Beware of BLTCOINTALK.ORG

[NotATether]

There is currently a fake Bitcointalk clone with URL bltcointalk.org (L) online with a sticked message (topic ID 5572197) called "Administrator needs a loan". Over there it shows a post from Cyrus claiming that it's for a mini-vacation:



The problem is... This topic is not real. The actual topic on Bitcointalk just shows Cyrus moving somebody's Marketplace thread to another board.

Definitely be careful when you type Bitcointalk in your address bar, and do not send any money to those addresses and especially do not click on the login and register buttons or your account will definitely be hacked.

Is there a way to take down that site?

[LoyceV]

How did you even find that site? Did a search engine fail to do its job?

[Mahiyammahi]

Wtf this is a mirror of Bitcointalk exactly everything is being mirror. Aside from the url nothing has been difference. All thing is identical even posts are updating in live times.



Even this page got mirrored. Any newbie's or someone didn't looked carefully towards the URL can get scammed easily.

[LoyceV]

Even this page got mirrored.

In my early days on Bitcointalk, there were a few websites that did this. I assumed it's meant to steal accounts, but asking for loans is a new one. Someone with these skills should be able to make a honest living online.

I've added it to my hosts file:

Code:

127.0.0.1 bltcointalk.org
127.0.0.1 www.bltcointalk.org

@OP: have you reported the domain to abuse@ for phishing?

Code:

Domain Name: bltSCAMcointalk.org
Registry Domain ID: REDACTED
Registrar WHOIS Server: whois.nicenic.com
Registrar URL: https://nicenic.com/
Updated Date: 2026-01-29T05:56:46Z
Creation Date: 2026-01-24T05:56:25Z
Registry Expiry Date: 2027-01-24T05:56:25Z
Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
Registrar IANA ID: 3765
Registrar Abuse Contact Email: abuse@nicenic.net
Registrar Abuse Contact Phone: +852.68581443
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

[PX-Z]

How did you even find that site? Did a search engine fail to do its job?

Up to this. As i don't know how you end up getting there.

Typing the site url on my browser seems easier as browser always suggest the url before typing it full.

I access the url and this pops up, a message which is very helpful.

[mindrust]

We will see more of these scams in the era of AI. Nowadays the barrier for coding a complex system has disappeared thanks to AI. There are many people who has many freakishly dangerous ideas in their heads and they can accomplish their goals fairly easy because all they need to do is to explain the problem correctly to the AI and the AI will hand them the solution. I wouldn’t be surprised if this btt clone was prepared with the help of AI.

AI can fake appearance, voice, writing style… obviously it will fake websites too. It was still possible to mirror websites before the AI but nowadays it is dirt cheap to engineer a scam like that.

[CONVOAI]

The search engine is working properly. Even when I search by typing bltcoincointalk, the original bitcointalk is showing. I think it is unlikely that the fake site will come up unless you specify the direct URL. Please share where you found it?

[libert19]

You posted 'L' in title, and I still read it as, 'Bitcointalk.org' and I was like, what's wrong? Then I read thread, and it finally dawned on me.

As for loan request, sounds legit. It's also, 'news' icymi.

[Alvin_talk]

Nice find, if only people use the time they spent developing their scam skills and scam sites on more meaningful things, I think the world would have been a better place ,unfortunately, the world is not always a bed of roses, we have the good and the bad, so let's try as much as possible to verify what you click.

Suggestion: Can this information be added as a warning in the news sticky until the fake site has been taken down? In order to avoid possible scam to members of this forum.

[alani123]

A search engine's main function is to serve ads and generate traffic so if that site paid for a top spot ad with the keyword bitcointalk it would appear before any legitimate result. META and Google make money off anyone willing to pay them. This is their business model.

[NotATether]

How did you even find that site? Did a search engine fail to do its job?

I'm a fast typer, and this time I mistyped "l" instead of "i" in the address bar. It's not from Google or anything, though I wouldn't be surprised if someone were to find it there too.

I immediately knew it was fake because my dark theme was missing.

Fortunately there doesn't seem to be any JS loaded - before I poked around the site I disabled Javascript in the browser.

@OP: have you reported the domain to abuse@ for phishing?

Not yet. It would be sent to abuse@nicenic.net, right?

Edit: done

Even this page got mirrored.

How ironic  

I think if the IP address can be found, it can be blacklisted from Bitcointalk's servers. It strikes me more of a "request forwarder" to the original site than a site with a scraper (which would take months, or even years, to scrape yourself).

[_act_]

I will blame this on domain registrars because this kind of thing supposed not to happen at all. Why are they giving similar name (of a site that has been existing for up to 2 decades) to a site that is new?

Another people that I will blame are the government. The domain registrars are not well regulated because this fake domain should not exist at all.

[NotATether]

I got an immediate (automated) reply! Looks like they're taking this seriously.

Code:

Dear reporter,

Thank you for contacting the NiceNIC Legal and Abuse department. We confirm the receipt of your abuse report, it will be reviewed and processed following our policies.

Date: 2026-02-01
Complained domain name(s): bltcointalk.org
Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED

Please be aware that NiceNIC investigates a large volume of complaints, therefore, we will respond to you only if additional information on the matter is required. However, rest assured that your complaint will be properly evaluated and action will be taken if necessary.

You are welcome to check yourself if the domain is active by searching the domain status via NiceNIC Lookup (https://www.nicenic.net/whois/). If the domain status is in clientHold/serverHold, it means the domain has been suspended and is not available on the internet.

If you wish to contact the domain holder, hosting, or email provider for the domain name in question, you may consider using the RrSG ACID Tool (https://acidtool.com/) to identify their contact details.

IMPORTANT: In order to support the process of investigation, please review the instructions below depending on the type of abuse you are reporting. To help us fully investigate your claim, please ensure your submission includes all the requirements we describe. If you have submitted a complaint and realize that information is missing, please simply reply to this message, including the additional information, and make sure that the complained domain name is kept in the subject so that we can track your replies:

Information required to support our investigation: https://nicenic.net/customer/reportabuse.php
How does NiceNIC investigate Suspected Email Abuse/Spam: https://www.nicenic.net/customer/Email-Abuse-Spam.php

Copyright and Trademark Policies:
https://nicenic.net/customer/copyright_trademark_policies.php
Uniform Rapid Suspension System (URS): https://www.icann.org/urs-en/

In order to learn how to notice different types of incidents, how to report them, and some of the best remedial actions and preventive measures that can be taken, you are welcome to check the following article: https://www.nicenic.net/customer/understanding-fraud-and-abuse-dp.php

Best regards,
NiceNIC Abuse Team
ICANN Accredited Registrar since 2012
Domains | Reseller API | Business Email | SSL Certificates | Servers

[DPHOR]

To be realistic whomever that is not that watchful could easily get their details logged in thinking it is the original site, the funniest thing there is that they all looks Identical and there is no changes in it. This is already cloned and anyone who is not careful to login to that site could easily got hacked or affected. Those who do lending business should be that careful because is another way to easily get them trap by requesting for quick loan without them taking records of the site.
But how do you come to discover this site? Did they in anyway message you or burst into your dm?

[joker_josue]

I got an immediate (automated) reply! Looks like they're taking this seriously.

Typically, hosting companies don't like their servers being used for this type of purpose, and they want to resolve the issue quickly, provided there is clear evidence, which is the case here.

In principle, the situation should be resolved within 1-2 days. We await further updates.

[shield132]

This is funny. I visited bltcointalk and when you scroll down to Meta section, this thread is here.

How does anyone fall for such scam? First of all, no one needs 200K USD on a mini-vacation and second of all, if someone goes to a very expensive vacation, they aren't stupid enough to forget their money. These are already two red flags. Another red flags here are the thing that Cyrus could directly get that money from theymos or from other friends who he knows and hold multiple Bitcoins. Then, he pinning the thread on news section in the header is simply too childish. Four red flags exposed immediately. If anyone falls for such scam and sends money to this scammer, is not a naive person but is a stupid. Sorry for being rude but that's truth.

Bitcoin address to send loan payment:bc1qh5k04lsmuhh9z9jyynfthla04vhkywegsrgdpx
Ethereum address to send loan payment:0xebCeB733DB4f2E20dF4C673c241B03DfE2c86511
Litecoin address to send loan payment:ltc1qe9te6jszgm2snfjn2ufr9z6qgvx0tfvatj8qrj
TRC20 address to send loan payment:TDskRv7EsM2D5izZi5h1WLiyGxySZ2BykW

I'm keeping my eye on these addresses. Does anyone know how to track all of them together on one website? Is there such a website that will update me if any of these addresses receive money? Right now, I checked them separately and the balance on all of them is zero. That's a good news.

[libert19]

I will blame this on domain registrars because this kind of thing supposed not to happen at all. Why are they giving similar name (of a site that has been existing for up to 2 decades) to a site that is new?

Another people that I will blame are the government. The domain registrars are not well regulated because this fake domain should not exist at all.

I wouldn't blame either. You can't really expect 'em to go find all combos scammers can come up with, and restrict registrations on same. I believe it'll be a resource intensive task, that they wouldn't be willing to do. CMIIW though.

I got an immediate (automated) reply! Looks like they're taking this seriously.

...

I wouldn't get my hopes high on automated response, but let's see.

...But how do you come to discover this site? Did they in anyway message you or burst into your dm?

It's good to read comments.

[NotATether]

Bitcoin address to send loan payment:bc1qh5k04lsmuhh9z9jyynfthla04vhkywegsrgdpx
Ethereum address to send loan payment:0xebCeB733DB4f2E20dF4C673c241B03DfE2c86511
Litecoin address to send loan payment:ltc1qe9te6jszgm2snfjn2ufr9z6qgvx0tfvatj8qrj
TRC20 address to send loan payment:TDskRv7EsM2D5izZi5h1WLiyGxySZ2BykW

I'm keeping my eye on these addresses. Does anyone know how to track all of them together on one website? Is there such a website that will update me if any of these addresses receive money? Right now, I checked them separately and the balance on all of them is zero. That's a good news.

Use Arkham Intelligence. I think they let you do this sort of thing. They do, actually. Go create a free account and then you can add all fo the scam addresses in your profile and the system will start tracking them all at once, and you can even see the connected transactions and everything. I even use their data in BitMixList.

PS. Cyrus has plenty of BTC! I don't think he will ever need a loan

[Lucius]

I have had the link from this forum saved in my favorites since 2014 when I first visited the forum. I used it too until I decided to use the link to bypass the captcha on the login page. I don't understand why anyone with an account on this forum would manually enter the address into the address bar or, even worse, search using a search engine.

I guess it all boils down to that old saying "if you're looking for trouble, you'll find it sooner or later".

[LoyceV]

It strikes me more of a "request forwarder" to the original site

In that case, it should be possible to overload it to more than 1 request per second, so Bitcointalk will start rate-limiting it. Unfortunately, wget only gets 122 bytes instead of full pages, and I don't know why.