Declined 76561198031110182 & 76561198030201646

I believe on this thread the summary should go first.

Summary:
Two of my closet friends recently sent me a phishing/hijacknig link in chat (see chat log/screenshots). The chats were identical so I would assume that they clicked on the link and then were hijacked and sent the link to all their friends.

The url is: http :// steamconnumjty . MALWARE-SUSPECTED-bugs3- . com / forums / (no spaces)

Hijacked accounts:


steamID: [SF]SmokeyMapleBacon
steamID32: STEAM_0:0:35422227
steamID64: http://steamcommunity.com/profiles/76561198031110182
customURL:
steamrepURL: http://steamrep.com/profiles/76561198031110182



steamID: Captain Crossfire
steamID32: STEAM_0:0:34967959
steamID64: http://steamcommunity.com/profiles/76561198030201646
customURL: http://steamcommunity.com/id/crossfiretarget
steamrepURL: http://steamrep.com/profiles/76561198030201646


Screenshots:

HIJACKING SITE (http :// steamconnumjty . MALWARE-SUSPECTED-bugs3- . com / forums /)


CHATS:




Chat Logs:

Code:

Never tell your password to anyone.
Captain Crossfire: have you seen that written about you on the forum?
http://steamconnumjty.MALWARE-SUSPECTED-bugs3-.com/forums/
log in forum and go to section off topic
Captain Crossfire is now Offline.
Captain Crossfire is now Online.
[SF] Skr3wz!: you've been hijacked
[SF] Skr3wz!: you know
[SF] Skr3wz!: ?
[SF] Skr3wz!: lol

Code:

Never tell your password to anyone.
[SF]SmokeyMapleBacon: have you seen that written about you on the forum?
http://steamconnumjty.MALWARE-SUSPECTED-bugs3-.com/forums/
log in forum and go to section off topic
[SF]SmokeyMapleBacon is now Offline.
[SF]SmokeyMapleBacon is now Online.
[SF]SmokeyMapleBacon is now playing Team Fortress 2. Click here to join.
[SF]SmokeyMapleBacon is now playing Team Fortress 2. Click here to join.
[SF]SmokeyMapleBacon is now Offline.
[SF]SmokeyMapleBacon is now Online.
[SF]SmokeyMapleBacon is now Away.
[SF]SmokeyMapleBacon is now Online.
[SF]SmokeyMapleBacon is now Away.
[SF] Skr3wz!: you've been hijacked bro

Thanks for the info. If your friends were indeed hijacked, please have them post on this thread with screenshots of the support tickets.

I will defiantly get them to do that. As an added note it looks like the Hijackers took all of Captain Crossfire's unusuals (I'll tell him to show the trade history)

So I did some digging and found the scammer's main and 2 alts. The alt that he used to hack my friends is karambahaha (getting trade history screenies atm)

EDIT GOT SCREENIES, HE TOOK MY FRIENDS ENTIRE INVETORY:


The user is (CHECK HIS BP HE HAS THOSE HATS & HE IS 1 OF 2 FRIENDS OF THE SCAMMER ALT):

steamID: nikitos
steamID32: STEAM_0:0:34161011
steamID64: http://steamcommunity.com/profiles/76561198028587750
customURL: http://steamcommunity.com/id/shit1
steamrepURL: http://steamrep.com/profiles/76561198028587750


His scammer alt that he used to hack my friend:

steamID: karambahaha
steamID32: STEAM_0:1:53301555
steamID64: http://steamcommunity.com/profiles/76561198066868839
customURL: http://steamcommunity.com/id/3tdcg23rgfdsgds
steamrepURL: http://steamrep.com/profiles/76561198066868839

2nd scammer alt?
steamID: irek21
steamID32: STEAM_0:0:18784351
steamID64: http://steamcommunity.com/profiles/76561197997834430
customURL:
steamrepURL: http://steamrep.com/profiles/76561197997834430

I hid the above post due to information privacy. It is still visible to the admin that will review this thread.

Aces i have the ticket from the second person too, how should i post that pic?

PM it to me please. I'll post it for admins.

My other friends trade history (Note they both traded to the same alt account)



(I'll get his support ticket soon)

In the meantime, mark these:

steamID: irek21
steamID32: STEAM_0:0:18784351
steamID64: http://steamcommunity.com/profiles/76561197997834430
customURL:
steamrepURL: http://steamrep.com/profiles/76561197997834430

steamID: karambahaha
steamID32: STEAM_0:1:53301555
steamID64: http://steamcommunity.com/profiles/76561198066868839
customURL: http://steamcommunity.com/id/3tdcg23rgfdsgds
steamrepURL: http://steamrep.com/profiles/76561198066868839

steamID: nikitos
steamID32: STEAM_0:0:34161011
steamID64: http://steamcommunity.com/profiles/76561198028587750
customURL: http://steamcommunity.com/id/shit1
steamrepURL: http://steamrep.com/profiles/76561198028587750

^ this very interesting

Thanks for tagging him Diego, I really hope Captain Crossfire can get his unusuals back >.< (Most of them he bought through paypal)

If you have some free time, may you link to your unusuals with TF2Items please?

It was my friend's unusuals that were stolen (among his other items)

They were:
A P. Energy Festivizer: http://www.tf2items.com/item/963663509
A G. Fetti Heavy Duty Rag: http://www.tf2items.com/item/963663575
A Bubbles Glengary Bonnet: http://www.tf2items.com/item/963649281 <-- This one went to a different account during the same hack (The guy who was the 2nd alt)
A Orb. Fire Doctor's Sack: http://www.tf2items.com/item/846741632 <-- This one went to a different account during the same hack (Possibly a 3rd alt D
A Hearts Trilby: http://www.tf2items.com/item/784684513 <-- Went to the guy that the doctor's sack went to....

Hmm I think that the guy that the 2nd two unusuals might be working with nikitos (not an alt because he has a highlander badge and over 3800 hours in tf2)
steamID: Dneprikus.ua
steamID32: STEAM_0:1:18097465
steamID64: http://steamcommunity.com/profiles/76561197996460659
customURL:
steamrepURL: http://steamrep.com/profiles/76561197996460659

My friends BP before the hack:
http://www.tf2items.com/id/crossfiretarget?time=1340821751
My friends BP afterwards:
http://www.tf2items.com/id/crossfiretarget?time=1341949594

I really appreciate the help, I hope Valve contacts me soon, my ticket still hasn't been answered.

They usually take 2-3 days, at best. They get a lot of emails and messages.

Friend of mine got hijacked just last night by this guy.
His Orbiting Fire Hustler's Hallmark went to Irek21: http://www.tf2items.com/item/887650161
Same with many of his vintage hats, and likely his 20 ref.
V. Texas Ten Gallon: http://www.tf2items.com/item/808172066

He should be coming in some time today to post the trade log.

I'm this guys friend, and here, I have a picture of proof showing trade history:

Thanks for the extra info, the guys been given a scammer tag and hopefully with all this evidence we can get him and his alts a trade ban.

They replied, and got all my stuff back, as a warning they said this is the only time they'll do this for me, they won't help me again. That is good enough for me.