Possible Phishing Scheme Using In-game Chat

[Trug]

I had a player send a tell to me today, asking me to follow a link to a forum post in order to protest an update. The link at first glance looks like a legitimate FFXIV forum post link, but closer inspection shows that there are some extra bits (-tf.xyz) added on to the .com section which make me suspect that this is a phishing attempt. See attached image for the specifics. I'm used to the normal gold spammers in towns, but this was a new one for me.

Edit: Image doesn't appear to load in the forums, the Imgur link to it is here: https://imgur.com/DmMm3hx

[Ellie_Acerola]

I recieved a private message as well:
"Square Enix Should Not Allow This Update At Such A Sensitive Time, Please Vote Against It Before They Ruin The Game On The FFXIV Forum Post: ****-tf.xyz/ffxiv/****"
From Xoniaan Yerr * Zalera

I too saw that bit as deceptive and checked on the legitimate ffxiv forums (here) to make sure. I won't be going to that link and I advise others to not go to it as well.

[Rhaervis]

Good afternoon and thank you for posting in the Final Fantasy XIV Technical Support Forums.

We apologize for any inconvenience that has occurred when playing Final Fantasy XIV. Unfortunately the issue you are describing is not a technical issue. We will be moving this thread to "General Discussion".

Good luck with your adventures through Eorzea!

[Enla]

This has been a pretty common scam since COVID started. The scammers in question realized they weren't getting as many clicks with their gold selling schemes and decided to try and fake a forum thread instead to get more people to take the bait. Sadly given how many people have come onto the forums complaining about being hacked due to said scam it's working.

[Cincierta]

People still sadly fall for this, and as a general rule of thumb is to never follow random pm links sent to you in-game. It's always a safe bet that it's a scam. Someone on the reddit found a way to report the domain to the host and permanently suspend it, but it was a process that I don't remember off the top of my head.

[KageTokage]

I feel like they should just auto-redflag any domain that follows up a ".com" with any manner of additional symbols other then a slash because it's almost always a scam attempting to imitate a legitimate web address.

The website has actually been shut down multiple times at this point, but they simply register a new, nearly identical domain that changes a few of the random letters and numbers around.

[ShariusTC]

this kind of thing that make me unfollow FF14 channel on twitch as none of there parties do anything to prevent it

[Valkyrie_Lenneth]

this kind of thing that make me unfollow FF14 channel on twitch as none of there parties do anything to prevent it

Its impossible to prevent. They can't take action against the site creators, they can't force people to not follow the links. All they can do is help people recover their accounts after.


Also, xiv makes nothing off of twitch, so that's really a pointless gesture.

[ShariusTC]

Its impossible to prevent. They can't take action against the site creators, they can't force people to not follow the links. All they can do is help people recover their accounts after.


Also, xiv makes nothing off of twitch, so that's really a pointless gesture.

i dont care if it make anything of twitch, just don't want to deal with all kind of fake live stream on that channel

[Trug]

I suppose the reason I initially posted this in tech support was because I wasn't sure what to do about it. I didn't want to use the RMT reporting function, since the message didn't advertise RMT, and I would have had to click the link to confirm anything. That's a hard nope. The last thing I need is to get hit with a ban or something for abusing the RMT reporting function. But if I just put it in general chat, I'm doubtful that it will generate any kind of official investigation into the account(s) which have been hijacked to send out the shady PMs.