Archived Report: 76561197985785608 - (Noobinator / [TF2] Team Fortress 2 Items)

Scam Report

Report Type: [Money] PayPal scam or scam attempt
Virtual item type involved: [TF2] Team Fortress 2 Items

Accused profile: 76561197985785608 (Noobinator)

Victim profile: 76561198030418573

What happened? Description:

Noobinator added me to buy me some buds. I checked his Steamrep and did a background check and everything seemed fine. However, apparently he has been hijacked, and the hijacker has stolen 13 buds from me. He's tagged on TF2OP now (the only site where I did't check), but I'm afraid its too late for me.
And the worst part its that I actually suspected, I've f✿✿✿ed up badly.​

Provide Evidence:

Here are screenshots of the chat window, my Paypal acount and inventory history.​

f✿✿✿✿er just got 7 Buds from me.

Yes, he's hijacked as of now. I'm leaving this thread open, but DO NOT TRADE WITH NOOBINATOR.

The files that are being sent are CONFIRMED VIRUSES. Do not click them.

He got 13 from me. I should have trusted my instinct. And there is no way to recover them, right?

the hijaker sent me a virus link

Steam is aware of this hijacking. I can't promise anything, but contact Steam Support and hope for the best.
The files that are being sent are CONFIRMED VIRUSES. Do not click them.

Noobinator's account is currently disabled.

Sent. And now I can only wait.

I got the same message.

I also got the confirmation he got disabled too.

Never trust ANYONE, as you can see they aren't hijacking proof. Steamrep admins can still be hijacked.

Let's hope VALVe gonna think again about their hijacking item policy change.

Yes, I was hijacked and was sent the link from a trusted HL leader friend I know from competitive play. It didnt fit the typical phisher profile and I guess that was why I bit on it. Sorry to anyone that lost something, but Valve should replenish it like my 8 unusuals that were initially stolen.

That's some great news for everyone involved in this fiasco. I'll be out for a day or two, but if Steam gives you everything back at least we can leave this just as a bitter experience. And I'll be extra careful from now on.

Steam support hasn't even aswered yet, and its been two days since I sent the report. I've read in other threads that the may take several days, so time to be patient.

Hi there,

We were quite fast in marking and warning Valve about Noobinator's hijacked account, and the account was locked down soon after.

Noobinator was hijacked in this timeframe:

April 18th, ~ 3:30pm PST = UTC -8 = 11:30pm UTC / 3:30pm PST​

Account was locked (can talk but not trade):

April 19th, ~2:00am CET = UTC +1 & +1 DST= April 19th, ~0:00am UTC / April 18th, 4:00pm PST​

The account was marked on SteamRep as Banned:

April 19th, 0:03am UTC = April 18th, 4:03pm PST​

The account was made inaccessible somewhere between the lock and (no exact record for this available):

April 19th, 3:50pm PST = UTC -8 = 11:50pm UTC / 3:50pm PST

Hidden Content:

**Hidden Content: Content of this hidden block can only be seen by members of (usergroups: Administrative, Moderating).**

He then regained account fully around (unlocked):

April 20th, 11:06am PST = UTC -8 = 7:06pm UTC / 11:06am PST​

I've worked with Noobinator to ensure checks on his account access, so the hijacker will not be able to get access to the account again from this occurrence.

Mule account:
As we where quite fast, the hijacker had not moved the scammed items from the mule account yet:

All scammed items where moved to this MULE account:

| steamname: traderis
| steamID32: STEAM_0:1:67124131
| steamID64: http://steamcommunity.com/profiles/76561198094513991
| customURL:
| steamrep: http://steamrep.com/profiles/76561198094513991​

See also: http://forums.steamrep.com/threads/76561198094513991-mr-jokny.33788/

More information on the mule account:
Banned on TF2 Outpost for spamming phishing links back in June 15th, 2013, IP's show Germany (Proxy) and New York (also Proxy) so those are useless. We have on good account that the phisher is probably from Lithuania (cannot elaborate on that, sorry).

The actual victims were:

Loss of 13 Buds:

| steamname: Drot
| steamID32: STEAM_0:1:35076422
| steamID64: http://steamcommunity.com/profiles/76561198030418573
| customURL: http://steamcommunity.com/id/Droter
| steamrep: http://steamrep.com/profiles/76561198030418573
Report:
http://forums.steamrep.com/threads/...8-noobinator-tf2-team-fortress-2-items.62494/​

Loss of 7 Buds:

| steamname: CoooookiE
| steamID32: STEAM_0:1:37781085
| steamID64: http://steamcommunity.com/profiles/76561198035827899
| customURL:
| steamrep: http://steamrep.com/profiles/76561198035827899
Report:
http://forums.steamrep.com/threads/...8-noobinator-tf2-team-fortress-2-items.62495/​

Loss of 8 buds:

| steamname: Leves TF2-T [A]
| steamID32: STEAM_0:0:23350111
| steamID64: http://steamcommunity.com/profiles/76561198006965950
| customURL: http://steamcommunity.com/id/Bableves
| steamrep: http://steamrep.com/profiles/76561198006965950​

Loss of 5 buds:

| steamname: Zey
| steamID32: STEAM_0:0:41354695
| steamID64: http://steamcommunity.com/profiles/76561198042975118
| customURL: http://steamcommunity.com/id/zeryon_
| steamrep: http://steamrep.com/profiles/76561198042975118
Report:
http://forums.steamrep.com/threads/...8-noobinator-tf2-team-fortress-2-items.62624/
http://forums.steamrep.com/threads/...8-noobinator-tf2-team-fortress-2-items.62528/​

For these victims, please contact Steam Support telling them:
You have been scammed by a hijacker on Noobinator's account which was marked as a trusted SteamRep Admin at the time (please state it like that). All above trades mentioned have been in that time-span of ~30 minutes before any action could have been done.

As the mule account was caught and LOCKED before moving items further, you should stand a fair chance to get your item trade reversed because they were never moved on. We would like the victims to report back to their reports here if / when items are being granted back. Till that point, the reports will be kept open.

We're very sorry for the discomfort this may have caused. We are considering actions to improve things as we go, and this situation (re-)started a discussion on improvements in admins section for this. The results may be reflected at a later date-- both in public policies and in our own internal procedures with admins.

Greetz,

SilentReaper(SR)

Per standard SteamRep protocol, below is proof of my hijacking, to prove I was not the thief and that I had indeed been hijacked, losing control of my acct. This should also suffice in clearing me from this report and proving I was not the scammer. That being said, I am indeed very sorry for your loss and this mess, and hope steam is able to recover and replace your items. As Silent Reaper suggested, please be sure to report this in detail to Steam via a Steam ticket. Very best of luck to you.

Seems I forgot something.

Would the victims please supply their Steam Ticket number for this case.

Mine is 8297-FHKL-9479. I updated it a few hours ago with the information you provided.

Well, they've finally answered, and its bad news: They're not giving the items back.

I personally don't think its fair, since this wouldn't have happened if Noobinator's account had not been hijacked in the first place, and I couldn't really know it was a hijacker, but they won't listen, so I guess this is the end of it.

I've replied to them, just in case they decide to change their minds, but my hopes aren't high.

Oh my god they actually listened and gave me the buds back. I can't believe it. I'm so happy that this has ended the best possible way. Thanks everyone for their time and help.