Julia Gillard the Honest Posted November 20, 2013 Share Posted November 20, 2013 It all started when my good friend, who I affectionately refer to as Jack the Hijacker, added me. Everyone, say it with me. "Hi, Jack!" http://www.tf2outpost.com/user/508368 I don't know what his current main account is. By main account, I mean the one where he stores the big-ticket items such as unusual hats. He keeps changing accounts, obviously. However, I certainly know of many of his hijacked accounts. Many of these accounts haven't been banned on Outpost and continue to spread Jack's virus (I say virus referring to the sharing of his hyperlinks and am fully aware that it's not an actual computer virus). I, personally, would like some kind of immediate action to halt him because I've seen how problematic he is. However, I know that that would be difficult so in the meantime, let me go through some unbanned, hijacked (by Jack) accounts. They're easy to identify as they've given him their items, obviously. Unless if you've been stalking or harrassing the Jacks of the World as I have, you probably don't realise how infectious he is. http://www.tf2outpost.com/user/497149 This one's my current source of contact with Jack. He uses it to store cheaper stranges occasionally. Aside from the Hetman's which the victim here unboxed, he instantly acquired Jack's unusuals after I got that last main account banned. I don't have proof but I believe that this user was hijacked via a random friend request on Steam (he has Jack on his friends' list, as well as KOODA, who I'll get to later). I know that he has been hijacked but it wasn't via Outpost. The fukamigasa (from http://www.tf2outpost.com/trade/15569068) even has another victim swearing revenge (http://www.tf2outpost.com/trade/15804981), which leads me to another victim. http://www.tf2outpost.com/user/76561198009012326 This one was hijacked by Jack right here. http://www.tf2outpost.com/trade/15569068 He took the bait and gave away his information, then told Jack, "add me i cant add you..." http://www.tf2outpost.com/user/469700 I don't know if this one is the hijacker or simply someone who has absolutely no objection with buying from the hijacker. First of all there's this hat, which is straight from Jack. http://www.tf2outpost.com/trade/15785286 Then there's this other hat which is straight from Jack. http://www.tf2outpost.com/trade/15775250 By the way, http://www.tf2outpost.com/trade/15772828 is hijacked. He said so on one of my trades. http://www.tf2outpost.com/trade/15688052 Oh, back to this user who likes buying hijacked hats. http://www.tf2outpost.com/trade/15730581 Here's the trade where http://www.tf2outpost.com/user/196546 was hijacked. http://www.tf2outpost.com/trade/15708970 As for the Dragonborn Helmet, its last owner has already been marked as an Account of Jack so I won't go into it (I don't know how Jack acquired it since the owner before him knew about his phishies as shown in http://www.tf2outpost.com/trade/14209003). Here's some more Jack. http://www.tf2outpost.com/trade/15772902 This victim clicked straight on that first Jack-link. You can see him saying this on his other account (http://www.tf2outpost.com/user/333542). However, this Account of Jack --- http://www.tf2outpost.com/user/334359 --- still needs to be marked. Look at this hat! http://www.tf2outpost.com/trade/15830544 Two things: http://www.tf2outpost.com/user/129164 (KOODA) needs to be marked for being Jack's storage account and http://www.tf2outpost.com/trade/15205803 needs to be marked for clicking on that Jack-link. I'll now conclude this initial post. Those are simply the hats that I can recall having seen in Jack's account in the last few days. I'm sure that there were more but I foolishly assumed that he wouldn't have much success so didn't save any records. However, I will certainly start doing that here now. I greatly appreciate how stressful Jack must be to the Outpost staff and I certainly don't expect them to be able to instantly ban all of the Accounts of Jack. However, I will continue with my own private investigations into Jack's actions. In particular, I've learnt that if I harrass him by spamming "Hijacked!!!" on the trades of the Accounts of Jack, he then (if he hasn't already) moves the hats to another account, which eventually leads me to the discover of more of his accounts. As for actually punishing or stopping Jack, I obviously can't do anything about him beyond annoying him. I too have to put up with him (or possibly other Jacks). http://i.imgur.com/ubVIw8h.jpg Some coincidental fun in this one's friends' list there. BSoD, BLUEDEMON or any other Outpost staff, if you're reading this, please consider these findings. It is indeed a lot of reading but these are just the ones that I've got current proof of having been hijacked. Many of these new traders are having their accounts hijacked on Outpost. I propose banning all URLs in trades (which exceptions for, say, YouTube in the trade owner's notes, but not in other users' offers). This would annoy some people but it certainly wouldn't hinder any trading. Instead of posting your trade's URL, you would instead have to say, "I offer my special hat/set." This is a trivial inconveniece --- a small price to pay --- to stop Jack. For everyone else, I simply post this to warn you that these accounts have been hijacked. If someone adds you to quick-sell one of their hats then you know that he is Jack the Hijacker. Link to comment Share on other sites More sharing options...
AwesomeMcCoolName Posted November 20, 2013 Share Posted November 20, 2013 -- TL;DR please Link to comment Share on other sites More sharing options...
@@@@@@ Posted November 20, 2013 Share Posted November 20, 2013 fishing for phishers Link to comment Share on other sites More sharing options...
CrimsonWarlord Posted November 20, 2013 Share Posted November 20, 2013 jack the hi-jacker Link to comment Share on other sites More sharing options...
dabaers Posted November 20, 2013 Share Posted November 20, 2013 HOW DO WE KNOW NONE OF THOSE LINKS ARE PHISHING LINKS??? THAT'S WHAT A CLEVER PHISHER WOULD DO, PUT PHISHING LINKS IN A POST ABOUT PHISHERS. Just kidding. At least "Jack" won't be interested in my backpack. Im poor Link to comment Share on other sites More sharing options...
Cedarium Posted November 20, 2013 Share Posted November 20, 2013 What is jack high on? Link to comment Share on other sites More sharing options...
Julia Gillard the Honest Posted November 20, 2013 Author Share Posted November 20, 2013 TL;DR please fishing for phishers That pretty much sumarises it. Derpeh likes manipulators and I play with Jacks. I've just thought about a new way to find the Accounts of Jack. I'm going on a look through his friends' recent actions. https://steamrep.com/profiles/76561198112033836 Link to comment Share on other sites More sharing options...
Blue Screen of Death Posted November 20, 2013 Share Posted November 20, 2013 OK. First of all, I appreciate all the effort (and time) you are putting into this. I greatly appreciate how stressful Jack must be to the Outpost staff and I certainly don't expect them to be able to instantly ban all of the Accounts of Jack. Doing these investigations is very time consuming and time is something we don't ever have enough. I personally cover a handful of communities + OP forums, reports and appeals, therefore spending too much time on a single person is often impossible and not recommended - other people deserve their matters to be addressed too. However, I will continue with my own private investigations into Jack's actions. My suggestion is to stalk this account 24/7 too: http://www.tf2outpost.com/user/469700 . I've seen it linked to many past bans and it's fishy enough to deserve an investigation of its own. If anybody comes up with good evidence on this one, let me know. As for actually punishing or stopping Jack, I obviously can't do anything about him beyond annoying him. I too have to put up with him (or possibly other Jacks). http://i.imgur.com/ubVIw8h.jpg Some coincidental fun in this one's friends' list there. BSoD, BLUEDEMON or any other Outpost staff, if you're reading this, please consider these findings. It would greatly help any of us (the staff) if the information was made available in an organized and objective way. This would speed up the reading/look up/confirmation process and generate more promptly responses. E.g.: A was hijacked: <proof> B has/is selling A's hijacked hats: <proof> B bought A's hats from C: <proof> C is a hijacker's alt: <proof> A's OP link, A's SR link B's OP link, B's SR link C's OP link, C's SR link I propose banning all URLs in trades (which exceptions for, say, YouTube in the trade owner's notes, but not in other users' offers). This would annoy some people but it certainly wouldn't hinder any trading. Instead of posting your trade's URL, you would instead have to say, "I offer my special hat/set." This is a trivial inconveniece --- a small price to pay --- to stop Jack. A new system is being put in place to halt and take action against phishers, the first part already went live yesterday (some may have already noticed it, if not, check Sneeza's trade). Link to comment Share on other sites More sharing options...
Julia Gillard the Honest Posted November 20, 2013 Author Share Posted November 20, 2013 OK. First of all, I appreciate all the effort (and time) you are putting into this. Doing these investigations is very time consuming and time is something we don't ever have enough. I personally cover a handful of communities + OP forums, reports and appeals, therefore spending too much time on a single person is often impossible and not recommended - other people deserve their matters to be addressed too. My suggestion is to stalk this account 24/7 too: http://www.tf2outpost.com/user/469700 . I've seen it linked to many past bans and it's fishy enough to deserve an investigation of its own. If anybody comes up with good evidence on this one, let me know. It would greatly help any of us (the staff) if the information was made available in an organized and objective way. This would speed up the reading/look up/confirmation process and generate more promptly responses. E.g.: A was hijacked: <proof> B has/is selling A's hijacked hats: <proof> B bought A's hats from C: <proof> C is a hijacker's alt: <proof> A's OP link, A's SR link B's OP link, B's SR link C's OP link, C's SR link A new system is being put in place to halt and take action against phishers, the first part already went live yesterday (some may have already noticed it, if not, check Sneeza's trade). Thanks for the incredibly quick response! I've just found a heap more (and am still going) so I'll present them in this format when I've got them ready. Regarding the user who you said is extremely suspicious (http://www.tf2outpost.com/user/469700), I've been watching these particular hats closely. http://www.tf2outpost.com/trade/15784295 I keep coming across http://www.tf2outpost.com/user/223955 as having traded with all of Jack's friends so I've been expecting to stumble across something with him. That's as far as I can go with him though. I haven't proven anything with him yet. Link to comment Share on other sites More sharing options...
Julia Gillard the Honest Posted November 20, 2013 Author Share Posted November 20, 2013 Here's my next round of findings using BSoD's suggested format. These are just another round after investigating the Outpost links (navigated to with SteamRem) of all of Jack's friends. Not all of these are hijackings so I'll specify the different ones. In general, I can't prove that the next owners bought them from the hijacker because he adds people to quick-sell. These hats simply appear in their accounts next so I would require their cooperation to completely prove these. -------------------------------------------------------------- http://www.tf2outpost.com/user/187585 was hijacked: http://www.tf2outpost.com/trade/15803311 got a phisphing link and then those three unusual hats went straight to the marked hijacker. The next owner (TheHiddenDuck) then received the hats (I believe that he's the new main account but can't prove that because it's private). http://www.tf2outpost.com/user/32944 has these hats now: http://www.tf2outpost.com/backpack/76561198027846812 where they reside on Page 5. http://www.tf2outpost.com/user/508368 is the hijacker's account: After the hijacking by http://www.tf2outpost.com/user/510118, they simply went to that account next. This pattern will be repeated throughout these reports. ---- http://www.tf2outpost.com/user/187585 SR: https://steamrep.com/?id=76561198049652795 http://www.tf2outpost.com/user/32944 SR: https://steamrep.com/?id=76561198027846812 http://www.tf2outpost.com/user/508368 SR: https://steamrep.com/?id=76561198112033836 -------------------------------------------------------------- The following two reports aren't phishing reports but are very concerning (particularly the second one). -------------------------------------------------------------- Suspected victim (I can't find proof but it's suggested by the next report): http://www.tf2outpost.com/trade/15665113 His SR: https://steamrep.com/?id=76561198061875140 -------------------------------------------------------------- Hijacker's fence: http://www.tf2outpost.com/backpack/76561198056246906 Proof: The following, out of his hats, are straight from hijacking accounts: Sunbeams Geisha Boy; Darkblaze Waxy Wayfinder; Blizzardy Storm Strontium Stove Pipe; Haunted Ghosts Dread Knot (suspected but not proven); Disco Beat Down Soldered Sensei; Smoking Conquistador; Stormy 13th Hour Salty Dog; Cloud 9 Bot Dogger; and the Steaming Towering Pillar of Hats (straight from http://www.tf2outpost.com/user/508368's account). -------------------------------------------------------------- The following reports are all hijacked accounts. -------------------------------------------------------------- http://www.tf2outpost.com/user/313601 was hijacked. Proof: http://www.tf2outpost.com/trade/15513860 After that phish (same as in the first report of this post), this hat went to http://www.tf2outpost.com/user/508368 just like the hats of first report. The last owner in its Outpost history: http://www.tf2outpost.com/user/68587 I can't confirm where it is now since he has a private backpack. http://www.tf2outpost.com/user/21653 bought it (along with two others to follow in the next reports): Here it was next. http://www.tf2outpost.com/trade/15805958 ---- http://www.tf2outpost.com/user/313601 SR: https://steamrep.com/?id=76561198078901977 http://www.tf2outpost.com/user/68587 SR: https://steamrep.com/?id=76561198041381757 -------------------------------------------------------------- http://www.tf2outpost.com/user/300566 was hijacked: He followed a phishing link and returned to say so on Outpost. http://www.tf2outpost.com/trade/15803476 http://www.tf2outpost.com/user/231097 has and is selling this hat: http://www.tf2outpost.com/trade/15830486 http://www.tf2outpost.com/user/231097 bought this hat from http://www.tf2outpost.com/user/21653, who bought it from the hijacker in the previous report. The phisher http://www.tf2outpost.com/user/510728 is the same hijacker since the hat then went straight to http://www.tf2outpost.com/user/508368. ---- http://www.tf2outpost.com/user/300566 SR: https://steamrep.com/?id=76561198080854549 http://www.tf2outpost.com/user/231097 SR: https://steamrep.com/?id=76561198060801935 http://www.tf2outpost.com/user/21653 SR: https://steamrep.com/?id=76561198048948978 http://www.tf2outpost.com/user/510728 SR: https://steamrep.com/?id=76561198115150141 -------------------------------------------------------------- http://www.tf2outpost.com/user/388679 was hijacked: http://www.tf2outpost.com/trade/15785153 was attacked by the first phishing account, after which this hat went to http://www.tf2outpost.com/user/471111, which is where other hats have gone after being hijacked. The hat is now in another account but it isn't currently available for purchase. http://www.tf2outpost.com/backpack/76561198027846812 http://www.tf2outpost.com/user/471111 is the hijacker's account: We've already seen other hijacked hats being swapped around his account. ---- http://www.tf2outpost.com/user/388679 SR: https://steamrep.com/?id=76561198094881984 http://www.tf2outpost.com/user/471111 SR: https://steamrep.com/?id=76561198094219659 -------------------------------------------------------------- http://www.tf2outpost.com/user/449349 was hijacked: http://www.tf2outpost.com/trade/15802607 After that phishing link, two of those items (in particular, the unusual hat) went to the marked hijacker. We've already covered where this hat then went, with the other hijacked hats in above reports. ---- http://www.tf2outpost.com/user/449349 SR: https://steamrep.com/?id=76561198095733539 -------------------------------------------------------------- That's that second round. You were certainly right about the time problem. I've really got to do some work now so must leave this for now. Link to comment Share on other sites More sharing options...
∞Ramses Posted November 20, 2013 Share Posted November 20, 2013 I hope you realize you can't win the fight against phishers. Nice efforts, though. I hope this/these phisher(s) gets what he/they deserve. Link to comment Share on other sites More sharing options...
Julia Gillard the Honest Posted November 20, 2013 Author Share Posted November 20, 2013 BSoD, regarding the user who you want some evidence of shady dealings (http://www.tf2outpost.com/user/469700) for, I've found proof that the hats that I suspected were hijacked were. If nothing else, he regularly buys hijacked hats. Here's a list of such hats. This is just a single report about one person so regarding format, this is all evidence against the same person. http://www.tf2outpost.com/trade/15785286 Straight from the marked hijacker. http://www.tf2outpost.com/trade/15784295 I had to find some proof that the last owner of these was hijacked. I now have it. Twenty-two minutes ago, this user posted on his own profile. http://steamcommunity.com/profiles/76561198053515749 "Tak KUZWA! ODZYSKAÅEM ITEMY I KONTO! CHWAÅA MI! :D" Unfortunately I don't speak Polish but Google Translate says that he is saying that he has regained his account and items. http://translate.google.com/#auto/en/Tak%20KUZWA!%20ODZYSKA%C5%81EM%20ITEMY%20I%20KONTO!%20CHWA%C5%81A%20MI! We can easily verify this by checking his backpack now. http://www.tf2outpost.com/backpack/76561198053515749 His unusual hats have now been duplicated. http://www.tf2outpost.com/trade/15791483 http://www.tf2outpost.com/trade/15785280 It's also noted that the last comments on his Steam profile are telling him how to gain his account back after the hijack. http://translate.google.com/#auto/en/Napisz%20do%20supporta%2C%20niech%20skurwysyna%20poci%C4%85gn%C4%85%20do%20odpowiedzialno%C5%9B%C4%87i! "Write supporta, let that motherfucker will pull accountable!" http://translate.google.com/#auto/en/To%20konto%20skradziono!%20nie%20odbierajcie%20wiadomo%C5%9B%C4%87i%20z%20tego%20konto!%20ktos%20mi%20je%20ukrad%C5%82!!!!! "This account has been stolen! not receive messages from this account! Someone stole it!!" So there's the proof that that account was hijacked just before your suspect got those hats. This hijacking theory is suported by the now-duplicated unusual hats being in the victim's possession once more. http://www.tf2outpost.com/trade/15637731 is straight from the hijacker. http://www.tf2outpost.com/trade/15730581 Look at the Stately Steel Toe. Here it is. http://www.tf2outpost.com/backpack/76561198062859354 Here it is again. http://www.tf2outpost.com/backpack/76561198071110747 It has been duplicated. The reason is that it was hijacked and then traded to your suspect. Proof of the hijacking: http://www.tf2outpost.com/trade/15708970 This victim says here that it was that phishing link that led to the hijacking, immediately before your suspect acquired this hat. http://www.tf2outpost.com/trade/15641116 The Tam O' Shanter's straight from a hijacker. http://www.tf2outpost.com/trade/15775250 is straight from the hijacker. http://www.tf2outpost.com/trade/15728764 He fell for the phish in one of his trades. http://www.tf2outpost.com/trade/15551558 This hat has moved accounts but this trade is still open despite not being in this victim's backpack. http://www.tf2outpost.com/backpack/356441 In this victim's backpack, I'd like to draw your attention to that piece of refined metal. It shows that this account has been trading with your suspect recently. Also, his taunt went straight to the hijacker's account. http://www.tf2outpost.com/trade/15727924 http://www.tf2outpost.com/trade/15696957 Straight from a hijacker's fence (I'll let you website administrators do your IP checks on these and just assume that these are different people). http://www.tf2outpost.com/trade/15676204 The Bot Dogger is from the same person as the last hat that I just listed. http://www.tf2outpost.com/trade/15639826 is straight from a hijacker. Before these trades, his whole behavious was completely different. He listed some hats up to a dozen times in different trades rather than these sudden quick-sells so this account might have been hijacked or this might mark a time when he started buying hijacked hats. This isn't proof of anything but it is an interesting observation. For now, that's all that I can find about him. All of his recent stock is from hijackers. Link to comment Share on other sites More sharing options...
AwesomeMcCoolName Posted November 22, 2013 Share Posted November 22, 2013 @JGtH you might want to look into Thunder: http://www.tf2outpost.com/user/64726 I've seen him selling quite a few hats off of banned alts/other banned OP users, not sure if just bad luck or not... //haven't looked into it at all, and he also has a lot of none-sketchy hats so.... Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.