4 accounts that have likely been sold or stolen. Now advertising malicious sites

[logfiles]

A few weeks back Kittygalore was on my radar. The account had all of a sudden changed their password and email address despite not being active for months.

Yesterday the account changed the password again along with 3 other accounts.

Accounts involved:
1. Kittygalore
2. t3xasdolly
3. Mr.John19
4. endut15

Here are a few common things about this accounts
1. Password changes happened around the same time

https://bpip.org/Profile?id=1115371
https://bpip.org/Profile?id=94843
https://bpip.org/Profile?id=1139385
https://bpip.org/Profile?id=1068566

2. They are now advertising different "bridges" on their signatures and personal text area, some of which are phishing sites according to Metamask
Common sites on their signatures

Code:

polygonbridge.net
multichains.pro ---> Offline
iziswap.org
minswap.exchange
spookyswap.io
lumifinance.net ---> Not found
woofi.finance
curvefinance.net
arbitrumbridge.net ---> Metamask Phishing warning (https://metamask.github.io/phishing-warning/v4.0.0/#hostname=arbitrumbridge.net&href=https%3A%2F%2Farbitrumbridge.net%2F)

3. The posting style is the same after the hacks or ownership changes

4. The accounts we previously inactive for a long times.

[Jawhead999]

Here are the original sites:

portal.polygon.technology https://x.com/0xPolygon
woofi.com https://x.com/_WOOFi
izumi.finance https://x.com/izumi_Finance
spooky.fi https://x.com/SpookySwap

They're more clever now for not posting the link, instead they hide it on their signature, but they're forget if we have logs for changing password. I will leave negative feedback on their profile, good job @logfiles.

[ABCbits]

2. They are now advertising different "bridges" on their signatures and personal text area, some of which are phishing sites according to Metamask

In addition, they also advertise the malicious link on their profile page. I've seen SEO spammer also use this technique, where link on profile page remains even after the account got banned or nuked.

[Wonder Work]

3. The posting style is the same after the hacks or ownership changes
4. The accounts we previously inactive for a long times.

Wow, When I followed these accounts along with a few more when I store the daily data of the wake up account. Accounts have changed hands and maybe one person is trying to use so many accounts alone. However, they need to be dealt with and if they are not stopped, they will take the next steps as if they were not involved. Keep up your good job logfiles. 👍

[hugeblack]

I think the phishing/malware links rule works even if the link is in the signature so if you see any of them post such links report it to mods.
Overall it's a new thing in the past lower rank accounts were used for such scams.

[YOSHIE]

3. The posting style is the same after the hacks or ownership changes

Maybe you are, right that they changed hands or were hacked, from the four accounts you can take examples that lead to hacking, such as the @endut15 account, previously you could see the bounty hunter account.
The proof can be seen in the Spreadsheets in one of the Bounties.


In fact, he stopped posting in 2022 and in 2024-2025 started posting again, as seen in his profile on the spookyswap.io phishing site.


Which is more convincing that endut15, changed ownership, he used to post Indonesian local sections, and currently he is promoting the phishing site, here it is very clear that the spookyswap.io site does not have support in Indonesian, but:

Language Support: Website and apps now available in languages like Chinese, Korean, Spanish.

As I quoted above language support, this indicates that the person holding the endut15 account is no longer the original owner, but has changed hands.

[JollyGood]

Whether the accounts were hacked or sold, there is a growing market for this behaviour. If an account farmer sold the accounts, it means they are happy with their side hustle and if they were hacked, you have to ask how someone managed to hack four accounts and change their passwords within minutes of each other.

[dkbit98]

This accounts are connected for sure, I saw them use this ❓ question mark, we don't see that very often, and they are probably using some AI tools to generate their posts.
I don't know if this accounts are hacked or sold, but it is safe to assume they are part of the same farm group.
I wouldn't worry about them so much, but if I was a manager I wouldn't hire them in any of my campaigns.

PS
I just noticed that Kittygalore is a part of my ignore list, so he must be spamming for a while.

[logfiles]

Here are the original sites:

portal.polygon.technology https://x.com/0xPolygon
woofi.com https://x.com/_WOOFi
izumi.finance https://x.com/izumi_Finance
spooky.fi https://x.com/SpookySwap

They're more clever now for not posting the link, instead they hide it on their signature, but they're forget if we have logs for changing password. I will leave negative feedback on their profile, good job @logfiles.

Thanks, @Jawhead999, I am going to use this as a reference for the phishing site promotion that's going on. I have also left feedback and created trust flags just in case the mods don't ban the accounts

In addition, they also advertise the malicious link on their profile page. I've seen SEO spammer also use this technique, where link on profile page remains even after the account got banned or nuked.

Let me try asking in Meta why this is so?

I think the phishing/malware links rule works even if the link is in the signature so if you see any of them post such links report it to mods.
Overall it's a new thing in the past lower rank accounts were used for such scams.

I am working on it. Thanks


Trust flags for the 4 accounts, please support the flags
1. https://bitcointalk.org/index.php?action=trust;flag=3362
2. https://bitcointalk.org/index.php?action=trust;flag=3363
3. https://bitcointalk.org/index.php?action=trust;flag=3364
4. https://bitcointalk.org/index.php?action=trust;flag=3365

[yahoo62278]

Here are the original sites:

portal.polygon.technology https://x.com/0xPolygon
woofi.com https://x.com/_WOOFi
izumi.finance https://x.com/izumi_Finance
spooky.fi https://x.com/SpookySwap

They're more clever now for not posting the link, instead they hide it on their signature, but they're forget if we have logs for changing password. I will leave negative feedback on their profile, good job @logfiles.

Thanks, @Jawhead999, I am going to use this as a reference for the phishing site promotion that's going on. I have also left feedback and created trust flags just in case the mods don't ban the accounts

In addition, they also advertise the malicious link on their profile page. I've seen SEO spammer also use this technique, where link on profile page remains even after the account got banned or nuked.

Let me try asking in Meta why this is so?

I think the phishing/malware links rule works even if the link is in the signature so if you see any of them post such links report it to mods.
Overall it's a new thing in the past lower rank accounts were used for such scams.

I am working on it. Thanks


Trust flags for the 4 accounts, please support the flags
1. https://bitcointalk.org/index.php?action=trust;flag=3362
2. https://bitcointalk.org/index.php?action=trust;flag=3363
3. https://bitcointalk.org/index.php?action=trust;flag=3364
4. https://bitcointalk.org/index.php?action=trust;flag=3365

Flags supported, this type of behavior disgusts me. People put in lots of time and in some cases lots of effort to earn bitcoin and morons like this try to steal it. Just pure laziness!!!

Be great if we could track people who rob and steal and land em all in jail. Aside from trying to follow the blockchain btw, I'm talking like btc with a tracker embedded or something crazy. Something that allows people to find a physical address.

[JollyGood]

Coming from a mild-mannered individual such as yourself, this seems extremely out of character 

Having a facility to do that would be taking things a step too far. Of all the things I could have imagined being mentioned by any number of forum members, I did not see you making a statement that made me worried and giggle at the same time.

On a serious note, do you think the accounts were sold as a pack or they were hacked?

Be great if we could track people who rob and steal and land em all in jail. Aside from trying to follow the blockchain btw, I'm talking like btc with a tracker embedded or something crazy. Something that allows people to find a physical address.

[yahoo62278]

Coming from a mild-mannered individual such as yourself, this seems extremely out of character  

Having a facility to do that would be taking things a step too far. Of all the things I could have imagined being mentioned by any number of forum members, I did not see you making a statement that made me worried and giggle at the same time.

On a serious note, do you think the accounts were sold as a pack or they were hacked?

Be great if we could track people who rob and steal and land em all in jail. Aside from trying to follow the blockchain btw, I'm talking like btc with a tracker embedded or something crazy. Something that allows people to find a physical address.

I have never liked cheaters. Nowhere close to out of character. I think if these guys are trying to rob honest folks, they deserve to be hunted down and tossed in a cell somewhere at the least.

I see the sarcasm lol but I wanted to let those that might not k iw how much I dislike cheaters to k ow and not be confused. Some may not get your comment.

[The Sceptical Chymist]

Whether the accounts were hacked or sold, there is a growing market for this behaviour. If an account farmer sold the accounts<snip>

It's 2025, way after the merit system made account farming nearly impossible--or at least 100x more difficult than it used to be.  Even if this is an example of an account farmer, I find it hard to believe that the account farming problem that's been present for over a decade is getting worse.  Account sales?  I don't know.  I used to have my finger on the pulse of that shady market, but these days I really don't.

Where the hell are bitcointalk accounts being sold, exactly? 

Good work on catching and calling out this crap, OP and everyone else.

[JollyGood]

It's 2025, way after the merit system made account farming nearly impossible--or at least 100x more difficult than it used to be.  Even if this is an example of an account farmer, I find it hard to believe that the account farming problem that's been present for over a decade is getting worse.  Account sales?  I don't know.  I used to have my finger on the pulse of that shady market, but these days I really don't.

When barriers are put up, determined people manage to find ways around to fulfil their ambition. The merit system might have made it more difficult to increase member rank but as an example of just one account farmer, the sheer number of naim027 controlled accounts that were exposed show how bad the problem really could be.

He is not the only account farmer, there was the figmentofmyass and no doubt many others (I think he had two accounts simultaneously enrolled in the CM campaign). Many of them joined the forum after the merit system was introduced therefore there has to be some degree of success otherwise they would have given up.

Where the hell are bitcointalk accounts being sold, exactly?  

I found one seller on one well knowm website selling accounts and merits. There is definitely a market for it.

[logfiles]

Two more accounts had their passwords change again today and their signature spaces have been updated with the phishing links similarly just like the ones I had reported earlier on.
I wonder why mods are not banning these accounts.

I will try to make a report again

1. N9_Ninja
2. Cheffe

Flags:
> https://bitcointalk.org/index.php?action=trust;flag=3370
> https://bitcointalk.org/index.php?action=trust;flag=3369

[LoyceV]

A few weeks back Kittygalore was on my radar.

I've just received PM-spam from Kittygalore Banned! I know it's "not done" to post PMs publicly, so I'll only posts my Reason for reporting this PM:

Spam. This user has "censored" in his profile and spams it by PM. It reads like chatbot verbal diarrhea, so my guess is this user is spamming more users with "customized" spam messages.
I've never seen this before, and would appreciate a strong punishment so this doesn't become more common.

The PM "explains" plagiarism to me, which I recently posted about. That makes it a level of custom spam I haven't seen before. I'll tag this user and add it to my PM ignore list.

Update:

Autoban user: N/A in topic #0 by member #1115371

Accounts involved:
1. Kittygalore
2. t3xasdolly
3. Mr.John19
4. endut15

If those are alts, any PM they send now is ban evasion. They've all been active recently, so I guess they're all spamming.

[Lucius]

I received a PM from @Mr.John19 which is actually a comment on one of my posts in the Bitcoin discussion. There's no logic in him sending me a PM instead of replying in the thread, because it's not about anything that couldn't be written publicly.

I checked the negative feedbacks on his profile and that led me to this topic.

[Shishir99]

Good catch logfiles.

After the banning of mixers on the forum, it seems the accounts have become cheap, and the account buyers and sellers have started to do good business. Otherwise, I don't see how it actually worth buying these accounts just to promote those shitty phishing. I don't think any account owners will rent their accounts to these companies or those scammers, knowing they are going to promote phishing services. I mean, I can't think of anything else except that the account was sold, or maybe these are hacked accounts.

Too many accounts were hacked previously, and still, it seems the hacking continues. Isn't it alarming? Or is it the result of a Data breach? I guess that happened even before I came to this forum. This is what Mozilla Monitor shows https://monitor.mozilla.org/breach-details/BitcoinTalk

[logfiles]

I received a PM from @Mr.John19 which is actually a comment on one of my posts in the Bitcoin discussion. There's no logic in him sending me a PM instead of replying in the thread, because it's not about anything that couldn't be written publicly.

I checked the negative feedbacks on his profile and that led me to this topic.

I am just curious to know what he was trying to tell you 

Good catch logfiles.

After the banning of mixers on the forum, it seems the accounts have become cheap, and the account buyers and sellers have started to do good business. Otherwise, I don't see how it actually worth buying these accounts just to promote those shitty phishing. I don't think any account owners will rent their accounts to these companies or those scammers, knowing they are going to promote phishing services. I mean, I can't think of anything else except that the account was sold, or maybe these are hacked accounts.

Most of them are probably hacked. These usually happens even with accounts that are user to share links that have malware. The hacker thought that he could try to trick some users into clicking on the phishing links and using the scam services

[Lucius]

~snip~
I am just curious to know what he was trying to tell you 

There is nothing special about that PM that was intended for me in the sense that it should have been sent in that way at all - it could have been a completely normal post in the topic if for some strange reason that user had not decided to express their opinion in that way. It's obvious that whoever is behind all these linked accounts has some strange need to communicate with people through PM, although at least in my case the content of such messages is not something that could not be published publicly.