Rejected 76561198000140150 (cYs) Del Piero I TMG I (SR Scammer)

Thanks

Found these
http://www.skial.com/threads/del-pieros-multiple-accounts-banned-for-spamming-and-shilling.2752/
http://www.skial.com/threads/ding-dong-the-witch-is-dead.12634/page-5#post-125297

As mattie has said, please add anything else to your defense, otherwise their is nothing to justify overturning your original tag. Ill give you 2 days longer.

Posting this here too:

steamID: (cYs) Del Piero steamID32: STEAM_0:0:19937211 steamID64: http://steamcommunity.com/profiles/76561198000140150 customURL: http://steamcommunity.com/id/buffon1234 steamrepURL:http://steamrep.com/index.php?id=76561198000140150

Appeal thread:
http://forums.steamrep.com/threads/76561198000140150-cys-del-piero-i-tmg-i-sr-scammer.1377/

Further information on an impersonator (impersonated himself and another trader), caught by using different Steam accounts from the same IP address.

___________________________________________

Hi,

I'm contacting you, because you posted in the above mentioned appeal thread. Daemon linked one of my posts (http://forums.steamrep.com/threads/...iero-i-tmg-i-sr-scammer.1377/page-2#post-4572) I made on Skial a couple of days ago, in this thread. The post shows that a scammed item (http://www.tf2items.com/item/725715131) ended up at a Steam account, which is on the "real" Del Piero's friend list, making a further connection between him and the impersonator account.

Since then I found the ID of two more scammed items
http://www.tf2items.com/item/725888500
http://www.tf2items.com/item/682536688

Just as the first one, these two go through/end up at a steam account on a friend list of the "real" Del Piero, who denies any connection between himself and the impersonator accounts.

It's rather circumstantial, but I think it's highly unlikely that all the items I know of just find their way to accounts on same guys friend list who shares IP with the original scammer.

I have some screen shots here in case he deletes any of them from his friend list:

http://i.imgur.com/UVzv4.png
http://i.imgur.com/JOWSB.png
http://i.imgur.com/EoMYx.png
http://i.imgur.com/azD3X.png
http://i.imgur.com/AwNG4.png

http://i.imgur.com/fTQyA.png
http://i.imgur.com/YBm5R.png
http://i.imgur.com/NoMnA.png
http://i.imgur.com/5BceK.png

http://i.imgur.com/g83XD.png
http://i.imgur.com/V39Uj.png
http://i.imgur.com/zJ7us.png
http://i.imgur.com/YCXkH.png

The Faron8 impersonator being one of Del Piero's alts is confirmed by HelenAngel (http://img585.imageshack.us/img585/5507/85073084.png), but it isn't on his Steamrep page yet, only the other one.

I hope this information will be helpful with your investigation.

As I've said before the IP is not really evidence since someone can spoof their IP as mine and or hack it.

And as before you're still wrong. Post from my IP, go.

It really doesn't work that way. The only real way to spoof an IP on a TF2 server would be to use a full internet tunneling VPN (unless the scammer somehow managed to inject packets with spoofed data in real time, however no TF2 server would accept that type of connection, and would disconnect you immediately, and the HLStats logs show that your SteamIDs were connected for extended periods of time, so this defense simply isn't feasible), however your IP address, which was recorded on both SteamIDs, is a residential IP, and not a VPN IP.

Spoofing your IP to a web page is much simpler than spoofing it to a TF2 server. It's an entirely different protocol, and I don't think the market for pre-assembled hacks to spoof your IP in TF2 data is large enough to suggest that some script kiddy scammer is spoofing their data to act as if it was yourself.

It might be simpler to spoof the IP to a web page but it's possible to spoof it to a TF2 server. Since it's a possibility the IP adress itself is no evidence.

And what about this: http://img585.imageshack.us/img585/5507/85073084.png?

The 2 scammer accounts and yours were seen from the same US proxy within 15 minutes of each other. How can somebody do that?

As I said, though, the only feasible way to do this is through a proper VPN. And the IP address that was detected is not from a VPN, but rather a residential internet connection. There is no other plausible way to spoof an IP on a TF2 server.

I have an invite into you, please accept, either-way I plan to wrap this up today.

By request of portalbal my opinion.

Bit of haywire of ppl's concepts on spoofing IP's.

For sake of understanding I'll try to explain the REAL logistic nightmare it is to actually do such.
Say the to be spoofed IP address is "A".. and the place this must be spoofed to is on "B" (site, server, w/e).

In order to spoof the IP address, there several things that are needed:
- Spoofer must know IP of his victim, (which isn't really hard to find btw).
- Spoofer must have the skills to hack internet routing devices, or other equipment.

Possible approaches:
- The IP address "A" is a actual proxy/vpn, which allows any other to use that as well (not this case)
- The IP "A" is residential, and has proxy running where somebody could use his connection to do this. (residential: yes, proxy on there: no, quite unlikely, for residential has a NAT router between, it needs to be configured on the NAT router, and some pc or device must then act as proxy for external connections... too many requirements, works only if the residential is cooperating to config all that)
- The internet routing boxes between "A" and "B" to be hijacked and to reroute the traffic. Interesting part in this is, that the successrate gets higher to spoof via this method the closer to the final IP "A" it is (for traffic may follow other routes otherwise. That is IF one can hack such routers... And I can tell you, those are quite hard to crack, for those are attacked daily and their owners aren't crazy either. Often those can only be configured via their "Console" port, and nothing else.
- physical access to either the end point "A" or the hardware before it reaches it. (hacker's wet dream, not gonna happen, any real person having the access would risk his job for it)

That concludes that:
- If the IP match was on VPN only, that might have been circumstantial.
- Turns out that the matched IP was residential, which is way beyond the paygrade of the hating scammer out there to do the level of attack and gaining the access. A scammer that could do that would be able to hijack accounts anyway via other means, so would not be needing to do petty thefts, like "impersonating".

Final note:
Using VPN's for legit use in trading isn't a wise move, for this ends up near always matching up with one or another scammer. We of SR see those, and that red flags us immediately for suspicious behaviour and we can tag them accordingly (only showing for admins etc). We dont share IP info without proper cause, and if, only with other admins of communities that we support with tags (UTC, EE, etc) and we expect the same policy to be kept on their side. We've had demands for such info in the past from people that where scammed, but we don't give such info to non-admins.

Currently I don't see a way out for the appeal to be concluded positive.

I'm very tired and have the flu, so forgive any bad spelling or bit wonky reasoning...

and I actually forgot 2 casu's. lol... meh, soon to bed.

- endpoint B can be compromized (hacked)
- and the person interpreting the logs can be...

The reason I didn't really come up with those are quite obvious, and I can dismiss both. I've seen Bottiger around, I'm not going to call 'm a liar. As I also know that he manages his community and does that with his skills, I can pretty much strike that possibility of it been (hi[j/h])acked too.

But meh, one had to be complete.

Unfortunately, after speaking with you at some length (1 hour 45 mins) we reached an impasse, our standards regarding IP matches are well established and never have we come across a case where an "IP was hacked", saying that, cyber crime is a very serious issue, it includes account hijacking and we have dealt with such cases before but never with spoofed IPs, If that is the case, you need to contact the police or your ISP as its a pretty serious matter.
Your only defense is that someone used your IPs on multiple occasions within the same time frame, even so, all the scammed items went through the same accounts that have the impersonator and you on them. At some point, common sense has to kick in, you are either the scammer or in cahoots with the scammer, both markable offenses, so not out of context ill post a chunk or two:

(tbh, the rest of the chat was arguing semantics and circlejerking each-other, but available upon request)

Based on the facts and after re-reviewing this over and over, their is noting to justify overturning your tag. If you come across additional proof of your claim or contact the authorities or your ISP feel free to re-appeal, until such a time, your tag was applied justly and your appeal denied justly.