It was Hive account@artakan - I'd hold off on the pitchforks just yet, I don't think his intent is malicious. I think he was just showing how it could be done, but yes, it does pay to alway double check URL's.

https://steemit.com/steemit/@artakan/welcome-to-the-first-steemit-com-clone-notice-the-i-instead-of-the-i