I got one of these yesterday. The domain was thel4ntern-login[.]com — noticed the "4" instead of "a" immediately. Almost clicked it too because the message said my account would be "suspended within 24 hours" if I did not verify. Glad I double-checked the URL first.

I think I fell for this. I clicked the link and entered my username and password. I did not notice anything wrong until I was redirected to a generic page. What should I do now? I already changed my password but I am panicking a bit.

u/new_crypto_buyer — do not panic, you did the right thing by changing your password immediately. Please also enable 2FA if you have not done so already. If you had any marketplace payment tokens saved in your account, remove and regenerate them. We are monitoring for any unauthorized access on compromised accounts.

Tip for everyone: if you use a password manager, it will not autofill credentials on a domain that does not match the one saved in your vault. This is one of the easiest ways to spot phishing pages. If your password manager does not offer to fill, that is a huge red flag.

I ran the phishing domains through VirusTotal and they are already flagged by 12+ AV engines. The registrar is Namecheap — they are usually responsive to abuse reports. Has anyone checked if the phishing pages are still live? I can set up a canary cookie to track if they are still harvesting.

Just want to add — the phishing DM I received had perfect grammar and formatting. It did not have the usual spelling mistakes you see in phishing attempts. These attackers are getting more sophisticated. Everyone needs to be extra vigilant about checking URLs, even when the message itself looks legitimate.