Thanks.

One more thing I noticed, after I entered fake account information with password FU.K YOUXXX
is that it redirects me to regular Bitvest Plinko Signature Campaign after it takes my 'login details'
https://bt.irlbtc.com/view/5088858.0

Maybe lightlord, creator of this topic, should be contacted regarding this,
just that he is aware of the situation.
They are probably using other random links, with malicious attachments.

One more way to super protect is to install browser extension called NoScript, but it is a bit complex.

I will add that also.
Thanks

I think it is good to use Trust, rather than Flag.  Of if you still want to use Flag, it should be a Newbie Flag, as this Flag created by admin, on @newsilike:
https://bitcointalk.org/index.php?action=trust;u=157669
That guy has not broken any contract with you, and has not yet stolen your money.

Well, I've got this assumption that the hacker thinks he can get as this user is just a Member rank and have little to know about phishing. Not knowing what he tried to mess is a techy guy and even surpass him on the knowledge about those kinds of things.

It might be good to move this one on B&H board as it is more appropriate there. Nice catch OP.

Same reason why he hacked user kingpin4321
and maybe he thinks members like me are stupid brainless sheeps.

Thank you for your 'advice'.


Thanks.
Fake bitcointalk login website is still very much active!
I noticed that time is not changing on fake site June 07, 2019, 10:23:06 PM for now

https://whois.domaintools.com/sebiltv.com.tr

I've supported the flag and tagged it since this account obviously tried to hack the OP. But we don't know if it's a hacked account or a bought account.

But yes I'm a little bit surprised to see that so few people have already done the same. 


https://bitcointalk.org/index.php?action=trust;u=2447711

Someone stated this before:


And I checked his history also.

Firefox expands it to this:
And then obviously can't find the site.

If I try this (the first 5 characters copied from the URL from the PM, then "test" added by me:
Firefox turns it into this:
What kind of sorcery is this?

It reminds me of the homograph attack, which is now automatically replacred on all English boards.

This is the culprit:
Google confirms it's Cyrillic: https://en.wikipedia.org/wiki/Ge_(Cyrillic)

I guess theymos missed this one.