What to do to avoid phishing sites

[hd49728]

Today, I saw this thread, started by @nakamura12, that reminds me that I read a few topics on the same issues with phishing sites and scammers.
A Reminder To Newbies!

I think it is helpful to generalize some basic strategies of scammers and methods of phishings.

• Type #1: New domain names with additional prefix or suffix from famous sites' domain names
• Type #2: Fake domain names with minor difference in unicode (that mostly not discovered by careless people)

Some basic examples for two types of phishing sites:
Type #1:

Code:

http://electrum.org.uk/
http://electrumclient.org/
http://downloadelectrum.org/
http://electrumsite.com/
http://electrumweb.net/
http://electrumupdate.com/
http://electrumproject.org

Type #2:

https://twitter.com/ElectrumWallet/status/1144678604523147265?s=20

Source:
⚠⚠️⚠~Beware on active phishing Electrum websites~⚠⚠️⚠ (Collection list updated)
Remember that scammers apply same strategies to build fake bitcointalk forum, exchanges. So, apply those steps will help you being safe from attackers.
thebitcointalk.net and bitcointalk.to are FAKE phishing sites ! (edited)

BitcoinTalk.org is the ONLY domain the forum has.

Exchanges (Poloniex, Bittrex, Binance have phising sites with unicode, but I still not find them for examples; so if you know such topics, please help):

I've just received an email from some scammer which asked me to review Poloniex's new terms of use.

But the link leads to:

https://secure.poloniex.work/

When you know they are phising sites, you should do two things:
Report them to Google
Like this

I check all sites from the list, the result is the following : First and last site from the list are loaded quite normal (no blocking from adblock, av or other security software), and other sites are blocked by my browser (Firefox) as Deceptive site ahead with the following warning :

electrumclient.org has been reported as a deceptive site. You can report a detection problem or ignore the risk and go to this unsafe site. Learn more about deceptive sites and phishing at www.antiphishing.org. Learn more about Firefox’s Phishing and Malware Protection at support.mozilla.org.

Although the idea of blocking such sites in users host file is not bad, for most users it still represents a challenge. What we need to do is report such sites as phishing to Google. In this way such sites will be blocked for every user, even those who are not aware of the problem will be protected.

It is also important to use adblocks for browsers, since most users use search engines to find Electrum site, and bad ones usually pops up at the top of the search list. The last line of defense is antivirus software which should be updated, and good AV will analyze any downloaded file and prevent the user from installing bad software.

Protect your computers by editing your hosts file

Another one to be added to your hosts files then.

On Windows, navigate to "C:\Windows\System32\Drivers\etc\", and open the hosts file in a text editor.
On Mac, navigate to "/private/etc/", and open the hosts file in a text editor.
On Linux, open terminal and write "sudo nano /etc/hosts"

Add the following two lines to the bottom of the hosts file:

Code:

0.0.0.0 bitcointalk.to
0.0.0.0 fonstavka.com

Your browser will now be unable to open those two phishing sites.

There are some of the most active users who keep updating phising sites:
- socks435
- Baofeng
- GreatArkansas
If you are a fan of bitcoin, use Electrum wallet to store your bitcoin, you should be careful with phishing sites that try to clone Electrum site and never stop popping up.

You should follow them to get fastest updates on phishing sites.

Warning!
Remember addresses of important sites are always the best!

Sometimes, links to upgrades provided by official wallets might be abused by attackers, so it will be the best if you remember exact address of sites (to download walelts, ie.)
Thanks @NeuroticFish by reminding me about it

Umm... a few months ago there was a huge problem: a vulnerability in Electrum allowed hackers show a custom message in Electrum, message that was not coming from Electrum developers, message that was showing a link and asking for upgrade. Whoever "upgraded" from there, got a fake Electrum that stole their funds.

I know that you meant something else, the entries from the help menu, but imho that's just a small step away and can lead to too much trust and .. sometimes problems. I think that remembering the address is much safer and not a big effort.

There is announcement of admin: Electrum vulnerability allows arbitrary messages, phishing



IMPORTANT NOTES:
- Don't arbitrarily click on links (using Google to search that link plus keywords 'phishing sites' or 'phishing' to check those links)
- Remember exact links of limited, but extremely important sites.
- Bookmark links of wallets, exchanges, forums (important sites).
- Report phising sites when you find them or know about them by other's warnings
- Using Host-file to deal with phishing sites

Read more:
- Tampering attacks!
- Punnycode attacks
- [LEARN] Phishing Quizzes - Beginners & Experts
- Host-file to deal with phishing sites

[1713585604]

1713585604

[1713585604]

1713585604

[1713585604]

1713585604

[1713585604]

1713585604

[Upgrade00]

Nice post. It would be helpful to bookmark all the sites you visit regularly, and always review any new site before adding it to your list.
Never click on links from unsolicited emails, telegram messages or even PMs here on the forum.
Before clicking on edited links here on BT, hover over the link to view the original HTML or copy and paste the link if you're using a mobile browser.

[NeuroticFish]

There are also browser extensions that help you finding out pretty easy if a site is legit or phishing.
However, the best approach is being careful and instead of searching for the websites on the internet, typing directly the correct address will keep you out of troubles.

[hd49728]

There are also browser extensions that help you finding out pretty easy if a site is legit or phishing.
However, the best approach is being careful and instead of searching for the websites on the internet, typing directly the correct address will keep you out of troubles.

Browsers have bookmark features to do it. Or people can save links of their most visited sites in their own ways (beyond bookmarks) for later use. No one can remember all site addresses.

[NeuroticFish]

Browsers have bookmark features to do it. Or people can save links of their most visited sites in their own ways (beyond bookmarks) for later use. No one can remember all site addresses.

You're right, however, for some cases (namely electrum) I still advise remembering it (electrum.org), just because one may need it on a fresh PC or a live OS.
But yes, for normal use bookmarking the proper site is also a great approach.

Anything, just don't search for it, because fake sites are often returned in the top of search results, and don't click onto links in e-mails, websites and so on.

[hd49728]

You're right, however, for some cases (namely electrum) I still advise remembering it (electrum.org), just because one may need it on a fresh PC or a live OS.
But yes, for normal use bookmarking the proper site is also a great approach.

Anything, just don't search for it, because fake sites are often returned in the top of search results, and don't click onto links in e-mails, websites and so on.

Sure. It is the same with forum address. Anyone of us don't remember the forum address: bitcointalk.org. It is easy to remember most important sites. For the rest, use bookmarks, and spreadsheets.
If someone use the same computer, that already install Electrum wallet (for example), just click on link from the wallet to upgrade to newest version. There is no need to search for site of Electrum, then might get trapped.
One more thing, people should dedicate one computer for extremely important things: Wallets.
Their rest devices can be used for other stuffs: log in emails, log in exchange accounts, log in the forum accounts, and for entertainments.

[NeuroticFish]

If someone use the same computer, that already install Electrum wallet (for example), just click on link from the wallet to upgrade to newest version. There is no need to search for site of Electrum, then might get trapped.

Umm... a few months ago there was a huge problem: a vulnerability in Electrum allowed hackers show a custom message in Electrum, message that was not coming from Electrum developers, message that was showing a link and asking for upgrade. Whoever "upgraded" from there, got a fake Electrum that stole their funds.

I know that you meant something else, the entries from the help menu, but imho that's just a small step away and can lead to too much trust and .. sometimes problems. I think that remembering the address is much safer and not a big effort.

[hd49728]

Umm... a few months ago there was a huge problem: a vulnerability in Electrum allowed hackers show a custom message in Electrum, message that was not coming from Electrum developers, message that was showing a link and asking for upgrade. Whoever "upgraded" from there, got a fake Electrum that stole their funds.

I know that you meant something else, the entries from the help menu, but imho that's just a small step away and can lead to too much trust and .. sometimes problems. I think that remembering the address is much safer and not a big effort.

Exactly!
I know that time, when the forum has running text warned about that phising attacks, and theymos created a thread to warn about it, too.
Hang on minutes, I will give you theymos' thread on this.
This one:
Electrum vulnerability allows arbitrary messages, phishing
Anyway, you made a point, that deserves to add in OP. Thanks.

[welovedcrypto]

There are few tools which detects phishing site. You should add them in your thread.

NetCraft: https://chrome.google.com/webstore/detail/netcraft-extension/bmejphbfclcpmpohkggcjeibfilpamia?hl=en
WOT: https://chrome.google.com/webstore/detail/wot-web-of-trust-website/bhmmomiinigofkjcapegjjndpbikblnp?hl=en
HTTPS Everywhere :https://chrome.google.com/webstore/detail/https-everywhere/gcbommkclmclpchllfjekcdonpmejbdp?hl=en

[hd49728]

The point is there is no phisers will build their phising sites to clone small, unfamous sites. They always target at famous sites, like the forum, Binance, Electrum and so on. I don't see issues to remember extremely important things in my life, such as my wife's phone number, my house address,  and it is the same for important sites in crypto. Just remember them (always narrow down your list of most important sites for your interests - less than dozen, maybe; then you will remember them). Always bookmark for cases you forget their addresses.

[boyptc]

Best is to use Google chrome and adblocker, also keep track on HTTPS

This is good for google chrome browser users but how about for other browsers?

I've installed metamask before and whenever I landed to a suspicious sites, it gives me a warning but I have uninstalled it. I want to know if someone who's still using it and if its still working?

[Kakmakr]

I think people should be more observant and also not be too lazy to double check and to verify the link that they use on a daily basis. Some people simply click on a bookmark in their browser, thinking that the URL cannot be tampered with. They will simply click on links in emails, without verifying that the URL does not redirect them to a phishing site.

If a URL is short, just type it... it is as easy as that and also check the auto-completed part of the URL, if it is stored in the browser cache, because that can also be tampered with.

Simply be more observant and double check every URL, before you use it. 

[hd49728]

Additional point:
In previous posts, I wrote about important sites. For example, coinmarketcap.com, from which you can easily search for links to exchanges, Binance, Bitmex, Okex, and so on. It is good if you remember those sites, but if you don't remember, searching them from reliable sites, that you remember. Most of things in crypto can be searched with coinmarketcap.com (project's website, explorer, social channels, available exchanges, etc.). Honestly, I always begin from CMC, not Google.

[Pmalek]

Best is to use Google chrome and adblocker, also keep track on HTTPS

10 years ago that would be enough but today HTTPS is no proof of anything. It costs only a few $ or is even free and all it does is it creates a wrong sense that the website in question is legit due to the encrypted connection.

[mk4]

This is good for google chrome browser users but how about for other browsers?

I've installed metamask before and whenever I landed to a suspicious sites, it gives me a warning but I have uninstalled it. I want to know if someone who's still using it and if its still working?

Yes, Metamask still has that feature as far as I know. But seriously. You really just need to stop googling websites that you know and already use anyway. Instead, simply accurately type it in on the address bar, and bookmark the page for future use. Problem resolved.

[Baofeng]

Thanks OP for mentioning my name, 

Best is to use Google chrome and adblocker, also keep track on HTTPS

10 years ago that would be enough but today HTTPS is no proof of anything. It costs only a few $ or is even free and all it does is it creates a wrong sense that the website in question is legit due to the encrypted connection.

Correct, actually I open up a thread about that one, PSA: Cyber Actors Exploit 'SECURE' Websites in Phishing Campaigns - FBI

[Baofeng]

For FF users, there is one trick in the book that can help you see the punycode.

[1] Type "about:config" in the address bar


[2] Then type "punycode" in the search bar


[3] Then double click on "network.IDN_show_puny_code" and enable it to true.

[Nnuego]

I believe when you search for something on google, it will give you different result of what you've searched for and it abit highlight of the result found. You read carefully and, click on the one that's explain it better

[hd49728]

I believe when you search for something on google, it will give you different result of what you've searched for and it abit highlight of the result found. You read carefully and, click on the one that's explain it better

In crypto, the first place you should visit and use when you want to search on crypto projects is coinmarketcap.com.
Visit that site, type project name in search box, and see what you get. If you can find project on coinmarketcap.com through its search box; it is somehow give you links to those projects' channels (Websites, Github, Available exchanges, Explorers, etc. - official ones, not phising ones). Projects already listed on coinmarketcap.com do not equal to good projects, but at least you will not get phised by phising sites.

For important sites, you have to remember their site addresses, and bookmark can be used and helpful. However, bookmark has its own risks of being tampered.

Avoid starting to search using Google if you can find those projects from coinmarketcap.com

[ccryptopark]

I just learned about these guys https://www.phishfort.com/

had a peek into their blogs and seems like they know what they're up to