1. SteamRep is shutting down at the end of 2024. See announcement.

Archived 76561198082794151 (Chaliy)

Discussion in 'Archived Reports' started by JazzLobster, Apr 18, 2013.

  1. JazzLobster

    JazzLobster New User

    Messages:
    6
    Victim:
    |steamID: [S.T.A.R.S] Jazzy
    |steamID32: STEAM_0:1:51245836
    |steamID64: http://steamcommunity.com/profiles/76561198062757401
    |customURL:
    |steamrepURL: http://steamrep.com/profiles/76561198062757401

    HIjacker:
    |steamID: chaliy
    |steamID32: STEAM_0:1:61264211
    |steamID64: http://steamcommunity.com/profiles/76561198082794151
    |customURL:
    |steamrepURL: http://steamrep.com/profiles/76561198082794151

    Description:
    It's hard to prove this, but I'll try my best. I accidentally pressed a phishing link at my TF2 Outpost trade: http://www.tf2outpost.com/trade/10147421
    The link was posted via another hijacked Steam account. This account was hijacked by the same person. My original e-mail and/or password is now changed, so I don't have access to my account anymore. One item from my Team Fortress 2 inventory was stolen. Screenshot of my trade history: http://i.imgur.com/m15XA3W.png
    My item was sold as quickly as possible. Possibly for real money, as the hijacker's inventory is almost empty http://steamcommunity.com/profiles/76561198082794151/inventory/
    The hijacker's Steam account was created recently (January 13, 2013). His profile seems private, and he's got zero hours in Team Fortress 2. Here's a screenshot of a chat between him, and a Outpost Trader. He wanted to sell my item: http://i.imgur.com/MsVw6g4.png

    After further research at TF2 Outpost, I found the same phishing link being posted by his previous victims:
    http://www.tf2outpost.com/trade/10117335 - Dr.Müller
    http://www.tf2outpost.com/trade/10099844 - JG.Untrixツ
    http://www.tf2outpost.com/trade/10147864 - IIp
  2. waipun

    waipun New User

    Messages:
    9
    Steam:
    STEAM_0:0:46077848
  3. JazzLobster

    JazzLobster New User

    Messages:
    6
    This hijacker is still active. He must be stopped soon.
  4. Sir Campsalot

    Sir Campsalot New User

    Messages:
    11
    Steam:
    STEAM_0:1:52759663
    Guys, if you look closely, the real hijacker wasn't very careful. I've clicked on the link well aware of what might be on the page. The link was not the same, I appear to have lost the trade and person that posted the link, but I have the link itself: http://steomcommunity.com/profiles/736432131785135732/. I found this while searching for a decent price on Outpost.
    It leads to the same person as the link provided. I too noticed that other people fell victim to the same attack, and with careful inspection of the phishing page I've found the culprit.
    |steamID: Peonlord
    |steamID32: STEAM_0:1:41946357
    |steamID64: http://steamcommunity.com/profiles/76561198044158443
    |customURL: http://steamcommunity.com/id/Peonlord
    |steamrepURL: http://steamrep.com/profiles/76561198044158443
    Where I looked you might ask? The links on the page.
    Before this however, I tried going to steomcommunity.com. I found that it was a place for phishers to upload pages of their own choosing. This gave me the idea to check to see if the hijacker was careless. Obviously he was, since I'm here. The first link I clicked was on the recommendation for Team Fortress 2 at the bottom of the page. I suddenly found myself on the real Steam Community website. It was Peonlord's page. I decided to compare Peonlord's page and this "steomcommunity" page. I'll be getting some screenshots soon, but for now, I'll just explain. His steam badges are the same, the day he joined is the same, steam rating the same, number of games in his wishlist is the same, date and time of recommendation of TF2 is the same. The only thing that is different is the link that says "view all" above the comments. The view all link leads me to this person:
    |steamID: woobzor
    |steamID32: STEAM_0:0:18868863
    |steamID64: http://steamcommunity.com/profiles/76561197998003454
    |customURL: http://steamcommunity.com/id/woobzor
    |steamrepURL: http://steamrep.com/profiles/76561197998003454
    I'm fairly sure that Peonlord is the hijacker, however it could be this woobzor person just got careless when trying to frame this Peonlord person (or it could be they were working together and I just have a wild imagination).

    Side note: whichever person did it, he used every single account he hijacked to phish some more on Outpost. More people may be hijacked that just those mentioned. We should keep searching and removing all fake Steam Community links until this person runs out of hijacked accounts.
  5. Sir Campsalot

    Sir Campsalot New User

    Messages:
    11
    Steam:
    STEAM_0:1:52759663
    Oh and something I missed in the list of things that are the same between the fake page and Peonlord's page: the number of groups is the same.
  6. Sir Campsalot

    Sir Campsalot New User

    Messages:
    11
    Steam:
    STEAM_0:1:52759663
    Screenshots:

    [​IMG]

    [​IMG]

    [​IMG]

    [​IMG]

    [​IMG]
  7. Sir Campsalot

    Sir Campsalot New User

    Messages:
    11
    Steam:
    STEAM_0:1:52759663
    All links lead to legitimate Steam Community pages or the fake Steam login page
  8. Sjru

    Sjru User

    Messages:
    17,464
    Steam:
    STEAM_0:1:13315037
    Hello!!!
    Thank you for your report! An SR admin will review yours in a while!

    Hidden Content:
    **Hidden Content: Content of this hidden block can only be seen by members of (usergroups: Administrative, Moderating).**
  9. JazzLobster

    JazzLobster New User

    Messages:
    6
    I now have my account back. Here's the reply to my Steam Support ticket (Unfortunately it's in danish)
    Steam Support.png
  10. Xenophobia

    Xenophobia Retired Staff

    Messages:
    4,323
    Steam:
    STEAM_0:1:20973413
    Sorry for the wait.

    I need a few things from you.
    1. Link your Steam account with your forum account.
    2. Screenshot your entire Steam support ticket.
    3. Provide an uncropped screenshot of your inventory history.

    You can PM me the screenshots as I'm going to be closing the report due to it's age.
    Thanks.