Beware of BLTCOINTALK.ORG

[DYING_S0UL]

Well this is an interesting finding! Never had imagined we would see this day when bitcointalk gets it's phishing site. I got so curious that I even visited the fake one and scrolled through it, and man, it was totally identical, a cloned of the original one (maybe a few days behind), but it seems like the site is being updated each day with new posts, to make it look like the real bitcointalk forum.

[KingsDen]

Well this is an interesting finding! Never had imagined we would see this day when bitcointalk gets it's phishing site. I got so curious that I even visited the fake one and scrolled through it, and man, it was totally identical, a cloned of the original one (maybe a few days behind), but it seems like the site is being updated each day with new posts, to make it look like the real bitcointalk forum.

Wait? Did you login?
How did you visit the site? As a guess user?
I am even afraid to click the link.
Please don't try login if you value your account.

[dkbit98]

There is currently a fake Bitcointalk clone with URL bltcointalk.org (L) online with a sticked message (topic ID 5572197) called "Administrator needs a loan". Over there it shows a post from Cyrus claiming that it's for a mini-vacation
Another one?!

It has been a long time since we had clones like this, and they are probably trying some phishing scam again.
All members should especially watch out if they receive PM with links from anyone.

Is there a way to take down that site?

We can report it to g00gle, but lot of people needs to report it for shutting down.
I reported this website just now, and I suggest others should do the same.

[juttsab@]

Is there a way to take down that site?

We can report it to g00gle, but lot of people needs to report it for shutting down.
I reported this website just now, and I suggest others should do the same.

I have also reported it. Hopefully, this site will be shut down as soon as possible

[hosemary]

We can report it to g00gle, but lot of people needs to report it for shutting down.

Will the website shut down if your report to google is accepted?
As I already said in the previous page of the thread, you can flag the website as unsafe by reporting it to google, but to take the website down, you need to report it to the hosting company.

Someone correct me if I am wrong, please.

[rat03gopoh]

"Won't get suspended without solid proof"

Their statement imply they are too:

• kind
• lazy
• greedy
• stupid

[jcojci]

We can report it to g00gle, but lot of people needs to report it for shutting down.

Will the website shut down if your report to google is accepted?
As I already said in the previous page of the thread, you can flag the website as unsafe by reporting it to google, but to take the website down, you need to report it to the hosting company.

Someone correct me if I am wrong, please.

Reporting to google, yahoo, bing can warn them to filter that site from the crawling of the search engine. The site will not get list on the search engine.

But I agree that we must report it to the hosting company and also domain name registrar. They will shutdown the site by contacting the owner

[libert19]

Ok. So this is new. I checked the site on virustotal's url checker and 2 providers flagged it as malicious, which was bit surprising because I thought it's just a clone made to phish for funds.

https://talkimg.com/image/UEJ3gH

I visited it in incognito tab to, 'check' — I hope it does not backfire.

[LoyceV]

I visited it in incognito tab to, 'check' — I hope it does not backfire.

That's what Tor browser is for.

[Smartvirus]

Even this page got mirrored.

In my early days on Bitcointalk, there were a few websites that did this. I assumed it's meant to steal accounts, but asking for loans is a new one.

Thats the general idea, being a site that tries to mirror the forum, it’s only normal to assume that the intent is to still as many accounts as possible from unsuspecting users that might try to access the account and given that, our “i” and “l” keys aren’t that far apart on our keyboards, one might stroke wrong and be caught in the scandal.

Scammers with this much resource always try to cast a wide net which explains why, they would go to such length in creating a mirror site and asking for vacation loans, using some of the elite users on the forum so as to amass sympathizers but, they ought to know the entire forum is always watching, ready to discover and report to create awareness.

With a lot of reports on this, the host could take it down.

Checked it up on WHOIS data and the registrar information is: NICENIC INTERNATIONAL GROUP CO., LIMITED
Their administrative, billing and technical contact is in Dhaka.

[Lucius]

I visited it in incognito tab to, 'check' — I hope it does not backfire.

That's what Tor browser is for.

I think less than 10% of active users of this forum use Tor. Most people complain that it is too slow for them, but I think the truth is much closer to the fact that they don't care about privacy.

[babo]

However I wonder, wouldn't it have been better to post this thread in reputation?

It doesn't seem like much of a meta thread to me, but great job reporting it, you did a great job.
What a fantastic community you are I'm serious

ps: don't get angry if I suggested the Reputation sub forum

[LoyceV]

I think less than 10% of active users of this forum use Tor. Most people complain that it is too slow for them, but I think the truth is much closer to the fact that they don't care about privacy.

I didn't mean to use Tor browser for everything, just keep it open in case you want to check an untrusted site.

[dkbit98]

Will the website shut down if your report to google is accepted?
As I already said in the previous page of the thread, you can flag the website as unsafe by reporting it to google, but to take the website down, you need to report it to the hosting company.

I am not a fortune teller to know what is going to happen, but I am sure many websites got closed after we reported them for phishing in the same way.
But if someone has time and wants to report it directly to hosting provider, than go for it.

I didn't mean to use Tor browser for everything, just keep it open in case you want to check an untrusted site.

Why keep it open all the time when it literally takes around 5 seconds to open Tor and get connected?

[PX-Z]

Good news, the site was taken down after at least of 3 days https://dnschecker.org/#A/bltcointalk.org. Probably many did report the site on its registrar, which i always doubt nicenic doing its role. Or they did because ICANN was cc on the email as well. I suggest doing it too when reporting to any domain from nicenic and cc their global support email globalsupport@icann.org

[NotATether]

Good news, the site was taken down after at least of 3 days https://dnschecker.org/#A/bltcointalk.org. Probably many did report the site on its registrar, which i always doubt nicenic doing its role. Or they did because ICANN was cc on the email as well. I suggest doing it too when reporting to any domain from nicenic and cc their global support email globalsupport@icann.org

Yahoo!

I have no idea how they managed to clone all the posts though. That was some dark magic.

[TryNinja]

Good news, the site was taken down after at least of 3 days https://dnschecker.org/#A/bltcointalk.org. Probably many did report the site on its registrar, which i always doubt nicenic doing its role. Or they did because ICANN was cc on the email as well. I suggest doing it too when reporting to any domain from nicenic and cc their global support email globalsupport@icann.org

Yahoo!

I have no idea how they managed to clone all the posts though. That was some dark magic.

Didn't we all solve this already? Yourself included?

It strikes me more of a "request forwarder" to the original site than a site with a scraper (which would take months, or even years, to scrape yourself).

You write phishing.com/index.php?topic=5573143.0 -> they request the same page on bitcointalk (index.php?topic=5573143.0) -> they send it to you (acting as a proxy). That's it.

This is definitely the case.

If I edit one of my posts and reload the phishing mirror, I can immediately see the changes.

[joker_josue]

It strikes me more of a "request forwarder" to the original site than a site with a scraper (which would take months, or even years, to scrape yourself).

You write phishing.com/index.php?topic=5573143.0 -> they request the same page on bitcointalk (index.php?topic=5573143.0) -> they send it to you (acting as a proxy). That's it.

This is definitely the case.

If I edit one of my posts and reload the phishing mirror, I can immediately see the changes.

That's right, they're not even making copies, just spreading them. It's an old technique, from the days of torrents.

Who remembers the many mirrors in the famous PirateBay?