this to get account sellers to give up the details that was rebuffed by the community?  Because I'll tell ya, I don't remember anything like the latter and I think publishing PMs from shitbag account sellers would be A-OK with anyone who cares about the forum.

I sure as hell know I don't mind what OP did, neither the sting aspect nor the publishing of PMs.  In other circumstances it wouldn't be appropriate, but considering that he might have saved someone from getting scammed by a high-ranking member who's not the original account owner or the forum itself from shitposting, I'd say it's well above board behavior.

Roslinpl?  Jesus, I haven't seen that username in forever.  I could have sworn whoever they were had disappeared for good.  I'm going to tag some accounts now and appreciate the info.

There are two types of account selling, the good type aka transparent selling of accounts and the bad type aka secret selling of mostly stolen accounts.

I gave you merits for doing the legwork here, but I disagree with the above; there is no good type of account selling.  Whether it's out in the open or on another website, the consequences can be exactly the same.

[LoyceV]

People tried this before, publishing private messages and lying for a sting operation isn't appreciated by everyone.

Are you by any chance referring to that sting operation that Lauda and others did a couple of years back, or was there another attempt like this to get account sellers to give up the details that was rebuffed by the community?

I couldn't find the link from mobile, but it's bob123's topic from 3 years ago: Flagging accounts which are up to sale.

[dkbit98]

The only issue is selling accounts is not illegal, so tagging said accounts would be an abuse of power. A large portion of the community is against account sales so I'm not sure why it's not a rule. if theymos (or any high recognized name)account was to ever be sold, do you know the amount of btc he could get donated?

You can add neutral feedback in this case if you suspect that account was sold or changed hands.
If there are enough evidence and if someone is doing ban evasion or abusing campaigns than you can add negative feedback.
I wouldn't care much about roslinpl, but his post history changed a lot after account purchase.

[yahoo62278]

The only issue is selling accounts is not illegal, so tagging said accounts would be an abuse of power. A large portion of the community is against account sales so I'm not sure why it's not a rule. if theymos (or any high recognized name)account was to ever be sold, do you know the amount of btc he could get donated?

You can add neutral feedback in this case if you suspect that account was sold or changed hands.
If there are enough evidence and if someone is doing ban evasion or abusing campaigns than you can add negative feedback.
I wouldn't care much about roslinpl, but his post history changed a lot after account purchase.

I personally think if there is proof an account has changed hands, a tag should be given.

Most users likely don't pay attention unless it's red though. Even the buyer wouldn't likely care about a neutral as they could still participate in most campaigns.

Low ranked nobody accounts that pose no threat to the community as far as being able to borrow large amounts with no collateral, maybe the neutral. High ranking or highly trusted accounts is where we should all consider a negative to stop someone from trying to scam.

[hZti]

There are two types of account selling, the good type aka transparent selling of accounts and the bad type aka secret selling of mostly stolen accounts.

I gave you merits for doing the legwork here, but I disagree with the above; there is no good type of account selling.  Whether it's out in the open or on another website, the consequences can be exactly the same.

I can agree with you that in 99% of the cases but I did not feel that I would be in the position to decide that every account selling is bad, since the unofficial forum rules (https://bitcointalk.org/index.php?topic=703657.0 Rule 18) do not strictly forbid it. Also there is for example this case: https://bitcointalk.org/index.php?topic=1609612.msg16194427#msg16194427 which to me is unnecessary, but still I can't really say that it is a super bad thing.

I personally think if there is proof an account has changed hands, a tag should be given.

Most users likely don't pay attention unless it's red though. Even the buyer wouldn't likely care about a neutral as they could still participate in most campaigns.

In my opinion it should be a forum rule that you can sell accounts, but you have to wear a tag for at least 120 days that the account has changed hands. You can never know who dealt with the account in the past and therefore trusts the account and if it is a common practice (which I can definitely tell from the amount of accounts that were sold daily in the Telegram Group) it will destroy a lot of trust in the forum in general. It may not even that people loose money, but some users are also trusted for their technical knowledge or their judgment on Price action etc.

[_BlackStar]

In my opinion it should be a forum rule that you can sell accounts, but you have to wear a tag for at least 120 days that the account has changed hands.

That tag should stay forever as a warning to any user. I can't imagine if everyone agrees on selling accounts and it's never a problem, then surely it will turn into a profitable business in an instant. Imagine if users who post something constructive, quality start running this business? Will the forum and users be fine?

I assume that selling accounts is frowned upon mainly because it can be a bad start for the forum. There are more and more farming ^{[in bounty or campaign],} spammers are out of control and will cause various problems that can harm other parties financially. So account sales must be tagged even though in the rules account sales is allowed.

[logfiles]

All accounts flagged. My target was to flag roslinpl since the profile has multiple service announcements that could easily fool newbies into dealing with a new owner of the account.

1. MatthewLM - https://bitcointalk.org/index.php?action=trust;flag=2992
2. jkoil - https://bitcointalk.org/index.php?action=trust;flag=2993
3. raffern - https://bitcointalk.org/index.php?action=trust;flag=2994
4. archita - https://bitcointalk.org/index.php?action=trust;flag=2995
 
1. roslinpl - https://bitcointalk.org/index.php?action=trust;flag=2996
2. Monzsta - https://bitcointalk.org/index.php?action=trust;flag=2997
3. Accountslegend - https://bitcointalk.org/index.php?action=trust;flag=627

[hZti]

All accounts flagged. My target was to flag roslinpl since the profile has multiple service announcements that could easily fool newbies into dealing with a new owner of the account.

2. jkoil - https://bitcointalk.org/index.php?action=trust;flag=2993

Guys what do you think about account jkoil? It was 100% sold and now the owner of the account claims that he got back his email address via google and therefore is again in control of his account. While I want to believe that this is true, without proof the buyer could easily claim the same. See here for reference: https://bitcointalk.org/index.php?topic=5405076.msg60525702#msg60525702 .
What I can see from https://bpip.org/Profile?id=206476 is that he for sure did not deal with bitcointalk recovery team. There is also no proof of dealing with google recovery team.

Accounts for sale or already sold:
 

Code:

MatthewPL
jkoil
raffern
archita
glendall
nandnor

Account sellers:
 

Code:

roslinpl
Monzsta
Accountslegend

added user glandall to list (https://bitcointalk.org/index.php?action=trust;u=44649 proof: https://bitcointalk.org/index.php?topic=5190670#post_glendall )
added user nandnor to list (https://bitcointalk.org/index.php?action=profile;u=6 proof: https://bitcointalk.org/index.php?topic=1609612.msg16194427#msg16194427 )

[morvillz7z]

Guys what do you think about account jkoil? It was 100% sold and now the owner of the account claims that he got back his email address via google and therefore is again in control of his account. While I want to believe that this is true, without proof the buyer could easily claim the same. See here for reference: https://bitcointalk.org/index.php?topic=5405076.msg60525702#msg60525702 .
What I can see from https://bpip.org/Profile?id=206476 is that he for sure did not deal with bitcointalk recovery team. There is also no proof of dealing with google recovery team.

I checked the seclog myself, there are indeed no recorded dealings with the bitcointalk recovery team.

I'd say the account seller/new owner is trying to salvage their already neg trusted account by making up a sob story about how they were hacked.

I remember jkoil from 2014-2016 and he was a native English speaker. The new owner of this account is not.

^ Lol, Busted!

[lovesmayfamilis]

I already wrote on another topic that it is rather suspicious that a user who knows about various kinds of password generators allows his e-mail to be hacked.
In addition, his language has deteriorated significantly compared to the posts that were written earlier.

Looking back, this user knows how to create passwords....

Passwords, lost, stolen, ... the same "old" subjects Smiley
https://nextcoin.org/index.php/topic,1930.45.html
https://nextcoin.org/index.php/topic,2474.30.html

I still skip password generators and password managers Smiley  When being skeptic enough, nothing in the computer is in safe. At least a copy of the password must be written in paper/wood/rock/younameit in safe place.)

However, it didn't work for him, or he's not a real user.

Does anyone here believe in a quick response from Google support, and getting mail back on rather peculiar questions? And also does anyone remember the dates of creation of their emails?

[_BlackStar]

Does anyone here believe in a quick response from Google support, and getting mail back on rather peculiar questions? And also does anyone remember the dates of creation of their emails?

Not here, I'm sure it will take a little longer because the service will review it first. The one that best supports my assumption is because jkoil once said:

i am still trying it . but maybe hacker changed all my recovary. the hacker is much smart.

So the Google support team conducts a review first before sending the password reset link. I assume the restore action will take a bit of time as google is not as easy to believe in fairy tales. If he manages to recover his e-mail, that means he also knows how to prove ownership of his account here and I think he should do it to assuage those doubts.

[FatFork]

I already wrote on another topic that it is rather suspicious that a user who knows about various kinds of password generators allows his e-mail to be hacked.
In addition, his language has deteriorated significantly compared to the posts that were written earlier.

Clearly, this is meant to repair his trust score after the account changed hands. As nutildah pointed out, jkoil has a dramatically different language style now.

Does anyone here believe in a quick response from Google support, and getting mail back on rather peculiar questions? And also does anyone remember the dates of creation of their emails?

This is just not credible to me. I don't believe his email was compromised at all and he even contacted Google. Getting a reply from Google within a day is virtually impossible.

[logfiles]

<...>

Hey, just saw a Pm from you.

I am not the kind of person who would love to destroy someone's account, especially if they are the real owner. I need to be sure you are the original owner of the account and not the same account seller trying to trick us.

Could at least prove that you are indeed the original owner, like show us the recovery message from Google. I am pretty sure they sent one to you. Make sure you blur off any sensitive information, but be sure important things like the date the email was sent can be seen. It should have been easier if you have any staked Bitcoin address.

I will remove my tag if this is confirmed.