GUILTY Case# 2011-076 | gaban13 vs www.goldermarkets.com

Based on the available evidence, do you believe that GolderMarkets.com is guilty?

  • Guilty

    Votes: 34 91.9%
  • Not Guilty

    Votes: 3 8.1%

  • Total voters
    37
  • Poll closed .
The logs you have attached don't cover all trading.

Let's talk about acc #8119548 alone.

Your log shows there was one trade opened by the EA:

16:33:00 GolderExpert EURUSD,M1: open #1525211 sell 0.05 EURUSD at 1.41658 ok

And two closed by a script:

20:49:36 CLOSEALLPROFIT EURUSD,M1: close #1518477 sell 0.05 EURUSD at 1.40637 at price 1.40366

23:13:37 CLOSEALLPROFIT EURUSD,M1: close #1529528 sell 0.05 EURUSD at 1.40766 at price 1.39782

But the broker journal shows three orders were closed that day: 1525211, 1518477 and 1529528 - in this order of receiving commands.
Moreover, they failed few times and something repeated the close command.
This could be the Script trying again and logging failures with: LastError = 136.
But there is something wrong with the timing in the sequence.
As if someone else was executing commands via some other interface.
See attachment.

What did issue command to close order #1525211 that day? It's not in your logs.

Does the broker provide web interface so you can trade directly on his platform?

There is one instant sell order at 1.40766 in a bottom of this screenshot - I cannot find it in your logs.
 

Attachments

  • Screen shot 2011-10-11 at 14.31.35.png
    Screen shot 2011-10-11 at 14.31.35.png
    193.8 KB · Views: 12
Last edited:
The logs you have attached don't cover all trading.

Let's talk about acc #8119548 alone.

Your log shows there was one trade opened by the EA:

16:33:00 GolderExpert EURUSD,M1: open #1525211 sell 0.05 EURUSD at 1.41658 ok

And two closed by a script:

20:49:36 CLOSEALLPROFIT EURUSD,M1: close #1518477 sell 0.05 EURUSD at 1.40637 at price 1.40366

23:13:37 CLOSEALLPROFIT EURUSD,M1: close #1529528 sell 0.05 EURUSD at 1.40766 at price 1.39782

But the broker journal shows three orders were closed that day: 1525211, 1518477 and 1529528 - in this order of receiving commands.
Moreover, they failed few times and something repeated the close command.
This could be the Script trying again and logging failures with: LastError = 136.
But there is something wrong with the timing in the sequence.
As if someone else was executing commands via some other interface.
See attachment.

What did issue command to close order #1525211 that day? It's not in your logs.

Does the broker provide web interface so you can trade directly on his platform?

There is one instant sell order at 1.40766 in a bottom of this screenshot - I cannot find it in your logs.

the previous log is only for 2011/09/09 during the incident happen.attached in my logs from 2011/09/01 to 2011/09/09. they have webtrader but i never log to their platform.i only use mt4 platform.

seriously i don't know anything about the command. i am only a trader.never had problem like this before so i have less concerned on journal.the post in your attachment is for 2011/09/06.i already attached full logs file
 

Attachments

  • logs.zip
    5.8 KB · Views: 6
Last edited:
the previous log is only for 2011/09/09 during the incident happen.attached in my logs from 2011/09/01 to 2011/09/09. they have webtrader but i never log to their platform.i only use mt4 platform.

seriously i don't know anything about the command. i am only a trader.never had problem like this before so i have less concerned on journal.the post in your attachment is for 2011/09/06.i already attached full logs file

Ok, these logs fill the gap.

I'm attaching updated extract from that day.
 

Attachments

  • Screen shot 2011-10-11 at 21.56.24.png
    Screen shot 2011-10-11 at 21.56.24.png
    247.2 KB · Views: 10
Last edited:
This is what I find here:

- the broker logs show series of GBPNZD trades that are not in gaban13 logs.
- gaban13 EURUSD trades are both in his logs and the broker logs (it would be nice if you created a package of both application and experts logs because one needs both to aggregate events).
- both gaban13 trades and the ones he says he didn't do are logged with the same ISP ip addresses.
- there is a difference in the way the broker system responded to the orders. gaban13 EA/manual order sequence looks like this:

2011.09.06 17:14:38 110.159.13.240 '8117721': instant sell 0.05 EURUSD at 1.40753 sl: 0.00000 tp: 0.00000 (1.40754 / 1.40774)
2011.09.06 17:14:38 '1': request from '8117721' (sell 0.05 EURUSD at 1.40753 sl: 0.00000 tp: 0.00000)
2011.09.06 17:14:40 GolderMarkets Meta T '1': confirm '8117721' sell 0.05 EURUSD at 1.40753 sl: 0.00000 tp: 0.00000 (1.40759 / 1.40779)

Note we have a sequence of events: an order is coming in and the broker system responding and logging the order processing progress messages.

While the problematic ones are missing the normal system messages:

2011.09.08 19:29:17 110.159.13.240 '841571': order #1550584, sell 0.50 GBPNZD at 1.91623
2011.09.08 19:29:45 110.159.13.240 '841571': order #1550591, sell 0.50 GBPNZD at 1.91612
2011.09.08 19:30:03 110.159.13.240 '841571': order #1550598, sell 0.50 GBPNZD at 1.91607
2011.09.08 19:30:20 110.159.13.240 '841571': order #1550604, sell 0.50 GBPNZD at 1.91608
2011.09.08 19:30:35 110.159.13.240 '841571': order #1550607, sell 0.50 GBPNZD at 1.91607
2011.09.08 19:30:50 110.159.13.240 '841571': order #1550614, sell 0.50 GBPNZD at 1.91583
2011.09.08 19:31:07 110.159.13.240 '841571': order #1550622, sell 0.50 GBPNZD at 1.91576
2011.09.08 19:31:26 110.159.13.240 '841571': order #1550627, sell 0.50 GBPNZD at 1.91572
2011.09.08 19:31:27 '841571': reach stopout ml 82.05%, equity: 1051.96, margin: 1282.05

Which suggests these orders were entered somehow differently (outside MT4) while the timing suggests automated action.

Either something/someone traded the accounts from gaban13 side (he says not) using the same public ip, either someone wiped out the accounts (deliberately?) and then covered it by replacing ip addresses in the broker database with the one gaban13 used the last.

gaban13 points that about 15 minutes before the first GBPUSD trade someone was checking the accounts passwords:

2011.09.08 19:15:43 109.108.132.95 '4019': checking password of '8118831' [successful]
2011.09.08 19:21:08 109.108.132.95 '4019': checking password of '841571' [successful]
2011.09.08 19:21:22 109.108.132.95 '4019': checking password of '8117721' [successful]
2011.09.08 19:21:46 109.108.132.95 '4019': checking password of '8118826' [successful]

And these requests come from some ISP located in UK while the rest comes either from Malaysia (gaban13 location), either Singapore (the broker server?).

This indeed may point to the fraud/hacking. Especially I didn't find this kind of entry elsewhere. Neither this kind, neither this ISP.

I have a growing impression either the broker did it either someone hacked the broker internal system and then the accounts - only this way he could bypass the MT4 interface resulting in missing normal order processing system messages while he was able to replace ip addresses to cover his activity.
Yes - the fraudster wasn't smart enough thinking he could cover it all. ;-)

Of course one may say gaban13 did it all and then edited his logs to cover it up.
Yes, he could do that. But he couldn't enter the trades the way they didn't trigger the broker MT4 interface to log the order processing messages. Unless he had some other way to do it automatically.

That's how I get it.

Added:

Just came across the broker warning/scam report regarding gaban13:

http://www.golderforex.com/specialcase/200912-IB-official-notice.html

Which sounds very serious. The text contains links to the five accounts journals:

http://www.golderforex.com/specialcase/JournalReport_8117721.htm
http://www.golderforex.com/specialcase/JournalReport_8118826.htm
http://www.golderforex.com/specialcase/JournalReport_841571.htm
http://www.golderforex.com/specialcase/JournalReport_8118831.htm
http://www.golderforex.com/specialcase/JournalReport_8119548.htm

And indeed all of them are missing this password check entry.
This does not build the broker report confidence.
 
Last edited:
Vendetta?

Just one more thought: it all looks like vendetta-revenge.
All of it: the damage to the accounts, your comments, the broker comments (on his site).
Didn't you clash with the broker or someone else over the business?
 
Just one more thought: it all looks like vendetta-revenge.
All of it: the damage to the accounts, your comments, the broker comments (on his site).
Didn't you clash with the broker or someone else over the business?

actually their representative from Singapore approach me to be their master IB in Malaysia..i don't know where is the problem.maybe all my clients made much profit (using scalper EA),that is why they unhappy with me. most of my clients double their account within a month.this type of broker only happy when trader lose their money.
thank you for your clear explanation.much appreciate
 
Last edited:
There is no smoke without a fire - this looks more like deliberate attack rather than the fraud itself. I may be wrong but this is my impression.
 
I think the golder could have easily said he violated terms/agreements and cancelled his profits/commission and suspend his account. Like most brokers do.

Instead of some over elaborate hacking coverup. Just my opinion tho.
 
Back
Top