I wonder how are people falling for this.
Scams like these have been existing for a long time, but someone still falls for those.
Using metamask is smartest thing to do, as you can use myetherwallet for example without exposing your private key ever to their site.

Which domain do they send you to? Reporting that could help to take the site offline, atleast for a while.