Saturday, March 3, 2012

Phishing? No, thanks

Copied from the group notice I've sent to the Builder's Brewery group:


So, what is "phishing"? It is just another way for scammers and other, say... "lazy people" to get your login data and, from that moment, take over your account and use it for their own benefit (usually, monetary, but also impersonating you... or even asking for it to be canceled after it!)

It consists in showing you a link to click (or creatively making it look like an official one - read more below,) very similar to the service you have an account in, usually offering discounts, bargains... and when you click them, they redirect you to a page that can even look the same as the login page (from Second Life, this time.)

So we feel safe, enter our login and password, and bam! We're busted. The scammer now has our login data, and they can very quickly log into the SL website, change our password, change the confirmation e-mail and, of course, log inworld, impersonate us, spend the money, use our credit card if we have associated payment info on file (or spend until the last of our L$ if we don't have this payment info...)

If we copy a link, paste it, and notice that the domain name does not finish in, we can be sure that the website is trying to get our login data.

So, an example: for sure does NOT come from the official SL web: Don't trust it finishes in It comes from the official SL web (note the DOT before! is NOT an official SL web!)

There are other ways for scammers to hide the real Internet address so we click in a link and then input our loging data.
The following page: explains some tips to recognize these attempts of phising.

IMPORTANT - The official link to login into our account via the web is very similar to the following (being the most important how it *begins*):

Notice how the link begins:

Here we can read:

httpsWe're login through the Secure HTTP protocol
id.secondlife.comThe domain name finishes in (again, note the DOT before

Read here about a recent case:
This can happen to any of us. It only takes a moment of tiredness to put our login data in the wrong place.

Please, share this notecard: protect yourself by being informed, and protect others by helping them in being informed.

Information is always our best defense against scams.

Take care all,

-- Auryn Beorn


  1. A good rule of thumb with websites...whether they're for SL or for your personal bank or bills... NEVER just follow a convenient link. Always use your own fingers to type that link in or from your saved bookmarks. It's not very hard for someone to make the text of a link look legitimate, yet the actual link goes someplace else. Phishing has been around for a long time. It's one of the hazards we have to live with both in SL and RL. Be careful. =^.^=

    1. I prefer to type the URLs in fact. They're not that complicated to remember. If it's for the e-mail, then sure "gmail" has to be something like "". If SL, then sure I have to type "" and then click in "log in". But it takes just a moment of tiredness to fall in one, that's why we have to be alert always.

      Btw... It's also a good idea to use different passwords for different services. It wouldn't be the first time that, by knowing your password for a service, a thief tries that same password in other services you may have an account in.