RMT HIJACKER NAMING SCHEME FOUND!! (SE please notice)

[Saithorx]

I may have spotted another one...

<first 3 letters of server>dex

aledex...
asudex...
bahdex...

and so on. Maybe they are gonna use the stats of the game

soon to be rmt
hadagi hadvit hadstr hadmnd hadint

[Bignineinch]

I got my account hacked. They moved me from Ragnarok to Hades and stripped me of course. The main m&*%$er moving all the big equips is Dimostenis, along with some others that I found- already task forced them but lol. >.> Tried talking to him once I got my account back- no reply. Damn cowards.

[Bignineinch]

I may have spotted another one...

<first 3 letters of server>dex

aledex...
asudex...
bahdex...

and so on. Maybe they are gonna use the stats of the game

soon to be rmt
hadagi hadvit hadstr hadmnd hadint

The had... are RMT, one of them sold my merc. kris and other ppl's stuff already on Hades.

[vagus]

I was browsing the bazaar's and ran into 3 that had the same type of model and a variety of gear. All 3 seemed to have equipment for a job and they were just dumping it. No major big items like a sash, just a variety of gear.

http://i269.photobucket.com/albums/j...705_230258.jpg

Here's a SS of one of the bazaar's. The account had a few HQ staves signed by [Taniss].

http://i269.photobucket.com/albums/j...705_230308.jpg

There is no Taniss on Odin, so this could be a user changing servers and just selling all of his gear. If it is, then i apologize, however it just looks too fishy.

-V

[notEtheron]

Oh my christ! After reading this thread, I came across this on cerberus

http://www.ffxiah.com/item.php?id=14825&sid=23

Dusk gloves +1 for 4M, I'd take that anyday. Think they are 20M+ atm. Look who sold them

[Pic0o]

Hello with my 1st post on here. I should have picked a happier topic, but figured extra info is worth it.

My Wife and I moved to Shiva when we reactivated, to play with some of her IRL friends, as we were on Ragnarok for the previous few years we've been playing. Anywho, Her account got Stolen around May 29th or so. I cleaned her PC, did the GM / SE dance, and she's back.

I'm pretty sure the only reason her Chars did not get moved to another server, is because she did a World Transfer for her old Chars, earlier in the week, prior to the account being stolen. When we got access back, her Char was gutted completely (Gil and Gear), so from there, a GM started the Rollback process, that was completed ~ 3 weeks later.

Once it was done, she got her Gear and Gil back, but was reverted back to Ragnarok. Sadly, she's stuck there until the end of August, as SE does not seem to flex on the World Transfer restriction of 90 days, seemingly for any reason.

Finally, when her account was stolen, someone renamed a Mule to Kutgkgki. I wanted to add that as possible trending, since I have yet to see much on that naming scheme. As I type this, I realize the Hijacker, perhaps intended to move her to the Kujata server (close to scheme, but not quite) and got blocked by the Day limit?

At lease SE refunded the World Transfer charge, since the Character Rollback put her mains back on Ragnarok.

Sorry about the backlog, best wishes in perma-shutting this kind of account stealing garbage down for good, or at least making it occur on a much more minuscule scale.

[Mayareira]

http://www.ffxiah.com/player.php?id=1281991&ig=1

Midguangtou, recently popped on midgard selling these stuff.

[EagleCeres]

Guess who was making a killing in Ifrit
Ifrdongbei -> http://www.ffxiah.com/player.php?id=1255180
last AH sale Jun. 11, 2008

[Palom]

http://www.ffxiah.com/player.php?id=1281991&ig=1

Midguangtou, recently popped on midgard selling these stuff.

I don't know what's more disturbing; all these RMT mules selling hijacked shit, or the fact that when I looked at this one, the first thing that irritated me was someone actually bought a Chasuble +1.

[Tawboo]

I caught the RMT's in action in Port Sandy yesterday...

zzale
jjale
**ale

...where trading back and forth on top of the AH. jjale would stay and a number of other **ale were loggin in and out.

while all this was going on there were two...

alemoon
alemoonn

...at the bottom of the AH trading also. alemoon kept casting invisible. ?!? i got right up next to alemoon and all of the sudden "it" sent me a trade. I opened the trade window and just waited. then i got a tell alemoon>>> 850987 (or a similar number) i just sat there waiting for item or gilz or something. "it" then closed the window. there were to many GM calls ahead of me to do anything at that moment and i needed to log out shortly after.

that really got my blood boiling in the morning.

[eldogress]

what if they have different departments. once account is hacked they have like a chop shop set up. if you look at the histories per server you see which are active drones and inactive drones ( maybe even banned) and they create a new one u see a few pop up after june 24th.

i noticed this when i got hacked and moved to ragnorak the 29th. when i logged in their was still stuff that fell down to me in dbox. I guess i got account locked in time but not soon enuf, and by the time i thought about looking at the name it had dissapeared. i heard of the haddongbei crew on hades suspected of hacking accounts and looked it up on other servers.

what if once the account is taken they send your gear to serveral different mules, and all you non ah gear to another mule. kinda of like departments you have the staff and ring seller, rse and lower gear seller, etc, etc,...

the non ah gear sellers would almost have to be a toon not named like that ( i personally wouldnt by from toon with first 3 of server.) this has been know on hades for sometime now.

this way you could never get them all at once and they would always have gil/money flowing. check it out on ever server the drones only sell a certain type of gear. and you can see the last sell date or when they prob got banded and which were just created.

[Doofus]

I was browsing the bazaar's and ran into 3 that had the same type of model and a variety of gear. All 3 seemed to have equipment for a job and they were just dumping it. No major big items like a sash, just a variety of gear.

http://i269.photo/bucket.com/albums/...705_230258.jpg

Here's a SS of one of the bazaar's. The account had a few HQ staves signed by [Taniss].

http://i269.photo/bucket.com/albums/...705_230308.jpg

There is no Taniss on Odin, so this could be a user changing servers and just selling all of his gear. If it is, then i apologize, however it just looks too fishy.

-V

That could possibly be delna, if its not a RMT, he likes to use variations of his name for his mules, sometimes he forgets to use invisible(online status) and i see their names, and hes a craftaholic, so who knows.

[Naash]

How can I hunt down stolen items selling RMTs on my server?


First step... /sea all [your server's first 3 letters]
See any characters in Lower Jeuno, Rolanberry (or Sauromugue/Battalia), Bastok or San d'oria? Level 1 or anon? May want to check on them.

Characteristics:
Hume Male, Face type 1A (blond), title is usually "New Adventurer".
Job is usually WAR and starting city Sand d'Oria or Bastok.

The naming pattern will be (server's first 3 letters) + 2-4 letters or more that can be:
- a job's abbreviation (pld, blm, cor...)
- a Chinese word (such as Baihe, ChangMao, Guangtou, Dongbei, Shuibian...)
- random letters or a job + random letters.


Checking with FFXIAH
Check the history of the following suggested popular items, such as HQ Elemental Staves, SH, Sorcerer Ring, etc. Check if any recent seller had a name starting by the first three letters of your server name, and if so, check in turn their history.

Anything fishy? They're only selling popular HL items, sometimes twice the same item in a row, a little under the market price? They're never buying anything? If you found them early, you'll see that typically the first history on these characters will be buying stacks of prism powders and silent oils.


Items often sold by suspicious characters, because typically stolen from hacked accounts:
http://www.ffxiah.com/item.php?id=17546
http://www.ffxiah.com/item.php?id=17550
http://www.ffxiah.com/item.php?id=17554
http://www.ffxiah.com/item.php?id=17558
http://www.ffxiah.com/item.php?id=17560
http://www.ffxiah.com/item.php?id=14630
http://www.ffxiah.com/item.php?id=15327
http://www.ffxiah.com/item.php?id=14774
http://www.ffxiah.com/item.php?id=14640
http://www.ffxiah.com/item.php?id=13155
http://www.ffxiah.com/item.php?id=12605
http://www.ffxiah.com/item.php?id=13734
http://www.ffxiah.com/item.php?id=17187
http://www.ffxiah.com/item.php?id=13056
http://www.ffxiah.com/item.php?id=13145
http://www.ffxiah.com/item.php?id=13952
http://www.ffxiah.com/item.php?id=14421
http://www.ffxiah.com/item.php?id=17829
http://www.ffxiah.com/item.php?id=13289
http://www.ffxiah.com/item.php?id=14630


Now the next step... Before anything, REPORT!

Follow one of the links to the STF report page in your favorite language and report on them.

EN: https://secure.playonline.com/supportus/exmf.html#stt
JP: https://secure.playonline.com/support/exmf.html#stt
FR: https://secure.playonline.com/supportfr/exmf.html#stt
GE: https://secure.playonline.com/supportde/exmf.html#stt


Thanks for your time.

[buttson]

is ***zhadila known?

http://www.ffxiah.com/player.php?id=1289646&sid=11

[EvilSid]

Read this to see how much lucky my friend Attilax was:

NB. also contains an RMT/account stealer's name corresponding to the scheme.

http://www.webalice.it/otacon00/ffxi/RMT01.JPG

I skip the part with all the boring questions to verify the identity of the account's owner. This is what come after:

http://www.webalice.it/otacon00/ffxi/RMT02.JPG

http://www.webalice.it/otacon00/ffxi/RMT03.JPG

http://www.webalice.it/otacon00/ffxi/RMT04.JPG

I don't have a clue about the reason for what this stealer did not receive these items. Maybe he had too many to receive (so delivery box overloading) or he was unable to connect because of current restrictions. Or he has been banned in the meantime.

Btw i'm going to report his name to Special Task Force.

We finally caught one!!! 8-)8-)8-)

Here's the two screens who make the proof:

http://www.webalice.it/otacon00/ffxi/RMT05.JPG
http://www.webalice.it/otacon00/ffxi/RMT06.JPG

I hope this could help the other players in Ragnarok

[Naash]

Wow, that's a nice find and your friend was lucky. Could you give us more details about the timing of how this happened? How long did the RMT have before you were able to use the account? Did you get access to the account after reporting and getting the PW reset or something?

[EvilSid]

Wow, that's a nice find and your friend was lucky. Could you give us more details about the timing of how this happened? How long did the RMT have before you were able to use the account? Did you get access to the account after reporting and getting the PW reset or something?

The password wasn't changed.. maybe 'cause it was an EU account, and the Membership section can't be accessed from NA (and JP?) accounts. For this reason I was unable to set a new password for my friend from my pc, as I said to GM.

We suspect Attilax logged in right in the middle of something. He just said he found the character in front of Lower Jeuno AH yesterday night (GMT), and he thought to have forgotten it there, but a few later he discovered to just have 163 gil. He tried to call a GM but because of his bad english he wasn't able to explain properly.

This morning I helped him and accessed from his account, I discovered the missing of the Pluto Staff, and then I called a GM.
So the items have remained in the delivery for about 10-11 hours, or even more (he discovered the theft at 23.00, i've found the items at 10.30).

[Rasantath]

i think i found something new. i searched the forums briefly first.
saw a char in nashmau (of all places) called Cvdiabn. the 'dia' is what caught my eye, since i'm on diabolos. the other characters are all in a straight line on the bottom row of a standard north american qwerty keyboard layout.
checking ffxiah i didnt see any transactions by this player (and they logged out before i could get a screenshot). when i did check ffxiah for other variations, i found some other interesting ones. their auction house history seems to indicate either fishing or crafting.
http://www.ffxiah.com/player_search....=cv%25bn&sid=0

[Midnightjade]

On Midgar:

Astridbirgit: http://www.ffxiah.com/player.php?id=1282755

Midnoot: http://www.ffxiah.com/player.php?id=1287959&sid=29

Both suspicious histories. Name of the second one also suspicious.

The first one also just dumped a pair of strider boots on AH for 400k.

[Freijah]

Astrid had the good sense to sell a Domaru.