Scammed by PurplePandaLabs for $900 - GG gaslighting

I mean, for fucks sake, the time he spent doing that shit he could probably make the money some legit way.
I think his job in real life is graphics designer...which makes that pic Ollie posted so much fitting!
 
Looks like OP made a number of accounts on PPL's website + also made some fake emails. He made purplepandalab@proton, placed a $900 order on the site but never paid it. Instead he transferred $900 from his own wallet to another one of his wallets so that he had 'proof of payment'. After doing this he wrote himself an email from his fake ppl@proton address saying "payment received!". He's trying to frame it as if a 'hacker' intercepted the payment on PPL's website. He sets the scene for this by 'photoshopping' a different QR code on the order payment page for the original $900 order. You can see that the QR code has a black background, though, and the address is a bc1 address (segwit) which is recently released and only compatible with some newer wallets. No payment gateways use bc1 addresses yet, and the black background leads us to believe that this was crudely cropped and pasted by OP as part of the scam.

Basically he, apparently, faked this big charade in which PPLs website was producing QR codes for a 'hacker's' wallet, when in reality he was just moving money between his own wallets to try to make it look like he paid someone that he didn't. And he would've gotten away with it too if it weren't for you meddling kids!

Thanks. I hate people who steal.
 
Okay so a lot to reply to.


The main one people keep banging on about is the wrong colour QR code - look at the top right of the screen at the addons for Firefox, i'm using Dark Reader and as you will see below in the video, it changes the colour from white to black.

Install the addon yourself and have a look.

https://addons.mozilla.org/en-GB/firefox/addon/darkreader/

https://gfycat.com/splendidhelpfulbanteng

Change quality of the video to HD to see it clearly. Note that I did create a second PPL account today to show this as I didn't want to fill my original (and only other) PPL account with fake orders.

Scammer history

A lowlife scumbag (yeah, that’s you), created several accounts on the same time period on the website, after creating the orders he sent his money to his own account, he approached with the different accounts to me, Melody and Panda asking about his order, obviously the order was not processed because we didn’t receive any payment to our addresses (addresses that are generated by a second website and we can’t manipulate), then this guy, with every account answered super surprised “how’s that, I sent my money to the address that was given on the website, maybe you guys have been hacked as in the past or you have scammed me” (more or less this were the guy’s messages with every account).

How we framed you
1)You are so stupid that you edited the pic wrong, every QR code generated by our website has a white design and fits inside the square, yours is black and doesn’t fit inside the square, congrats, you are smart enough to breathe and not shit on yourself.

2)Our website and the system it automatically uses, uses old addresses, you address is one of the new BTC addresses, and the guys from here that have ordered trough me they always know I give new addresses and not older ones as the website does, i even posted a guide here.

3)This message that you sent: “ the BTC address that was provided has received multiple deposits within a few day range of when i was given it, maybe others that placed an order on your website will get into contact in the coming weeks but either way i'm out of $900”
Wow, not suspicious at all, not suspicious at all that all the accounts created at the same time, that were not already customers, and that didn’t fullfill their orders were messaging us about this.

4)And wow you have a freshly new created account! @Millard if you have some free time i can send you all the prove needed to prove that this guy is a scammer and to see if you can ban him.

Honestly you are a sad person that took some of my precious free time off after having some of the worst months of my life, you also took my time to get attention to other members, since the security of the website will always be a priority for me since the previous problems.
Lots to reply to here..

I have only made two accounts in total on PPL website - the first being the one I placed the order on and the second being the one I created just now to show the dark reader addon.

I have only ever asked about my order on the one protonmail account or wickr, please show what 'proof' you have otherwise. Of course if you make up some fake email accounts or edit screenshots you'll just claim innocence. Exact same argument you have against me.

1. Dark reader addon

2. I've no idea how PPLs BTC system works, I just know that I was sent to a different URL to pay (as shown in the first screenshot) than the one supplied in the email.

Have you investigated this link at all or are you too convinced I am a scammer?

Protonmail email order links to:
https://www.purplepandalabs.com/shop/payment?code=210729020421630

Website forwarded me to:
https://www.purplepandalabs.com/shop/payment?code=041026682648504

3. What accounts were created at the same time? Give us some information/screenshots/proof?

4. Of course it's a fresh account - i've never registered on this forum before and had no reason to until placing an order. The entire plan was to order a bunch of stuff and have it tested and providing the evidence for others to help decide which source to use.

The security of the site will always be a priority for you? Aren't you just a rep? Why do you priorities the security of the site? What access do you have exactly?

I'd love to know how deep your fingers are in the pie. If you have access to any sensitive information then you are gonna be suspect number one imo. Reps are a dime a dozen and you are what, the third one or more for PPL?

Maybe @purplepandalabs can shed some light on this and look into that link.

View attachment 151723
Top pic your: “I have learned to edit pics, im a pro guy”
Bottom pic: our normal address and order.

View attachment 151724
Panda was completely right about using this pic, enjoy!

Dark reader addon.

i have been working with BTC in real life for a long time, you just faked the invoice with an address type that the website is not even capable to create, you just put a segwit address lol they never use segwit

+10 points to Slytherin for the effort

I've no idea about BTC so can't answer that. All I can say is if the order was intercepted then that can explain how a segwit address was used if it is currently is not possible with PPLs billing system.

Looks like OP made a number of accounts on PPL's website + also made some fake emails. He made purplepandalab@proton, placed a $900 order on the site but never paid it. Instead he transferred $900 from his own wallet to another one of his wallets so that he had 'proof of payment'. After doing this he wrote himself an email from his fake ppl@proton address saying "payment received!". He's trying to frame it as if a 'hacker' intercepted the payment on PPL's website. He sets the scene for this by 'photoshopping' a different QR code on the order payment page for the original $900 order. You can see that the QR code has a black background, though, and the address is a bc1 address (segwit) which is recently released and only compatible with some newer wallets. No payment gateways use bc1 addresses yet, and the black background leads us to believe that this was crudely cropped and pasted by OP as part of the scam.

Basically he, apparently, faked this big charade in which PPLs website was producing QR codes for a 'hacker's' wallet, when in reality he was just moving money between his own wallets to try to make it look like he paid someone that he didn't. And he would've gotten away with it too if it weren't for you meddling kids!

I did not create that email address - i'd imagine someone would have made it years ago considering PPL has been around for what, 5+ years? I know that PPL owner himself used to use purplepandalabs@proton with an S on the end so it would make sense that someone would have registered the scam one years ago to phish people with.

Hey @Gdawg do you realize you are nothing but a 2-bit reverse scammer? You must have a tiny brain to even do this sort of thing. Since you joined up here a few days ago did you try pulling this scam on Panda on another forum? If so hope you get your ass banned everywhere!

Even Millard here takes a very dim view of scammers and reverse scammers.

I'm all for roasting a scammer and love reading shit like this however being the apparent scammer in this case is pretty wanky.

The reason why I went with PPL is because they were one of the best rated (non-USA) sources that I could find and I took a bit of a gamble doing such a large order as the first one.

To get into this mess is a bit shitty but there's always a risk with stuff like this.

If PPL is actually legit then they need to look into why the fuck I was forwarded to the different PPL URL and who is behind it.

Is it someone that works for PPL? Is it PPL in general? Is it someone that's gained access somehow? Fuck if I know, i'm just giving the information I have at hand.

Either way i'm considering the money lost at this point and will use a different source in future. Obviously not going to mention what source as then people will claim i'm just here to badmouth and shill for another one.

If anyone here trusts PPL and is going to place orders with them here's some advice, order that shit via email and do not use the website because clearly that can be intercepted. If PPL won't let you order that way, well that says something about the source.
 
@Gdawg, if you feel Ollie is lying please offer proof. If you do have any other clear proof please share as what Ollie and the owner of Panda posted shows you as being in the wrong. In addition there's other emails that may be missing.
 
Okay so a lot to reply to.


The main one people keep banging on about is the wrong colour QR code - look at the top right of the screen at the addons for Firefox, i'm using Dark Reader and as you will see below in the video, it changes the colour from white to black.

Install the addon yourself and have a look.

https://addons.mozilla.org/en-GB/firefox/addon/darkreader/

https://gfycat.com/splendidhelpfulbanteng

Change quality of the video to HD to see it clearly. Note that I did create a second PPL account today to show this as I didn't want to fill my original (and only other) PPL account with fake orders.


Lots to reply to here..

I have only made two accounts in total on PPL website - the first being the one I placed the order on and the second being the one I created just now to show the dark reader addon.

I have only ever asked about my order on the one protonmail account or wickr, please show what 'proof' you have otherwise. Of course if you make up some fake email accounts or edit screenshots you'll just claim innocence. Exact same argument you have against me.

1. Dark reader addon

2. I've no idea how PPLs BTC system works, I just know that I was sent to a different URL to pay (as shown in the first screenshot) than the one supplied in the email.

Have you investigated this link at all or are you too convinced I am a scammer?

Protonmail email order links to:
https://www.purplepandalabs.com/shop/payment?code=210729020421630

Website forwarded me to:
https://www.purplepandalabs.com/shop/payment?code=041026682648504

3. What accounts were created at the same time? Give us some information/screenshots/proof?

4. Of course it's a fresh account - i've never registered on this forum before and had no reason to until placing an order. The entire plan was to order a bunch of stuff and have it tested and providing the evidence for others to help decide which source to use.

The security of the site will always be a priority for you? Aren't you just a rep? Why do you priorities the security of the site? What access do you have exactly?

I'd love to know how deep your fingers are in the pie. If you have access to any sensitive information then you are gonna be suspect number one imo. Reps are a dime a dozen and you are what, the third one or more for PPL?

Maybe @purplepandalabs can shed some light on this and look into that link.



Dark reader addon.



I've no idea about BTC so can't answer that. All I can say is if the order was intercepted then that can explain how a segwit address was used if it is currently is not possible with PPLs billing system.



I did not create that email address - i'd imagine someone would have made it years ago considering PPL has been around for what, 5+ years? I know that PPL owner himself used to use purplepandalabs@proton with an S on the end so it would make sense that someone would have registered the scam one years ago to phish people with.



I'm all for roasting a scammer and love reading shit like this however being the apparent scammer in this case is pretty wanky.

The reason why I went with PPL is because they were one of the best rated (non-USA) sources that I could find and I took a bit of a gamble doing such a large order as the first one.

To get into this mess is a bit shitty but there's always a risk with stuff like this.

If PPL is actually legit then they need to look into why the fuck I was forwarded to the different PPL URL and who is behind it.

Is it someone that works for PPL? Is it PPL in general? Is it someone that's gained access somehow? Fuck if I know, i'm just giving the information I have at hand.

Either way i'm considering the money lost at this point and will use a different source in future. Obviously not going to mention what source as then people will claim i'm just here to badmouth and shill for another one.

If anyone here trusts PPL and is going to place orders with them here's some advice, order that shit via email and do not use the website because clearly that can be intercepted. If PPL won't let you order that way, well that says something about the source.


Dude. Wait a second. Are you lying?
 
@Gdawg, if you feel Ollie is lying please offer proof. If you do have any other clear proof please share as what Ollie and the owner of Panda posted shows you as being in the wrong. In addition there's other emails that may be missing.

Lying about what exactly? I don't know who scammed me, whether it is PPL in general, someone that works there or a third party. I just know that I was forwarded to a different URL than the one provided in the PPL order email.

Dude. Wait a second. Are you lying?

No, what is it you think i'm lying about?
 
Okay so a lot to reply to.


The main one people keep banging on about is the wrong colour QR code - look at the top right of the screen at the addons for Firefox, i'm using Dark Reader and as you will see below in the video, it changes the colour from white to black.

Install the addon yourself and have a look.

https://addons.mozilla.org/en-GB/firefox/addon/darkreader/

https://gfycat.com/splendidhelpfulbanteng

Change quality of the video to HD to see it clearly. Note that I did create a second PPL account today to show this as I didn't want to fill my original (and only other) PPL account with fake orders.


Lots to reply to here..

I have only made two accounts in total on PPL website - the first being the one I placed the order on and the second being the one I created just now to show the dark reader addon.

I have only ever asked about my order on the one protonmail account or wickr, please show what 'proof' you have otherwise. Of course if you make up some fake email accounts or edit screenshots you'll just claim innocence. Exact same argument you have against me.

1. Dark reader addon

2. I've no idea how PPLs BTC system works, I just know that I was sent to a different URL to pay (as shown in the first screenshot) than the one supplied in the email.

Have you investigated this link at all or are you too convinced I am a scammer?

Protonmail email order links to:
https://www.purplepandalabs.com/shop/payment?code=210729020421630

Website forwarded me to:
https://www.purplepandalabs.com/shop/payment?code=041026682648504

3. What accounts were created at the same time? Give us some information/screenshots/proof?

4. Of course it's a fresh account - i've never registered on this forum before and had no reason to until placing an order. The entire plan was to order a bunch of stuff and have it tested and providing the evidence for others to help decide which source to use.

The security of the site will always be a priority for you? Aren't you just a rep? Why do you priorities the security of the site? What access do you have exactly?

I'd love to know how deep your fingers are in the pie. If you have access to any sensitive information then you are gonna be suspect number one imo. Reps are a dime a dozen and you are what, the third one or more for PPL?

Maybe @purplepandalabs can shed some light on this and look into that link.



Dark reader addon.



I've no idea about BTC so can't answer that. All I can say is if the order was intercepted then that can explain how a segwit address was used if it is currently is not possible with PPLs billing system.



I did not create that email address - i'd imagine someone would have made it years ago considering PPL has been around for what, 5+ years? I know that PPL owner himself used to use purplepandalabs@proton with an S on the end so it would make sense that someone would have registered the scam one years ago to phish people with.



I'm all for roasting a scammer and love reading shit like this however being the apparent scammer in this case is pretty wanky.

The reason why I went with PPL is because they were one of the best rated (non-USA) sources that I could find and I took a bit of a gamble doing such a large order as the first one.

To get into this mess is a bit shitty but there's always a risk with stuff like this.

If PPL is actually legit then they need to look into why the fuck I was forwarded to the different PPL URL and who is behind it.

Is it someone that works for PPL? Is it PPL in general? Is it someone that's gained access somehow? Fuck if I know, i'm just giving the information I have at hand.

Either way i'm considering the money lost at this point and will use a different source in future. Obviously not going to mention what source as then people will claim i'm just here to badmouth and shill for another one.

If anyone here trusts PPL and is going to place orders with them here's some advice, order that shit via email and do not use the website because clearly that can be intercepted. If PPL won't let you order that way, well that says something about the source.
@OllieJacobs do you have any answer to @Gdawg rebuttal? It may be alot to read but read it and answer him....
 
Lying about what exactly? I don't know who scammed me, whether it is PPL in general, someone that works there or a third party. I just know that I was forwarded to a different URL than the one provided in the PPL order email.



No, what is it you think i'm lying about?
Okay do you have an explanation for the bitcoin addy you were shown when you placed this supposed order? Several people have identified that address as a Segwit address that many wallets cannot handle yet while Ollie has indicated that Panda still uses the old-style bitcoin addresses. Another thing I thought might be relevant is that your system is *possibly* infected with malware that looks for things like bitcoin addresses and changes them. Have you done a malware scan on your system? A recommended scanner is Malwarebytes and they offer a free scanner.

I use the Dark Reader app as well, and it does alter the color of websites and I haven't tried it on sample QR codes however but you MIGHT have a point with that.
 
Last edited:
Okay do you have an explanation for the bitcoin addy you were shown when you placed this supposed order? Several people have identified that address as a Segwit address that many wallets cannot handle yet while Ollie has indicated that Panda still uses the old-style bitcoin addresses. Another thing I thought might be relevant is that your system is *possibly* infected with malware that looks for things like bitcoin addresses and changes them. Have you done a malware scan on your system? A recommended scanner is Malwarebytes and they offer a free scanner.

I use the Dark Reader app as well, and it does alter the color of websites and I haven't tried it on sample QR codes however but you MIGHT have a point with that.

Fair shout for Malwarebytes, just done a scan and it's all clean.

FWIW i've used BTC a few times these past few weeks and not have any issues.

If someone were to gain access to my computer in any way i'd imagine the first thing they'd be raiding is my PayPal account.

As for an explanation for the BTC addy - it could be any number of things - if PPL are a legit source then they've been compromised in some way, whether it's an employee or third party. Maybe someone is skimming from the top, maybe someone has found a zero day and is making use of it but not enough for PPL to turn off the website.

For your Dark Reader, i'd recommend placing a fake order and record the screen while toggling Dark Reader on/off. If PPL are behind it then they'll likely change something to discredit my proof and continue the scamming.
 
A quick and dirty test I did with Dark Reader on Panda's site using both Chrome and Firefox indeed turn the white boxes black.

I would like to see Ollie try this extension and hopefully get to see who's right and who's wrong.
 
In all fairness, they did get compromised not too long ago. I never believed the whole "it was a remailer" story. They were compromised before that, too. In this case, I could see a possible selective-type redirect to a payment page that was slipped in. So in this case, both parties could be innocent, except that it would be an indication that PPL's opsec continues to blow.
 
In all fairness, they did get compromised not too long ago. I never believed the whole "it was a remailer" story. They were compromised before that, too. In this case, I could see a possible selective-type redirect to a payment page that was slipped in. So in this case, both parties could be innocent, except that it would be an indication that PPL's opsec continues to blow.
Very good point right there and this may well be what's happening. I asked OP if he did a malware scan as I suspect possible malware could be redirecting or altering the payment page especially if that page was showing a so-called BC1 address and Panda indicated they only use the old-style bitcoin addresses supposedly generated by another site (which might been compromised).

I was going to test my theories but I am very leery of making an account on that site.
 
This gets interesting.
Very. I did a little bit of digging and I am coming closer to the conclusion OP is right but questions still remain especially about the bitcoin address displayed in OP's screenshot of the payment page versus Ollie's.
 
Maybe saying their opsec blows is a bit harsh. They do a lot of volume and have a public website that sells AAS. The site has to stay public. It's going to attract some of the best motherfuckers on this planet as a juice'y target. Do it well enough, and subtlely enough, and you could probably collect quite a bit of BTC while both parties accuse each other of fraud. If I was going to do it, I'd have a condition set such that it only happens infrequently and for amounts in excess of a certain amount, sending them to a cloned payment page that has a different address. They are literally going to have to hire a hacker to defend themselves, and all they're going to be able to do is slow someone down enough to give them time to detect intrusions and modifications... or make hacking them so annoying they find another target. Nothing will be 100%.
 
Top