Bitcoin Forum
November 04, 2024, 10:48:37 PM *
News: Latest Bitcoin Core release: 28.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: « 1 2 3 4 5 6 [7] 8 9 10 »  All
  Print  
Author Topic: Stolen account yussuf89  (Read 8939 times)
Quickseller
Copper Member
Legendary
*
Offline Offline

Activity: 2996
Merit: 2371


View Profile
February 23, 2015, 08:04:56 PM
 #121

https://bitcointalk.org/index.php?topic=764034.msg8610073#msg8610073
Hacker/scammer took out the loan to this address: https://blockchain.info/address/1HQATDRExXexyCc2hHJ8F272evTgm21JZ4

A week ago that address made this transaction where the guy identifies his skype address: https://blockchain.info/tx/c998155f548d0a4ce3c1b311c76c89b4ce13a4489dcf6b5550cea74f73cd23a9

Skype: Nizamhekker

He uses it a lot, just google it and a bunch of hackforums results come up.

Here is one of his btctalk accounts: https://bitcointalk.org/index.php?topic=742872.msg8397265#msg8397265
https://bitcointalk.org/index.php?action=profile;u=164938

Here is another one: https://bitcointalk.org/index.php?topic=857347.msg10001956#msg10001956
https://bitcointalk.org/index.php?action=profile;u=380653

Take the BTC address (1DwQxpZGC5e7ZkR1xbagAmJcaHmU88v5aj) from nizamcc's post and you also find this account: https://bitcointalk.org/index.php?topic=764034.msg8610073#msg8610073
https://bitcointalk.org/index.php?action=profile;u=372665

Both nizamcc and YOLOMAN have fake positive trust from the same sock account: https://bitcointalk.org/index.php?action=trust;u=348988

Confident they are the same person. Anyway, let me know if you can find anymore of his accounts/info about him before I post a scam accusation. 

Edit: my response
I also find it interesting as to just how much whoever got the loan was gambling, there was ~19 pages worth of transactions to/from luckyb.it addresses when looking at blockchain.info. However only ~1.5 pages of those were from after the transaction of the loan. While scrolling through all the transactions, I noticed that he made a few very large bets, one for .25BTC, one for ~.31BTC, among others. Additionally it looks like his bankroll started with 11 BTC. Actually no, he spent that here, which was later spent here which was likely depositing it into either a casino or some other service/site that holds funds on behalf of others. It looks like his initial bankroll was 1.8 BTC (here, here, and here), he then gets a series of <.01 BTC transactions into that address, until he starts playing luckyb.it. He later send ~1.1 BTC to the address (here and here). He sent another ~3 BTC (here, and here).

I lost track of how much he sent to other addresses then luckyb.it address, however one of note is thiswhich sent ~3.1 BTC to some other address. I would say that he likely sent around between 1.5 and 2.5 BTC to other addresses in addition to the above transaction. This is strange because it implies that he was roughly 'even' with his gambling with that specific address.

It looks like this transaction sent .005 to an address tagged as 'lucky bit promo', I am not sure what it is, however a forum search comes up with nothing, and I am having trouble accessing my VPN via foreign country gateways so I can't access luckyb.it appearing to be outside of the US. It is probably a dead end, but it could lead somewhere. I know luckyb.it was running a contest where people could guess the time of the millionth bet if they sent funds to a luckyb.it address, however it is not that one.

The 11 BTC amount is interesting because it is very close to what moreia stole in his ponzi with williamj. There are a small number of people that have that much bitcoin. This was my gut feeling from the start and was somewhat confirmed by him saying that he clicked on a link from the PD chat that likely contained some kind of malware. Moreia has a history of spreading malware, and either him or someone else did a very similar thing on Coinichiwa to Neonecrox13 (convicted2008).
They just posted the link to it. I can't remember their name but they did again the next day after it happened while I was on there talking told RedsnOw to ban them, that link was the only thing I"ve ever downloaded and I got robbed. But yeah I installed a antivirus and did a system backup to a few days prior to this happening. I know u probably think I know them or something, but honestly before now I've never heard of them before. After I downloaded the antivirus I did have like 3 or 4 it said. I think I can still get to it shows the names and what they were in.
Ask Redsnow if they are anyway he can get the chat logs from Coinichiwa on Jan 23 and 24th. Im fairly sure it was that day that I downloaded it, but it could have been the day before I'm not sure. But I do know that the name of it was 999dice.exe. I know that don't help at all though. Also let me check and see if I can find anything on my computer from that date. I'm not sure I can though where I did a system back up. But I will look.
https://i.imgur.com/4cCSRR6.png

https://i.imgur.com/QCCP9Hz.png

https://i.imgur.com/L8HcWGP.png



The webaddress is www dropbox com s hbosomsnyicqxtf 999dice.exe?dl=0 <---maleware

Like I said though, it says Link not found at dropbox. They have took it off there I imagine.

I do agree that the person who got the loan is the same person as nizamcc and IceTurk, although the later doesn't really matter as he has negative trust already. The newbie account is probably also the same but that is less concrete. Assuming the newbie is an alt of them then YOLOMAN is also an alt of them, which is interesting because he gave marcotheminer positive trust for escrowing an account trade (he does not 'publicly' sell accounts, does not have an escrow thread, and I have long suspected that a good amount of his lending thread is him lending to his alts). It is even more interesting because YOLOMAN did not give any feedback to the person who actually sold the account. Even more interesting is that YOLOMAN had a debt to marcotheminer and "defaulted" here, his first post of his lending thread however lists the loan as being "repaid" with no mention of being late, the reuse of his address makes it very difficult to know for sure if the loan was actually repaid or not. Looking from the beginning of November back to the beginning of septemer, I didn't see any transactions sending .007 (the repayment amount) to 12hYBWiPqfwdveGzpbRdGxeqnoMcNvGNSq (marcotheminer's repayment address for all his loans). although there was one for .005 during that time.

Could you link me to the place of this quote? Nizamcc is under my control and YOLOMAN used to be (both were acquired from a defaulted loan).

★ ★ ██████████████████████████████[█████████████████████
██████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████
████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
★ ★ 
marcotheminer
Legendary
*
Offline Offline

Activity: 2072
Merit: 1049


┴puoʎǝq ʞool┴


View Profile
February 23, 2015, 08:05:36 PM
 #122


The MadZ quote isn't there?
Quickseller
Copper Member
Legendary
*
Offline Offline

Activity: 2996
Merit: 2371


View Profile
February 23, 2015, 08:06:58 PM
 #123

it was received via PM

★ ★ ██████████████████████████████[█████████████████████
██████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████
████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
★ ★ 
shorena
Copper Member
Legendary
*
Offline Offline

Activity: 1498
Merit: 1540


No I dont escrow anymore.


View Profile
February 23, 2015, 08:12:11 PM
 #124

Nizamcc is also used on reddit[1] and localbitcoin[2]. On localbtc a single trade in Amsterdam, NL[3] was not finsihed with user Greeney[4]. Not sure if you also saw this transaction[5] it has a comment attached "Withdraw to nizamcc from Cryptcominer.com"


[1] http://www.reddit.com/user/Nizamcc
[2] user profile: https://localbitcoins.com/accounts/profile/nizamcc/
[3] https://localbitcoins.com/ad/136655/purchase-bitcoin-ukash-netherlands
[4] user profile: https://localbitcoins.com/accounts/profile/Geeney/
[5] https://blockchain.info/tx/d146bae2c66c88e794842c625f86a39a4b41e1046897d8c8e26368da5f30a9c3

Im not really here, its just your imagination.
marcotheminer
Legendary
*
Offline Offline

Activity: 2072
Merit: 1049


┴puoʎǝq ʞool┴


View Profile
February 23, 2015, 08:12:22 PM
 #125


This might belong in a whole new thread but nizamcc is fully under my control since it defaulted from a loan back in 2014.
Quickseller
Copper Member
Legendary
*
Offline Offline

Activity: 2996
Merit: 2371


View Profile
February 23, 2015, 08:14:42 PM
 #126


This might belong in a whole new thread but nizamcc is fully under my control since it defaulted from a loan back in 2014.
so you came into possession of the account in August 2014?

★ ★ ██████████████████████████████[█████████████████████
██████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████
████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
★ ★ 
marcotheminer
Legendary
*
Offline Offline

Activity: 2072
Merit: 1049


┴puoʎǝq ʞool┴


View Profile
February 23, 2015, 08:15:59 PM
 #127


This might belong in a whole new thread but nizamcc is fully under my control since it defaulted from a loan back in 2014.
so you came into possession of the account in August 2014?

I need to look back, I don't recall the exact date.
marcotheminer
Legendary
*
Offline Offline

Activity: 2072
Merit: 1049


┴puoʎǝq ʞool┴


View Profile
February 23, 2015, 08:17:21 PM
 #128

Nizamcc is also used on reddit[1] and localbitcoin[2]. On localbtc a single trade in Amsterdam, NL[3] was not finsihed with user Greeney[4]. Not sure if you also saw this transaction[5] it has a comment attached "Withdraw to nizamcc from Cryptcominer.com"


[1] http://www.reddit.com/user/Nizamcc
[2] user profile: https://localbitcoins.com/accounts/profile/nizamcc/
[3] https://localbitcoins.com/ad/136655/purchase-bitcoin-ukash-netherlands
[4] user profile: https://localbitcoins.com/accounts/profile/Geeney/
[5] https://blockchain.info/tx/d146bae2c66c88e794842c625f86a39a4b41e1046897d8c8e26368da5f30a9c3

[5] was when the account was already in my control hence why the address withdrawn to is: 16WztVJTanbz2PMBLKckL3a3KLrotBaLok
marcotheminer
Legendary
*
Offline Offline

Activity: 2072
Merit: 1049


┴puoʎǝq ʞool┴


View Profile
February 23, 2015, 08:29:28 PM
 #129

I think that marcotheminer should return the account now since it was probably hacked, but everyone should give yussuf89 negative feedback for being unable to stand behind his account's actions unless he pays 50-75% of the loan principle. (This is just my opinion -- I'm not going to try to enforce it.)

I have managed to come to an agreement with Zeki. I believe he will be posting a signed message shortly.
Zeki (OP)
Member
**
Offline Offline

Activity: 75
Merit: 10


View Profile
February 23, 2015, 08:37:54 PM
 #130

-----BEGIN BITCOIN SIGNED MESSAGE-----
marcotheminer now fully controls the account and unless the loan is repaid by the agreed date, it will be sold and 0.37btc will be kept by marcotheminer, the rest given to Zeki. Please remove negative trust.
-----BEGIN SIGNATURE-----
1GiesDVsMFrBR7VYFx7FpHhCkvXz7Qp2qk
H013LOmmaiOnwpTVi8cRr1VcFpf02hZpxvci4DaBykBqOEElS2bf/RgxiS9aE6mtH3KTQ04g4fhFdIVZj4CGQ/E=
-----END BITCOIN SIGNED MESSAGE-----
marcotheminer
Legendary
*
Offline Offline

Activity: 2072
Merit: 1049


┴puoʎǝq ʞool┴


View Profile
February 23, 2015, 08:39:35 PM
 #131

-----BEGIN BITCOIN SIGNED MESSAGE-----
marcotheminer now fully controls the account and unless the loan is repaid by the agreed date, it will be sold and 0.37btc will be kept by marcotheminer, the rest given to Zeki. Please remove negative trust.
-----BEGIN SIGNATURE-----
H013LOmmaiOnwpTVi8cRr1VcFpf02hZpxvci4DaBykBqOEElS2bf/RgxiS9aE6mtH3KTQ04g4fhFdIVZj4CGQ/E=
-----END BITCOIN SIGNED MESSAGE-----

Just for clarification "1GiesDVsMFrBR7VYFx7FpHhCkvXz7Qp2qk" is the address; it isn't part of the signature.
Quickseller
Copper Member
Legendary
*
Offline Offline

Activity: 2996
Merit: 2371


View Profile
February 23, 2015, 08:40:29 PM
 #132

-----BEGIN BITCOIN SIGNED MESSAGE-----
marcotheminer now fully controls the account and unless the loan is repaid by the agreed date, it will be sold and 0.37btc will be kept by marcotheminer, the rest given to Zeki. Please remove negative trust.
-----BEGIN SIGNATURE-----
1GiesDVsMFrBR7VYFx7FpHhCkvXz7Qp2qk
H013LOmmaiOnwpTVi8cRr1VcFpf02hZpxvci4DaBykBqOEElS2bf/RgxiS9aE6mtH3KTQ04g4fhFdIVZj4CGQ/E=
-----END BITCOIN SIGNED MESSAGE-----
are you sure that is fair to all parties? This results in Marco actually profiting from all this while you would take the entire loss. Additionally accounts controlled Marco were also potentially involved with whoever received funds from your accounts loan.

★ ★ ██████████████████████████████[█████████████████████
██████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████
████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
★ ★ 
marcotheminer
Legendary
*
Offline Offline

Activity: 2072
Merit: 1049


┴puoʎǝq ʞool┴


View Profile
February 23, 2015, 08:41:59 PM
 #133

are you sure that is fair to all parties? This results in Marco actually profiting from all this while you would take the entire loss. Additionally accounts controlled Marco were also potentially involved with whoever received funds from your accounts loan.

I think it is. Could you rephrase that last sentence?
Muhammed Zakir
Hero Member
*****
Offline Offline

Activity: 560
Merit: 509


I prefer Zakir over Muhammed when mentioning me!


View Profile WWW
February 23, 2015, 08:43:00 PM
 #134

-----BEGIN BITCOIN SIGNED MESSAGE-----
marcotheminer now fully controls the account and unless the loan is repaid by the agreed date, it will be sold and 0.37btc will be kept by marcotheminer, the rest given to Zeki. Please remove negative trust.
-----BEGIN SIGNATURE-----
H013LOmmaiOnwpTVi8cRr1VcFpf02hZpxvci4DaBykBqOEElS2bf/RgxiS9aE6mtH3KTQ04g4fhFdIVZj4CGQ/E=
-----END BITCOIN SIGNED MESSAGE-----

Just for clarification "1GiesDVsMFrBR7VYFx7FpHhCkvXz7Qp2qk" is the address; it isn't part of the signature.

FYI address needs to be there inorder for the verification become successful or it will become partial success but yes, success is all that we need.

   -MZ

marcotheminer
Legendary
*
Offline Offline

Activity: 2072
Merit: 1049


┴puoʎǝq ʞool┴


View Profile
February 23, 2015, 08:43:57 PM
 #135

-----BEGIN BITCOIN SIGNED MESSAGE-----
marcotheminer now fully controls the account and unless the loan is repaid by the agreed date, it will be sold and 0.37btc will be kept by marcotheminer, the rest given to Zeki. Please remove negative trust.
-----BEGIN SIGNATURE-----
H013LOmmaiOnwpTVi8cRr1VcFpf02hZpxvci4DaBykBqOEElS2bf/RgxiS9aE6mtH3KTQ04g4fhFdIVZj4CGQ/E=
-----END BITCOIN SIGNED MESSAGE-----

Just for clarification "1GiesDVsMFrBR7VYFx7FpHhCkvXz7Qp2qk" is the address; it isn't part of the signature.

FYI address needs to be there inorder for the verification become successful or it will become partial success but yes, success is all that we need.

   -MZ

Yes, I know. 1GiesDVsMFrBR7VYFx7FpHhCkvXz7Qp2qk is the address if anyone is confused.
Quickseller
Copper Member
Legendary
*
Offline Offline

Activity: 2996
Merit: 2371


View Profile
February 23, 2015, 08:46:00 PM
 #136

are you sure that is fair to all parties? This results in Marco actually profiting from all this while you would take the entire loss. Additionally accounts controlled Marco were also potentially involved with whoever received funds from your accounts loan.

I think it is. Could you rephrase that last sentence?
you had admitted to be in control of accounts whose owners were the receipants of the loan. Although it is unclear if Marco purchased/took the accounts as collateral before the evidence connecting the accounts to the hack was posted or not. At least this is the case as of now.

Edit: also how is it fair that you take no losses when you are both at fault?

★ ★ ██████████████████████████████[█████████████████████
██████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████
████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
★ ★ 
Muhammed Zakir
Hero Member
*****
Offline Offline

Activity: 560
Merit: 509


I prefer Zakir over Muhammed when mentioning me!


View Profile WWW
February 23, 2015, 08:49:21 PM
 #137

IMHO marcotheminer should get 0.32BTC as that is what he loaned and the remaining to Zeki.

FYI at the end after you decide, PM me. A person has messaged me asking if I have any accounts for sale, he/she is ready to give a good amount and he wants a HM account.

   -MZ

Muhammed Zakir
Hero Member
*****
Offline Offline

Activity: 560
Merit: 509


I prefer Zakir over Muhammed when mentioning me!


View Profile WWW
February 23, 2015, 08:51:45 PM
 #138

Edit: also how is it fair that you take no losses when you are both at fault?

I think the account could be sold at a minimum of ~0.6+BTC. They should split evenly, if they got more, 0.32BTC to marcotheminer and remaining 0.32+BTC to Zeki.

   -MZ

Quickseller
Copper Member
Legendary
*
Offline Offline

Activity: 2996
Merit: 2371


View Profile
February 23, 2015, 08:54:22 PM
 #139

Edit: also how is it fair that you take no losses when you are both at fault?

I think the account could be sold at a minimum of ~0.6+BTC. They should split evenly, if they got more, 0.32BTC to marcotheminer and remaining 0.32+BTC to Zeki.

   -MZ
why shouldn't marcotheminer take any loss from this? He failed to secure a signed message and as a result took possession of a hacked account. There is no reason why the OP should have to bear the entire loss

★ ★ ██████████████████████████████[█████████████████████
██████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████
████████████████████████████████████████████████████████████
███████████████████████████████████████████████████████████████████
★ ★ 
erwin45hacked
Legendary
*
Offline Offline

Activity: 1064
Merit: 1000



View Profile
February 23, 2015, 08:56:43 PM
 #140

IMHO marcotheminer should get 0.32BTC as that is what he loaned and the remaining to Zeki.

FYI at the end after you decide, PM me. A person has messaged me asking if I have any accounts for sale, he/she is ready to give a good amount and he wants a HM account.

   -MZ

indeed i agree in some parts marco should only get 0.32 which is the amount he loaned, and also by selling the accounts could mean zeki is in loss, but the fact that the account could get to a high price then i think its fair for zeki too
Pages: « 1 2 3 4 5 6 [7] 8 9 10 »  All
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!