LTCGear.com SCAM - Enough is enough, lets get some info together

[NotAPonzi]

It seems there are some new WP Scans posted on http://pastebin.com. I'm not going to post them after all the shit last time.

Some interesting developments...

PM me the link please

[1713559056]

1713559056

[1713559056]

1713559056

[1713559056]

1713559056

[1713559056]

1713559056

[1713559056]

1713559056

[vipgelsi]

It seems there are some new WP Scans posted on http://pastebin.com. I'm not going to post them after all the shit last time.

Some interesting developments...

Can you share your thoughts on the interesting developments?

Thanks

[djm34]

It seems there are some new WP Scans posted on http://pastebin.com. I'm not going to post them after all the shit last time.

Some interesting developments...

Can you share your thoughts on the interesting developments?

Thanks

add a look to that but quite frankly I don't understand anything

[crazyivan]

It seems there are some new WP Scans posted on http://pastebin.com. I'm not going to post them after all the shit last time.

Some interesting developments...

Can you share your thoughts on the interesting developments?

Thanks

Yup, clarification would be nice.

[m3]

http://www.btcfeed.net/news/ltcgear-next-gawminers/

[PhilippeStevens]

That scan is very very shorter than the previous, what does that mean ? Security improved ?
Also, enumeration seems to be gone.

I'm just asking questions, don't know anything about it
Anyone can develop on it ? Danzor ?

[NotAPonzi]

Ok a little update, so it looks like Chris has been reading this topic and has taken some actions to hide his tracks even more

http://pastebin.com/VpQzEuhh
http://pastebin.com/kuruZ5mJ

Original User List:

Code:

+----+-----------------+-----------------+
    | Id | Login           | Name            |
    +----+-----------------+-----------------+
    | 1  | geegee          | Chris           |
    | 2  | cucu            | Vasile          |
    | 3  | ionion          | Ion             |
    | 4  | lavinia         | Vasilica Gigi   |
    | 5  | z34b19ry0       | z34b19ry0       |
    | 6  | johncena        | John Cena       |
    | 7  | anne            | Anne Smith      |
    | 8  | lavinia-schipor | Lavinia Schipor |
    | 9  |          |          |
    | 10 | dirtybit        | David           |
    +----+-----------------+-----------------+

New User List:

Code:

+----+----------+----------+
    | Id | Login    | Name     |
    +----+----------+----------+
    | 5  | johncena | johncena |
    | 7  | 0100110  | 0100110  |
    | 8  | 020btc   | 020BTC   |
    | 9  | 0nie13   | 0nie13   |
    | 10 | 0rphane  | 0rphane  |
    +----+----------+----------+

Basically the user list has changed from the original scan. All the "real" original accounts have been deleted. geegee/cucu/ionion/lavinia and a couple others. In addition he's started to add news as a sub page of farm payments instead of making a wordpress "post" like he used to. The only reason I can see for him doing that is because pages don't show who the author is like posts do.

It doesn't prove very much but it indicates two things to me:
1. He is reading these threads and watching what we say (seems highly coincidental he would make these changes without having seen the information posted here)
2. He has reason to try hide the above information

The scans also show that nothing besides those changes have occurred. No extra security, no additional plugins. What has happened in all that downtime? Seems like basically he's just spent the time trying to cover his tracks.

[Vertje]

First post here, i'm from the neighbors of litecointalk but I discovered something regarding the user-list of the Pastebin.
I was able to log-in on an account of the list and discovered the following:

https://litecointalk.org/index.php?topic=22870.msg248421#msg248421

Maybe it gives you more information. I'm at work now so I don't have the time to look into it.

[play4fun]

Ok a little update, so it looks like Chris has been reading this topic and has taken some actions to hide his tracks even more

http://pastebin.com/VpQzEuhh
http://pastebin.com/kuruZ5mJ

Original User List:

Code:

+----+-----------------+-----------------+
    | Id | Login           | Name            |
    +----+-----------------+-----------------+
    | 1  | geegee          | Chris           |
    | 2  | cucu            | Vasile          |
    | 3  | ionion          | Ion             |
    | 4  | lavinia         | Vasilica Gigi   |
    | 5  | z34b19ry0       | z34b19ry0       |
    | 6  | johncena        | John Cena       |
    | 7  | anne            | Anne Smith      |
    | 8  | lavinia-schipor | Lavinia Schipor |
    | 9  |          |          |
    | 10 | dirtybit        | David           |
    +----+-----------------+-----------------+

New User List:

Code:

+----+----------+----------+
    | Id | Login    | Name     |
    +----+----------+----------+
    | 5  | johncena | johncena |
    | 7  | 0100110  | 0100110  |
    | 8  | 020btc   | 020BTC   |
    | 9  | 0nie13   | 0nie13   |
    | 10 | 0rphane  | 0rphane  |
    +----+----------+----------+

Basically the user list has changed from the original scan. All the "real" original accounts have been deleted. geegee/cucu/ionion/lavinia and a couple others. In addition he's started to add news as a sub page of farm payments instead of making a wordpress "post" like he used to. The only reason I can see for him doing that is because pages don't show who the author is like posts do.

It doesn't prove very much but it indicates two things to me:
1. He is reading these threads and watching what we say (seems highly coincidental he would make these changes without having seen the information posted here)
2. He has reason to try hide the above information

The scans also show that nothing besides those changes have occurred. No extra security, no additional plugins. What has happened in all that downtime? Seems like basically he's just spent the time trying to cover his tracks.

let him read this, 1 month+ patient for him to deliver the payment, and now he is asking for tax, pretty silly, if he intended to run, better scrub off whats left or people will come to hunt him down.

[Danz0r77]

First post here, i'm from the neighbors of litecointalk but I discovered something regarding the user-list of the Pastebin.
I was able to log-in on an account of the list and discovered the following:

https://litecointalk.org/index.php?topic=22870.msg248421#msg248421

Maybe it gives you more information. I'm at work now so I don't have the time to look into it.

Which account is it?

[play4fun]

First post here, i'm from the neighbors of litecointalk but I discovered something regarding the user-list of the Pastebin.
I was able to log-in on an account of the list and discovered the following:

https://litecointalk.org/index.php?topic=22870.msg248421#msg248421

Maybe it gives you more information. I'm at work now so I don't have the time to look into it.

Which account is it?

you should check the post, indeed very suspicious i can tell

[Vertje]

First post here, i'm from the neighbors of litecointalk but I discovered something regarding the user-list of the Pastebin.
I was able to log-in on an account of the list and discovered the following:

https://litecointalk.org/index.php?topic=22870.msg248421#msg248421

Maybe it gives you more information. I'm at work now so I don't have the time to look into it.

Which account is it?

you should check the post, indeed very suspicious i can tell

I won't tell because I think it is a testing account of Chris. I send him a PM and the moderator of Litecointalk who has/had contact with Chris.
The mailaddress he used to create the account starts with: "geegee" that a direct link to the original user list

+----+-----------------+-----------------+
    | Id | Login           | Name            |
    +----+-----------------+-----------------+
    | 1  | geegee          | Chris           |

[djm34]

First post here, i'm from the neighbors of litecointalk but I discovered something regarding the user-list of the Pastebin.
I was able to log-in on an account of the list and discovered the following:

https://litecointalk.org/index.php?topic=22870.msg248421#msg248421

Maybe it gives you more information. I'm at work now so I don't have the time to look into it.

Which account is it?

you should check the post, indeed very suspicious i can tell  

I won't tell because I think it is a testing account of Chris. I send him a PM and the moderator of Litecointalk who has/had contact with Chris.
The mailaddress he used to create the account starts with: "geegee" that a direct link to the original user list

+----+-----------------+-----------------+
    | Id | Login           | Name            |
    +----+-----------------+-----------------+
    | 1  | geegee          | Chris           |

oh so he is that elusive percent of user (10k account 100 belonging to himself  )
by the way, your post on litecointalk must have been removed because didn't see anything.
If it is suspicious it would be nice to tell a little more, or at least a short summary...

ps: I promise, I won't ask why in the hell are you logging in other people account even though it is suspicious as well...
(nice protection if it is possible to log in Chris account btw... or may-be he is trying to trace people doing that...)

edit: a new pastebin is available showing the first 45 users... 
seriously is that site not even protected a little bit ? (if there is something clear, he is not working in improving the security...)

[Danz0r77]

edit: a new pastebin is available showing the first 45 users...  
seriously is that site not even protected a little bit ? (if there is something clear, he is not working in improving the security...)

Definitely recognize some names on that list

[djm34]

edit: a new pastebin is available showing the first 45 users... 
seriously is that site not even protected a little bit ? (if there is something clear, he is not working in improving the security...)

Definitely recognize some names on that list

a second list of 1000 users published (haven't seen the first one though...)

[damiano]

edit: a new pastebin is available showing the first 45 users... 
seriously is that site not even protected a little bit ? (if there is something clear, he is not working in improving the security...)

Definitely recognize some names on that list

a second list of 1000 users published (haven't seen the first one though...)

Where is the list?

[Vertje]

First post here, i'm from the neighbors of litecointalk but I discovered something regarding the user-list of the Pastebin.
I was able to log-in on an account of the list and discovered the following:

https://litecointalk.org/index.php?topic=22870.msg248421#msg248421

Maybe it gives you more information. I'm at work now so I don't have the time to look into it.

Which account is it?

you should check the post, indeed very suspicious i can tell  

I won't tell because I think it is a testing account of Chris. I send him a PM and the moderator of Litecointalk who has/had contact with Chris.
The mailaddress he used to create the account starts with: "geegee" that a direct link to the original user list

+----+-----------------+-----------------+
    | Id | Login           | Name            |
    +----+-----------------+-----------------+
    | 1  | geegee          | Chris           |

oh so he is that elusive percent of user (10k account 100 belonging to himself  )
by the way, your post on litecointalk must have been removed because didn't see anything.
If it is suspicious it would be nice to tell a little more, or at least a short summary...

ps: I promise, I won't ask why in the hell are you logging in other people account even though it is suspicious as well...
(nice protection if it is possible to log in Chris account btw... or may-be he is trying to trace people doing that...)

edit: a new pastebin is available showing the first 45 users... 
seriously is that site not even protected a little bit ? (if there is something clear, he is not working in improving the security...)

It is too bad that Litecointalk removed my post but I’ll give you a brief summary.

I looked at the pastbin with 10 usernames and I tried to log-in on the first one. The correct password was; “drumrolls”… test!. Now that I was able to log-in I took a look at the account and I found a working order history (see screenshot).

http://s24.postimg.org/n5nc5wext/ltcgear1.jpg
Besides the working order history I found that there were some suspicious orders, for example the 3K0 pack at 25dec for just 1$ (see screenshot).

http://s29.postimg.org/bgci2s64j/ltcgear2.jpg

At this moment I was doubting if this was a “fake” account, maybe one of the accounts who was messing with the shares and fake purchases etc. But the mailaddress uses to create this account starts with: geegee….@.....com. When I searched this mail address, I found out that is was linked to a certain website registered in Bucharest (where Chris supposedly lives).
The name geegee is also used in the oldest pastbin, so this was enough proof that this was really Chris his account.

+----+-----------------+-----------------+
    | Id | Login           | Name            |
+----+-----------------+-----------------+
    | 1  | geegee          | Chris           |


So, since I have no bad intentions with this account I changed the password (because if I can guess it, other people are also capable). Send an mail to Beekeeper, and informed the moderator at Litecointalk who has some direct contact with Chris.

This was all yesterday; at this moment it is still possible to login on this account.
If you have more question, feel free to ask

[LTCGearX]

So, Lavinia

She runs:
http://www.virtual-electronic.ro/

Domain is now offline.

Whois at http://www.rotld.ro/engleza/index_en.html shows:

Domain Info
Domain Name:

virtual-electronic.ro
Registrar:

ICI - ROTLD
Registration Date:

2004-02-23 00:00:00
Nameservers:

ns1.gazduire.ro
ns2.gazduire.ro
Status:

OK



   
Owner Data (Registrant)
Owner Name:

Virtual SRL
Address:

Str. Maica Domnului Nr.42
Address:

Sector 2
Address:

Bucuresti
City:

xx
Sector/County:

Postal Code:

70000
Country:

ROMANIA
Phone:

+40-021-2109207
Fax:

+40-021-2109207
E-mail:

lavy2003@hotmail.com



There is also the order for some fans:
http://www.ic886.com/ic/GB0535ADB2-8/datasheet/pdf/106850.html

More contact:
http://www.dioda.ro/WeblinksPro/l_op=viewlinkdetails/lid=173.html

[NotAPonzi]

So, Lavinia

She runs:
http://www.virtual-electronic.ro/

Domain is now offline.

Whois at http://www.rotld.ro/engleza/index_en.html shows:

Domain Info
Domain Name:

virtual-electronic.ro
Registrar:

ICI - ROTLD
Registration Date:

2004-02-23 00:00:00
Nameservers:

ns1.gazduire.ro
ns2.gazduire.ro
Status:

OK



   
Owner Data (Registrant)
Owner Name:

Virtual SRL
Address:

Str. Maica Domnului Nr.42
Address:

Sector 2
Address:

Bucuresti
City:

xx
Sector/County:

Postal Code:

70000
Country:

ROMANIA
Phone:

+40-021-2109207
Fax:

+40-021-2109207
E-mail:

lavy2003@hotmail.com



There is also the order for some fans:
http://www.ic886.com/ic/GB0535ADB2-8/datasheet/pdf/106850.html

More contact:
http://www.dioda.ro/WeblinksPro/l_op=viewlinkdetails/lid=173.html

Thank you for that info

[LTCGearX]

The company had some attention from Anonymous in 2013:
http://pastebin.com/T1v8iHGT
http://pastebin.com/rUBXXrcv

Unsure why.

Also, strangely, this Google search brings one Facebook user back:
https://www.google.co.uk/?gws_rd=ssl#q=bitcagetech%40gmail.com