I just received a message from a new account with no posts, Administrator_Jason, offering a free iPad.
The message contains a link that looks like it is from Sonos.com but it is to presentnow.com. This has all the red flags of a scam.
Just a warning to be careful about what you click on, even here.
Mark
Hi All,
We’ve started banning these accounts and have taken steps to prevent more of this type from being created. While we’re looking into longer term solutions, we’ve currently enabled account registration approval by the moderation team on the forum.
Thank you for the reports on this and for your patience.
Edit:
I’ve merged a few threads into this one as they were made before we started banning the spam accounts.
Edit 2:
The accounts involved in sending out messages are all banned and, after making some adjustments on our end, you shouldn’t see any new messages regarding the spam link in this thread.
Not sure any Sonos folks are working the weekend shift here.
If you click on the three dots in the lower right corner of a post, there is a “Report” link.
I don’t see those dots for private messages, just public posts.
Agreed, those three dots don’t appear on the PMs, only on forum (public) posts.
Anyone actually clicked the link? I clicked it and redirected me to that Present Now and then I stopped did not interact or enter anything. I closed my browser, deleted all time history etc - on Chrome Mobile on Android Samsung. I ran 4 AV scans and it's come back ok and looked at my downloads and does not seem to have anything recent. Any further risk here does anyone know?
The accounts have got smarter because no longer using Administrator prefix, just the profile image uses Administrator image.
I was unaware you could embed links in PMs…but then I’d never tried.
I just received a message from a new account with no posts, Administrator_Jason, offering a free iPad.
The message contains a link that looks like it is from Sonos.com but it is to presentnow.com. This has all the red flags of a scam.
Just a warning to be careful about what you click on, even here.
Mark
I received a similar message. 99.9% sure its a scam.
I’ve received a similar phishing message from "CozyMomentsZ” - so they are definitely not limiting themselves to an administrator prefix.
In my humble opinion, Sonos should:
Rate-limit PMs per account in general: caps per minute/hour/day, tighter limits for new or low-reputation accounts.
Detect duplicate/near-duplicate message bodies sent to many recipients (fuzzy hashing, shingling) and block fan-out.
Implement a feature that shows the recipient exactly what url they will be redirected to. The messages claims to refer users to a sonos website but, evidently, the actual url of the link points to a different domain.
Implement a Report feature for private messages and moderators that go with it.
This issue was reported to LostSight (the software that Sonos uses for Community) in 2018:
https://communities.gainsight.com/customer-communities-cc-17/private-messages-spam-18588
Don’t hold your breath!
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
