What does this phishing website compromise? Earlier this day, I have received an email saying that there is a buyer for my localbitcoins advertisement:



However, the https://localbitcoins.com/ads/37726/103702 link shown actually links me to:    


  http://mandrillapp.com/track/click.php?u=30106122&amp;id=8f52703cd0ec4b2b81e069630069dbdc&amp;url=http%3A%2F%2Fllocalbitcoins.com%2Faccounts%2Flogin&amp;url_id=ad428ed9d64304239644387c1388db2f686a98ca


I've accidentally clicked it and it brings me to a phishing website which looks identical to localbitcoins. The phishing website is hosted on http://llocalbitcoins.com (whois record). Notice that there are two "L"s in the domain name.

Wwhat does the hidden link do? Now that I've clicked the link, what can happen to me?

I've changed my password since then. But what else can I do to protect myself?
LocalBitcoins provides two-factor authentication which protects you against all kinds of phishing attacks. Even if the attacker gains access to your password by phishing link or malware (e.g. infected Windows machine), they cannot access your one time codes needed to login and do transactions.

LocalBitcoins recommends you to enable two-factor authentication on your Wallet page (if you have bitcoins) and every time in your user profile navigation bar unless it is enabled.



There are two different methods for two-factor authentication


Mobile app (Google Authenticator) - works on iPhone, Android and other smart phones
Paper codes (you print a set of one time codes)


Both options can be enabled from the link shown in the screenshot above, or from this direct link. For both options, you need to also make sure you have a proper backup as in the case you lose access to your mobile phone with two-factor authentication app you cannot no longer login to LocalBitcoins. 

To receive the email in the question the user probably has published email in an advertisement, LocalBitcoins forums or given it to a malicious trader. LocalBitcoins recommends you do not do communications or trade deals off-site outside LocalBitcoins messaging system.

In the case you have already given your password to a phishing site


Change your LocalBitcoins password immediately
Enable two-factor authentication as instructed above