Skip to main content
MayberryRFD
Contributor I
Jun 26, 2026 2:32 AM UTC

Beware free iPad messages

I just received a message from a new account with no posts, Administrator_Jason, offering a free iPad. 

The message contains a link that looks like it is from Sonos.com but it is to presentnow.com. This has all the red flags of a scam. 
 

Just a warning to be careful about what you click on, even here. 
 

Mark

    This topic has been closed for further comments. You can use the search bar to find a similar topic, or create a new one by clicking Create Topic at the top of the page.
    Pinned Reply By Jamie A

    Hi All, 

    We’ve started banning these accounts and have taken steps to prevent more of this type from being created. While we’re looking into longer term solutions, we’ve currently enabled account registration approval by the moderation team on the forum.

    Thank you for the reports on this and for your patience.

    Edit: 

    I’ve merged a few threads into this one as they were made before we started banning the spam accounts.

    Edit 2:

    The accounts involved in sending out messages are all banned and, after making some adjustments on our end, you shouldn’t see any new messages regarding the spam link in this thread.

    View in thread

    76 replies

    Show previous replies
    DM3000
    Lyricist I
    Jun 28, 2026 5:46 AM UTC

    I’ve received a similar phishing message from "CozyMomentsZ” - so they are definitely not limiting themselves to an administrator prefix.

    In my humble opinion, Sonos should:

    • Lock new user registrations and private messages until countermeasures are in place.
    • Immediately do a sweep of all of these messages that were already sent, removing them, banning accounts, and alerting recipients. A lot of users are at risk of still falling for this scam.
    • Implement a feature that limits the ability to message other users from new accounts.

    • Rate-limit PMs per account in general: caps per minute/hour/day, tighter limits for new or low-reputation accounts.

    • Detect duplicate/near-duplicate message bodies sent to many recipients (fuzzy hashing, shingling) and block fan-out.

    • Implement a feature that shows the recipient exactly what url they will be redirected to. The messages claims to refer users to a sonos website but, evidently, the actual url of the link points to a different domain.

    • Implement a Report feature for private messages and moderators that go with it.

    Translate
    Retuer
    Lyricist I
    Jun 28, 2026 6:36 AM UTC

    Another spam account: JoyfulRide

    Translate
    craigski
    Local Superstar
    Jun 28, 2026 6:53 AM UTC

    This issue was reported to LostSight (the software that Sonos uses for Community) in 2018:

    https://communities.gainsight.com/customer-communities-cc-17/private-messages-spam-18588

    https://communities.gainsight.com/customer-communities-cc-17/fighting-with-spammers-endless-topic-22405

    Don’t hold your breath!

     

    Translate
      RocketMonkey
      Lyricist II
      Jun 28, 2026 10:04 AM UTC

      I’ve received a similar phishing message from "CozyMomentsZ” - so they are definitely not limiting themselves to an administrator prefix.

      In my humble opinion, Sonos should:

      • Lock new user registrations and private messages until countermeasures are in place.
      • Immediately do a sweep of all of these messages that were already sent, removing them, banning accounts, and alerting recipients. A lot of users are at risk of still falling for this scam.
      • Implement a feature that limits the ability to message other users from new accounts.

      • Rate-limit PMs per account in general: caps per minute/hour/day, tighter limits for new or low-reputation accounts.

      • Detect duplicate/near-duplicate message bodies sent to many recipients (fuzzy hashing, shingling) and block fan-out.

      • Implement a feature that shows the recipient exactly what url they will be redirected to. The messages claims to refer users to a sonos website but, evidently, the actual url of the link points to a different domain.

      • Implement a Report feature for private messages and moderators that go with it.

      That seems very sensible given how many there are. Id probably also lock any accounts that have been recently created and block the IP addresses used to create the accounts. 

      Translate
      jgatie
      jgatie
      Jun 28, 2026 4:16 PM UTC

      I’ve received a similar phishing message from "CozyMomentsZ” - so they are definitely not limiting themselves to an administrator prefix.

      In my humble opinion, Sonos should:

      • Lock new user registrations and private messages until countermeasures are in place.
      • Immediately do a sweep of all of these messages that were already sent, removing them, banning accounts, and alerting recipients. A lot of users are at risk of still falling for this scam.
      • Implement a feature that limits the ability to message other users from new accounts.

      • Rate-limit PMs per account in general: caps per minute/hour/day, tighter limits for new or low-reputation accounts.

      • Detect duplicate/near-duplicate message bodies sent to many recipients (fuzzy hashing, shingling) and block fan-out.

      • Implement a feature that shows the recipient exactly what url they will be redirected to. The messages claims to refer users to a sonos website but, evidently, the actual url of the link points to a different domain.

      • Implement a Report feature for private messages and moderators that go with it.

       

      You are expecting Gainsight to be able to implement one of these, never mind all of them?  I'll be back later with my reply, I'm pretty sure I broke a rib laughing, and need to get to the ER.

      Seriously, Gainsight hasn't been able to prevent new accounts from posting links on the public forum, never mind the stuff on your (very reasonable) list.  This place is routinely taken over by Spam that can be (and is) easily prevented/moderated on forum software maintained and moderated by amateurs, never mind the official support site for a billion dollar company.  

      Translate
        buzz
        buzz
        Grand Maestro
        Jun 28, 2026 5:14 PM UTC

        The active moderators are SONOS employees mostly working UK business hours. I believe there may be an active EU moderator. Once a scammer figures out the schedule, they pretty much have free reign. 

        Translate
          Stanley_4
          Stanley_4
          Grand Maestro
          Jun 28, 2026 5:45 PM UTC

          Makes spamming Sonos a nice weekend side gig to your Monday to Friday job.

          The default display option to hide the true link destination behind user selected text is also a great aid to the spammers.

          Click-n-learn.com (a harmless destination but it doesn't have to be)

          Translate
            Brewtle
            Lyricist I
            Jun 28, 2026 5:46 PM UTC

            https://en.community.sonos.com/members/administrator-xavian-8248869

            Translate
              Steve1098482
              Trending Lyricist I
              Jun 29, 2026 12:52 AM UTC

              I got one form Аdministrаtоr-Axton going to present-now.club

              and their “Address” is IT Building No.3, NESCO IT Park, NESCO Complex, Western Express Highway, Goregaon (East), Mumbai 400 063

              According to goddaddy

              Sonos shooud do more to protect their community

              I received my email from Sonos’s own outbound email system.

              Just so poor from Sonos.

              Translate
                Airgetlam
                Airgetlam
                Jun 29, 2026 3:54 AM UTC

                You’d receive an email from Sonos on any PM on the forum, unless you go in and turn that off. 

                Translate
                Bruce
                Show more replies
                Terms & ConditionsAccessibility statement