harizen - ban appeal

[harizenbanappeal]

After 3 days off, I was shocked that my forum account, harizen, got banned and locked today.
https://bitcointalk.org/index.php?action=profile;u=458393

Exploring what kind of sh*t happened while I'm off, I've seen this thread in the Scam Accusation thread:
https://bitcointalk.org/index.php?topic=5469184.0

Clearly, I'm not the one who posted that and I don't know how it's possible that someone got access to my account where I know in the first place the security measures in taking care of my personal account, not just here in the forum. I will never post such malicious posts.

I don't know what's the chance of getting my account unlocked but I'm hoping.

I already sent an email to the address given on the error message.

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
My account harizen has been hacked/lost. Please reset the email to mirglobalbtc@gmail.com. The current date is October 5, 2003.
-----BEGIN SIGNATURE-----
12tNRHh7q51F2TnVr45hwNH9u1kqHNrgem
IIMhqRIOc18cGvl9IlnqLDMPWjVsN1Ms61bHcZX1TnXtSeQhLn18vEgVl5YdNZyxPYMXFryQR1bbEf3ufa90iJo=
-----END BITCOIN SIGNED MESSAGE-----

Here is the unedited post where I posted that address: https://bitcointalk.org/index.php?topic=996318.msg24176166#msg24176166

[1714530487]

1714530487

[1714530487]

1714530487

[1714530487]

1714530487

[hosseinimr93]

Are you sure your account has been banned? What's the message you see after you login to the forum?

There is no record of ban for your account on modlog which means that the account has not been banned. Of course, since temporary bans are not displayed in the modlog, there's a chance that your account has been banned temporarily.

[harizenbanappeal]

What's the message you see after you login to the forum?

There is no record of ban for your account in modlog which means that the account has not been banned. Of course, since temporary bans are not displayed in the modlog, there's a chance that your account has been banned temporarily.

Sorry harizen, you are banned from using this forum!
For security, your account has been locked. Email ...

Anyway, I already followed the instructions here and hoping for good progress.
https://bitcointalk.org/index.php?topic=5089777

[Nwada001]

Since you don't know how your account was accessed and the malware link that was dangerous for others was posted here, I will advise you to take security measures into consideration first as to enhance your security, as I can see that your account password has not yet been changed and was also not changed at the time of the incident.
 
If the password was not changed, anyone who did this might have used your device or a device you last logged in with, or the person who has access to your password, which you should change even though the account is still banned.

[shahzadafzal]

Sorry harizen, you are banned from using this forum!
For security, your account has been locked. Email ...

Anyway, I already followed the instructions here and hoping for good progress.
https://bitcointalk.org/index.php?topic=5089777

That's sad, not sure what you can do in this situation. seclog does not show any thing like Password change etc to suspect account hack.

That means your password was probably compromised and someone was able to login and post that thread.

Your only chance of getting back your account back is proving that your account was hacked. I guess moderators might not have access to your IP addresses and only theymos have such access. He can verify if that topic was created from some what "different ip/location", and also if your hacker was in your pc then good luck.

[hosseinimr93]

Considering the message and given that there's no record of ban on modlog, it seems that you didn't get banned and your account is locked. There's a probability that someone tried to reset your password using your secret question.
See the topic created by achow101: PSA: ACCOUNTS WILL BE LOCKED IF THE SECRET QUESTION IS USED TO RECOVER IT.

Since you signed a message from your staked address and sent an email to the provided email address, I think your account should be unlocked.
Just wait.

[logfiles]

That's sad, not sure what you can do in this situation. seclog does not show any thing like Password change etc to suspect account hack.

That means your password was probably compromised and someone was able to login and post that thread.

That's what those hackers do. They no longer change passwords so that the owner of the account won't be alert through their email address that the password has been changed. All they do is log into the compromised account and the post links to malware

If the owner of the account or the mods are not attentive enough, this can appear as though the real own of the account made such a post.

Anyway, good luck to Harizen on recovering his account and perhaps a reminder to use stronger passwords, different passwords for different sites and avoid malicious apps or browser extensions on his device.

[Xal0lex]

It will not be easy to restore this account. Because it is unknown how deep the hackers penetrated the account. What if they accessed the email, the private wallet keys, and anything else that can be accessed. Maybe this person's computer was hacked and the hackers accessed everything that was possible. Where is the guarantee that this didn't happen? It's just my opinion. At any rate, good luck in recovering your account.

[albon]

That's what those hackers do. They no longer change passwords so that the owner of the account won't be alert through their email address that the password has been changed. All they do is log into the compromised account and the post links to malware

If the owner of the account or the mods are not attentive enough, this can appear as though the real own of the account made such a post.

Anyway, good luck to Harizen on recovering his account and perhaps a reminder to use stronger passwords, different passwords for different sites and avoid malicious apps or browser extensions on his device.

I have another assumption that if his computer was hacked. His forum account was open on the browser, and logged in; the hacker could, when he finds the computer idle, control the mouse and keyboard and publish what he wants through the account because he cannot change the password or email if he does not get them through the keylogger or text documents.

@Harizen, I wish you all the best in returning to your account after the administrators review what you provided and unlock the account. I believe it was locked as a security precaution after the scam ANN topic was published from it.

Now, all that must be done is to find out the real reason that the hacker was able to access your account; you should think and review what you did before this happened. I also advise you to use another device and change the complete account security information if your account has been unlocked until you make sure of this hacker; he cannot reaccess the account again.

[PX-Z]

It will not be easy to restore this account. Because it is unknown how deep the hackers penetrated the account.

Is it the verification or signing a message of the staked address and the email used is enough for account recovery? regardless how the hackers able to access all of those you mentioned?

If that's really the case, OP should reset its account password, email associated to its account, and lastly reset/reformat its device to a new one.

[Husires]

If you are not using Tor and the IP address is the same for the past months, this will be useful.

Do you have contact with a trusted person in this forum, such as your phone number, or have you been communicating for years on Telegram or any platform outside this forum? You can send him a message and ask him to confirm that you are the real owner of this account.
Try as much as possible to provide data and add information that the hacker cannot know.

It will not be easy to restore this account. Because it is unknown how deep the hackers penetrated the account. What if they accessed the email, the private wallet keys, and anything else that can be accessed. Maybe this person's computer was hacked and the hackers accessed everything that was possible. Where is the guarantee that this didn't happen? It's just my opinion. At any rate, good luck in recovering your account.

This can be confirmed if there has been a change in the writing style in recent days compared to previous months. The account has a long record of posts.

[tranthidung]

If you are not using Tor and the IP address is the same for the past months, this will be useful.

Harizen can check his IP last 30 days https://bitcointalk.org/myips.php. If real owner and hacker both use Tor, it can not help to detect suspicious login sessions.

Do you have contact with a trusted person in this forum, such as your phone number, or have you been communicating for years on Telegram or any platform outside this forum? You can send him a message and ask him to confirm that you are the real owner of this account.
Try as much as possible to provide data and add information that the hacker cannot know.

Account recovery is possible but it does not mean the account will not be hacked again if a PC, laptop, phone and email already all compromised. It's hard to prove that the account will be safe after recovery.

The account is likely locked, not banned. The reference case shows how recovery is difficult if the hacked person still use same devices after recovery, account might be hacked again like kenzawak!

Good luck to the real owner and hopefully he will recover his account successfully as well as no victims from the malicious files so far.

This case reminds me about kenzawak.
kenzawak hacked (again)
Account "kenzawak" compromised again

As Halab mentionef, the account is already locked.
Follow the instructions here please: https://bitcointalk.org/index.php?topic=5089777

[LogitechMouse]

It took me I think or more than a week when I experienced the same thing. My account got hacked last year, and with that, I knew that the email that I used in this account is being pwned (I think this is the term they used correct me please if I'm wrong). I changed my email, used an email that hasn't been used ever since, but created for quite some time, and until now, it's been all good in the hood.

Just wait for it I guess since you have your signed address up there. It took longer for me because I need to find where did I put the seed phrase of my address where I put my sign here. Luckily, I found it or my account will be gone forever. Good Luck, and that will be temporary OP. I guess change your email to an email that hasn't been used in anything. Worked for me. Of course, be careful as well.
P.S. @tranthidung, yes unfortunately. It says "Pwned in 3 data breaches and found 3 pastes (subscribe to search sensitive breaches)"
Yes currently, I'm not using that email anymore, and the worst thing is that, I'm always receiving random emails from potential scammers. Not annoying for me though. I guess that hacking incident that happened to me with my account is what I considered as "blessing in disguise" since I learned something from that mistake.

Anyway, thanks for sharing that links. Bookmarked it already.

[tranthidung]

It took me I think or more than a week when I experienced the same thing. My account got hacked last year, and with that, I knew that the email that I used in this account is being pwned (I think this is the term they used correct me please if I'm wrong).

Is your email shown as pwned with https://haveibeenpwned.com/ ?

I changed my email, used an email that hasn't been used ever since, but created for quite some time, and until now, it's been all good in the hood.

Abandon your pwned email is good but hackers might have deeper access to more of your accounts and even your devices are compromised too.

Old or new email, using a strong password is important too because weak passwords are easily to be bruteforced.

• Are your passwords in the green ?
• [GUIDE] How to Create a Strong/Secure Password

[harizenbanappeal]

Thanks, everyone for the input!

This is really strange. I mean how??

I still don't know how that hacker was able to breach my account. I tried to recap what I did these past days and weeks. As an internet guy for a long, basically, I know the basic and advanced safety measures for protecting my personal account. Although there's no 100% guaranteed protection, I'm really sure I didn't do some crappy moves that lead to this. My Bitcointalk account was only accessed here in my IP's home and on my mobile data (single network) when away.

No downloading attachments, no downloading apps, not entering any inputs on a field, etc.

I don't welcome any random apps, browser plugins, extensions, etc. from random sources on my PC. It's been well protected by me for years and this is actually the first time I got to this kind of situation. Aside from that, all my keys, passwords, and any personal stuff can't be found on my PC, email, notepad, files, etc. as I stored those on my external flash drive and a backup USB drive.

In the first place though, I'm glad that my account got locked right away after posting that thread as it might do some sh*tty moves. I was around 2-3 days offline until I realized that my account was compromised. Hopefully, I can get back my beloved account.

It took me I think or more than a week when I experienced the same thing. My account got hacked last year, and with that, I knew that the email that I used in this account is being pwned (I think this is the term they used correct me please if I'm wrong). I changed my email, used an email that hasn't been used ever since, but created for quite some time, and until now, it's been all good in the hood.

Hey Kabayan.

Did you just send an email to the provided address and just wait? No follow-up?  

[lovesmayfamilis]

This is not the first time that we have seen a good user banned, obviously through no fault of his own. Nevertheless, it would be useful to ask the OP if you have any guesses as to how it could have happened that another person used your account. This is useful to all of us, and you will do a great job if you tell us what was asked last time. What system do you have? Browser? Do you use shared Wi-Fi, and are you the only owner of your device? In addition, could there be a click on a phishing link? All questions seem naive; however, these are the most obvious holes through which a hacker can get to the user.

[Lucius]

~snip~
I still don't know how that hacker was able to breach my account. I tried to recap what I did these past days and weeks. As an internet guy for a long, basically, I know the basic and advanced safety measures for protecting my personal account. Although there's no 100% guaranteed protection, I'm really sure I didn't do some crappy moves that lead to this. My Bitcointalk account was only accessed here in my IP's home and on my mobile data (single network) when away.

It is more obvious that you made a wrong step somewhere, because if this were not the case, someone else would not have gained access to your account. Regardless of where you store your login information, the moment you enter it in your browser, it becomes vulnerable if you have a keylogger or RAT on your computer or smartphone.

Did you check your IP logs as advised by @tranthidung, do you see the IP address the hacker used?

[LoyceV]

What if they accessed the email, the private wallet keys

If OP deposits into his staked address, he'll find out if it's compromised....

Harizen can check his IP last 30 days https://bitcointalk.org/myips.php.

As far as I know, that works when you're banned, but not when your account is locked.

I still don't know how that hacker was able to breach my account.

The only safe assumption is that anything is compromised now. Which means you'll have to wipe your computer, reinstall everything from scratch, change all your passwords, and restore your user data from backup.
While you're at it:

Don't reinstall your OS - switch to Linux. Mint is fairly close to Windows if you are not familiar with Linux.

[goxcraft]

Explain the whole situation from start to end in your appeal. And sign your staked address to prove that you are still the owner of this account, at this moment. By the looks of it, somehow a hacker managed to guess the password and used it to post malicious thing! Are you sure it was not someone you know personally? If it was a hacker, there was no point in spaming the forum. Rather he would try to sell as soon as possible. Just my assumption.

[NotATether]

I still don't know how that hacker was able to breach my account. I tried to recap what I did these past days and weeks. As an internet guy for a long, basically, I know the basic and advanced safety measures for protecting my personal account. Although there's no 100% guaranteed protection, I'm really sure I didn't do some crappy moves that lead to this. My Bitcointalk account was only accessed here in my IP's home and on my mobile data (single network) when away.

Perhaps some cybercriminals were able to extract your Bitcointalk session cookies and sell them on a darknet marketplace while you were away (this can be mitigated by logging out and back in again).

Or maybe a low-tech explanation is that somebody got access to a device you were logged in to Bitcointalk with, or they got your username/password, and then they started to make the malware posts.