dkbit98 (OP)
Legendary
Offline
Activity: 2324
Merit: 7382
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 09:25:29 AM |
|
https://bitcointalk.oгg/index.php?topic=5154525.0#msg51488782 Firefox expands it to this: https://bitcointalk.xn--og-hlc/index.php?topic=5154525.0#msg51488782 And then obviously can't find the site. If I try this (the first 5 characters copied from the URL from the PM, then "test" added by me: Firefox turns it into this: http://www.k.xn--ogtest-pof/ What kind of sorcery is this? It reminds me of the homograph attack, which is now automatically replacred on all English boards. Some weird $hit yeah... I noticed that also with domains. I notified and reported Google and Symantec, as well as Metamask thanks to mainconceptI wonder why the account (kingpin4321) isn't tagged yet. I created it.
Add the flag in your OP. I supported the flag and tagged it since this account obviously tried to hack the OP. But we don't know if it's a hacked account, it could have been bought too. Someone stated this before: I think kingpin4321 fell for the exact same thing. Yesterday in Services someone posted a fake giveaway with a link to a phishing Bitcointalk clone, he was first to reply. I guess I was late with my tag/flag. ![Embarrassed](https://bitcointalk.org/Smileys/default/embarrassed.gif) A third known case (possibly even more) within the past 36 hours: LinkAnd I checked his history also. Why the real owner doesn't say anything, if his account had been hacked? He would already come in meta and on this thread to report the hack, no? There is something fishy. OK.. please examine the case and catch the fish. I reported on time, and as fast as I could. ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fs8.hostingkartinok.com%2Fuploads%2Fimages%2F2019%2F08%2F29767c88aeb6e9007c522e31de75150b.jpg&t=665&c=NIIxtDPIcfpV0A)
|
|
|
|
bob123
Legendary
Offline
Activity: 1624
Merit: 2481
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 09:25:50 AM |
|
Firefox turns it into this: http://www.k.xn--ogtest-pof/ What kind of sorcery is this? That's no sorcery, but IDNA encoding. The following cyrillic letter is the cause of that: This is quite frequently used by phishing sites to deceive others into clicking on a 'known' URL. That's a known problem with unicode domain names.
|
|
|
|
efialtis
Legendary
Offline
Activity: 1848
Merit: 1423
www.gosubetting.com
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 09:29:49 AM |
|
Received exactly the same from the same user - thanks for pointing this out op!
|
|
|
|
Saint-loup
Legendary
Offline
Activity: 2702
Merit: 2408
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 09:31:00 AM |
|
https://bitcointalk.oгg/index.php?topic=5154525.0#msg51488782 Firefox expands it to this: https://bitcointalk.xn--og-hlc/index.php?topic=5154525.0#msg51488782 And then obviously can't find the site. If I try this (the first 5 characters copied from the URL from the PM, then "test" added by me: Firefox turns it into this: http://www.k.xn--ogtest-pof/ What kind of sorcery is this? Must be a diacritical sign I guess.
|
|
|
|
dkbit98 (OP)
Legendary
Offline
Activity: 2324
Merit: 7382
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 09:43:00 AM Last edit: August 08, 2019, 11:19:08 AM by dkbit98 |
|
|
|
|
|
Saint-loup
Legendary
Offline
Activity: 2702
Merit: 2408
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 10:17:08 AM |
|
OK.. please examine the case and catch the fish. I reported on time, and as fast as I could. ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fs8.hostingkartinok.com%2Fuploads%2Fimages%2F2019%2F08%2F29767c88aeb6e9007c522e31de75150b.jpg&t=665&c=NIIxtDPIcfpV0A) Now your thread has been moved in the beginners section I think very few members will see it. So I think you should open a thread in Economy > Trading Discussion > Reputation section, on Kingpin4321. It's the right place for flags and tags. https://bitcointalk.org/index.php?board=129.0
|
|
|
|
dkbit98 (OP)
Legendary
Offline
Activity: 2324
Merit: 7382
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 10:29:40 AM |
|
OK.. please examine the case and catch the fish. I reported on time, and as fast as I could. ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fs8.hostingkartinok.com%2Fuploads%2Fimages%2F2019%2F08%2F29767c88aeb6e9007c522e31de75150b.jpg&t=665&c=NIIxtDPIcfpV0A) Now your thread has been moved in the beginners section I think very few members will see it. So I think you should open a thread in Economy > Trading Discussion > Reputation section, on Kingpin4321. It's the right place for flags and tags. https://bitcointalk.org/index.php?board=129.0Listen... Someone else proposed that I move it to B&H since it is also a guide for newbies and I don't have extra time to move topics all day round.... It is where it is now. Thanks. Nice catch tho, it can really be pretty obvious attempt from the hacker. I just wondered why choose your account over a higher account which he can benefit more, hmm sounds fishy.
Well, I've got this assumption that the hacker thinks he can get as this user is just a Member rank and have little to know about phishing. Not knowing what he tried to mess is a techy guy and even surpass him on the knowledge about those kinds of things. It might be good to move this one on B&H board as it is more appropriate there. Nice catch OP.Update: Reported to Commodo also https://www.comodo.com/home/internet-security/submit.php?url=http://sebiltv.com.tr/index/index.php?topic=5088858.0&&submissionType=1&source=1
|
|
|
|
Pmalek
Legendary
Offline
Activity: 2856
Merit: 7409
Playgram - The Telegram Casino
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 10:45:57 AM |
|
Why the real owner doesn't say anything, if his account had been hacked? He would already come in meta or on this thread to report the hack, no? There is something fishy. He was active in July almost on a daily basis and has not posted anything since July 30th. After that he either got hacked or went rogue. He is now banned so I guess that is it. Regarding the phishing attempt. If you have ticked to always be logged on to bitcointalk and you see that the site is asking for your login details you should be alarmed. If you have not ticked that option bitcointalk will log you out after 1 hour so if you open a new tab where you are asked to enter your login details confirm it on the page you usually visit when you login to bitcointalk. If you are logged out there as well, everything is fine. Log back in on the site you have saved and you usually log in on bitcointalk. If you are still logged in but the other tab is asking you to login again - you know it is a phishing attempt. All this above is for those that don't understand phishing sites and that bitcointak internal sites are marked in green when you hover over it with your mouse.
|
|
|
|
▄▄███████▄▄███████ ▄███████████████▄▄▄▄▄ ▄████████████████████▀░ ▄█████████████████████▄░ ▄█████████▀▀████████████▄ ██████████████▀▀█████████ █████████████████████████ ██████████████▄▄█████████ ▀█████████▄▄████████████▀ ▀█████████████████████▀░ ▀████████████████████▄░ ▀███████████████▀▀▀▀▀ ▀▀███████▀▀███████ | ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ Playgram.io ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ | ▄▄▄░░ ▀▄ █ █ █ █ █ █ █ ▄▀ ▀▀▀░░
| │ | ▄▄▄███████▄▄▄ ▄▄███████████████▄▄ ▄███████████████████▄ ▄██████████████▀▀█████▄ ▄██████████▀▀███▄██▐████▄ ██████▀▀████▄▄▀▀█████████ ████▄▄███▄██▀█████▐██████ ██████████▀██████████████ ▀███████▌▐██▄████▐██████▀ ▀███████▄▄███▄████████▀ ▀███████████████████▀ ▀▀███████████████▀▀ ▀▀▀███████▀▀▀ | | │ | ██████▄▄███████▄▄████████ ███▄███████████████▄░░▀█▀ ███████████░█████████░░█ ░█████▀██▄▄░▄▄██▀█████░█ █████▄░▄███▄███▄░▄██████ ████████████████████████ ████████████████████████ ██░▄▄▄░██░▄▄▄░██░▄▄▄░███ ██░░░█░██░░░█░██░░░█░████ ██░░█░░██░░█░░██░░█░░████ ██▄▄▄▄▄██▄▄▄▄▄██▄▄▄▄▄████ ███████████████████████ ███████████████████████ | | │ | ► | |
|
|
|
dkbit98 (OP)
Legendary
Offline
Activity: 2324
Merit: 7382
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 01:18:19 PM |
|
One more thing. It is better to use Firefox browser as it shows warnings for this unsecure logins ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fs8.hostingkartinok.com%2Fuploads%2Fimages%2F2019%2F08%2F9853e8e012764a712533ed22bfb57b2f.jpg&t=665&c=cLRBtAQI6Q23OA)
|
|
|
|
bob123
Legendary
Offline
Activity: 1624
Merit: 2481
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 01:35:01 PM |
|
One more thing. It is better to use Firefox browser as it shows warnings for this unsecure logins
This does just mean that the website does not use http s. This is definitely NOT an indicator for the authenticity of a website. I'd expect any phishing site not created by completely incapable people to have a TLS certificate. You can get them for free.
|
|
|
|
dkbit98 (OP)
Legendary
Offline
Activity: 2324
Merit: 7382
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 01:45:13 PM |
|
One more thing. It is better to use Firefox browser as it shows warnings for this unsecure logins
This does just mean that the website does not use http s. This is definitely NOT an indicator for the authenticity of a website. I'd expect any phishing site not created by completely incapable people to have a TLS certificate. You can get them for free. I know that ![Grin](https://bitcointalk.org/Smileys/default/grin.gif) And I just say it is one more step to protect yourself better... Firefox is better than Chrome... but you still need to use your brain. As for better protection my suggestions are on first page
|
|
|
|
Saint-loup
Legendary
Offline
Activity: 2702
Merit: 2408
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 03:04:53 PM Last edit: August 08, 2019, 03:26:48 PM by Saint-loup |
|
OK.. please examine the case and catch the fish. I reported on time, and as fast as I could. ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fs8.hostingkartinok.com%2Fuploads%2Fimages%2F2019%2F08%2F29767c88aeb6e9007c522e31de75150b.jpg&t=665&c=NIIxtDPIcfpV0A) Now your thread has been moved in the beginners section I think very few members will see it. So I think you should open a thread in Economy > Trading Discussion > Reputation section, on Kingpin4321. It's the right place for flags and tags. https://bitcointalk.org/index.php?board=129.0Listen... Someone else proposed that I move it to B&H since it is also a guide for newbies and I don't have extra time to move topics all day round.... It is where it is now. Thanks. Nice catch tho, it can really be pretty obvious attempt from the hacker. I just wondered why choose your account over a higher account which he can benefit more, hmm sounds fishy.
Well, I've got this assumption that the hacker thinks he can get as this user is just a Member rank and have little to know about phishing. Not knowing what he tried to mess is a techy guy and even surpass him on the knowledge about those kinds of things. It might be good to move this one on B&H board as it is more appropriate there. Nice catch OP.You didn't understand me, I wasn't suggesting you to move this thread there but to create another one for flagging and tagging Kingpin4321 since he was still hurting people according to Efialtis testimonial. Now he seems to have been banned, so the issue about him is closed, normally. BTW I don't think it's a topic for beginners since the hacker is not targeting newbie accounts and the case is raising concerns about homographic attacks, so it was a rather weird suggestion from this guy... ![Undecided](https://bitcointalk.org/Smileys/default/undecided.gif)
All this above is for those that don't understand phishing sites and that bitcointak internal sites are marked in green when you hover over it with your mouse.
People are not only using old computers with mouse, we are in 2019 now. ![Wink](https://bitcointalk.org/Smileys/default/wink.gif)
|
|
|
|
Lauren Smith
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 05:26:22 PM |
|
That is pretty clever and quite a nasty way to phish. You see the link and click and without thinking you login again. The thing is I always keep myself logged in so if I do log out it is because I logged out myself. It is a bit odd to get a link right to the reply saying they have replied to you. Though this is a perfect way to let someone know you have replied. I think at anytime you are ever asked to login for any reason what so ever that you should check the address. Even pages I bookmark I check the address just incase.
Very nasty and very easy to fall for this if you not paying much attention which is easy.
|
|
|
|
mainconcept
|
My pull request got accepted, MetaMask now blocks the site: ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FAANZ4AR.png&t=665&c=Ae7xoAQ8NMmHRg)
|
|
|
|
electronicash
Legendary
Offline
Activity: 3178
Merit: 1054
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 06:30:21 PM |
|
they've been doing this phishing since the dawn of time but it still works for some. it should be common sense to see something is wrong if there is the need to login again when you know you are already loggedin. the url of the website is very important to notice here. My pull request got accepted, MetaMask now blocks the site: ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FAANZ4AR.png&t=665&c=Ae7xoAQ8NMmHRg) when you aren't sure which app to use your metamask, don't use it. browser apps aren't something you can controll, you may have the privkeys but pick which app to use your metamask.
|
|
|
|
dkbit98 (OP)
Legendary
Offline
Activity: 2324
Merit: 7382
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2019, 07:22:22 PM Last edit: August 08, 2019, 07:46:47 PM by dkbit98 |
|
My pull request got accepted, MetaMask now blocks the site: Great news! Thank you for your support and fast response. +merit they've been doing this phishing since the dawn of time but it still works for some. it should be common sense to see something is wrong if there is the need to login again when you know you are already loggedin. the url of the website is very important to notice here.
It may be obvious for you and me, but average user can get distracted thinking it is just a browser issue, and enter his details, resulting in his account being hacked.
|
|
|
|
big_daddy
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2019, 08:27:30 AM |
|
another way to secure your profile is to Stake your Bitcoin address this is the most efficient way to prove your ownership of your Bitcointalk account -> Stake your Bitcoin address hereall you have to do is to use your BTC wallet and make a message like this -> -----BEGIN BITCOIN SIGNED MESSAGE----- This is <username> at bitcointalk.org. The current date is <date>. -----BEGIN SIGNATURE----- <insert Bitcoin address here> <insert signature here> -----END BITCOIN SIGNED MESSAGE----- and post it in that thread above, someone will quote you and you are safe if you get hacked, you will proof your identity with your BTC wallet the tutorial -> How to sign a message?!
|
If you don't believe it or don't get it, I don't have the time to try to convince you, sorry.
|
|
|
|
hd49728
Legendary
Offline
Activity: 2184
Merit: 1044
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2019, 11:36:09 AM |
|
another way to secure your profile is to Stake your Bitcoin address
This step is only helpful to secure forum accounts, not to secure bitcoin. ![Grin](https://bitcointalk.org/Smileys/default/grin.gif) Hackers can hack your computers, steal your account, and steal your money. You can use signed message to get your account back, while your bitcoin will be stolen forever. There is no backwards trip for your bitcoin from hackers to you.
|
|
|
|
big_daddy
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2019, 11:39:07 AM |
|
another way to secure your profile is to Stake your Bitcoin address
This step is only helpful to secure forum accounts, not to secure bitcoin. ![Grin](https://bitcointalk.org/Smileys/default/grin.gif) Hackers can hack your computers, steal your account, and steal your money. You can use signed message to get your account back, while your bitcoin will be stolen forever. There is no backwards trip for your bitcoin from hackers to you. it's obvious
|
If you don't believe it or don't get it, I don't have the time to try to convince you, sorry.
|
|
|
|