Closed Pre-Alpha Coming! Click Here Now!

This is a very exciting time for the Guild of Guardians community as the Pre-Alpha demo registrations just closed and soon there'll be an email going out to those who were selected to participate.  Anyone who owned a GoG NFT when the last snapshot was taken and who also registered for the Pre-Alpha demo will automatically be included.  Great news right!



Why am I worried then?  The public announcement of a closed pre-alpha means there's an opportunity for scammers to start a campaign to get users to click on what they think will be links to download the pre-alpha, which could actually turn out to be malicious payloads.  A sophisticated adversary may try to craft an executable that looks like a mobile phone app and trick members of the community to install keyloggers or other nasty malware.

You might start to see emails like the title of this blog post enticing you to click so you can be one of the first to preview the app.

When you get the email to join the Pre-Alpha please take a moment to do the following:

  1. Check the Guild of Guardians official discord to see if they've announced invitations have gone out.
  2. Post a message in general asking if anyone else received the invitation.
  3. Check that the email is from team@guildofguardians.com.
  4. Double check that the email is from team@guildofguardians.com.
  5. Look closely at any link in the email and make sure it goes to something that makes sense.
  6. If you are asked to enter any information, like a password or a seedphrase, stop and reach out to the Guild of Guardians team directly on discord.
  7. Get a hash for any executable you download, hopefully that will be provided in the discord, so you can compare the hash of any file you download with the hash the GoG team provides.
Also be extra careful around discord direct messages, or people offering you their pre-alpha spots.  If someone offers to share access to the pre-alpha, walk away.

Once the email goes out I'll provide additional guidance in another post.  This is truly an exciting time for the community, but it's also a prime time for scammers.  Please be careful out there.

If you see anything suspicious you can always reach me @gogscamtracker on Twitter or email report@gogscamtracker.com.

Comments

Post a Comment

Popular posts from this blog

NameSilo Abuse Reporting

Image
On Sunday I sent a message to NameSilo (abuse@namesilo.com) regarding the following token scam websites: guildofguardianes[.]com guildofguardians[.]net guildofguardian[.]net guildofguardians[.]cc It's hard to predict the response for any given domain registrar.  Some are really responsive, but in my experience if you want to get something done quickly you need some kind of pre-existing relationship with the registrar in question.  This is where companies like Phishlabs (https://www.phishlabs.com/) shine with their brand protection services as they automate the process of requesting takedowns for their clients and invest in maintaining strong relationships with registrars. As an independent researcher, my success with getting sites taken down varies. In this case I received an automated response directing me to their "Report Phishing Form" hosted at https://new.namesilo.com/phishing_report. I can only imagine the volume of phishing reports this registrar gets, and there
Read more

More Sites Taken Down

 Last week I received responses from NameSilo confirming they took action on the following domains: zerions[.]info zerions[.]com guildofguardians[.]org guildsofguardians[.]me guildofguardians[.]top I'm very impressed with NameSilo's response time, they've been very cooperative.  If anyone from NameSilo happens to read this article, thank you so much! I still have several domains to work my way through hosted on the same servers.  It's easy to drown in the amount of scams around crypto, so I try to focus on Guild of Guardians related scams, but it's difficult to leave the others hanging.  I'm hoping to get through reporting the rest of the domains soon. A bit of a short update, but it's been a bit of a crazy week last week.  Will write up a more comprehensive update this week. Stay safe out there, and if you see anything suspicious you can always reach me @gogscamtracker on Twitter or email report@gogscamtracker.com.
Read more

Down MetaMask Impersonation Rabbit Hole

Image
It's Friday night.  I should be doing something else.  I have a VR headset literally two feet away from me collecting dust, and what I am I doing?  I'm scouring the internet for more sites that have implemented a specific MetaMask impersonation technique. I created a short video demonstrating the technique, and if you're curious you can check it out here: https://youtu.be/OJu9HlJ2wsc At first it was just a few Guild of Guardians sites that I found and managed to get taken down, but shortly after I decided to leverage dnstwist to find some additional look-a-like domains, and after adding the tld swap option I uncovered even more. I noticed a pattern though, two IP addresses kept coming up in connection with this particular MetaMask impersonation: 5.61.58.93 and  45.136.50.34 If you want to know what all is hosted on a particular server you can leverage tools like VirusTotal.  In some cases you'll come across IP addresses used by shared hosting providers, in other words y
Read more