Beware free iPad messages

Hi, I received one, too. Mine came from Аdministrator_Emmett, who does not appear to be banned.

Not sure any Sonos folks are working the weekend shift here.

If you click on the three dots in the lower right corner of a post, there is a “Report” link.

I don’t see those dots for private messages, just public posts.

Agreed, those three dots don’t appear on the PMs, only on forum (public) posts.

Same here

Anyone actually clicked the link? I clicked it and redirected me to that Present Now and then I stopped did not interact or enter anything. I closed my browser, deleted all time history etc - on Chrome Mobile on Android Samsung. I ran 4 AV scans and it's come back ok and looked at my downloads and does not seem to have anything recent. Any further risk here does anyone know?

The accounts have got smarter because no longer using Administrator prefix, just the profile image uses Administrator image.

I was unaware you could embed links in PMs…but then I’d never tried. 

I received a similar message. 99.9% sure its a scam.

I’ve received a similar phishing message from "CozyMomentsZ” - so they are definitely not limiting themselves to an administrator prefix.

In my humble opinion, Sonos should:

• Lock new user registrations and private messages until countermeasures are in place.
• Immediately do a sweep of all of these messages that were already sent, removing them, banning accounts, and alerting recipients. A lot of users are at risk of still falling for this scam.
• Implement a feature that limits the ability to message other users from new accounts.

• Rate-limit PMs per account in general: caps per minute/hour/day, tighter limits for new or low-reputation accounts.

• Detect duplicate/near-duplicate message bodies sent to many recipients (fuzzy hashing, shingling) and block fan-out.

• Implement a feature that shows the recipient exactly what url they will be redirected to. The messages claims to refer users to a sonos website but, evidently, the actual url of the link points to a different domain.

• Implement a Report feature for private messages and moderators that go with it.

Another spam account: JoyfulRide

This issue was reported to LostSight (the software that Sonos uses for Community) in 2018:

https://communities.gainsight.com/customer-communities-cc-17/private-messages-spam-18588

https://communities.gainsight.com/customer-communities-cc-17/fighting-with-spammers-endless-topic-22405

Don’t hold your breath!

That seems very sensible given how many there are. Id probably also lock any accounts that have been recently created and block the IP addresses used to create the accounts. 

You are expecting Gainsight to be able to implement one of these, never mind all of them?  I'll be back later with my reply, I'm pretty sure I broke a rib laughing, and need to get to the ER.

Seriously, Gainsight hasn't been able to prevent new accounts from posting links on the public forum, never mind the stuff on your (very reasonable) list.  This place is routinely taken over by Spam that can be (and is) easily prevented/moderated on forum software maintained and moderated by amateurs, never mind the official support site for a billion dollar company.  

The active moderators are SONOS employees mostly working UK business hours. I believe there may be an active EU moderator. Once a scammer figures out the schedule, they pretty much have free reign. 

Makes spamming Sonos a nice weekend side gig to your Monday to Friday job.

The default display option to hide the true link destination behind user selected text is also a great aid to the spammers.

Click-n-learn.com (a harmless destination but it doesn't have to be)

https://en.community.sonos.com/members/administrator-xavian-8248869

I got one form Аdministrаtоr-Axton going to present-now.club

and their “Address” is IT Building No.3, NESCO IT Park, NESCO Complex, Western Express Highway, Goregaon (East), Mumbai 400 063

According to goddaddy

Sonos shooud do more to protect their community

I received my email from Sonos’s own outbound email system.

Just so poor from Sonos.

You’d receive an email from Sonos on any PM on the forum, unless you go in and turn that off. 

good to know
so its turned on by default?

and then scammer use the forum to scam

great

It makes sense, from a community perspective, to notify a user that they’ve received a PM. It only becomes an issue when that PM is sent by a scammer.  And, it’s an option, but yes, it’s on by default. 

what do sonos do to actively protect the community from scammers ontheri own forum?

I’ve also received one of these and will report it to ​@Jamie A privately.

Also surprised there is no way to directly report a PM. This is essential for effective running of a forum like this