http://i.cubeupload.com/d1Dr28.png You must be particularly careful because a new pernicious phishing attempt is currently spreading on Steemit! # Never give your password on suspect or unknown websites!! I already warned you about several scam attempts (see bottom of this post for a list of them). Here is a new one. ### Scam Description The scammer will send you a comment like this: ![](https://cdn.steemitimages.com/DQmXe7oHXfugWUHrEj6G4umPz9aCnGePUbs4uNW9fB9AMJG/image.png) _{_NOTE: the author or the content of the comment may be different from the above screenshot_} If you look closely at this comment in detail, you will notice that it is actually composed of texts and images that serve to mislead the user: ![](https://cdn.steemitimages.com/DQmX5gsHWQZFBihUeF6itWpLWctyTeVvSYppsBbMAYeiYHX/image.png) How does the scammer wants to trick you? 1. He uses a fake “upvote/reply” image to simulate the end of his comment. 2. He uses an image containing a well known user name with a high reputation, in our example it is @exyle. Did you noticed there is no avatar in front of @exyle's name? 3. He adds his phishing comment with the poisoned links. You may think this is a comment from @exyle. 2. He adds a fake “upvote” arrow and “reply” link, embedded in an image with an underlying link to the phishing website. 3. He adds a a bunch of blank lines at the end of his crafted comment to hide the real Steemit’s “upvote/reply” ![](https://cdn.steemitimages.com/DQmTKWcgkqvEoHnQH7PxxvLX2n43exqBuDnUBPDjXFYVjDN/image.png) If you click on the link in the comment (the one that contains your supposedly copied post) or if you want to “upvote” or “reply” to “@exyle’s comment”, you will be redirected to a fake Steemit website: ![](https://cdn.steemitimages.com/DQmRJVNrStzpf9AGegNoVkH2VZFSLKNt88Q3RwTWhEHaQFi/image.png) _{_NOTE: the domain name displayed may be different from the above screenshot_} After a while, the page will fade out and a popup will appear, asking for your credentials: http://u.cubeupload.com/arcange/EoKt1Q.png _{_NOTE: the domain name displayed may be different from the above screenshot_} If you enter your credentials (DO NOT DO IT), you will be redirected to the the real steemit.com website. The goal of the creator of this website is to steal your credentials to hack your account and funds! ### Preventive action activated I will add any account sending phishing links to the black list of my Warning-Bot and it will issue warnings with a link to this post, notifying users of the malicious activity of those accounts. If you find similar phishing attempts, contact me on [steem.chat](https://steem.chat/direct/arcange) To protect yourself, you can: * always double check before clicking on a link, especially if this links take you away from steemit.com. * verify the reputation of people writing comments on your posts. A user with a low reputation should trigger you attention. ### Previous threat alerts If you missed them, please find here the previous alerts I published: * [Scam alert and white hat counter-strike](https://steemit.com/steemit/@arcange/scam-alert-and-white-hat-counter-strike) * [Phishing exploit has been stopped - Scammers thwarted!](https://steemit.com/steemit/@arcange/phishing-exploit-has-been-stopped-scammers-thwarted) * [Potential scammer reported- @jones420](https://steemit.com/steemit/@arcange/potential-scammer-reported) * [Fake Steemit website try to steal your password!](https://steemit.com/steemit/@arcange/scam-alert-fake-steemit-website-try-to-steal-your-password) * [Phishing attack to steal your active key](https://steemit.com/steemit/@arcange/scam-alert-steemitsecurity) * [Potential scammer reported - @minnowpond](https://steemit.com/steemit/@arcange/potential-scammer-reported-minnowpond) * [Scammer reported - @russiann](https://steemit.com/steemit/@arcange/potential-scammer-reported-russiann) * [Scammer reported - @steemitrobot](https://steemit.com/steemit/@arcange/scammer-reported-steemitrobot) * [Scammer reported - @tripadvisor.com](https://steemit.com/steemit/@arcange/scammer-reported-tripadvisor-com) * [Scammer reported - @harquick](https://steemit.com/steemit/@arcange/scammer-reported-tripadvisor-com) * [Scammer reported - @gtg.witnesses](https://steemit.com/steemit/@arcange/scammer-reported-gtg-witnesses) * [Phishing site reported - sleemit(dot)com](https://steemit.com/steemit/@arcange/phishing-site-reported-sleemit-com) * [Phishing site reported - www.steemitfollowup(dot)ml](https://steemit.com/steemit/@arcange/phishing-site-reported-www-steemitfollowup-ml) * [Phishing site reported - www.steemitfollowup(dot)cf](https://steemit.com/steemit/@arcange/phishing-site-reported-www-steemitfollowup-dot-cf) * [Phishing site reported - www.autosteemer(dot)com](https://steemit.com/steemit/@arcange/phishing-site-reported-autosteemer-dot-com) * [Phishing site reported - www.autosteemer(dot)club](https://steemit.com/steemit/@arcange/phishing-site-reported-autosteemer-dot-club) * [Phishing site reported - upperwhale](https://steemit.com/steemit/@arcange/phishing-site-reported-upperwhale) * [Phishing site reported - steamit(dot)ga](https://steemit.com/steemit/@arcange/phishing-site-reported-steamit-dot-ga) * [Phishing site reported - steenit(dot)cf](https://steemit.com/steemit/@arcange/phishing-site-reported-steenit-dot-cf) * [Phishing site reported - steemautobot(dot)ml](https://steemit.com/steemit/@arcange/phishing-site-reported-steemautobot-dot-ml) * [Phishing site reported - autosteem(dot)info](https://steemit.com/steemit/@arcange/phishing-site-reported-autosteem-dot-info) * [Phishing site reported - steemij(dot)tk](https://steemit.com/steemit/@arcange/phishing-site-reported-steemij-dot-tk) * [Phishing site reported - steemitservices(dot)ml](https://steemit.com/steemit/@arcange/phishing-site-reported-steemitservices-dot-ml) * [Phishing site reported - uppervotes(dot)ml](https://steemit.com/steemit/@arcange/phishing-site-reported-uppervotes-dot-ml) * [Phishing site reported - steemupgot(dot)ga](https://steemit.com/steemit/@arcange/phishing-site-reported-steemupgot-dot-ga) * [Virus infection threat reported - searchingmagnified(dot)com](https://steemit.com/steemit/@arcange/virus-infection-threat-reported-searchingmagnified-dot-com) * [Phishing site reported - steemrobot(dot)ga](https://steemit.com/steemit/@arcange/phishing-site-reported-steemrobot-dot-ga) * [Phishing site reported - postupper(dot)ml](https://steemit.com/steemit/@arcange/phishing-site-reported-postupper-dot-ml) * [Phishing site reported - steembot](https://steemit.com/steemit/@arcange/phishing-site-reported-steembot) * [Phishing site reported - steemone](https://steemit.com/steemit/@arcange/phishing-site-reported-steemone) * [Phishing reported - Scammers use account's profile](https://steemit.com/steemit/@arcange/phishing-reported-scammers-use-account-s-profile) * [Phishing site reported - steemitfoto](https://steemit.com/steemit/@arcange/phishing-site-reported-steemitfoto) * [Scammers must really hate me a lot to create a dedicated scam link](https://steemit.com/steemit/@arcange/scammers-must-really-hate-me-a-lot-to-create-a-dedicated-scam-link) * [Phishing site reported - pixz](https://steemit.com/steemit/@arcange/phishing-site-reported-pixz) * [Anti-phishing war - The crooks continue their bashing campaign](https://steemit.com/steemit/@arcange/anti-phishing-war-the-crooks-continue-their-bashing-campaign) * [Phishing site reported - SteemitProtection](https://steemit.com/steemit/@arcange/phishing-site-reported-steemitprotection) * [Phishing site reported - myaprotection](https://steemit.com/steemit/@arcange/phishing-site-reported-myaprotection) * [Phishing site reported - TPM Rotator](https://steemit.com/steemit/@arcange/phishing-site-reported-tpm-rotator) * [Phishing site reported - SteemPix](https://steemit.com/steemit/@arcange/phishing-site-reported-steempix) * [Phishing site reported - minnowboosternetwhitelistinvite](https://steemit.com/steemit/@arcange/phishing-site-reported-minnowboosternetwhitelistinvite) * [Phishing site reported - steemituper](https://steemit.com/steemit/@arcange/phishing-site-reported-steemituper) * [Phishing site reported - steemiv](https://steemit.com/steemit/@arcange/7qq68f-phishing-site-reported-steemiv) * [Phishing site reported - Post copied without your permission](https://steemit.com/steemit/@arcange/phishing-reported-post-copied-without-your-permission) * [Phishing site reported - Black Steem](https://steemit.com/steemit/@arcange/phishing-site-reported-black-steem) * [Phishing site reported - Steembottracker(dot)trade](https://steemit.com/steemit/@arcange/phishing-site-reported-steembottracker-dot-trade) * [Scammer reported - @still-observer](https://steemit.com/steemit/@arcange/potential-scammer-reported-still-observer) ### reminder A bit of paranoia is the basis of security. There are a few simple rules to follow in order to avoid having your account hacked: **Rule 1:** NEVER, I repeat, NEVER use or give your **owner key** or password! **Rule 2:** Use your **posting key** to **login, post and vote** on **trusted websites** like steemit.com or busy.org. **Rule 3:** NEVER give your **active key** as this key allows to control your funds! Only use your **active key** for special operation like money transfer or account update on **trusted websites** like steemit.com. **Rule 4**: Anywhere else, if you are requested to provide any of the above key: **RUN AWAY!!!** 4 simple rules. It's not much to remember. Follow them scrupulously, and you will only have to laugh at unsuccessful attempts from scammers. Spread the words, **resteem this post to your friends**, and you will make the platform safer. Thanks for reading! --- If you notice any new suspect activity like the one described above, drop a comment on this post or contact me on [steem.chat](https://steem.chat/direct/arcange) --- [![](http://i.cubeupload.com/QJk1c8.png)](http://steemitboard.com/@arcange) _{_footer created with **[steemitboard](steemitboard.com)** - click any award to see my board of honor_} ### Support me and my work to protect the Steemit platform. ### [Vote for my witness ](https://steemit.com/~witnesses)