Stop Phishing Links being posted in Group Chat
tracked
Abysinnia Resident
Lately a lot of SL groups have been getting hit by spammers posting phishing links that look like real Marketplace stores. Here’s an example of the kind of thing going around:
[12:16:37] Rẙaḽīể (ryalie): New store!
Outfit + Shape, Everything is free, limited quantity https://marketplacsecondlife-style-body-mesh-catwa-185089.store
It’s clearly meant to trick people, and residents are falling for it because it looks close-ish to a legit SL URL. People are losing their Lindens because their accounts become compromised, thinking they’re logging into a trusted site. The scammers then use those compromised accounts to spam other groups (sometimes even pay-to-join ones), which just keeps the cycle going and leads to more stolen Lindens and MORE hacked accounts.
My suggestion is to remove clickable URLs in group chat and IMs unless they’re from trusted sites. Maybe have a whitelist for known, safe domains like:
Or other KNOWN and trusted sites. Everything else could just show up as plain text or with a warning before opening. Other possible options could include: color-coding links (safe ones in green, unverified ones in grey or red), adding a short delay before opening non-trusted URLs (“This link will open in 5 seconds”), or even giving users a setting in Preferences to allow clickable links from trusted domains only.
This would stop a lot of the spam and protect people from phishing. It would also cut down the workload for in-world group moderators (who constantly have to boot spammers) and reduce support tickets from compromised accounts; meaning less work for your support team, cost savings for you, and a safer experience for everyone.
Thank you!
Log In
Spidey Linden
Merged in a post:
Block EVERYTHING from "herokuapp[dot]com"
Dana Enyo
I know that deciding a single domain is off-limits to all IM and Group Chat may be opening a can of worms, but THOUSANDS of phishing messages have been/are being sent with bogus addresses (like "markettplace-secondlif-etcetc...", and they ALL come from this herokuapp[dot]com domain. A server provider is actually supposed to respond when known crimes are being committed using their services. I've already reported it, but I'm just a person (and a fictional one, for that matter). Seems to me a call from Linden Research Inc. might have a better chance of having an impact?
Because what they're doing really is criminal.
AmyLynnLaville Resident
LL should just make 2FA mandatory and or mandatory with an opt out (use at your own risk LL wont be responsible for Lost/Stolen accounts). But to not use it with all the phishing nowadays is just not wise.
Tapple Gao
My product, Teeglepet, would be affected by such a ban
pehf Resident
None of us know what's going on behind the scenes and I'd certainly hope LL is talking to Heroku App about this, but if progress isn't made and they make no serious attempt to reduce fraud, an outright block is going to be necessary. Sure, some scammers will find workarounds, but the more hurdles you place in front of the scammers, the fewer will try.
It's worth pointing out that registering domains and getting webhosting is rarely something that can be done completely anonymously. So the workarounds being proposed by some here are infeasable in practice. At least, by anyone who plans to stay out of prison.
EDIT: I've seen a few people say their own products would be affected, but do those products actually have URLs seen in IMs/Group IMs? Because I think the proposal is about blocking IMs and Group IMs only. And if it's promotional URLs, you can always use a tool like tinyurl.com to obscuficate it (there'd be no harm and it'd be within the spirit of the ban, because the ban relates to the fact it's easy to create fake marketplace-looking URLs with Heroku, which tinyurl.com wouldn't do.)
Shadow Siamendes
I wouldn't agree with that and even say it could cause bad side-effects. That platform is also used to host legit apps, some that might even be used for SL stuff. Banning that service entirely would just cause scammers to migrate to another platform (there are plenty others out there even free ones) and it would be just a cat-mouse-game thing.
Giving more awareness about the dangers is usually the way to go but surely it's a hard task. Regardless how many warnings and such a platform might put in place, some people would still fall for it for n reasons (like not caring or just not reading stuff).
At least a thing that might help, similar to what other platforms have done and I have seen suggested here, is to give a warning when clicking such links like "This link is not an official one, make sure it's trustable..." etc etc.
Phil Metalhead
Shadow Siamendes I agree; there are very likely legitimate scripts/products out there that use Heroku as a backend that would be broken by such a blanket ban.
Conversely, scammers could easily spend a couple of bucks to register something like "makretplace-secondlife-com․xyz" to frontend their Heroku app (seriously, you can register a .xyz domain for like $3) to bypass this ban, and chances are they'll make that back in the first half hour of running their scam.
A better (albeit somewhat tedious) solution would be to have all non-SL chat links (and possibly even dialog links) open up a mid-screen popup: "The link you clicked is NOT an official Second Life or Marketplace link. Do you wish to continue? [Visit link] [Cancel]"—of course proper SL/Marketplace links would bypass this. The effect would be that legitimate Marketplace ads/links would take users directly to the intended destination, and scam links would inherently get gatewayed. They could even add a third button, [Allow example․com] so for stuff you visit frequently (for example, kittycats.ws for us KittyCatS folks) it disables the dialog. In fact, I think I'm going to make this suggestion.
Dana Enyo
Phil Metalhead I would be fine with that. But at the same time, there really should be some legal action taken against these people. The company hosting the domain is blameless UNLESS they're informed of the problem, and if they are informed and allow it to continue, they're committing a crime. We use words like "scam" and "phishing," but it's really much more serious.
Beatrice Voxel
The hosting company needs to be held to account if they're ignoring reports of fraud using their services. The fact that they have 'legit' customers means they also have something to lose if they don't cooperate.
Shadow Siamendes
well, they have a way to report abuses though, more details at https://www.heroku.com/contact/
Shadow Siamendes
Phil Metalhead and yep, that's pretty much the type of thing I suggested. Platforms like Steam, Twitch, Discord among plenty others have such mechanisms.
Phil Metalhead
Beatrice Voxel they're not "ignoring" reports of fraud; their platform is self-service. I've found them to actually be quite responsive to reports, but the way the scammers work is they spin up their scam site and gather/export whatever they can before they get shut down, then spin up another one. It's basically digital whack-a-mole (with apologies to the Moles).
Beatrice Voxel
Phil Metalhead In that case, the host needs to do a bit more verification before spinning up a site. Such as "has this payment method/account been reported for fraud before?" or "How many accounts has this payment method hosted in the last X months?" A valid site will have low metrics for those things - the payment method may be for multiple sites, but they're stable. A fraudster will be a storm of yo-yos.
And yes, this is the sort of pattern recognition that most AI services are good at finding.
Phil Metalhead
Beatrice Voxel they likely use stolen payment methods or prepaid cards or the like. They try a given method, if it fails they hop VPN and try the next one until they get a successful signup. There's not really any way of proactively preventing it, certainly not while remaining competitive with other services (Google, for example, offers a similar service, and yes I regularly see it used for fraud/phishing sites too).
The alternative suggestion I and others have made is to insert warning dialogs when clicking links. It doesn't depend on a third-party provider to do anything, and most importantly, it doesn't involve blanket-banning a provider that legitimate products also use.
Lucia TopHat
Seems like an easy way to get rid of so much of the scamming.
AlettaMondragon Resident
I wouldn't be surprised if LL hadn't taken the necessary steps to deal with this issue outside of SL, seeing how they don't take the necessary steps to protect SL and its users inworld. Blocking server providers that host scammers willingly would be one of these steps. Continued work on MFA to add safeguards, backups and make it more consistent but less redundant across SL's many web platforms would be other important steps.
And if all that still wouldn't be enough, they should consider not giving back stolen accounts to people, at least not so easily, along with their money, so they would learn to examine links and websites before they enter their login credentials. Some people fall victim to these things
repeatedly
, which is astonishingly puzzling when you think about how ridiculously stupid the scam ads are. I wouldn't be interested in any of that gibberish even if it were real, but they rush to click on those.Jessica Hultcrantz
and 99% of those links end with ?source=chatgpt
SL Feedback
Merged in a post:
Un-Trusted Links Symbol
Zada Bury
The Phishing / Scam Pest goes still around (average) in Group-chats ... since years.
I found at least 2 Feedbacks with good technical suggestions (filtering mainly), I know a 3rd with "teasing" the users with more groups for activating the MFA ... but in the last 2 weeks, I still AR'd 20 incidents.
So if there is no willing, to simple add a keyword-blocker in the group-chat system and "silent" let messages with text-passages as like "h...uapp" (yes, we all know it!) drop and send them to the Trust&Safety-Team, so them can nuke the account ... (or investigate, from where the connection comes and where the money goes and so on) ...
... change at least the logic behind the "Trusted Links"-Symbol. Show "Untrusted Links" with a FAT warning.
Also: Nobody will recognize a missing "trusted Link" symbol.
I would have more suggestion to write about, but I am much to bored about this topic after ... YEARS (I think, first report abut these kind I have stored is from 2022, older stuff is from 2016).
WeFlossDaily Resident
Getting ride of hyperlinks altogether in chat would also be fine, although the scammer could still post the text, so . . . ya, would actually solve nothing.
Load More
→