Possible Phishing Scheme Using In-game Chat

I had a player send a tell to me today, asking me to follow a link to a forum post in order to protest an update. The link at first glance looks like a legitimate FFXIV forum post link, but closer inspection shows that there are some extra bits (-tf.xyz) added on to the .com section which make me suspect that this is a phishing attempt. See attached image for the specifics. I'm used to the normal gold spammers in towns, but this was a new one for me.

Edit: Image doesn't appear to load in the forums, the Imgur link to it is here: https://imgur.com/DmMm3hx

I recieved a private message as well:
"Square Enix Should Not Allow This Update At Such A Sensitive Time, Please Vote Against It Before They Ruin The Game On The FFXIV Forum Post: ****-tf.xyz/ffxiv/****"
From Xoniaan Yerr * Zalera

I too saw that bit as deceptive and checked on the legitimate ffxiv forums (here) to make sure. I won't be going to that link and I advise others to not go to it as well.

Good afternoon and thank you for posting in the Final Fantasy XIV Technical Support Forums.

We apologize for any inconvenience that has occurred when playing Final Fantasy XIV. Unfortunately the issue you are describing is not a technical issue. We will be moving this thread to "General Discussion".

Good luck with your adventures through Eorzea!

This has been a pretty common scam since COVID started. The scammers in question realized they weren't getting as many clicks with their gold selling schemes and decided to try and fake a forum thread instead to get more people to take the bait. Sadly given how many people have come onto the forums complaining about being hacked due to said scam it's working.

People still sadly fall for this, and as a general rule of thumb is to never follow random pm links sent to you in-game. It's always a safe bet that it's a scam. Someone on the reddit found a way to report the domain to the host and permanently suspend it, but it was a process that I don't remember off the top of my head.

I feel like they should just auto-redflag any domain that follows up a ".com" with any manner of additional symbols other then a slash because it's almost always a scam attempting to imitate a legitimate web address.

The website has actually been shut down multiple times at this point, but they simply register a new, nearly identical domain that changes a few of the random letters and numbers around.

this kind of thing that make me unfollow FF14 channel on twitch as none of there parties do anything to prevent it

I suppose the reason I initially posted this in tech support was because I wasn't sure what to do about it. I didn't want to use the RMT reporting function, since the message didn't advertise RMT, and I would have had to click the link to confirm anything. That's a hard nope. The last thing I need is to get hit with a ban or something for abusing the RMT reporting function. But if I just put it in general chat, I'm doubtful that it will generate any kind of official investigation into the account(s) which have been hijacked to send out the shady PMs.

Quote:

---

Originally Posted by Trug

I suppose the reason I initially posted this in tech support was because I wasn't sure what to do about it. I didn't want to use the RMT reporting function, since the message didn't advertise RMT, and I would have had to click the link to confirm anything. That's a hard nope. The last thing I need is to get hit with a ban or something for abusing the RMT reporting function. But if I just put it in general chat, I'm doubtful that it will generate any kind of official investigation into the account(s) which have been hijacked to send out the shady PMs.

---

Use the Report RMT function, as even though you received the message from the last person that received the message and fell for it, it is still the work of RMT scammers/hackers.
The investigation team will be able to figure out it was a victim's account being compromised, but that will also be part of the account owners account recover process.

Quote:

---

Originally Posted by ShariusTC

this kind of thing that make me unfollow FF14 channel on twitch as none of there parties do anything to prevent it

---

Its impossible to prevent. They can't take action against the site creators, they can't force people to not follow the links. All they can do is help people recover their accounts after.


Also, xiv makes nothing off of twitch, so that's really a pointless gesture.

Quote:

---

Originally Posted by Kirika-

Use the Report RMT function, as even though you received the message from the last person that received the message and fell for it, it is still the work of RMT scammers/hackers.
The investigation team will be able to figure out it was a victim's account being compromised, but that will also be part of the account owners account recover process.

---

That makes sense, will do from now on. Thanks!

Quote:

---

Originally Posted by Valkyrie_Lenneth

Its impossible to prevent. They can't take action against the site creators, they can't force people to not follow the links. All they can do is help people recover their accounts after.


Also, xiv makes nothing off of twitch, so that's really a pointless gesture.

---

i dont care if it make anything of twitch, just don't want to deal with all kind of fake live stream on that channel

Yeah, these are getting more and more frequent. I'm getting at least one a day now, so people are definitely falling for it. Might be time for SE to put up a warning in the login message for a while, I think?

edit: I went to the link the first time I got one of these, and it really does look like a legit login screen... if I'd been paying any less attention, I might've fallen for it myself. Instead, I just entered the username Really? and the password nicetrydips**t, and then went and changed my actual password just in case anyway.

Hopefully reporting the domain to Google Safe Searching enough will eventually get them to flag it and any similarly named off-shoots as malicious.

Quote:

---

Originally Posted by ShariusTC

i dont care if it make anything of twitch, just don't want to deal with all kind of fake live stream on that channel

---

...fake live stream?

Quote:

---

Originally Posted by KageTokage

Hopefully reporting the domain to Google Safe Searching enough will eventually get them to flag it and any similarly named off-shoots as malicious.

---

I think that .xyz domain is just a web hosting service. They'd end up flagging thousands of legitimate sites if they did that.


Also I wouldn't namedrop the people you send you tells, and blur their names in screenshots. They're not scammers, they're victims who have had their accounts compromised.