⚠️ How Scammer tried to Hack my Bitcointalk and how to Protect yourself?⚠️

[dkbit98]

Code:

https://bitcointalk.oгg/index.php?topic=5154525.0#msg51488782

Firefox expands it to this:

Code:

https://bitcointalk.xn--og-hlc/index.php?topic=5154525.0#msg51488782

And then obviously can't find the site.

If I try this (the first 5 characters copied from the URL from the PM, then "test" added by me:

Code:

k.oгgtest

Firefox turns it into this:

Code:

http://www.k.xn--ogtest-pof/

What kind of sorcery is this?

It reminds me of the homograph attack, which is now automatically replacred on all English boards.

Some weird $hit yeah...
I noticed that also with domains.

I notified and reported Google and Symantec,
as well as Metamask thanks to mainconcept

I wonder why the account (kingpin4321) isn't tagged yet.

I created it.

Add the flag in your OP.

I supported the flag and tagged it since this account obviously tried to hack the OP. But we don't know if it's a hacked account, it could have been bought too.

Someone stated this before:

I think kingpin4321 fell for the exact same thing.

Yesterday in Services someone posted a fake giveaway with a link to a phishing Bitcointalk clone, he was first to reply. I guess I was late with my tag/flag.  

A third known case (possibly even more) within the past 36 hours: Link

And I checked his history also.

Why the real owner doesn't say anything, if his account had been hacked?  
He would already come in meta and on this thread to report the hack, no?
There is something fishy.

OK.. please examine the case and catch the fish.
I reported on time, and as fast as I could.

[1715155182]

1715155182

[bob123]

Code:

k.oгgtest

Firefox turns it into this:

Code:

http://www.k.xn--ogtest-pof/

What kind of sorcery is this?

That's no sorcery, but IDNA encoding.

The following cyrillic letter is the cause of that:

Code:

г

This is quite frequently used by phishing sites to deceive others into clicking on a 'known' URL.
That's a known problem with unicode domain names.

[efialtis]

Received exactly the same from the same user - thanks for pointing this out op!

[Saint-loup]

Code:

https://bitcointalk.oгg/index.php?topic=5154525.0#msg51488782

Firefox expands it to this:

Code:

https://bitcointalk.xn--og-hlc/index.php?topic=5154525.0#msg51488782

And then obviously can't find the site.

If I try this (the first 5 characters copied from the URL from the PM, then "test" added by me:

Code:

k.oгgtest

Firefox turns it into this:

Code:

http://www.k.xn--ogtest-pof/

What kind of sorcery is this?

Must be a diacritical sign I guess.

[dkbit98]

Update:

I reported fake website to this website
Phishtank
https://www.phishtank.com/

https://www.phishtank.com/phish_detail.php?phish_id=6152971


I also reported it with Watchdog extension
https://www.cryptopolice.com/

[Saint-loup]

OK.. please examine the case and catch the fish.
I reported on time, and as fast as I could.

Now your thread has been moved in the beginners section I think very few members will see it.
So I think you should open a thread in Economy > Trading Discussion > Reputation  section, on Kingpin4321. It's the right place for flags and tags.
https://bitcointalk.org/index.php?board=129.0

[dkbit98]

OK.. please examine the case and catch the fish.
I reported on time, and as fast as I could.

Now your thread has been moved in the beginners section I think very few members will see it.
So I think you should open a thread in Economy > Trading Discussion > Reputation  section, on Kingpin4321. It's the right place for flags and tags.
https://bitcointalk.org/index.php?board=129.0

Listen...
Someone else proposed that I move it to B&H since it is also a guide for newbies
and I don't have extra time to move topics all day round....
It is where it is now.

Thanks.

Nice catch tho, it can really be pretty obvious attempt  from the hacker. I just wondered why choose your account over a higher account which he can benefit more, hmm sounds fishy.

Well, I've got this assumption that the hacker thinks he can get as this user is just a Member rank and have little to know about phishing. Not knowing what he tried to mess is a techy guy and even surpass him on the knowledge about those kinds of things.

It might be good to move this one on B&H board as it is more appropriate there. Nice catch OP.

Update:
Reported to Commodo also
https://www.comodo.com/home/internet-security/submit.php?url=http://sebiltv.com.tr/index/index.php?topic=5088858.0&&submissionType=1&source=1

[Pmalek]

Why the real owner doesn't say anything, if his account had been hacked?  
He would already come in meta or on this thread to report the hack, no?
There is something fishy.

He was active in July almost on a daily basis and has not posted anything since July 30th. After that he either got hacked or went rogue.
He is now banned so I guess that is it.

Regarding the phishing attempt.
If you have ticked to always be logged on to bitcointalk and you see that the site is asking for your login details you should be alarmed.
If you have not ticked that option bitcointalk will log you out after 1 hour so if you open a new tab where you are asked to enter your login details confirm it on the page you usually visit when you login to bitcointalk. If you are logged out there as well, everything is fine. Log back in on the site you have saved and you usually log in on bitcointalk. If you are still logged in but the other tab is asking you to login again - you know it is a phishing attempt.

All this above is for those that don't understand phishing sites and that bitcointak internal sites are marked in green when you hover over it with your mouse.

[dkbit98]

One more thing.
It is better to use Firefox browser as it shows warnings for this unsecure logins

[bob123]

One more thing.
It is better to use Firefox browser as it shows warnings for this unsecure logins

This does just mean that the website does not use https.
This is definitely NOT an indicator for the authenticity of a website.

I'd expect any phishing site not created by completely incapable people to have a TLS certificate. You can get them for free.

[dkbit98]

One more thing.
It is better to use Firefox browser as it shows warnings for this unsecure logins

This does just mean that the website does not use https.
This is definitely NOT an indicator for the authenticity of a website.

I'd expect any phishing site not created by completely incapable people to have a TLS certificate. You can get them for free.

I know that  
And I just say it is one more step to protect yourself better...
Firefox is better than Chrome... but you still need to use your brain.

As for better protection my suggestions are on first page

[Saint-loup]

OK.. please examine the case and catch the fish.
I reported on time, and as fast as I could.

Now your thread has been moved in the beginners section I think very few members will see it.
So I think you should open a thread in Economy > Trading Discussion > Reputation  section, on Kingpin4321. It's the right place for flags and tags.
https://bitcointalk.org/index.php?board=129.0

Listen...
Someone else proposed that I move it to B&H since it is also a guide for newbies
and I don't have extra time to move topics all day round....
It is where it is now.

Thanks.

Nice catch tho, it can really be pretty obvious attempt  from the hacker. I just wondered why choose your account over a higher account which he can benefit more, hmm sounds fishy.

Well, I've got this assumption that the hacker thinks he can get as this user is just a Member rank and have little to know about phishing. Not knowing what he tried to mess is a techy guy and even surpass him on the knowledge about those kinds of things.

It might be good to move this one on B&H board as it is more appropriate there. Nice catch OP.

You didn't understand me, I wasn't suggesting you to move this thread there but to create another one for flagging and tagging Kingpin4321 since he was still hurting people according to Efialtis testimonial.
Now he seems to have been banned, so the issue about him is closed, normally.  

BTW I don't think it's a topic for beginners since the hacker is not targeting newbie accounts and the case is raising concerns about homographic attacks, so it was a rather weird suggestion from this guy...  

All this above is for those that don't understand phishing sites and that bitcointak internal sites are marked in green when you hover over it with your mouse.

People are not only using old computers with mouse, we are in 2019 now.  

[Lauren Smith]

That is pretty clever and quite a nasty way to phish. You see the link and click and without thinking you login again. The thing is I always keep myself logged in so if I do log out it is because I logged out myself.
It is a bit odd to get a link right to the reply saying they have replied to you. Though this is a perfect way to let someone know you have replied. I think at anytime you are ever asked to login for any reason what so ever that you should check the address. Even pages I bookmark I check the address just incase.

Very nasty and very easy to fall for this if you not paying much attention which is easy.

[mainconcept]

I just opened a pull request for MetaMask: https://github.com/MetaMask/eth-phishing-detect/pull/3221

The site should be blocked through the MetaMask extension if they accept it.

My pull request got accepted, MetaMask now blocks the site:

[electronicash]

they've been doing this phishing since the dawn of time but it still works for some. it should be common sense to see something is wrong if there is the need to login again when you know you are already loggedin. the url of the website is very important to notice here.

I just opened a pull request for MetaMask: https://github.com/MetaMask/eth-phishing-detect/pull/3221

The site should be blocked through the MetaMask extension if they accept it.

My pull request got accepted, MetaMask now blocks the site:

when you aren't sure which app to use your metamask, don't use it. browser apps aren't something you can controll, you may have the privkeys but pick which app to use your metamask.

[dkbit98]

I just opened a pull request for MetaMask: https://github.com/MetaMask/eth-phishing-detect/pull/3221

The site should be blocked through the MetaMask extension if they accept it.

My pull request got accepted, MetaMask now blocks the site:

Great news!
Thank you for your support and fast response.
+merit

they've been doing this phishing since the dawn of time but it still works for some. it should be common sense to see something is wrong if there is the need to login again when you know you are already loggedin. the url of the website is very important to notice here.

It may be obvious for you and me, but average user can get distracted
thinking it is just a browser issue, and enter his details, resulting in his account being hacked.

[big_daddy]

another way to secure your profile is to Stake your Bitcoin address

this is the most efficient way to prove your ownership of your Bitcointalk account -> Stake your Bitcoin address here

all you have to do is to use your BTC wallet and make a message like this ->

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
This is <username> at bitcointalk.org. The current date is <date>.
-----BEGIN SIGNATURE-----
<insert Bitcoin address here>
<insert signature here>
-----END BITCOIN SIGNED MESSAGE-----

and post it in that thread above, someone will quote you and you are safe
if you get hacked, you will proof your identity with your BTC wallet

the tutorial -> How to sign a message?!

[dkbit98]

another way to secure your profile is to Stake your Bitcoin address

this is the most efficient way to prove your ownership of your Bitcointalk account -> Stake your Bitcoin address here

all you have to do is to use your BTC wallet and make a message like this ->

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
This is <username> at bitcointalk.org. The current date is <date>.
-----BEGIN SIGNATURE-----
<insert Bitcoin address here>
<insert signature here>
-----END BITCOIN SIGNED MESSAGE-----

and post it in that thread above, someone will quote you and you are safe
if you get hacked, you will proof your identity with your BTC wallet

the tutorial -> How to sign a message?!

Good point.
I added that on the list on page 1,
and I also staked my Bitcoin address some time ago

One more thing would be good to have installed is
Malwarebytes Browser Extension

for Firefox
https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/?src=search

For Brave and Chrome browsers
https://chrome.google.com/webstore/detail/malwarebytes-browser-exte/ihcjicgdanjaechkgeegckofjjedodee

[hd49728]

another way to secure your profile is to Stake your Bitcoin address

This step is only helpful to secure forum accounts, not to secure bitcoin. 
Hackers can hack your computers, steal your account, and steal your money.
You can use signed message to get your account back, while your bitcoin will be stolen forever. There is no backwards trip for your bitcoin from hackers to you.

[big_daddy]

another way to secure your profile is to Stake your Bitcoin address

This step is only helpful to secure forum accounts, not to secure bitcoin. 
Hackers can hack your computers, steal your account, and steal your money.
You can use signed message to get your account back, while your bitcoin will be stolen forever. There is no backwards trip for your bitcoin from hackers to you.

it's obvious