Here is a copy paste from a comment I made before on steem about phishing, but thought it would be handy here too. Btw nice article, I think people need to try educate themselves on this topic if they don't want to fall victim to phishing.
Some of the guys that do phising like do make use of url shorteners to hide the actual link. Or from what I could tell in your post they used steem markup to disguise the actual link. In the case where the use a url shortnerer for example tinyurl then you can actually check what the link redirects to by making use of curl. You can do it like this:
$ curl -I https://tinyurl.com/2fcpre6
See the output. The actual url it redirects to is in the "Location" section in the response.
(Image not shown due to low ratings)(Image not shown due to low ratings)(Image not shown due to low ratings)
Images were hidden due to low ratings.
Good point...However contact the bot owners downvoting you after you removed the .com on the phishing links and change to (dot) com ...see my post how I did it
it happened to me too however I contacted the bot owners and changed to dot as in this post.