Bitcoin Forum
August 18, 2019, 05:47:50 AM *
News: Latest Bitcoin Core release: 0.18.0 [Torrent] (New!)
 
   Home   Help Search Login Register More  
Pages: [1] 2 »  All
  Print  
Author Topic: Steps to check potential phising links  (Read 582 times)
lobcmt2
Full Member
***
Offline Offline

Activity: 420
Merit: 154



View Profile
April 10, 2019, 11:10:29 AM
Last edit: April 15, 2019, 05:35:14 AM by lobcmt2
Merited by LoyceV (4), bones261 (2), OgNasty (1), TheNewAnon135246 (1), iasenko (1), r1s2g3 (1), GreatArkansas (1), DdmrDdmr (1), cabalism13 (1), Husna QA (1), whotookmycrypto (1)
 #1

The topic aims at newbies, but it might be useful for older users, who spend little time in the forum, to discover, and to learn.
Phising links are one of the most terrible things that make-money-online guys have to face with.
I am not sure, but I guess that there is no stupid phisers will put their phising links directly, instead they tend to hide them inside url link.

I give you an example, in which I presents three ways to post link to the topic you are reading.

1) Hidden link
Steps to check potential phising links

2) Direct link
https://bitcointalk.org/index.php?topic=5130231.0
Phisers never post their phising links that way because no one is stupid and lazy too much to fall into their opened traps like this (very limited people will fall into such bad trap).

3) Shortened links
Example:
Code:
https://bit.ly/2Vzd1C9
I posted the link with code because I don't want you to unintentionally click on the link. Please don't click on the link or any link like this.



SOLUTIONS
So, how to check that links are potential phising links or not?
It is very easy, what you have to do is only four steps:

1) Don't hurry too much, don't lazy too much to immediately click on the topic or article links, whichever links hidden via url links.
If you find something interesting with their posts, and have intention to get more information they shared with hidden links, it's good to stop at this step, and move to the second step.

2) Clicking on the quote button to see which are hidden links or shortened links
If you find that the links inside url are familiar, it is safely to move next to read and get information.
If you find that the links inside url are un-familiar, it is better to stop at this, and do next steps.
For example:
If you click on the quote button to quote my OP, you will see hidden link like this:
Code:
[url=https://bitcointalk.org/index.php?topic=5130231.0]Steps to check potential phising links[/url]
And, the link is safe, because it leads to official bitcointalk.org forum, right?

Another way to check is hovering on the link, the you will see the link behind.
For example:
1. The image show the link hidden in the topic titles posted by DdmrDdmr, you can see the link in the left corner at the bottom of your browser by hovering your mouse on the topic title. It is easy, isn't it?


2. In the second example, I create a hidden link behind the phrase Bitcointalk Forum, that will lead you to a fake bitcointalk site. Please remember it will lead to a fake bitcointalk site, so please don't log in your bitcointalk account on that site. Your account might be hacked. I don't advertise for fake site here. It's just an example and it is another way to help you know about one of fake bitcointalk sites.
Bitcointalk Forum
If you really click on the link, it will lead you to the fake forum
It will become worse if you click on link that lead you to more dangerous sites, so please don't click on suspicious links.
Instead, one again, please hover your mouse on the suspicious link, then you will see hidden link behind. Like this:

You can see the link will lead you to bitcointalk[dot]com (that is fake/ scam forum).


3) Searching with the potential phising sites/ links with key words including their names + phising links/ phising sites.
Next, if the link you see after quoting or hovering looks risky, strange, you should do more search on those sites' reputation.
Key words should be used are:
- phising
- scam
- fake
- site name/ domain name


Another way is to check suspicious link with tools (I don't know about them well, so appreciate if someone can help).
whotookmycrypto suggested a site to check suspicious links, but someone else said even that site is not safe. So, please decide using it or not with your own interest.

4) Disable phising links found on your computer
After links determined as phising links, you should do the last step.
Another one to be added to your hosts files then.

On Windows, navigate to "C:\Windows\System32\Drivers\etc\", and open the hosts file in a text editor.
On Mac, navigate to "/private/etc/", and open the hosts file in a text editor.
On Linux, open terminal and write "sudo nano /etc/hosts"

Add the following two lines to the bottom of the hosts file:
Code:
0.0.0.0 bitcointalk.to
0.0.0.0 fonstavka.com

Your browser will now be unable to open those two phishing sites.


SHOULD READ:

What with bitcointalk .COM, it's a bit misleading.
[GUIDE] Use this for identifying Scam/Phishing/ Websites & Exchanges in Crypto


Other tips contributed by participants in the topic:
For most famous redirect website, you can just add a "+" (plus symbol) at the end of the URL and you'll go to a page where it shows everything about the redirection link (the final destination, clicks, stats, etc...).

Example:
https://bit.ly/2Vzd1C9+


CONTRIBUTORS
I appreciate to all contributors whom help me to make the topic better.
whotookmycrypto
DdmrDdmr
r1a2y3m4
TryNinja
GreatArkansas
1566107270
Hero Member
*
Offline Offline

Posts: 1566107270

View Profile Personal Message (Offline)

Ignore
1566107270
Reply with quote  #2

1566107270
Report to moderator
1566107270
Hero Member
*
Offline Offline

Posts: 1566107270

View Profile Personal Message (Offline)

Ignore
1566107270
Reply with quote  #2

1566107270
Report to moderator
The forum was founded in 2009 by Satoshi and Sirius. It replaced a SourceForge forum.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1566107270
Hero Member
*
Offline Offline

Posts: 1566107270

View Profile Personal Message (Offline)

Ignore
1566107270
Reply with quote  #2

1566107270
Report to moderator
whotookmycrypto
Full Member
***
Offline Offline

Activity: 168
Merit: 198


WhoTookMyCrypto.com


View Profile WWW
April 10, 2019, 11:25:02 AM
Last edit: April 10, 2019, 05:42:35 PM by whotookmycrypto
Merited by OgNasty (1), Pmalek (1), DdmrDdmr (1), lobcmt2 (1)
 #2

Scammers also commonly use URL shorteners to mask their links. Examples include bitly and rebrandly.

Example of a shortened link: https://bit.ly/2Vzd1C9

Instead of clicking the link to check out where it leads, throw the link into websites like http://redirectdetective.com.

This is what would appear:


lobcmt2
Full Member
***
Offline Offline

Activity: 420
Merit: 154



View Profile
April 10, 2019, 11:27:43 AM
 #3

Thanks, that is why I say we should click on the quote button to see which links hidden behind, then your steps recommended above are great. To be honest, I did not know about that, before you shared it above.  Grin
whotookmycrypto
Full Member
***
Offline Offline

Activity: 168
Merit: 198


WhoTookMyCrypto.com


View Profile WWW
April 10, 2019, 11:36:49 AM
 #4

Thanks, that is why I say we should click on the quote button to see which links hidden behind, then your steps recommended above are great. To be honest, I did not know about that, before you shared it above.  Grin

Great share mate. We are all learning. Didn't know some of the stuff you mentioned in your post too so thanks for the share.

lobcmt2
Full Member
***
Offline Offline

Activity: 420
Merit: 154



View Profile
April 10, 2019, 11:38:21 AM
Last edit: April 10, 2019, 11:55:48 AM by lobcmt2
 #5

You know what, I just saw this one a seconds ago:
What with bitcointalk .COM, it's a bit misleading.
whotookmycrypto
Full Member
***
Offline Offline

Activity: 168
Merit: 198


WhoTookMyCrypto.com


View Profile WWW
April 10, 2019, 11:44:40 AM
 #6

Yeah these things pop up all the time so need to be careful. Another example that appeared a short while ago:

https://bitcointalk.org/index.php?topic=5122733.0

jossiel
Hero Member
*****
Offline Offline

Activity: 1260
Merit: 541



View Profile
April 10, 2019, 11:49:25 AM
 #7

Scammers also commonly use URL shorteners to mask their links. Examples include bitly and rebrandly.

Example of a shortened link: https://bit.ly/2Vzd1C9

Instead of clicking the link to check out where it leads, throw the link into websites like http://redirectdetective.com.

This is what would appear:
[img ]https://i.imgur.com/3fkNLLl.png[/img]

Hey, I've been looking for a site like this. Thank you for sharing this site, this is really helpful. Phishers do really use link shortners to hide the real link they are sharing.

They will add some interesting captions and statements relative tovthe topic and at end they'll put that link.

.BitDice.               ▄▄███▄▄
           ▄▄██▀▀ ▄ ▀▀██▄▄
      ▄▄█ ▀▀  ▄▄█████▄▄  ▀▀ █▄▄
  ▄▄██▀▀     ▀▀ █████ ▀▀     ▀▀██▄▄
██▀▀ ▄▄██▀      ▀███▀      ▀██▄▄ ▀▀██
██  ████▄▄       ███       ▄▄████  ██
██  █▀▀████▄▄  ▄█████▄  ▄▄████▀▀█  ██
██  ▀     ▀▀▀███████████▀▀▀     ▀  ██
             ███████████
██  ▄     ▄▄▄███████████▄▄▄     ▄  ██
██  █▄▄████▀▀  ▀█████▀  ▀▀████▄▄█  ██
██  ████▀▀       ███       ▀▀████  ██
██▄▄ ▀▀██▄      ▄███▄      ▄██▀▀ ▄▄██
  ▀▀██▄▄     ▄▄ █████ ▄▄     ▄▄██▀▀
      ▀▀█ ▄▄  ▀▀█████▀▀  ▄▄ █▀▀
           ▀▀██▄▄ ▀ ▄▄██▀▀
               ▀▀███▀▀
        ▄▄███████▄▄
     ▄███████████████▄
    ████▀▀       ▀▀████
   ████▀           ▀████
   ████             ████
   ████ ▄▄▄▄▄▄▄▄▄▄▄ ████
▄█████████████████████████▄
██████████▀▀▀▀▀▀▀██████████
████                   ████
████                   ████
████                   ████
████                   ████
████                   ████
████▄                 ▄████
████████▄▄▄     ▄▄▄████████
  ▀▀▀█████████████████▀▀▀
        ▀▀▀█████▀▀▀
▄▄████████████████████████████████▄▄
██████████████████████████████████████
█████                            █████
█████                            █████
█████                            █████
█████                            █████
█████                     ▄▄▄▄▄▄▄▄▄▄
█████                   ▄█▀▀▀▀▀▀▀▀▀▀█▄
█████                   ██          ██
█████                   ██          ██
█████                   ██          ██
██████████████████▀▀███ ██          ██
 ████████████████▄  ▄██ ██          ██
   ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ██          ██
             ██████████ ██          ██
           ▄███████████ ██████▀▀██████
          █████████████  ▀████▄▄████▀
[/]
DdmrDdmr
Hero Member
*****
Offline Offline

Activity: 588
Merit: 2550

There are lies, damned lies and statistics. MTwain


View Profile WWW
April 10, 2019, 12:00:41 PM
 #8

<…>
One thing to bear in mind is that you cannot quote a post to see the link if you are not logged-in into the Forum. People seem to often browse without loggin-in (see last charts on [Chart] Bitcointalk statistics on impression counts for ads). Nevertheless, whether you are logged-in or not, you can always hover over the hidden link on the forum, and see the linked URL displayed on the bottom left side of your screen.

lobcmt2
Full Member
***
Offline Offline

Activity: 420
Merit: 154



View Profile
April 10, 2019, 12:03:40 PM
 #9

You shared great tip, DdmrDdmr, I tried hovering over hidden link, and saw what you meant. Thanks.
jademaxsuy
Member
**
Offline Offline

Activity: 518
Merit: 23

★777Coin.com★ Fun BTC Casino!


View Profile WWW
April 10, 2019, 03:57:48 PM
 #10

Well there are many phishing links here, in telegram or from social media being posted just to compromise user's account and they can even do it for some  users are notnjust careful with their account, wallet.or etc. As long they think that it was the right website.

Most users that can do mistake without checking the links are not that techie when it comes to the technical aspect of the system.

whotookmycrypto
Full Member
***
Offline Offline

Activity: 168
Merit: 198


WhoTookMyCrypto.com


View Profile WWW
April 10, 2019, 04:38:10 PM
 #11

Hey, I've been looking for a site like this. Thank you for sharing this site, this is really helpful. Phishers do really use link shortners to hide the real link they are sharing.

They will add some interesting captions and statements relative tovthe topic and at end they'll put that link.

No problem. If someone can point to a browser extension (firefox / chrome) that allows users to hover over a link and receive the eventual website address, do share on this forum. Would send merit your way.  Haven't been able to find a plugin with that functionality, the rest all require copying and pasting of addresses which is a hassle.

r1a2y3m4
Full Member
***
Offline Offline

Activity: 476
Merit: 123



View Profile
April 10, 2019, 05:31:51 PM
Merited by r1s2g3 (1)
 #12

I just want to add an information to check if the link is a phishing link. One way to avoid that is to hover. When we say hover it is when you put your mouse over a file or a link and you can see the link to that file. Here's an example to it.


You can see the blue arrow, I hovered at bitcoin forum. And the link was showed at the lower left part(where the red arrow is pointing).

Please don't click what's below this, I only used this as an example.

Hover to this -> twitter.com. As you can see, the in human's eye is twitter.com but if you click it it will redirect you to another page(facebook.com). So, you need to hover on every file that you are suspecting.

Baofeng
Hero Member
*****
Offline Offline

Activity: 868
Merit: 518


View Profile
April 10, 2019, 06:15:47 PM
 #13

One thing I don't like about http://redirectdetective[dot]com is that it's not even secure,  Smiley



..bustadice..         ▄▄████████████▄▄
     ▄▄████████▀▀▀▀████████▄▄
   ▄███████████    ███████████▄
  █████    ████▄▄▄▄████    █████
 ██████    ████████▀▀██    ██████
██████████████████   █████████████
█████████████████▌  ▐█████████████
███    ██████████   ███████    ███
███    ████████▀   ▐███████    ███
██████████████      ██████████████
██████████████      ██████████████
 ██████████████▄▄▄▄██████████████
  ▀████████████████████████████▀
                     ▄▄███████▄▄
                  ▄███████████████▄
   ███████████  ▄████▀▀       ▀▀████▄
               ████▀      ██     ▀████
 ███████████  ████        ██       ████
             ████         ██        ████
███████████  ████     ▄▄▄▄██        ████
             ████     ▀▀▀▀▀▀        ████
 ███████████  ████                 ████
               ████▄             ▄████
   ███████████  ▀████▄▄       ▄▄████▀
                  ▀███████████████▀
                     ▀▀███████▀▀
           ▄██▄
           ████
            ██
            ▀▀
 ▄██████████████████████▄
██████▀▀██████████▀▀██████
█████    ████████    █████
█████▄  ▄████████▄  ▄█████
██████████████████████████
██████████████████████████
    ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
    ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
       ████████████
......Play......
r1s2g3
Sr. Member
****
Offline Offline

Activity: 616
Merit: 387


I am alive but in hibernation.


View Profile
April 10, 2019, 06:29:08 PM
 #14

Please don't click what's below this, I only used this as an example.

Hover to this -> twitter.com. As you can see, the in human's eye is twitter.com but if you click it it will redirect you to another page(facebook.com). So, you need to hover on every file that you are suspecting.


I guess, I know about that but it slipped from my mind.  I was wondering the same after reading OP that how I will check links that are not posted in this forum.

One thing I don't like about http://redirectdetective[dot]com is that it's not even secure,  Smiley




Still it look better option that going directly to the url shortened link.

.
Game that
pays for
Playing











A
blockchain
based game
Ask me anything
about the game
in Bitcointalk.











A game
that recognize
your ownership
Join the
exciting game
of splinterlands











              ▄▄▄▄▄▄██████▄▄▄▄▄▄
          ▄▄██████████████████████▄▄
        ███████▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀███████
     ████████▌    ▄▄▄▄▄▄▄▄    ▐████████
   ▄██████████▌  █████ ▀ ▀███  ▐██████████▄
  ▐███████████▌ ████▄▄ ██ ▐███ ▐███████████▌
  ████████████▌▐█████     ████▌▐████████████
 █████████████▌ ███▄▄ ██ ▐████ ▐█████████████
 █████████████▌  ███    ▄████  ▐█████████████
██████████████▌    ▀▀▀▀▀▀▀▀    ▐██████████████
██████████████████████████████████████████████
▀████████████████████████████████████████████▀
   ▐██████████████████████████████████████▌
   ▐█████████████▀▀▀▀▀▀▀▀▀▀▀▀█████████████▌
    ▀▀██████▀▀                  ▀▀██████▀▀
Theb
Sr. Member
****
Offline Offline

Activity: 1022
Merit: 412



View Profile
April 10, 2019, 06:30:45 PM
Merited by lobcmt2 (1)
 #15

For people recommending on hovering on the potential phishing links, this will only work if the url itself is directly linked to the text. But for URL shorteners this trick won't work as they would only show you the url for the shortned website not the website link itself (try hovering on the shortened link posted by whotookmycrypto in the thread). So if you know that you are on a sketchy website or a strange person have given you a URL shortened link then you must be very cautious on looking at the various red flags seen on a phishing website because I myself personally won't even bite and click the link, I would rather search the official website instead in Google just to be safe.


FORTUNEJACK
      ▄▄███████▄▄
   ▄████▀▀ ▄ ██████▄
  ████ ▄▄███ ████████
 █████▌▐███▌ ▀▄ ▀█████
███████▄██▀▀▀▀▄████████
█████▀▄▄▄▄█████████████
████▄▄▄▄ █████████████
 ██████▌ ███▀████████
  ███████▄▀▄████████
   ▀█████▀▀███████▀
      ▀▀██████▀▀
         
         █
...FortuneJack.com                                             
...THE BIGGEST BITCOIN GAMBLING SITE
       ▄▄█████████▄▄
    ▄█████████████████▄
  ▄█████████████████████▄
 ▄██
█████████▀███████████▄
██████████▀   ▀██████████
█████████▀       ▀█████████
████████           ████████
████████▄   ▄ ▄   ▄████████
██████████▀   ▀██████████
 ▀██
█████████████████████▀
  ▀██
███████████████████▀
    ▀█████████████████▀
       ▀▀█████████▀▀
#JACKMATE
WIN 1 BTC
▄█████████████████████████▄
███████████████████████████
███████████████████████████
██████████▀█████▀██████████
███████▀░░▀░░░░░▀░░▀███████
██████▌░░░░░░░░░░░░░▐██████
██████░░░░██░░░██░░░░██████
█████▌░░░░▀▀░░░▀▀░░░░▐█████
██████▄░░▄▄▄░░░▄▄▄░░▄██████
████████▄▄███████▄▄████████
███████████████████████████
███████████████████████████
▀█████████████████████████▀
khaled0111
Sr. Member
****
Offline Offline

Activity: 798
Merit: 491


View Profile
April 11, 2019, 05:26:44 PM
Merited by lobcmt2 (1)
 #16

...
There are many online tools that can be used to retrieve the target URL. All you have to do is to copy paste the shortened URL and you will get the original one.
Baofeng justr stated one of them which is redirectdetective.com and here is another one checkshorturl.com
lobcmt2
Full Member
***
Offline Offline

Activity: 420
Merit: 154



View Profile
April 11, 2019, 05:30:14 PM
 #17

There are many online tools that can be used to retrieve the target URL. All you have to do is to copy paste the shortened URL and you will get the original one.
Baofeng justr stated one of them which is redirectdetective.com and here is another one checkshorturl.com
In a summary, I got two potential sites for use:
Code:
redirectdetective.com
checkshorturl.com
Not sure why Baofeng stated the site does not really secure. Did you get opinion of Baofeng?
One thing I don't like about http://redirectdetective[dot]com is that it's not even secure,  Smiley



khaled0111
Sr. Member
****
Offline Offline

Activity: 798
Merit: 491


View Profile
April 11, 2019, 06:00:53 PM
 #18

...
Not sure why Baofeng stated the site does not really secure. Did you get opinion of Baofeng?
One thing I don't like about http://redirectdetective[dot]com is that it's not even secure,  Smiley



I think because he is using http instead of https (BTW it was whotookmycrypto who mentioned it not Baofeng, sorry for that)  Cheesy
There is nothing to fear, I just used virustotal to scan it and the result was 100% clean
TryNinja
Legendary
*
Offline Offline

Activity: 1106
Merit: 1418


CS <3


View Profile
April 11, 2019, 06:31:43 PM
 #19

For most famous redirect website, you can just add a "+" (plus symbol) at the end of the URL and you'll go to a page where it shows everything about the redirection link (the final destination, clicks, stats, etc...).

Example:
https://bit.ly/2Vzd1C9+

jossiel
Hero Member
*****
Offline Offline

Activity: 1260
Merit: 541



View Profile
April 11, 2019, 11:21:44 PM
 #20

Hey, I've been looking for a site like this. Thank you for sharing this site, this is really helpful. Phishers do really use link shortners to hide the real link they are sharing.

They will add some interesting captions and statements relative tovthe topic and at end they'll put that link.

No problem. If someone can point to a browser extension (firefox / chrome) that allows users to hover over a link and receive the eventual website address, do share on this forum. Would send merit your way.  Haven't been able to find a plugin with that functionality, the rest all require copying and pasting of addresses which is a hassle.
Will do, if I've found an extension that this kind of function, I'll notify everyone here quickly. I understand what you are trying to convey and I felt that, we have to check it like the tutorial you have given and it consumes time.

Unlike hovering it to the link, you can already check what's the true link behind that shortener.

.BitDice.               ▄▄███▄▄
           ▄▄██▀▀ ▄ ▀▀██▄▄
      ▄▄█ ▀▀  ▄▄█████▄▄  ▀▀ █▄▄
  ▄▄██▀▀     ▀▀ █████ ▀▀     ▀▀██▄▄
██▀▀ ▄▄██▀      ▀███▀      ▀██▄▄ ▀▀██
██  ████▄▄       ███       ▄▄████  ██
██  █▀▀████▄▄  ▄█████▄  ▄▄████▀▀█  ██
██  ▀     ▀▀▀███████████▀▀▀     ▀  ██
             ███████████
██  ▄     ▄▄▄███████████▄▄▄     ▄  ██
██  █▄▄████▀▀  ▀█████▀  ▀▀████▄▄█  ██
██  ████▀▀       ███       ▀▀████  ██
██▄▄ ▀▀██▄      ▄███▄      ▄██▀▀ ▄▄██
  ▀▀██▄▄     ▄▄ █████ ▄▄     ▄▄██▀▀
      ▀▀█ ▄▄  ▀▀█████▀▀  ▄▄ █▀▀
           ▀▀██▄▄ ▀ ▄▄██▀▀
               ▀▀███▀▀
        ▄▄███████▄▄
     ▄███████████████▄
    ████▀▀       ▀▀████
   ████▀           ▀████
   ████             ████
   ████ ▄▄▄▄▄▄▄▄▄▄▄ ████
▄█████████████████████████▄
██████████▀▀▀▀▀▀▀██████████
████                   ████
████                   ████
████                   ████
████                   ████
████                   ████
████▄                 ▄████
████████▄▄▄     ▄▄▄████████
  ▀▀▀█████████████████▀▀▀
        ▀▀▀█████▀▀▀
▄▄████████████████████████████████▄▄
██████████████████████████████████████
█████                            █████
█████                            █████
█████                            █████
█████                            █████
█████                     ▄▄▄▄▄▄▄▄▄▄
█████                   ▄█▀▀▀▀▀▀▀▀▀▀█▄
█████                   ██          ██
█████                   ██          ██
█████                   ██          ██
██████████████████▀▀███ ██          ██
 ████████████████▄  ▄██ ██          ██
   ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ██          ██
             ██████████ ██          ██
           ▄███████████ ██████▀▀██████
          █████████████  ▀████▄▄████▀
[/]
Pages: [1] 2 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!