My guesses would be phishing (the lookalike .to site, with its high placement in Google results, seems like a perfect way to collect Bitcointalk passwords) and password stealing malware disguised e.g. as altcoin wallets.