Scammers are trying to steal our login credentials

[Stranger]

I've had 2 scam attempts in the last few days, both of which were attempting to steal my login credentials. Here's how it works:

1) Legitimate user posts a watch for sale.
2) A TRF user says they're interested and provide a link to (1) their references on TRF or (2) their collection on TRF for a potential trade.
3) When legitimate user clicks the link, they get to a page made to look exactly like the TRF login page. If you look at the address bar in your browser you will see it is not pointing to rolexforums.com. If you enter your credentials, they will be captured and the scammer will be able to post on your behalf here.

I've had 2 attempts from users Dgercp and brandonmpennington (now banned). The former sent me a link via PM, the second sent me an email.

The email attack is particularly deceptive because it's an HTML document where the link *looks* like a TRF address, but then redirects you to the scam web page.