[18:25] <A> yes?
[18:25] <C> hey man
[18:26] <B> hey
[18:26] <C> thx for coming
[18:26] <B> thanks
[18:26] <C> how did u find out that ip?
[18:26] <B> or in other words how did you even think to try that IP?
[18:26] <C> coz we are considering what all that shit can mean.. and we have strange thinks ;p
[18:26] <A> flare on darkcointalk found it, it no longer works...it is an ip from a test net node
[18:26] <A> cloak testnet
[18:26] <B> i see
[18:27] <C> yea i was thinking the same
[18:27] <C> did u tried to google that ip?
[18:27] <A> not yet
[18:27] <C> can u link us to flare post?
[18:27] <B> could you link us to the thread please
[18:28] <A>
https://darkcointalk.org/threads/cloaksend-2-0-posa-fake-or-legit.1868/page-3#post-15554[18:28] <B> thanks
[18:29] <A> my thoughts are either the devs are also the mol devs, or someone in the private testing was the mol dev
[18:30] <C> kk thank u for helps
[18:30] <B> thanks for the clarification
[18:31] <A> the ip also shows up is some old doge threads, just googled....
[18:31] <A> who knows
[18:31] <B> i see
[18:32] <B> hmm i'll guess I'll have to spend some time on this
[18:33] <A> i dont know what criteria there was for private testing,...im going to keep googling testnet ips and look for a pattern
[18:34] <B> I'll try that too
[18:34] <A> k
[18:49] <A> so it looks like this is a digital ocean ip, and its been used as a seed node in a bunch of cryptos, mol, qrk, V, plus a russian shibe thread
[18:50] <C> lol what does it mean?
[18:51] <C> A: ?
[18:51] <A> someone set up an instance with digital ocean to act as a seed for these coins. Looks like a cloak node was setup there as well. the name registration on the ip may just be a coincidence
[18:52] <C> the same person?
[18:52] <A> that i dont know
[18:52] <C> is there a posibility that were diffrent people?
[18:52] <A> yes
[18:52] <C> how?
[18:52] <B> are the servers at digital ocean Virtual machines?
[18:53] <A> yes, vm's, digital ocean is popular, so its possible two unreleated users ended up with the same ip months apart. I just think the fact that this ips is being used repeatedly for seed nodes is unusual, unless the ip is static and continuous managed by a single person
[18:54] <A> if thats the case, the ip is static for a long run instance, it means a single person is behind all these nodes
[18:55] <B> ya
[18:55] <B> wondering if we could ask digital ocean how they deal with IPs
[18:56] <A> it would probably be on their site, static ip would be a popular option
[18:56] <B> I'll take a look
[18:56] <A> solved....
[18:57] <A> what for this
[18:57] <A> wait
[18:57] <A> ....
[18:57] <A>
https://who.is/whois/blocks.moleculecoin.com[18:58] <C> that.. doesnt give us any hint i think?
[18:58] <C> its panama...
[18:58] <C> or i am wrong?
[18:59] <A> ok i might have jumped the gun
[18:59] <A>
https://who.is/whois/cloakcoin.com[18:59] <A> both identicle, but its the same company, whois guard
[19:00] <C> its namecheap?
[19:00] <C> or namecheap is only registrator?
[19:00] <C> and panama is the buyer?
[19:00] <B> its whois guarded
[19:00] <A>
http://www.enom.com[19:01] <A> was used to register both domains
[19:01] <C> but reseller is namecheap?
[19:01] <C>
https://www.namecheap.com/legal/whoisguard/whoisguard-agreement.aspx[19:02] <B> namecheap is the reseller of the whois guarded thing i think
[19:02] <A> yes, my point was there is another coincidence
[19:04] <B> ya
[19:04] <A> the ip also shows in the code for version coin, and versioncoin.com was also registered with enom.com
[19:05] <A> it looks like the same group, using the same services for multiple coins
[19:06] <B> yup
[19:07] <B> thats not good
[19:07] <A> digital ocean confirms static ip
[19:07] <A>
https://www.digitalocean.com/community/questions/are-digital-ocean-s-ip-addresses-static[19:08] <C> but diffrent vm can get same ip as well?
[19:08] <B> but they are static
[19:08] <A> i dont think so
[19:11] <A> who wants to paste this into the cloak thread
[19:12] <C> dont
[19:12] <A> haha
[19:12] <B> one sec
[19:12] <B> checking other coins too
[19:13] <C> lol
[19:14] <A> i dont hold any cloak, i got out of a small position at 0.002, it just smells bad to me
[19:14] <B> can you keep this between us for now, doing whois lookups on other shitcoins
[19:15] <A> yes
[19:15] <C> i am tryign to contact digital ocean
[19:15] <C> to find out about ips
[19:16] <A> i posted a link above
[19:16] <C> nyway ti dont see livechat there ;/
[19:17] <B>
https://who.is/whois/antimatter.cc[19:17] <B>
https://who.is/whois/versioncoin.com[19:17] <B>
https://who.is/whois/cloakcoin.com[19:18] <B>
https://who.is/domain-history/moleculecoin.com[19:18] <B>
https://who.is/whois/atocoin.com[19:18] <B>
https://who.is/whois/vault-coin.com[19:18] <A> thats a lot of shit coins to be registered by a single provider
[19:18] <B>
https://who.is/whois/libertycoin.co/[19:19] <B> looking for more
[19:24] <B> you guys find anymore?
[19:24] <A> not yet
[19:25] <C> i am trying to reach same ip case
[19:25] <A>
http://www.whois.com/whois/fireflycoin.com[19:26] <B>
https://who.is/whois/probecoin.com[19:27] <B>
https://who.is/whois/theshibecoin.com[19:27] <A> ok so what are the odds that entirely different devs used the same site to register these domains...shibecoin.com is on digital ocean aswell
[19:28] <C> it is possible ever to find same pattern in diffrent pack of coins?
[19:29] <A> the other coins ive check use godaddy or random companies
[19:29] <C> digital is used for many peoples
[19:29] <C> by*
[19:29] <B> ya found some godaddy but godaddy is very popular
[19:29] <C> buy u mean same ip as well?
[19:29] <C> but*
[19:30] <A> yes that was my original point, digital ocean is used by many people, but the same ip at digital ocean is linked to multiple coins, which are linked to the same registrar, it looks like the same group
[19:31] <C> lets say registration is pretty anon
[19:31] <C> coz it could be paid by btc as i remember right?
[19:31] <C> what about digital? is there way to pay anonymously for that service?
[19:31] <A> it could be anyone, but it looks everything is channeled through a common link
[19:34] <B> nop enom only accepts credit cards just tried buying a domain
[19:35] <C> but namecheap
[19:35] <C> allows btc
[19:36] <B> let me see
[19:36] <C>
https://www.namecheap.com/support/payment/bitcoin.aspx[19:37] <B> but did they register the domain at namecheap or at enom? seems they paid for the whois guard service offered from namecheap
[19:37] <A> thats what i think, enom is listed primarily
[19:38] <C> for me its looks like that namecheap bought domen from enom
[19:38] <C> but i dont really know how buying domens works
[19:39] <A> Domain Name: CLOAKCOIN.COM Registrar: ENOM, INC. Whois Server: whois.enom.com Referral URL:
http://www.enom.com[19:40] <A>
http://www.webhosting.info/registrars/reports/total_domains/ENOM.COM[19:41] <A> enom owns 8% of the market, so it is unlikely that random people all used enom. It is more likely a single person who is used to them used it
[19:42] <B> found this:
http://www.webhostingtalk.com/showthread.php?t=1111525[19:43] <B> and this:
http://www.blackhatworld.com/blackhat-seo/black-hat-seo/617450-difference-between-enom-namecheap-i-need-some-help.html[19:45] <B>
http://www.warriorforum.com/main-internet-marketing-discussion-forum/940369-namecheap-still-reseller-enom.html[19:46] <B> might explain it more clearly here:
http://davezan.com/does-enom-own-namecheap.html[19:48] <B> check the whois of the sites for various coins i listed
[19:48] <B> reseller: Namecheap
[19:48] <A> well i think its likely that some of those shit coins are coincidence, but we can definitley link cloak, molecule, and shibe to the same static ip
[19:50] <B> might be a coincidence too
[19:50] <B> but this is what concerns me
[19:50] <B> look:
https://bitcointalk.org/index.php?topic=478176.60[19:50] <B> check this post out
[19:51] <B>
https://bitcointalk.org/index.php?topic=478176.msg5454949#msg5454949[19:51] <A> and versioncoin
https://bitcointalk.org/index.php?topic=478176.msg5454949#msg5454949[19:51] <B> notice anything?
[19:51] <B> thats got me wondering
[19:51] <A> yep we both posted the same thing
[19:51] <A> a hard coded node
[19:51] <B> lol ya
[19:51] <B> ya
[19:52] <B> the first one before the source was even pushed onto github
[19:52] <B> not even
[19:52] <B> so there's some possibilities here
[19:52] <A> so you think we uncovered a massive shit coin operation or what?
[19:52] <B> not sure
[19:52] <B> we have some theories
[19:53] <B> either
[19:53] <B> one of the devs or someone in the private testing of PosA was a former dev
[19:53] <A> yes i think thats clear
[19:53] <B> and used their server as a testnet node
[19:54] <B> or the server is Alty's
[19:54] <B> wish I could find out the entire list of tests on testnet
[19:54] <B> link bct usernames, go through their posts
[19:55] <A> i am
[19:55] <B> lets say that ip were to get ddosed what would happen?
[19:58] <B> i guess nothing seeing that the server must of been shutdown
[19:58] <A> staycrypto, who hardcoded the ip into version coin, also worked with cagecoin
https://bitcointalk.org/index.php?topic=451389.msg5397476#msg5397476[19:59] <A> his last post was in april
[20:00] <B> i see
[20:00] <B> that blocks.moleculecoin.com is that block exxplorer?
[20:02] <B> checked molecule's thread that link is no where to be seen
[20:02] <A> i dont know, its offline, yes i cant find it either
[20:03] <C> gf, what about molecu coin ? i saw same ip somewhere there anything more?
[20:04] <B> no the server was shutdown
[20:04] <B> what bothers me more is that MrRGnome wouldn't answer about the image when someone asked
[20:04] <B> like he intentionally ignored it and changed the subject
[20:05] <A> your post was erased
[20:05] <C> he is in main dev team?
[20:05] <C> or second one?
[20:05] <B> i deleted it
[20:05] <A> oh ok, i didnt see it at all, i noticed you were the most recent message, but i didnt read it
[20:06] <B> i was going to try and explain why that showed up but after googling my answer would be wrong
[20:08] <B> in the irc
[20:09] <C> other he knows more about that from inside or other he is fucked up with all fud that comes into irc/thread
[20:09] <C> anyway sb turn off server/node minutes after u A put screen on btcthread
[20:09] <A> yes i noticed that
[20:10] <B> thats what i can't seem to forget
[20:10] <C> i am curious how drk's dev find it out
[20:11] <B> he must of been trying to check PoSA out, turned to test net to see the peers
[20:12] <B> tested the IPs one by one until getting a hit on one of them
[20:13] <A> im going to nslookup current nodes and see if anything is registered
[20:13] <C> to connect to testnet
[20:14] <B> <@MrRGnome> Huge difference between an actual concern about the protocol and a logline in a pic
[20:14] <B> only response to that image
[20:14] <C> i need to put testnet=1?
[20:14] <B> after that a whole new discussion started
[20:14] <C> in conf file?
[20:15] <C> eh i should make a coffee
[20:17] <B> i got into testnet should it start getting peers automatically that are still in the testnet?
[20:18] <C> if wallet will find it yes
[20:18] <B> k
[20:18] <C> but i am not sure if wallet will find any
[20:18] <A> 95.85.37.194 = dogesms.com
[20:19] <C> A: its from node lists?
[20:19] <A> yes, mainnet
[20:19] <C> tbh it can be anyone
[20:19] <C> but i will find if this page is scam or sth
[20:19] <C> godaddy
[20:20] <A> Juha Kovanen
[20:20] <B> anyone faimilar?
[20:22] <A> probably just a regular node, we need to find an ip thats linked directly to a coin
[20:22] <B> maybe check the node list at the block explorer
[20:23] <C> there are like 70 or 100+ ip addreses
http://cloak.blockexplorer.cc/nodes/[20:23] <B> ya maybe look at the .33 ones possibly?
[20:23] <A> yes ive gone though about 30
[20:24] <C> ok lets split tje job
[20:24] <C> just check them in google?
[20:24] <C> or same as in screen drk devs did?
[20:25] <B> k
[20:25] <B> brb got to grab something to eat
[20:26] <C> so nslookup ip googlednd?
[20:26] <C> dns*
[20:26] <A> heres one
[20:26] <A>
https://cryptocointalk.com/topic/11782-slimcoin-slm-information/[20:26] <A> one of the original slimcoin nodes is now a cloak node
[20:26] <A> 107.181.250.216
[20:27] <C> \https://darkcointalk.org/threads/help-test-rc2-forking-issues.1009/page-43
[20:27] <A>
https://bitcointa.lk/threads/ann-slimcoin-proof-of-burn-new-block-gen-mineable-by-low-power-computer.315729/[20:27] <C> also here ^^
[20:28] <C> its just a regular pc or vm for wallets probally
[20:29] <C> nah
[20:29] <C> its tor exit node
[20:29] <C>
http://cy-int.com/records[20:29] <A> yes there are a lot of exit nodes on the list
[20:30] <C> can it be connected with tor "anon"for cloak wallet?
[20:30] <C> like we should see tor nodes in tor way of addresses?
[20:32] <A> i dont know
[20:33] <C> tor no matter if its safe or not, but many peoples still uses it to create feeling of anon
[20:38] <A> was anyone able to connect to any testnet nodes? im not finding any
[20:39] <C> i am trying atm
[20:39] <C> with standart node list
[20:39] <C> standard*
[20:39] <C> but so far no connection
[20:43] <A> same as mine
[20:44] <B> saem here doesnt connect
[20:45] <B> maybe we need to use a different version
[20:48] <A> 146.185.149.201 is a seed node for version coin, nslookup shows woof.moonmooncoin.com a particle block explorer
[20:50] <A> 162.243.234.210 is both seed2.versioncoin.com and seed.moleculecoin.com
[20:51] <C> and appear also at atomcoin
[20:51] <C> and shibe
[20:51] <C> and again its digital ocean
[20:51] <A> yes digital ocean
[20:54] <C> eh i am really fuckin confused right now
[20:59] <A> I think the evidence is pretty clear, devs from different coins have been colluding for a while now, or its the same group
[21:00] <C> yea:/
[21:04] <B> sad
[21:04] <B> i guess that explains why everything was open sourced
[21:04] <B> devs not revealing themselves
[21:05] <B> wondering if PoSA is real or not
[21:05] <B> or onemarket for that matter
[21:17] <A> a coin coin seed 37.59.21.199 also points to
www.verters.com vertcoin
[21:17] <A> jade coin
