If you got tagged by "Support Bot" on DEV, don't click.
It took one look at the profile:
- The name isn't "Support". It's Cyrillic letters dressed as Latin ones: "Suрроrt Воt".
- The account was created on Nov 4: 0 posts, 41 comments when I looked.
- It tags 10 people per comment, in alphabetical order, ten at a time. Nobody at DEV works through the alphabet by hand.
- The username has already changed: my notification says salemsalem123, the profile now says supportbot123.
No real platform verifies you through a stranger's comment, and none needs your card for it.
Clicked but typed nothing? Close the tab, clear that site's data, check your downloads.
Authorized something or typed a password? Revoke the app and change the password now.
Entered your card? Call your bank.
Then flag the account: profile, then "Flag" or "Mark as Spam".
Check the profile before the link. It takes ten seconds, and it would have stopped this one cold.
Top comments (14)
Thanks for letting everyone know!
Anytime! If more of these pop up, hit Flag on the profile. Way more useful than clicking to see where it goes 😄
yeah we need to share this post and report the scammer
Yes, flagging is what actually gets it taken down. If it tagged you too, report it from the profile, every flag helps.
Thanks for the post. So annoying!
BTW, you can also use my Ghostify browser plugin (beta) to auto hide the future ones. just by setting an auto-Ghostify rule! 🤣
This will only work for posts now (out of the box).
By adding custom selector rules, you can make it work for comments too. I'll soon add the same capabilities for comments by default as well.
Hacktoberfest Open-Source AI Challenge: Ghost in the Machine Submission 👻🌼
From a Simple "Mark as Seen" to Feedgrab & Ghostify: Story of My Life!
Nice idea, and hiding is half of it. The catch here is that this one lands as a mention in your notifications, not in the feed. Would a comment rule catch it before the notification does?
Browser based hiding is in the UI. So, if the notification is on the site, it'll hide it. But if it goes to email, then that will obviously not be hidden.
I myself didn't get the email, only notification here. So that would've been stopped. Also, it runs on client side, so it puts no pressure on the DEV servers.
Fair, in the page it covers it, and client side is the right place for it. If a copy ever goes out by email, that's the gap, since the link then lands outside DEV.
Open it in Brave (new window with tor), then spam it 🤣
Tempting 😄 but I'd skip it. Tor hides who you are, not what the page does to your browser, and someone new reading this might try it for real. Flag it and let it die with zero clicks.
LOL. You're right. I should try it within a VM.
A throwaway VM is the right lab 😄 If you do open it, write up where the link goes. I'd read that post.
I almost fell for it! But as soon as i noticed the only option to verify was with a credit card, i realized pretty quickly
Good catch! Careful though, just opening the link already gives them something: your IP, your browser, and if the link is unique to you, proof that your account is live and clicks. That's how you land on the next, better-crafted list.