Fake Bitcointalk forum Warning

[dkbit98]

Few days ago someone created fake Bitcointalk forum with all our data.
It is collecting data Live!

Watch out for potential Phishing and Scam attempts.

bitinfo.cc
A bit more information with images I posted in Scam Acussation section:
https://bitcointalk.org/index.php?topic=5193535

Stay safe

[1715237297]

1715237297

[Lafu]

Maybe its the same people or user that was running the bitcointalk.to webpage?
Wasnt there somewhere a post or a thread that the bitcointalk.to site isnt anymore online!
I cant find it at the Moment because im on mobile!
Thanks for the Information by the way

[TryNinja]

Looks like the login and register buttons lead to BitcoinTalk? This shouldn't be such a big issue (at least for now). Just like BitcoinTalk.to which AFAIK only showed ads and his captcha didn't work, so no one could try to login or register.

[LTU_btc]

Maybe its the same people or user that was running the bitcointalk.to webpage?
Wasnt there somewhere a post or a thread that the bitcointalk.to site isnt anymore online!
I cant find it at the Moment because im on mobile!
Thanks for the Information by the way

Yep, you're right. Bitcointalk.to has been offline in recent months. Now I tried to search for it and when I visited their website I saw that this domain is for sale.
I doubt that owner of these websites is same, because it just doesn't makes sense. They had perfect domain Bitcointalk.to and now appears with some random name Bitinfo.cc which are not even similar to Bitcointalk name.

[logfiles]

The small positive is that the copycat's domain is totally different from bitcointalk's unlike the old scammy bitcointalk.to
It should be a little easy to notice that the domain in quite different.

[hosseinimr93]

Looks like the login and register buttons lead to BitcoinTalk? This shouldn't be such a big issue (at least for now). Just like BitcoinTalk.to which AFAIK only showed ads and his captcha didn't work, so no one could try to login or register.

If you click on "Login" button, you navigate to real bitcointalk. But if you open one of the threads and then click on "Login" button you will navigate to the fake "login" page.
Seems that they are still working on their website.

[Chikito]

https://www.virustotal.com/gui/url/c14a1cc39ed84f106df83648b84a908e20f5ac9aa455224b9b4bdaf5d33627c0/detection

One engine detected this URL https://bitinfo.cc/

Forcepoint ThreatSeeker - Malicious

Be careful

[logfiles]

If you click on "Login" button, you navigate to real bitcointalk. But if you open one of the threads and then click on "Login" button you will navigate to the fake "login" page.
Seems that they are still working on their website.

I think the idea is to get those people who search for related to what is discussed on Bitcointalk through google. They would then be tricked to click on mirror links of threads similar to those on bitcointalk after which they will be prompted to log in onto the phishing website.

[Coyster]

I think the idea is to get those people who search for related to what is discussed on Bitcointalk through google. They would then be tricked to click on mirror links of threads similar to those on bitcointalk after which they will be prompted to log in onto the phishing website.

I think this looks well like a very smart and calculative move, I always try to use the forum's search engine and not google, though sometimes it's not really a straightforward process in searching for what you're looking for.

I thought if probably you're searching for a thread on Google, you'll just be redirected or taken straight to the thread? Does the user need to login there?

[TryNinja]

I think the idea is to get those people who search for related to what is discussed on Bitcointalk through google. They would then be tricked to click on mirror links of threads similar to those on bitcointalk after which they will be prompted to log in onto the phishing website.

That's indeed the case. This already happened multiple times with the Bitcointalk.TO website, which was a third-party random mirror of the forum. I already clicked on it by mistake multiple times. And I'm not the only one.

If you click on "Login" button, you navigate to real bitcointalk. But if you open one of the threads and then click on "Login" button you will navigate to the fake "login" page.
Seems that they are still working on their website.

I tried logging in with some random username and password and looks like when you click the "Login" button, the request is sent to the real BitcoinTalk. While this doesn't mean the website isn't stealing our data (at least not stealing through the POST request from the login form), I agree that we sould treat it as a scam.


TIP: Add the website to your hosts file to block it and avoid clicking on it by mistake.

I totally fell for the cloned site, until I realized I couldn't see your trust ratings.
I have added this line to /etc/hosts

Code:

127.0.0.1       bitcointalk.to

Now my computer can't access that phishing site anymore.

Just do the above but with bitinfo.cc instead of bitcointalk.to.

Code:

127.0.0.1       bitinfo.cc

[pooya87]

TIP: Add the website to your hosts file to block it and avoid clicking on it by mistake.

there is also a simple remedy that could cover all other possible fake copy-sites which i find very useful and that is the browser's zoom option for those browsers that store the zoom state per domain not for the whole browser (eg. Chrome and Firefox).

for example i have zoomed reddit to 200% so when i visit https://www.reddit.com/r/Bitcoin/ i'll get an easy visual confirmation that i am on a website i have visited before. but if i go somewhere else like https://np.reddit.com/r/Bitcoin/ i'll immediately see a zoomed out (default) size which is a quick indication of different domain.

[PrimeNumber7]

There are only a small number of people who are collecting enough data to pull this off.

I have said before that there should be limits as to how much data/many pages a person can access per time unit.

In case the person behind this site is not collecting the data live, but rather is pulling the data on request, it should not be difficult for the administration to compare a random set of page requests via the site referenced in the OP to logs to see the IP address of who is accessing the pages in real time, and take action.

[DdmrDdmr]

<…>

You don’t really need to scrape any data at all to do what the clone site does. I’d say that the cloned site merely inserts Bitcointalk in a frame (or such), and that it’s own sole native development is that of the login screen, used to capture your credential and then redirect you to Bitcointalk. At least, that is the intent when they get it to work properly.

They do not need to scrape a single page. I just compared the clone to the original, refreshed them, compared data, and the content was verbatim (even stats). They do not scrape, but simply mask the content in a frame.

[akamit]

Report phishing sites to Google here > https://safebrowsing.google.com/safebrowsing/report_phish/ and Google will do the rest.

Hopefully, the phishing site will not get indexed and rank to any keyword. Moreover, if any visitor accidentally visits the site then Google may show the red warning saying "Phishing Site".

I have reported it!

[hugeblack]

Watch out for potential Phishing and Scam attempts.

There are a lot of differences that can be noticed such as the logo of the forum at the top of the page, the pumping button, +Merit, userscripts do not work.

Registrar URL: http://www.key-systems.net
Updated Date: 2019-09-10T15:03:43Z
Creation Date: 2019-09-10T15:03:26Z
Registry Expiry Date: 2020-09-10T15:03:26Z

Not much work has been done on this site, so it may seem like an alternative to Bitcointalk.to

Generally, you should be careful and Re-check the domain.

[dkbit98]

https://www.virustotal.com/gui/url/c14a1cc39ed84f106df83648b84a908e20f5ac9aa455224b9b4bdaf5d33627c0/detection

Be careful

Thanks for reporting. I missed this

Report phishing sites to Google here > https://safebrowsing.google.com/safebrowsing/report_phish/ and Google will do the rest.

Hopefully, the phishing site will not get indexed and rank to any keyword. Moreover, if any visitor accidentally visits the site then Google may show the red warning saying "Phishing Site".

I have reported it!

Yeah this shitsite is reported as soon as I saw it, but it would help if more people do it.
You can also report it to Symantec: https://submit.symantec.com/antifraud/phish.cgi

I also reported it to Metamask

[marlboroza]

https://www.virustotal.com/gui/url/c14a1cc39ed84f106df83648b84a908e20f5ac9aa455224b9b4bdaf5d33627c0/detection

One engine detected this URL https://bitinfo.cc/

Forcepoint ThreatSeeker - Malicious

I looked into this yesterday and I find very strange that only Forcepoint showed warning while other engines showed it as clean. I used their scanner and got this result :





 

Login button on main page is linking bitcointalk.org, but inside threads link is for phishing purposes.

[KingScorpio]

Few days ago someone created fake Bitcointalk forum with all our data.
It is collecting data Live!

Watch out for potential Phishing and Scam attempts.

bitinfo.cc
A bit more information with images I posted in Scam Acussation section:
https://bitcointalk.org/index.php?topic=5193535

Stay safe

why is it a fake? it is simply a different bitcoin forum, are here some greedy monopolists upset?

[actmyname]

why is it a fake? it is simply a different bitcoin forum, are here some greedy monopolists upset?

Read that part back.

[TryNinja]

why is it a fake? it is simply a different bitcoin forum, are here some greedy monopolists upset?

Dude? It's a literal clone of BitcoinTalk.

I found your exact post in there: https://bitinfo.cc/topic.php?topic=5193542.msg52790760#msg52790760 < FAKE BITCOINTALK

What does fake mean to you?