GUYS report them to their registrar so they remove the site ASAP.
Send an email to [email protected] with a link to this thread and an explanation.
Topic: New Phishing Link Going Around (Read 2560 times)
I deleted the spam PMs and banned all of the users and IPs sending them.
The source on the phishing website contains the following:
Code:
Is that last piece a session ID?
Maybe you could take a look at the logs and find out what IP was using that session ID.
It also looks like the phishing site is including style sheets from bitcointalk.org. You could set up the server to send a modified stylesheet that has a warning message added when it is requested by the phishing domain in order to warn people it is a phishing website.
Good ideas
I deleted the spam PMs and banned all of the users and IPs sending them.
The source on the phishing website contains the following:
Code:
Is that last piece a session ID?
Maybe you could take a look at the logs and find out what IP was using that session ID.
It also looks like the phishing site is including style sheets from bitcointalk.org. You could set up the server to send a modified stylesheet that has a warning message added when it is requested by the phishing domain in order to warn people it is a phishing website.
Good work, mate. +1
I deleted the spam PMs and banned all of the users and IPs sending them.
I got one from p3tmacter
This guy is registering hordes of new accounts for the purpose of phishing peoples accounts. Look at the new members list and you'll find a bunch. I just went through the first 2 pages of the bitcointalk member list, these are only a few hours old.
NEMmaster
NEMxtester
EspoNem
nemeconomy
utopian-nem
nem-team
nemutopian
p3tnaster
nemxt
nem-xterster
You can see the members list here listed from new to old.
https://bitcointalk.org/index.php?action=mlist;sort=registered;start=0;desc
There's probably much more.
This guy is registering hordes of new accounts for the purpose of phishing peoples accounts. Look at the new members list and you'll find a bunch. I just went through the first 2 pages of the bitcointalk member list, these are only a few hours old.
NEMmaster
NEMxtester
EspoNem
nemeconomy
utopian-nem
nem-team
nemutopian
p3tnaster
nemxt
nem-xterster
You can see the members list here listed from new to old.
https://bitcointalk.org/index.php?action=mlist;sort=registered;start=0;desc
There's probably much more.
I don't get it - why are they doing it? Is it to give NEM a bad name, or to show ill fitted strength? It's bizarre to me. Not to mention, they bragged about the thought of them going to hack acounts.
I got one from p3tmacter
This guy is registering hordes of new accounts for the purpose of phishing peoples accounts. Look at the new members list and you'll find a bunch. I just went through the first 2 pages of the bitcointalk member list, these are only a few hours old.
NEMmaster
NEMxtester
EspoNem
nemeconomy
utopian-nem
nem-team
nemutopian
p3tnaster
nemxt
nem-xterster
You can see the members list here listed from new to old.
https://bitcointalk.org/index.php?action=mlist;sort=registered;start=0;desc
There's probably much more.
This guy is registering hordes of new accounts for the purpose of phishing peoples accounts. Look at the new members list and you'll find a bunch. I just went through the first 2 pages of the bitcointalk member list, these are only a few hours old.
NEMmaster
NEMxtester
EspoNem
nemeconomy
utopian-nem
nem-team
nemutopian
p3tnaster
nemxt
nem-xterster
You can see the members list here listed from new to old.
https://bitcointalk.org/index.php?action=mlist;sort=registered;start=0;desc
There's probably much more.
Bombard the site with fake username and passwords.
Someone could set up a script to do it. 
Bombard the site with fake username and passwords.
OP: remove the hyperlink in the top post.. I was about to click it..
It's a phishing link. You'll be fine as long as you don't enter your username or password. But you can basically enter in a random or fake one. I didn't remove all of the link, because, I'm pretty sure they all have the same topic start number. 654845.
Anyway, you could basically click away, and even sit on the link and nothing will happen but a discouraged person, looking at the hundreds accounts with 'theymos' or 'satoshi' as their username.
Phisher is probably thinking he caught a big one..
. What you got after logging in? Redirecting to BT?~~MZ~~
Yep, redirects right back to the real site under the link that is in the OP.
hero member
Activity: 560
Merit: 509
I prefer Zakir over Muhammed when mentioning me!
Phisher is probably thinking he caught a big one..
. What you got after logging in? Redirecting to BT?~~MZ~~
Phisher is probably thinking he caught a big one...
Just posted this in Alts:
So, can we mega-ban p3tnnaster, please?
And for the URL, just add NOT....u can still see the URL as an example, but its no longer clickable.
Guys/girls/things:
Just had this in my PMs.....
As you can see, the link leads to Bilcointalk.org......very frigging dodgy.
The senders name resembles that of a real NEM member: p3tmaster.
Just had this in my PMs.....
Hi dear, Very important news about NEM Open Alpha.
NOThttp://bilcointalk.org/index.php?topic=654845.msg7515541#msg7515541
the NOT is from me, do not use the above link!NOThttp://bilcointalk.org/index.php?topic=654845.msg7515541#msg7515541
As you can see, the link leads to Bilcointalk.org......very frigging dodgy.
The senders name resembles that of a real NEM member: p3tmaster.
So, can we mega-ban p3tnnaster, please?
And for the URL, just add NOT....u can still see the URL as an example, but its no longer clickable.
Maybe remove the link itself, not the address
What I said.
Maybe remove the link itself, not the address
hero member
Activity: 560
Merit: 509
I prefer Zakir over Muhammed when mentioning me!
OP: remove the hyperlink in the top post.. I was about to click it..
I think it's better not to. So other can know the link and how it looks. Clicking the link is okay, entering username and password is dangerous.
~~MZ~~
OP: remove the hyperlink in the top post.. I was about to click it..
Thanks for this! Remember to always check the URL, and if you have never seen the message before, its probably a phishing scam.
I'm a hundred percent sure this is a new phishing link going around. I just got it a few seconds ago, and, I'll just drop it here so that people will be warned.
As you can see, Bitcointalk is clearly spelled wrong. And, I've never ran into this guy before.
Hi bro! I have bad news for you! You can see about in there
http://bilcointalk.org/index.php?topic=654845.msg7515541#msg751554
http://bilcointalk.org/index.php?topic=654845.msg7515541#msg751554
As you can see, Bitcointalk is clearly spelled wrong. And, I've never ran into this guy before.
They can hide it behind bitcointalk too. so always look at the bottom of the screen before clicking on any link.
Jump to: