Beware: new phishing attempts

[Rehayem]

I thought of making this post because scammers and hackers are trying now a different way to steal your account with the typical giveaway or raffle of sorts.

All names will be blacked out in accordance with Terms of Service. This is for educational purposes only.

First and foremost, they will send you a tell, however this time it will be linked to somewhere else, now a safe website we know: in my case, it was official Twitch website.

While looking at this, you might be compelled to agree this looks legit.


Looking further into their "About" page, it shows an actual forum link.

Before you even attempt to click this, this is an obfuscated link to make it look legit. The moment you hover over the link, you will see the real one. Going to the actual forum link leads to nowhere.


Analyzing it with VirusTotal shows exactly how it behaves, marked by multiple antiviruses as malware. This "website" redirects to a fake forum copy with those strange links that tend to end in .com-h.nl or something similar.

This is not a safe forum website. This is a phishing link meant to steal your account since it also bypasses 2fa


Remember kids, if it looks too good to be true, it probably is. Never click those links. They will use safe websites to lure in people, stuff like Twitch, Youtube, even Carrd websites.

Thanks for coming to my TED talk. Stay safe out there.

[Jeeqbit]

It's an interesting change of tactic, but the victims are usually not active members of this forum.

They are mostly new and casual players that would have never visited the forums before. People who visit the forums regularly normally know all about this already.

It's purposefully aimed at people who think there is something to see on the forums but who have never actually visited them before.

[Rehayem]

It's an interesting change of tactic, but the victims are usually not active members of this forum.

They are mostly new and casual players that would have never visited the forums before. People who visit the forums regularly normally know all about this already.

It's purposefully aimed at people who think there is something to see on the forums but who have never actually visited them before.

That is true, however it doesn't stop having this post eventually end up in the search engine in case anybody is ever confused or unsure. Spreading the word about this new phishing attempt can also help curb potential attempts of theft.

[hydralus]

They put a warning about these phishing attempts every time you log in.

[Rueby]

Honestly...
'if it sounds too good to be true' it very much is.

Thanks for this tho

[FudoMyoo]

I received a link in the FC warning about a phishing scam related to voting for FF14 as GOTY.

Without reading it carefully, I copied the link to my browser and stupidly logged into my SE account as a loyal fan. Five minutes later, my internet went down, and I assumed it was an ISP issue. As I prepared for bed, a friend texted my wife, saying I had logged in and abruptly left the FC. Using mobile tethering, I regained control of my account, but I still lost 100 million gil.

Lesson learnt. lol

[Rehayem]

They put a warning about these phishing attempts every time you log in.

Yes, but the previous tells were linking directly to the fake forums. These new attempts are meant to lure you into a trusted website (like Twitch) to fool unsuspected people who may not be that tech savvy or understand it's all a facade.

[JimCasey_RF6]

You can't fix stupid. Just let fools be fools and have them learn through the school of hard knocks.

[Regis_Paran]

I received a link in the FC warning about a phishing scam related to voting for FF14 as GOTY.

Why would they include an actual fraudulent link in the warning?...

[Kaurhz]

I feel like with this they actually need to revise the information and guidance on Phishing attempts for the main post. Personally, I know to always check where the hyperlink is actually going to, but I do know a lot of people that would fall for that obfuscated hyperlink.

It also feels that the attempt was very much in reaction to the information supplied in the article to be wary of phishing attempts where it discusses the legitimate link for the forums.