{"version":1,"alerts":[{"slug":"fake-roblox-lookalike-domain-vwww-roblox-co","status":"investigating","publicationStatus":"published","publishedAt":"2026-08-22","updatedAt":"2026-08-22","number":4,"headline":"Kids: watch out for game sites using lookalike domains","brand":"Roblox","topics":["impersonation","email-and-account"],"channels":["website","ads","social-media"],"audience":"Children, parents, and people who play Roblox or other online games.","summary":"A website using the address vwww-roblox[.]co uses Roblox's name with an unusual vwww- prefix and a different domain ending. Lookalike game sites can be used to trick players into entering passwords, verification codes, or payment details. Do not sign in through a link sent in a chat, video, ad, or game message.","warningSigns":["The address begins with the unusual vwww- prefix, rather than simply using the official game domain.","The address ends in [.]co instead of the official service's expected domain ending.","A page asks for a game password, verification code, payment details, or a download after you clicked an unexpected link.","The offer promises free Robux, game currency, items, or an account reward in exchange for signing in."],"domains":["vwww-roblox[.]co"],"searchTerms":["vwww-roblox[.]co","fake Roblox website","Roblox lookalike domain","fake game login","gaming phishing"],"actions":["Close the page and do not enter your password or verification code.","Open the official game app or type the official website address yourself instead of using the link.","Ask a parent, guardian, or trusted adult before signing in through an unfamiliar game website.","If you entered a password, change it through the official game service, change it anywhere else you reused it, and turn on multi-factor authentication.","If a child received the link in a game or chat, use the platform's built-in report and block tools."],"limitations":["Scammers can change domains quickly. A familiar game name in a web address does not prove that the page belongs to the game company."],"image":{"path":"/images/alerts/fake-roblox-lookalike-domain-vwww-roblox-co.webp","alt":"WatchOut graphic highlighting the unusual vwww- prefix and [.]co ending in the defanged address vwww-roblox[.]co.","caption":"Look closely at game websites. An extra letter or unfamiliar domain ending can be a warning sign."}},{"slug":"signal-support-impersonation","number":5,"status":"investigating","publicationStatus":"published","publishedAt":"2026-08-22","updatedAt":"2026-08-22","headline":"Fake Signal support messages ask for recovery keys","topics":["impersonation","email-and-account"],"channels":["signal"],"audience":"People who use Signal and receive unexpected account or support messages.","warningSigns":["The message claims that the account is at risk or will be deleted.","It tells you to click Accept or follow unexpected account instructions.","It asks you to provide a recovery key or other secret in the chat.","Signal's in-app review controls show Block and Report options for the contact."],"brand":"Signal","summary":"A message pretending to be Signal support claims that an account is at risk and asks the recipient to click Accept and provide a recovery key. This is a scam warning: never share a recovery key, registration code, verification code, password, or other account secret in response to an unexpected message.","domains":[],"searchTerms":["Signal support impersonation","fake Signal support","Signal verification code scam","Signal account scam"],"actions":["Do not reply to an unexpected message claiming to be Signal support.","Never share a Signal registration code, verification code, password, recovery phrase, or other secret with someone who contacted you unexpectedly.","Open Signal directly and use its official in-app or help resources instead of links in the message.","If you shared a code or account information, secure the account through Signal's official recovery and security guidance."],"limitations":["Scammers may change the wording or use a different account-warning story, but an unexpected request for a recovery key or other account secret is unsafe."],"image":{"path":"/images/alerts/signal-support-impersonation.webp","alt":"Signal chat showing a message claiming an account is at risk and asking for a recovery key, with Block, Report, and Accept buttons visible.","caption":"A message pretending to be Signal support asks for a recovery key. Do not share account secrets in a chat."}},{"slug":"canadian-government-phishing-german-pivot-2026","number":3,"status":"investigating","publicationStatus":"published","publishedAt":"2026-08-07","updatedAt":"2026-08-07","headline":"Phishing campaign impersonating the Canadian government shows signs of preparing German government lures","brand":"Government of Canada / Service Canada; Kraftfahrt-Bundesamt (KBA)","summary":"A CSRF investigation mapped a phishing email impersonating the Government of Canada and Service Canada. The Canadian redirect chain is now offline, but the same GitHub account uploaded a logo belonging to Germany's Federal Motor Transport Authority (KBA) on 2026-08-07. This suggests preparation for a possible German pivot; no live German phishing page has been confirmed. CSRF reported the GitHub account to GitHub.","domains":["redirect-fa486f8e.vercel[.]app","servicescanada-health.my[.]id"],"searchTerms":["fake Government of Canada health-card email","Government of Canada / Service Canada phishing","Kraftfahrt-Bundesamt","KBA","servicescanada-health.my[.]id","redirect-fa486f8e.vercel[.]app"],"topics":["impersonation","email-and-account"],"channels":["email"],"audience":"People in Canada receiving government-branded emails, and organizations in Germany that may see KBA-branded lures.","warningSigns":["An unexpected email claiming to be from the Government of Canada or Service Canada.","Links that pass through redirect pages instead of going to an official government address."],"actions":["Do not click links in unexpected government emails.","Verify government messages by opening a new browser window and typing the official website yourself.","People in Canada can report suspected fraud to the Canadian Anti-Fraud Centre.","Organizations in Germany should watch for unexpected messages using KBA or other German government branding and route suspicious samples to their security or incident-response team.","Preserve the original message, headers, screenshots, and URLs for reporting; do not forward suspicious links to the public."],"limitations":["The Canadian redirect chain mapped in the investigation is no longer active as of 2026-08-07.","No live German phishing page or German victim message has been confirmed.","The KBA logo upload indicates possible preparation but does not prove that a German campaign has launched.","The final Canadian harvesting form was not captured.","The GitHub account and technical clues do not establish the operator's identity, nationality, or physical location.","The campaign may use different domains or infrastructure not yet linked to this activity."],"observedAt":"2026-08-07","image":null},{"slug":"nike-recruitment-facebook-login-impersonation","number":1,"status":"investigating","publicationStatus":"published","publishedAt":"2026-08-04","updatedAt":"2026-08-04","headline":"Suspected Nike recruitment impersonation site presents a Facebook-style login","brand":"Nike","summary":"A reported recruitment-themed website at nikerecruits[.]com appears to use Nike branding and presents a Facebook-style sign-in page. The combination may be intended to trick visitors into entering account credentials. This is an initial warning based on the reported page appearance and requires review before publication.","domains":["hxxps://nikerecruits[.]com/"],"searchTerms":["Nike","nikerecruits[.]com","Nike recruitment impersonation","Facebook login impersonation","fake recruitment site"],"topics":["job-and-task","impersonation","email-and-account"],"channels":["website"],"audience":"People looking for jobs online who come across Nike-branded recruitment pages.","warningSigns":["A recruitment-themed site uses Nike branding but is not on Nike's official website.","The site presents a Facebook-style sign-in page asking for account credentials."],"actions":["Do not enter Facebook, Nike, email, or other account credentials on the site.","Verify job opportunities through Nike's official careers channels reached independently, not through a message or link.","If you entered a password, change it immediately through the official service, change it anywhere else you reused it, sign out other sessions, and enable multi-factor authentication.","If you entered personal or payment information, monitor the affected accounts and use the service's official fraud or account-recovery process."],"limitations":["This is an initial report about the site's appearance; the page, credential collection, operator, and relationship to Nike or Facebook require independent verification.","The presence of Nike or Facebook branding does not establish that either company operates or endorses the site.","Do not treat this alert as proof of a specific victim count, malware, or confirmed data theft."],"image":null},{"slug":"zillow-impersonation-task-scam","number":2,"status":"investigating","publicationStatus":"published","headline":"Suspected Zillow impersonation and task-scam site: zillowofficial[.]com","brand":"Zillow","summary":"A reported website uses Zillow branding while presenting an agent or in-house tester program. Its FAQ describes daily order sets, negative balances on premium tasks, and topping up an account before work can continue. A separate domain is reported as the support destination. These are strong warning signs associated with task scams and impersonation, but this alert does not establish who operates the sites or whether Zillow was involved.","domains":["hxxps://zillowofficial[.]com/","hxxps://sxzkghtby[.]cyou/"],"searchTerms":["Zillow","zillowofficial[.]com","sxzkghtby[.]cyou","Zillow impersonation","task scam","negative balance premium task","order completion top-up"],"topics":["job-and-task","impersonation"],"channels":["website"],"audience":"People offered agent, tester, or task-based work using Zillow branding.","warningSigns":["Daily order sets or tasks where premium tasks put your account into a negative balance.","Being asked to top up an account before you can keep working or withdraw money.","Zillow branding on a website that is not Zillow's official address."],"actions":["Do not sign in, send money, or top up an account to complete tasks or unlock a withdrawal.","Do not use the reported support link or reply to the people who sent it.","Verify Zillow through its known app or a web address you enter yourself, not through a link in a message or job offer.","If you already sent money or account details, contact your bank or payment provider using its official contact method and secure the affected accounts."],"publishedAt":"2026-08-04","updatedAt":"2026-08-04","limitations":["This draft is based on the supplied page text and reported support address; CRF did not open or interact with the suspicious sites.","The page text does not establish who operates either domain, whether Zillow authorized the program, or whether any person lost money.","A shared brand name, page design, or support link is a lead about possible impersonation, not proof of attribution."],"image":null}]}