1. There is no such thing as a "pending" ban or Steam admin. Anyone threatening your account is a scammer trying to scare you. Read more.

Archived Report: 76561197985785608 - (Noobinator / [TF2] Team Fortress 2 Items)

Discussion in 'Archived Reports' started by Drot, Apr 18, 2014.

  1. Drot

    Drot New User

    Messages:
    10
    Steam:
    STEAM_0:1:35076422
    Scam Report

    Report Type: [Money] PayPal scam or scam attempt
    Virtual item type involved: [TF2] Team Fortress 2 Items

    Accused profile: 76561197985785608 (Noobinator)

    Victim profile: 76561198030418573

    What happened? Description:
    Noobinator added me to buy me some buds. I checked his Steamrep and did a background check and everything seemed fine. However, apparently he has been hijacked, and the hijacker has stolen 13 buds from me. He's tagged on TF2OP now (the only site where I did't check), but I'm afraid its too late for me.
    And the worst part its that I actually suspected, I've f✿✿✿ed up badly.​

    Provide Evidence:
    Here are screenshots of the chat window, my Paypal acount and inventory history.​

    Attached Files:

  2. CoooookiE

    CoooookiE New User

    Messages:
    20
    Steam:
    STEAM_0:1:37781085
    f✿✿✿✿er just got 7 Buds from me.
  3. daemon

    daemon Retired Staff

    Messages:
    1,209
    Steam:
    STEAM_0:0:26049181
    Yes, he's hijacked as of now. I'm leaving this thread open, but DO NOT TRADE WITH NOOBINATOR.

    The files that are being sent are CONFIRMED VIRUSES. Do not click them.
    Last edited by a moderator: Apr 18, 2014
  4. Drot

    Drot New User

    Messages:
    10
    Steam:
    STEAM_0:1:35076422
    He got 13 from me. I should have trusted my instinct. And there is no way to recover them, right?
  5. Stephen the Brave

    Stephen the Brave New User

    Messages:
    38
    Steam:
    STEAM_0:0:28384907
    the hijaker sent me a virus link Capture.PNG
  6. daemon

    daemon Retired Staff

    Messages:
    1,209
    Steam:
    STEAM_0:0:26049181
    Steam is aware of this hijacking. I can't promise anything, but contact Steam Support and hope for the best.
    The files that are being sent are CONFIRMED VIRUSES. Do not click them.

    Noobinator's account is currently disabled.
  7. Drot

    Drot New User

    Messages:
    10
    Steam:
    STEAM_0:1:35076422
    Sent. And now I can only wait.
  8. Evanescence

    Evanescence New User

    Messages:
    418
    Steam:
    STEAM_0:1:19459148
    I got the same message.

    I also got the confirmation he got disabled too.

    Never trust ANYONE, as you can see they aren't hijacking proof. Steamrep admins can still be hijacked.

    Let's hope VALVe gonna think again about their hijacking item policy change.
  9. Noobinator

    Noobinator Retired Staff

    Messages:
    888
    SteamRep Admin:
    STEAM_0:0:12759940
    Yes, I was hijacked and was sent the link from a trusted HL leader friend I know from competitive play. It didnt fit the typical phisher profile and I guess that was why I bit on it. Sorry to anyone that lost something, but Valve should replenish it like my 8 unusuals that were initially stolen.
  10. Drot

    Drot New User

    Messages:
    10
    Steam:
    STEAM_0:1:35076422
    That's some great news for everyone involved in this fiasco. I'll be out for a day or two, but if Steam gives you everything back at least we can leave this just as a bitter experience. And I'll be extra careful from now on.
  11. Mattie!

    Mattie! SteamRep Admin

    Messages:
    5,251
    SteamRep Admin:
    STEAM_0:0:5712733
    Keep in mind that we do not know how Steam will handle this yet. We are hopeful, but please file Steam Support tickets and reference this thread if you need. Ask them if they will please reverse the trades because it isn't everyday that a Steam hijacker is able to abuse such trust (and we believe this was caught in time to prevent the items from getting very far). We are hopeful the items will be returned.

    If Steam Support does refuse your request, please let us know on this thread, or feel free to send a PM to Noobinator and myself about the outcome.
  12. Drot

    Drot New User

    Messages:
    10
    Steam:
    STEAM_0:1:35076422
    Steam support hasn't even aswered yet, and its been two days since I sent the report. I've read in other threads that the may take several days, so time to be patient.
  13. SilentReaper(SR)

    SilentReaper(SR) Retired Staff

    Messages:
    11,992
    SteamRep Admin:
    STEAM_0:0:89705646
    Hi there,

    We were quite fast in marking and warning Valve about Noobinator's hijacked account, and the account was locked down soon after.

    Noobinator was hijacked in this timeframe:
    April 18th, ~ 3:30pm PST = UTC -8 = 11:30pm UTC / 3:30pm PST​

    Account was locked (can talk but not trade):
    April 19th, ~2:00am CET = UTC +1 & +1 DST= April 19th, ~0:00am UTC / April 18th, 4:00pm PST​

    The account was marked on SteamRep as Banned:
    April 19th, 0:03am UTC = April 18th, 4:03pm PST​

    The account was made inaccessible somewhere between the lock and (no exact record for this available):
    April 19th, 3:50pm PST = UTC -8 = 11:50pm UTC / 3:50pm PST
    Hidden Content:
    **Hidden Content: Content of this hidden block can only be seen by members of (usergroups: Administrative, Moderating).**

    He then regained account fully around (unlocked):
    April 20th, 11:06am PST = UTC -8 = 7:06pm UTC / 11:06am PST​

    I've worked with Noobinator to ensure checks on his account access, so the hijacker will not be able to get access to the account again from this occurrence.

    Mule account:
    As we where quite fast, the hijacker had not moved the scammed items from the mule account yet:

    All scammed items where moved to this MULE account:
    | steamname: traderis
    | steamID32: STEAM_0:1:67124131
    | steamID64: http://steamcommunity.com/profiles/76561198094513991
    | customURL:
    | steamrep: http://steamrep.com/profiles/76561198094513991

    See also: http://forums.steamrep.com/threads/76561198094513991-mr-jokny.33788/

    More information on the mule account:
    Banned on TF2 Outpost for spamming phishing links back in June 15th, 2013, IP's show Germany (Proxy) and New York (also Proxy) so those are useless. We have on good account that the phisher is probably from Lithuania (cannot elaborate on that, sorry).

    The actual victims were:

    Loss of 13 Buds:

    Loss of 7 Buds:


    Loss of 8 buds:
    | steamname: Leves TF2-T [A]
    | steamID32: STEAM_0:0:23350111
    | steamID64: http://steamcommunity.com/profiles/76561198006965950
    | customURL: http://steamcommunity.com/id/Bableves
    | steamrep: http://steamrep.com/profiles/76561198006965950

    Loss of 5 buds:


    For these victims, please contact Steam Support telling them:
    You have been scammed by a hijacker on Noobinator's account which was marked as a trusted SteamRep Admin at the time (please state it like that). All above trades mentioned have been in that time-span of ~30 minutes before any action could have been done.

    As the mule account was caught and LOCKED before moving items further, you should stand a fair chance to get your item trade reversed because they were never moved on. We would like the victims to report back to their reports here if / when items are being granted back. Till that point, the reports will be kept open.

    We're very sorry for the discomfort this may have caused. We are considering actions to improve things as we go, and this situation (re-)started a discussion on improvements in admins section for this. The results may be reflected at a later date-- both in public policies and in our own internal procedures with admins.

    Greetz,

    SilentReaper(SR)
    Last edited by a moderator: Apr 22, 2014
  14. ☠Noobιηator☠

    ☠Noobιηator☠ New User

    Messages:
    5
    Steam:
    STEAM_0:0:12759940
    Per standard SteamRep protocol, below is proof of my hijacking, to prove I was not the thief and that I had indeed been hijacked, losing control of my acct. This should also suffice in clearing me from this report and proving I was not the scammer. That being said, I am indeed very sorry for your loss and this mess, and hope steam is able to recover and replace your items. As Silent Reaper suggested, please be sure to report this in detail to Steam via a Steam ticket. Very best of luck to you.

    Attached Files:

  15. SilentReaper(SR)

    SilentReaper(SR) Retired Staff

    Messages:
    11,992
    SteamRep Admin:
    STEAM_0:0:89705646
    Seems I forgot something.

    Would the victims please supply their Steam Ticket number for this case.
  16. Drot

    Drot New User

    Messages:
    10
    Steam:
    STEAM_0:1:35076422
    Mine is 8297-FHKL-9479. I updated it a few hours ago with the information you provided.
  17. Drot

    Drot New User

    Messages:
    10
    Steam:
    STEAM_0:1:35076422
    Well, they've finally answered, and its bad news: They're not giving the items back.

    I personally don't think its fair, since this wouldn't have happened if Noobinator's account had not been hijacked in the first place, and I couldn't really know it was a hijacker, but they won't listen, so I guess this is the end of it.

    Attached Files:

  18. Drot

    Drot New User

    Messages:
    10
    Steam:
    STEAM_0:1:35076422
    I've replied to them, just in case they decide to change their minds, but my hopes aren't high.

    Attached Files:

  19. Drot

    Drot New User

    Messages:
    10
    Steam:
    STEAM_0:1:35076422
    Oh my god they actually listened and gave me the buds back. I can't believe it. I'm so happy that this has ended the best possible way. Thanks everyone for their time and help.

    Attached Files: