New Phishing Link Going Around

[Bitcoins101]

Phisher is probably thinking he caught a big one..

  . What you got after logging in? Redirecting to BT?

  ~~MZ~~

Yep, redirects right back to the real site under the link that is in the OP. 

[1713502498]

1713502498

[1713502498]

1713502498

[1713502498]

1713502498

[1713502498]

1713502498

[1713502498]

1713502498

[1713502498]

1713502498

[acs267]

OP: remove the hyperlink in the top post.. I was about to click it..

It's a phishing link. You'll be fine as long as you don't enter your username or password. But you can basically enter in a random or fake one. I didn't remove all of the link, because, I'm pretty sure they all have the same topic start number. 654845.

Anyway, you could basically click away, and even sit on the link and nothing will happen but a discouraged person, looking at the hundreds accounts with 'theymos' or 'satoshi' as their username.

[Nullu]

Bombard the site with fake username and passwords.

[Bitcoins101]

Bombard the site with fake username and passwords.

Someone could set up a script to do it. 

[NoirSuccubus]

I got one from p3tmacter

This guy is registering hordes of new accounts for the purpose of phishing peoples accounts. Look at the new members list and you'll find a bunch. I just went through the first 2 pages of the bitcointalk member list, these are only a few hours old.

NEMmaster
NEMxtester
EspoNem
nemeconomy
utopian-nem
nem-team
nemutopian
p3tnaster
nemxt
nem-xterster


You can see the members list here listed from new to old.
https://bitcointalk.org/index.php?action=mlist;sort=registered;start=0;desc
There's probably much more.

[acs267]

I got one from p3tmacter

This guy is registering hordes of new accounts for the purpose of phishing peoples accounts. Look at the new members list and you'll find a bunch. I just went through the first 2 pages of the bitcointalk member list, these are only a few hours old.

NEMmaster
NEMxtester
EspoNem
nemeconomy
utopian-nem
nem-team
nemutopian
p3tnaster
nemxt
nem-xterster


You can see the members list here listed from new to old.
https://bitcointalk.org/index.php?action=mlist;sort=registered;start=0;desc
There's probably much more.

I don't get it - why are they doing it? Is it to give NEM a bad name, or to show ill fitted strength? It's bizarre to me. Not to mention, they bragged about the thought of them going to hack acounts. 

[theymos]

I deleted the spam PMs and banned all of the users and IPs sending them.

[EvilDave]

Good work, mate. +1

[ForgottenPassword]

I deleted the spam PMs and banned all of the users and IPs sending them.

The source on the phishing website contains the following:

Code:

<title>Login</title><!--368ef74f52681c46ec130f3d13d9f239ea78ffb6c1718a5e8bda35ea3af8626a1c46ec130f3d13d9f239ea78ffb6c171138a3f3d4e7f8f4069051c46ec130f3d13d9f239ea78ffb6c171faa6-->

Is that last piece a session ID?

Maybe you could take a look at the logs and find out what IP was using that session ID.

It also looks like the phishing site is including style sheets from bitcointalk.org. You could set up the server to send a modified stylesheet that has a warning message added when it is requested by the phishing domain in order to warn people it is a phishing website.

[jackjack]

I deleted the spam PMs and banned all of the users and IPs sending them.

The source on the phishing website contains the following:

Code:

<title>Login</title><!--368ef74f52681c46ec130f3d13d9f239ea78ffb6c1718a5e8bda35ea3af8626a1c46ec130f3d13d9f239ea78ffb6c171138a3f3d4e7f8f4069051c46ec130f3d13d9f239ea78ffb6c171faa6-->

Is that last piece a session ID?

Maybe you could take a look at the logs and find out what IP was using that session ID.

It also looks like the phishing site is including style sheets from bitcointalk.org. You could set up the server to send a modified stylesheet that has a warning message added when it is requested by the phishing domain in order to warn people it is a phishing website.

Good ideas

[mik3]

GUYS report them to their registrar so they remove the site ASAP.

Send an email to  abuse@internet.bs  with a link to this thread and an explanation.