Ouch, that sounds pretty dangerous. It's a good thing that they are using Steemconnect at least, so it will be a bit more difficult to fake a phising site if users make sure to see that the Steemconnect URL is real or fake.

Great job with Travelfeed by the way! I was just checking it out earlier today, and I will definitely test it out more when I leave for my next trip somewhere.