#phishing warning

so, i was going through my notifications 10 minutes ago. and i came across this notification amongst a few others:

it already looks suspicious. tumblr doesn't usually inform people of security breaches by tagging them in public posts.

i opened the notification.

there were 45+ other comments mentioning dozens of people of "suspicious activity", about which they had to take several steps immediately.

and that was the moment i knew this is a phishing aimed to attack devices and harvest credentials.

because take a look at the post of @1255128758912896 blog:

seem off? it is. it baits people into believing that if the so-called "restriction" (that wasn't imposed at all, because this is fake) is false, they will get two weeks of tumblr premium subscription free.

and take a closer look at the "link", which seems so straightforward:

the plain text is linked to an entirely different website, which i copied instead of opening. this:

https: //age - verif.cfd/6W7G3N8U7

i added spaces in between so it doesn't open automatically. .cfd websites are notorious for scam/phishing campaigns.

even opening the link can expose:

IP and device data

browser vulnerabilities

notification spam permissions

fake CAPTCHA malware

auto-downloads

trudging further ahead and clicking things in the website can:

install malware

steal card details

collect emails and passwords

push fake investment schemes

please be careful with such phishing blogs. all reblogs are turned off and comments are deleted of this post so newcomers remain unaware. this is my first time seeing one, but it can look convincing to some.

tagging my some of my mutuals here.

@fedyas-damsel @literatureloverx @nerdyloverparadise @m1rs101 @b1rd-0f-w4r @melancholic-whimsy @lily-of-knossos @barbies-favourite-silhouette @maroontragedy @transchuu1stbeliever @emconan @lemunati @avanunez @liliesareblooming

PLEASE REBLOG TO SPREAD AWARENESS.

found another phisher, but this time they reblog posts and adds their phishing link to them

If you're a Gmail user you might've also received this kind of message saying that "your subscription has closed" or is about to close and if it happens, your device will be prone to cyberattacks (ironic, isn't it) and you need to prolong the subscription by clicking provided link and supposedly paying some money.

It's all not true since using Gmail doesn't come with any payments nor subscriptions. These messages were sent from an address that is supposed to fool you into thinking it was sent by Google. If you look closely you can see that the sender has very long username full of random letters and the email address has nothing to do with Google.

Don't click the link under any circumstances, just report the message for phishing, the option is within those three dots next to the "set as important" and reply buttons.

I found these of messages in my spam folder but they might show up in the main folder/other places.

there have been emails going around, often implying/saying it's from something you'd subscribed to. sometimes you can tell right away it's a scam, but other times they have been getting increasingly sneaky. they also are getting around ALL of my gmail spam filters, and additionally, there is an option to "unsubscribe" built into gmail now, which can lead you to clicking a dangerous link!

do not click "unsubscribe!"

if you get a promotional email from someplace you don't remember subscribing to, or had previously unsubscribed to, look at it carefully. there are some key signs something is wrong:

the email is from a random gmail account. not any official company one, or anything to do with the service/products being advertised

there's a long space between the unsubscribe button and the email contents

the email can be "from" a company you know (such as McAfee Advisor, which also sends emails similar to what these companies do anyways), or something you've never heard of.

below are some photo examples of ones i have personally received!

yours will not show up as spam. it will arrive in your normal inbox.

i have gotten plenty more convincing emails than this one lately, so please please be careful!

finally, here is the gmail unsubscribe button.

Do Not Click This If You Receive A Phishing/Scam Email.

it is tied to whatever link is written by the emailer with "unsubscribe" on it, and will automatically open it for you in your browser. these links do not unsubscribe you to anything, they are just phishing tools.

This is obviously NOT Netflix. I mean, the first part of their URL ALMOST spells out “imposter.” Don’t trust ANYONE who emails you like this.

I’ve never even once subscribed to Netflix (I just wouldn’t have the time, even if there weren’t so many other streaming services from which to choose).

I contacted Netflix and they verified that it was a phishing email, and not to click on anything (which I didn’t do -- I just forwarded it to them -- they told me to forward the email to [email protected] though I did find it odd that the original email is formatted as such that nothing can be added to the email when it’s forwarded to be reported -- so I forwarded the email and then sent a separate email with an explanation after that’s what their Customer Service Rep on the official site advised me to do since I was unable to explain in the forward, but I imagine they’ll get the gist). But at least those were instructions I actually received on their official site.

Be careful out there. Always  be vigilant about emails you did not expect. Check with the main company to see whether it’s legit and do so by seeking them out yourself, not by clicking a link in an email. (in my case I knew it wasn’t them, since I’ve never done business with this company, not even a free trial, , and they’ve big enough to not send things from random-looking email addresses, so my only goal was to alert them that they may need to warn their members about this).

Being a good Netizen doesn’t mean supporting major corporations; but sometimes it IS letting them know that a thing is happening so they can protect their subscribers from this type of phishing email. Because I guarantee SOME would fall for this.

ANYONE WHO USES STRIPE, LOOK OUT FOR THESE EMAILS! THIS IS A PHISHING EMAIL!

Devon Energy is real, and I don’t know if they actually have anything to do with Stripe, but their real url is devonenergy.com, not with two ‘y’s as above. Not to mention emails from Stripe end in ‘@stripe.com’ and show up as just ‘Stripe’ for the name, not Stripe Verification. 

For those that don’t know phising is the practice of fraudulently obtaining sensitive information such as passwords or in a worst case scenario banking information. This could be accomplished, in a variety of different ways. For instance by redirecting the victim to a fake login page, so that when they type in their login ID and password, the attacker gets their information.For this reason it’s important that you always check the address bar of your login pages to make certain the little lock icon is closed, and that the whole of the url is correct, so that you know you have the legitimate address.

However this particular attack is somewhat more sophisticated, because you do not get redirected to another page, instead it’s only the login iframe that affected. If you put in your email and you get you see this message DO NOT choose “Use the pass word to login” option! This is a fake and you’re liable to get your account stolen.

If for some reason other then an incorrectly typed password you have trouble logging you’ll get a message like the one below. Where you’ll have the usual fields for your email and password and a small caption underneath will read: There was a problem logging in, try again later.

If you click on forget your password you should be taken to a screen that looks like this.

Apparently a lot of artists have been getting fake job offer just like this, so PLEASE be careful!! Common traits I’ve noticed in job offer scams are:

The email address uses a general email server, rather than an actual company’s name (example: when I worked for Sesame Workshop, their email address ended in @sesame.org. Not gmail, yahoo, hotmail, etc)

The email redirects you to a chat service for the ‘interview’

The proceedings generally move way too quickly (normally companies respect your time and schedule a specific date for a job interview)

Even though they’re the ones who reached out to you, they don’t actually know any real information about you (it’s recruitment staff’s job to do their research before sending out any job offers)

They ‘found you through your ArtStation.’ Idk why but this shows up a lot. I haven’t updated my artstation in years, and yet I have all these people saying they found me through my profile there. 

The salary is....... incredibly unreasonable for someone with only 1-2 years of job experience. For context, my acquaintance works as a software tester. He makes $78,000 a year. This job offer was offering me $68 an hour, which would come to... around $141,000 a year. That’s insane.