Beware of BLTCOINTALK.ORG

[Mitchell]

Cyrus, I had no idea you were so short on cash. I'll send you some money buddy!

[SilverCryptoBullet]

There is currently a fake Bitcointalk clone with URL bltcointalk.org (L) online with a sticked message (topic ID 5572197) called "Administrator needs a loan". Over there it shows a post from Cyrus claiming that it's for a mini-vacation:

That phishing forum is not the first one as there are many scam phishing forums that are not Bitcointalk.org forum.
What with bitcointalk .COM, it's a bit misleading.
⚠️ BITCOIN-TALK FORUM PHISHING WEBSITE! BE AWARE!! ⚠️
Bitcointalk.to DOMAIN is a Pishing Site [DO NOT LOGIN]
Be carefull of Bitcointalk.to !
thebitcointalk.net and bitcointalk.to are FAKE phishing sites !
Is Bitcointalk.to same of Bitcointalk.org ?
bitcointalk.to = bitcointalk.org ?
Is bitcointalk.to legit or scam?

Is there a way to take down that site?

Reporting it can take it down but it takes time.
https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en

[hosemary]

Reporting it can take it down but it takes time.
https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en

You can't make a website shut down just by reporting it to Google. If your report to Google is accepted, the website may be flagged as unsafe, but it will not be taken down and people will still be able to visit it.
If you want to take down a website, you need to report it to the hosting company and NotATether has already done that.

[ibminer]

Cyrus needs money but is not able to access his wallets... so he wants people to send funds to his wallets?  Classic.

[Mia Chloe]

~snip

I visited the site earlier this morning and I was just too bored to talk about it. well point is chances of someone mistaking the site for this forum is 1 in a hundred and I'm gonna say why. First there are a lot owf warning messages one even saying the site is a fake clone of this forum.

The chances of you mistaking and "l" for "I" in bitcoin is just so thin plus auto correct aren't even letting you get past that lol... It's easy to create a clone site.. my guess is they used free hosting too none the less let's get the reports started.

[LTU_btc]

Honestly, before opening topic I didn't expected that this clone is made to take loans. I thought that it will be another phishing website made to steal peopole's accounts. Though, maybe it can be used for that purppose too, nobody can't guarantee.
Anyway, fake Cyrus didn't got much success - looked at his BTC address and it's completely empty.

I will blame this on domain registrars because this kind of thing supposed not to happen at all. Why are they giving similar name (of a site that has been existing for up to 2 decades) to a site that is new?

Another people that I will blame are the government. The domain registrars are not well regulated because this fake domain should not exist at all.

These things isn't much regulated and mostly automated, so, not much can be done, actions can be taken only after someone report it to domain registrar

Cyrus needs money but is not able to access his wallets... so he wants people to send funds to his wallets?  Classic.

Yeah, it doesn't makes much sense, but who cares

[Yablee0]

There is currently a fake Bitcointalk clone with URL bltcointalk.org (L) online with a sticked message (topic ID 5572197) called "Administrator needs a loan". Over there it shows a post from Cyrus claiming that it's for a mini-vacation:



The problem is... This topic is not real. The actual topic on Bitcointalk just shows Cyrus moving somebody's Marketplace thread to another board.

Definitely be careful when you type Bitcointalk in your address bar, and do not send any money to those addresses and especially do not click on the login and register buttons or your account will definitely be hacked.

Is there a way to take down that site?

Sharp one boss you have done great,  is still amazing how you were able to discover this disaster that would have been a big blow to us especially those with little or No ideas on stuff like that. I still don't understand how most people are bend on eating other people's swelt and nothing shake or worried them, imagine the numbers of people that wouldn't lose their account that they have put in so much work over the years if not for this information of yours, boss your actions is one of a kind keep it up.👏

[Mrbluntzy]

From all the clone website of this forum, this one looks more identical and uneasy to detect but there are some browsers you will use, it will redirect you to the original URL, I tried to log into this fake URL but the browsers I'm using is asking me to continue to bitcointalk.org. there was one cloned site of this forum I saw before, the users here had different username on that site making it look totally different from this forum but this one that looks exactly like bitcointalk can make a member unknowingly sign in to their account on that URL and that is how their account would be hacked. Nice catch and thank you for sharing.

[nakamura12]

I have had the link from this forum saved in my favorites since 2014 when I first visited the forum. I used it too until I decided to use the link to bypass the captcha on the login page. I don't understand why anyone with an account on this forum would manually enter the address into the address bar or, even worse, search using a search engine.

I guess it all boils down to that old saying "if you're looking for trouble, you'll find it sooner or later".

I also do the same which I save the link of the forum in order not to type the url by mistake. I think the owner of this fake Bitcointalk is to steal anything they can get their hands with like the accounts and other stuff. I remember that I received a PM on telegram if I want to buy an account from someone and vice versa. Maybe that person is part of such team. This one is much more alike with the original compared to previous bitcointalk forum clones before.

[SamReomo]

Those phishing domain names are always dangerous and people often get tricked by the scammers because of such domain names. Now Bltcointalk.org and Bitcointalk.org are very similar for some people and looking at those at first glimpse most people will falsely believe that the L version is original one and send Bitcoin to the scammers. I'm happy that OP found the phishing domain name and reported it here so innocent members of the forum can be safe from such scammers.

[Synchronice]

OP, thanks for the notice. It's funny how creative the owner of a phishing website is. Administration of the forum, where Bitcoin was born and where satoshi was posting, is begging for Bitcoins so hard that they are even pinning it in the news section. That really made my day

I have had the link from this forum saved in my favorites since 2014 when I first visited the forum. I used it too until I decided to use the link to bypass the captcha on the login page. I don't understand why anyone with an account on this forum would manually enter the address into the address bar or, even worse, search using a search engine.

I guess it all boils down to that old saying "if you're looking for trouble, you'll find it sooner or later".

To be honest, I always have at least one tab of Bitcointalk opened in my browser, probably since the year I registered on this forum but to be honest, sometimes I manually type bitc in my browser and open a Bitcointalk in a new tab.
You might find it strange but too many people use search engines to visit website. I bet that too many people will visit google, type bitcointalk to later move on this website. I know it's strange but too many people do that. I have a friend who has a marketing agency that also works on SEO and I've seen his analytics of various websites. On every website he manages, visitors were typing the name of the website in search engine and visiting a website that way.

[PX-Z]

I got an immediate (automated) reply! Looks like they're taking this seriously.

Typically, hosting companies don't like their servers being used for this type of purpose, and they want to resolve the issue quickly, provided there is clear evidence, which is the case here..

In my years of reporting phishing site and domains to nicenic none of them got approved even if you show them all the evidence screenshots, etc. I need to bring it to ICANN before those shits do their jobs handling abuse use of their service.
That automated reply is generic and the moment you asked for follow ups they will ignore or asked several proof. It's basically the one-stop registrar for scammers.

Look how they described their service. "Won't get suspended without solid proof"

[TryNinja]

It strikes me more of a "request forwarder" to the original site

In that case, it should be possible to overload it to more than 1 request per second, so Bitcointalk will start rate-limiting it. Unfortunately, wget only gets 122 bytes instead of full pages, and I don't know why.

This is definitely the case.

If I edit one of my posts and reload the phishing mirror, I can immediately see the changes.

I wrote a small script to make 10 requests per second (sorry theymos ). It's working:

Way too fast!
Your IP has been temporarily banned due to an extremely excessive request rate. Do not make more than an average of 1 request per second. This ban will expire automatically after a while.

429 via Cloudflare

theymos can probably grab their IP addresses and block them on Cloudflare.

[LoyceV]

I wrote a small script to make 10 requests per second (sorry theymos ). It's working:

Way too fast!

It's back online.

theymos can probably grab their IP addresses and block them on Cloudflare.

They'll just switch to a different IP-address and continue.

[ABCbits]

--snip--
In my years of reporting phishing site and domains to nicenic none of them got approved even if you show them all the evidence screenshots, etc. I need to bring it to ICANN before those shits do their jobs handling abuse use of their service.
That automated reply is generic and the moment you asked for follow ups they will ignore or asked several proof. It's basically the one-stop registrar for scammers.

Look how they described their service. "Won't get suspended without solid proof"

Your statement seems to be true. Looking at https://www.trustpilot.com/review/nicenic.net, 77% review have 1 star and some of them redirect their anger of getting scammed to them. I'm aware there are DMCA or similar abuse that could be used to take down non-scam/malicious website, but it seems it's not what NiceNIC aim to prevent.

[Lucius]

I also do the same which I save the link of the forum in order not to type the url by mistake. I think the owner of this fake Bitcointalk is to steal anything they can get their hands with like the accounts and other stuff. I remember that I received a PM on telegram if I want to buy an account from someone and vice versa. Maybe that person is part of such team. This one is much more alike with the original compared to previous bitcointalk forum clones before.

What won't people do for a few dollars these days - I was also accused by a scammer of contacting him on Telescam that I wanted to buy his account, and then he sent me a PM here on the forum. Still, it's unlikely that these are the same people, because if you manage to hack an active account, the real owner will react before they manage to sell it.

~snip~
To be honest, I always have at least one tab of Bitcointalk opened in my browser, probably since the year I registered on this forum but to be honest, sometimes I manually type bitc in my browser and open a Bitcointalk in a new tab.
You might find it strange but too many people use search engines to visit website. I bet that too many people will visit google, type bitcointalk to later move on this website. I know it's strange but too many people do that. I have a friend who has a marketing agency that also works on SEO and I've seen his analytics of various websites. On every website he manages, visitors were typing the name of the website in search engine and visiting a website that way.

It's strange to me, but maybe it's strange to others that I've had the same link saved in my favorites for over 10 years. Honestly, nothing surprises me anymore lately, people are getting weirder, I don't know if it's because of climate change or AI

[NotATether]

Guys, I have an update. They said they are currently performing an investigation, and that if it indicates they are indicating in abuse of some sort, they will suspend it after up to 48 hours.

I won't post the full email for privacy reasons.

Shit day, but a shittier day for scammers.