- Joined
- Mar 10, 2013
- Messages
- 1,260
- Reaction score
- 6,722
Hello folks,
Multiple Minecraft communities have been issuing notices to players about a number of active phishing scams. A large number of users have been victimized by phishers, and their online accounts have been compromised because of it. Not just Minecraft accounts either; Mojang accounts (which access all of your MC accounts), Skype accounts, Youtube accounts, Email accounts, and even Paypal accounts have been compromised because of it.
As we've recently stated, phishers are using legitimate-looking links to trick people into visiting them. They have spoofed links to Youtube, Facebook, Mojang, and other communities while contacting people via Skype, TeamSpeak, Youtube, and other platorms. They may claim to be posting a link to a funny video, a report abuse, ban dispute, or a Premium rank giveaway, but the links are fraudulent.
For this reason, we are urging users to use discretion when they are prompted with an unknown link. Do not access any link you do not trust, and report anyone who is attempting to phish you.
What is Phishing? What is a Phisher?
Phishers will use compromised accounts to phish other people as well, regardless of the medium used. Teamspeak, Skype, Youtube, and other similar communication platforms all provide easy contact for phishers to reach out to other potential victims, thus perpetuating their attempts. If your friend suddenly sends you a link out of the blue and encourages you to view it, take heed: your friend's account may be compromised and you may be dealing with a phisher.
Common tactics for phishers:
Checking a Link
If you are unsure if a link is legitimate or not, there are ways to check for its validity.
If a phisher is successful, they will have full access to whatever account information they have been given. Next, they will use this information to lock your access out by changing the account's password so that only they can gain access.
From there, their actions usually depend on what account they have access to. If they have gained your Mojang account information, they will be able to use all of the Minecraft accounts you own; a current black market exists where users can buy stolen MC accounts. If they gain your Skype information, they will attempt to phish everyone in your contacts list. If they have access to your Youtube account, prepare for more phishing and some potentially scandalous videos. If they gain access to your Paypal account, prepare for a series of illegal purchases with your own money. Do note that phishers can gain access to accounts other than the one they phished for if the log-in information is the same across those accounts; the phisher can gain access to your Facebook account using your Mojang account information if the log-in and password information are the same.
A special mention is to be said if they gain access to your email account. Your personal email account usually houses very sensitive information to other sites, including log-in information and reset passwords. Furthermore, because email addresses are also used as identities as well, the phisher can fool others into believing that they are the legitimate owner of your email account. Email accounts are jackpots for phishers, as they will be able to gain access to basically every account you have ever owned.
If You Are a Victim of Phishing, What Can You Do?
The key to reacting to a successful phishing attack is speed. You will be in a race to contain the phisher as quickly as you can.
If you were sent a malicious link, please make the staff aware ASAP so that we can spread the word to others. Provide evidence of the chat and the link being provided, as well as the evidence that the link is malicious. If the user is phishing others on our system, they will be removed immediately.
MCGamer Emails
Regarding emails from MCGamer, emails will always be sent from either @minecraftsurvivalgames.com or @mcgamer.net (for example [email protected]). Most of our emails are in reply to other users' emails to us, but we will occasionally email out to other users first. As such, if you recieve an email from a user claiming to be part of MCGamer, be sure that their email address includes @minecraftsurvivalgames.com or @mcgamer.net.
In the event that you are sent an email claiming to be from MCGamer that is not from one of our official emails, treat it as a malicious email. If the email contains any links, do not click any of them. Bring the email to the staff's attention ASAP, and we will handle the user in question.
Multiple Minecraft communities have been issuing notices to players about a number of active phishing scams. A large number of users have been victimized by phishers, and their online accounts have been compromised because of it. Not just Minecraft accounts either; Mojang accounts (which access all of your MC accounts), Skype accounts, Youtube accounts, Email accounts, and even Paypal accounts have been compromised because of it.
As we've recently stated, phishers are using legitimate-looking links to trick people into visiting them. They have spoofed links to Youtube, Facebook, Mojang, and other communities while contacting people via Skype, TeamSpeak, Youtube, and other platorms. They may claim to be posting a link to a funny video, a report abuse, ban dispute, or a Premium rank giveaway, but the links are fraudulent.
For this reason, we are urging users to use discretion when they are prompted with an unknown link. Do not access any link you do not trust, and report anyone who is attempting to phish you.
What is Phishing? What is a Phisher?
Common Phishing Tactics
Phishers will use compromised accounts to phish other people as well, regardless of the medium used. Teamspeak, Skype, Youtube, and other similar communication platforms all provide easy contact for phishers to reach out to other potential victims, thus perpetuating their attempts. If your friend suddenly sends you a link out of the blue and encourages you to view it, take heed: your friend's account may be compromised and you may be dealing with a phisher.
Common tactics for phishers:
- Change the characters of the URL (www.you1ube.com instead of www.youtube.com),
- Exploit text formatting to fake links (the text will say www.youtube.com, but it will link to another malicious site).
- Post links to log-in sites that look the same as a legitimate site, then logging the information you type in.
- Send you to a download link for a program masquerading as something else. Once the program is downloaded and unpacked, a malware is installed that will collect your sensitive information and send it to the phisher.
Checking a Link
If you are unsure if a link is legitimate or not, there are ways to check for its validity.
- Under no circumstances should you visit the link before checking its validity.
- Highlight the link itself. Right-click on the link, and select, "Copy Link Address"
- Create a new text document, and paste in the copied text.
- Inspect the address for oddities. Look for replaced characters (such as numbers instead of letters, two "r"'s instead of an "m", or an "l" instead of an "I") or suspicious marks.
- If the link is suspicious, do nothing. Block the person and ignore any further attempts.
If a phisher is successful, they will have full access to whatever account information they have been given. Next, they will use this information to lock your access out by changing the account's password so that only they can gain access.
From there, their actions usually depend on what account they have access to. If they have gained your Mojang account information, they will be able to use all of the Minecraft accounts you own; a current black market exists where users can buy stolen MC accounts. If they gain your Skype information, they will attempt to phish everyone in your contacts list. If they have access to your Youtube account, prepare for more phishing and some potentially scandalous videos. If they gain access to your Paypal account, prepare for a series of illegal purchases with your own money. Do note that phishers can gain access to accounts other than the one they phished for if the log-in information is the same across those accounts; the phisher can gain access to your Facebook account using your Mojang account information if the log-in and password information are the same.
A special mention is to be said if they gain access to your email account. Your personal email account usually houses very sensitive information to other sites, including log-in information and reset passwords. Furthermore, because email addresses are also used as identities as well, the phisher can fool others into believing that they are the legitimate owner of your email account. Email accounts are jackpots for phishers, as they will be able to gain access to basically every account you have ever owned.
If You Are a Victim of Phishing, What Can You Do?
The key to reacting to a successful phishing attack is speed. You will be in a race to contain the phisher as quickly as you can.
- You will need to deny the phisher access to any account they may be able to access. If they have gained your log-in information, you will need to change the passwords for any account that can be accessed using that log-in information; for good measure, we suggest changing all of the passwords to your account. Most sites should offer the ability for you to change your password yourself, but sometimes contacting the website's support address is necessary.
- After the phisher's access to other accounts is contained, alert the people whom the phisher may be able to contact. Warning these people that your account has been hijacked will help prevent them from being phished themselves, thus containing the phisher even further.
- Alert the authorities, and get your account back. Websites should offer a support address which will allow you to contact their support team. So long as you are able to verify your identity, you should easily be able to regain access to your compromised account. This usually entails the Support Team changing your previous password and emailing to you, with the suggestion that you change it yourself promptly afterwards.
- Mojang's instructions for regaining access to your Mojang account can be found here: LINK.
If you were sent a malicious link, please make the staff aware ASAP so that we can spread the word to others. Provide evidence of the chat and the link being provided, as well as the evidence that the link is malicious. If the user is phishing others on our system, they will be removed immediately.
MCGamer Emails
Regarding emails from MCGamer, emails will always be sent from either @minecraftsurvivalgames.com or @mcgamer.net (for example [email protected]). Most of our emails are in reply to other users' emails to us, but we will occasionally email out to other users first. As such, if you recieve an email from a user claiming to be part of MCGamer, be sure that their email address includes @minecraftsurvivalgames.com or @mcgamer.net.
In the event that you are sent an email claiming to be from MCGamer that is not from one of our official emails, treat it as a malicious email. If the email contains any links, do not click any of them. Bring the email to the staff's attention ASAP, and we will handle the user in question.
Last edited:
