Bitcoin Forum

I'm a hundred percent sure this is a new phishing link going around. I just got it a few seconds ago, and, I'll just drop it here so that people will be warned.


As you can see, Bitcointalk is clearly spelled wrong. And, I've never ran into this guy before.

I received the same thing from the user vovka777
Report it!

Thanks for this warning user such you are rare :-)

wow the best is you can enter any fake user or fake pass it will redirect you here

thanks for warning users

I and other few persons got it too. Don't enter your username and password in it. I have put a -ve trust (https://bitcointalk.org/index.php?action=trust;u=349554) but mine will do nothing! ::) Please PM to any person who are in DefaultTrust list, so that everybody can see.

The message I got :

  ~~MZ~~

I am in default trust, tell me which accounts sent that

Thank you for all the reports. If you see any more phishing PMs, be sure to report them as well.

So far, 7 users have been banned for posting this particular phishing site. :o The first 3 accounts that I banned were most likely hacked accounts (members or above), but all the newer ones are coming from 0 post accounts. I'm IP banning them, but whoever is behind it probably has access to vpns/proxies/dynamic ip.

edit: 4 more users have been banned for sending phishing links

I got the same - It's a phishing attempt.

Newbies will fall for that one.

Check and double check your links send to you. ALWAYS.

Link to the profile of the user LOL909 : https://bitcointalk.org/index.php?action=profile;u=349554 .

I think it isn't needed anymore, he might has banned. Anyway, just put it for the safety of others. :)


  ~~MZ~~

I both got this, reported the PM and posted a scam accusation about it.

It was more then obvious as to what was happening because I was already logged in and it was asking me to log in again

They can hide it behind bitcointalk too. so always look at the bottom of the screen before clicking on any link.

Thanks for this! Remember to always check the URL, and if you have never seen the message before, its probably a phishing scam.

OP: remove the hyperlink in the top post.. I was about to click it..

I think it's better not to. So other can know the link and how it looks. Clicking the link is okay, entering username and password is dangerous. ::)

  ~~MZ~~

Maybe remove the link itself, not the address

What I said.  ::)

Just posted this in Alts:


So, can we mega-ban p3tnnaster, please?
And for the URL, just add NOT....u can still see the URL as an example, but its no longer clickable.

Phisher is probably thinking he caught a big one...
https://i.imgur.com/6NLdSZC.png

 :D . What you got after logging in? Redirecting to BT?

  ~~MZ~~

Yep, redirects right back to the real site under the link that is in the OP. 

It's a phishing link. You'll be fine as long as you don't enter your username or password. But you can basically enter in a random or fake one. I didn't remove all of the link, because, I'm pretty sure they all have the same topic start number. 654845.

Anyway, you could basically click away, and even sit on the link and nothing will happen but a discouraged person, looking at the hundreds accounts with 'theymos' or 'satoshi' as their username.

Bombard the site with fake username and passwords.

Someone could set up a script to do it.  :D

I got one from p3tmacter

This guy is registering hordes of new accounts for the purpose of phishing peoples accounts. Look at the new members list and you'll find a bunch. I just went through the first 2 pages of the bitcointalk member list, these are only a few hours old.

NEMmaster
NEMxtester
EspoNem
nemeconomy
utopian-nem
nem-team
nemutopian
p3tnaster
nemxt
nem-xterster


You can see the members list here listed from new to old.
https://bitcointalk.org/index.php?action=mlist;sort=registered;start=0;desc
There's probably much more.

I don't get it - why are they doing it? Is it to give NEM a bad name, or to show ill fitted strength? It's bizarre to me. Not to mention, they bragged about the thought of them going to hack acounts. 

I deleted the spam PMs and banned all of the users and IPs sending them.

Good work, mate. +1

The source on the phishing website contains the following:

Is that last piece a session ID?

Maybe you could take a look at the logs and find out what IP was using that session ID.

It also looks like the phishing site is including style sheets from bitcointalk.org. You could set up the server to send a modified stylesheet that has a warning message added when it is requested by the phishing domain in order to warn people it is a phishing website.

Good ideas

GUYS report them to their registrar so they remove the site ASAP.

Send an email to  abuse@internet.bs  with a link to this thread and an explanation.