Beware: new phishing attempts

I thought of making this post because scammers and hackers are trying now a different way to steal your account with the typical giveaway or raffle of sorts.

All names will be blacked out in accordance with Terms of Service. This is for educational purposes only.

First and foremost, they will send you a tell, however this time it will be linked to somewhere else, now a safe website we know: in my case, it was official Twitch website.

While looking at this, you might be compelled to agree this looks legit.
https://i.imgur.com/CvbUs9V.png

Looking further into their "About" page, it shows an actual forum link.

Before you even attempt to click this, this is an obfuscated link to make it look legit. The moment you hover over the link, you will see the real one. Going to the actual forum link leads to nowhere.
https://i.imgur.com/KFiKAp2.png

Analyzing it with VirusTotal shows exactly how it behaves, marked by multiple antiviruses as malware. This "website" redirects to a fake forum copy with those strange links that tend to end in .com-h.nl or something similar.

This is not a safe forum website. This is a phishing link meant to steal your account since it also bypasses 2fa
https://i.imgur.com/GmEqTNY.png

Remember kids, if it looks too good to be true, it probably is. Never click those links. They will use safe websites to lure in people, stuff like Twitch, Youtube, even Carrd websites.

Thanks for coming to my TED talk. Stay safe out there.

It's an interesting change of tactic, but the victims are usually not active members of this forum.

They are mostly new and casual players that would have never visited the forums before. People who visit the forums regularly normally know all about this already.

It's purposefully aimed at people who think there is something to see on the forums but who have never actually visited them before.

Quote:

---

Originally Posted by Jeeqbit

It's an interesting change of tactic, but the victims are usually not active members of this forum.

They are mostly new and casual players that would have never visited the forums before. People who visit the forums regularly normally know all about this already.

It's purposefully aimed at people who think there is something to see on the forums but who have never actually visited them before.

---

That is true, however it doesn't stop having this post eventually end up in the search engine in case anybody is ever confused or unsure. Spreading the word about this new phishing attempt can also help curb potential attempts of theft.

They put a warning about these phishing attempts every time you log in.

Honestly...
'if it sounds too good to be true' it very much is.

Thanks for this tho

I received a link in the FC warning about a phishing scam related to voting for FF14 as GOTY.

Without reading it carefully, I copied the link to my browser and stupidly logged into my SE account as a loyal fan. Five minutes later, my internet went down, and I assumed it was an ISP issue. As I prepared for bed, a friend texted my wife, saying I had logged in and abruptly left the FC. Using mobile tethering, I regained control of my account, but I still lost 100 million gil.

Lesson learnt. lol

Quote:

---

Originally Posted by hydralus

They put a warning about these phishing attempts every time you log in.

---

Yes, but the previous tells were linking directly to the fake forums. These new attempts are meant to lure you into a trusted website (like Twitch) to fool unsuspected people who may not be that tech savvy or understand it's all a facade.

You can't fix stupid. Just let fools be fools and have them learn through the school of hard knocks.

Quote:

---

Originally Posted by FudoMyoo

I received a link in the FC warning about a phishing scam related to voting for FF14 as GOTY.

---

Why would they include an actual fraudulent link in the warning?...

I feel like with this they actually need to revise the information and guidance on Phishing attempts for the main post. Personally, I know to always check where the hyperlink is actually going to, but I do know a lot of people that would fall for that obfuscated hyperlink.

It also feels that the attempt was very much in reaction to the information supplied in the article to be wary of phishing attempts where it discusses the legitimate link for the forums.

Quote:

---

Originally Posted by Regis_Paran

Why would they include an actual fraudulent link in the warning?...

---

My guess is to weed out the idiots.

Quote:

---

Originally Posted by WinglessSeraphim

My guess is to weed out the idiots.

---

Ouch ... Pfft I deserved it anyway. Earning back 100million gil is easy anways.

FYI to the OP: using discord to link image to a forum post won't last long. They're no longer visible by the time I wrote this (to inform you).

Quote:

---

Originally Posted by Rehayem

Yes, but the previous tells were linking directly to the fake forums. These new attempts are meant to lure you into a trusted website (like Twitch) to fool unsuspected people who may not be that tech savvy or understand it's all a facade.

---

The in-game warning says, "If you receive a Tell containing a URL to a website from a random player, please check the contents carefully since there is a high possibility that it is a phishing site." Which covers every case. Going even further than that, they link to a lodestone post that gives several examples, including the one OP is talking about. All of the information is there every time you log in if people bother to read.

Quote:

---

Originally Posted by Rein_eon_Osborne

FYI to the OP: using discord to link image to a forum post won't last long. They're no longer visible by the time I wrote this (to inform you).

---

I've updated the images, thanks.

Quote:

---

Originally Posted by hydralus

The in-game warning says, "If you receive a Tell containing a URL to a website from a random player, please check the contents carefully since there is a high possibility that it is a phishing site." Which covers every case. Going even further than that, they link to a lodestone post that gives several examples, including the one OP is talking about. All of the information is there every time you log in if people bother to read.

---

I agree, but they're not using only Twitch. They're using other safe websites, to which I wish SE updated that warning.

not sure which is worse that people still do phishing links or that people are still stupid enough to fall for them

who we kidding its absolutely the latter